“Managing 1200 Chromebooks”

Chromebook Foundations for Admins

tinyurl.com/webb1200

Methods, Configurations and Tools that have made year one go fairly smoothly…

Quick Links

• Ideas and Methods
• Apps & Sites
• Tech Coaching
• Classroom Management Tips
• Student Behavior with Chromebooks
• How to Get Buy-In
• Deployment
• Collection
• Pitfalls
• Admin Console Config

This document does not highlight networking infrastructure details. For more information on recommended appliances or other info please see the “5 Keys” document at: tinyurl.com/5keysWC.

Thanks for joining our session!

2014 Southwest Center Tech Summit Round Table Group from Webb City R7 Schools:

Tim White

Director of Technology

Nathan Dingman

Technology Instructional Coach

Dennis Kimzey

High School Library Media / Tech Integration Specialist

Shawn Mayes

High School Assistant Principal

Ideas and Methods

• We’re in it together - ongoing communication between Tech Dept and Principals. What’s working, what’s not? What do we want to change? Nothing is in stone and no one’s plans are perfect. In the end we’re all here for the kids.
• Written Standards Presented Upfront - do your best to plan for the worst. Layout your expectations, fines, and penalties as much as possible in written agreements, signed by students and parents before anyone gets their device: www.wcstudent.org/handbook
• Have some Spares - we started the year with about 80 spares and ended up with about 12 at the end. By the time we finish damage repairs we’ll have spent about $12k in repair parts for a $380k initiative.
• Enlist a Trainer - we hired one of our existing tech savvy teachers as a full time tech coach and staff tech needs liaison and it has made a world of difference. A tech team member who thinks like a teacher and works with them in the trenches, one-on-one during planning blocks and heading up large group PD sessions. Smaller schools may consider having a current teacher become a half-time tech coach. It would be difficult to be successful without one.
• Libraries were made for Technology - our High School Library Media Center has become a central hub for our blended learning initiative. Without the use of this large space and the coordinating / organizational efforts of our Library Media Specialist, we would have really struggled. This past year we rolled out (and back in) close to 1200 devices on more than one occasion. Thanks to some major configuration changes required in December we got some extra practice in this routine! Our library provided a perfect location to bring large numbers of students through as well as ample air-conditioned space for storage of devices over the summer. We are currently in progress moving our help desk into the library as a more natural fit for student and staff tech support.
• Manage Student Apps - as nice as it sounds to be completely open to creativity and let the kids be free to explore all apps, in reality that turns into chaos. These devices were meant for educational productivity. Preload a few good apps that all kids can use and make a collection of optional apps that students can choose to install. But don’t just make it open season on apps.
• Limited Gmail / Bulk Mailing Access - if your content filter supports it, keep student access to Gmail limited to your school Gmail which can be easily monitored for CIPA compliance. Restrict student access to send bulk messages or share Google docs in bulk to other students or staff.
• Empowering Staff and Admins - we utilize Hapara Tools which allows easy monitoring of student Chromebook screens, open browsing tabs, and Gmail / Google Drive accounts. All staff have access to these monitoring tools, helping keep kids accountable and curb negative behavior. Additionally our admins have access to our GoGuardian.com panel and can quickly make note of flagged student web browsing activity and even block access to sites with flagged content / keywords that might have made it past web filtering. GoGuardian has become our number one tool in keeping students on track with the Chromebooks. It's like the extra set of eyes every parent and admin wishes they had. And it works 24/7 wherever the Chromebook goes.
• Offsite Filtering / Access Logging - as much as we’d love to trust our kids, they’re still human and we need to offer protection for them when no one else is watching. While this is currently a grey area in CIPA legal enforcement (most states do not require it) the decision to enforce off-campus filtering of district owned devices can save you a lot of stress and emotion filled parent / admin conversations. Chromebooks offer a very simple proxy setting that allows you to point all student accounts to an internet content filter whether on-campus or at home. It even filters if they bring a hotspot to school. We use ContentKeeper for all filtering at school and at home and have been very pleased with their integration with Google Apps as well as their responsiveness to various needs we’ve had. With some help from a network specialist, most traditional content filters can be made to work off-site with the Chromebook proxy setting as well. But some Firewall / UTM based solutions cannot (if they have no proxy address to point to). In these cases ContentKeeper is a solid, high performing solution that I would recommend.
• Restricted Access - even the best kids make mistakes. “They’re all good kids” but sometimes we have to help reshape their behavior. When a really big incident happens or a student crosses the line one-too-many times, it’s time for Plan B. We’ve made a special section in our Google Apps panel for theses special users. It gives them full access to essential sites like Google Drive, Schoology (our LMS), Khan Academy, USA Test Prep, etc. but blocks access to all other sites. This way they can still get their assignments done but will not be tempted into other distractions that helped them get into trouble before. We often pair restricted access with being removed from the take-home program -- instead they check out their device from the help desk every morning and back in each afternoon. After a period of time they can return to the take-home program and even back to normal web access.
• Full time Chromebook Specialist - at one time it was enough to have one building tech at our high school, but with the addition of 1200 student devices that just didn’t work. In addition to student workers we also have a full time staff member dedicated to working our help desk so we can ensure that we have someone to assist any hour of the day when students or staff need to stop by for Chromebook help.
• Enlist Student Helpers - this has been one of the greatest helps to our blended learning initiative. Every hour we have one or two student workers assisting in our help desk. Students help with simple things like helping kids login when they forget their password and more complex things like replacing broken screens or damaged keyboards. We don’t give our student helpers the “keys to the kingdom” but they have enough information to be a lot of help to our other students and staff. This year our student workers have saved us countless hours of labor.

Apps / Sites We Love for Chromebooks:

• Google Drive apps of course... (Docs, Sheets, Slides, Forms, Drawings)
• Chrome Store Education category for good apps to try out
• Sophia.org - great for flipped classrooms - video upload, quizes that follow
• YouTube - we use Youtube Safety mode for take-home policy, Full Youtube on Campus

*Asterisked* titles are ones we are really excited about...

Tech Coaching Tips:

• Plan and Reflect with teachers - Each teacher has met with our Technology Coach 1 on 1 to reflect on the year and to set goals for the next year.  This time has become one of the best times for teachers to reflect and plan.  During these meeting you will probably be able to give the teacher a new tool or resource for them to look at later.
• Meet your staff where they are - Whole group PD is good to introduce a new tool or resource but when it comes down to implementation in the classroom small groups or individually works best.  
• Sharing times are great - Give the teachers a chance to share what they are doing in their classroom.  Some of the smallest and best strategies come from fellow teachers.  We run a mini conference at Webb City as one of our PD days, teacher apply to present and teacher choose their own schedules.  Our feedback from this PD day has been great, teachers feel they can choose sessions that fit them.  We offer everything from basic tech tools, to most advanced strategies.  
• Be available - Our Tech Coaches have booking sites set up so teachers can book them to either help them plan or implement the new technology.  When they are not in the classroom they do try to set aside time to float around during plan times and to have face to face conversation with staff members of what is going on in their classroom.

Classroom Management Tips:

• Classroom Set Up

• Rearrange your room so that it is easy to walk around see student screens.
• Arrange desks into groups for easier collaboration.

• Managing Student Work

• Set a procedure for how students should label any documents that they complete.

• Teach the students how to create headers with the required information.
• You may want to create a poster with this for the start of the school year or have an example on a Schoology page.

• Have students create folders for each subject in their Google Docs
• Set a procedure for turning in electronic assignments.

• Will they email the homework?
• Will they save the homework to Google Docs or upload to Schoology?
• Will they print certain assignments?
• How will they name the document?  (Class period, Name, Assignment Name)

• During Instruction Time/When You Need Their Attention

• During direct instruction, the students should close the lid of the laptop.
• Before you give instructions, make sure that you have their attention. Use phrases such as:

• ​"1,2,3, eyes on  me"
• "I want to see your eyeballs"
• "Lids closed"
• “Sit on your hands”

• If a Teacher has good classroom management now, they will come up with strategies to manage their classroom.

All these things are take from >>Managing a 1-to-1 Classroom Handout for New Teachers<< feel free to look at the document for more info.

Student Behavior with Chromebooks:

• Acceptable use policy and it’s importance  >> our HS Policy <<

• We made infractions very broad

• Parent meetings and effectiveness
• Admin was kept in the loop from IT on sites that were a concern as well as searches that were a concern
• Student behaviors that were common

• Gaming, music videos, chatting through documents, inappropriate material, using others username and password, proxies, repeat offenders
• Consequences ranged from warnings to suspensions
• For repeat offender be ready with some resources to offer parents for repeat offenders

• Counseling services available in the area

• Stats

• 1176 total students in High School
• 132 referrals in first year

• 56 1st semester
• 76 2nd semester

• 125 resulted in warning, detention, or loss of privilege
• 7 suspensions
• 20 repeat offenders

• Technology is always changing, students are wise and crafty when it comes to getting around filters

• Students would share a document and type in it and change the font to white. We would open the document and it would appear that there was nothing on there. Student that received the document would change the font to black and be able to read what was on it.

• Communication---Admin and IT as well as parents

How to Get Buy-in:

• Blended Learning Concept - you don’t have to replace everything you already do. Introducing the new tech pieces as a tool for class - an add-on, not a replacement for good instruction
• “Taking a Step” - we’re not expecting full use from all staff the first week, even the first year. Take a step and move in the direction of using a little bit of the technology, a little at a time. Find something that works and use it for awhile.
• Do a Pilot - Let your staff see it work in small pockets and these will be your leaders during the full deployment
• Pilot Staff Meetings - the group of teachers operating the meetings - what’s working, what’s not
• Prep your School - regular PD for all teachers the semester before you will launch
• Provide Access to the Student Device - we got a Chromebook for every teacher so they would know the capabilities / limitations

Deployment Tips:

PLAN, PLAN, PLAN

Fall Deployment (1st Year):

• Chromebooks in boxes with designated students (not smart)
• Scanned SN and had students open box
• Taped Student ID and Taped over SN for security
• Video on how to change password

• Wanted to do more Google Intro but time did not allow
• Process took about 20 min per student (be aware of how long it will take)
• We did groups of 20 and had 2 stations with the password video

Semester Deployment (Mid Year)

• Delivered undamaged devices to the students homeroom classroom
• Damaged devices students had to come and pay fines to get device back

Collection Tips:

PLAN, PLAN, PLAN

• Take Time to create a spreadsheet for data collection >>Example<<
• Fall Collection (end of 1st semester) -- Fairly inefficient method

Done to re-enroll Chromebooks for SSL Filtering update / Root Certificate Push

• 9 Drop off Stations
• Sorting/Organization

• Homeroom Class

• Damage assessment

• Student not present (We don’t recommend)

• Spring Collection (end of year) -- Much, much better way...

• Assembly Line:

• Bag Check/Scan Serial
• Shell Damage
• Trackpad/Keyboard
• Final Assessment/Fine Notification
• Damage Assessments with Student Present

• Storage/Inventory

• Graduation Year
• Last Name
• Types of Damage
• Re-Purpose Senior Chromebooks

• Damage Stats

• End of the year 1 collection

• Bag Damage - 22
• Charger - 25
• Screen - 12
• Shell - 50
• Keyboard / Trackpad - 8

• During year

• Screens - 162
• Keyboards - 7
• Charger - 16
• Bags - 6
• Cases - 1

Pitfalls we have worked through:

• Kids using VPNs to hide browsing and bypass filtering - had to block the Settings page. We’d still love a better fix -- this is a big hassle for kids but is otherwise very difficult to stop.
• Kids attempting to hijack admin accounts - while unsuccessful a small group of students attempted to hijack of few IT Admin google accounts. The easy solution was to eliminate the attack face. We created alternate Google Apps admin accounts and no longer have any normal named accounts set as super-admins (or any kind of admin access)
• Misuse of Youtube and Games - what works in one setting and activity can become a big distraction in another. We’re still working on behavioral ways to combat this misuse but in general are leaning toward a zero tolerance policy -- unless specifically permitted by teacher in class, watching music videos or playing games will result in 24 hour confiscation of Chromebook.
• Enroll your Student Devices to their Email Domain - our primary GAFE domain is wcr7.org but we have a couple of secondary domains we’ve added to this Admin Panel / Primary Domain including our student domain, wcstudent.org. Initially it was recommended to enroll all student devices to the primary domain. Unfortunately when root certificate push and SSL interception became an option for Chrome OS, this created a big issue. We ended up having to collect all student devices and re-enroll them to our secondary domain to match our student’s login accounts to get past unpleasant SSL warnings. Until then we simply couldn’t fully implement SSL web filtering and some of the nicer features like consumer gmail blocking (while still allowing school gmail).
• Losing OU Settings when renaming OUs in AD and syncing with GADS - while compiling this document I experienced this issue… When renaming an OU in AD, GADS does not send a rename operation to Google Apps. Instead it deletes the OU in Google and then recreates it with a new name and places the former users inside the newly created OU. This may seem harmless but in the process we lost all Chrome OS settings for more than one renamed OU. The better method is to manually rename OUs in AD and then manually rename the corresponding OU in Google Apps. Consequent GADS syncs will not have need to modify the Google Apps OU or delete it and will prevent a painful settings rebuilding process.
• Leaving Guest Mode enabled - during a small state testing pilot prior to launching we were asked to allow Guest mode for Chromebooks. However we did not remember to turn it back off prior to deploying devices. The first night students were excited to learn that by logging in as a guest they could bypass all filtering. This was a small embarrassment at launch we would like to spare you.

Admin Console Configuration Details:

Most of these are user settings but a few need to be device settings. Device settings tend to be applied to the whole organization (including staff) as devices are only identified by serial, not hostname like in AD.

Productivity Tip: Search for a setting with Chrome’s Ctrl-F Search box.

Chrome Management settings pages seem to scroll forever. Skip the scrolling and jump straight to what you want. Ex. Ctrl-F “URL Blacklist” jumps you straight to the blacklist (or exceptions list).

While this list of Configuration examples is by no means exhaustive, these are tips that have proved helpful for us. Please test in small units of users / devices before applying settings to an entire OU or all organizational devices.

Policy Updates

Restricted access

Proxy Configuration

Require SafeSearch

Wireless Tips for connectivity

Chromebook URLs to Whitelist on your Filter

Pushing new Wireless Settings

Plug your Homepage

Block unapproved Apps

Our pre-Installed Apps

Optional Apps and how to make these available to kids

Gmail Policies for Students

Protect your Mass Email Lists

Settings you should block for students:

• Themes
• Developer Mode
• Incognito Mode
• Chrosh (Terminal access)
• Settings (allows VPN tunnelling access)
• Access to clear browsing History
• Guest mode (Device Setting - IMPORTANT)

Sticky areas

• Enforcing Chrome Management on non-Chromebook devices - a loophole for clearing history but difficult for kids who want to use their accounts on personal devices
• Getting the Student Google Drive Sharing settings right for collaboration with other schools and Vocational partnerships but not allowing widespread connections with all public accounts
• High School email policies - grade schools can all understand not having wide open email accounts. However in High School the need to communicate outside the district is much more common. We still have not found agreement within our administration on the right balance. Some want it wide open. Others want them to only message our own staff and select individuals outside the school. This has been an ongoing challenge to maintain the “email whitelist” and keep everyone happy. But we can normally accommodate the needs of a given situation.

Config Details and Screenshots:

Note: All screenshots are from our High School Students OU in the admin panel unless otherwise stated. In general we do not enforce Chrome policies on staff unless were helpful, such as preinstalled apps. All configurations below are User Settings unless otherwise specified.

Policy Updates

User Settings - General - Policy Refresh Rate

- set your Policy Refresh Rate to the lowest (30 min.) for quicker updates

        - in theory devices will check in for settings updates every 30 minutes

- when testing a new setting you can force an update from a logged in Chromebook

        - surf to: about:policy  and click “reload policies” -- similar to a “gpupdate /force” in Windows

Device Settings - Scheduled Reboot

We set our devices to auto-reboot after 7 days to be sure that Chrome OS updates and Policy updates that have not otherwise pushed will always apply within a week’s time. This number is up to you, but 7 days seemed like a good number for us.

Note: we disallow the “auto-reboots after updates” setting to prevent frequent surprise reboots. With the scheduled 7 day reboot we can expect automatic reboots no more frequent than once per week.

Restricted access

User Settings - Blocking - URL Blacklist

This requires creating a special OU just for these special users that need less freedom. If you’re a GADS / Active Directory shop, make the OU in AD first, then sync. Otherwise, just add the suborganization in the Google Admin Panel.

Next choose to block all sites by entering an asterisk * in the URL Blacklist. This lets nothing through to users in this OU so you need to go down to the next box (URL Blacklist Exception) and make a short list of Allowed URLs for these students. Some sites will require digging on your firewall logs to discover backend URLs required to make components of the page work.

An Example Shortlist of Exceptions

wcr7.org

wcstudent.org

schoology.wcr7.org

drive.google.com

mail.google.com

myspanishlab.com

mylabs.px.pearsoned.com

Now any users placed inside of this Restricted Access OU will have access to the sites above but all other web browsing activity will be blocked.

Proxy Configuration

User Settings - Network - Proxy Settings   (not the “Networks” top tab)

The Proxy Server URL will be your own proxy address, a custom URL for each school and content filter. The most reliable solution I have seen for filtering Chromebooks is ContentKeeper. They have some great features at a reasonable price. Other filtering appliances may have the option to map a public IP address or DNS record to the appliance proxy address. In the past we have used other solutions from Securly, GoGuardian, and various other demos, but ContentKeeper has been the best all around product for Chromebooks and other devices on our network. Check with your filtering appliance technical support for configuration assistance.

Require SafeSearch

User Settings - Content - Safe Search

While your web content filter will normally enforce this already, it’s nice to have a fallback. Let Chrome Management help you enforce this:

Chromebook URLs to Whitelist on your Filter

There’s a fairly lengthy list of https URLs you will need to whitelist on your content filter / firewall / proxy if you want your Chromebooks to work on your network. If you don’t do this they will be crawling slow, have difficulty logging in and have other random issues. Whitelisting these sites does not open up any ability to search for or view unfiltered web content. Fear not…

Latest list:    (they update this from time to time)

https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941

2/22/16 Snapshot of the list (check back on the link above for the latest list of URLs)

accounts.google.com

accounts.gstatic.com

accounts.youtube.com

clients1.google.com

clients2.google.com

clients3.google.com

clients4.google.com

commondatastorage.googleapis.com

cros-omahaproxy.appspot.com

dl.google.com

dl-ssl.google.com

gweb-gettingstartedguide.appspot.com

m.google.com

omahaproxy.appspot.com

pack.google.com

safebrowsing-cache.google.com

safebrowsing.google.com

ssl.gstatic.com

storage.googleapis.com

tools.google.com

www.googleapis.com

www.gstatic.com

cache.pack.google.com

chrome.google.com

clients2.googleusercontent.com

lh3.ggpht.com

lh4.ggpht.com

lh5.ggpht.com

lh6.ggpht.com

Wireless Tips for connectivity

This is not a setting but a short list of security / band settings when configuring Wireless APs and SSIDs that have helped our Chromebooks connect more reliably:

1. Use WPA2 with AES (CCMP) -- do not allow mixed mode WPA/WPA2. Do not allow WPA2 TKIP
2. If your APs support 5 GHz either turn off 2.4 GHz for your Chromebook SSID(s) or band steer clients to 5 GHz. While 2.4 GHz can work fine, 5 GHz seems to be the preferred band for our Chromebooks. (Keep in mind that 5 GHz does not travel well through walls…)
3. Don’t overload your APs. Our wireless APs can happily support around 40 clients. While more than 40 can connect, any more than this drops performance fast. Talk with your Wireless vendor to find the optimum performance number for clients attached to a given AP. Apply client Load Balancing settings (if available) and place APs near enough to student concentrations to prevent overloading APs, especially in your high use classrooms.
4. Avoid tunnelling VLANs / SSIDs back to your Wireless controller. If at all possible do all your VLANing at the switch. Tunnelled VLANs result in higher seek times for most vendors, longer DHCP response and DNS lookups and in general result in bad performance for an Internet Dependant device.

Pushing new Wireless Settings

Device Management - Chrome - Network

While you can manage wireless networks via user settings as well, device settings seem to work best for us for reliable connectivity.

• Be sure to click “For Devices” at the top
• If updating a Wireless Password for a Pre-shared Key mode SSID it is wise to work in “Key Pairs”

• Add in the new SSID and Password as a new Wi-Fi config and allow several days for the new settings to propagate before disabling / renaming the old SSID or changing the password
• In the example below I have 2 Wi-Fi networks: Pilot and Blended-Access-CB

• If today my students are using Blended-Access-CB and I want to change the password I can update the password on Pilot and may choose to update the SSID name as well.
• After waiting a few days for device policies to update I can now ensure that the Pilot SSID is enabled on my Wireless APs with the correct password and then disable the Blended-Access-CB SSID.
• The majority of clients will now connect to the Pilot SSID without issue.

• We have found it is a bad idea to simply update the Wi-Fi password while leaving the SSID name the same. If you simply update the password 50% or more of your clients will fail to connect, as they assume they just have the password wrong and you will get to manually key in the password on numerous devices. You want to avoid that.

Plug your Homepage

User Settings - Startup - Home Button

If you don’t have a student portal yet, now is the perfect time to start one up. Google sites makes it easy to create a simple Portal with a news feed, calendar and tech tips for students. This is also a great place to post your policies and important links. You can check ours out at www.wcstudent.org.

While you’re at you might as well make that the default start-up page when kids login and even the home button. Now vital information can load first thing when they login and getting back to the portal is a single home-button click away.

1. Configure the Home Button:

2. Add your Startup Pages:

Block unapproved Apps

User Settings - Apps and Extensions - Allowed Apps and Extensions

If you haven’t set it as an optional or pre-installed app, block it. This reduces the number of distractions significantly and prevents quite a few abuses of the technology.

Note: For any optional installs (non pre-installed apps) you wish to add to your School Chrome Store page, you will need to also add them to this “Allowed Apps” list by clicking Manage.

Our pre-Installed Apps

User Settings - Apps and Extensions - Pre-Installed Apps and Extensions

Remotely install the essential Apps you want all your kids to have. This is a good place for conversation with instructional / tech coaches and / or a team of pilot teachers who can help shape this list. Remember every student will get this entire list so consider that some specialized calculators, foreign language tools, etc. may be better as Optional Apps in the School Chrome Store rather than Pre-Installed Apps for all.

(Click Manage pre-installed apps to begin building your list)

Our list of Pre-Installed Apps:

Note: This is also where you will deploy forced extensions for ContentKeeper, Hapara, etc.

Optional Apps and how to make these available to kids

User Settings - Chrome Web Store - Chrome Web Store Homepage

This is the easiest place to make a custom page of Optional Apps which students can install themselves. This is the self service portal for Chromebooks.

** Important: Any apps you add to this page must also be added to the list of “Allowed Apps and Extensions” above **

Some of our Optional Apps:

Gmail Policies for Students

Our Gmail policy is a bit restricted. We opted to begin with a fairly close set of communication options and open up over time. This has made policing of email a non-issue.

1. Restricted Delivery

We restrict students from sending mail to each other and only allowed sending / receiving mail to faculty. Every school is different and you may not wish to have such a restrictive policy:

Google Apps - Settings for Gmail - Advanced Settings - Compliance - Restrict Delivery

• Be sure at this point that the Students OU is selected - don’t apply this setting to Faculty
• Because we have restricted delivery (send / recieve) to only wcr7.org this means students cannot send or recieve to wcstudent.org (the student domain). So far this has not been a problem.

2. Disclaimer in the Footer

We also add a disclaimer message to the footer of every student email sent just to be sure the receiver knows the audience they are working with:

Google Apps - Settings for Gmail - Advanced Settings - Compliance - Append Footer

3. Catchall Routing for Auditing

We do a BCC of all student email sent or received to a catchall account for quick lookups in the event of an email communication issue.

Google Apps - Settings for Gmail - Advanced Settings - Routing - Receiving / Sending Routing

Note: You will need to create a “catchall” email account before completing these steps:

Principals and IT Admins can then spot check the catchall account or easily investigate reported issues by simply logging in to the catchall account and running a quick search by student name. These catchall accounts can fill up quickly so it is wise to cycle these every few months with a new account or plan to use the more robust Google Vault service as an alternative for Auditing and Compliance.

Protect your Mass Email Lists

In Google Groups settings, only allow Group Managers (owners) to send to your Student Email Lists.

• Preventing students from emailing the entire student body with a random thought
• Prevent the overzealous teacher from flooding the entire student body with information

• We allow Principals, Department Heads, Media Staff and the Athletic Director to email the Mass Student Lists

• Also wise to set similar access rule on Mass Staff lists

• We only allow group members to email the High School Staff email list

Settings you should block for students:

• Themes

• User Settings - Apps and Extensions - Allowed Types of Apps and Extensions

• It’s not surprising how quickly themes can get out of control...

• Uncheck “Theme”

• Developer Tools

• User Settings - User Experience - Developer Tools

• Incognito Mode

• User Settings - Security - Incognito Mode

• Chrosh (Chrome Shell Terminal access)

• User Settings - Blocking - URL Blacklist
• Add the following line item to the blacklist:

• */html/crosh.html

• Settings (allows VPN tunnelling access)

• User Settings - Blocking - URL Blacklist
• Add the following line item to the blacklist:

• chrome (blocks all Chrome URLs)
• Alternatively…

• chrome://settings
• chrome://settings-frame

• Note: if you use a Chrome Extension based content filter such as GoGuardian or Securly, or if you block connections to unknown addresses, VPN tunneling should not be an issue and you can leave Settings access open for students.

• Access to clear browsing History

• User Settings - Security - Browser History

This is a more old-school way of checking up on web activity, but it never hurts to have a backup plan when asked to do an investigation. Set this to “Always save browser history” to prevent students from clearing it out.

• Also need to URL Blacklist the following: (User Settings - Blocking - URL Blacklist)

• chrome://history-frame
• chrome://history

• Guest mode (Device Setting)

• Device Settings - Guest Mode / Sign-in Restriction

** IMPORTANT: If you don’t disable Guest Mode or Restrict Sign-In, students can bypass every policy we have set so far. Do not skip over this. **

• Be sure that you have selected the OU (or parent OU) that all student devices are contained in. We apply this setting to the entire domain.

Thanks for joining our session!

Tim White

Technology Director

Webb City R7 Schools

twhite@wcr7.org

@timwhite101

www.wcr7.org

www.wcstudent.org

www.webbcitybrightfutures.org

Nathan Dingman

Technology Integration Coach

@NathanDingman

ndingman@wcr7.org        

Additional Tips (2015-June KC Hangouts)

• Find a way on your filter to block Consumer Gmail

• ContentKeeper, Securly, iBoss, Smoothwall, CIPA Filter, Fortinet, McAfee, BlueCoat, maybe others too… can all do this.

• GAM - command line tool

• fills in the gaps needed for bulk changes
• especially helpful if you don’t have GADS (Active Directory Sync)

• If you’re going 1:1 -- start talking now about not rolling in devices every year

• this is too much work
• just roll in transfers and graduates

• Protect your mass email groups -- don’t allow just anyone to email all staff / students
• Get someone else to create your AD / Google Accounts

• K12ITC, Active Directory Student Sync, others too
• Google Schools Directory Sync -- newer product (SIS → Google) FREE
• Autoprovisions users from reading your Student Information System users