Teacher wants to access active directory...

[Olumite]

hi

 

A teacher who has the role of "data manager" wants an i-teach-esque way of ammending/viewing people's profiles.

 

I realise that for her to be able to do such things I'd have to give her admin rights. which would enable her to roam free-range around the server.

 

There is no way I am giving her nor anyother teacher admin rights (nightmares of the possible horrors). I'd rather say there is no method that wouldnt comprimise the security of the server.

 

Is there another way?

Any suggestions welcome!

 

lol

 

My first post!

[plock]

Delegate control?

 

Create a Microsoft Management Console with the specific permissions of exactly what you would like the user to be able to perform. Ensure you delegate the control to only the OU you would like them to manage.

[FN-GM]

I think you can use delegate control so it will let her into active directory on a normal user and edit items. If you don't want her to edit things by default standard users can view things in AD but not change anything.

[FN-GM]

Beat me to it!

[plexer]

What exactly do you mean by amending/viewing peoples profiles?

 

What are they wanting to acheive?

 

Ben

[FN-GM]

Do you mean profiles asin the users settings or the users account in Active Directory?

[plock]

This article will describe delegating control and how to set it up:

 

http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

 

This article describes creating a custom MMC:

 

http://support.microsoft.com/kb/230263

[ICT_GUY]

Give her your mcp server 2003 book along with the XP one and the networking one and possibly the active directory one.

 

Tell her that when she passes the exams she can come poke around your server under supervision. Even limited rights to admin users would not get past me, one click and its a head ache for me.

 

Her f*** up costs you your job. And I would not let anyone touch my servers that didnt know at least what I do and certainly not without me breathing down their necks and taking notes. As for admin rights, when hell freezes over.

[webman]

I think this problem is more of a managerial one. Why does the Data Manager want access to ammend/edit user profiles - surely this is what the Network Manager and/or IT Technicians are for?

 

I second ICT_GUY's suggestion

[plock]

I use the above method for allowing ICT Teachers to only reset student passwords!

[GrumbleDook]

She wants to see profiles? I presume that you mean files in home areas (not all here have profiles and home areas in the same place).

 

Fine ... using RMTSHARE and XCACLs to add a group called 'teacher_view) with read permissions to student homeareas ... put her in the group ... and then give her an excel spreadsheet with student details ...

 

column 1 - student name

column 2 - year

column 3 - form

column 4 - UNC location of home area.

 

She can then create her own filter views on the file and get access to whoever she wants.

 

The AD is not a thing for non-admins to play with ... delegation of control of the AD is one way but if all she wants is a searchable list of home areas and links to them ... give her the above file.

[kingswood]

She wants to see profiles? I presume that you mean files in home areas (not all here have profiles and home areas in the same place).

 

Fine ... using RMTSHARE and XCACLs to add a group called 'teacher_view) with read permissions to student homeareas ... put her in the group ... and then give her an excel spreadsheet with student details ...

 

column 1 - student name

column 2 - year

column 3 - form

column 4 - UNC location of home area.

 

She can then create her own filter views on the file and get access to whoever she wants.

 

The AD is not a thing for non-admins to play with ... delegation of control of the AD is one way but if all she wants is a searchable list of home areas and links to them ... give her the above file.

 

Fantastic idea.

 

The amount of ICT teachers I have had almost argue the point with me is astounding. I mean- throw away my MCP and HNC etc and just hand over the reigns to a teacher who because they have "ICT" in their title think that being an administrator on the network is some kind of power right. I like your idea of filter views.

 

Of course another way of doing it is by setting permissions for a group of your creation (teacher_admins or whatever) and then mapping a drive in a logon script so that teachers who need access to home areas can get it within the limitation of their own accounts. I had this method suggested to me this past month.

 

Great idea though Tony- thanks!

 

Paul

[CyberNerd]

hmm. profiles.

send her a copy of the user.dat and get her to open it with a text editor. It's quite easy to understand, really.

[bossman]

Are you sure it's user profiles and not their documents as in their my docs directory.

 

I delegate the mmc out to teachers so that they can reset user passwords and give out more printer credits they can also go into user accounts and see the pupils work as well. It also gives them the capacity to turn off the internet for that user.

[ICT_GUY]

I have a VB prog that I wrote that opens every students homefolder in a particular class. Also antother that puts files into them.

 

Teachers were trying to do this manually and wating 1 hour of PPA time.

[plock]

Are you sure it's user profiles and not their documents as in their my docs directory.

 

I delegate the mmc out to teachers so that they can reset user passwords and give out more printer credits they can also go into user accounts and see the pupils work as well. It also gives them the capacity to turn off the internet for that user.

 

Same setup here!

[localzuk]

All teachers in our school have access to all pupils home directories as a simple shared drive. They currently don't have access to anything else.

 

My boss, the bursar, is a domain admin - and a pile of documentation on how to do things should I, for some reason, be off for a prolonged period of time.

 

Thats it. The only other people with admin accounts are our sims support team/county council support team.

 

No-one else is permitted to access the AD, and if it were requested I would throw all the toys out of my pram

[plock]

I understand where you're coming from; perhaps your end users aren’t as forgetful as everyone I've worked with.

 

Allowing our IT Teaching staff (who have basic IT skills) to be able to reset students passwords using Delegation of Control and a Custom MMC, this has allowed for my life to no longer be taken up by silly password resets!

 

The IT teaching staff can only reset student passwords from our Top Level Pupils OU through to the entry years of the students. Using a custom MMC they can’t see the other OU’s nor have any control over them.

[SpuffMonkey]

Our teaching staff refused to be allowed to change student passwords as it was an "admin" job. They're still happy to waste time on the phone requesting them though.

[localzuk]

I understand where you're coming from; perhaps your end users aren’t as forgetful as everyone I've worked with.

 

Allowing our IT Teaching staff (who have basic IT skills) to be able to reset students passwords using Delegation of Control and a Custom MMC, this has allowed for my life to no longer be taken up by silly password resets!

 

The IT teaching staff can only reset student passwords from our Top Level Pupils OU through to the entry years of the students. Using a custom MMC they can’t see the other OU’s nor have any control over them.

 

Oh, they forget! Our year 5's forget how to spell their own names - and that is obviously the server's fault.

[plock]

Would you prefer to spend time resetting passwords than completing useful tasks such as improving network performance?

 

There is no harm in Delegating Control of ONLY the ability to reset STUDENT passwords from my point of view.

[pallen]

Teachers cannot change passwords and when brought up it was decided it was not their job so would not do it. We do have a couple of teachers who can browse through to pupils areas to access work etc. This has saved time when pupils are working in groups and one of them is off.

 

As for access to the server, I doubt anyone would want it and I certainly wouldn't give it them. Not without a big disclaimer covering me anyway

[plock]

I agree no access to the server, including Active Directory! Only a Custom MMC which allows them access to the Pupils OU with only 'password reset' rights.

 

In my experience the IT teaching staffs have been more than willing to complete this. Firstly they admit it speeds up their lessons and saves us time.

[Olumite]

Thanks for the responses.

 

Apologies for the confusion, the teacher hasnt stated that she'd want to view students 'my docs' folders. Just their user profile ala active directory. I'd like to let her use active directory but in a very limited capacity. Without giving her admin rights and/or giving her the password to the server. So a shortcut on her desktop/start menu to a restricted active directory is what I'm after.

 

The teacher wants to be able to view pupil/staff's username, so that she can see if whatever theyre typing isnt using the correct upper or lower case characters. She wants to be able to view the usernames in a list so that at a glance she can see. what the situation is.

 

To top it off she'd like to be able to reset the passwords.

 

Ive tried the custom mmc suggestion. So she'd be able to view/reset users/passwords. However as the active directory is on the server, I am unable to create a working shortcut to the mmc I created.

[pallen]

If they want to check usernames, you can just export them into an excel spreadsheet. As for password changes, I dont allow it so dont know, but following the instructions from all those have said should help.