quote:
Today I get a call saying I have to pick my Son up from school and the school is recommending expulsion. We have a hearing later this week.

He is being accused of Unauthorized Use of Technology. They are saying numerous files were moved or had permission changes. They couldn't prove it was actually him but said forensic evidence showed it was his login that made these changes.

Produce the empirical evidence he did it, like video tape of him at a computer doing it or GTFO.

quote:
Does anyone know how these systems work? Do they not have screen recorders, wouldn't the files be somewhat protected if they were that valuable, is there anyway to prove that he was the one that actually did it? All they are telling me is it came from his account.

Can there be screen recorders? yes Are there screen recorders? not likely, to expensive and takes up to much space.

Security is only as good as the administrators and software being used. Most likely its a Windows domain situation and most administrators I have dealt with do not understand the difference between Share and NTFS permission. I have seen so many over-permissioned system in my career simply because people do not understand how to issue them properly and they go straight to full control for everyone.

If someone did it on his account, there is no way to prove it was not him, but unless they have time stamp of video matching the audit logs, they have no clue who did it. In these situations, I have the student change the password immediately. I have seen too many administrator mistakes blamed on students in my life. Goes back to that other thread, they do not understand how it happened so your son must be a hacker.

quote:
All they are telling me is it came from his account.

This does not mean shite. Seriously, a good hacker will use someone else's account and they will never even know it. Seriously, I would get serious with these people.

quote:
Right now I can't prove he didn't do it and they couldn't prove to me he did and I think expulsion is a little harsh for his first infraction.

I cannot say for sure, but I would bet more money on some administrator screwing up permissions over some random kid hacking their files. If a high school kid can hack their stuff with modern windows domain security, they are incompetent.

quote:
your son shouldn't have access to serious files. that is a security issue on their end. not your kid's fault. if he hacked into a teacher's account that is another story but the fact is this low level student some how has access to important files that the schools deems for expulsion. you have to hit them with that angle to save your kids life

This is 110% correct MountainDew. Bingo.

Give your kid the benefit of doubt until proven otherwise, I have seen too many students get blamed for incompetent administrators.

If they cannot point to the exploit he "used" to "hack" the system, then this is not an actual hack.

quote:
Expulsion got denied. Back to school tomorrow. Still not happy the way all this went down so about to be visiting the school board so him getting kick out or me with some chrome bracelets is still a possibility.

Thanks for all the suggestions.

Have them produce all audit logs pertaining to the incident. That will include server logs and the logs from the computer where he did it and any other relevant information pertaining to their accusation.

This post was edited on 3/4/22 at 3:50 pm