VNC Policy for technicians

[pinemarten]

it really depends on the relationship between teaching/admin staff and tech support at your particular establishment -at some schools, the atmosphere is one of helping each other , learning together , using our expertise to resolve difficulties.

 

at others, there may be an atmosphere of resentment and mistrust, which only deteriorates further once staff discover that their every move can be monitored - perhaps by the person they would least like to be doing the monitoring.

 

it's all about power for some, you see - we have access to things that they don't, can control things that they don't understand, and can make them look foolish and incompetent in so many ways - if we choose to

[theriver]

The problem is that almost all can be setup to allow this. Net Support, VNC, RRC, ABTutor and Dameware are ones we use and all can be setup this way. Dameware is specifically a bussiness tool with FIPS compliance and you can still do this.

 

Oops, I hadn't intended to imply that this was limited to VNC, sorry.

 

We're in a position of trust, just as the finance people are trusted with money - and just as with finance I think there's two aspects to it:

 

1) acting in a trustworthy and professional manner, and being seen to be doing so

2) being prepared for when trust breaks down. By this I mean that although 99% of the time everything's fine, at some point there could be a situation where either a member of technical staff deliberately does something wrong, or an accusation is levelled at an innocent person.

 

Admins don't have to have access to everything, it's quite possible to lock yourself out of a share - but letting yourself back in again leaves tracks, and that's your protection.....

[Guest Guest]

...but letting yourself back in again leaves tracks, and that's your protection.....

 

 

Not if you know what you are doing it doesnt (or atleast on a standard windows setup ie one which 99.99% of schools will have).

 

As i said the only way on a standard windows setup is with encrypted documents, and that still isnt perfect.

[soveryapt]

Do those of you using VNC have a unique password for each instance? If you don't there's a major security problem.

 

I've not used VNC for a while, but last time I did (it was the Ultra flavour) there was an option to tie it into the MS Logon Credentials, so if you are using VNC then this is probably the best option as then when your password changes so does the one for VNC and I'm pretty sure you can lock this down to Admins only too.

 

Though this thread has raised a question for me now and I'll be looking into what protection there is for the NetSupport / iTalc implementations I have at schools. As has been said, why would I want to look at staff files unless they have asked me to or I have been directed to by SMT, but it's better to protect ones self too one thinks.

 

Edited December 2, 2009 by soveryapt
:)

[rh91uk]

I generally just ring the person concerned and ask if it is ok that I remote into their machine.

[cookie_monster]

I've not used VNC for a while, but last time I did (it was the Ultra flavour) there was an option to tie it into the MS Logon Credentials, so if you are using VNC then this is probably the best option as then when your password changes so does the one for VNC and I'm pretty sure you can lock this down to Admins only too.

 

Though this thread has raised a question for me now and I'll be looking into what protection there is for the NetSupport / iTalc implementations I have at schools. As has been said, why would I want to look at staff files unless they have asked me to or I have been directed to by SMT, but it's better to protect ones self too one thinks.

 

 

 

 

You can set a connection password on Netsupport but I don't think it demands it by default, we don't bother on student workstations as the tutor is banned for non authorised users. We use Dameware for supporting staff PC's as this uses Windows authentication.

[mjs_mjs]

I use gencontrol here, same as VNC. As am admin we all have access to everything, we have to to be able to do our jobs. As alreddy said it's a trust thing. It's still an offecnce under the computer missuse act for an admin to gain unauthroised access to files/data.