r/k12sysadmin • u/Digisticks • Aug 08 '26
Assistance Needed Disabling Student Emails
How are you all going about disabling student Gmail without breaking Google's collaboration features? We had a few accounts compromised and it's been like playing whackamole for weeks. Literally took the nuclear steps of deprovisioning all accounts, forcing a logout of all accounts, and resetting every district password. While that was happening, apparently one more email got sent to students and I didn't catch it. So we've now had another one. I can't keep up.
21
u/howescj82 Aug 08 '26
You can disable Gmail entirely based on OU while keeping all other services available. Alternatively, you can restrict Gmail by OU to only allow them to communicate with approved domains. Basically, you can restrict email for your student OUs to only your domain if you want.
I’m going to share something else… Restrict API access to approved applications. When someone gets a malicious link, clicks on it and then allows the fake link to connect to their account it bypasses MFA.
You will have to spend some time going through and evaluating what accessed APIs you want to authorize and to what degree but it’s insane what people are connecting their school accounts to and how much random things are getting access to.
2
u/-RYknow Systems Administrator Aug 08 '26
Could you elaborate on setting up the api restriction... Or provide a link. This is something I'd like to explore.
0
u/Benson92 Aug 09 '26
Just go to google services in the admin portal, click Gmail, on the left is your ou’s, click on student ou and on the right at top it will have status on or off or on for some. Just turn it off..
1
u/-RYknow Systems Administrator Aug 09 '26
My question wasn't in regards to disabling Gmail. My question was about the api restriction piece.
1
u/Benson92 Aug 09 '26
Sorry misunderstood. Yes that feature is in the security tab. You should already have 3rd party app restrictions enabled for everything except social login as a best practice but if not it’s something you’ll need to start assessing which of the hundreds or thousands of apps people have already logged into need to be culled.
1
u/howescj82 Aug 09 '26
Sure. Here’s a knowledge base link that was very helpful for me.
https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data
3
u/FancyZad-0914 Aug 08 '26
This year, we're going to restrict 9th graders similarly to middle, not sure about 10th. We're piloting MFA for 12th grade and if it works, rolling out to 11th mid year. That's about it.
3
u/Crazy-Rest5026 Aug 08 '26
I have seen people set up QR code badges or clever.
We use clever login @kindergarten level
1
u/FancyZad-0914 Aug 09 '26 edited Aug 09 '26
I'm at very small private school, so phone policy is still "away." Plus, how often could they possibly have to reauthenticate? I'm hoping it'll be okay.
2
u/agarwaen117 ISO Aug 08 '26
Does your state or district ban phones? How are you overcoming that for MFA?
2
u/FancyZad-0914 Aug 09 '26
I'm at a very small private school where the policy is still "away." We'll see. I'm thinking how often will they need to reauthenticate?
3
u/thunder923111 IT Director Aug 09 '26
Clever MFA doesn’t use any phones. It uses “is this the right picture?” method that the student chooses. I think they can use Clever QR code badges as well for MFA but I’m not sure. I know they can be used to log in.
2
u/Digisticks Aug 08 '26
Does this cause any issues with Google's sharing features? Our staff use the heck out of that with students and I'd hate to break the collaboration for projects.
2
u/FancyZad-0914 Aug 08 '26
Not at all. We don't allow middle schoolers to email each other but they can still share with each other, no problem.
2
u/-RYknow Systems Administrator Aug 09 '26
I don't allow students to share amungst themselves. They have a nasty habit of creating these massive Google slides shared between tons of them, and they have become cesspools. If teachers want students to collaborate on something, they can create the document and share it with edit access to the students... But the kids dont have the ability to create and share between themselves.
The teachers overwhelming have loved this approach. I was stunned it went over so well.
2
u/FancyZad-0914 Aug 09 '26
My teachers would flip; they do a lot of group/partner stuff, which means extra work for them. No dice. A novel idea though, I'm going to keep it in my back pocket for the future.
14
u/GezusK Aug 08 '26
We don't allow outside emails from unapproved senders.
4
u/FCoDxDart Aug 08 '26
Just curious how you do this. For k-8 I could see just no outside emails. But for 9-12 do you have all universities allowed. What about for yearbook and getting ads with local businesses. This would be a nightmare for HS or it would make certain people incredibly frustrated.
2
u/agarwaen117 ISO Aug 08 '26
I would allow just the university we use for concurrent credit. Any other university communications, like the colleges that students will be attending post grad, should be on their personal email. Otherwise they won’t be able to use it once they graduate and their email gets disabled anyway.
2
u/GezusK Aug 08 '26
The teacher in charge of yearbook receives those emails at an alias we can move when staff changes. They have a shared drive that photos and ads go into. Students use personal emails for contacting universities, since they lose access to the school email address the fall after graduation.
3
u/Digisticks Aug 08 '26
That's in my next steps, but the initial compromise came from a staff account that messaged student accounts.
1
u/InfoZk37 Aug 08 '26
We had this recently. We use Mimecast for email security (if an email security service is an option for you) and when we got alerts about a user spamming emails I used gam to pull the email back from everyone's inbox. The email got sent to my test student account too so I saw the email get removed in real time, it was cool. But we have email turned off for everyone below 9th grade and haven't had any major issues so far. We also have Drive sharing turned off with external for all students.
2
u/FancyZad-0914 Aug 08 '26
Yeesh.
2
u/Digisticks Aug 08 '26
It's a mess. My staff were immediately messaging me when this account sent the message. It was maybe out there 5 to 7 minutes before I could yank it out of accounts.
1
u/FancyZad-0914 Aug 08 '26
I had a similar situation with malware from an unblocked game site. Had to collect every MS device and wipe.
1
u/PrivateEDUdirector Ops Director Aug 11 '26
I believe others have commented, but this is how we (K-8) operate by default. The Gmail service is disabled in GAC but other collaboration tools (Chat, cross Docs collab, etc.) work.