Charlotte-Mecklenburg Schools located in Charlotte, NC, is one of the nation’s largest school districts. They are in the midst of a massive and aggressive migration to Microsoft’s Active Directory and Windows XP. Their goal as a technologically progressive district was to provide students with the best technology available to assure an affective learning environment. As a continuing effort to provide the best environment possible, Charlotte-Mecklenburg wanted to invest in additional tools and software that would provide them the environment they needed to better secure the network and yet meet the requirements and demands of their customers.

Issues Needing Attention

• Elimination of application logons for students
• Controlling applications that are presented to students and teachers
• Better access management regarding shared resources – drives and printers
• More secure and robust script environment

To improve this situation, Charlotte-Mecklenburg School District implemented Version3 Simple Sign-On. Version3 Simple Sign-On V2.0 provided Charlotte-Mecklenburg Schools with the tools necessary to address each of these issues and more.

Background
Charlotte-Mecklenburg School District is made up of approximately 150 schools in Charlotte, NC. It is one of the largest districts in the state of North Carolina. These schools range from kindergarten – 12th grade, as well as special needs schools, with approximately 122,000 students and 15,000 teachers and administrators. The district also has approximately 20,000 workstations and 9,000 network printers that need to be managed.

Solution: Active Directory integrated access management
Charlotte-Mecklenburg Schools chose a solution that would integrate into their new Active Directory environment, as well as, not require any new hardware to implement. The solution that was chosen was Version3 Simple Sign-On. Version3 Simple Sign-On provides a suite of Active Directory integrated features.

Simple Sign-On Feature Set

• Identity Management – Desktop and Web SSO
  • Support both Desktop and Portal/Web Single Sign-On
  • Windows, Web, Thin Client, and Host-based
  • Aliasing/Impersonation capabilities
  • Secondary / Multifactor Authentication
• Application Publishing
  • Publish any application anywhere on the computer
  • Publish both managed and non-managed applications
  • Connection Management
  • Connect to network resources – Shared Drives and Printers
• Application Monitor
  • Audit/Log application usage
  • Respond to Events
• Other Supported Features
  • Automated Password Change
  • Kiosk – public access machines
  • Self-Service – users can change own passwords
  • Provisioning – extend to provisioning solutions

Easiest of Installations
Charlotte-Mecklenburg implemented Version3 Simple Sign-On utilizing many of the components listed above. Version3 Simple Sign-On has a very simple initial install to extend the Active Directory schema. Once installed, management of the product is accomplished using the standard Active Directory Users and Computers console with a minimal Simple Sign-On component installed to expose the Simple Sign-On extensions. The client install is simply a single file install and can be deployed using many basic software deployment tools utilized in most organizations today. Version3 provided Charlotte-Mecklenburg with a tool called the Simple Sign-On Client Launcher to dynamically install and update the client during the logon process. This eliminated any issues regarding deploying the client to the many thousands of workstations that Charlotte-Mecklenburg has to work with.

Benefits to Charlotte-Mecklenburg Schools

Benefit #1: Elimination of Application Logons for Students
Charlotte-Mecklenburg saw the issue of application logons as deterrent to student productivity and a point of frustration for teachers and staff. For that reason, they saw that issue as the highest priority to fix. Simple Sign-On provided Charlotte-Mecklenburg with the ability to continue utilizing their investment in Active Directory without adding additional hardware to their environment. Simple Sign-On now automates the logon processes for windows and web based applications thousands of times a day for thousands of students across the district. There is now a noticeable and verifiable affect on how the students use these applications and how teachers can spend their time in the classroom.

Benefit #2: Controlling Applications Presented to the Students and Teachers
Charlotte-Mecklenburg, with their previous network operating system, was able to limit the applications presented to the students. They wanted that same functionality in their new environment, but knew that Active Directory alone was not going to meet their needs. Simple Sign-On provides Charlotte-Mecklenburg with the ability to combine the power of Active Directory group policies with Simple Sign-On Application Publishing. Group policies are used to restrict the student desktop and redirect the start menu and Simple Sign-On is used to build a completely customizable and dynamic menu. Only the applications that the users have permissions to use and those that exist on the computers are presented to the students and teachers.

Benefit #3: Better Access Management for Printer and Drive Shares
Charlotte-Mecklenburg originally used complex logon scripts for the configuration of drive mappings and shared printer connections, but with the shear number of sites and devices, they realized the complexity needed a new method of control. Simple Sign-On provides the ability to manage connections to drive shares and printer shares via the Active Directory Users and Computers console. Charlotte-Mecklenburg chose to configure drive mappings based on user group memberships for the school and configure printer connections based on the workstations. Also, Charlotte-Mecklenburg has a combination of Lexmark and Hewlett-Packard printers. The Lexmark printers required administrative rights to install the printer drivers and in the past required some administrative user intervention. Simple Sign-On not only manages the connection to the printers, but also provides a feature to install printer drivers as an administrative account without user knowledge or intervention.

Benefit #4: More secure and robust scripting environment
Simple Sign-On eliminates the need for most logon scripts, but there are instances when scripting is required. Charlotte-Mecklenburg has found that the best way to make some changes to application configuration is by the use of a logon script. Simple Sign-On provides a very robust scripting environment that utilizes standard scripting technologies including VBScript, JavaScript, and Auto-It. They were also told that others could be added such as Kix32 and Perl. Charlotte-Mecklenburg now uses these scripting tools to make necessary changes and fixes to application and workstation settings. If these changes require administrative rights, Simple Sign-On can do that too.

Delegation of Task
Charlotte-Mecklenburg chooses to delegate basic network administrative task to technical contacts within the individual schools using Active Directory delegation and permissions. They also required that this extend to Simple Sign-On features as well. Since Simple Sign-On is integrated into Active Directory, it adheres to Active Directory delegation rules as well as providing Simple Sign-On unique delegation techniques. This allows Simple Sign-On to meet the requirements from Charlotte-Mecklenburg in allowing the local technical contacts to manage their users and resources effectively and in a comprehensive manner.

Summary
Charlotte-Mecklenburg School District continues to implement Version3 Simple Sign-On in all schools deploying Windows 2003 server and Windows XP desktops. Simple Sign-On has not only saved time and money, but has also helped the school to more fully take advantage of their new environment. The school continues to find ways to utilize the features of the product and to take better advantage of their investment.

Download the Case Study!