Use of domain password (& staff AUP, etc.) ;)

[MkII]

Thanks very much for that guys [except you Stewart! hehe]

 

The windows 2000 figure is useful too.

 

would kick up a fuss and say if you are supporting it then you have final say on what should go on network...

That's what I intend to do Russ. This guy is a manager that spends a lot of time fixing PC's. He has his own 'network' that he looks after entirely himself, but my argument is that he can't possibly sustain this with all the changes afoot - so it's me that'll have to support them.

[Ric_]

That's what I intend to do Russ. This guy is a manager that spends a lot of time fixing PC's. He has his own 'network' that he looks after entirely himself, but my argument is that he can't possibly sustain this with all the changes afoot - so it's me that'll have to support them.

 

I thought that teachers weren't allowed to do technical stuff (like they're not allowed to do admin). The unions have been in uproar about this and hence teaching assistant posts were created.

 

They can't have it both ways!

 

Besides, why does he have a password that can join computers to YOUR domain? I think your security policy and license management policy needs review - I assume that all the correct CALs have been purchased!?!

[MkII]

Funny you should say that Ric_ - that's the exact argument I've been having for the last 2 years when management caved in and decided to let him have the domain password.

 

It's just a power thing for him, but because of the way he is, he likes to 'do' things off his own bat, I have no idea what changes are happening on the network. We're arguing that one today too.

 

Any gems you may have on that topic gratefully recieved too - the meeting is at 1pm.

 

Cheers

[Geoff]

*BOFH hat on*

 

Well, you could be evil and tell his union what he's up to. Or you could be even more evil and deliberately sabotage things he touches then point the finger.

[Ric_]

You could take away the ability to join the computers to the domain - it's a simple deny checkbox under his priviledges

[Geoff]

Ask for an external security audit.

[MkII]

He doesn't have access with his OWN password - oh no - he MUST have the actual domain password.

 

I've changed the password before under instruction of my line manager and experienced detritus falling from a great height to make us let him have the new one.

 

We now have a resource committee and everything must be passed by it. They decreed that the password be known by the Head, Myself, and this Head of Technology. [they just excluded the ICT Coordinator]. At the last meeting we said that no-one except me should use it - but apparently they didn't realise this - and want to change it back PDQ.

[MkII]

That's a good idea Geoff.

[Geoff]

No, only you knowing the password doesn't work either. What happens if you get mowed down by a school bus? What you should do is have a typed copy of the password(s) in the schools fireproof safe in a sealed envelope.

[Geoff]

Oh yes, you can beat him to death with the DPA and RIPA acts too. For bonus points, if you have a well worded AUP for staff he's probably breached that too. Hopefully one can convice the head that that's a sacking offence.

[MkII]

We do as you say Geoff re having a copy somewhere.

 

Only me use the password - other people know it as well.

 

The point is that Management are saying that he should know and use the password - unlike everyone else in the school - just because he's pushing for it.

[Geoff]

No AUP for staff then? Perhaps you should propose one...

[MkII]

Yes - I've draughted one to go into next years handbook. But how would I make it so that he isn't exempt? And how could I wangle restricted access to the whole network into the data protection argument?

[Geoff]

Yes - I've draughted one to go into next years handbook. But how would I make it so that he isn't exempt?

 

Simple. If you don't agree to the AUP and you can't use the computers.

 

And how could I wangle restricted access to the whole network into the data protection argument?

 

This is also quite simple. One of the provisions in the DPA basically says 'Data must be securely kept'. Clearly because your teacher friend has access to data he doesn't need to have access too. i.e. other staffs files and pupils files he does not teach. One cannot consider that data secure. Especially as he isn't someone under you direct control.

 

This link should help too:

 

http://www.dataprotectionact.org/4.html

 

If the school does not uphold the DPA then it will be taken to court and fined thousands of pounds per incident!

[tarquel]

Done and done Geoff

 

Could you edit your post now (I cant for you as I'm not a mod here)?

 

***NOTE:***

 

This topic was created and split from the topic:

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=124

 

Regards,

Nath

[MkII]

Thanks Nath. Good job.

 

Sanity has been restored and now we are back to me being the only one authorised to actually use the password.

 

Two other teachers are to have knowledge of it to use in my absence, and technical alterations to be carried out by a third party support company or authorised beforehand by the Head and documented. This will be reviewed come December 31st when the teachers won't be allowed to touch it.

 

Comments?

 

Thanks again Geoff - I intend to pass that on to the Head.

[MkII]

One of the provisions in the DPA basically says 'Data must be securely kept'. Clearly because your teacher friend has access to data he doesn't need to have access too. i.e. other staffs files and pupils files he does not teach. One cannot consider that data secure. Especially as he isn't someone under you direct control.

Is that correct Geoff - is it against the DPA for a teaching staff to have access to pupil files that they do not teach?

[Geoff]

Under the provisions of the DPA you are not permitted to access personal information stored on computer systems at your workplace that is not relevant to doing your job.

 

Its basically covered in Schedule 2 of the Act if you wish to get tangled up in legalese.

 

If he's not teaching all pupils he certainly doesn't need to access their data.

 

Even leaving the issue of pupils data aside, he shouldn't need to access other members of staff data ever. That in itself is reason enough to take domain admin access from him in my book.

[Diello]

Congrats mark I get the final say in who gets the password, or admin level access. Seems I'm lucky, and I thought I had things bad.

 

Well, I'd certainly think the DP Registrar might have a thing or two to say about it, if they were that students tutor or HoY maybe... but not just random teachers. Only our IT Teachers have access to kids work, and I gave that grudingly.

[Ric_]

The way to get around careless bus drivers is to create a copy of the domain admin user and give it a ridiculous username/password. You then seal this in an envelope and lock it away in the safe for use in emergencies.

 

The Lancs auditors like this method too - much praise when I told them about it

[MkII]

You are so devious Ric_ ! Must admit the thought has crossed my mind .

 

But someone else does know the password I hope...

[ChrisH]

The way to get around careless bus drivers is to create a copy of the domain admin user and give it a ridiculous username/password. You then seal this in an envelope and lock it away in the safe for use in emergencies.

 

The Lancs auditors like this method too - much praise when I told them about it

 

this is what i have done also.

[tarquel]

Just a small thought here but will Job Eval help here?

 

i.e. for those of us that are unclear on our "roles" (especially what the SMT's decide regarding our roles) or other members of staff not realising that they shouldn't be doing something or performing something, etc. (like with mark's case) - Would job eval help clear up what should and shouldn't be happening when it comes in?

 

In my case, I clearly dont know where i stand, and being of the 'gutless' sort, I find it hard to ask those sort of questions like the other day he went a bit defensive when I asked him about the student AUP lol - all I wanted to do was see it lol.

 

Its funny how they dont want you to have the money/status of network admin, etc., but then everything is your responsibility when things happen - like bromcom. I didnt get asked on it, or get involved at all, then when it buggered up the other month, apparently "I" was responsible for managing it lol - I think I made a good point back at him tho, and finally got the admin staff to "ring the damn helpdesk themselves" (after all, thats what its for lol)

 

*ahem*....'scuse my rantin yet again lol...but I hope you see my point in posting this... :S !?

 

Regards,

Nath