Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Schools cannot secure email, learning platforms, student records, finance or safeguarding systems by protecting staff passwords alone. Every user account sits alongside nonhuman identities—service accounts, application registrations, API tokens, certificates, managed identities and automated jobs—that may retain powerful access without anyone signing in. A defensible programme inventories and limits both kinds of identity, applies strong authentication where a person is involved, and replaces persistent machine secrets with short-lived, tightly scoped credentials wherever possible.
Identity is the access graph behind a school
An education environment is identity-centric. Staff and pupils use identities to reach email, learning platforms, cloud storage, student-information systems (MIS), assessment services and network resources. Finance, safeguarding, special educational needs and disabilities (SEND) records, and administration systems add higher-impact data. Suppliers and integrations extend the same graph beyond the school’s own directory.
As an Amazon Associate I earn from qualifying purchases.
Human identities represent people: teachers, support staff, pupils, contractors, governors, guests and administrators. Machine identities represent software or a workload acting on its own: a scheduled export, an application registration, an API client, a service account, a certificate, a CI/CD job or an integration between the MIS and a cloud service. A stolen password can let an attacker impersonate a person; a stolen token or application secret can let them run an approved workload with little visible human activity.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Identity type | Typical examples | Distinctive risk | Core control |
|---|---|---|---|
| Human | Staff, pupil, contractor, guest and administrator accounts | Phishing, password theft, misuse and access left behind after a role change | Unique credentials, MFA, least privilege and rapid joiner-mover-leaver action |
| Machine | Service accounts, app registrations, API keys, certificates, managed identities and automation jobs | Long-lived secrets, excessive permissions and activity that may not trigger normal user-focused checks | Named ownership, scoped or short-lived credentials, secret management, rotation and workload monitoring |
Protecting only the first row leaves the second row as an unmonitored route into the same data. Conversely, locking down service accounts while allowing an administrator’s password to be phished still leaves a direct route to sensitive records. The controls must be designed as one access programme, with different techniques for people and workloads.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What guidance requires for human accounts
Apply MFA to the accounts and systems that matter most
The UK Department for Education (DfE) core standard defines multi-factor authentication as asking a user for “2 or more pieces of evidence to verify their identity.” Its Cyber Security Hub says MFA should cover privileged accounts, internet-facing systems, services containing sensitive data, VPNs and other remote access. In a school, that normally puts administrators, cloud and remote-access staff, finance, safeguarding, SEND, assessment and MIS access at the front of the rollout.
MFA changes the consequence of a stolen password. As the DfE explains, if a hacker obtains a username and password, the second verification step can still block access. MFA is not a substitute for least privilege, device security or monitoring, but it removes a large class of password-only attacks from the highest-value entry points.
Separate administration from everyday work
Administrators should have a separate privileged account for configuration and support, while their ordinary account is used for email, teaching and other routine work. DfE guidance says global or administrative accounts should not be used for routine business; Microsoft likewise recommends separate admin accounts. This separation reduces the chance that a malicious link opened during normal work inherits directory-wide authority.
Block legacy authentication where the identity platform supports it. Older protocols may not understand modern MFA and can become a bypass around a carefully configured sign-in policy.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use least privilege and review it every term
DfE’s core standard tells IT teams to create accounts only when required, limit privileges to what the role needs and disable accounts as soon as someone leaves. Build an inventory covering staff, pupils, contractors, guests and administrators. For every account, record an owner, role, systems and data it can reach, and an end date where access is temporary. Review permissions at least once each term and remove access that no longer matches the person’s work.
Do not impose automatic password changes solely because a calendar interval has passed. Microsoft notes that predictable periodic changes can encourage weaker, reused passwords and create unnecessary reset work. Reset a credential when it is exposed, suspected of compromise or required by a documented risk decision, while enforcing unique passwords and MFA.
Why machine identities need a separate control set
Find every nonhuman credential
Start with an inventory of service accounts, application registrations, API keys, certificates, workload identities, scheduled tasks, scripts and third-party integrations. Record the technical owner, business purpose, systems and data reached, creation date, expiry or rotation date, environment and emergency contact. “Unknown owner” is a finding that needs remediation, not an acceptable ownership state.
Include integrations that move data between the MIS, learning platforms, finance tools, safeguarding systems and external SaaS. A supplier connection is part of the school’s data-controller and supplier-risk responsibilities: the school must know what data flows, which identity authorises it and how access is withdrawn.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prefer managed or short-lived credentials
Attackers exploit stolen application credentials and tokens. Microsoft’s Secure Future Initiative advises customers to adopt phishing-resistant MFA and modify applications to use Azure Managed Identity. The equivalent principle applies in mixed or non-Microsoft environments: let the platform issue a workload identity where possible, use short-lived and narrowly scoped tokens, and avoid embedding a permanent secret in source code, scripts, configuration files or student-facing devices.
When a static key or certificate is unavoidable, store it in an approved secrets-management system rather than a spreadsheet or shared drive. Define rotation and expiry before deployment, test the replacement path, and keep an emergency procedure for revoking a compromised credential without taking down teaching-critical services.
Separate environments and watch for abnormal use
Development, testing and production should not share credentials. A test application should not be able to read live safeguarding data, and a production integration should not use a developer’s personal token. Alert on unusual token use, privilege changes, impossible-travel-style anomalies, unexpected source locations, access outside a workload’s normal schedule and sudden increases in data retrieval. Machine activity may not produce an interactive sign-in, so workload logs and token telemetry need their own review path.
Reassess a machine identity whenever an application, vendor, data flow or automation job changes. Remove unused identities promptly; an old integration with a valid key is still an active entry point.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Phone-free MFA and security keys
Some schools do not permit pupils or staff to use personal phones. DfE guidance identifies computer-based authenticator applications, suitable biometrics and USB security keys as alternatives. A FIDO2/WebAuthn security key is particularly useful for privileged users because the key performs a phishing-resistant cryptographic challenge rather than displaying a code that can be relayed to an attacker.
Before buying keys, verify that the school’s identity provider supports FIDO2/WebAuthn for the required account types and devices. Document enrollment, lost-key revocation, recovery and replacement. Keep a spare key under controlled custody for each high-risk administrator or maintain another approved recovery method; otherwise a lost key can become an availability incident. Check accessibility, USB-port availability, browser and operating-system support, and whether shared or specialist devices can use the chosen key.
Joiner, mover and leaver automation
Lifecycle errors are often more damaging than a single failed login policy. A joiner must receive the right account and baseline groups; a mover must lose old privileges as their role changes; a leaver must be disabled immediately, including sessions, tokens, VPN access, delegated mailboxes and application access. DfE recommends formal joiner-mover-leaver processes and considering automatic account creation and deletion linked to the MIS. Microsoft describes automated provisioning and conditional access for education; schools using other directories should implement the same outcomes with their available tools.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Joiner: HR or the authorised school process records the start date, role, site and manager; the directory and required applications provision only the groups needed for that role.
- Mover: a role or department change triggers removal of old groups before new access is granted, with a human owner confirming exceptions.
- Leaver: disable the account at the agreed departure time, revoke active sessions and tokens, transfer approved business data, disable linked machine credentials and collect hardware.
- Exception: temporary, supply and contractor access has an explicit expiry and a named sponsor who must renew it.
A practical 90-day implementation plan
| Period | Actions | Evidence of completion |
|---|---|---|
| Days 0–30 | Inventory human and machine identities; identify privileged accounts and sensitive systems; disable stale accounts; enable MFA for administrators and remote/cloud staff; create separate admin accounts; block legacy authentication where supported. | Named owners and purposes for identities, a list of high-risk systems, and sign-in policies covering priority entry points. |
| Days 31–60 | Agree joiner-mover-leaver ownership with HR; link lifecycle to the MIS where feasible; register every third-party SaaS integration; remove over-permissioned users and service accounts; move application secrets into managed storage. | Documented workflow, approved integration register, reduced standing privilege and controlled secret locations. |
| Days 61–90 | Deploy phishing-resistant MFA for high-risk users; replace long-lived application secrets with managed or short-lived credentials where possible; alert on suspicious sign-ins and token activity; run a termly access review; test incident and account-recovery procedures. | Recovery drills, reviewed access attestations, workload alerts and a tracked remediation list. |
How to evaluate an identity platform or service
When comparing Microsoft 365, Google Workspace, an on-premises directory or a mixed environment, assess the control rather than the brand label. Ask:
- Does it cover both human accounts and workload identities?
- Can it automate provisioning, deprovisioning and role changes from the MIS or another authoritative source?
- How precisely can least privilege, conditional access and administrator separation be expressed?
- Does it support phishing-resistant MFA, including FIDO2/WebAuthn where phones are not allowed?
- Where are secrets, certificates and tokens stored, scoped, rotated and revoked?
- Are sign-in, token and privilege-change events easy to audit and alert on?
- Will it integrate with the directory, MIS, learning platforms and third-party SaaS used by the school?
- Are accessibility, recovery, spare credentials and administrative workload acceptable?
- What is the total cost of licensing, hardware, implementation and ongoing review?
DfE requirements are UK school and college guidance. Schools elsewhere should map the same principles to their local obligations; US Department of Education material, for example, provides broader student-record authentication principles. Microsoft’s managed-identity recommendations are vendor-specific implementation guidance, so equivalent controls must be designed for Google Workspace, other cloud providers, on-premises Active Directory and hybrid estates.
What success looks like
A mature school identity programme can answer, quickly, who or what has access to each sensitive system, why that access exists, who approved it, when it expires and how it will be revoked. People authenticate with strong, appropriate MFA and use separate administrative accounts. Workloads use owned, minimal and preferably short-lived identities rather than secrets copied into code. HR, IT and system owners share a tested process for joiners, movers and leavers, while termly reviews and workload monitoring catch drift before it becomes a breach.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
