Apprentice Access

[Disease]

We have an apprentice starting soon, a first for us and I was wondering what others who have had an apprentice have done for access. How much have you given them?

 

Glad for any extra info and gotchas relating to IT apprenticeship management as well.

 

Many Thanks

[pete]

My general rule is: "Enough to do the tasks you're asking them to complete, not so much that they can cause unexpected overtime for their colleagues."

 

...then increase access as they develop / demonstrate they're not going to cowboy it.

--

 

A lot of it depends on the aptitude and attitude of the apprentice. There'll be a lot of shadowing initially and explaining why things are done a certain way.

[mavhc]

Started with: A logon that doesn't have desktop/web restrictions, and access to the helpdesk, start with fixing per computer problems.

 

Also read only logins for things like wifi

[Rogueleeder]

I was an apprentice 3 years ago and I had one to train not long ago. Give them 2 accounts, one for normal use, one for password changes and creating users. Gradually gave them access to servers and switches and elevation as I showed them best practice. I think for the first 3 months I asked that he tell me of any changes he was thinking of making or program installs.

 

Worked quite well, let him build up some independence while learning the best ways to do things and not develop bad habits.

[mavhc]

Also log everything that's a configuration change you all do that's not a response to a ticket with self created tickets

[Roberto]

I was an apprentice 3 years ago and I had one to train not long ago. Give them 2 accounts, one for normal use, one for password changes and creating users.

 

I'd say everyone should be doing this - keep 'daily driver' account and admin account separate. And also give minimum access based on the jobs they're doing. Good advice for apprentices but also for all IT support types - if someone doesn't need full admin they shouldn't have it.

[mavhc]

Don't you just elevate certain apps?

[Jcx500]

I would delegate access to your ad environment on a separate adm account

[pete]

An apprentice / relative newbie to IT is an excellent test of your documentation. Get them reading it, checking it's still valid and highlighting missing steps or context that the rest of your team assume "we all know that".

 

I'd carry out more frequent reviews with them. Nothing formal, just more of a regular how's it going, what went well / not so well so you can adjust early on.

 

If you're the IT manager/lead, don't be the apprentice's mentor - by all means contribute on topics / shadowing, but their main mentor shouldn't be you - it'll consume too much time early on.

[MatthewL]

Good time to create some groups, say Level 1 to Level 3 with different permissions, in future you then only need to add users to the group and you can add the groups in on the different servers therefore making it easy in future.

 

Password resets, create users, add users to group (but no delete) could be a good start first, local admin permission to install stuff, maybe admin on file server server if you have lots of changes on there, ability to restore files, print server admin to clear queues, that should be enough to start with.

[FN-GM]

Like every employee, including IT, access should be aligned to their duties. So only give access to perform tasks they will be carrying out.

[Olliedawg]

I started as an apprentice around 2 years ago & I soon discovered that I had the exact same permissions in AD as the current NM, which i thought was brave! I'm not one to tamper with things that I'm not knowledgeable about, but somebody else could have caused some damage lol (accidental or malicous).. So yes I would recommend what others have suggested above

[plumyeti]

I completed an apprenticeship couple years ago.

 

First day I was given full admin privileges, Google Admin, Domain Admin, etc....

 

It depends on trust... Do you trust that person?

I knew my manager at the time before I started the role so he knew my abilities and was a bit different.

 

Obviously I wouldn't do this if I didn't trust them.

Only give them the access require for each task they complete.

Don't allow them access until you've walked them through what everything is.

[mbedford]

I'd say everyone should be doing this - keep 'daily driver' account and admin account separate. And also give minimum access based on the jobs they're doing. Good advice for apprentices but also for all IT support types - if someone doesn't need full admin they shouldn't have it.

 

Do this for EVERYONE in the business!! If you are not, id put the apprentice to one side for a bit and get to work on resolving the new big problem you have :-D

[mavhc]

When I arrived here everyone had admin access to the computers, now even I have trouble running software it's so secure, reimaged every computer for starters.

 

So much for council IT support