A collection of Windows applications and utilities designed to prepare and manage laptops for incarcerated students. These tools automate the credentialing process, enforce security policies, manage user accounts, and maintain system compliance.
This repository contains several applications that work together to:
- Automate laptop setup and credentialing for student use
- Enforce security policies and firewall rules
- Manage Windows user accounts and permissions
- Monitor system activity and capture screenshots
- Sync data with the Student Management Console (SMC)
- Generate Canvas tokens for LMS integration
The main credentialing application that automates the full student laptop setup workflow.
Key Features:
- Validates operator input and configuration
- Sets firewall rules and security policies
- Creates student Windows user accounts
- Generates Canvas tokens for OPE-LMS integration
- Installs required services and dependencies
- Applies security hardening steps
- Stores configuration in Windows Registry for downstream services
What it does:
- Verifies BIOS lockdown status
- Confirms administrative privileges
- Caches configuration data in registry
- Pulls SMC configuration and validates student account
- Syncs network interface and time settings
- Orchestrates
mgmt.execommands to:- Unlock the machine
- Credential the laptop
- Add Windows Defender exclusions
- Install services
- Relock the device
Usage:
- Configure
credential_config.jsonbefore running - Run as Administrator (right-click → "Run as administrator")
- See credential/README.md for detailed configuration options
Logs: %PROGRAMDATA%\ope\logs\ope-credential.log
A comprehensive command-line management utility that handles system configuration, security enforcement, and maintenance tasks.
Key Features:
- System configuration and setup
- Network interface management (approve/disapprove NICs)
- User account management (create, enable, disable, remove)
- Group Policy and firewall policy management
- Registry and folder permission management
- Process management and monitoring
- System time synchronization
- Credentialing workflow orchestration
- Data synchronization with SMC
Common Commands:
mgmt.exe config- Initial configuration setupmgmt.exe credential- Run credentialing processmgmt.exe sync- Sync with SMC (passwords, logs, work folders)mgmt.exe screen_shot- Capture screenshotmgmt.exe scan_nics- Scan and disable unauthorized network interfacesmgmt.exe apply_group_policy- Apply security lockdown policiesmgmt.exe apply_firewall_policy- Apply firewall rulesmgmt.exe help <command>- Get help for specific commands
Logs: %PROGRAMDATA%\ope\logs\ope-mgmt.log
A Windows service that runs in the background to maintain system security and compliance.
Key Features:
- Monitors USB device connections
- Automatically scans and manages network interfaces
- Enforces security policies on a schedule
- Captures periodic screenshots
- Monitors login events
- Executes scheduled maintenance tasks
- Responds to device events (NIC plug/unplug)
What it does:
- Runs continuously in the background
- Executes
mgmt.execommands on schedule:- Network interface scanning
- Screenshot capture
- Permission resets
- Registry maintenance
- Responds to USB device events
- Monitors for unauthorized network adapters
Installation:
- Installed automatically by
credential.exe - Can be installed manually using
bin\install_service.cmd - Service name:
OPEService
Logs: %PROGRAMDATA%\ope\logs\ope-service.log
A utility for capturing screenshots of the student's desktop for monitoring purposes.
Key Features:
- Captures full desktop screenshots (supports multi-monitor)
- Adds timestamp and user information overlay
- Saves screenshots to
%PROGRAMDATA%\ope\screenshots\ - Can be run manually or scheduled via OPEService
Usage:
- Run directly:
sshot.exe - Called automatically by
mgmt.exe screen_shot - Scheduled by OPEService at configurable intervals
Logs: %PROGRAMDATA%\ope\logs\ope-sshot.log
- Windows 10/11
- Python 3.12 (3.13 not supported yet by Nuitka)
- Administrative privileges
- Network access to SMC server
-
Clone the repository:
git clone https://github.com/open-prison-education/ope-laptop-tools cd ope-laptop-tools
-
Create virtual environment and install dependencies:
python -m venv venv .\venv\Scripts\activate pip install -r modules.txt
-
Configure credential application:
- Edit
credential/credential_config.json - Set SMC URL, admin username, and other required settings
- See credential/README.md for configuration details
- Edit
-
Run credentialing process:
- Right-click
dist\credential\credential.exe→ "Run as administrator" - Or run from source:
python credential\credential.py(as admin)
- Right-click
Use Python 3.12 for all builds (3.13 not supported yet by Nuitka).
Before building, create a Python virtual environment and install all required packages:
python -m venv venv
.\venv\Scripts\activate
pip install -r modules.txtBuild mgmt:
.\nuitka_mgmt_build.cmdBuild screenshot:
.\nuitka_sshot_build.cmdBuild OPEService:
python .\build_svc.pyBuild credential:
cd credential
.\build_credential.cmdOutput: All built applications are located in the dist directory.
Due to antivirus false positives, a custom PyInstaller build is required. See the original article for details.
-
Clone PyInstaller:
git clone https://github.com/pyinstaller/pyinstaller
Clone to
c:\pyinstaller -
Modify bootloader:
- Add variables to functions in
bootloader/src/pyi_main.c - Adding something like
int ope_custom=1;in each function changes binary signatures - This prevents antivirus false positives
- Add variables to functions in
-
Build bootloader:
cd c:\pyinstaller\bootloader pip uninstall pyinstaller # Install dependencies via Chocolatey (see PyInstaller docs) # Switch to Python 3.11 if needed setx VSCMD_SKIP_SENDTELEMETRY 1 python .\waf distclean all --target-arch=64bit
-
Install custom PyInstaller:
cd c:\pyinstaller pip install .
ope-laptop-tools/
├── common/ # Shared modules and utilities
├── credential/ # Credential application
│ ├── credential.py # Main credential script
│ └── credential_config.json
├── mgmt/ # Management tool modules
│ ├── mgmt.py # Main mgmt entry point
│ ├── mgmt_*.py # Individual management modules
│ └── mgmt.version # Version information
├── opeService/ # OPEService Windows service
│ └── OPEService.py
├── screenshot/ # Screenshot utility
│ └── sshot.py
└── modules.txt # Python dependencies
The credential application uses credential_config.json for all settings. Key configuration options:
See credential/README.md for complete configuration reference.
Many settings are stored in Windows Registry under HKEY_LOCAL_MACHINE\SOFTWARE\OPE\:
- Log levels
- Timer intervals (screenshot, NIC scan, etc.)
- SMC configuration
- Student account information
- Network type and domain information
All applications log to %PROGRAMDATA%\ope\logs\:
ope-credential.log- Credential application logsope-mgmt.log- Management tool logsope-service.log- OPEService logsope-sshot.log- Screenshot tool logs
Log levels can be adjusted using:
mgmt.exe set_log_level <level>Where level is typically 1-5 (higher = more verbose).
- Network Interface Control: Only approved network adapters are allowed
- Firewall Management: Automated firewall rule application
- Group Policy: Security lockdown policies applied automatically
- User Account Management: Automated student account creation and management
- Permission Enforcement: Registry and folder permissions reset on schedule
- Device Monitoring: USB and network device event monitoring
- Screenshot Monitoring: Periodic desktop screenshots for compliance
- Verify BIOS is locked down (set
have_you_locked_down_the_bios: true) - Ensure running as Administrator
- Check SMC connectivity and credentials
- Review
ope-credential.logfor detailed error messages
- List approved NICs:
mgmt.exe list_approved_nics - List system NICs:
mgmt.exe list_system_nics - Approve a NIC:
mgmt.exe approve_nic "NIC Name" "subnet"
- Run trace collector:
mgmt.exe show_trace - This shows real-time console output from OPEService
- Credential Application README - Detailed credential configuration
- Release Log - Version history and changes
For issues, questions, or contributions, please refer to the project repository or contact the development team.