Supply Teacher Logins

[sippo]

How do you do it? Do you use a generic login, then ask the cover team to reset the password once they have left? What do you do for short term or long term supply staff?

[3s-gtech]

We never use a generic logon - it makes the process of tracking who was where, safeguarding, email in an emergency, MIS cover etc much harder. Of course that means we have to set each supply teacher up - which takes about ten minutes.

[Oaktech]

Generic login, password changed nightly by script and notified to office staff by email.

 

Staff staying longer than a week get their own login and email and sign the standard AUP.

[Chaniel]

We use generic logins (Supply01, Supply02 etc.), the cover team can then assign those to specific cover staff and know who is where, email the right person etc. Short term supply staff get very limited access, essentially the same as a student account, coverwork is put into a folder for them to access which is mapped as a drive.

 

Long term supplies will get a proper account set up like a normal member of staff.

[gmonks]

Have a dedicated supply account, regularly changing the password.

[Sonic007]

Supply1, Supply2, etc.

 

Limited access accounts and same with MIS access.

[howartp]

Coverstaff01, 02, ....

 

Hacked the SIMS Cover list (cover.html) to display the cover email address of the particular cover person so staff know who to email work to.

 

(Powershell reads AD forename, surname, display name and outputs a CSV. PHP reads the original cover.html with coverstaff names and substitutes accordingly as it displays)

[Ditto]

I've avoided the use of generic accounts from a best practices point of view - does Cyber Security Essentials cover this? My approach is to make the creation and deletion of accounts as automated as possible so it is little more than a press of a button.

[southhamster]

We have 20 supply01 etc and reset passwords after use. Sealed . Envelopes in the safe handed out in rotation so we know if any have been used.

[sigma]

I dislike generic accounts, but as I only do 3 hours a week at 2 particular schools, supply techers can have been and gone before I ever know anything about them. I think I could make the sealed envelope approach work.

[MatthewL]

Generic accounts a no no for users, if your not in very often why not create an OU in AD, assign a security group that can create users and reset passwords and setup a MMC taskpad using RSAT and give Office Manager or someone/several people access to create and reset passwords for each person. Create a template account that they can copy and don't allow any other changes, problem solved.

[Tones]

Interested in knowing how someone deals with this that's been Cyber Essentials certified as it states:

 

"Can you only access laptops, computers and servers in your organisation (and the applications they contain) by entering a unique user name and password?

You must ensure that no devices can be accessed without entering a username and password. Users cannot share accounts."

 

A unique user name and password for everything and no sharing of accounts. So technically the only one who could pass in this thread is 3s-gtech and ditto based on their responses.

[Ditto]

Interested in knowing how someone deals with this that's been Cyber Essentials certified as it states:

 

"Can you only access laptops, computers and servers in your organisation (and the applications they contain) by entering a unique user name and password?

You must ensure that no devices can be accessed without entering a username and password. Users cannot share accounts."

 

A unique user name and password for everything and no sharing of accounts. So technically the only one who could pass in this thread is 3s-gtech and ditto based on their responses.

I had Cyber Essentials in mind when I replied, but also doesn't NCSC suggest the same? I've yet to get my charity to pursue CE, but I am shifting mindsets bit by bit.

[free780]

What sort of lead time do schools have for account creation?

 

In HE we have visiting lecturers but we get enough notice to create individual accounts.

 

Test accounts are also shared which isn’t inline with CE. They really should be assigned per user. When you have MFA enforced shared accounts just don’t work or you limit access to on site.

[jmak]

What sort of lead time do schools have for account creation?

 

In HE we have visiting lecturers but we get enough notice to create individual accounts.

 

Test accounts are also shared which isn’t inline with CE. They really should be assigned per user. When you have MFA enforced shared accounts just don’t work or you limit access to on site.

1) Teacher phones head teacher at 6.30am to say they're going to be off sick.

2) Head teacher phones supply agency when they open at 7am.

3) Supply teacher arrives at 8am (unless they're coming from too far away, in which case the issue is that the IT tech can end up supervising the class until they get there which is a whole different issue)

4) IT tech arrives at 8:50 to start work at contacted time of 9:00

 

So about minus one hour [emoji57]

 

In seriousness, it needs to be an automated system that a teacher can use (supply teachers often arrive before office staff).

[Tones]

I'm thinking an easy solution without giving direct access to AD and with minimal training is:

Have a CSV file on a restricted share to those who need it; headers as required for a new account

Task scheduler on a suitable server using a powershell creation script that looks at the csv, creates an account in a specific OU, clears the input csv, and outputs the new user / password for the cover supervisor.

 

I think that should cover the requirements and is minimal fuss for everyone.

 

Any other ideas?

[DaveTheTech]

I'd be tempted to look into powerApps.

But it would do the exact same as the above. But add in approvals and notifications - similar to the Class Drop In function for Teams.

[Jcx500]

We have a dedicated ou for this , we know the dates when they start and finish and it expires the day they leave. These accounts are locked down more than the standard staff account