Do you allow staff to have Local Admin privileges?

[Ravening_Wolf]

I am currently having an argument with my SMT relating to a specific user and local admin permissions on said staff member's PC so that they can "still work when the network is down" (we have had two outages in 6 months thanks to power cuts, both of which were resolved in less than 2 hours).

 

Said member of staff has had local admin privileges in the past and saved all of her data to the C: drive. Until the hard drive "failed". Apparently four years worth of work was lost including staff appraisals, personal references and other sensitive data relating to personnel.

 

Despite the blatant incompetence on display, plus the severe breach of Data Protection legislation, said member of staff is still pushing for local admin rights! And the Head is backing them up!

 

In fact, the Head wants all staff to have local admin permissions and the ability to install their own software. I have attempted to explain that my position becomes untenable if that desire becomes a reality as I will never be able to keep track of software licenses let alone the trouble caused by the multitude of cr4p which would be added to the network. And the potential for further breaches of Data Protection legislation, intentional or otherwise...

 

Anyway, before you all start complaining this thread should be in FFS, what I really need to know is this: How many of you allow your staff unrestricted C: drive access with permission to install anything and everything?

[Quackers]

On their laptops and PC's of which they only use they are allowed local admin. Any PC's in LABS etc they are not.

[Ravening_Wolf]

Do you have an AUP in place with enforceable punishment for breaches, such as installation of unlicensed software?

[mattx]

Oh my, I feel really sorry for you on this. There is NO way I would let anyone have the admin password. Can't you get some sort of Edugeek E-petition setup so we can all back you up on this ? Then you can show it to your head and SMT.

As you know a network setup like that would be un-manageable. Can't you explain if this happened it would not be long before the students got hold of the password and started deleting everything in site and causing a mass of problems ?

If they still insist of granting Admin rights to all staff, I would write up an E-mail letter to them & the Govs explaining what will happen, and when it happens you want NOTHING to do with it and that you had warned the SMT & Head and because of their actions you don't have a network anymore...

I am sure others on the site would offer more valueable advice but all I can do is wish you luck on your quest.

Get a petition going on here, I'll sign it....

[witch]

Staff can do whatever they like on their laptops - I have tried to point out all the things you mention but the head just lets them get on with it.

They aren't allowed on my network, though, and if I get them for repair I take care to clean them up.

I have said that if they go on my network, they will have the same permissions that staff have there - ie not allowed to install anything.

[MK-2]

I know giving staff LA rights to their laptops can open up a whole can of worms.

All staff here have LA on their laptops. Yes, they can install their own software, but all know that we regularly (once every 6 weeks or so) get all staff laptops in to make sure updates are running and do basic health checks on them. So that means we will notice things and point it out to them (installation of file sharing/p2p stuff for example) or if it poses a threat, remove it.

It's not an ideal situation but I think (not 100% sure) that with SIMS on their laptops, if they are LA then updates will install rather than us having to do it manually.

[Quackers]

Do you have an AUP in place with enforceable punishment for breaches, such as installation of unlicensed software?

 

We have no AUP.

[linuxgirlie]

Never, laptops they can do what they want, but network pc's are locked down and all work is saved onto the servers. I couldn't think of a worse thing than the burser losing all their work.Sometimes even a knoppix cd can't rescue the contents of a harddrive!!

 

Jo

[OverWorked]

I make staff members of the local admin group on thier own laptops, so they can do what they like with them. They need to be able to set up internet. They would be responsible for any crap software.

 

I also configure offline file so they can work at home and in school. This would negate the argument about needing to use the laptop when the server's down.

[contink]

At a guess the best way to resolve this is to put together some demands of your own.

 

1. AUP with enforceable penalties if breached (ie: loss of admin rights, etc..)

2. Require a training course to have been completed BEFORE admin rights given

3. Absolutely no admin access on anything other than their specific classroom machine and/or laptop

4. SLT must sign off on any remedial work required because of a teacher mis-using the admin privs

 

Beyond that I'd quietly make them at most a power user and ensure that any machines are locked down in terms of what they can do on the network.. and ensure that the network is locked down itself to detect and block any malware or suspect usage (eg: from a child gaining access and going a wandering).

 

Either way you'll only be able to counter the problems by stating your position in terms of the experience they will undoubtedly gain by forcing you to go this route. A classic case of "I told you so" waiting to happen..

 

My sympathies...

[GrumbleDook]

Local Admins on their laptops ... but all teachers work from laptops ... there are no 'teacher computers' in any of the rooms now.

 

On the normal desktops ... they are locked down. The only exceptions are a few of the admin staff who are member of the local admin group (but still locked down) purely to make life easier with some of the admin software used.

[NetworkGeezer]

It's not an ideal situation but I think (not 100% sure) that with SIMS on their laptops, if they are LA then updates will install rather than us having to do it manually.

 

Not strictly true. SIMS will update for non-admins if you run SIMSperm.bat on the machine before hand. This loosens permissions on the C:\Program Files\SIMS folder and on the HKCR registry key(yikes!).

[pete]

Laptops: if they know what they're doing and the benefit outweighs the grief they would cause themselves. Currently that's 3 users out of ~60. SMT back me on this - everything they need for teaching is installed automatically. New tax laws FTW as well

 

Desktops: Nope, even if you're the only one to use that machine.

 

Given the users history of saving to C:, it would be safer for them to sit on their hands until the power comes back on.

[maniac]

Our staff have the ability to logon their laptop without the network being present, but they are still logging on with their network account. Because we have offline files enabled on all laptops this means they can be used as if they were on the network even if the servers aren't available. Of course they loose public drives etc. but their own home area, desktop etc. is still available.

 

All staff have local admin rights to the laptop too but again only through their network account, they don't have a local login as such. They still can't install software though, as we've disabled that ability using group policy. As soon as a setup program is run, it requests the administrator details.

 

The only reason we enabled local admin rights on laptops was so staff could install hardware at home such as printers, scanners, USB modems etc. which they couldn't do otherwise.

 

Desktop machines, no one has rights above a normal user. Never had any one challenge this as the machines do everything needed of them.

 

Mike.

[Ravening_Wolf]

I have a meeting with the Head on Friday and would like to be able to present a full AUP on the day in the event that I get overruled. Does anyone know where to find a template? The links on Becta were, errrr, poor...

[daveyboy]

Nobody has local admin rights on any network workstation / laptop (we regularly image them - software updates, patches - fixes)

 

But - what we term as 'staff laptops' the staff use as local admin - BUT - if they come to me for repair, upgrade, or even for a 'health check' (or AV is out of date) they are imaged with the latest version. The staff are 100% responsible for the data that is on them.

 

Laptops are for staff to write reports, create resources etc, etc - Not for ebay, personal banking, or for their family / friends to use.

[bishopsgarthstockton]

stick by your guns mate. Do not allow them admin rights.

 

im sick of teachers who think they know all and they do what the can to get what they want even if it means tramppling all over us.

 

ICT teachers wanted write/modify permissions for kids work folders. I had given them read permisions so they could check the kids work. I told them no way....Never.

 

Crap i will come down for you and drum it in to your boss head for you if you like :twisted:

[CheeseDog]

Just finished an AUP and given it to staff to sign. PM me an email address and I can send it you.

 

It's more or less based on things I found on the policies section in here.

[MkII]

We're moving to no admin access here. Not 'actual' LA but 'a' local admin.

 

We had a policy of tightening up security if a member of staff caused too much work, and one of those that fell foul of this was a Deputy Head.

 

All staff now use SIMS on their desktops and we made them power users + GP lockdowns. This has been fine so far.

 

Some people have pushed for access - they had so many problems with virtually unrecoverable PCs (well a hell of a lot of work or a re-build) that they now happily live with tied down PCs.

 

What we say is that we set up the machines to be reliable business machines. If anything happens to the machine to stop it functioning on the network then that is unacceptable to the business, costing time and money to rectify that needn't be spent.

 

It's difficult in the present climate where IT is not given the status it needs in schools, and poor business descisions are made.

[netadmin]

We used to lend staff the domain admin account...big mistake.

We quickly stopped after someone installed Limewire filesharing on about five computers, and downloaded a virus onto their network drive (requiring the server operating system to be reinstalled).

 

Now, no staff gets any type of admin access, except for local power user if needed for special program. But even then, there are so many restrictions enabled through group policy they cannot really do much damage.

[Grommit]

We allow LA rights for staff on Staff PC's as we feel that they need to explore ICT and see what works for them..

 

There is no peer to peer allowed or such but only "proper" software.. (like the CD in the TES)

 

If the PC dies we just re-ghost and it's as fresh as a daisy again...

 

This is better than having the frustration of the staff moaning that they are treated like children and that the T&L is suffering because they cannot experiment with new software without asking the permission ICT Department..

 

We have a good working relationship with the teaching staff and we like to keep it that way...

 

The staff also have read and write permissions to the Students folders.. as they transfer the students work from Floppy/Flash drives to the students folders in class.. or else we would have lots of students coming to the ICT office asking for their homework to be copied everyday..

 

We also give the "ICT Teachers" Student Password Change rights.. and thays only Change the Student Password..

 

Laptops... they are free to do what they want with as again I feel that they must play with new software and see how it can improve T&L and not have a Laptop where thay can only do Office and other pre setup software work...

 

Again.. if it dies.. a quick Ghost and it's as fresh as a Daisy..

[MkII]

You could use Deep Freeze or MS's Shared Computer Toolkit on PCs with LA access - then they could experiment all they like - re-boot and it's all gone

 

IIRC Ric has set up virtual machines on all his school's PCs for this very purpose - those staff that would like to play at admin..

[NetworkGeezer]

We used to lend staff the domain admin account...big mistake.

We quickly stopped after someone installed Limewire filesharing on about five computers, and downloaded a virus onto their network drive (requiring the server operating system to be reinstalled).

 

Did I read that right? The domain admin account was given to non-technical staff. Whether or not they install crap on computers, giving total access to a wide range of people means you effectively have no security. It would be like lending a master key to all the doors in the school to different people.

 

Thank god you stopped it.

[mrforgetful]

We tend to give them Local Admin access on laptops just so they can install printers and any software they may need when at home. It's never caused any problems and is so much smoother than us having to install everything.

 

Noone has Adminof access on a standard network PC except technical staff and one teacher - the Head of ICT.

[6Foot2]

Removed.