Welcome To Controlling Laptops with Active Directory

1
Welcome To Controlling Laptops with Active
Directory
Lee Tilley Director of Technology Chaminade
College Preparatory School in St.
Louis LTilley_at_Chaminade-stl.com
2
Chaminade College Preparatory School History

• Founded 1910
• Private Marianist Catholic Middle/High School
• All Boys Day and Resident School
• ISACS and NCA Accredited
• Past 14 years 99.7 of graduates college
• 75 have received scholarship
• 93 of students ACT scores are 21-27
• 77 of students SAT scores range from 1010 to
  1260
• Laptop History

3
Things we have addressed with Active Directory

• Security
• Email
• Filtering
• Accounts for School and Home use
• Class Groups
• Allowing or Disallowing Internet, Intranet, and
  Email

4
Security

• Security through Child Domain
• Student Login is Restricted to assigned computer
• Password Policy
• NTLM Hash on all Passwords
• File Permissions
• Local administrator account restricted on servers
• Terminal Services only loads loop back policy

5
Email

• Controlling email for students who have violated
  the use policy without affecting everyone
• Restricting the list of users students can view
  to restrict the temptation of mass email

6
How we restrict Email

• Delivery Restriction and Security of Address
  Books

7
Filtering

• We are using St. Bernards Iprism and Microsofts
  ISA server
• Integrated with Active Directory this allows for
  seamless authentication
• Rules can be applied to Active directory groups
  so that upon authentication the correct rule is
  applied
• Teacher has override access for students during
  class

8
Why Integration with ISA

• Proxy Servers
• Https control
• File Restriction such as Flash and Java
• Prevents unauthorized Internet traffic

9
School and Home Accounts

• Both Domain accounts
• School is set for user privileges only
• Home is Local administrator privilege
• By having both accounts on domain we can restrict
  time that a student can access the home account
• Yet student have almost 100 freedom of the
  system at Home
• We have the ability to restrict the home account
  to the same level as their school account if
  needed

10
School Account

• We control the system and make sure only certain
  applications are allowed to run
• Students can add hardware devices
• Students can not install any software
• Students have control panel locked down
• Other restrictions such as the start menu

11
(No Transcript)
12
(No Transcript)
13
Total number of Policies

• Combine them into one or two policies before
  deployment
• 4MB
• Separate for development

14
Home Account

• Students are Full administrator of the local
  computer
• We have taken a different approach because we
  want students to connect to our network so that
  we can keep them off of this account
• Students use cached credentials when they login
  outside of our network

15
Other Benefits Active Directory Gives us

• Printing Restrictions and Ability to Charge for
  Printing
• Exam Account is the same for everyone
• Implement Home account restrictions to students
  if needed

16
Class Groups

• Allows for email list to be automatically created
  for teachers for each class
• Classes can have rights to applications other
  classes do not
• Teachers can give rights or take away rights in
  their class room

17
Restricting Internet and Email

• Teachers have the choice to restrict the Internet
  and/or email
• Web Interface
• Automatic reset on 90 Minutes

18
Questions

• Contact Information
• Lee Tilley
• Chaminade College Preparatory School
• 314-993-4400 x190
• Email LTilley_at_chaminade-stl.com