Kenneth_Ting Posted October 12, 2015 Posted October 12, 2015 (edited) Hi We are a self hosted SLG school, and are told that we need to take care of password reset/retrieve function of our own whereas if hosted by Capita which is taken care of. Any suggestion on what application that would provide the password reset/retrieve function and timeout feature which is compaitable with SLG/SharePoint is greatly appreciated. thanks Ken Edited October 12, 2015 by Kenneth_Ting
bald_pig Posted October 12, 2015 Posted October 12, 2015 get a phone call, reset the password yourself in AD?
Kenneth_Ting Posted October 12, 2015 Author Posted October 12, 2015 I would love to.. but if the parents are given this option, we will receive more than hundreds call during report release time. so the man power involved would justify the cost of subscribing this kind of tools which facilities them to reset/retrieve password
vikpaw Posted October 12, 2015 Posted October 12, 2015 If you have the users in AD, then ADManager Plus is a good option that allows self service. You can auto register the users if you wish. We're just setting this up now, but it did cost. Another option is to have AD in the cloud, so you can sync your AD to Azure and then setup a front end where users can go to change their password. Long term i'd like to do this, don't know all the ins and outs, but it should be fine for allowing users to change their password when we enforce it, not totally sure about the process for forgotten password. I'm going to do more research on this with a view to setting up ADFS and allowing other systems to sync users with out AD.
Sylv3r Posted October 12, 2015 Posted October 12, 2015 Ours is not automated but we request all parents log password resets etc via our Helpdesk. When the reports are released we tend to get about 30 - 40 reminder e-mails. We are getting there and the number is getting less each round of reports.
Kenneth_Ting Posted October 13, 2015 Author Posted October 13, 2015 Thanks for the info May I know, Are you self hosted SLG school? We have once considered to implement Azure for password reset/retrieve, and then checked with Capita whether it would be compatible with SLG. they said no. so now we are looking for other option. thanks Ken
howartp Posted October 13, 2015 Posted October 13, 2015 We put in https://www.manageengine.com/products/self-service-password/ for parents in July and it's working really well. Peter 1
vikpaw Posted October 13, 2015 Posted October 13, 2015 We put in https://www.manageengine.com/products/self-service-password/ for parents in July and it's working really well. Peter That's the one I meant, they make ADManager - it's the self service thing. Free for 50 users too, so good to test out. Did you get them to enroll, or autoenroll?
howartp Posted October 13, 2015 Posted October 13, 2015 That's the one I meant, they make ADManager - it's the self service thing. Free for 50 users too, so good to test out. Did you get them to enroll, or autoenroll? They all got new passwords when we set it up (we moved from three seperate systems to using AD for them all) so I had Powershell generate a password, create their AD accounts, set expiry to "next month", email them with the generated password, and provide links to Self Service to enrol and reset their password. The powershell runs every night from SIMS, so any parent who is no longer active in SIMS does not get their expiry extended to "next month" so their access will always cease within 31 days. They have to enrol if they want to change their password, so most of them have. If they ring/email for new password, at the moment I just delete their account and it regenerates overnight and resends them email. Quicker than me logging into Self service to see if they've enrolled. Peter 1
vikpaw Posted October 13, 2015 Posted October 13, 2015 @howartp - you take the email from SIMS and populate AD? Be interested to see that script if it's shareable.
howartp Posted October 13, 2015 Posted October 13, 2015 AppendParents2AD.txtGetPassword.txt See attached, renamed as .ps1 I can't take credit for the GetPassword script, I just modified two lines to remove I, i, L, l, 0, O from the character choices. CSV from SIMS (CommandReporter) outputs the following columns, renamed to match AD: "sn","givenName","mail","sAMAccountName" sAMAccountName is from a UDF called "UsernameOverride" which is null for most parents. If I get a clash (say two Sarah Smith's) then I enter "Sarah.Smith2" into one of those UDFs which the script then uses the following day. Peter 1
rpwillis Posted October 14, 2015 Posted October 14, 2015 You need to be very careful if putting email addresses in AD in case they get exposed to students. I once had a panicked call from a school as a student had searched for their teacher in SharePoint, the people picker had displayed all users with that surname, with email addresses, and the student had emailed the teacher's husband (also a parent). Capita's ADP had put the email addresses in AD and SharePoint was picking them up. Was easy enough to remove all the emails addresses, but you pretty much have to assume that any information in AD is potentially visible to students through SharePoint Exchange or any other system which uses AD. 1
howartp Posted October 14, 2015 Posted October 14, 2015 Hi Richard, Yep, thanks for the heads up but I did consider this before proceeding. I've purposely put our Parents in a completely separate OU from anything school related. We don't use SharePoint, and our Exchange student accounts are locked as to where they can search. I'm not aware I run any other system where students are exposed to AD searching. Peter
rpwillis Posted October 14, 2015 Posted October 14, 2015 Hi Richard, Yep, thanks for the heads up but I did consider this before proceeding. I've purposely put our Parents in a completely separate OU from anything school related. We don't use SharePoint, and our Exchange student accounts are locked as to where they can search. I'm not aware I run any other system where students are exposed to AD searching. Peter That should be OK then. I was tricked by the thread starting with SLG so was assuming SharePoint was involved.
bald_pig Posted October 14, 2015 Posted October 14, 2015 That should be OK then. I was tricked by the thread starting with SLG so was assuming SharePoint was involved. I don't think you've been tricked, SLG runs on sharepoint, if you don't sharepoint you don't have SLG!
vikpaw Posted October 14, 2015 Posted October 14, 2015 Very useful point. I'd prefer not to email them directly. Maybe we can sync them somehow via an intermediate step and do a mailmerge.
vikpaw Posted October 14, 2015 Posted October 14, 2015 To be fair we have taken a slight tangent, though all still useful info for the original SLG query. Hope it's useful @Kenneth_Ting
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now