Staff laptops and access to the C Drive.

[Jake]

How does everyone handle this?

 

By default, we do not allow staff members access to the C Drive on the laptops which they take offsite. As an example, we did have a staffmember (female), who had access to the C drive, and when the laptop was brought in with a problem it was discovered that the laptop had over 350 porn images on it (mostly of male genitalia)

 

However, a couple of staffmembers have had access to the C drive on their current laptops as the result of an oversight. Now there are new laptops being issued, and some teachers are complaining extremely vocally about having their C drive access rights removed.

 

Generally what they are supposed to do is work on the laptops and save their work to a usb stick if needed, then they can drop that work into their user areas on the network. The brunt of the issue is that they are saying their usb sticks are breaking and they are losing alot of hours of work.

 

The problem that we get (admittedly not from all staffmembers, some actually do use their laptops for work), is that many times when a laptop comes in for a virus update or a problem, we discover that there is a multitude of games installed on the laptop, where they have been using the laptop for young relatives to play games on. (or worse in the case of the aforementioned staffmember).

 

Needless to say that the teachers in question are now on the warpath heading to see the head about the whole "stupid" restriction issue.

[nawbus]

Needless to say that the teachers in question are now on the warpath heading to see the head about the whole "stupid" restriction issue.

 

Would these be the same staff who would throw a hissy fit if they got a telling off for letting a virus lose round the network?

[djm968]

Many schools get around this using offline files and synchronisation. It can the a pain in the a$@e to configure, but worth the effort.

[jumpinjamez]

We use offline files - the staff can save to the My Documents folder and it gets sycronised when they connect back on to the school network.

 

They have no access to anywhere else on the laptop.

Its not the best system as there are issues but it appears to be ok.

 

I do feel asking them to save on a usb pen is asking for trouble as we say usb pens are for back up and transporting data not a file storage device.

[Jake]

The offline files would work I suspect...if only we could get the staff to actually bring their laptops into school regularly.

[Kained]

We allow access to the c: drive to staff with laptops and rights to install too, but we do make staff bring them in on regular intervals for "cleaning" ie removal of stuff that shouldnt be there, update anti virus etc, usb keys etc are they're own responsibility but they can upload from the laptop to there network folder.

[Jake]

Dont you get issues with them installing games and what not on the laptops that way?

[plexer]

Our staff do all their reporting on students electronically now so most of them have their laptops with them for this.

 

When we go to electronic registration then they will have to have them for this purpose.

 

We use offline files and it works well only issue I had was when I moved all the staff to a new server and had to use csccmd in a batch file to point them to the new location.

 

Staff are beginning to have a local user account just for installing their home printers etc... but will be sorted out if they install illegal software.

 

Ben

[djm968]

Your AUP should state that staff laptops MUST to be bought into school at least once a week and connected to the network for Virus updates.

 

This would perform a sync at the same time. If you configure offline files, staff then have two options.

 

1: Save to my documents and sync at school or

2: Use a stick.

 

If any staff still have an issue with this, I would go above them as the solutions you have provided for off site document storage are a reasonable compromise which will not impact teaching and learning.

[Jake]

That would be wonderful, sadly we have hit a snag in regards to our staff AUP, the head refuses to make the staff have to sign the AUP. So of course , there is nothing to stop them turning around when its brought up, and say "I never saw any AUP"

 

Frustrating to say the least

[djm968]

I had a debate with Directorates at an Academy recently about this same issue. Basically a compromise was mutually agreed along the lines that the Directorates would be granted full access to their laptops but if they installed anything or changed the configuration in such a way that they broke the thing it was unreasonable to expect the onsite technical staff to try and fix it and instead the laptop would just be re-imaged and all data stored locally and additional software would be lost.

[limbo]

I find the problem is that some staff can absolutely be trusted to have administrator access to their laptop and would actually be held back if they did not, but other staff you know will get up to all sorts.

 

The problem is that you must have one set of rules for all.

 

The issues you have talked about are not technical decisions that need to be made - this is up to your SMT to decide, based on you best honest advice.

 

Staff view pornography or installing games on their laptop is usually against the terms of their employment at an LEA level because it will probably quite clearly state that use of Council equipment for illegal activites is forbidden, plus profit making (which would include logging on to ebay) and a whole host of other things.

 

If SMT decide that staff should have administrator access then let them - if you anti-virus is all up to date on the network then a virus infected laptop will not be able to spread it far - and for this they would have to be connected to the network anyway at which point the software should update an then detect.

 

If a laptop is brought to you because it has death by installed software then fix it, make a note and let SMT know because, again, this is not a technical problem and therefore not for you to decide what happens.

[Disease]

 

If SMT decide that staff should have administrator access then let them

 

Thats just absurd, SMT should not be left to make decisions on Network Security, thats what I get paid for. Decisions should always be placed in the hands of people who fully understand the implications of those decisions, which I am afraid most SMT members do not.

[limbo]

@Disease: If the SMT value you enough to let you have that kind of power, then they ae going to with your recommendation anyway so what is the diference other than when disgruntled staff go running to SMT they know what the decision is, why it was made and that they made it.

[Jake]

now i'm confused

[djm968]

Tell the Bursar that due to the anticipated high demand of laptop maintenance as a result an uneforced AUP, it may eventually be necessary to outsource this maintenance to an at considerably cost school.

 

I think there will be an AUP in staff pigeon holes within a few days!

[Disease]

Tbh no users on a network should have administrator access on a network other than the administrators. If you do that you are leaving youself open to a whole world of hell.

[Disease]

Tell the Bursar that due to the anticipated high demand of laptop maintenance as a result an uneforced AUP, it may eventually be necessary to outsource this maintenance to an at considerably cost school.

 

I think there will be an AUP in staff pigeon holes within a few days!

 

 

Would not work, Trust me.

[Zoom7000]

By default, we do not allow staff members access to the C Drive on the laptops which they take offsite. As an example, we did have a staffmember (female), who had access to the C drive, and when the laptop was brought in with a problem it was discovered that the laptop had over 350 porn images on it (mostly of male genitalia)

 

I've caught many male students and a few male staff, but never as yet heard of a female case. I don't know why, it just seems surprising.

[RobC]

Couple of things to add to this:

 

Firstly, regarding storage. If offline files isn't an option, you could always use Partition Magic or something similar to create a suitably sized second partition on the laptop in which staff can save their data.

 

Secondly, regarding staff and administrator access. Have a look into the principals of Least User Access. Basically, no one should use an administrator-level account on an everyday basis. If you require administrator level access, you will be issued with a logon for a secondary account that can be used for administrator level functions either by loging in with that account, or by using the RunAs command. Even administrators shouldn't be using admin-level accounts as their main accounts!

 

Rob Cowan.

[jcs808]

We give them a portion of the c drive. I create a folder on the hard drive, set quotas and use the subst command to map it to a drive letter. This way they have a 15 gig "drive" they can access at home or when logged onto the network. It also stops the moaners who think that using a usb stick is too time consuming.

 

As far as an AUP, we were just audited and this point about what staff access on work issued computers was raised. The result is that we're looking into some sort of logging or filtering system for when these laptops are used on home internet connections.

 

The bottom line is these laptops are issued for work purposes.

[Jake]

Yeah, we are going with setting up a small, and we mean small , quoted area of the drives as a save space. That is covering us against the people who say their USB sticks keep breaking etc , but not giving them enough of the hard drive to whack games and lord knows what else on