"All my other schools gave us the administrator passwords"

[eyetea]

Had a member of staff grumbling today - several bits as per usual but then they went on to state that in all the other schools they've worked in that they (and some other staff like ICT teachers) were given the administrator passwords...

 

My answer was a firm they may have done that but unfortunately we don't.

 

Out of interest how many of you lot give ICT teachers / teachers admin passwords...

 

J

[Jamman960]

I wonder whether it varies based on tech support availability? when I first started in my current school the head, deputies and head of ict(teaching) all had admin rights, tech support previously consisted of 1 day per fortnight.

 

I gradually reduced rights to the point that I'm now the only admin, my line manager gets told the password if I'm not in and need to sort something over the phone but other than that no one gets given admin access... One of the deputies decided to install the sparkle box toolbar everywhere!

 

I did visit one small primary where everyone was using the admin account including pupils... This stopped pretty quickly

Edited March 19, 2015 by Jamman960

[6Foot2]

I have been asked for it in the past and I have ALWAYS refused.

 

The password is not written down anywhere except for in a sealed tamper proof envelope in our Finance safe.

 

In Network Support we do not say the password out loud nor do we indicate it letter by letter to each other. If it is required by a visiting engineer we enter it on their behalf.

[mrbios]

I would feel very disappointed in anyone that clicks yes to this poll, and i'd want them to fully explain their decision....so that i could argue with them over how stupid they were.

[elsiegee40]

Never! Over my dead body! etc

 

Sealed. In the safe.

Edited March 19, 2015 by elsiegee40

[fairm010]

Never ever. In an envelope in the safe in Bursars office.

[MrFrostmaul]

Only me and the Network Manager have the admin passwords. There is a copy of the admin passwords in the disaster recovery plan which is locked away in a safe.

[Davit2005]

Passwords in safe just in case 5 members of the senior IT team get all killed simultaneously and only to be used in that scenario.

 

We can easily make users admin on their own machines (if their job absolutely requires it, although we try and avoid at all costs) plus their is a domain group which has local admin rights on all workstations just in case a contractor temporarily needs to install software in multiple places.

 

Apart from first scenario there is no need to give any user an admin password.

Edited March 20, 2015 by Davit2005

[Gibson335]

My initial thought would have been, 'I don't believe you' but then little surprises me anymore. Crazy notion. Ours are in our backup media safe and the BM's safe.

[unixman_again]

At the first school I was at, one IT teacher had the password. She wasn't Head of IT either, just a teacher. However, as an ex sysadmin on highly available systems, she knew what she was doing and I trusted her. She only used it if I was off and she needed it. In the subsequent two schools, only we in IT know it. It isn't even recorded in a sealed envelope, so if the IT team are all run over by the number 11 bus, I guess the college might be in the poo!

 

Actually they won't be; I'm sure most admins know how to crack an M$ password.

[abillybob]

Have two administrator accounts. One emergency administrator account (for disaster recovery) and it's password is off site with the head at her home in a laminated envelope. The other standard admin account here is only me that knows the password. On the one-off chance I have given it to the deputy but he never uses it without my permission first.

[localzuk]

The only administrators here are:

 

Me

My technician

Assistant Head (Resources) - I would prefer to remove this, but I'd be shot and fired if I did.

The SIMS support account used by our LEA - agreed to by others, I can't overrule. I might try to minimise permissions though at some point.

 

That's it.

[synaesthesia]

Absolutely not. The only people with access to this password are the ICT support team (3 people). There are laminated, sealed passwords for emergency use in the safe.

Noone else in the school, head teacher included, has access.

[Oaktech]

in the rare occasions when someone not from the IT inner sanctum has needed some sort of access I've created a special account for that specific occurrence and removed it when the time has passed.

 

Example: Medhurst installing our dashboard software remotely. Made them an admin account for the machine they were working on only. Contractor fixing exchange at my last place, made them a standard account but delegated exchange privileges to it.

[DavePa]

Looks like I'm the sole person who does - Nobody (including the IT team) has admin access on their account so if any admin work needs to be done we log in as the administrator. My predecessor (who still works for us but in a different role) has access to it as does my FD although as both have been here in excess of 10 years and have access to all systems this is not considered a risk.

[Sagima]

Occasionally we make a member of staff an admin on their own machine temporarily. Almost all staff use their personal tablets in school so they can do what they like on them - we don't supply them with laptops.

[hardtailstar]

Myself, The Head and the IT coordinator have the password.

 

No one else gets it, if they do I shoot the person that gave it to them.

[sparkeh]

What type of administrator are we talking here?

 

Domain admin is in my head and on a DR document in the safe that only a couple of SMT know about should I step under a bus.

 

The bursar has the credentials of an local admin for her machine to put into UAC prompt when the LA need to remote in to help/fix stuff.

 

Other than that its a no.

[eyetea]

The statement was made when I needed to pop in to install something on their PC which then prompted for UAC. Half a mind to show her the results of this poll!

[LiamH]

At my last place just the 3 or us in IT support and our support company had admin accounts.

 

At my current place I have to request local admin rights to the machines I support

[nickbro]

It's in the disaster recovery plan.

 

Myself

IT Technician

Assistant Head (Resources)

 

have domain admin accounts, myself and AH have the systemadmin password as well.

 

The administrator password is known only by me and the disaster recovery plan.

 

In the primary schools 3/4 members of staff have local admin rights to the pcs on their network, but no domain admin account

 

If server access is required, they need to use administrator, and only I have that password so need to enter it for them.

[Joanne]

I give people local admin rights to their machines so they can install software, but never domain admin access!

[dapaulio]

When I First joined the sschool I thought even the non technical network manager shouldn't have the only admin password. Now the password has been changed and locked in a safe. All tech guys have been given a separate admin account and a user account and elevated the network managers permissions just enough for him not to give me grief. He has since left and the new network manager has no more

privileges than a normal staff member. The most powerful thing she can do over any other teacher is access her c drive and delete print jobs from a queue. Makes for a happier network when you're not battling with who may have screwed something up. I'm glad I implemented this as soon as i did as years went on I come to learn there were lot more teachers that did know the admin password then did. Scary thought

Edited March 21, 2015 by dapaulio

[Jonah]

Only myself and my senior engineer have separate domain admin accounts, my other engineer has local admin on all clients and certain delegated permissions for AD, etc.

 

There is a third domain admin account, the credentials of which are stored in a sealed envelope in the school safe - it also has an event log trigger on the DCs that emails me and the Head when it's been used - just in case!

[MrFrostmaul]

@jomah, that what we currently have as if somebody leaves you don't need to keep changing the master password and for auditing reasons you can see who does what incase anything happens.