The Challenge
Greenfield Academy is a K-12 school district spanning 8 campuses, serving 15,000 students and 2,000 staff members. Like many educational institutions, they relied on pre-shared key (PSK) WiFi passwords to give students and staff network access.
The problem was predictable: passwords leaked constantly. Students shared them with friends, posted them on social media, and even wrote them on bathroom walls. Each time a password was compromised, IT had to change it across every access point on the affected campus and redistribute it to all authorized users - a process that consumed hours and generated waves of support tickets.
The numbers told the story: the district averaged 3 IT tickets per student per semester just for WiFi issues. BYOD onboarding was a 45-minute ordeal that often required a visit to the IT help desk. Staff and student devices shared the same network with no segmentation, creating both security and performance concerns.
- Shared PSK passwords regularly leaked to unauthorized users
- 3 IT support tickets per student per semester for WiFi problems
- BYOD onboarding took 45 minutes per device
- No separation between student, staff, and guest networks
- IT team spent 20+ hours per week on WiFi-related issues
- No device management or visibility into what was connected
The Solution
Greenfield Academy deployed IronWiFi's WPA-Enterprise solution with certificate-based authentication via SCEP, integrated with their existing Microsoft Intune deployment for managed devices. The project was planned for summer deployment to minimize disruption, and all 8 campuses were fully operational by the start of the fall semester.
The architecture created three distinct network segments: a staff network with certificate-based authentication for managed devices, a student BYOD network with self-service certificate enrollment, and a guest network with captive portal access for visitors. Each segment had its own bandwidth policies and access controls.
For managed devices (staff laptops and school-issued Chromebooks), certificates were pushed silently through Intune - staff never had to do anything. For student BYOD devices, a self-service portal guided students through certificate installation in under 2 minutes, with no IT intervention required.
- WPA-Enterprise with certificate-based authentication (EAP-TLS)
- SCEP integration with Microsoft Intune for managed device enrollment
- Self-service portal for student BYOD certificate installation
- Three segmented networks: staff, student, guest
- Per-segment bandwidth management and access policies
- Centralized dashboard for monitoring all 8 campuses
"The day we turned off the PSK was the day our WiFi problems ended. No more leaked passwords, no more students on the staff network, no more 45-minute onboarding sessions. Our IT team went from firefighting WiFi issues to actually working on projects that move the district forward."- David Chen, Director of Technology, Greenfield Academy
The Results
The impact was dramatic and immediate. WiFi support tickets dropped by 90% in the first semester after deployment. The remaining tickets were primarily connectivity issues unrelated to authentication - the password problem was completely eliminated.
BYOD onboarding went from a 45-minute help desk visit to a 2-minute self-service process. Students install their certificate once at the start of the year and their devices connect automatically from that point forward - across all 8 campuses.
Network segmentation resolved the security concerns that had kept the security team up at night. Student devices are isolated from staff resources, and the guest network provides internet-only access with no path to internal systems. The IT team reclaimed 20 hours per week that had been consumed by WiFi troubleshooting, redirecting that effort toward strategic technology initiatives.
Timeline
The entire deployment was completed in 6 weeks during the summer break. Week 1-2 covered infrastructure configuration and Intune integration. Weeks 3-5 handled campus-by-campus rollout with staff device enrollment. Week 6 was devoted to testing and the self-service student onboarding portal. By the first day of the fall semester, all 8 campuses were running on the new system with zero issues.