Here is a non-technical idea: This is a school, right? So educate them. Teach them the importance of consequences, acceptable use, the illegality of hacking... and yes, proper use of the internet. I mean, give them access, to a separate filtered network if need be, and create some curriculum around that. Classes, internet safety, strict compliance with whatever AUP, etc... Give them access to the network, and use it to teach them to be good internet citizens. And, how to use the internet productively, to assist in their education.

MAC filtering so only staff (and future CS college students) can use your main WiFi network.

@SteveDL MAC filtering is insecure as they can be spoofed.

How many high school students do you think know what a MAC address is and know how to change theirs? And how many can be bothered to do this on a regular basis? We're not looking at motivated adversaries here, we only need to increase the cost of attack to a reasonable level of effort.

We had this problem in my HS. Most students just gave up after their device got kicked and wouldn't reconnect. I'll admit to spoofing my MAC in the long nights in the robotics lab, but even when I mentioned it to the IT department, they said they weren't trying to protect against people like me, just the general masses.

No network access? No phones? I'm rather surprised at these levels of security paranoia at a school.

@grawity it's probably an attempt for kids to stay focused in class rather than security paranoia.

@DaveMcQueen : Since the problem isn't purely technical, this makes definitely a very good question which can get better answers on Server Fault.

How is the password leaking in the first place? Is it so weak that it gets brute forced? Has it been written down on a piece of paper that somebody unauthorized could find? Is a key logger installed on one of the authorized machines? Is one of the persons with unauthorized access to the network deliberately leaking it? First step towards answering that question could be switching from using a shared key to using different credentials for all authorized users. It will be less work to change the credentials of a single user once leaked than to change a password that has to be communicated to all

@AviD so far your comment is the best answer, would you care posting it, please?

@AviD They already learnt something about internet, consequences etc.: If they can't catch you no consequences for you.

This reminds me of commitstrip.com/en/2014/09/02/back-to-school-in-2014

@Lohoris and OP - I am not posting my comment as an answer, since it is not an answer for Security.se. I think Parenting or something similar would be infinitely better, because I don't think technical solution is right for this problem. That said, it is what it is, this is the problem he is trying to solve - I can't change that for him.

@AviD I understand, but, after all, if he asked the wrong question, it is fare to give him the right answer, even if that, out of context, would have been OT. I'll quote your comment in my answer then, but I'll be happy to remove it in case you change idea.

You can also reduce the incentive for hacking the wireless. Filter ALL connections to facebook, 9gag, candycrash, porn sites, etc from the school. That will also affect teachers but it might give a good example and increase productivity. Those sites might still be configured as accesible from the wired connections or from a whitelist (like the school community manager that needs to publish things on facebook).

@SteveDL: How many students know stuff like that? Not many. How many need to know stuff like that in order to automate it and share it with the entire school? Only one. The "make the system too hard for 'not a dedicated adversary' to attack" rationale never works; it's the same problem as DRM.

If the goal is to not have the students on the network, just create a public network for them to access. Most people just want to access the internet.

@SteveDL, I'm a high school student that can just grab the MAC address from aircrack and connect to the Wi-Fi network. Of course, there's no benefit because there's a student network, but whatever. Just saying, it's possible for a student to know, care, and do.

What if you put the internet gateway behind a VPN? Even if the students can bypass the WPA, spoof the MAC and so, cracking a user-certificate based VPN is close to impossible to them. And it's easy to monitor the VPN server and detect if more than 2 (or 20) devices are using the same credentials.

No sooner that the teacher is out of the room than they'll go to the taskbar and look at the properties of the WiFi router to get the password. - Sounds like it's the teachers, not the students, that need to be educated...

Sounds like the core problem is complete lack of enforcement of school policies -- if the school doesn't allow phones tablets and laptops, then what devices are students using to get online? There's no point in having a policy that's ignored, so you may as well drop the "no electronic devices" policy and give the kids a Guest wifi network so they can stop hacking into teacher computers to get the password.

@DanNeely : They are hostile to technical questions because they are easy to answer Making somewhat the site as Super User duplicate. But the OP definitely need more a mixed approach.

Close your school. It is clearly a place of fascism trying to dumb down and monopolize students.