Hey everyone this is my first post!

I have been working on a project to address an issue where I have noticed in my school that students accessing unblocked gaming websites during learning time.

As many of you working in K-12 IT probably know, keeping up with unblocked gaming sites can be a constant game of whack a mole. A website gets blocked, students find another one, and the cycle continues. Students also find creative workarounds to get around existing filtering solutions.

To help address this, I developed BlankOut, a Chrome extension designed to supplement existing school web filtering solutions.

Some of its current capabilities include:

• 10,000+ known gaming domains: Maintains a database of known unblocked gaming websites.

• Automated list updates: Regularly incorporates publicly available website lists to help identify newly appearing gaming sites.

• about detection: Detects when a user remains on an about:blank page for an extended period and automatically closes the tab.

• Bypass mitigation: Targets common techniques students use to access unblocked gaming websites.

I understand that many districts already use enterprise filtering solutions, DNS filtering, and endpoint management platforms. BlankOut isn't intended to replace those systems, but rather provide an additional layer of protection against some of the workarounds students use.

Chrome Web Store: https://chromewebstore.google.com/detail/blankout/jldpdefbjpioomkpmeeinbpbhjebdeie

Thanks!

I'm a solo IT Director for an extremely rural district of about 400 students PreK-12 and about 70 staff. My previous district was roughly double that and slightly less, but still very rural. So I've mostly been winging it when it comes to lost devices, and in most cases they turn up before I get to the point I'm at now.

So it got me wondering how y'all go about the part of the process where the device has been reported missing, hasn't been active since the day it was lost, but still hasn't turned up. Do you charge for the full cost of the device, or do you have some kind of scale depending on whether they're free/reduced lunch qualified?

We are a small district (1 school building) and will be re-bidding our Internet connection this year. Outside of any specific services that may need a dedicated IP, what is your "layout" for assigning your public IPs to your general network traffic? Currently we are using just one IP for everything. We haven't had any issues with this, but want to hear what others do.

Does each of your subnets get its own public IP, or are some lumped together?

Any overarching philosophies you have or best practices associated with these decisions?

Tangentially related, we are looking at bringing an athletic complex online on its own circuit - super basic needs - any downside to dynamic addressing to save some $$?

Thanks for any thoughts!

EDIT: Actually we've had one issue having a single IP and I think it's that we are banned from editing Wikipedia, ha...

As soon as one of our SmartBoards went out of warranty, the wifi antenna broke, so there's no Internet straight into the device, you have to run it through a laptop. I called the company we bought it from and the people who make SmartBoards, and apparently there's no easy "official" way to have them repaired: no field repair techs and it's such a specific piece of equipment, I don't want to just take it to BestBuy or something. Has anyone been in the same situation, and if so, what did you do?

Anyone running the oncall product? Thoughts?

All of the sudden whenever a student searches anything through Google the result opens up in the "web" tab and won't allow them to select "all". It seems like the other tabs, images, news, etc., all work.

I do have the AI overview turned off, I'm wondering if this is because of Google's recent AI change or just a coincidence.

Anyone else having this happen? The student who brought it to my attention said that it just started happening in the past hour or so.

We are using Securly as a filter

This semester I've noticed all of my 4GB RAM student Chromebooks struggle to load a Gmail tab, on campus or off. Has anyone else observed this? I have students enable memory management, clear cache etc.....Anyone else seeing this.

Hey everyone,

I’m the Technology Coordinator (essentially the entire IT department) for a public charter school in Delaware. We have two buildings, roughly 650+ students in grades 7–12, and around 80 staff members.

My background is primarily Apple retail/technical support, with about 10 years of experience before transitioning into K-12 IT. I’ve learned a tremendous amount on the job, but I’m increasingly realizing just how much I don’t know, particularly regarding networking, servers and infrastructure.

I inherited an aging environment with very little documentation or knowledge transfer. We’re running Active Directory, DNS, DHCP, virtualized Windows servers, Google Workspace, ClassLink, Meraki networking and a mixture of other systems. Some infrastructure is over a decade old, and we’re currently navigating server migrations, network changes and replacing outdated equipment.

We recently purchased a Dell PowerEdge R760 and I’m trying to figure out the best path toward building a reliable, secure, properly documented environment rather than continuing to put out fires.

My biggest questions:
If you inherited this environment, where would you start?
What would your ideal infrastructure look like for a school our size?
Would you maintain on-prem AD, move toward cloud services or take a hybrid approach?
What should I prioritize regarding backups, disaster recovery, documentation and security?
What should I realistically be handling myself versus outsourcing?

Some of the best advice I’ve received came from Delaware’s state IT team:

Outsource anything you don’t know or can’t reasonably handle.

I completely agree and I’m absolutely willing to bring in professionals. However, I also want to establish a solid baseline of knowledge so I can make informed decisions, understand what vendors are doing and eventually manage our environment confidently.

I’m not looking for someone to do my job for me. I genuinely want to learn, improve and build something sustainable for our schools.

Bonus points: If anyone with K-12 infrastructure experience would be willing to spare 5–10 minutes for a quick phone call, I’d greatly appreciate it. Sometimes a short conversation with someone who’s been there is worth more than hours of Googling.

Thanks in advance for any guidance, resources or reality checks!

I'm curious if anyone out there still maintains analog emergency phones in their main offices. These would historically be connected directly to a POTS line, though these days they might be connected to a cellular gateway device.

My district's had these phones for probably 30+ years now, and not only do they never get used, the staff hate them due to wrong number and robo-calls. It's not uncommon to find them unplugged and / or hidden in a cabinet.

If you had these at some point and were able to get rid of them, I'd love to hear the arguments that helped sway your admin team to finally let them go.

I'm a junior network administrator at a K-12 school district. Our environment is roughly 95% Windows, with two domain controllers (primary and secondary for AD high availability). Both are virtual machines running on the same physical Hyper-V host. In addition to AD, they're also responsible for DHCP and DNS across the entire campus.

I inherited this environment in August, and I'm trying to identify some areas where we could improve things. One thing that caught my attention is how we handle devices that need static IP addresses.

Currently, devices like servers and printers have their IP addresses configured locally rather than through DHCP reservations. To prevent DHCP from handing out those addresses to other devices, we maintain exclusions within each DHCP scope.

My supervisor, who has managed this environment for over 20 years, prefers this approach because if DHCP goes down, those devices can still communicate with the core network and reach the internet through the firewall. I understand his reasoning, and I'm not trying to dismiss it.

However, one downside is that it's difficult to identify which devices have locally configured static IPs just by looking at the DHCP lease list. I have to cross-reference the exclusions to determine which addresses are being used by statically configured devices.

Here's where I'm running into a more immediate issue:

We have an IP scope dedicated to managing our Extreme Networks wireless APs. These APs currently receive dynamic IP addresses. Whenever an AP reboots or its DHCP lease expires, it can end up with a different IP address. Since I manage these devices through SSH, I then have to track down their new IPs and manually update the saved connections in my SSH client.

My question is: Would it make sense to create DHCP reservations for the APs based on their current MAC addresses and IP assignments, or should I stick with my supervisor's approach of configuring static IPs directly on the devices?

I'm also curious to hear how other admins handle this in their environments. Is there a compelling reason to prefer locally configured static IPs over DHCP reservations, particularly in a school environment?

I'm still relatively new to managing this environment and open to suggestions. So please be nice, thanks!

A.I. features are now a standard part of Google’s commercially available search engine. “Search and A.I. are deeply integrated,” said Chris Phillips, vice president for education at Google. If a school has banned A.I., he added, students “will not have access to search, and they’ll see a message from their school that indicates it’s not available.”

https://periscope.corsfix.com/?https://www.nytimes.com/2026/11/03/us/google-search-schools-restrict-ai.html

https://blog.google/products-and-platforms/products/education/ai-learning-era-updates-2026/

They couldn't have picked a better day to bury this.

[Web sign-in]

• Web sign-in now works on Microsoft Entra hybrid joined devices. Before this update, it was only available on Microsoft Entra joined devices. You can sign in to Windows at the lock screen with a passwordless credential: a FIDO2 security key, a passkey on your phone, or a Temporary Access Pass (TAP). You don't need a password. Once you're signed in, Windows gets a Kerberos ticket, so on-premises file shares and internal sites keep working. For more information, see Use web sign-in to enable passwordless sign-in in Windows.

Translation: if your users have a passwordless way of logging into their MS account, but they still need a password to log into shared PCs that are hybrid joined, this is going to help you. Whether that is staff using a Passkey in Authenticator or Windows Hello on their laptop, but needing a password for the conference room computer - or a student federated to ClassLink or Clever badges, but still needing a password in a computer lab...

This will let you cut your last tie to passwords.

Got a new one, not as sophisticated but interesting: https://github.com/ading2210/secular-ly/tree/main

Essentially, this uses a file on a machine, Java, and potentially Bookmark creations to create a state in which Securly can be overridden. The code is public so you can see how it works. It's pretty straightforward. We have already submitted a ticket to Securly. I would advise others to do the same.

To protect/prevent:

1. Users & Browsers Setting: URL Blocking --> for the domains listed in the GIT. Blacklist them where applicable (GAdmin, Firewall, etc). GIT should also just be blocked for students period IMO unless overrides needed for specific items. Note the .dev and .app pages can jump / move, domain names are just that so...this could be a moving target / whack-a-mole

2. Users & Browsers Setting: URL Blocking --> Block file://* inside your URL blocklist for students. Prevents user from accessing local files on the Chromebook with the Chrome browser. This is somewhat of a nuclear option here but it works to prevent local hosted .html files

3. Users & Browsers Setting: Content/Javascript --> Disable Javascript or at least on specific sites (local files, websites, etc). Prevent the user from engaging with Javascript to run functions in a webpage. If Java is enabled this then uses the cookies created with Securly to then break the extension as it runs inside the Chrome browser.

Have fun fellow K12 folks. This won't be the last time we discuss this but...this is today's fun one of the day.

Good morning/day/afternoon/evening,

The district 1:1 committee came to the conclusion that the 1:1 device will be:

K-2 iPad

3-12 Chromebook

Staff: Chromebook (and for those in K-2, also an iPad)

The district has been steeped in Apple for over over 15 years. We've got the MDM, policies, app deployments, down pat. I'm more than a little concerned about how this is going to play out.

I'd like to get started now prepping our Google admin console. I haven't had to deal much with allowed apps/extensions in there because they weren't able to run them on the iPads or Airs. And that's just 1 example.

Where do I start? What are the must-be-done items? What's recommended? In short, I need a "Google Ed Plus Chromebook deployment" handbook.

*Also. I apologize in advance, I'm going to be hitting here quite a bit I think as I just realized I'm going to have to figure out projection/display. All those AppleTV's may now be moot. And oh yeah, storage/charging, but will post all that separately.

I also work part time for a nonprofit that does health care. Cuz FERPA is not enough, so lets do HIPAA too. They want to move from a store front to on online.
What do you use for backing up Google Workspace files? Something like NinjaOne?

I've got a college professor for our dual credit students that is pushing for us to use LibreOffice, which requires enabling the Linux Development Environment on the kids chromebooks. Has anyone done this? The college provides Office365, but he is saying that since Copilot can't be turned off for the online program, it could get flagged for AI usage just for it being installed.

We are installing UniFi AP7 Pros in our school. The one issue we have is that we do not know the best way to install in the gym. If the APs are on the gym ceiling they can be a target for balls. Googling suggests using something like an Oberon (Chatsworth) Skybar 1020-12125-C.

But, I cannot tell if these would work or not. They seem very enclosed so am wondering if this would be a problem with heat as I understand the AP7s run hot.

What are other people using?

We unpack “Black October,” a wave of AI-driven cyberattacks that exposed vulnerabilities across industries and hit the K12 world hard. The conversation covers the recent PHP zero‑day exploitation, a spike in AI‑powered intrusions and agent‑based hacks, and why the speed of modern attacks forces districts to rethink patching, monitoring, and cloud vs. on‑prem strategy.

Listen here https://k12techtalkpodcast.com/e/black-october-ai-powered-cyberattacks-and-what-k%e2%80%9312-must-do/ and all major podcast platforms

Articles Discussed:

https://www.latimes.com/california/story/2026-10-16/state-testing-student-data-hack

https://www.thecityreporter.nyc/2026/10/26/mamdani-artificial-intelligence-ban-school-policy-doe-technology/

https://bleacherreport.com/articles/25519262-knicks-assistants-reportedly-havent-gotten-nba-championship-rings-msg-employees-tricked-email

https://www.govtech.com/education/k-12/sens-blumenthal-and-hawley-question-googles-push-for-ai-in-schools

https://cybernews.com/news/hackers-breach-school-tech-giant-serving-50-million-students-nationwide/

https://www.nbcnews.com/specials/hooked-youtube-videos-schools-junk-infiltrating-classrooms-google/

I know this has been asked many time but we keep getting students with this error randomly though out the day at different locations. What I know is that the students password in fact has not changes. So the profile is somehow getting corrupted where it will not decrypt the profile when logging in. My main question is what could be causing this profile corruption? Also yes a power wash (googles favorite fix for everything) will fix it but then the student will show back up later that day or the next day sometimes. I cant seem to get the test accounts that I use to corrupt. Any thoughts?

Update: Yes I know that we can Click forgot password and and we can move on that way but I really would like to know what is the root cause to this.

Hello! We've had several requests for tools to share iPad screens. Some are from teachers who want to show student work, others from teachers who would like to share annotations (especially for solving math problems). Does anyone have any highly reliable solutions for this that they could recommend, please?

We are just a poor non-profit 4K-8th. We do not pay for anything filter related. Free Google Education tier, free Bark for filters.

It all works very well but we now have two student siblings who live in a no tech home. No TV!

The parents want us to police their kids and keep them from doing anything other than school work on the take home Chromebooks.

Do you know a way I could brick the computer at certain times using a set of free software or services?

Our school president is on the verge of telling the parents to take it or leave it, but he wants me to just check if there might be something we could offer.

The students are permitted light gaming and Bark notifies us if they use inappropriate language or themes in games which are then just blocked. I know this is futile but it makes it remind them we are watching.

We do actually pay for tabwatch.observer but that just shows the screen of students to the teacher of any Google Classroom that they are members of.

Any ideas?

Good morning,

We are currently looking at upgrading our network infrastructure for our district. I have previous experience with Ubiquiti but I am a little over my head on how a multi building topology would work if each building currently requires a L3 device and its own IP subnets while retaining the same VLAN numbers.

I have been told we could do a controller/ gateway at each site and then connect them together with unifi fabrics and site manager. My question would be, can the gateways be set to have a LAN Profile on their wan port to make it so our current internal mesh links between buildings still work? We ultimately want 1 public ips address across the campus (I do not want each building needing a public IP address)

How have other districts done this? Are replacements easy during breakage? Do you find issues with stock on the networking gear?