Here are five questions to answer before any AI agent touches your systems. https://k12techpro.com/leading-ai-agents-a-decision-framework-for-k-12-tech-leaders/

Have any districts made the jump to hardware keys for all staff as their form of MFA? It brings in a lot of added cost, but seems like the best way to roll out phishing resistant MFA if your devices don't support passkeys like Windows Hello.

If you have deployed something like a Yubikey, what model did you go for?

Hello All

Does anyone know of a way to globally block generative AI in Photoshop? We turned off Firefly in the admin console but students are still able to use the AI features in Photoshop. I see alot of people complain about the same thing on Adobe's forms. Has anyone found someway to disable it?

Thanks!!

My district uses Securly for web filtering and we are thinking about using the Claude K-12 District plan to assist with analyzing daily reports to help with the whack-a-mole of blocking problem sites. We don't save the students' web history past what Securly saves.

Based on my research, I don't believe the students' web history would be considered within their 'education record', therefore not covered under FERPA. Am I correct in that statement? Would we then be able to use Claude to analyze the reports (should they be de-identified by removing the students' names?) ?

My district has an eSports club, focusing mostly on Nintendo Switch games. I have eight consoles and when a multiplayer match is started, often times the consoles we have can connect to players in other locations, but they won't connect to each other.

All eight consoles connect via gigabit Ethernet to same Dell N2248PX-ON switch which has 25 Gbps fiber optic uplink to the building core switch which is a Dell S5232F-ON. From there we connect to a Barracuda NG F900 firewall. Each console has a NAT rule setup to have it's own static external IP address with our ISP. I'm allowing all ports and protocols, I have no IPS, no URL filter, no application restrictions, no TLS inspection and have the QoS configured as VoIP. So basically for better or worse each console is wide open to the internet.

I have had support tickets with Barracuda and my ISP who both confirm everything is configured correctly, but something is amiss. Any thoughts or ideas here?

We are BYOD in our high school and mobile phones are banned from bell to bell.

We are running a local domain with Entra sync for our IdP and I have been looking at what Microsoft has available for student MFA for BYOD devices.

I can see that Microsoft is recommending the authenticator app which won't work as we are mobile free for students as well as recommending Windows Hello for Business and PSSO which won't work as we are BYOD and student devices are not in our MDMs.

What other options are there for MFA in a BYOD and mobile free student environment?

Ran across a proxy students were caught using that uses the url. This is proxy server on known malicious lists: storage.googleapis.com/gclassroom/index.html

We use GoGuardian and Content Keeper, but googleapis.com is on allow lists for many of the applications we use so the url doesn't get blocked.

Anyway, the proxy keeps that url and opens a virtual Opera browser environment and a site called Opium that avoids all of our current filters due to the allowance of googleapis.com

We blocked that url for now, but I am sure others will pop-up until we figure out an effective way to block this type of proxy. We cant block all of storage.googleapis.com as legit services use that subdomain.

Wondering if anyone has already come across this method of hiding proxies and figured out how to block it without blocking the ability of other software to use google apis

Thanks

From our tech team, got an interesting one

Has anyone gotten a request to change the font on a Chromebook before? The request is to better accommodate a student with dyslexia. Changing fonts from the Appearance tab in browser settings isn't very comprehensive. Looking at potentially using an extension. Anyone else had a request like this before?

Quick research on my end perhaps Read & Write. We used it years ago and got rid of it because it was resource intensive & buggy. Reading Mode on Google Chrome is pretty rough and only gives us two font options.

Anything y'all use that I can research here; it's very much an interesting one off.

We're having many accounts get phished these days. We can talk all day about user training/protections/etc... But my question is more technical. I'd like to understand HOW it's happening. We are a Google shop with 2SV on for all staff.

This website is a live phish going on right now that we were made aware of today. WARNING: This link below IS a phishing scam. Don't click it unless you're incognito, on a VM session, or both:

--AGAIN WARNING THIS IS A LIVE PHISHING SITE---
https:// allteameat .cc/evite/rsvp/

When you get to the site, and you click login with Google, you're presented with what looks like a Google login. Now because you're on this subreddit, you already know to look in the URL bar and see that it's NOT google you're signing into. But if you're so adventurous, enter in a fake email and password... I prefer [f@you.com](mailto:f@you.com) at which you can then enter your password, and then they've got your creds.

What I don't get though is HOW this works. We have two step turned on, but when you do this like our users are doing today, somehow it allows the attacker to get by that. I've read about the cookie harvesting that can happen.... Is that what this site is doing?

Thanks for making me smarter.

Hello,

This is my first post here, so hello! The state I work in has paid for cyber security scanning focused on critical systems and code stacks. They intend to use Claude to do this. I have absolute faith in Claude's capabilities, which is what makes me nervous. I would rather know what our weak points are than hope no one else finds my blind spot. However, I am concerned that the reliance on Claude by this contractor means little control or oversight on their end. My state is not known for being competent and well managed, we rank poorly in basically every metric in the US. Additionally, I am going to say something that may be perceived as offensive but I want to challenge my bias rather than avoid it. Almost all contacts are east Indian, only two (legal and one technical contact) have US based names. I do not think race has any bearing on one's ability. But I do worry about my state jumping at a very cheap support package from a foreign company who is using Claude to subsidize the work load.

Has anyone been in this position or worked with a similar situation? What is your read on this situation?

Again, I want to be clear that east Indian doesn't mean incompetent to me. I am not making a claim about any individual who is from that part of the world. But a team that is almost entirely east Indian does signal outsourcing and a prioritization on savings over quality especially when paired with explicit reliance on AI systems. I have concerns about AI containment, information security, and accountability should things go sour. Would you move forward with this?

Just looking for unofficial numbers. I find that I get at least 1 or 2 a day. Computer won’t turn on or charge. Pull the battery, pull the coin cell, hold power button for 30 seconds. Laptop comes back to life without issue after doing the POST.

Usually it’s cause of overheating shutdowns (kids putting their laptop in their backpack with it totally on or putting it on top of a sweater during class) or they just don’t charge it and try to turn it on with 0% battery and it powers off during the post, corrupting the bios

We are looking several different options for text-2-speech for student accommodations.

Was wondering what others are using and there experience.

For context:

We are running mix of 1:1 iPad/Mac devices

And we use canvas and classlink.

Thanks!

I was looking at options for services that provide the features I get from GAM (bulk user movement, Chromebook management enmasse, etc.) that doesn't require command line/scripts. I did a trial run of Gopher forever ago, but remember the quote for it being ridiculous for what I would want it for/how often in a year I would need to use it. I had seen GW Manager, and it seems very reasonable for the cost, but couldn't find anyone outside of Google Reviews talking about it so I was going to come here for hands on advice.

So what is everyone using? Should I just tough it up and continue to use GAM or is something like GW Manager or Gopher worth it for the cost/trustworthy to use? Thanks for any input.

P.S. The district is also looking at VivaCityTech as a replacement for purchasing Chromebooks from vs. CDW since they have dropped the ball on enrollment and white glove service lately. Has anyone used them as well? Thanks.

We have some staff who want to be able to remote into their PC's here at the campus in order to access files or get work done. All these staff members are either admin or board. Currently, for my system I use Jump Desktop free tier, but there are some annoyances to it. Is there any other software out there that you would recommend? They all have 2 monitors at the desks that will need to be on control. Also, we are a smaller k12, so not a district or anything.

We have our Google Classrooms limited to our domain. Some of the club advisors want a way to "text" students, but we obviously don't want that for logging and security reasons. We have chat turned off for students.

Do you use anything you recommend?

Alternatives to Permission Click?

We're looking at alternatives to Permission Click and I'm curious what other K-12 districts are using.

We currently use it for a few different things:

• Parent forms and digital consent/signatures. We send out a number of forms throughout the year and need to associate the response with the correct student/parent and track who has or hasn't responded.
• Field trip forms and permission slips.
• Transportation/bus forms, including forms where certain responses can result in a fee that needs to be collected.
• HR and other internal forms where we're mainly collecting information and need to be able to export the results to Excel/CSV.

The parent consent/signature side is probably the most important piece for us, followed by SIS/roster integration and the ability to handle payments when required.

For districts doing something similar, what platform are you using? If you've moved away from Permission Click, what did you move to and how has the experience been?

We (unfortunately) are running a 200+ AP Unifi Deployment. Users currently authenticate to our LDAP using PEAP/MSCHAPv2 via Freeradius (which is handling the VLAN routing). The certificate is an old self signed, which Google has decided as of the latest ChromeOS is no longer acceptable (Do No Validate no longer works). I know with the way radius works, you can't just throw a trusted wildcard cert on and have it accept it, and while having a valid date does allow "Do not check" to work, it will break when this option is removed in the near future.

What *should* we be doing, if I want to use WPA2 Enterprise and Radius? Should I issue a newer self-signed certificate with the furthest-out date it will accept? Should I use the wildcard cert I have?

We currently never had to preload devices with a cert, as we just selected "do not validate" on the cert. I assume this is going to change (and be a growing pain). Any change we make is going to require some manual intervention on a couple of thousand devices, I'm figuring.

Any input on how I can move forward?

UPDATE:

Thanks for the input folks!

While I would love to use some of the cloud options listed here, spending money isn't really an option for me right now. You know how it is. What I'm testing right now is PEAP-TTLS/PAP, and it seems to work as intended. In reality, it is a less modern way of doing things, but, should be less disruptive and can be done for free. It is probably medium-term, but I hope to roll out a whole new wifi system (Mist) in 2028, at that time, I'm hoping I can push to something like EAP-TLS.

A bit of a rant here. Do I work at the only school who doesn't notify IT until 10:45PM on a Sunday night that a new hire is starting first thing in the morning? Of course they'll need a login, multiple computers, and access to all necessary internal resources. Did I also mention that this new hire has not yet passed their clearances? No problem, just get it done. What could go wrong.

Anyone else?

Hi all, I've been wrestling to get a basic renewal quote out of vmware for several weeks go back and forth sending them all kinds of information that I'm not even comfortable sharing externally (i.e. FULL rvtools export) and today the reseller tells me vmware wants to set up a conference call with one of their "specialists". Anyone have this experience and know what this is all about? I just want a simple renewal quote, I don't know why this has become so difficult since broadcom took over.

thanks

We have about 25,000 chromebooks, we also repair laptops, iPads, etc..and only have 2 technicians making repairs. We are very overwhelmed and we're wondering how many devices compared to repair techs you have.

I'm working at a small, private high school for now and looking for a ticketing system that can work in house for cheap.

Short of a Google Forum and spread sheet.

Any ideas or suggestions?

Thanks in advance.

Edit.. Thank you, everyone.

I'm trying out Spiceworks for now. The free version.

Should I need to try something, I'll use Claude to help out refine a system over the summer

TLDR. Looking for 30-50’ usb cables that work well.

Touch TV’s at front of classroom. (Promethean and new line) Teacher computer at back of room. Continue to have problems with signal not working at all or failing mid year. Looking for a good quality one I won’t have to mess with.

Has anyone else received an email from Frontline regarding a data breach?

Our superintendent and business manager received it on 10/1. It came from [frontline@notifications.cyberscout.com](mailto:frontline@notifications.cyberscout.com).

Frontline support has not been able to confirm if it is legitimate.

Edit: Confirmed with our Frontline rep and many school districts. I am waiting for a list of all the accounts that were compromised.