Google Apps & Chromebooks for Education Deployment Best Practices

Transcription

1 Google Apps & Chromebooks for Education Deployment Best Practices February 3, 2016 Edward / google.com/+edwarddoan

2

3 Topics Google Apps for Education Chromebooks for Education Chrome Device Management

4 Google HEX 3369e8 eeb d50f25 RGB HEX 75787B 4285F4 RGB Google F23A35 for WorkE4A Greys 0F9D Why Drive? Google Apps Configuration HEX e6e6e RGB b1b1b1 d4d4d4 e9e9e Google confidential Do not distribute

5 Domains & Organization Units company.com Google Apps Account company.com Primary Domain company.co.uk Domain Alias subsidiary.com Secondary Domain User Accounts & Nicknames

6 Recommended OU Structure

7 How Google Apps Directory Sync Works Google Apps Directory Sync is a one-way sync: 1. Queries your LDAP server 2. Queries your Google Apps account 3. Compares the two lists and generates list of changes 4. Updates Google Apps to match your LDAP settings Customer Data: accounts LDAP Queries Responses SSL Updates Firewall Queries Directory Sync Responses Port: 389

8 Google Apps Directory Sync Tool Synchronizes your Google Apps user accounts to match the user data in your LDAP server. Supports sophisticated rules for custom mapping of users, groups, non-employee contacts, rich user profiles, aliases, calendar resources, and exceptions. Performs a one-way synchronization. Data on your LDAP server is never updated or altered. Runs as utility in your server environment. No machine outside your perimeter accesses your LDAP directory server data. Ability to test your sync before deployment

9 Google Apps Directory Sync Tool

10 Google Apps Password Sync Installs on each domain controller in your environment Enable the provisioning API User's mail attribute must be populated with the same address used for the user's Google Account All passwords must be reset once installed before they will sync to Google Apps

11 Key Lessons OU Structure needs to support service & policy settings i.e. OUs broken down per school rather than Staff/Students. Provisioning methods need to provide granular structure or groups Use GADS to translate to supportive structure Have an effective account life cycle process

12 Google Groups Best Practices Naming Group names do not support symbols or special characters Display name should be descriptive of the actual group use User Managed Groups Allow all employees to create and manage groups available to domain users For large organizations, Google recommends disabling user managed groups All groups are provisioned with a specific set of access rights and features True of all groups created manually, via API or GADS Use the Groups Settings API to change required settings in bulk Core IT and Early Adopter phases should be thought of as coexistence Ensure all groups are setup correctly in legacy system during migration Starting with Early Adopter phase, all mail should be routed via Google When MX records are pointed at Google and groups provisioned, mail cannot easily be routed to the legacy system. Google does not recommend this configuration. Use the Groups Settings API to change required settings in bulk Provisioning Coexistence Mail Routing

13 Provisioning Automation Tools Google Apps Directory Sync - LDAP mapping to Google Apps Google Apps School Directory Sync - Great for syncing groups Google Apps Password Sync - Active Directory password sync Google Apps Manager - Easy access to APIs Clever - SIS Sync

14 Google HEX 3369e8 eeb d50f25 RGB HEX 75787B 4285F4 RGB Google F23A35 for WorkE4A F9D Networking & Why Drive? Mail Routing Greys HEX e6e6e b1b1b1 d4d4d4 e9e9e9 RGB Google confidential Do not distribute

15 Enterprise Network Topology Comparison Moving from a traditional enterprise network topology: MPLS Internet Remote Site Router Proxy Hub Site Router to a cloud-friendly network: Localized Network Services Local Egress Point Internet Centralized Network Services

16 Mail Routing: Early Adopter Co-existence Gmail MX Record Existing AV / SPAM / DLP External Sender (if part of legacy architecture) Routing Rules Legacy / Unknown Users Inbound: Intra-domain: Outbound: Shadow Domain Gmail gmail.yourdomain.com Legacy Mail Server

17 Mail Routing: Go-Live Gmail MX Record External Sender Routing Rules Unknown Users Legacy Mail Server Inbound: Outbound: Gmail

18 Anti-Spam: Sender Policy Framework (SPF) SPF Records Intra-domain mail Outbound mail Inbound mail DNS records identifying mail servers permitted to send on behalf of a domain Google highly recommends implementation for all Google Apps customers DNS txt record = "v=spf1 include:_spf.google.com ~all" Google uses SPF records to determine if messages come from authorized senders SPF records will help ensure your intra-domain mail is not misclassified as spam The recipient message security device can refer to your domain s SPF to determine if the message comes from an authorized mail server Google Apps will refer to the sending domain s SPF records to determine if the message comes from an authorized mail server

19 Anti-spam: Domain Key Identified Mail (DKIM) Benefits Action Items DKIM is a mail validation system designed to detect spoofing Validates that incoming mail is authorized by the sending domain's administrators Adds a digital signature to mail message headers sent from your domain Signing improves spoofing protection for your domain Important: do not use if you route mail through an outbound gateway that modifies messages (e.g. DLP device changes header/body) Generate a domain key for your domain Add the domain key to your domain s DNS records Turn on authentication in the Advanced Tools section of the Admin Console

20 Google HEX 3369e8 eeb d50f25 RGB Google F23A35 for WorkE4A017 HEX 75787B 4285F4 RGB HEX e6e6e RGB Greys 0F9D Migration b1b1b1 d4d4d4 e9e9e Google confidential Do not distribute

21 Let's make a long-term coexistence, they said. It would be fun, they said.

22 Google Apps Migration for Microsoft Exchange (GAMME) You can migrate , contacts, calendar, and Public Folder data from on-premise and hosted Microsoft Exchange to Google Apps, whether you have just a few users or tens of thousands. You can also migrate data from PST files and s from IMAP servers (Novell GroupWise, Cyrus, Dovecot, Courier, SunMail, Zimbra and Gmail) using this tool. Link to Tool

23 Google Apps Data Migration Service Migrate , contacts, and calendar data from Microsoft Exchange or IMAP hosts. Entirely cloud-based, no onpremise migration server Also migrates from another Google Apps domain Link to Tool

24 Chromebooks for Education

25

26 Chromebooks: Best-selling device in K-12 education 69% Less labor to deploy 82% Less teacher time spent troubleshooting 91% 0 hours Less labor to support Addressing virus issues Source: IDC white paper Quantifying the Economic Value of Chromebooks for K-12 Education (updated April 2013)

27 Chrome OS Device Formats bit.ly/chrometimeline

28 Student Assessments

29 Essential Third-Party Tools chromebookinventory Add-on An Edu focused Google Apps consultancy group based in VA. They work with the EdTechTeam to host Google Apps for Education Summits and GAfE technical retreats throughout the world. Check out their GAfE Audit. Chromebook monitoring, filtering, and anti-theft for schools. Usage insights and analytics help schools better understand how their technology is being used, so they can positively influence student behavior. This tool allows you to export and bulk update the key metadata and org units of your managed Chrome devices via a Google Sheet. bit.ly/cbinventory

30 Be on the lookout for... S I S Cloudready replaces Windows/MacOS X with a customized version of Chromium OS, transforming your old computer into a fast, reliable, and easy-to-manage Chrome experience. ASUS Chromebook Flip is a convertible touch Chromebook. Chrome app ecosystem is growing, too -Android developers can now port their app to Chrome. Admins can provision and populate classes on behalf of their teachers, sync SIS with Classroom, and get basic visibility into classes being taught in their domain. Check out Rostersync.

31 Chrome Devices and Management

32 Chrome User Settings Best Practice Set granular policies by OU Pre-install apps Set default pages to load on startup Assign Bookmarks URL blacklist

33 Chrome Extensions & Apps Best Practice Pre-install apps per OU Block apps & extensions Recommend apps

34 Chrome Device Settings Best Practice Restrict sign-in to Forced Re-enrollment Assign Printers Recent Activity Reporting Set up Kiosk Mode

35 Chrome Device Management Best Practice Assigned owner & location Track usage Activation & update status bit.ly/cbinventory

36 Have you also thought about? Admin Console configuration (Security, Compliance, Services) Wireless Coverage Legacy Applications School Policies Insurance Cases

37 Chromebox for signage A more affordable and reliable platform for sharing information and content to remote screens Secure Affordable Flexible Manageable A variety of security features work together to help keep each device free from unwanted tampering Less expensive to buy, deploy and support than other media players Growing ecosystem and support for a wide range of hardware, peripherals and applications Manage one or thousands of devices from one browser-based console

38 Chrome for kiosks Give your administration or visitors the tools and information they need Flexible Affordable Manageable Administer secure online student assessments such as state standardized tests from PARCC & Smarter Balanced Low TCO Manage all devices from a single location Set up and get started in minutes Provide fresh, localized content and differentiated experiences and develop any kind of app for Chrome OS Create single-use (eg check-in) and multiple-use (eg libraries) kiosks Update functionality and content in seconds

39 Questions?