IT Teachers and Computer rights

[mb2k01]

Can anyone tell me the difference between the Doman Admin and an Enterprise Admin account? I am a Domain Admin, but the LEA are our Enterprise Admins. I assume they are higher so have more control.

 

A member of the Domain Admin group has full administrative privillages to make changes in the domain for which is is the admin for.

 

A member of the Enterprise Admin group has full administrative privillages to make changes to the entire forest and any domains in it.

(Hope that's right!)

[PEO]

All admin passwords are in the school safe for HT DHT and My line manager. My line manager also has a technician account but its only to be used in extreme situations.

[spiderz]

Thanks for the replies. Both the Dept. Head and Headteacher have admin rights at the moment. It seems from the replies your views are similar to mine. The main problem is that he was both IT Teacher and Network Manager before i was employed (I was employed because he didn't have enough time to complete his teaching duties).

 

Thanks again!

[mb2k01]

Why do those teaching and leadership colleagues have administrative access?! That's madness!

You should find out what it is they want to do under their existing prvillages exactly and start working on a delegated permission allowing them do do it under a non-administrative account.

 

You have a whole list of reasons to want to do this - reduce risk of accidental damage, accidenal data loss, increase security, prevent viruses etc etc.

[GrumbleDook]

A few quick points ... partly summarising comments from others.

 

1 - The 24 tasks are quite clear as to what a teacher can't do.

• ICT trouble shooting and minor repairs
  
• Commissioning new ICT equipment
  
• Ordering supplies and equipment: teachers may be involved in identifying needs
  
• Managing pupil data: teachers will need to make use of the analysis of pupil data
  
• Inputting pupil data: teachers will need to make the initial entry of pupil data into school management systems.
  

These are the key tasks I thought I would highlight. Notice it does not mention anything about managing ICT / IT or even doing planning / design work. However, neither managing or planning needs to include admin access. Some of the management of ICT / IT is part of the Leadership strand anyway ... so if they are not paid on the Leadership spine then they are not paid to manage it. TLRs are for Teaching and Learning ... although many schools seem to have wangled their way around paying people for doing work they are either not doing or shouldn't be doing.

 

2 - Never use the Domain (also read Enterprise) Admin account except when doing some *very* specific task, such as significant upgrades or role changes of servers / DCs. MS has some darn good advice on this (go search on Technet) and folk have already pointed to some of these articles.

 

3 - You should have alternative domain level accounts in reserve in case the Domain Admin accounts goes pear-shaped. These should not be used either but details recorded, locked away and only used in emergencies.

 

4 - You should have relevant accounts with delegated control. If you are installing software (eg Backup software) then use the backup software account to install it. This will mae sure you have the right access to services etc. For admin work have a personal admin account that you only use when needed and then have your everyday account which only has the 'right' access for simple admin tasks such as change password etc.

 

5 - The Head is the Boss. When he says who can and can't have access follow their instructions when locking things down, but only open things up there is a clear and direct need. "Just in case" is not a good reason and pointing out the good practice measures above is the best way to show that you *want* to do what they have asked / ordered but it really works better if you do it the way that MS designed it to work. However, the Head is the Boss and unless you want to take it to the Governors then do what the Boss says (examples of when not to follow the instructions include giving full rights to the SIMS server, the file server with access to all the pay details, the file server which has the Head's home area on ... in fact there are lots of examples and once you point out the stuff about Pay and the Head's home area then common sense tends to prevail IMHO!)

 

6 - If they ask for admin access then ask if you can conduct an OFSTED style inspection of them teaching. It is a tongue in cheek comment ... but it can be used to point out that people have different specialisms and whilst there is an overlap ... it doesn't mean it should be done!

[p858snake]

Why do those teaching and leadership colleagues have administrative access?! That's madness!

You should find out what it is they want to do under their existing prvillages exactly and start working on a delegated permission allowing them do do it under a non-administrative account.

I would guess as a teacher has been re-seting students passwords or getting work from their home drives then one day BAM! and couldn't do it.

 

 

But yes find out what he wants it for and get them to check what he is still employed under because if his title is still listed as a network manager on paper somewhere.....

[elsiegee40]

As ever, sound and comprehensive advice from Grumbledook

[mb2k01]

I would guess as a teacher has been re-seting students passwords or getting work from their home drives then one day BAM! and couldn't do it.

 

Getting work from a student home directory account shouldn't be something a non-administrator should do - privacy laws etc?

 

Password changes are easiest of all to delegate. Create a custom MMC and put adminpack.msi on stations required to do it.

[Great_Scott]

Completely agree with GrumbleDook and others on this one. Follow MS advice and procedures.

Create two additional accounts call them manager1 & manager2 or whatever you want and only use those for day to day work, you can grant admin rights to your usual staff log in too if you want and as for other junior or non experienced technicians create an account called tech1 or whatever.

Adhere to your AUP regarding passwords on these accounts as well, you'll also manage your audit trails easier - seeing who made what change and when.

Don' know about everyone else but I'm seriously paranoid when it comes to knowing who is doing what and when and I would never grant admin rights to any other user, even the HTor SMT members.

[spiderz]

Why do those teaching and leadership colleagues have administrative access?! That's madness!

You should find out what it is they want to do under their existing prvillages exactly and start working on a delegated permission allowing them do do it under a non-administrative account.

 

You have a whole list of reasons to want to do this - reduce risk of accidental damage, accidenal data loss, increase security, prevent viruses etc etc.

 

Hey, the administration policy they have in place was like this when i started a few months ago, i also discovered even a few LSA staff had administrative rights which i've since have sorted. Thanks for the advice its something which definitely needs sorting.

[cellarmeister]

At the end of the day its the HT who is in overall charge and if he says he wants the ICT teacher off admin rights then thats what should happen....NO QUESTION........if the ICT teacher throws his rattle out of the pram and starts bitching to governers, unions etc then the blokes a clown...and if he has a go at you then just tell him to fook off and take it up with the head....

[Tony_Mc]

When I started at my school I had over 70 domain admins on the system, from the head right down to some students.

 

The fuss it kicked up and the problems with software running when we cut it down to 2 was fantastic.

 

had a few very upset people and some REALLY upset people.

 

The person who is upset can moan all he wants there is NO WAY he will get anywhere.

[Tony_Mc]

I should have asked...

 

do you work for the school or for a company that supports the school:?

[penfold]

I know this thread is a little old, but 1 point no one has mentioned is job evaluation aspect. If the teacher is given admin rights does that then mean that they are the network manager? The reason being, that if there is a teacher with the level of access required for doing certain tasks (the same as you) can you not ask about equality in pay? Of course I am assuming that the head of IT is paid more than you here(but that is normally the case)

 

Otherwise how can you argue that you are respsonsible for the sole running of the network if there are other people who can do the job in your absense? A teacher cannot do your job unless they have been given time to do this, and if they have been given time to do this, it should be on the same rate of pay as you. A full time teacher does not have the time to carry out another full time Network Manager role. As people have pointed out, a record of an admin account is all that is needed to be passed to someone who is qualified to take over in the unlikely event you dont come back to work.

[powdarrmonkey]

I know this thread is a little old, but 1 point no one has mentioned is job evaluation aspect. If the teacher is given admin rights does that then mean that they are the network manager? The reason being, that if there is a teacher with the level of access required for doing certain tasks (the same as you) can you not ask about equality in pay? Of course I am assuming that the head of IT is paid more than you here(but that is normally the case)

 

No, right of access does not equal competence.

[TechMonkey]

No, right of access does not equal competence.

 

Should I refrain from the obvious classroom joke?

[penfold]

No, right of access does not equal competence.

 

I never said that having the access rights equals competence. But it is only the same as employing someone who cant do the job after they had a good interview. My point being was that IF they have the same rights as you and can make the same decisions, how do you seperate the responsibility? How do you then sererate the different job and different pay scales if you have 2 people having the same remit? And if they haven't got the same remit, then they dont need the same access.

[srochford]

How do you then sererate the different job and different pay scales if you have 2 people having the same remit? And if they haven't got the same remit, then they dont need the same access.

 

Not sure if I understand the point you're making. I wouldn't expect someone who's not a network manager to just dabble in things because they can but this is where you have passwords locked in a safe etc so that in emergency someone else can do the job even though it's not their main job.

 

You then justify different pay scales because the jobs aren't the same.

 

In a different example, a school might have a head and deputy head. They won't get paid the same money or do the same job but if the head is on holiday or off sick then the deputy would be expected to do the urgent things that come up that the head might have had to do (so they might need to make important decisions, authorise payments etc)

[powdarrmonkey]

My point is that you can't decide someone's pay on whether they have access to something. Pay should be awarded on the basis of skills, competence and experience, not political bickering to get rights of access and then not know what to do with it.

[penfold]

My point is that you can't decide someone's pay on whether they have access to something. Pay should be awarded on the basis of skills, competence and experience, not political bickering to get rights of access and then not know what to do with it.

 

Pay is awareded based on roles and responsibilities NOT on skills and experience. You need the skills and experience to get the job in the first place, but once employed you should be on the same scale as other people performing the same duties. Thats what Job Evaluation was supposed to address. You can compare what you are paid to someone else who is carrying out the same role and responsibilities as you. Shouldn't the teacher only have the same level access if they are carrying out the same role? And as you pointed out, they should have the same skills also.

 

Srochford: I wouldn't expect a teacher to pickup the network admin password and look after the network if the NM was off UNLESS they knew the network and carried out regular work. If that was the case it should be in their JD because they cant do it employed to do it as a teacher under the 24 tasks. If they did have a contract which stated they maintain the network, then you can argue about Job Evaluation.

 

The reason I brought this up is more to do with progression in terms of pay. If you have a teacher who has all the same rights as you and is your line manager, it can become harder to identify when you take on more responsibility which warrents a pay rise?

 

Anyway as others have stated it's not really your concern as it is the Head who has made the decision and not you. I think I'll leave it there as I seem to have take us slightly off topic sorry:getmecoat: