GRitchie Posted June 10, 2015 Posted June 10, 2015 I'm starting as a Network Manager in a secondary school in a few weeks, and was wondering if anyone had any tips/advise? I'll be essentially single staffed and there are approximately 300 students. Currently their servers are all physical and I definitely want to virtualise the network. My main concern is, what if there are 'backdoors' being left by the current technician? What's the best way to find these etc. Any tips, advise and experiences will be greatly appreciated and I'll be sure as heck posting on here a lot more than I currently do!! I've seen this post a few years back, but maybe there are some other opinions now!
X-13 Posted June 10, 2015 Posted June 10, 2015 My main concern is, what if there are 'backdoors' being left by the current technician? You really think that little of the current technician?
GRitchie Posted June 10, 2015 Author Posted June 10, 2015 You really think that little of the current technician? No, but you just NEVER know? And plus, who knows who has been there before the current technician.
jamesb Posted June 10, 2015 Posted June 10, 2015 If you're genuinely worried about backdoors then you'll need to do a full AD audit to cover the most common ones. It's fairly simple though - just make sure that every account is accounted for (heh) by an active user, or an active service. Change the passwords of any service or admin accounts. Disable any accounts not accounted for. 99% of backdoors are just an AD account left in. You almost certainly don't need to worry about the remaining 1%. Oh, if you are really concerned about it then you might also want to check your DCs for the presence of skeleton key or other malware. 1
Steve21 Posted June 10, 2015 Posted June 10, 2015 You really think that little of the current technician? I don't think it's thinking little of them, more just being careful. My old school supported a lot of our feeders and most if not all of the old support companies who were doing them before had left remote tools/FTP/company accounts etc active on the servers. Better safe than sorry Steve 1
GRitchie Posted June 10, 2015 Author Posted June 10, 2015 That's how I see it Steve, I don't mean any wrongdoing by it - don't want to insult the current guy. He seems like a nice bloke and is happy to help with the crossover period but it is just being that extra bit cautious! :-)
X-13 Posted June 10, 2015 Posted June 10, 2015 No, but you just NEVER know? And plus, who knows who has been there before the current technician. ...you sound paranoid. Check what accounts are active, what permissions they have, query any domain admin accounts you're not sure of and check out the GPOs. Apart from that, don't worry about it. ...Oh, check scheduled tasks too. Nothing funnier than a 6 month delayed prank.
GRitchie Posted June 10, 2015 Author Posted June 10, 2015 Always have been always will be - tends to be the best way I find! Aside from the backdoor possibilities any other tips for coming in as a new NM would be great!
Steve21 Posted June 10, 2015 Posted June 10, 2015 Dig dig dig Obviously you won't find everything, but at least get the idea of what servers do what, how certain processes are done etc. Login a student account and see what you can break, I've got into SIMs servers using default logins, census data from silly permissions etc. Talk to people, find the issues they're having, what they'd like to see etc etc. And always be careful with trying to change stuff too quickly, better to stand back and watch and see how things go before jumping in and changing something only for it to break 100 other things Steve
GRitchie Posted June 10, 2015 Author Posted June 10, 2015 All sounds sensible! There seems to be a few things I will want to change, but I do agree it's probably best not to rush into big decisions.
sippo Posted June 10, 2015 Posted June 10, 2015 Just work your hours. As a 'manager' you will be probably be expected to work longer hours without the thanks... I 'try' to do my 8 hours and that's it. It never happens mind.
GRitchie Posted June 10, 2015 Author Posted June 10, 2015 Yeah, I agree sippo - seems like that's always the case in IT. As my current role as IT Technician I often end up going 'above and beyond the call of duty'; suppose it's just part of the job...
sonofsanta Posted June 10, 2015 Posted June 10, 2015 Sit on your backside for the first month. I reckon that's about the length of time it takes to start getting a feel for things, both the network and the staff, before you start diving in and making big changes. Someone will grab you on the first day and blow something up to me an urgent disaster that they need you to fix. They're probably lying and trying to take advantage. Just spend your time working out what servers do what, checking them over for updates etc., working out the network topology, what computer specs you've got around, what audio-visual kit there is... just sit and observe and document and act as a basic technician dealing with minor problems. You'll soon spot the patterns and start formulating a list of priorities and a plan of action 1
elsiegee40 Posted June 10, 2015 Posted June 10, 2015 My main piece of advice is take your time before you change anything. Rushing into changing things, even virtualising, is a recipe for disaster. Get in the staff room at breaks, talk to people, listen, understand, investigate what is happening on the network and understand that too... then you will be in a position to make changes without the whole lot crashing down around you. 1
elsiegee40 Posted June 10, 2015 Posted June 10, 2015 Oh... and avoid fiddling with minor settings too until you have got a handle on things. That tiny setting in AD will probably prove to be the one thing holding the whole network together even though it is clearly impossible to affect anything else by changing it!
Geoff Posted June 10, 2015 Posted June 10, 2015 My main concern is, what if there are 'backdoors' being left by the current technician? What's the best way to find these etc. Are you aware of any reason the current tech would do this? Never the less, if there is a logic bomb hidden somewhere and he's a good sysadmin you will not find it in time. The only mitigation you have is offline backups and a complete wipe and rebuild (as you would with any security breach).
mthomas08 Posted June 10, 2015 Posted June 10, 2015 ...you sound paranoid. Better safe than sorry? Sometimes I find it's healthy to be paranoid although for me it's making sure everything is perfect (close to it if possible). As for the OP, see what paper work is currently there. When I started my current job there was little to nothing, predecessor essentially wanted out and was gone. Some things I did: 1. Full School Audit of Hardware 2. Classroom Audit - Current state of rooms for IT, can't stress how terrible some rooms were in. 3. Budget plan, see what's been currently ordered in the last 3 Years and was the School getting a good deal 4. Look for simple improvements - Imaging system, virtualisation, server improvements/reliability, network upgrades. 1
Oaktech Posted June 10, 2015 Posted June 10, 2015 Don't make big changes. You won't build up a relationship with the staff if you pull the ICT rug out from under their feet. As far as backdoors etc go, check every server for teamviewer, got to meeting, logmein, splashtop, chrome remote desktop, etc. Trawl AD for anything that looks odd and or has big permissions. Get a staff list from your HR and disable any accounts that aren't on it - if you disable more than you should, people will come and let you know! If you run O365 or GApps, do the same. Start mapping your network out physically, need to know that stuff because when you virtualise you will likely want to vlan, and you can't vlan properly if your infrastructure is a mess. Work out what you've got, what needs replacing, what can stay for a year, what can stay for 5 years even. Prioritise your plans but expect those plans to change upon input from staff! Fight for a budget that will let you fix all the big problems in one fell swoop, but if you're on your own in the job, don't bite off more projects than you can handle. Promising and buying big, but not delivering won't make you any friends on SMT and will make your probation difficult to pass. If you start something, make sure you have everything required to finish it. 1
fiza Posted June 10, 2015 Posted June 10, 2015 Aside from the backdoor possibilities any other tips for coming in as a new NM would be great! Don't make too many changes too quickly. Nothing worse than the new guy coming in and throwing his weight around. Obviously make changes that provide instant benefits to users and eanr you brownie points but take it slow and get to know the network before embarking on anything drastic. 2
rad Posted June 10, 2015 Posted June 10, 2015 Check the backup system, make sure that is working and test it. Create a file one day, restore it the next. 2
featured_spectre Posted June 10, 2015 Posted June 10, 2015 Check for Active Directory accounts - make sure they have an account or service attached. Change any PW's or remove accounts you're not sure of. Check the router or servers for any VPN connections as they may allow connections in. Check for any remote software VNC/Teamviewer/Logmein etc. If in doubt, uninstall it. Check for any skeleton keys or keyloggers etc. Beyond that, I wouldn't worry too much about backdoors in. The rest, everyone has covered. 1
PyROm Posted June 10, 2015 Posted June 10, 2015 Make sure active directory recycle bin is turned on. Concentrate on improvements end users will notice first, spending lots of money on virtulisation where the end user wont notice much difference may cause questions to be asked if there are other things the money could have been spent on. If the school has ees/vlk licensing check vlsc login is switched over to your email along with any other online services or server fault reporting etc. Eg. Dell open manage. 1
halbaradkenafin Posted June 10, 2015 Posted June 10, 2015 Make sure active directory recycle bin is turned on. Definitely this if the forest level is 2008 (r2?) or above. If the school has ees/vlk licensing check vlsc login is switched over to your email along with any other online services or server fault reporting etc. Eg. Dell open manage. Better yet set it to a generic account which you have access to but isn't your own (so [email protected] or something) and that way it's easy to transfer over to someone else should you move on or hire someone else to help you.
teejay Posted June 10, 2015 Posted June 10, 2015 Always under promise and over deliver. If there isn't a Helpdesk logging system set up, get one done and make the staff use it. Take your lunch break and also take some 5 minute breathers from the computer. Take some cake in and share it round with the key staff you need to get on your side, caretaker, bursar, office staff etc. Make sure you claim any overtime and expenses, I can assure you teaching staff do so don't be afraid to do the same. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now