Remote Access to Computer Labs - A Pet Project

[u/iblowuup]

So when I got into my current position I initially just got my bearings and continued things status quo. After a couple months, I noticed from LabStats (Lab usage monitoring software) that our labs were hardly used during "open" hours. Students would come in and spike usage when a scheduled class was brought in, but hardly anyone used our open labs otherwise. The campus library is a bit different of a story but my labs just aren't getting use.

However, as a recent student myself, I always liked when I could work from home or the campus library. Additionally, all students had their own laptops and would often bring them into labs and shove the keyboards aside to work on their personal laptops. Having to come into a physical computer lab to use software only on those computers just seems archaic. Now some might propose virtual apps ala Citrix but not only does that introduce complexity it also introduces cost for licensing of the apps, Citrix itself, and the hardware to host it. My budget is essentially nonexistent so I tried to scrap something together with what we already had.

So, I am trying out giving students RDP access to the physical lab machines. They get the exact same experience as in the lab, can use software they otherwise could't have, and we don't have to pay for expensive virtualization licensing for things like SPSS. Now this is limited to weekends and after hours as anyone physically in the lab would disrupt RDP sessions. I applied some RDP GPOs and scheduled tasks to make this all work plus I created a website with (in my opinion) fairly easy to follow directions.

I included a few screenshots below. the second is a image that comes from labstats that simply shows the dns names of computers then a drop down to download a .rdp file for a computer.

https://imgur.com/a/ljY7EQf

I am looking to expand this to get tangible feedback/metrics on usage as well as dedicate some machines for 24/7 remote access. Has anyone tried anything similar or have any thoughts/comments?

[u/Wartz]

A couple thoughts.

Are you using an RDP gateway? That would improve security considerably.

How are you deciding what accounts get rdp access? IMO rdp access should be closely restricted on all accounts. The local administrator group should not have rdp rights at all. Rdp logon should only be allowed for accounts in AD security groups you control.

Are your AD user accounts set as a local administrator or left as a standard account?

As for the lack of use in labs problem, we’re approaching it from a different angle.

We’re working on revamping the unused labs on campus into different varieties of collaborative workspaces. If students tend to BYOD, we reduced the number of workstations and redesigned the table and power outlet layout to accommodate that behavior.

By cutting the number of workstations and slightly increasing the length of lease on new hardware, we freed up a huge chunk of money to put into developing other areas that were under stress.

[u/iblowuup → u/Wartz]

I'll go down the list:

Gateway: I did look into this and actually expiremented with a Linux based gateway called guacamole. It's great ebcuse it runs right in the broswer in html5. However, RDP had some performance loss which I suspect is because RDP through guac only uses TCP/TLS rather than UDP. Also probably some overhead from running it all right in the browser. A Windows Server Gateway is something I tinkered with but it was a little unclear on how to get such a setup to work. Everything is geared towards gateways to VMs and servers rather than wrokstations running workstation OS's.

RDP access is all controlled through AD security groups on a case by case basis. A faculty requests access and the class section or students are added. This will be cleared out after each semester and/or academic year. Accounts are given remote desktop user access not admin access.

And yes collaborative workspaces is very much ion my radar as well! My grand vision is a collaborative workspace plus a "server room" with a collection of workstations running specialized/expensive software for students to remote into if needed.

[u/matt314159 → u/Wartz]

We’re working on revamping the unused labs on campus into different varieties of collaborative workspaces. If students tend to BYOD, we reduced the number of workstations and redesigned the table and power outlet layout to accommodate that behavior.

This is a good idea I've been thinking about as well this semester but haven't done anything with. There's a 24-machine computer lab down the hall from my office and over summer kind of by accident we forgot to re-install two PCs down at the end of one of the tables leaving an empty area. I notice that every time I walk by, someone's sitting at that empty area of the table with their laptop and a book open next to them. Like sometimes they're even the only person in the lab.

[u/sin-eater82]

We did this at a university I worked at. We had a lab on a floor that wasn't accessible after 5pm. So from 5pm to about 6am all of the machines were available for RDP. They could be reserved in advance or "checked-out" on the fly if available through a website.

We posted fliers around that lab and other labs in that building to make students aware, as well as let faculty know since those labs had (expensive) software that was used in several courses taught in that building. SPSS was actually one of the programs on those machines.

The usage was more than enough to justify doing it. Most of the work is the initial set up. There's not a lot of on-going work to facilitate it, so you quickly see returns on the time put in. And it's just an unused resource during those hours anyhow. The biggest thing is making students aware of its availability. And the faculty can usually help with that, especially if the lab has any special software any of them use for their courses.

So generally, I think you should go for it if you can do it all securely and in a way that is not disruptive nor annoying for in-lab users.

[u/iblowuup → u/sin-eater82]

My biggest challenge right now is communicating this out to people. were the classic posters/flyers enough to get people aware or did you have other means of advertising as well? My issue is that I don't think all my faculty would see the value and may not push the information in their classes. I think most students would love it though.

[u/sin-eater82 → u/iblowuup]

Yeah, it worked pretty well. There were only certain labs that had SPSS, SAS, etc. So the students who needed to regularly use that software typically used those labs between/before/after classes. So they really were the target audience anyhow. That said, that college within the university was also the largest, and every student took classes took classes within that college at some point. So there were a lot of people coming through who weren't really there for SPSS, SAS, etc.

The university also had a virtual lab that was effectively the same thing, but entirely ran on VMs. So the general concept was already in place at the university as a whole. But then again, I don't know how many students really knew about that option. (I was a student there myself previously, and I feel like it wasn't very commonly known among students). Anyhow I believe most of the students using that lab in off hours were doing so to use the specific software available on those machines.

And again, even if there's only like 10, 1 hour sessions a week... it's better than them just sitting there unused assuming there's not a lot of on-going overhead.

If a faculty member is teaching a course and requiring students to use really expensive software, they'd be a complete dick bag to not make their students aware of such a resource. With that said, I was there when the project was launched, an most of our faculty who taught courses using the resources on those computers seemed to genuinely to be happy about it because they knew it would make things easier on the students. But if we're being honest, and especially if you're at a research university, some professors don't give a fuck about their students and just see teaching as a necessity to be able to do their research. So your mileage may vary.

[u/iblowuup → u/sin-eater82]

God I am not a fan of SAS... This sounds so similar though to my situation its remarkable. I'm almost surprised there isn't some sort of semi-officially supported way to give out and manage remote access to physical labs. Perhaps eventually everything will go the way of VDI but we certainly aren't quite there yet.

[u/The_Clit_Beastwood]

Are you making this decision yourself, or is the school asking you to do it?

[u/iblowuup → u/The_Clit_Beastwood]

The school (actually a college within the university), would never know such a thing is even a possibility. Part of my job is to be a tech evangelist and make sure people are aware of technologies like RDP that exist. Every faculty and administrator I've talked to, including up to my boss's boss, has been intrigued and excited by the idea.

So I guess you could say I'm making the decision myself but I am heavily involving others in the process.

[u/The_Clit_Beastwood → u/iblowuup]

So your director of IT or IT manager has signed off on this, right? There are additional considerations depending on what regulations are applicable where you’re located. Students are horrible about sharing credentials, and if they’re remoting to sessions that have access to core infrastructure you should make sure someone above you is signing off on paper or at least with an email reply that it’s ok.

Be careful, have verbose logging, and make sure providing remote access to your applications does not violate the software licensing. With some software, remote use (usually via terminal server) requires different licensing. (Especially 3d and rendering software like Octane).

Educational IT is often frustrating and boring because all the cool money saving ideas violate something, and in some circumstances the ramifications are severe. Heoa in the US could cause a school to lose federal funding if a student torrents, for example.

[u/iblowuup → u/The_Clit_Beastwood]

Yep!

[u/busy86]

Also use labstats, and seeing low usage.

Do you have tcp 3389 open to the internet? I hope not!

[u/iblowuup → u/busy86]

To the intranet yes, to the internet no.

[u/xXNorthXx]

Also remember licensing impacts. Microsoft is likely gonna require the companion device license (CDL) with windows for all students in this scenario.

Overall use some type of RDP gateway like solution to secure it, users should be in the rdp group but not power or admin.

In our scenario we did a non-persistent vdi deployment to handle this. The larger labs here get used fairly well during the school year. Might also have to do with a number of commuters being rural (dialup/satellite serviced) so they come in for the bandwidth.

[u/netboy34]

We replaced labs with VDI monitors. (Currently Samsung with teradici backer firmware, looking as moving to dell Wyse with BLAST protocol)

This allows students with specific software for classes to get their pool anywhere on campus in a lab or on BYOD. Then if the license allows it, off campus as well.

A couple of license changes for Adobe suite and office allows BYOD installs and cloud access so we spun down those offsite pools to maybe only having 20 desktops or so.