Staff Admin rights

[itgeek]

Please can you advise if I should give Staff at our school Administrator rights on there own laptop`s. Please can anyone advise. I can see problems like itues and other software being installed.

 

Thanks

[Edu-IT]

Is there a reason why they need administrator rights? If not then personally I wouldn't bother. If all the software they need is installed on the laptop then I can't think of any other reason why they would need administrator rights, other than to modify settings and install more software.

[kmount]

We allow it under the proviso that if they wreck it, we flatten it and put it back to how it was when they were first handed it.

[jcollings]

We allow it under the proviso that if they wreck it, we flatten it and put it back to how it was when they were first handed it.

 

Pretty much the same here.

[laserblazer]

We do the same and only one teacher has done anything to be frowned upon. To be honest, the other teachers give him more grief than I do because if they use his classroom they have to take their own laptop with them as they can't find their way around his.

[chrbb]

All our staff have local admin rights on the school laptops for use off the network. No problems as yet!

 

Sorry hijacking this thread for another question.

 

Do most people use the same domain/gp restrictions for head/smt?

[kmount]

Yep, no special treatment on permissions.

[Gatt]

Nope, All of SMT (bar 1) get the same Domain/GP settings as everyone else in the school..

Tho I'm going to be re-assesing Admin permissions shortly....

[kmount]

What happens for the "bar 1"?

[Gatt]

He has a few titles (Asst Head/Head of ICT/Head Of Science/Dir. of E-Learning...Chief Botttle Washer...) and he was acting-NM for a while before I came, so he has the same rights as me and my tech..

 

But I'm going to be re-evaluating the Permissions come Septemeber as I say so he may end up with fewer permissions than he had before...

[chrbb]

So even the head has same locked down machine? I've had an inkling recently that my head is none too happy with a locked down machine! But not really sure what to do as the head runs the show and employs me!

[cookie_monster]

We ran into no end of issues when they had restricted rights especially in the hols when we aren't always around. In the end we gave them local admin rights and made them sign an agreement that A, We would image it if they caused any issues and B, they aren't allowed to install Games or P2P apps. This applies to SMT and Teachers.

 

We do have a less restricted policy for those that want to do what they like, they get the laptop but can't use it on the network. They can use the internet at home and use a pendrive to transfer docs from the laptop to the network.

Edited February 20, 2008 by cookie_monster

[Ryan]

Just to chip in...

 

To the hijacked sub-thread: all staff from head to cleaners all get same permissions here, and are subject to the same pc and network restrictions and web filtering.

 

And relating to admin permissions: Some staff (that i trust) get local admin on their classroom machines, and that's it.

[kmount]

So even the head has same locked down machine? I've had an inkling recently that my head is none too happy with a locked down machine! But not really sure what to do as the head runs the show and employs me!

 

Our machines are only locked down from a network perspective, and its not posed any problem for us at all, not even with the 'needy' IT teachers.

[GrumbleDook]

Staff have local admin rights on their school laptops and also a local account with admin rights for when at home.

 

They all know the rules about sticking software on and we do threaten them with an audit every so often. We have very few issues with them cocking things up and most staff are now competent enough so that we don't have to worry too much.

 

When they are logged into the school domain they get locked down, restricted control panels, etc ... but this is mainly so they have the same experience as students on desktops so that nothing they demonstrate should be that different to students.

 

We also clearly remind staff that the laptops belong to the school, not the staff ... they are only to be used at home for work purposes otherwise they become a taxable perk, that no other people (husband/wife/partners/children/etc) should use the machine and that no students are to use their machines either.

[Ric_]

As Tony says, the laptop is the school's property and, as such, it is my belief that there should be no need for anybody to have elevated priviledges.

 

None of the teaching staff where I work have elevated priviledges on laptops but we are very ammenable when it comes to installing extra gubbins for them.

[plexer]

The head doesn't employ you.

 

Ben

[localzuk]

The head doesn't employ you.

 

Ben

 

Actually, in most schools, the head does appoint everyone. I found out that all staff appointment decisions are ultimately up to the head, except for the headship itself.

 

But on the subject of local admin priv's, all teachers have local admin priv's on our network and I am starting to think it is a bad idea. Random bits of software and hardware are being purchased and installed, and some which is being pinched from other schools. I'm going to be writing a policy document for laptop use, as there is nothing guiding it other than a 'you have to pay for it if you break it, and you should cover that with your own insurance when it isn't off site' policy.

[chrbb]

Yes in theory the head doesn't employ me but they are the boss and that's what counts!

 

Staff have local admin rights on their school laptops and also a local account with admin rights for when at home

 

Do you give staff local admin rights whilst logged on as a domain member and if so is it just a case of adding their domain username to the local admins group? this may be an adequate solution in this case.

[Ryan]

so is it just a case of adding their domain username to the local admins group?

Exactly

[Michael]

I allow all staff users local admin rights on laptops only. Staff always want/need to install/test new software they come across and I'd rather they do it on the laptop and not on a workstation connected directly to the domain!

 

Also, lots of staff have broadband and as we all know, the majority of broadband packages are still supplied with a USB modem, which of course requires drivers to be installed. Some staff also like to install the Google Toolbar (for example), which I don't mind too much.

 

There are some which install MSN Live Messenger, iTunes and Football Manager, but I really couldn't care less. It's my job to ensure the laptops are working correctly. It's the ICT Co. who should monitor/evaluate what staff are doing with laptops.

[DG01]

We issue staff with laptops which is installed with all the necessary software they need for day to day use.

 

The laptops are sync'd with the network via .bat scripts every time they login (when connected with a network cable/wireless) to update as required.

 

On the network they are totally locked down however on their laptops they have administrator privileges and full liability/responsibility for any inappropriate use.

 

They are warned what is acceptable and what is not prior to being issued with a laptop.

[witch]

The teachers here can do anything they damn well like with the laptops and there isn't a thing I can do about it. I can't even get them to sign a bit of paper taking responsibility for the machine (the head doesn't care, you see). They have full local admin rights but when on the network they only get what is set for all which amounts to being able to delete printer queues and that is it.

I did get proper anti-virus on the machines - set to update from the network or home or anywhere - so that is something, I suppose!

[chrbb]

Well ours are set up with a local admin account for staff to login to at home if they need to setup broadband etc, but their domain account for when they logon at school is restricted and locked down, they don't have local admin rights for this account. Never had a problem, staff sign aup, I've set up proxy on and off 'buttons' for home broadband use if they want to login using their school account. Except recently as I said I've an inkling that the head isn't so happy with the arrangement! But am going to add them to the local admin account and see if that helps.

[azrael78]

We allow it under the proviso that if they wreck it, we flatten it and put it back to how it was when they were first handed it.

 

Same here. Plus we give them a local admin account (so we don't make their domain account a local admin) - so they can just login using their normal login information to work - and local admin account to install software/etc.