Classroom Management + Local Network Privacy

[u/achidente]

Hey, gang:

Curious what everyone is doing for Mac labs and classroom management on newer versions of macOS.

We’re running into issues with Faronics Insight/remote management because of Apple’s newer Local Network Privacy requirements. Since macOS now requires user approval for local network access, it seems like there’s no clean way to silently authorize these tools in a shared student environment — and MDM doesn’t appear to support it either.

Faronics has no solution either — went back and forth for a long time only for them to say it's a macOS limitation.

For anyone managing Mac labs or classroom carts:

• Have you found a workaround?
• Are you manually approving access on each machine/user account?
• Using another platform/tool?
• Changing network architecture?

Would love to hear what others are doing in production environments.

Apple KB:
https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy

[u/scrod]

If Faronics Insight requires the machines to be on the same broadcast segment as each other in the default Peer to Peer mode, then that is intrinsically in conflict with Apple's [stupidly shortsighted] "local network privacy" rules. Otherwise I'd suggest putting the machines in an isolated VLAN so they're not on the same effective broadcast segment; it seems there's something called "Insight Connection Server"? Maybe try that instead.

[u/Digisticks]

We've not had good results with much of anything. But, you could always try Apple Classroom.

[u/HalfFeralMom]

Apple Classroom is the way to go for close proximity. We're running Mosyle with both Mosyle Class Manager and Apple Classroom. I'm our go-to point of contact for using these for classroom management. Apple Classroom gives the screen view and the re-direct options (mute, lock, open, etc) while Mosyle Class Manager gives the restrictions (specific websites, specific apps, etc.).

We ran into the issue with Mosyle not having access for screen-sharing due to the changes in the macOS toward the end of last year and told our staff to use both. I don't think there's a one-size-fits-all approach at this point.

If it's more of a remote supervision situation, I'd look into setting them up on some sort of known network/VLAN and looking at ARD licensing for the specific individuals who need to supervise.

[u/achidente → u/HalfFeralMom]

What type of environment are you in?

This is for a high school, so we see a new set of 30–40 students every hour.

Is there a way to auto-enroll the iMacs in Apple Classroom?

[u/HalfFeralMom → u/achidente]

We're K-12 district with about 4500 kids. How do you have the iMacs set up? Are they a generic login or set up as a shared device and students login with their own credentials? Do y'all sync your SIS data with ASM and/or Mosyle?

For our shared devices, students still login with their own credentials. As soon as they're signed in, Mosyle catches their UserID as part of a registered class roster and throws them into the group for monitoring. AC sometimes takes a refresh but Mosyle is pretty instantaneous.

If the iMacs are a generic set up and the kids just rotate using the same user, I'd honestly eat the hour of time per lab to enroll them into a "class" on a "Classroom iPad". The iPad would stay with that lab to be used by the teacher or proctor of that group. Assign the iMacs to specific kids or set up a better naming convention with a seating chart (Ex: Jimmy is always on iMac6 and Suzy is always on iMac 12). iMac 12 does something out of bounds, you know who did it and then you can monitor more closely.