[sims] System Manager 7

[ctaylor]

Hi All,

 

I am a data manager in a large sec. modern. My IT department will not allow me to have Permissions to manage groups - as they feel it will be opening up the system too much!!

 

Anyway, I wanted to confirm my suspicion that it is possible to be added in to the SM7 group, then have my perms defined so that I could view and manage groups with much else.

 

Charlotte

Edited September 21, 2011 by ctaylor

[LosOjos]

A competent SIMS system manager would know that it is indeed possible to enable you to mange groups and nothing else.

 

There are pre-defined permissions groups in SIMS for a variety of common job roles, but custom ones can be created that allow a lot of flexibility as to the exact areas accessible and even whether these are read only access or whether you can edit them (in many cases, whether you can edit all details in that area or just your own!)

 

The problem is, quite often the IT team that manage the SIMS permissions do not actually use SIMS themselves so don't really understand the request and so you find yourself in a situation like yourself whereby a blanket "no" is given to requests for raised privileges.

 

I would try having an informal talk to them, if that fails contact your local SIMS support team (if you have one) and ask them to have a word. Your last resort should be your line manager/SLT - it is ridiculous to deny a Data Manager the ability to create groups in SIMS.

Edited September 21, 2011 by LosOjos
clarity

[ctaylor]

Thank you very much for the reply.

 

That is exactly what I have been trying to communicate, and you did so very articulately! I have gone through all these stages and am even getting 'no' from the top.

 

I'm going to try again though.

 

Charlotte

[bossman]

@ctaylor:

 

I would definitely schedule an informal meeting with your IT systems team as I am sure they would be amenable even if they are reluctant at first.

 

Demonstrate exactly what it is you require within Sims itself (with the help of a Sims account with access rights) and maybe they will help you.

 

I know as most other Systems managers are usually very helpful to all admin users when it comes to Sims.

 

Personally my data manager has those access rights within Sims and I have no qualms whatsoever, work with them to understand Sims more as my data manager does with me so together you can iron out any problems.

 

Have another go for their sakes.

 

Good Luck

[Sivadam]

This is just the latest example that I have seen where the SIMS Manager role is assigned to the wrong people. The SIMS Manager simply MUST be somebody in school who intimately knows the software itself. This is yet another example of a school inappropriately assigning System7 to an ICT department that just does not understand the requirements.

And, before bricks start flying my way, that statement is not aimed at all such departments, as I personally know some excellent SIMS Managers who work in these areas.

 

Also see thread:- System Manager access in SIMS.net

Edited September 22, 2011 by Sivadam

[ctaylor]

Thanks for all the re-assuring repsonses. As you can imagine this is just one of the issues I'm having with IT.

 

It's fair to say that I'm not an IT expert, but I am however getting towards that level operationally in SIMS and have a very decent general knowledge of technology. I'm unsure about which way I can approach it anymore. Being one of the youngest staff here, and this only being my third academic year has put quite a few backs up but really all I'm interested in is doing my job properly and therfore having an impact on the pupils themselves.

[zag]

Just in defence of the systems manager here I gave someone permissions that she simply had to have then got told off by someone else for letting her see contract details!!

 

Cant win sometimes in our position

[LosOjos]

Just in defence of the systems manager here I gave someone permissions that she simply had to have then got told off by someone else for letting her see contract details!!

 

Cant win sometimes in our position

 

Not meaning to be rude, but you really should have checked with HR and SLT before letting anybody access contract info... that's just common sense, isn't it?

[zag]

Not meaning to be rude, but you really should have checked with HR and SLT before letting anybody access contract info... that's just common sense, isn't it?

 

Well I think it was a Sims thing in the end. Apparently the rights for "creating lookups" also gave you the rights to personnel for some reason. We called Sims and they said it was a known problem at the time.

 

Hopefully Systems manager 7 sorted that as its much easier to see the complete rights now.

[ctaylor]

Also am I missing the point of the thread - that it's possible for staff to have permissions they NEED in SM7 without having access to things they don't?

[LosOjos]

Well I think it was a Sims thing in the end. Apparently the rights for "creating lookups" also gave you the rights to personnel for some reason. We called Sims and they said it was a known problem at the time.

 

Hopefully Systems manager 7 sorted that as its much easier to see the complete rights now.

 

Fair enough!

 

Also am I missing the point of the thread - that it's possible for staff to have permissions they NEED in SM7 without having access to things they don't?

 

No that's correct, in the vast majority of cases anyway. There are certain times (though very few) where it's not possible to give access to one area without giving access to others, but creating and maintaining groups is not one of those areas.

[pubgrub277]

I'm the data manager here and i dont mean to gloat but i have network admin rights not just full control of Sims.

i've never found it difficult to justify why i need the access. I'm first line support for all things Sims (installs/errors/why wont it do this questions).

My job spec states i manage all aspects of the data, the fact i hold the position of data manger implies i have a certain level of responsibility/accountability for my use/actions relating to all of the systems.

Maybe my role is slightly different to other establishments.

I could understand why an office admin/teacher might have their access restricted but not someone running the system.

[ctaylor]

I work for a Federation (2 large sec moderns and a sixth form) where started two years ago as the assesment co-ordinator and have since had a promotion of sorts to data manager (that is my actual job title). I now manage a team of 4 admin staff who do all the data and assessment. You would think i most places this would be enough seniority to warrant having these permissions.

 

I feel I am the only person really who can say what access people need, as I have the background knowledge as well as knowing people's job roles plus I work closely with so many senior staff across both sites that it's no longer viable to put a request in to the helpdesk everytime (paper form which needs to be hand delivered to IT office!!). IT staff then scowl across the desk at me and tell me it will be done when they can get round to it. The badly designed form doesn't even have a space for stating what perms the user should have. It simply lists which modules they need access to. The whole thing is a mess basically but they have such a tight reign on things it's impossible to improve/change anything.

 

I'm totally frustrated by it all, they think I'm going to mess the system up or something. It really shows the state of the situation where I am telling them what access I need and how to adminitser it to me, because they have no clue how to.

[pubgrub277]

I have quite a close relationship with our ICT support team, Ive been here longer than they have, and as such they see Sims as mine.

I carry out upgrades and have full access to the server. They deal with installs on desktops as part of the normal school image.

Dont think they would dream of telling me about how something was going to be setup or what access permissions would be.

We might discuss any issues but the final decisions for sims and data are mine.

[Sivadam]

I'm the data manager here and i dont mean to gloat but i have network admin rights not just full control of Sims.

i've never found it difficult to justify why i need the access. I'm first line support for all things Sims (installs/errors/why wont it do this questions).

My job spec states i manage all aspects of the data, the fact i hold the position of data manger implies i have a certain level of responsibility/accountability for my use/actions relating to all of the systems.

Maybe my role is slightly different to other establishments.

I could understand why an office admin/teacher might have their access restricted but not someone running the system.

You have highlighted the main issue. All schools work differently. I am the (wait for it!) Curriculum & Administration Services Manager. Our 'Data Manager' just handles the Assessment data! I wish the expression 'Data Manager' was totally wiped out. It is very misleading!

 

I also have access to the Servers etc but the ICT Services Team are the ones who normally look after Upgrades, Backups etc.

That is unless they are not here, in which case I do 'em - despite always saying I do not have the technical expertise!

 

I also often need SysMan Backups at extremely short notice, which is why I keep arguing for this to be retained in Sysman7 (or via another quick route!). But that is another story .........

Edited September 22, 2011 by Sivadam

[vikpaw]

At first i thought you were talking about basic groups, as in UDGs etc.

 

You really ought to have system manager permissions if you are the data manager, and usually, that will also mean SIMS manager. However, in some schools, SIMS manager may fall onto the IT team, as data manager is kept separate as an assessment area role. If you are doing extra things that make you the best person to be SIMS Manager then maybe they need to re-assess your role and the responsibility you have.

 

As you'll see on many threads that, system manager permissions doesn't actually give you a heck of a lot of rights. Many a time people can't do something and assume that sysman rights gives them superuser rights. The permissions structure is well sorted so that you'd explicity need other roles to carry out certain tasks.

 

That being said, there is extra access that comes with system manager, not least the ability to give yourself extra permissions and remove them again, so you can see what may worry the management. Also, i doubt that even with the new sysman 7 that there is any acceptable level of audit so that any untoward behaviour could be monitored. Sysman does give you access to some parts of the personnel file, even though it's the basics, address, DOB, phone / email, it's something they may not want to release.

 

Although it is possible to create a custom group to try and give you part of the permissions for just adding people to groups, it is notoriously difficult to give a part of a permission as one part often relies on an ability to view another, or on saving it validates other parts of the screen which if you can't access, wont work.

 

 

Download a copy of the permissions spreadsheet if you don't have it already as it gives a good idea of the scope of different roles. If you're not getting any joy from the IT team, perhaps there is someone in management that can take on that permission and allocate the roles on your behalf. In the old fashion of schools, the bursar would have had those rights as well as school admin and many others.

 

Maybe if you speak to the management / line manager not with a view to getting this permission that they have already vetoed, but finding an easier and quicker method to get the end result you need, they may side with you or come up with a workaround. They may see it's not such a bad thing for you to have, or resolve the issue with getting it done quickly.

 

If possible try to get a test system setup if you can on a laptop or otherwise, which will allow you to have extra permissions and then play with sysman groups. I understand that may be difficult. Unless someone else here has the time to try... (hint )

 

It is frustrating, but hang in there. If you and you team have the access you need to get your jobs done, then just make sure you document when you're putting your requests in, so that if anyone complains about access, you can say you've done your bit. Or, send the other people that need access direct to the IT Team or higher ups. Like bossman said, if you all take a step back, and try to discuss it again, you may find they are quite amenable to your request or at least will speed up doing it for you, as at the end of the day, you're making things easier for them.

[pete]

*makes standard complaint of "if SIMS had usable audit trails, this would be less of an issue"*

 

When you hire sysadmins, it's a case of "Trust, but verify" (i.e remote logserver that normal admins don't have access to). You can't do that with System Manager - the ability to elevate privileges, commit an action and demote privileges again without any real audit trail is a problem. No, System Manager 6's laughable excuse for an audit log doesn't count.

 

Here, there's 3 people with SM rights: myself and two DHs (we don't have a dedicated SIMS person). I've worked with them for years and we trust each other to a) not get up to shenanigans, b) let me know promptly if they bork it up. I can't say I'd trust all our staff to do that.

Edited September 26, 2011 by vikpaw
language!

[ctaylor]

Thanks for your reply vikpaw, I do understand the problem they have in some respects, and as suggested I did ask for my role to be looked at and for me to have responsibility for the permissions of individuals, for the reason that IT already give staff way too many permissions which may compromise my assessment data. I am as you stated - a data manager who heads up the assessment team, not an IT person really.

 

Would it be possible for you write down exactly what my IT people need to do to give me access to edit/view permissions but exclude me from other stuff I don't need. Granted I could use the permissions to add myself in to the group, but then that would be professional misconduct and surely they cannot assume I am going to do that!

 

Charlotte

[vikpaw]

The problem is, it's not easy to only give you those permissions, if you look at the attached photo, i don't think you will be able to only edit groups, you need to edit the users' memberships and i'm certain you will end up needing the full rights that sysman has which includes looking at personal info etc. If i get a chance to play with it on my test server i can give it a go, but i'm really busy at the moment. The problem is that editing permissions, inherently involves seeing quite a bit of personal info. Maybe you could just ask them to be explicit about what they think it will give you, because as i said earlier, people often think sysman has super rights to everything when in fact it doesn't. i have made a GOD group which does have superduperrights for the purpose of troubleshooting, but nobody is in it unless it's required for a short period.

[ctaylor]

Ok thanks - I will ask them what they are worried about me seeing, they may be worried unduly. Although I do suspect the main reason is that their sims knowledge is minimal and they don't know how to grant me the perms in the first place.

 

Charlotte

[vikpaw]

Well it's rather crude, but if you look at the official summer sims permissions sheet and compare assessment co-ordinator which you have with system manager which you want, then the things sysman can do is rather innocuous on most if not all counts.

 

permissions summer 11 compare assman to sysman.xlsx

 

Only use mine as a guide, i'd suggest doing the same yourself, and maybe keeping in things that you can already do that a sysman cannot as that's a longer list i think.

If they don't know what they are talking about, show them what you're really after.