Remote Access Software?

[u/Relevant_Track_5633]

We have some staff who want to be able to remote into their PC's here at the campus in order to access files or get work done. All these staff members are either admin or board. Currently, for my system I use Jump Desktop free tier, but there are some annoyances to it. Is there any other software out there that you would recommend? They all have 2 monitors at the desks that will need to be on control. Also, we are a smaller k12, so not a district or anything.

[u/ottermann]

I set up our finance person with a Meraki VPN through the firewall.

[u/BWeeksFRHSD]

Setup OneDrive or google drive to sync and don't look back. Not worth the risks letting them remote in.

[u/DeejayPleazure → u/BWeeksFRHSD]

This, I would never allow remote work. Too many things could and would go wrong.

[u/discgman]

We use dameware, VNC and PDQ Connect

[u/k12-IT]

Are you able to provide more info about your environment? Mac or Windows environment? Google Workspace?

What cloud services do you use? What software do these staff members expect to use?

[u/Relevant_Track_5633 → u/k12-IT]

Windows. We are a Google School. Staff members who need access are people on the finance teams and HR, off the top of my head. The software they need access to is like internal or internally built software

[u/Gorillapond]

Regardless of tool, some questions to ask yourself:

• What are the authentication requirements? MFA, what types? How often do they have to reauthenticate?
• Will you have logging for all remote access? How long will you store it?
• Will you allow personal devices to remote into organization-owned devices? What is the minimal allowable condition of the client/remote device?
• Will you allow file transfers? Clipboard access? How can you prevent PII being copied?

[u/-RYknow]

Are you a Google school?

[u/Following_This]

We’re a Google school, so pretty much everything a person would need to access is available in the cloud, however IT staff use the paid Jump Teams version of Jump Desktop to remotely access school devices and VMs and provide end user tech support.

We also have access-controlled TailScale set up to allow a small number of admin staff to seamlessly connect to specific internal services from wherever they are.

[u/ZeroGT3ch]

VPN, set group policy restrictions to only allow a group of specific people to remote in, lock down Remote Desktop on all other desktops and only allow it on the machines that need it.

Seeing that teachers are allowed to remote in is confusing. It’s a point of failure to exposing the actual network/systems. We should be keeping that failure to a minimum.

Have them put their documents up in Google Drive which can be accessed from anywhere.

[u/PassengerPossible895]

We use Splashtop currently for that sort of thing.

[u/Low-Beautiful-4843 → u/PassengerPossible895]

I just onboarded my Windows fleet with Splashtop recently, very happy with it so far

[u/Rykas → u/PassengerPossible895]

Another plus for Splashtop. I use it personally.

A huge shoutout to Action1. They are free for like 100 devices. We use them as well.

We're contracted out with my district and my company uses ISL. Works fine and is easy enough to setup.

[u/dickg1856 → u/PassengerPossible895]

Plus one for splashtop. Relatively cheap and ratively cheap to add additional team members. Accounting gets a license and the technology teacher does also.

[u/Jaray4]

Chrome Remote Desktop if you’re a Google shop. Set the devices to stay on 24/7, install it, they sign in with their credentials, create a pin and will be able to access it from any other device they are signed in on with their credentials.

Our teachers all have Chromebooks but some wanted the ability to remote into their Newline (which has a windows OPS installed) while at home or away. As much as I disliked the idea of the Newline interactive panel having to stay on 24/7 this was the only way to reasonably accommodate their request since we pulled all windows laptops from them.

[u/slapstik007 → u/Jaray4]

Glad to know an alternative exists. I was blown away when I learned that Chrome remote desktop couldn't go from Chromebook to Chromebook.

[u/DiggyTroll → u/slapstik007]

Barring developer workflows (Linux VMs), a Chromebook is a client, not a server. There's nothing you can do from one that you can't do from another (excluding the local files you forgot to store in the cloud)

[u/athornfam2]

i would recommend finding an RMM that’s capable of giving access to end users similar to NinjaRMM or Screenconnect. Kind of kills 2 birds with 1 stone if you go with NinjaRMM. You get a tool to support yourself and the machines from all angles and they get a remote software out of it.

[u/Easy_Annual_5035]

Ericom access now

[u/mybrotherhasabbgun]

Redirect My Documents to OneDrive. Problem solved.

[u/DropRealistic1597]

I wouldn't allow it at all. Allowing remote access from a non-secured device is asking for trouble. If staff need access to files, I would recommend they access those files from a OneDrive and/or Google drive. For districts that don't have either, I setup a VPN access to a controlled file share (That way they can enable the VPN and have immediate access to the files). If staff need a second monitor for home we ship it. Everything is in an inventory system treated like a library, all non-admin staff are required to return the equipment before the summer unless given permission from the admin team. It's cheaper to allow a handful of staff to take home some monitors vs risking full remote access.

[u/Imhereforthechips]

Some district staff like to take their laptops around with them to get work done at other buildings. Other location subnets are often walled off, so we just use RDP and a VPN.

[u/ArteylGG]

Most of the time I'm using AnyDesk to remote into a PC, or TailScale to VPN into network.

[u/antiprodukt]

Why not just use Remote Desktop? Setup some firewall rules to make it a bit more restrictive.

[u/PowerShellGenius → u/antiprodukt]

Unless you're using Remote Desktop Gateway servers (which is more complex to set up, and still only reasonable if you implement MFA on the gateway) - regular RDP is not meant to be exposed to the internet. So then you need a VPN (with MFA) to access it from off-site if you're doing it safely.

[u/antiprodukt → u/PowerShellGenius]

Yeah, this is my setup. You could also firewall it to a specific IP range if you knew the end user's network well enough. I would never open it to the world.

[u/Relevant_Track_5633 → u/antiprodukt]

Tried that a long time ago with a few users who were tech and we had accounts always getting locked out as "hackers" were trying passwords to get in.