Administrator Access

[Guest itnewbie]

I have recently asked to be added to the administrators group on our network so that I can log onto servers and help with problems with student's home directories.

 

I have been told that this isn't possible as being an administrator is a priveledge reserved for senior management only. Apparently IT support staff are not routinely given this level of access and need to consult management if they need to get to someone elses folder or make changes to servers.

 

This is my first job in a school. Is this normal practice?

[Guest Guest]

lmao It isnt a PFI type school is it?

 

So what exactly are you employed to do if you dont have admin access? Are you just a toner monkey?

 

Oh and to answer your question; If its a PFI type school then yeah it seems pretty common, but ive never heard of that being the case in a "normal" school

Edited March 26, 2008 by Guest

[Domino]

are you sure the person you spoke to understood what you were asking for?

 

I've never heard of senior management having access to servers, they certainly don't here!

[Michael]

No that isn't standard practice at all. What a crazy policy. I have full domain administrator access at all my sites. How else are you supposed to administer the network?

 

If you've been employed/hired to look after the network someone needs to wake up and give you that required access.

[Guest itnewbie]

What's a PFI type school?

[Gatt]

Private Finance Initiative - part of the Building Schools for the Future (BSF)

[joe90bass]

No that isn't standard practice at all. What a crazy policy. I have full domain administrator access at all my sites. How else are you supposed to administer the network?

 

If you've been employed/hired to look after the network someone needs to wake up and give you that required access.

 

Exactly!

[Guest PatBoland]

Senior Management having access to servers!! Definitely not here, chaos would reign and then end of network!!

[jcollings]

*Only* the technical team here are admins. No-one else. Not SMT, not Head of IT.

[fooby]

:O :O hahahahah

 

first thing my NM did when he started was TAKE admin away from everyone apart from him, most IT teachers and such had waay too much access. SMT and the principal didnt have admin so wasnt so much a problem.

 

See Acceptable Use Policies, and Data Protection Act. Make the users (at logon) click ok to accept your AUP then in the AUP state who has access (the NM and technical staff only will have full access to control the network, all teaching staff will have read write access to student documents (we do this here)) hopefully this will cover you.

[FN-GM]

*Only* the technical team here are admins. No-one else. Not SMT, not Head of IT.

 

Same here....

 

What is it that need fixing?

[Guest itnewbie]

Surely the head of IT should have the highest level of authority on a school's IT system?

 

Interesting that I seem to be in the minority not being an admin myself. I might pass on some of these comments to our management.

[MyDejaVu]

the Head of IT is just the Department Top Manager, just like the other Heads eg. Head of English, Head of Maths, Head of Languages. Heads of IT are not necessarily involved in the School's Network Infrastructure.

[Guest Guest]

Surely the head of IT should have the highest level of authority on a school's IT system?

 

Nope. Being able to teach IT doesnt mean you know how to use a computer and especially doesnt mean you have any idea about network management and security.

 

You might be lucky in having a head of IT who is capable of managing (some of) the system but you are certainly in an extreamly small minority.

 

What exactly does the head of IT want admin rights for? If he wants to see kids folders just setup the appropriate access for his account. Surely he doesnt install software on servers, play with policies, etc?

[Diello]

Surely the head of IT should have the highest level of authority on a school's IT system?

 

Interesting that I seem to be in the minority not being an admin myself. I might pass on some of these comments to our management.

 

Data Protection may also come into it - SLT have no need to have Admin access. Even BECTA (Gov's IT in Edu agency), will say that Admin access should only be for those charged with providing IT services to the school.

 

The way you have it is the total opposite to how it should be. They shouldn't have access, IT technical staff should have, NEED, access to everything.

 

What you describe is the insane.

 

The Head of ICT, unless also IT Manager, has no more right to admin rights than the Head of MFL. Even under BSF, SLT wouldn't have admin rights!

[Kitkatninja]

the Head of IT is just the Department Top Manager, just like the other Heads eg. Head of English, Head of Maths, Head of Languages...

 

That's how it is at my place.

 

Head of IT (or ICT) is for the academic department. Network Manager or IT Manager is the head of IT Services. The technical side does not tell the academic side how to teach and the same goes the other way. It's taken 2 1/2 long years (been here 4 years now) for the school to change and accept it - finally

 

-Ken

[Guest itnewbie]

I think our management's view on it is that they should be able to check up on what the rest of the staff are doing if required. It is also felt that there are data protection risks involved with giving support staff admin access. For that reason, we have to go to them if we need to logon to a server or access users folders, etc.

 

I don't necessarily agree with this, but I've only been in this kind of job for a small amount of time so it's not really my place to argue with them.

[joe90bass]

I think our management's view on it is that they should be able to check up on what the rest of the staff are doing if required. Why!!?? Don't they trust their staff?

 

It is also felt that there are data protection risks involved with giving support staff admin access. For that reason, we have to go to them if we need to logon to a server or access users folders, etc. More of a risk from you not being able to do your job. Are they going to setup all permissions properly?

 

I don't necessarily agree with this, but I've only been in this kind of job for a small amount of time so it's not really my place to argue with them. Nothing to stop you putting forward a case for you having unrestricted access to do your job, as per contract/job spec. I've not heard of any other school working this way!!!

[elsiegee40]

IMHO The people who actually run the network have to have Admin rights.

 

I have 2 logons: An Domain admin logon (that I only use when I need that level of Privilege... but that's most days!) and a teaching logon (which I use if I'm in with the kids, so my desktop is the same as the other teachers)

 

There has to be trust somewhere along the line and data sensitivity has always had to be entrusted to net admins. I was a Systems Programmer for a big insurance company for 10 years; I could have found out the personal details of many high-profile people; I preferred to keep my job!

 

It is also my opinion that management almost never need admin rights. Like everyone else, they need access to certain files and the scope may be wider than what teachers need. However, they do NOT need admin rights to get to that data; permissions need to be set up so they can get to what they need to. Admin rights extend to far beyond simply viewing information in folders; they are dangerous and you need to know how to use them!

 

A final point:

 

By having admin rights, management have the right to change student data. Exam boards take a very dim view of this. Management may say 'but we'd never do this', but if the school came under suspicion and this loophole was found there could be trouble.

[Heebeejeebee]

I think our management's view on it is that they should be able to check up on what the rest of the staff are doing if required. It is also felt that there are data protection risks involved with giving support staff admin access. For that reason, we have to go to them if we need to logon to a server or access users folders, etc.

 

I don't necessarily agree with this, but I've only been in this kind of job for a small amount of time so it's not really my place to argue with them.

 

Madness !!

 

HBJB

[strawberry]

I think our management's view on it is that they should be able to check up on what the rest of the staff are doing if required. It is also felt that there are data protection risks involved with giving support staff admin access. For that reason, we have to go to them if we need to logon to a server or access users folders, etc.

 

I don't necessarily agree with this, but I've only been in this kind of job for a small amount of time so it's not really my place to argue with them.

 

does your caretaker get to have keys? or does he have to goto the head to ask if he can open up the school every day?

 

ffs. some smt just plain dont get it.

[m25man]

What about coming into your office in the morning to find the head having re-installed exchange 2003 from an MSDE ISO he has downloaded, whilst having just dropped the Sims server out of the domain into a workgroup and given his PA full domain admin rights so she can get into everyones exchange mailboxes and home areas!

 

There are sites like this where the SLT belive that it is their right to do what ever they want on the network. The sole purpose of the network manager is to take the fall when it all goes wrong!

[elsiegee40]

What about coming into your office in the morning to find the head having re-installed exchange 2003 from an MSDE ISO he has downloaded, whilst having just dropped the Sims server out of the domain into a workgroup and given his PA full domain admin rights so she can get into everyones exchange mailboxes and home areas!

 

There are sites like this where the SLT belive that it is their right to do what ever they want on the network. The sole purpose of the network manager is to take the fall when it all goes wrong!

 

 

Actually, I think my notice would have to go in under those circumstances.

[Diello]

Actually, I think my notice would have to go in under those circumstances.

 

Definitely - whilst a long letter explaining the situation, normal procedure, and legal obligations, being sent to the Chair of Govs and the LEA as well. There'd also be a Union case for being stopped effectively doing your job.

[jcollings]

Surely the head of IT should have the highest level of authority on a school's IT system?

 

Interesting that I seem to be in the minority not being an admin myself. I might pass on some of these comments to our management.

 

Not at all. As others have said he's head of a teaching department. No different than Head of Maths, History etc. He doesn't play a part in running the network just teaching the ICT. He did ask for it on day one and was politely refused. He didn't ask after that. There is no reason anyone else needs admin rights really.