Staff Permissions / Freedom

[Netwacky87]

Hi All,

 

We're having a bit of a debate at the moment just wonder what other people do,

 

Regarding how much freedom/permissions they have to yoru network/workstation,

 

Do you allow them to change their background, allow access to command prompt...etc etc...

 

Cheers,

 

Mart

[nicholab]

Command prompt no way. Background is set to our school one. Our aim is to delivery what they need to teach.

[MatthewL]

If it was us it would be locked down and just access to what they need i.e. applications, corporate desktop etc.

 

Even our department are locked down to show that everyone is equal.

[Mr.G]

Command prompt no way. Background is set to our school one. Our aim is to delivery what they need to teach.

 

Teachers are professionals too. I think what we are all forgetting here is that while they might have limited IT knowledge (some) they aren't about to deliberately write commands like format c:

 

Yes they do sometimes leave the Pc's logged on, and yes there is a security risk involved in that, but the Teacher is then responsible for the damage caused (if any).

 

ScreenSaver locking times adjusted, down to 5 mins, restricting applications is more beneficial than simply removing access to most of the operating system.

 

I've found file screens are effective, preventing anyone from saving pre-configured extensions to the network. No exe's in user storage, no scripts, no batch files etc.

 

G

[SpuffMonkey]

Its the old Flexibility/Reliability/Cost triangle - you can have any 2 of the 3 - let them have whatever they want - but it'll either cost a lot to support properly, or become unreliable

[Ambient]

Personally speaking, i think it you "lock them down", it will make them turn against ICT.

 

On the network i used to manage at a school before i change jobs to my new compnay, i used to allow staff to have local admin rights on the PC they were currently on.

 

Staff knew the score when it came to installing software they shouldnt be.....i'd just re-build the computer with an image.

 

It worked very well for us.

[Pete10141748]

Staff here are unable to run any installations for themselves.

 

We used to let them change their screensaver but they mostly just turned them off, which when they leave their projectors on all day long is not a good thing! So now they are all set to be the smart bulb saver and can't be changed.

 

They can change their background picture as most use topical pictures of their class name picture (ducklings, puffins, wolves etc)

 

They can get to the control panel but not access all things (can't get to Add/Remove programs, can change the power options and so on)

 

From my POV I deny access to the things that they do not need; it makes sense to not allow them to install whatever they want because that also means I spend far less time sorting out botched installations, removing things that shouldn't be there or re-doing settings that they had no need to change in the first place.

 

Give them access to what they need to teach, they don't need to be administrating their computer though, that's your job!

[skunk]

Staff here have complete freedom to use any of the software on the system. If they need other software we are happy to provide it for them as long as it is within their budget and is interoperable with the system. Our philosophy is that the stability of the system is the highest priority. Most software (and all in the near future) is deployed centrally so they have no need to install software. When we moved to this system it dramatically dropped the amount of PCs/Laptops we were fixing due to "I only downloaded this software and it suddenly nothing works...." and as for ISP disks screwing up the network settings, a thing of the past. The earache, whiging, politics and backstabbing was something to behold when we went to this. However, the head stood behind us and said "I pay these guys to make these decisions and support them 100%"

 

The permissions are set up so that they could not format the C: drive when using the cmd prompt even if they tried.

 

Software compliance would be a minefield if we let anyone install anything they wished.

[pete]

Lab machines / general use computers are locked down - they should be consistent and reliable. Your own desktop/laptop (as in, if you create a pink-on-pink-on-pink colour scheme and then can't find anything on screen, no-one else is affected) there's more leeway, but it's still based on the user in question and leans towards ensuring the stuff works.

 

No-one gets local admin rights for use as their normal account because it's too easy for drive-by malware to take advantage of that (why hello Adobe).

 

but the Teacher is then responsible for the damage caused (if any).

 

The enforcement of this varies greatly from school-to-school. In certain places there's nothing more than "ooh, aren't computers funny, when are you going to fix it?" and in others you won't find more than a vigorous telling off.

 

If I lose mission-critical data without chance of recovery because of something I knowingly failed to do, I stand a good chance of getting fired. How many teachers (in a similar, clearly explained to them not to do X and why not) would? Excluding clear DP/Child Protection breaches?

Edited December 2, 2010 by pete

[Marci]

Staff here are set as priviledged users on their regular machine, but on any other machine they're locked down. Priviledged users are set to allow changes to themes - visuals, sounds, fonts, resolution etc etc but can't install software.

[3s-gtech]

Teachers here are totally locked down, as much as students. Different shares and folders obviously. The reasoning is maintenance and useability - Windows is much more hardy to attack when locked down, and I don't have to go round fixing installed trials/demos/torrents. Useability - nothing has been requested to be available that the staff don't have already. Why do they need access to the command prompt, Control Panel, etc, to teach? If they need a software install, they let me know as it's my job. Teachers often say they don't have enough time in the day, adding IT jobs into that would not improve the situation.

 

School admin staff are Power Users however - this is due to some of the apps they use. Still no cmd though.