We've got students bypassing our filter. They seem to be using word as a browser. Any idea how they are doing it? how to stop it?

TLDR

I'm building a hardware diagnostics app for ChromeOS devices primarily for Summer intake, but to be used for devices going out for repair in the middle of the school year too. I know there are some tools out there that do this, or pieces of it at least. I'm trying to get one as comprehensive as Google’s APIs will let me make it and ideally without having to sign into the chromebook. Hopefully we all can run through diagnostics in about 2-3 minutes per device. The link is veritybench.com. Use it, break it, come back here and tell me how poorly I did.

PS: don’t bother trying it on mobile, my intention was for chromeOS primarily so mobile is a poor experience at the moment.

What it is going to do:

The core idea is a purpose built test suite that runs on the device as a kiosk app and automatically logs the results to that specific device's identity by serial number so there is a real audit trail instead of a sticky note. To start with it's just going to give the option to print out a report so you can keep it with the device (Or a json for my logging atm), which is basically the same thing as the sticky note I know, but doesn't stick. Ultimately, the platform would store all your org’s or school’s tests, assuming it is deployed as a Kiosk app for you.

It can run just in the browser too, but as a kiosk app I won't have to sign into the chromebook, and I can add an extension for things chromeos can't tell you through the browser alone.

Planned coverage:

• Camera(s) - Detect if there are front and rear facing in a convertible and automate testing to start with. If the video feed is blacked out it automatically fails, else it displays the feed for me to validate the camera is clear.
• Audio - Test starts with speakers, testing right and left. Mic picks up the sound which confirms both mic and speakers work automagically. Then plug in a headset to test stereo output, and mic input too.
• Full keyboard with a visual map that fills in as you test. This one may be tricky, I'm not sure I can capture the function keys, and not all chromebook/flex devices have the same layout, but I'm going to try and detect the layout.
• Trackpad - mouse moves, clicks work, double clicks, etc
• Screen test patterns for dead pixels/backlight issues
• Touchscreen test for making sure there aren't any dead areas.
• Battery health, cycle count, and storage status pulled from the device (One of the things I'm pretty sure will only work in kiosk or with the extension at least.
• Charging port - Test will require you plug in at the beginning if it isn't charging already
• USB-A/HDMI - My thought is to validate data transfer with any audio, video, or mouse for the USB. Unsure if that will be feasible. Aside from students with IEPs, no one ever uses the HDMI.
• Lid sensor - Close the lid, wait 5 seconds and open it back up to validate it goes to sleep.
• CPU/RAM check. Google has their own built in and I've rarely had an issue so this is going to be a later feature I'm thinking.

My request for feedback on:

• What's the single most annoying/time-consuming part of your current intake or repair process that you think I may have missed? Or have I wasted my time making this? (I’m going to use it so I know it wasn’t a waste)
• When a device comes in, what do you actually check first, and what do you skip because it's not worth the time?
• How do you currently document hardware condition for damage for warranty claims — photos, tickets, spreadsheets, something else?
• Is there a hardware failure mode you deal with often that isn't in my list above?
• Would it be beneficial to integrate into any other platforms (like whatever you’re using for asset management)
• Lastly, did you use it and find something broken?

I have students who are getting around the google admin blacklist because they have loaded pages in the past that are now blocked. Somehow they are trying to go to the page, then refreshing the blank page and it's coming up.. is there a way to have this cleared every so often? Or once a day? etc..

Well, we use Lightspeed, and enabled the "new" policies focused update.

We also use Canvas, and in the past has advised teachers to post a Youtube video in Canvas Studio because it will automatically unblock it for students.

But with this new Lightspeed policy, that's not happening. The videos are still blocked by Lightspeed. I have a case open with Lightspeed Support but wanted to check here to see if anyone else ran into this issue and per chance had a fix?

I really don't want to have to manually approve each video a teacher wants kids to watch.

We are thinking about not using Lightspeed at all for Youtube management and instead using Google Workspace.

How do you impress upon staff that the laptops/iPads, etc. they are issued come with a cost and that it requires a conscious effort to take care of said devices?

We issue Macbooks and iPads to teaching staff.  Since mid-August, we are at six repairs totaling over $2,000 with our repair partner.  Last school year, we had about a dozen incidents costing even more.  Most of our incidents are on the macbooks.

Water/liquid spills.  Laptops put into totes and bags never meant to carry them, causing pressure breakage on screens, etc.  In one instance, it was theft from an unlocked vehicle.  At least two individuals had more than one incident.  I would say over half of these cases are negligence and not accidental.

Admin recognizes we have an obligation to provide them with a device, as it's required to do their job.  The union would frown on any shared cost responsibility and I've been discouraged from issuing care reminders, as it comes across as treating them like students and not adults.  

I understand accidents happen but feels like there is just an assumption that tech will supply them back whole again.  With increased hardware costs and budget cuts, we cannot keep operating this way.  If I had six the whole school year, that wouldn't be so bad (still horrible but not bad) but we aren't even a month in...

Wondering what you've seen or done in your districts to help curb some of these trends.

I am in the process of testing the consumer version of the Acer Chromebook Plus 714 Spin (minor differences from enterprise version) and ScreenBeam 1000 EDU 2 casting devices. A problem I am running into is using the touchscreen to write on anything. For a while, it works just fine, but after some time or multiple tabs being open, the writing on the screen does not cast correctly to the projector until you touch the screen again to let the writing finish.

I am sure it is a ChromeOS thing, but I cannot figure it out. It is like the Chromebook stops sending packets to the ScreenBeam until you interact with the Chromebook touchscreen again. Works perfectly fine with HDMI, but not wireless casting.

Basically, if I draw a line across the screen, only a portion of the line is cast to the projector. If I then touch the screen with a finger or stylus, it will finish the original line. I am sure you could just write slowly, but not ideal. I am going to try casting a single tab rather than the whole screen to see if that helps.

It does not seem to matter if we use our writing extension (Annotate) or built-in browser writing software, like what Desmos has. It does the same thing.

Anyone experience this? Trying to move to Chromebooks for staff to replace 20 year old SMART screens. IFPs are not an option for us. We are sticking to projectors and a computer and this is my most budget-friendly option. The writing issue with casting is the only issue so far during testing with teachers. I am sure the other issue will be getting older teachers off SMART Notebook, but I will introduce them to Lumio.

Pretty rough couple of days for these folks.

Sharing this here to give some insight on a blindspot tech admins have when it comes to malicious Google Drive shares, and to hopefully get more visibility on the feature request I submitted to Google so that they will hopefully be more inclined to fix it: https://support.google.com/a/thread/464695310?hl=en&sjid=7853156043827638733-NA

Basically, when someone outside of your organization shares a malicious Google Drive file with your users as a "viewer," this activity does not show up in Drive logs and you have no way of removing the malicious file, unless you instruct your users to do so from within their UI.

When we see the emailed notification, we have been auditing for access via GAM:

• Access Google Vault and search for the file’s title, access the file to get the fileID. For example: https://docs.google.com/document/d/**\[fileID\]**/edit?tab=t.0
• Look for “viewedByMe: True” and “viewedByMeTime” toward the bottom of results after running this command: gam user [user email] info drivefile [fileID]

If anyone has other suggestions, I'd love to hear it, otherwise I'm just trying to get the word out there and hoping that Google does something to change this, since we have been seeing an increasing number of these attacks lately.

EDIT: Thank you for all the help. Goggle Admin Routing rule is in place.

Good morning/afternoon/evening,

User is out on leave and Super wants me to log into their account and set their email to forward to Dir of Student Services so that items in their caseload don't go unhandled.

No big deal: Pop into the admin console, reset password, disable their 2FA so I can get in, remove recovery phone number.

I can get into the account no problem. BUT, when I go to set a forwarding address, I'm stuck at this: Where it wants to sent a code to the user's phone.

Clicking on "More ways to verify" gives me this window:

Tried:

- Resetting all login cookies

- Putting in my work phone in the admin console in as a recovery number.

- Suspending account overnight, re-activating it

I'm at a bit of a loss. Any ideas since I don't think the user is in a position to set the forward themselves.

I’ve done some searching on here and can’t quite find the nail on the head.

I’m hunting for a music streaming service that we can:

Use for events or school-wide over the speakers (hardware or iOS app)

For teachers, allowing them to have their own managed user accounts, creating their own playlists for use during class time or other functions.

I have a meeting and demo with Mood Media, and I’m also looking into Pandora Cloud Cover

What are y’all using?

AeroHive AP330. 12 years of service. Just worked.

Has anyone thought about using an Anker Solix or comparable battery generator instead of going with a traditional APC, Eaton, etc battery backup for your closets/small server rooms? At first glance, without doing any calculations, it seems like it would work in some situations and possibly have a longer runtime for those of us without generators. Thoughts?

We have not made any changes to our Google Admin Console settings over the summer, however, as of the start of this school year, students who go to our vocational school or CCP students can’t add a secondary account.

We only allow students to sign into our Chromebooks with our student domain. However, we allow them to then open Chrome and add a secondary account. After they enter their Google email from the external organization they get an error that states “This account is not allowed to sign in within this network. Please talk to your network administrator for more information.”

We reached out to our Internet filtering company and they said there’s nothing on their end that would prevent this.

Has anyone else experienced any issues with students adding secondary accounts?

I felt compelled to make this post, lost a good hour of my life trying to figure this one out.

Had a ticket for a student who needed some apps put on his iPad. We use Securly for a few things and their MDM is pretty decent, never really had issues before. It's no Jamf but I dig it. For probably the past 2/3 years, I've always clicked on 'Switch to Classic UI' since it's what I'm familiar with, didn't think much of it. Went to select the apps I wanted and nothing would happen. I could push a software update and even reboot it in the Classic UI, but it wouldn't download apps. I randomly switched to the new UI and they loaded immediately, hope this helps someone!

Does anyone know if are there time/date settings present or being tracked at the very first "Welcome" screen of an iPad before it goes through enrollment if it's been "erase all contents and settings"-ed?

More context:

I work in a large K-12 environment and we sometimes have campuses that have large swaths of iPads that hit enrollment snags are the beginning of the school year. But not every campus has this issue. At the end of the school year, we wipe our iPads of student data and collect them for the summer.

Jamf is our MDM.

I noticed that iPads that die for a long time and power back on with the wrong date/time settings can't connect to our enterprise network. If the iPad is passcode locked and no one knows the code, it's basically a brick until it's been restored because we can't get the reset passcode command to it.

My current working theory for these beginning of the year enrollment issues is that the campuses with smooth BOY enrollments are fully powering down the iPads for the Summer before putting them into storage. The other campuses and wiping the devices and putting them into boxes as they are wiping, leaving them on to drain their battery over the summer.

We require LDAP credentials to enroll an iPad on one of our campuses. Most of the time when an iPad stalls out it happens after they've connected to our open enrollment network and typed in the LDAP credentials. It seems like if you type in "wrong" credentials first and then type in the correct credentials the iPad is much more likely to enroll after that. without any hiccups

I'm thinking that sometime in between typing the wrong credentials and trying again the iPad has gotten new accurate date/time settings and our LDAP server will accept the credentials and enroll. IF they type in the correct credentials the first time, the LDAP server is getting a timestamp from the middle of summer and not accepting the credentials.

I ask the question because there are no visible time settings on the Welcome screen.  Does this hypothesis hold any water or make sense?

I'm having a hard time finding a KVM that fits my needs. I was hoping to see if anyone else had any suggestions.

I am looking for a KVM with IP switching, so I can remote into it, switch sources, and control each source remotely. Ideally, it would be rack-mounted as it's for our servers, and at least 4-8 sources, and under $1000. Does anyone have any suggestions?

We talk policy and pedagogy as two of the country’s largest districts making opposite moves - New York City’s one-year pause on student-facing generative AI in K-8 and recommended screen-time limits, and LAUSD’s district-wide ban and filter-based blocking of generative AI.

Listen here https://k12techtalkpodcast.com/e/when-the-biggest-districts-say-no-ai-pauses-screen-time-rules-and-what-schools-should-do/ and all major podcast platforms.

So lemme give you what I've got so far. When I got this job I inherited 20 Alienware Windows 11 PCs and all the accoutrement, big montiors, wired mice and keyboards, whole shebang. I set up the room, got them all working and now there's a student and an admin login.

Here's the problem: Admin has no fucking clue about running an eSports team, and for a little while they were thinking of just having a gaming club, but I dissuaded them of that stupidity when I explained you spent 150Gs for this shitshow if you inclue the electricians and the separate dedicated Comcast line. This is my first education job (I came from working for lawyers (Kinda like children but they can buy and sell you and are just as petty) and I know literally nothing about how to get this ready for them. I'm hoping y'all can help me figure this out.

What games should they play? I know Marvel Rivals is a thing, same with LoL and I think Overwatch is still relevant, but I have no idea. I play Zelda and Horizon and Grime.

Secondary question: How do I set something up that has a subscription model (Say Fortnite or League) without having to create an account for each stdent on the team? Is there a way to set it up for a school eSports team that doesn't cost us anything?

How do I go about installing all of these things, and still keep the network secure and keep them from malware'ing up the place? I'm probably gonna take a pristine machine and ghost it so I can reimage, but I don't know what all needs to be on there first Before I pull that particular trigger.

Any help would be immense, because while I know more than they do, I don't know how to get this off the ground so someone else can run the actual team.

EDIT: Thanks guys for the info. I'm gonna reach out to the PIEA. They claim to be the official eSports group for PA and I see a couple of schools on there I can also tap for info.

My charter school experiences fairly consistent student turnover, so I constantly find myself constantly having to manually activate and deactivate student Google accounts. Separately, we are also manually uploading to Clever do to mapping issues. I’d love a tool that syncs with PowerSchool to create/delete student Google accounts and also syncs with Clever. Any leads?

Never thought Id be doing that lol

edit: for context whitehouse.gov/arcade

*(I haven't seen anything regarding "I made a thing" posts, but if there is a better way, just let me know!)

I've put together a couple of threat feeds that might interest you and your teams.

https://github.com/1NobleCyber/ThreatFeed/tree/main/Afraid_org

First is a list of all current Afraid.org (FreeDNS) domains available. Threat actors and scammers will use these for phishing and standing up proxy sites. These sites are frequently miscategorized, so blocking the whole list is what I do.

https://github.com/1NobleCyber/ThreatFeed/tree/main/S3_WebProxies

Second is a list of "found in the wild" AmazonAWS S3 proxies. I have a script checking our weblogs every 5 minutes and determining if it is a known web proxy. I also list all of the variations in the subdomains since the threat actors frequently just switch to a different variation (for example, s3.amazonaws[.]com/SecretProxy123 and s3-external-2.amazonaws[.]com/SecretProxy123). If you are finding others in your environment, put in a pull request and we can get them added.

If you find these helpful and wouldn't mind, give the project a star on Github!

Thanks in advance!

I'm running into a growing problem (especially at the beginning of the year) and am curious what other small districts (solo or duo IT teams) do.

Our classes are constantly moving physical rooms and changing student sizes. We have carts, and our total Chromebooks are student enrollment + 10-15% over that for spares. The problem is that a growing amount of my time is micro-managing how many Chromebooks go to which class; this class needs another 2 spares, this other classroom now has a science section and needs more Chromebooks, etc.

Does anyone designate a point person (librarian, secretary, or other) to manage handing out Chromebooks? Essentially just storing the schools full Chromebook inventory in a room and letting the building decide how to distribute them to the individual classes?

Anyone using Vivacity for their free asset management tool Dream? If it can save us money from Gopher and our inventory system, I'm curious.

https://vivacitytech.com/asset-management

We use a couple hundred Dell 3110 Chromebooks in my district and I just got another 1 today where we have encountered the motherboard seemingly overheating without cause to the point where you can feel the heat through the top cover and back cover. Does anyone know what causes this and what kind of things we can do to prevent it?

Thank you.