Comment Network Access Control (Score 1) 1117
If you have the money, you should look into some Network Access Control(NAC), or enterprise firewall solutions. Something by companies like Mirage, ForeScout, or Fortinet(among others). This way, you can force any laptop on the network to authenticate, either AD, 802.1x, or captive portal. You can then run a host check to check for up to day Virus scanning software, as well as many other things.
While they are at school, the laptop has certain policies. You can push firewall, etc to the host. As well they can have Single Sign on for network resources.
At home the user has a client to connect into school resources through IPSec or SSL VPN. Policies can be put in place for home use, or can be allowed full access, as long as when you reconnect to the network you meet your policy.
Look into these companies and find a distributor to help you install it. Each devices servers different needs.
My company has deployed a similar solution for a School board in Ontario in the last year, and so far they like it.