Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
352

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child. There are privacy issues. Security issues. Potentially legal issues - is the software ...


145

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they need admin access, but I would want to revoke that access once they were done. I would want to know the list of everything they want to install, and if they ...


137

I wouldn't. You have no real way to tell exactly what they've changed. Some schools are excessively nosy or controlling. And even if the district is being respectful of your privacy, they could have a rogue admin in their ranks. Others have been bitten. There have been lawsuits because of blatant misconduct before. They have alternatives, so ...


66

Others have already stated why this is a bad idea and I fully agree, don't let them install those stuff (certificates??, no way), now, you don't have to be that parent if you present some options: Multi-booting: this way your kid can have a school OS and a home OS, he just need to let them install all the stuff on the school OS and remember not to do any ...


41

Under these circumstances, the ideal case is simple. Get a "burner" laptop for schoolwork only. Use standard tech and low specs suitable for the work at hand (contact their IT dept to find out what they feel is suitable) and let the school do whatever they want with it. The burner should cost at most a few hundred dollars and save a lot of hassle. If your ...


35

Now the school IT department wants to install some software on the laptop and is asking for administrative access. The school does it because it's easy for them. Lots of parents are computer illiterate and asking every parents to review and install software every time they needed to and keeping all of them up to date is very laborious. I feel that on ...


34

From a sysadmins point of view: They want to install Office, Outlook, an AV and some site certificates. If you already have an AV installed, (which you should), then another AV will conflict with yours and be a larger threat to your child's computer. Do a Google search for: "multiple antivirus installed" and you'll see why it's bad. As for the ...


16

Let's break this down: Your concerns as a parent Privacy: You don't want school staff being able to view what sites your kid is visiting, what files they have on their laptop, and other things that would come with admin access. Security: You don't really trust the school having the ability to install software; you're worried about viruses getting onto the ...


14

I don't think anyone else has discussed the certificate issue: In my experience, a lot of schools use a MITM firewall to intercept HTTP traffic for their filtering policies such as to look at the content of the page. This is a problem for HTTPS because they have to replace the certificate with their own - which is probably what they want to install. See ...


13

I'm going to provide a situation that I have experience with, and then draw parallels. I am a Software Engineer, and have worked at several shops with a BYOD (bring your own device) mentality. Each of these shops had their own security practices and software requirements that devices were expected to follow, and it was understood that IT would periodically ...


13

Both a burner laptop and a virtual machine are respectable options. Multiboot is not, as any time the hostile os is running it can modify the clean os, with beyond-admin privileges. I feel like virtual machine might be superior in more regards than simple cost: The child might benefit from being able to use a better laptop at school. I am talking about ...


12

Should I let my child's school have access to my kid's personal laptop? No. My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. No. The school can bulk buy books, stationary, tools and computers at a discount and tax free. How is it cheaper or better for each parent to know: what to buy, where to go, how to ...


10

Big No! While most everything has been covered, there is still the issue of child safety. Every year there are multiple lawsuits about schools spying on kids through their webcams. While you might think that they won't be able to do that with what they plan on installing, there is a good chance that the AV will allow them to. Take this case for instance: ...


9

To add to the others: Have a look at the list: They want to install Office, Outlook, an AV and some site certificates. Why? Installing Office means teaching a dependency on a big vendor early. The teachers themself should teach in a way, that it works in libreoffice as well or even other office programs. Most things done in schools do not use the ...


8

There are a number of special groups in Windows. Included among these are Authenticated Users, Interactive Users, Everyone, etc. These days, Everyone and Authenticated Users are effectively equivalent for most purposes, but if you had a pre-2003 domain level domain that would not be true. In any event, there is no way to observe the membership of these ...


7

You are right, just giving permissions to each user that needs them only ocasionally is not a good option. Sharing privileged accounts isn´t an option too. Since you did not specified your environment, I will provide two answers: Linux/*nix You could give each administrator the option to escalate to a higher privilege level on his operational account. ...


7

(Warning: here I am making some "educated guesswork", notably by analogy with what happens in other operating systems.) The behaviour you describe is normal: a .NET executable is actually a kind of script. From the point of view of the operating system kernel, there is no ".NET". The kernel knows of executable files. For the kernel, a file can be accessed ...


7

To minimize your hassle, I suggest you inquire about minimum specs and buy your child a "work" laptop to be used only for school. Then you just let them do whatever they want. Then the school is at fault for any problems and you have no further work with it. If you are budget strapped, then the next best solution which still gives you complete separation ...


6

If I were a parent, I would firmly say no to this. This is mainly because the laptop is paid by the parent. You should have control over what you buy, and I believe that it is already pushing it to require every parent to purchase a laptop for their child and have them bring it to school (especially if you believe that technology doesn't benefit learning). ...


5

SSL will usually not help. If the attacker has complete control over the computer, then he wins. He can inspect and modify the memory of all process in the computer. If the attacker is only a non-administrative user, then he won't be able to spy on process from other users. However, if the attacker can run code as the same user as either the server or the ...


5

There's nothing you can do with cmd that you can't do with any other program, except run cmd. This will actually break some malware that specifically tries to invoke cmd without having fallbacks to other shells, but it will also break some legit software that uses functions such as system or otherwise spawns cmd processes. In general, cmd isn't a well-...


4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (...


4

While many answers here outline potential dangers arising from giving someone admin access, it should also be noted that it's also a reasonable tool for the job the school IT is about to do. That's what I would request from parents if I were to do it, since explaining how to properly configure their own system would be a dead end. 80% of them wouldn't even ...


3

As long as the user is not a local administrator on the machine they should not have permission to kill any processes run as other users (including domain administrators). However unless you have an unusual physical setup the user can always kill the process with the power button or physically removing the power supply. I would suggest additionally your ...


3

My opinion is that with correct permissions, in Windows, the separation of partitions does not increase security because what is most important are the permissions and the separation of the partitions do nothing. You are quite right. Malware is not concerned with partitions, although I recall a few that do. Partitions are just a division of space that ...


3

Technically speaking there is very little risk in running an insecure VM on a secure machine IF that VM does not have network access (after all this is how you research malware). If it does have network access then you've essentially just circumvented all security safeguards. From a security perspective, assume that your VM will be insecure and thus full ...


3

The school "needs to install certificates"? That definitely is a red flag. As for installing Office, I would say install a copy on the computer for him rather than let the school do it. While some schools do offer this service (the community college does offer free access to Microsoft Office 365 which can be accessed online although using the apps would be ...


2

Authenticated users means exactly that - any and all users which have authenticated to the system. That would be any user that is a member of any group on your local system. Since Mike is a member of users he is inherently an authenticated user. In a domain environment this would be any user that is a member of any group on the domain.


2

If you're assuming that the malware is running as a UAC limited user, then you should assume that it has the capability to escalate itself to administrator. Privesc on Windows is trivial, since you can just trick the user into thinking a legit software update operation is occurring and they'll almost always accept the escalation prompt. There are many other ...


2

All Admin accounts need to be careful about what they run. The rule of thumb is to only run executables that have been vetted, and not to browse the Internet, if at all possible. Disabling 'Public Folders' is not a solution, but merely a small measure towards the standard practice the Admin should be using.


Only top voted, non community-wiki answers of a minimum length are eligible