Do you allow staff to have Local Admin privileges?

[CyberNerd]

IMO best 'compromise' option is to give staff an extra local admin account but not to allow their domain account to be a local admin account.

This way they can install if they need, but are discouraged from regularly logging in using the local admin account because its not on the domain, thus more painful.

[mrforgetful]

Just tell them 'Look, even though you're perfectly capable of exchanging your own contract when you move house, will solicitors let you? No? Exactly, neither will Administrators let you do what you probably could, so nerr nerrr'

[ZeroHour]

Simply NO!

No one gets LA or anything similar for any PC/LAPTOP that is on the domain. There are a couple of stand alones with no network rights but a LA account and we are trying to faze them out (only really a couple left).

The simple truth of it is most staff can not be trusted and/or have rather limited common sense with IT. They like to shop online and end up visiting a dodgy fake shop site that installs a virus/malware (or tries to) and sophos then becomes your last line of defence if they have LA (unless the virus uses process elevation exploits) and we all know that sophos has some *patchy* protection for malware. Most staff have the attitude that if they break it they dont care as they dont have to fix it and never really get punished (more a SMT issue).

Really if you want some more work/pain give it to them but I would fight really hard (balboa style hard ) to stop it being forced.

Remember vicarious liability means the blame can fall to the head/gov if illegal anything is found installed by staff. If they force you to do it (and get it in writing) then the responsibility is then theirs. If you emphasise that there collective bums are on the line and not yours if they go against you they may rethink that plan.

[acb_]

We don't allow LA rights. Not even for the guy who really wanted them: 'But I don't know enough to break anything!'

[pinemarten]

Networkgeezer wrote:

It would be like lending a master key to all the doors in the school to different people.

our school went one better about 10 years ago - cut about 12 copies of the master room key , gave one to each of the cleaners....

[Irazmus]

Networkgeezer wrote:

It would be like lending a master key to all the doors in the school to different people.

our school went one better about 10 years ago - cut about 12 copies of the master room key , gave one to each of the cleaners....

 

8O The only people here to have master keys are the caretakers, Head, Bursar and myself.

 

We give LA rights to staff on their laptops so they can install hardware at home, but the system is so locked down that they can't do any harm.

 

Only the Head of ICT and myself have LA rights anywhere else.

[sidewinder]

All teachers and admin staff have local admin

They cant install everything, as we are still frequently are asked to install software for them, but yes they can install most things

 

It was a decision taken a long time ago and is going to be difficult to change. I might well try it in the summer. But I am worried about Sims upgrades etc - with over 100 teacher pc's, it would be catastrophic if they stopped working

 

Only remember one instance of a teacher saving on the C drive, he lost his work when it failed and was informed it was his own fault. Everyone else seems to use their documents as they should

 

Im not overly desperate to change their access because we have so few problems, but I realise its a security risk and I need to do it

 

We're only just coming up to speed on security...up till last summer kids had local admin access :oops:

[NPearce]

As with previous posts, on my sites the teachers own laptops have local power user access. Mainly due to home printers etc software installations that are required.

On some sites I have set up syncronisation that will ensure all local documents are loaded to the server when connected to the network. Files that are stored anywhere else on the computer I am happy to 'clean' with the head teachers blessing.

 

Keep the network locked down, if it comes to it you may need to develop a compromise policy with the members of staff that only give them particular access to particular areas. It may be that you need to allow access at a folder level within the computer. Takes a little time, but certainlty saves you time if it were all to go wrong.

 

Nathan

[alonebfg]

we do not allow local admin rights 1 so they cant install software on the local pc when i started had on pc with 6 ie toolbars and was dragging down the whole network and the second reason we had someone who had stored all there stuff on laptop and harddrive broke all work lost. That why they have roaming profiles on laptops also if you have roaming profile if network does go down they can still work and it will sinc when the netwok come back so that is not a arguement. one thing i have done for two members of staff is set there admin folder to sync so they if we do lose network they sill have access to this folder.

[tarquel]

I dont allow LA rights to anyone....

 

*decides to not go here as he hasn't enough time to rant on this one ;)*

 

Thankfully, no one has asked for them [that I can think of]. Only staff members that have asked get "DVD/CD" access [with a legitimate reason].

 

While the current SMT will likely never draft a proper AUP for staff [or the kids - the kids do have to sign something, but its extremely old - and nothing to do with me. I did ask, but was looked at with a "why should you have anything to do with it?" kinda look, so there we go hehe], the county filters the internet and they technically come under the county employee status so if they misuse it, the county will know etc etc....

 

*realises he did start the rant and promptly stops - time, printer toner out, etc etc*

 

 

Nath

[Ravening_Wolf]

So where has this "we say it and you do it" attitude come from then? When I took this job I naively assumed that the school wished to draw upon my 10 years+ experience and let me run the network to the best of my ability and leave me responsible for such matters. What an idiot eh?

[tarquel]

lol You'd think that would be the way, and in some schools it is, but in some schools it isn't unfortunately.

 

I just grin and bear it [as best as I can :D]

 

But where this discussion is going is best left to a different thread methinks

 

Nath.

[Ravening_Wolf]

Please feel free to add to the original topic though - the more evidence I can provide to my SMT of the stupidity of their idea, the better. Thanks everyone.

[Kained]

I have a solution you can put into words for them to understand why they shouldnt, but i feel it would be inappropriate to write, therefore i would just say no and tell them you dont know how to give local admin rights to staff, but you will "look into it"

[Friez]

I was reading on the daily wtf about a large company once that had ageing ICT servers. The CEO didn't want to pay for it to be upgraded, afterall it's worked so great for all these 20-30 years... fine.

 

Then the AC decided to give in, and the ceiling decided to leak. The tech team obviously requested for fixes. CEO was more happy to pump the money (it was a serious server room) into a phat bonus for himself.

 

So he instead said "JEEZ just move the servers into the corridor, no water there, am I the only person who can THINK in here?". Yes indeed. So servers got moved into corridor.

 

Then they had an audit, they ended up forking out millions to get that new upgrade and server room going because the auditors made it quite apparent that putting peoples sensitive credit card/security/whatever data into a public corridor was not really legal.

 

In short: If you have an SMT that don't care, they WILL care when their neck is on the line and its made blatently apparent with substantial fines and potential jail time.

 

I know this story doesn't actually help you a lot, but I thought it was amusing and would cheer some of us up who are in that sorta situation