354

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child. There are privacy issues. Security issues. Potentially legal issues - is the software ...


147

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they need admin access, but I would want to revoke that access once they were done. I would want to know the list of everything they want to install, and if they ...


139

I wouldn't. You have no real way to tell exactly what they've changed. Some schools are excessively nosy or controlling. And even if the district is being respectful of your privacy, they could have a rogue admin in their ranks. Others have been bitten. There have been lawsuits because of blatant misconduct before. They have alternatives, so ...


67

Others have already stated why this is a bad idea and I fully agree, don't let them install those stuff (certificates??, no way), now, you don't have to be that parent if you present some options: Multi-booting: this way your kid can have a school OS and a home OS, he just need to let them install all the stuff on the school OS and remember not to do any ...


42

Under these circumstances, the ideal case is simple. Get a "burner" laptop for schoolwork only. Use standard tech and low specs suitable for the work at hand (contact their IT dept to find out what they feel is suitable) and let the school do whatever they want with it. The burner should cost at most a few hundred dollars and save a lot of hassle. If your ...


35

Now the school IT department wants to install some software on the laptop and is asking for administrative access. The school does it because it's easy for them. Lots of parents are computer illiterate and asking every parents to review and install software every time they needed to and keeping all of them up to date is very laborious. I feel that on ...


34

From a sysadmins point of view: They want to install Office, Outlook, an AV and some site certificates. If you already have an AV installed, (which you should), then another AV will conflict with yours and be a larger threat to your child's computer. Do a Google search for: "multiple antivirus installed" and you'll see why it's bad. As for the ...


16

Let's break this down: Your concerns as a parent Privacy: You don't want school staff being able to view what sites your kid is visiting, what files they have on their laptop, and other things that would come with admin access. Security: You don't really trust the school having the ability to install software; you're worried about viruses getting onto the ...


15

I don't think anyone else has discussed the certificate issue: In my experience, a lot of schools use a MITM firewall to intercept HTTP traffic for their filtering policies such as to look at the content of the page. This is a problem for HTTPS because they have to replace the certificate with their own - which is probably what they want to install. See ...


14

I'm going to provide a situation that I have experience with, and then draw parallels. I am a Software Engineer, and have worked at several shops with a BYOD (bring your own device) mentality. Each of these shops had their own security practices and software requirements that devices were expected to follow, and it was understood that IT would periodically ...


13

Should I let my child's school have access to my kid's personal laptop? No. My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. No. The school can bulk buy books, stationary, tools and computers at a discount and tax free. How is it cheaper or better for each parent to know: what to buy, where to go, how to ...


13

Both a burner laptop and a virtual machine are respectable options. Multiboot is not, as any time the hostile os is running it can modify the clean os, with beyond-admin privileges. I feel like virtual machine might be superior in more regards than simple cost: The child might benefit from being able to use a better laptop at school. I am talking about ...


10

Big No! While most everything has been covered, there is still the issue of child safety. Every year there are multiple lawsuits about schools spying on kids through their webcams. While you might think that they won't be able to do that with what they plan on installing, there is a good chance that the AV will allow them to. Take this case for instance: ...


9

To add to the others: Have a look at the list: They want to install Office, Outlook, an AV and some site certificates. Why? Installing Office means teaching a dependency on a big vendor early. The teachers themself should teach in a way, that it works in libreoffice as well or even other office programs. Most things done in schools do not use the ...


7

To minimize your hassle, I suggest you inquire about minimum specs and buy your child a "work" laptop to be used only for school. Then you just let them do whatever they want. Then the school is at fault for any problems and you have no further work with it. If you are budget strapped, then the next best solution which still gives you complete separation ...


6

If I were a parent, I would firmly say no to this. This is mainly because the laptop is paid by the parent. You should have control over what you buy, and I believe that it is already pushing it to require every parent to purchase a laptop for their child and have them bring it to school (especially if you believe that technology doesn't benefit learning). ...


5

There's nothing you can do with cmd that you can't do with any other program, except run cmd. This will actually break some malware that specifically tries to invoke cmd without having fallbacks to other shells, but it will also break some legit software that uses functions such as system or otherwise spawns cmd processes. In general, cmd isn't a well-...


4

While many answers here outline potential dangers arising from giving someone admin access, it should also be noted that it's also a reasonable tool for the job the school IT is about to do. That's what I would request from parents if I were to do it, since explaining how to properly configure their own system would be a dead end. 80% of them wouldn't even ...


3

The school "needs to install certificates"? That definitely is a red flag. As for installing Office, I would say install a copy on the computer for him rather than let the school do it. While some schools do offer this service (the community college does offer free access to Microsoft Office 365 which can be accessed online although using the apps would be ...


2

Generally, binaries can be renamed while they are executing, unless the process (or some other process) explicitly prevents this. Simply rename the binary and then drop a malicious one in with the old name. When the computer reboots (or the service restarts), it'll run your version. Another approach is DLL planting. Find a DLL that the app uses (ideally not ...


2

If anyone wants administrative access to my personal computer, I always require that I acknowledge what they wants to do with that privilege. The degree of detailedness depends on who the person is, and for the IT department of a school, I will demand that I acknowledge the following: What exact softwares, including versions, they're going to install; What ...


2

The only one of those that is even potentially a major risk is starting services, because services run as their own user instead of inheriting the security token of the process that started them. If the service account can launch more-privileged services, especially if any of them take parameters and/or otherwise consume data that the service account can ...


1

These two options have to do with account permissions which relates to file access, network access, and more depending on the policies within an environment. By default in Windows 10, when you launch an application you launch it as a standard user. In some instances, the OS will determine that you need administrative credentials to launch the application ...


1

While psexec or wmiexec (Linux python equivalent) will work, the latest Windows updates do not work with the default installation. This is because the ADMIN$ and C$ shares are not accessible without explicit registry configuration.


1

As already stated in other answers, creating a virtual machine for the school environment may be the optimal answer. It costs nothing in additional hardware, keeps the school environment isolated from the personal environment, allows the child full-time access to the best hardware you can budget, and allows the school to do as they wish with the VM, over ...


1

I would add that the child should be told to only use that computer for school purposes (Don't buy things from it, play games, download stuff, or even really use it with other accounts). After they graduate or if it becomes redundant or replaced, reinstall the original OS (with Windows, there's a wipe-disk option on the install media -- use it) to ensure ...


1

Your trading control for convenience. You should use the laptop only for his school use and nothing else as you have no idea what they will put on it. As there will be nothing personal on it now or in the future, I think over reacting to this situation would be bad. Treat it like a burner phone. It might feel wrong, but would it be any better if they gave ...


1

As you can see, the first argument is the PID of consent.exe's parent process. And by monitoring the APIs that this parent process (which is a "svchost") called before creating the consent process, I was able to find out that the third argument is a pointer to a structure within the svchost's heap, and the second argument is the length of the structure. The ...


Only top voted, non community-wiki answers of a minimum length are eligible