Network Access - who gets what?

[boomam]

Hi.

I was wondering what sort of access people at your schools/colleges get.

What i mean is, that outside of techies, network admins, ect; who else gets domain admin or even admin access?

 

Bits of internal politics happening here, and i think there's a chance that the head of ICT will demand from the head domain admin access 'because he needs it', and also wants me to document down things for him to do if im not here for worst case scenarios. (His old fix when i wasnt here of pulling the power and restarting wont quite work with our new blade based network. )

 

Personally, i just want to make him an account with access to things he 'needs' (printer queues, kids work folders, kids internet logs, ect; ) and then nothing else.

 

How does it work at your places. Do anyone but IT technical staff have 'full access'. And if so, how do you manage it?

 

I am actually seriously considering walking if the head decides that he (Head of ICT) should have domain admin access.

 

Thoughts?

[jcollings]

No-one but IT tech. support has admin access here. I don't see why anyone else would need it. Outside that we have the usual staff shares etc which staff can access but not students.

 

When the last head of IT came about 7 years ago he asked for it and I politley declined. He wasn't over bothered. I have started to give staff read only access to student folders so they can look for work etc.

 

What "admin" tasks does your head of IT want to do?

 

I think I'd be pretty miffed if the head made me give admin access to anyone else.

[boomam]

He's justifying it by it being just me there. No helpers.

So its a 'what if your not here' scenario.

 

So he wants training on building workstations, what to do if.

He says he'll never use it. But last time he had access before i cut him off, he started storing all manor of rubbish on the server, amongst other messes he made.

 

I was planning on, as said, a 'power login' to do stuff like student logs and whatnot, some light documentation saying this is how to image a workstation and some stuff about this is what each server does. And that'd be it.

But i think he wants it more in depth than that. Im reluctant to tbh.

 

Especially the domain admin access. Theres no accountability, and as im the only one here, if he messes up, its all on my head.

How they'd expect me to admin the network when the goal posts keep moving i dont know.

He's justifying it by 'ive done it in the past successfully'. Yes, on a one server network, not on a network like whats going in over summer.

 

The head did back me last time he wanted access, but im not so sure now.

[BaccyNet]

Here it is only IT Support who have Domain Admin rights, staff have local administrator rights over their networked laptop but thats as far as it goes.

 

Technically if the head requests administrator access, they should be given it. Not sure about anyone below that (or thats how it was said to me when I first joined, thats not to say I would stick with that idea though )

[jcollings]

Can't say I blame you - yes I can see the point of some kind of power user to reset passwords (ours have a little custom mmc) etc but full admin just isn't justified in my book (and I'm not some BOFH - I really do try to help 'em where possible).

 

Is he really going to build workstations etc? Workforce reform says clearly that teachers should not be doing things that aren't teaching and learning. Hell I can't even get ours to amend N's in the register!

 

As I said earlier I just can't see a reason why a teacher needs admin access - not because I don't trust them just because I can't see how having it helps them.

[bossman]

Just allow him power user access which should allow him access to the things he wants.

I would also have a quiet word with the headteacher and emphasise the fact that the head of ICT if given domain admin rights would be able to look at everything, including any secure documentation that the Headteacher or anyone else for that matter keeps on the servers.

 

Security is a must and you have to stress this to your Headteacher as he/she is legally responsible for the schools data.

[Hightower]

Just the techs here.

 

I have made up some documentation that is pinned on my wall - Server schema's - just details drives and sizes, shares on the server, backup plan, IP's - things like that. Partly so that if anything fails I can always restore with confidence and partly because if I'm not there and something goes wrong.

 

What we have done is created 'systemadmin2' with a random password and stored it in a sealed envelope in the school safe. That way if we're off, something goes wrong then the school can call in the County and they have access to a full admin account if they need it. It is there for this purpose only - no one else can open it.

[joe90bass]

Only techies here have admin rights, there is two of us though. Could you compromise and put the admin password in a locked safe, so if the unfortunate happened to you, and someone else had to step in they could?? As for day to day stuff, only give him the access he needs not wants!!

[strawberry]

i scared mine off by pointing out if anything went wrong then BOTH of the domain admins would get the blame, and i was the one who was properly trained.

[Sylv3r]

Only ICT Support have administrator privelages.

 

The ICT Staff are able to change student passwords.

 

No members of staff have access to any student work areas.

 

All staff other than the ICT Department have the same privelages and logon as a student. This way I can guarantee when a member of staff tries something before a lesson they are certain that it will work for students when the lesson takes place. This is the same for internet filtering also all staff and students have the same access.

[boomam]

Could you compromise and put the admin password in a locked safe, so if the unfortunate happened to you, and someone else had to step in they could??

Thats how it is now.

Im hoping he'll be happy with the power user thing.

 

He wants:

1 - Access to backups

2 - Create new users.

3 - Move users in/out of the internet ban OU.

4 - Access to internet logs for the kids.

5 - Delete/manage printer queues.

6 - Access to kids work

7 - Access to internet filters

 

Now num1 is a non issue as we have shadow copies and he knows how to use it. 2 & 3 can be done by delegating in AD. 4 should be possible as i can have the staffs internet go through the ISA and the kids through the VLE.

5 is simply an issue of giving him the printer security rights.

6 i can map a shared drive or two.

& 7 is similar to 4 as he can do that how it is with the VLE.

 

Is he really going to build workstations etc? Workforce reform says clearly that teachers should not be doing things that aren't teaching and learning. Hell I can't even get ours to amend N's in the register!

Is that info online anywhere?

 

Just allow him power user access which should allow him access to the things he wants.

I would also have a quiet word with the headteacher and emphasise the fact that the head of ICT if given domain admin rights would be able to look at everything, including any secure documentation that the Headteacher or anyone else for that matter keeps on the servers.

 

Security is a must and you have to stress this to your Headteacher as he/she is legally responsible for the schools data.

Ive been accused of being too security centric, even though i havnt done anything to limit what they can do. Merely lock out what they dont need.

 

 

The way i see it:

- No accountability with him having the access.

- Problems are on my head if he messes up.

- Its not good practice to do so.

- It makes my job harder as he could change things by accident.

- Data security, such as admin staff work, containing financial records, would be able to be accessed by him too.

-

[Busybub]

Been where you might be heading and would never want to go there again, I'd quit before it happens again. Had no end of grief getting anything done because of the constant conflicts I would come up against because the ICT teacher decided something was more convenient for him even if it screwed things up for everybody else.

 

Best one was his home folder that become so big that the backups failed due to lack of space (he was single handedly storing 44gb of crap, twice as much as the other 200 users combined). Had to take his files out of the backups so that the others would fit because he refused to delete anything, and he refused to cough up for additional storage... you can guess what happened and who got a bollocking for it.

 

The irony is that he spent 1500 quid on software he never used whilst an extra hard drive would have cost £50 and would have saved his ass!

 

Don't compromise, it's not worth the grief you end up with!

[Hightower]

Is this guy new? If not, where did all this come from? Why is he shouting now?

[strawberry]

Ive been accused of being too security centric, -

 

one mans security is another mans inconvenience. you need to take this matter to the manager who oversee's you both, your job is to run the network, this fella wants you to comprimise what you do to make his job easier. You need to find out what your manager thinks and ask him how you should do your job in light of this bloke making demands.

[jcollings]

 

Is that info online anywhere?

-

 

Teachernet, Key steps

 

 

This lists the tasks that should not be routinely undertaken. Half way down is this:

 

#

ICT trouble shooting and minor repairs

#

Commissioning new ICT equipment

[boomam]

Is this guy new? If not, where did all this come from? Why is he shouting now?

Nah, he's been here since the start.

 

At first, on the existing network, he had lots of access, i cut him off, argued with him, then the head took my side.

Its been alright since.

But over the summer we're building everything from scratch, so i think he's taking the opportunity to lay his mark down.

If he just wants elevated access over other staff, then thats fine.

But Domain Admin access, not a chance. I will quit if the decision goes against me.

 

Whats awkward though, is that im always asking for a second techie, so if i turn down training him in some routine stuff and whatnot, its weakening my position somewhat...

 

I do keep getting told by him that he doesnt want Domain Admin access, but then seconds later i'll get some spiele about how he used to manage fine when he did, so that to me paints a different picture long term.

 

What would you lot say i should train him to do?

Ghosting a workstation?

Resetting the server? (blade based).

Edited June 19, 2008 by boomam

[jcollings]

What would you lot say i should train him to do?

Ghosting a workstation?

Resetting the server? (blade based).

 

No - it's not his job! If he has time to ghost workstations etc he'd be better served working on some inovative teaching and learning project.

[boomam]

No - it's not his job! If he has time to ghost workstations etc he'd be better served working on some inovative teaching and learning project.

True, but as said, there-in lies my problem.

 

The school has fallen back on him in the past due to lack of techies, and i think the head still sees him as such.

+ If i refuse to train him in doing such tasks, then it will severely weaken my position in asking for a second technician to help me out.

It sounds like i hate the guy, i don't, he's actually a really nice bloke, helped me out no end, even contributed some of his capitation to pay for some help over summer for me. And i do think that he thinks a second technician would be good also, but, he always looks at worst case, never gonna happen, 10billion to 1 chance of happening, scenarios. And seems to have the heads 'ear' on that one. At the moment, if i leave, am off sick, on a course, ect; and something goes wrong, no-one can do nout. And that's the problem he's got.

Even though the new network will have so much redundancy that it can survive a good week or two without repairs on its own...

[boomam]

Just dug a letter i wrote on the matter to the head the first time this situation cropped up.

I think i'll re-jig it a bit and add in some of the stuff you guys/gals have mentioned.

[bossman]

@Boomam:

Have you considered that with him being a teacher the new teachers remit soon to be introduced states that a teacher will not do anything other than teach and in no way take on any admin duties.

Obviously doing IT tasks fits this criteria so unfortunately he cannot undertake any of these duties due to his union restrictions which will be part of his contract. If he wants to break his legal contract then i feel other teachers may feel resentment towards him and lay him in to their union which could involve some pretty dire consequences for the Headteacher.

The Head cannot allow this teacher to carry on like this, how would this teacher feel if you turned round and decided you wanted to teach his classes do you think that the Head would allow this i doubt it for the reasons you have put forward in that this teacher however well meaning he may seem does not have the necessary skills to perform the tasks he has asked for.

[boomam]

Bossman, do you have a link for that information.

Thats information is VERY useful...

[Hightower]

Can you not put the point forward that "he's paid to teach - most teachers are crying out for extra free PPA time, so if he thinks he's got time to do the techy stuff are you sure he's doing his teaching job right?"

[jcollings]

@Boomam:

Have you considered that with him being a teacher the new teachers remit soon to be introduced states that a teacher will not do anything other than teach and in no way take on any admin duties.

 

That's what I said earlier about workforce reform or workforce remodelling. It isn't something being brought in in the future - it's here, now. We have been remodelling our workforce for the last 4 years or so to take away non-teaching roles from teachers.

[jcollings]

Bossman, do you have a link for that information.

Thats information is VERY useful...

 

The link I gave you in a previous post is relevant to that - it's all about tasks teachers should not be doing. A google for teachers workforce reform will bring up many useful links.

[pallen]

Check your contract and see who is responsible for managing the network. If it is you, then you could allow him the access he wants AFTER you have fully trained him. You wouldn't allow a new tech full access to your network without training to ensure they didn't break it. Same rules apply(even taking out that contractually the teacher cant do these tasks- unless of course he is also employed as a part time techie) start by training him with the basics, and increase this as his competency groes.

 

Document everything, include the point that you cant be held responsible for anything that goes wrong if the head is giving authority to network wide settings to people who aren't capable of it. If you are not allowed to implement the things that need to be done, you cant be responsible when things break.

 

Is any county support available to you? If so, could you not point out that they are the backup in case anything happens to you?

 

Incedently, are you due to go through JE anytime soon? I'm just thinking that if this teacher gets the admin rights he wants, you will loose the sole responsibility of managing the network. If there are 2 of you doing the work it could be argued that the teacher is the NM and you are the techie implementing the things he wants done. I may be a little cynical here, but is something to watch out for.

Edited June 20, 2008 by pallen