Supply teacher accounts

[Rob_D]

We create individual accounts for each supply teacher, with standard staff internet access, no email, read only permissions to the shared area, and they get disabled at the end of every day (powershell script against the supply_teachers OU).

We only clear the supply accounts out at the end of the year, so if the same teacher comes back again, they can use their old account.

 

Long term supply get set up as regular staff, but kept in their own OU to make management easier.

 

As for trainee teachers, they have a contract and sign the AUP, so they get treated like regular staff (minus remote access). (Although might look at giving them their own OU at some point)

[KevinB]

Thanks for your input KevinB

 

But that seems to go against this thread altogether.

 

Why for instance are so many not allowing access to MIS systems/ shares etc if this is not a problem?

 

Just wondering [emoji849]

 

I think it's to do with who we are . As IT managers we are used to battening down the hatches as much as humanly possible, sometimes in a way that interferes with efficiency. That was very necessary in the past when systems were difficult to manage and harden but nowadays we have to tread a line between running open and vulnerable systems versus being Mordac the Preventer of Information Services. Each establishment is going to come to its own conclusion as to where to draw that line, and we try to draw it in a place that's legally compliant and safe, but not so far down the Mordac route as to make life more difficult than it needs to be.

[crwardell]

Supply accounts are essentially staff accounts but without all the mapped drives - just the planning and student work shares. No Office365 access, no MIS and they have remote sign-ins revoked. password changed weekly.

 

Hi Oaktech,

 

I hope you don't mind me asking.

What are the reasons you do not allow Supply teachers access to Sims etc?

I am trying to think of a valid reason to pass onto senior management. :-)

[Oaktech]

Hi Oaktech,

 

I hope you don't mind me asking.

What are the reasons you do not allow Supply teachers access to Sims etc?

I am trying to think of a valid reason to pass onto senior management. :-)

 

Long term supply/mat cover get access because they are responsible for registering a class.

 

Single day/Cover supply do not because classes are tied heavilly to logins and to create a new login and assign a class to it each time we have a supply is considered too much work. We have discussed having a supply login for each class but this has been vetoed again as being an unacceptable administrative overhead as the password would need to be changed after each different supply/cover has used it. It's worth noting that I don't assign MIS access, it's done through the office manager.

[Alis_Klar]

I wonder if InVentry can sync to AD and create a personalised supply login for staff when they sign in and make them click through the AUP on that screen too.

 

We have ScholarPack MIS which can spit out a daily supply password BUT it still has to be rest manually and this has two issues.

 

• I doesn't change every day automatically so someone with the old password can still get access the next day. There is simply a reset now button.
  
• More annoyingly if one office secretary resets it then another supply arrives and it is reset again by another secretary and they don't tell each other then the first password card will not work as the password has changed!!
  
• It doesn't even have a 'last reset' date and time
  

 

I have told ScholarPack and they have left it like this for over 2 years.

[hardtailstar]

Sometimes we can have a lot of supply staff in. Currently we have supply1, supply2, supply3 that is given out by the cover person. With this account they can login to the network as a normal teacher, access teacher shares and youtube/internet.

 

How do you guys manage supply requirements?

 

Exactly the same.

 

Our supply accounts don't have access to our shares (relevant work is passed on USB pens) - the account has access to the internet and the standard office apps (and some other bits of software) but not much else.

 

All our cover work is sent to a Cover inbox which every member of staff including supply teachers so they can access the work.

[Shaun_Dark_Lord]

We've moved to individual accounts for supply teachers. I hate having generic accounts, as inevitably, the kids find the login credentials. This doesn't create a huge workload. We have a powershell script setup for cover staff creation, so all we need to do is put their name and username into a csv and press "run".

[Alis_Klar]

We've moved to individual accounts for supply teachers. I hate having generic accounts, as inevitably, the kids find the login credentials. This doesn't create a huge workload. We have a powershell script setup for cover staff creation, so all we need to do is put their name and username into a csv and press "run".

 

Do you have or know of a script that will run interactively to ask the username and password on an ad-hoc basis without creating a CSV? (which is more suited to bulk creation)

[Shaun_Dark_Lord]

Do you have or know of a script that will run interactively to ask the username and password on an ad-hoc basis without creating a CSV? (which is more suited to bulk creation)

 

Yes - You could write a simple script using Read-Host to prompt for each variable.

 

I prefer to dump them in a CSV, even if it's just one user - That way a typo is more likely to be noticed before the account is created and not create more work.

[Shaun_Dark_Lord]

Do you have or know of a script that will run interactively to ask the username and password on an ad-hoc basis without creating a CSV? (which is more suited to bulk creation)

 

A simple script could be;

 

Import-Module ActiveDirectory
$dnsroot = '@' + (Get-ADDomain).dnsroot
$OU="OU=Supply Staff,OU=Users,DC=MyDomain,DC=sch,DC=uk"
$FirstName = Read-Host "First Name?"
$LastName = Read-Host "Last Name?"
$FullName = $FirstName + " " + $LastName
$SAM = Read-Host "User Name?"
$UPN = $SAM + "$dnsroot"
Write-Host "Creating user account $SAM for $FullName"
New-ADUser -Name "$FullName" -SamAccountName $SAM -UserPrincipalName $UPN -DisplayName "$FullName" -GivenName $FirstName -Surname $LastName -AccountPassword (ConvertTo-SecureString “Password123” -AsPlainText -force) -Enabled $true -Path "$OU"

[howartp]

Write-Host "Resetting Isolation password"

$Expiry = Get-Date -Hour 15 -Minute 15 -Second 00
Write-Host "Account Expiries will be set to: " $Expiry  #Today at 3.15pm

Import-Module ActiveDirectory

$subjects = "Maths","Geography","History","Science","French","German","Spanish","English","Drama","Music"
$subjectnum = Get-Random -Maximum 9 -minimum 0

$number = Get-Random -Maximum 999 -Minimum 111
$randomPasswordTxt = $subjects[$subjectnum] + $number
$randomPassword = ConvertTo-SecureString -string $randomPasswordTxt -AsPlainText -force


Set-ADUser isolation -AccountExpirationDate $Expiry
Set-ADAccountPassword isolation -reset -newpassword $randomPassword

Write-Host "Account updated"

Send-MailMessage -SmtpServer "192.168.5.15" -From "[email protected]" -To $("[email protected]") -Subject "Isolation guest account" -Body $("Isolation account for guest students:`r`n`r`nUsername: isolation`r`nPassword: $randomPasswordTxt`r`n`r`nThis password will expire at 3.15pm.`r`n`r`nYou will receive a new one at 8am.`r`n`r`nIT Support.") 

Write-Host "Email sent"

This is our script that resets the password and expiry for the student isolation user (spare PC in the isolation/removal room) every morning.

 

Generates passwords such as Maths123, German826, Science176 etc etc etc

 

Easy enough to type and even remember, but resets every day so no problem.

[Alis_Klar]

A simple script could be;

 

Import-Module ActiveDirectory
$dnsroot = '@' + (Get-ADDomain).dnsroot
$OU="OU=Supply Staff,OU=Users,DC=MyDomain,DC=sch,DC=uk"
$FirstName = Read-Host "First Name?"
$LastName = Read-Host "Last Name?"
$FullName = $FirstName + " " + $LastName
$SAM = Read-Host "User Name?"
$UPN = $SAM + "$dnsroot"
Write-Host "Creating user account $SAM for $FullName"
New-ADUser -Name "$FullName" -SamAccountName $SAM -UserPrincipalName $UPN -DisplayName "$FullName" -GivenName $FirstName -Surname $LastName -AccountPassword (ConvertTo-SecureString “Password123” -AsPlainText -force) -Enabled $true -Path "$OU"

Many Thanks @Shaun_Dark_Lord

 

Does this assign the password "Password123" and then you reset it as required? Would also want the script to spit out a the name and username to the default printer.

[Shaun_Dark_Lord]

Many Thanks @Shaun_Dark_Lord

 

Does this assign the password "Password123" and then you reset it as required? Would also want the script to spit out a the name and username to the default printer.

 

Hi

 

I could write the script for you, but a this is writing to your AD, it's probably a better idea for you to do a bit of reading, and figure out the next steps yourself. That way you'll have a good idea what to fix when it goes wrong.

[CHiLL]

Sorry to hijack this thread, but I've been working on my own script with inspiration from this thread, but I am struggling with the creation of the password in a ForEach loop.

 

I have 2x source text files - One contains a list of animals and another contains a list of special characters. I use these in conjunction with a random three digit number created in Powershell to generate a new password, such as Lion265&.

 

$Animal = Get-Random -InputObject (Get-Content 'D:\Scripts\List of Animals.txt')
$Number = Get-Random -Minimum 100 -Maximum 999
$SpecialCharacter = Get-Random -InputObject (Get-Content 'D:\Scripts\List of Special Characters.txt')
$Users = @('Cover1','Cover2','Cover3')

ForEach ($User in $Users) {

#Create random password
$RandomPassword = $Animal + $Number + $SpecialCharacter
New-Item -Path 'D:\Scripts' -ItemType File -Name "$User.txt" -Value $RandomPassword}

 

This script does generate a random password and creates 3x text files for each user in the array...however the password is the same password in each file. It's as if the $RandomPassword variable isn't being changed in each pass of the ForEach loop. I'm unsure why.

 

Edit: I'm stupid. I have declared the password variables outside of the ForEach loop, so they would be static. Putting them inside the loop would solve the issue.

Edited May 3, 2019 by CHiLL

[Shaun_Dark_Lord]

Sorry to hijack this thread, but I've been working on my own script with inspiration from this thread, but I am struggling with the creation of the password in a ForEach loop.

 

I have 2x source text files - One contains a list of animals and another contains a list of special characters. I use these in conjunction with a random three digit number created in Powershell to generate a new password, such as Lion265&.

 

$Animal = Get-Random -InputObject (Get-Content 'D:\Scripts\List of Animals.txt')
$Number = Get-Random -Minimum 100 -Maximum 999
$SpecialCharacter = Get-Random -InputObject (Get-Content 'D:\Scripts\List of Special Characters.txt')
$Users = @('Cover1','Cover2','Cover3')

ForEach ($User in $Users) {

#Create random password
$RandomPassword = $Animal + $Number + $SpecialCharacter
New-Item -Path 'D:\Scripts' -ItemType File -Name "$User.txt" -Value $RandomPassword}

 

This script does generate a random password and creates 3x text files for each user in the array...however the password is the same password in each file. It's as if the $RandomPassword variable isn't being changed in each pass of the ForEach loop. I'm unsure why.

 

Edit: I'm stupid. I have declared the password variables outside of the ForEach loop, so they would be static. Putting them inside the loop would solve the issue.

 

Happens to all of us

[CHiLL]

Happens to all of us

As soon as I posted it and read it back it was obvious! I'm now building the rest of the script to set the password in AD and email the file. This will make life easier for us.

[CHiLL]

Here's my finished script:

<#02/05/2019 - Script to create a random password for Cover and Visitor accounts, to be scheduled daily for a 'password of the day' function.

To create an encrypted password file that can be called without passing the password via plain text, use this command:
Note: It appears that the hashed password only works on the machine it was generated on. If you need to run the script on another machine, a new file will need re-creating on that machine.
#$Password = Read-Host "Enter Password" -AsSecureString | ConvertFrom-SecureString | Out-File -FilePath "\.txt"#>

############################################################################################################################################################################################
#Variables
############################################################################################################################################################################################
$Password = (Get-Content -Path "" | ConvertTo-SecureString)
$Credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username, $Password

$CSVFolder = 'D:\Scripts'
$CSVFile = $CSVFolder + "\TemporaryPasswords.csv"
$AnimalText = 'D:\Scripts\List of Animals.txt'
$SpecialCharacterText = 'D:\Scripts\List of Special Characters.txt'

#Specify accounts that will have their passwords reset
$Users = @('Cover','Cover1','Cover2','Visitor1','Visitor2','Visitor3','Visitor4','Visitor5')

#Specify expiry date
$Expiry = Get-Date -Hour 16 -Minute 00 -Second 00

#Define email parameters
$EmailParams = @{
   To = ""
   From = ""
   Subject = "Passwords of the Day"
   Body = "Please find attached today's new passwords of the day. `n `n Note: These accounts will be automatically disabled at 4pm today."
   Attachments = $CSVFile
   SMTPServer = "smtp.office365.com"
   Port = "587"
   Credential = $Credential}

############################################################################################################################################################################################
#Actions
############################################################################################################################################################################################
#Create/Overwrite CSV that will be populated with the new passwords
New-Item -Path $CSVFolder -ItemType File -Name 'TemporaryPasswords.csv' -Value '"Username","Password"' -Force
Add-Content -Path $CSVFile -Value "`n" #Adds blank line to prevent passwords being joined to the first line of the CSV

ForEach ($User in $Users) {

#Obtain random sections for the password
$Animal = Get-Random -InputObject (Get-Content $AnimalText)
$Number = Get-Random -Minimum 100 -Maximum 999
$SpecialCharacter = Get-Random -InputObject (Get-Content $SpecialCharacterText)

#Join the sections together to create one password string
$RandomPasswordText = $Animal + $Number + $SpecialCharacter

#Convert new password to a secure string
$RandomPassword = ConvertTo-SecureString -String $RandomPasswordText -AsPlainText -Force

#Add the password into the CSV file
Add-Content -Path $CSVFile -Value "$User, $RandomPasswordText"

#Set AD account password to newly created password
Set-ADAccountPassword -Identity $User -Reset -NewPassword $RandomPassword

#Set account expiry date to 4pm that day.
Set-ADUser -Identity $User -AccountExpirationDate $Expiry}

#Send email with password CSV as an attachment
Send-MailMessage     @emailParams -UseSsl -Verbose
Write-Output 'Email sent.'

Edited May 3, 2019 by CHiLL

[craigcamacho]

Hi,

 

I am trying to implement this but its prompting me for a username and password when i run it. Any chance you can explain what i need to do with these variables if anything please?

 

$Password = (Get-Content -Path "" | ConvertTo-SecureString)

$Credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username, $Password

[Boredguy]

Well you replace with the C:\Powershell\NiceSecurePasswordFile.txt which contains your password (or where else you choose to store the file)

 

The instruction on creating the file is 4 lines above it in the script

[DrBeaker]

Sometimes we can have a lot of supply staff in. Currently we have supply1, supply2, supply3 that is given out by the cover person. With this account they can login to the network as a normal teacher, access teacher shares and youtube/internet.

 

How do you guys manage supply requirements?

 

Same as you supply1, supply2, etc. Inherited but works OK. Logins given out by the Head's PA/cover staff.

 

Exactly the way you do it unless they're in on long term supply (>1 week) in which case we create them a specific account.

 

That's what I've tried to implement, anything longer than a week or more should have a proper account. That's up to HR, admin etc with onboarding and staff planning, not an IT issue AFAIC. E.g. I got asked today by someone about a new starter that's been here since September, doesn't have an account but and wasn't on the list I was given or any emails. Not my problem AFAIC.

 

@witch does this not open up issues in terms of Safeguarding (and subsequently GDPR) with access to files that may contain confidential data?

 

I've said exactly the same thing here and ....

 

Yes

Have I mentioned it

Yes

Has anything been done

No

 

 

That is all

 

Same as witch, they've done nothing about it, GDPR officer etc.

[craigcamacho]

Yeah I have generated my encrypted file but i am getting the following error when i run the main script.

 

"Cannot process argument because the value of argument "userName" is not valid. Change the value of the "userName"

argument and run the operation again."

 

Obviously I am being prompted for my password when i generate the encrypted file but struggling to understand how it is pulling the username. In the instructions for creating the encrypted file it mentions the below. Is it pulling my username from the file name or is that just for labelling purposes or is my username being passed through from my current login session on the server? If it is pulling from the file name what is the correct formatting? "E:\A.UserDC01"?

 

"Out-File -FilePath "\.txt"

Edited October 1, 2019 by craigcamacho