We are a small k-12 school with about 150 school devices plus personal staff devices. Students are not allowed on the network.
I have filters activated on the windows 2012 r2 standard server and need to approve and enter the mac address of permitted devices to receive an address from the DHCP server.
I connected to our dd-wrt router and found a few computers using more bandwidth than they should.
One of the computers using too many resources belonged to one of the staff members. I went to see what that person was doing and I found the laptop powered off and plugged into a charging cart. The teacher stated that the laptop had been off for 2-3 hours, yet the dd-wrt >> Status >> LAN >> Active Clients showed the device had over 500 connections to the internet.
Question: Is that even possible to see a device showing active on the network but is powered off? My expectation is NO unless the computer was not truly off.
And I do believe it was powered off. I stood there when she turned it on and booted it up. I double checked the mac address and it did match. The next time I looked at the active devices, the laptop was no longer on the list.