Admin Account Disabling certain elements

[mmoseley]

Hiya All!,

Got a certain IT teacher that has got admin rights on the network (not my Decision!) which im not very happy about

Now what the problem is, is that he has got Active directory tools installed on the computer, and he knows where to get it from, so when we disable a kids account for say playing games in lessons,

he will come along when its the kids IT lesson and enable the kids account and not disable again when done,

Is there a way so that he cant disable/enable accounts?

[Ric_]

You can use the delegation wizard to change these permissions but, of course, a domain admin could change them back if you don't disable the right ones.

[strawberry]

sounds like a policy problem rather than a technical one, explain to whichever numpty made the decision this is what happens.

[Geoff]

One thing you could do is turn on auditing and keep a log of what he does and doesn't do. If he's repeatedly messing things up, this would give you a good argument for removing it.

Alternatively, you might want to invest in some classroom control software. For example I use ABTutor. Which gives the Teachers a degree of control of the kids and the computers in their room but does not require you to give them any extra permissions.

[Michael]

It is extremely risky giving any teacher access to Active Directory and other network related tools (without sounding disrespectful to teachers).

We're all professionals at the end of the day, however it needs to be explored/reviewed of the possible consequences (in a worse case scenario).

I do think delegation is the way forward, however, it would also be a good opportunity to ask what functions this teacher needs and why.

[Geoff]

Also remember teachers unions aren't too keen on teachers doing non-teaching related tasks. So if he is keen on doing a bit of IT admining from his room you might want to suggest he becomes a full time technician, with the associated pay cut of course.

[maniac]

Why would a teacher require network admin rights anyway? If it's for installing software, or being able to have more control over their PC, then we give them Local only admin rights on the workstation they use, that way they can't screw up any other systems on the network. It actually works well, because we know they can't mess with the actual network, and they know we can't blame them when things go wrong!

Mike.