Removing Permissions from Staff

[GRitchie]

Hello,

I've been brought into a workplace whereby the staff all had local administrative rights. Due to multiple staff downloading dodgy content and one being greeted with a cryptolocker-type piece of software I've decided it's 100% necessary to remove local admin rights from them. Something I wouldn't have given them initially.

 

Lovingly the IT teacher doesn't like the fact she can't install software when 'she always used to be able to'.

How do I explain to her that it's not going to happen, nor will it...

 

Don't you just love teaching staff...

[Sagima]

I just told them it wasn't my decision - the head said so and to take up any problems with him. (i just made the suggestion)

[GRitchie]

That is also the case here, but I know she will try and get the head to make an exception...

[MrPstv]

Emphasise the security risks with every Tom Dick and Sally having Admin rights.

Email your concerns over to the head.

If they choose not to go with your recommnedations and it all goes pear shaped at least you pointed it out and your evidence is in your email.

 

 

Lock it down...

They will hate you at first but they will get over it.

Only IT Admin support have Administrator access rights.

[IrritableTech]

Explain to the head that you believe this is a necessary step to ensure the safe and secure use of the network. Your specific concerns are around data protection and safeguarding of pupils and staff. You don't wish to be seen as obstructive, but you do want to ensure the school is following its legal and moral requirements. You're happy to install software to computers on request if the software is legal, assisting teaching and learning and passes a few simple tests to ensure it is compatible and compliant. If the head teacher does not want this to go ahead, then ask for confirmation in writing.

 

Be helpful, knowledgeable and always have the schools best interest at heart.

[3s-gtech]

When you're dealing with anything that can access student data, you can use Child Protection as a guiding principle. Don't take it to ridiculous extremes, but apply it logically - 'could student data be at risk?' Key logging, data scraping and phishing attacks via malware and infiltration pretty much cover that base - yes, student data could be at risk. That pretty much shuts it down.

[Sagima]

If you do end up having to hand over admin rights it should be a separate admin account that she has to use runas for - I wouldn't just admin enable her domain account if you still need to support it.

[GRitchie]

Thanks guys. It would only be local administrative rights she would need on her own laptop for the purpose of installing software, but a lot of what you said covers that still.

 

I then am presented with the 'we have to have some level of trust in the staff' comments. Which is also a tough one to battle!

 

 

Not long before this, I'd removed Task Manager for students. After an uproar from the same member of staff, guess what I've been asked to make available again. And guess which students are ending Impero services etc.

[Areku]

who manages the security and protection of the network, you or her?

 

you, its not her call, if teachers where able to manage a network correctly, there would be no need for any of us to support and run it for them.

 

Students killing impero? block task manager, they had the opportunity, classroom management has failed. we step in to make it safe.

 

Instead, how about a step in between? maybe like a virtual box, with say deepfreeze on? off the network obviously?

 

Just because "its easier if X" is not a good enough excuse when we are talking about steps to protect data, yours, hers, and the students.

 

 

i know i sound like an arse here, but i really winds me up when teachers stop being teachers and start to think they are network admins/managers.

[GRitchie]

Tell me about it, welcome to my world. and the previous NM has done me no favours letting them do as they wish...

 

I don't want to seem like the bad guy either and have the staff hate me, but then the staff/HT says 'well we'll punish those who are stopping the services for Impero'.

 

Oh well, in which case we'll map them to the staff shared area too and if they open something, we'll just tell them off.......

 

:mad: :mad:

 

 

EDIT: and don't get me started on the 'you're not being fair - it's your way or no way' comments from staff..............

Edited December 10, 2015 by GRitchie

[X-13]

EDIT: and don't get me started on the 'you're not being fair - it's your way or no way' comments from staff..............

 

Just agree with them.

 

"Yes, it IS my way or no way. I'm the Network Manager and I'm fixing problems the old guy created. One of those fixes is removing permissions that you shouldn't have."

[GRitchie]

Hahaha! Don't you love making enemies as soon as you start a new job?

[X-13]

Hahaha! Don't you love making enemies as soon as you start a new job?

 

Better to come in guns blazin' and mellow out, than start off weak and let them expect it.

 

It's easier for staff to accept that you've relaxed, than accept that there are new rules... as you now know.

[Areku]

Just agree with them.

 

"Yes, it IS my way or no way. I'm the Network Manager and I'm fixing problems the old guy created. One of those fixes is removing permissions that you shouldn't have."

 

 

 

oooh blame the predecessor... good idea!