How strict are you on what you let students run/install?

[sidewinder]

My NM has asked me to implement a software restriction policy that will only let specified apps run for the students. Not only will this take ages, but Im also likely to miss things since there are so many apps

I do think its a good idea too though.

 

At the minute students can pretty much run anything they want and install most things, thanks to my predecessor setting everyone as local administrators just because one app wouldnt work properly. I have no idea what that app is anymore, but Im fed up of having to deal with the crap the kids install so Im just going to stop them being local admin

 

As this stops most things being installed, is that enough? All Im thinking is that it wont stop them installing apps to their memory sticks or running pointless standalone programs like stress.exe (although i do ban that anyway)

 

Also is there a lot of educational software that doesnt run very well under non-admin? Knowing how poorly some of it is coded

[plexer]

At the minute students can pretty much run anything they want and install most things, thanks to my predecessor setting everyone as local administrators just because one app wouldnt work properly.

 

Nobody thought this was a terrible idea until now?

Absolutely no way would I give students this access or staff for that matter.

 

Ben

[pinemarten]

no way should the users be local admins - that way lies disaster.

 

specified apps policy may take ages to set up, but not as long as sorting out a stuffed up network ....

 

you are right in saying that they can install apps to home folder or pendrives though- the monitoring of the use of such things though is down to supervision (as always) by teaching staff.

 

 

btw,you can 'ban' exe's by name but they will just rename them and run them anyway...

 

supervision,

supervision,

supervision,,

supervision.....

 

need I say more?

[Geoff]

You can use hashes instead of names to ban files.

You can lock down external drive access so they can't run things from those aswell.

 

There's plenty of existing threads on these subjects already. Just use the forum search.

[HodgeHi]

there is a setting in group policy where you can block installs from removable media.

[webman]

Our staff and students can't run executables from their home drives or removable media full-stop. The only places they can run them from is the public-readable share where standalone programs are installed and \Program Files on workstations.

[sidewinder]

At the minute students can pretty much run anything they want and install most things, thanks to my predecessor setting everyone as local administrators just because one app wouldnt work properly.

 

Nobody thought this was a terrible idea until now?

Absolutely no way would I give students this access or staff for that matter.

 

Ben

 

lol, ive always thought it was a terrible idea but the old NM wanted it kept that way, only now can I do something about it

 

and yes I have set hash rules already for a number of apps

 

hodgehi do you know where that setting is?

[GrumbleDook]

At the minute students can pretty much run anything they want and install most things, thanks to my predecessor setting everyone as local administrators just because one app wouldnt work properly.

 

Nobody thought this was a terrible idea until now?

Absolutely no way would I give students this access or staff for that matter.

 

Ben

 

As someone who has had students as local admins before it is not as bad as people think ... you can tie it down quite heavily and if they knacker a machine it is out of action for a period or two ... you explain to students it s because some of their fellow students have been prats ... and they tell you who it was ...

 

Access 2000 wizards, Multimedia Science School, demonstrating adding printers (ICT GNVQ), there are a host of things that is made easier for a local admin ... it teachs responsibility to the students ...

 

Ok ... enough of the trite "but students are perfect and won't damage stuff" ... it boiled down to the fact that doing some things a certain way actually created less work than the hassle the students can create as local admins.

 

It was something that gave time to support staff to iron out issues and could be rolled on and off when needed.

 

Not a perfect solution, but it was a working one.

[sidewinder]

^ That is part of the reason we've stuck with it so long

 

Although it does occasionally cause problems, its never anything more than a PC needing reimaging or being out of action for a few hours

 

Weigh that up against testing every bit of software for compatibility with non-admin and still getting strange problems and its not that bad.

 

Kids are still locked down suitably, theres nothing in the OS they can muck about with, installing rubbish is about as destructibe as it gets.

 

As for teachers, I dont have any intentions of taking away local admin for them. Whilst the odd one or 2 you have to watch out for, the majority never install anything more than itunes or software for their digital camera etc, and Id much rather let them do that than be called out to install every little thing.

Plus it helps a lot being able to fix small problems whilst being logged on as them, espeically when they're halfway through a lesson with a presentation open

[sreiach]

It's interesting how similar experiences can lead to different results.

 

When I started at my current jobs teachers had 'rights' to install what they liked and control of their classroom PC. Nightmare. I was being called every 10 minutes because - camera software messed up some other software, "im getting a blue screen", "I dont know i just clicked YES to everything". The last straw was walking up to a teachers computer and seeing he had a picture of his 'female friend' in a bikini as a full page wall paper (not kidding).

 

From then on we're like any other business. This computer does not belong to *you*. It is given for use by the company to do what the company requires of you. If we need you to do something we will provide the means. They now have completely locked down computers just like the students. This goes for the Principal and administration too.

 

So for digital cameras they can either use a school provided camera or use a multi card reader provided in open computer areas or labs. Same goes for scanners etc.

 

I've cut my requests done to almost nill. I'll accommodate some unique software requests. For example installing Google Earth, or some unique kids education software in the primary school.

[MkII]

The amount of software that needs admin privileges tho' sidewinder you could count on one hand - and that for us is the really old tech dept software - we're talking pre - windows, and dance ejay - which hardly runs WITH admin privileges.

 

On the other hand... the security risks you expose yourself to are horrendous without locking down very tightly - a lot more work, I would suggest, than setting up a vanilla 'user privilege level' system

[secman]

We are very strict. We use Winsuite to lock down the desktop and provide a menu system. We do not allow anything to be installed or run other than the software we have installed and made available via Winsuite. That applies to staff as well as pupils. (Staff are often worse than students for trying things!)

 

You can do the same sort of lockdown without a third party control package as others have said but I would never give students local admin. I have rejected software that wouldn't work without local admins. (Multimedia Science school will work without local admins!)

 

It's becoming a problem though as schools want to continue to use badly written software on new PCs. Can't really see it changing that much till someone gives us the cash to upgrade eveything and the curriculum reqiurements get updated.

 

Alan