Laptops For Teachers Scheme

[MuppetQueen]

Almost all of the teachers in my school have a laptop under this sceme. It was given directly to them and they nearly all took them home and have happily been using them ever since.

 

However, recently 2 things have been happening.

 

1. Staff have been brining in their laptops full of viruses/spyware etc. with no anti-products installed and lots of "inappropriate" material.

2. Staff have been asking if they can have their laptop connected to the network.

 

What is everyone elses policy on staff laptops? Do you get them to sign a contract? Do you allow them network access?

 

The problem is only going to get worse as we have just had wireless access installed.

 

Please help. :?

[Geoff]

You need a Staff AUP. You need them all to sign it.

[russdev]

also laptop for teachers belong to school not teachers and as such schools resposnability..

 

here we allow access and and we trying to keep them update at moment creating update script for them so when they access ther network share it uodates the laptop if needed.

 

russ

[Dos_Box]

Laptops should only be distibuted once the schools has installed AV products and ensured that a laptops policy is in force which should ensure that WSUS updates are installed the minuite the laptops entre schools.

[russdev]

yes but being our county insist we cant buy laptops ourself and they do bulk deal they get teachers to collect it...

 

luckly antivirus comes with it but rest....

 

Rus

[alan-d]

We have Sophos AV Enterprise edition via our LEA. When connected to the network it updates from the server but when at home it connects to the LEA automatically and updates via the web.

 

It's set so they cannot turn it off So they either update or don't use the internet

 

Wonderful piece of kit

[MkII]

Send the teachers to county then to get the laptops fixed! - or call them and ask who's supporting the laptops that are in need of attention due to thier policies - i'm sure you have a case.

 

Seems an outrageous arrangement.

[russdev]

then county dont provide restore disks either so we must send them back to themto get resotred... reason as they have agreements with ms over software..

 

load of rubbish leicestershire is...

 

Russ

[MkII]

Fine - so no work for you!

 

...just the configuration... can't you do a GPO install of your software to them all?

 

Who backs up/restores the data?

[russdev]

well..

 

what we are doing just to make life easier is we are ask them to bring it in then we config it the way we want it.

 

Just pain if we have to rebuild I am going to be taking it up with people at leicestershire in near future as this is last year of laptop for teachers.

 

What we are going to have an update side is a script that runs that does all updating when they connect to network share.

 

Russ

Russ

[GrumbleDook]

We just told the teachers tough. Either they give the computer back to us to rebuild or they don't connect to the network for *anything*.

 

This year we wouldn't let the laptops out until we have rebuilt them.

 

No machines com onto our network or receive support from us unless we install it.

 

Some people are not happy ... but at least we are not sending back to county to be rebuilt if they go pear-shaped at a stupid cost too.

[SpuffMonkey]

We just told the teachers tough. Either they give the computer back to us to rebuild or they don't connect to the network for *anything*.

 

Yeah - we say that either they can take it away and do what they want - but they can never connect to the network and we won't support them, or it comes to us - gets rebuilt - but they lose admin rights and can't install a load of dodgy software - but can use it on the network.

 

Sort of they don't pays their money and they don't takes their choice

[pmassingham]

You are welcome to amend our agreement to suit your school if you wish. I install AV on all laptops and then it is up to staff to allow autoupdate by connecting to the network or the internet at home. If they mess the machine up, I restore the original image.

laptop_agreement.doc

[danIT]

we have many teachers who have recieved laptops though this incentive. WE order them in bulk and they are delivered direct to us, we log serial and install all nessercary software including AV - updatable via Network. Supply them with a local account as a power user and they retun them every term or so for check over upgrade etc...

 

AUP is essential, its a good idea that teachers sign for a WORKING laptop and date it so when they bring it back problems u know when they occured and by whom.

[phil_thebeans]

We use sophos which is configured to auto update as and when they log on to our network. Unfortunately have had to give all users local administratot rights so they have full control. In 3 years have had to rebuild 20% due to negligence on web (trojans, popups , porn etc) worse thing about laptops on network is allowing them to backup to their network folder yesterday did audit one teacher had backud up all music and pic files (personal) over 500mb having a laugh. You do have some recourse though if you use protection of the networks integrity to control worse offenders. Good Luck.

[_Bat_]

So what about firewalls? This has been bugging me for a little bit now. Obviously we have a firewall provided to us by our LEA in school, so no need to have firewalls installed on client machines including laptops. Plus having any firewall including windows firewall enabled messes up certain things, especially sophos.

 

Yet teachers are encouraged to take laptops home and connect them to their home internet connection. This is especially dangerous to those laptops which are used by the teachers children (many of them are and I would hate myself if I had to enforce a policy to stop this happening). We need a firewall on the machines for home use, yet if there is one, it makes the laptop incompatible with our network in school.

 

Teachers have recently gotten into the habit of installing their own firewalls because they come on the CD (along with a load of other junk) which their ISP provide them with. I have got one sitting next to me now which has recently had norton installed. Not only does this block sophos by default but the install was buggy was caused windows to hang each time it was shutdown. I was reluctant to remove it for security, but had to for the above two reasons.

 

How does everyone else get around this?

[Geoff]

The GPO's for Windows firewall has a 'domain' and 'everything else' profile. You can enable the firewall when the machines are off the domain and disable it when they are connected this way.

[_Bat_]

The GPO's for Windows firewall has a 'domain' and 'everything else' profile. You can enable the firewall when the machines are off the domain and disable it when they are connected this way.

 

Small problem with this. The teachers rarely log into the domain on their laptops. They connect them to the network for internet purposes, but log in as a local user. They have been doing this since before I came and trying to get them to change it will need an act of God.

 

I think I will have to try and modify the windows firewall to trust the server and hope that it will fix that problem. The other problem is teachers installing their own firewalls... they often do this without even realising they have done it. One teacher even went as far as uninstalling Sophos off her laptop because the internet security program she had tried to install told her it was 'interfering'. The only solution to this appears to be locking down the local account from installing anything, which again, I am reluctant to do.

[alonebfg]

you can force the login via group policy and as soon as thego on the net they will need to connect to the network everytime if they are not on the network they will not be able to log in. Its a nasty thing to do but it will work and once they get used to it you will be able to take the policy off again. I had that problem and then one of the laptops broke and when they came to me and asked where all thee work was i said when was the last time you were on the network and they said months ago the i gave them the good news i could give them the work from 4 months ago but thats it. if the dont log in it dont get backed up.