Student Laptops / Domain access...

[Ben_Stanton]

How do you guys do it?

 

Do you make them buy their own laptops or lease/buy from school?

 

What do you do about AV. Buy there own or install school AV?

 

Do you attach to the domain or run a seperate network with its own dedicated proxy and ADSL line?

 

Anybody got a schematic, network topology I can look at?

 

My NM has what I think a strange concept...

 

Comments greaty appreciated - sorry if it's been covered before, I did try searching.

[mrforgetful]

What's his strange concept?

 

We will only let students use laptops logged on locally, not the network. I'm sure in the longer term things will have to be so that laptops can access their network resources, but for now it's not possible.

[Geoff]

None school devices fall foul of our Network Access Control box. If they fail certain requirements they get booted off the network. We use PacketFence to do this.

 

http://www.packetfence.org/

http://www.packetfence.org/dokuwiki/doku.php?id=registration_and_remediation_primer

[plexer]

Ben: You're in a private school aren't you? hence why your students probably have their own laptops and ours don't.

 

Ben

[Ben_Stanton]

Ben: You're in a private school aren't you? hence why your students probably have their own laptops and ours don't.

 

Ben

 

It is a relatively small school, but I think the majority of students do have their own. But at the moment they can only use them if the teacher gives the nod or in their dorms if boarding. They have no access to wireless or network. I recently had to chop off a girls toes when I saw her contemplating plugging her patch lead into a network point...

 

We are making the site 'hot' in preperation for sharepoint and laptop access...

[Halfmad]

Students wouldn't be allowed it on my network, regardless of who owns it. If they're taking the laptop home for use there with broadband etc then I'd simply not allow it on the domain in any way.

 

I'm not paid to support peoples private I.T. equipment, end of story.

[Ric_]

You could implement a system like BlueSocket with the plugin whose name I forget which runs a security check on the machine before allowing access. The laptop is then only allowed access to what you allow.

[alonebfg]

but surly if you only allow domain admins to join a pc to a domain then they will not get domain access. but i do know ehat you are thinking about. You have two options as far as i can see possably three wireless for laptops use secuarty and dont tell then the code and with wired use mac address resevation for all pcs on the network ( I know its a pain but i know it can be done had to do it in the navy on our network to not allow any ther machines on. 2 invest in a router and place it between sever and network and put mac address filter on it so computers without mac address in table will not get access to server and not get ip allocation. (downside can configure address manually but have to be cleaver and find an empty slot.) spend lots of money on a dhcp mac address filter secuarty software. There is a 4th option but will have to ask the linux boffs i belive you could create a liniux box with a firewall setup in line with server and mac filter so only mac address in linux box can access server much the same as router but cheaper option. I know from experance the cheapest is static ips on all machines but it takes time to set up and not easy or fullproof. but i know it works. You could do it slowtime which is what i had to do in the navy with 450 machines all with reserved ip address but you have to make sure the range does not go outside static range.

[GrumbleDook]

Option 1) do not allow any device to connect to your network unless you have set it up. Suggestions from Geoff deal with this.

 

Option 2) build the laptops yourself (they may be leased or owned by the student ... but you install them from scratch and have full control of them) and then lock them down as you see fit.

 

Option 3) Segregate them on the network by using Cisco / Bluesocket and VLANs as well as packet control. Only give them access to certain resources (webDAV or CIFS /SMB to specific shares ... and http too)

 

We go for option 2 ... not perfect but the problems we have are outweighed by the benefits to the students and staff.