Doling out passwords to students

[Blind]

I thought I would once again pester the EduGeek Hive Mind for the best practices in an area relatively unique to education.

 

How does your school go about giving unique and secure passwords to hundreds of people at a time?

 

Before I arrived, my school used the incredibly bizarre method of just forcing students to use their first name and not allowing them to change their password. (I suppose you can imagine what was happening to student files)

 

Last summer, I quickly cobbled together a universal password for incoming students and then required them to change it at first login, but this method has several drawbacks.

 

Ideally, I would like to give each student a random preset password that would work for their first login, but then have Windows require them to immediately choose their own. The choosing their own bit is easy, the automating and distributing the random one has got me stumped.

 

What say you?

[webman]

Here, new student accounts are 'password' and are instructed to change this at their first ICT lesson. It's always worked for us in the past.

[Blind]

That's pretty much what I did last summer, but I kept thinking that I was going to have several issues with kids logging in as other people and changing passwords.

 

Maybe I'm just paranoid, but this just seems problematic to me.

[GrumbleDook]

We have a standard password and have it set to reset on first login ... but we also disable the accounts until that first lesson ... which is on a day when only Years 7, 12 and 13 are in.

 

Makes life more manageable.

[webman]

Hmm. In theory it's possible but we've never had it happen before.

 

To be honest, I think the amount of admin work, time and cost required to initialise and distribute the unique passwords for a new intake far outweighs the time of resetting a handful of passwords in the unlikely event of someone logging in as others and changing that password.

[Guest]

we have tried several methods

 

we had set all new passwords to expire on 1st login but found new students couldnt work out the password changing screens on thier 1st day.

cue 100's of calls to helpdesk on thier 2nd day

 

then we tried password set to students unique ID but that was a mess as students worked out what other students passwords would be and logged in as them.

this year I think i will set passwords as thier unique ID but set them to expire in 3 weeks, ample time for them to work thier way around the pc and then set expire to around 7 weeks, all through group policy

setting completley unique random passwords would be the goal but then you have the headache of passing on that info to the students.

anything that involves more work for us is usually not gunna happen anyway

[mrcrazy04]

If anyone wanted to do it, this function will generate the random password (so I guess you could add it to the user creation script - and then output to the screen or to a text file).

It's VBScript - can't remember where I got it from though!

Function generatePassword(passwordLength)
'Declare variables
Dim sDefaultChars
Dim iCounter
Dim sMyPassword
Dim iPickedChar
Dim iDefaultCharactersLength
Dim iPasswordLength
'Initialize variables
sDefaultChars="abcdefghijklmnopqrstuvxyzABCDEFGHIJKLMNOPQRSTUVXYZ0123456789"
iPasswordLength=passwordLength
iDefaultCharactersLength = Len(sDefaultChars)
Randomize'initialize the random number generator
'Loop for the number of characters password is to have
For iCounter = 1 To iPasswordLength
'Next pick a number from 1 to length of character set
iPickedChar = Int((iDefaultCharactersLength * Rnd) + 1)
'Next pick a character from the character set using the random number iPickedChar
'and Mid function
sMyPassword = sMyPassword & Mid(sDefaultChars,iPickedChar,1)
Next
generatePassword = sMyPassword
End Function

[tosca925]

@MrCrazy

 

This looks good m8, could you elaborate more on what it does and an example of how you'd use it please?

[mrcrazy04]

It generates a random alpha numeric string, which is helpful as a password (I've also used it for generating verification strings on some websites I do).

 

You call it as follows:

generatePassword(5)

The 5 represents the length of the string, so you could make it shorter or longer.

 

I also edited

sDefaultChars="abcdefghijklmnopqrstuvxyzABCDEFGHIJKLMNOPQRSTUVXYZ0123456789"

to make it alpha numeric (it was just letters before) - so I guess you could add other characters like !#?@ etc

 

A user creator script I guess would be as follows (I haven't tested it, as I just specify one password).

password = generatePassword(5)

'<<<< RootDSE is used to obtain the default naming context (saves hard-coding the domain) >>>>
set objRoot = getobject("LDAP://RootDSE")

'**** Bind to the default users container ****
set objContainer = getobject("LDAP://cn=users," & objRoot.get("defaultnamingcontext"))

'<<<< Create the user object >>>>
set objUser = objContainer.Create("user","cn=" & fullname)

'<<<< The sAMAccountName is the username the user will use to logon >>>>
objUser.sAMAccountName = username

'<>
objuser.givenName = firstname
objuser.SN = surname
objuser.DisplayName = firstname & " " & surname
objuser.userprincipalname = username
'objuser.FullName = firstname & " " & surname


'<<<< Save the changes >>>>
objUser.Setinfo

'<<<< Set a password >>>>
objUser.setpassword password

'<<<< Enable the account >>>>
objUser.AccountDisabled = False

'<<<< Save the changes >>>>
objUser.Setinfo

[MkII]

I set passwords to surnames and change on 1st logon - quite easy to build the user accounts in a spreadsheet and copy surnames to the password field.

[tosca925]

Looking at this from a different angle, I could do with a script that i can run from sheduled tasks say once a month that will force users to change the ir password at next logon. But i would also liek the script to force the password to be at least 8 digits.

 

Can this be done.

 

I only want to run this on staff accounts and not kids so i can't set up a password poilcy s you can only have one per domain.

 

Anyone got a sample script?

[Geoff]

I only want to run this on staff accounts and not kids so i can't set up a password poilcy s you can only have one per domain.

 

Create a new domain. Put it in the same forest as your current domain. move the staff accounts to it. Apply GPOs and Password policy as required. Job done.

[dave.81]

Here, new student accounts are 'password' and are instructed to change this at their first ICT lesson. It's always worked for us in the past.

 

This is what we have been doing for years with no problems.

[tosca925]

webman wrote:

Here, new student accounts are 'password' and are instructed to change this at their first ICT lesson. It's always worked for us in the past.

 

This is what we have been doing for years with no problems.

 

I have a script already to do this and i am quite happy to use it but is there an option possible to add a line to the script that forces the user to use - say a minimum of 8 digits in their password.

[FN-GM]

I use this to generate passwords, and make each person there own little card with there username and password on.

 

http://www.pctools.com/guides/password/

[User3204]

We set the passwords to be the same at the start of the year for all enw students. This has been "password" or the name of the school, or the name of the domain. I change it yearly so other people can't guess it.

 

Then in their first ICT lesson they are shown how to change this.... so two weeks later, when they get their 2nd lesson, they've had a chance to forget it. I'll usually hang around in the class, and change/reset what is necessary.

 

We have had the year 7 students in for an open day during June/July so they should know their username.... yeah right, but can they spell it (it's their surname) ?

[webman]

so two weeks later, when they get their 2nd lesson, they've had a chance to forget it. I'll usually hang around in the class, and change/reset what is necessary.

 

For greater effect, use a wireless-enabled PDA to do this. "Oooh, aaah!"

[SpuffMonkey]

I used to let them set their own passwords - but when they found that no one could remind them of what it was - it became a sport to see who could come up to IT and get it reset the most times - I frequently had 70-80 students a day turning up. I asked to charge a 50p fine for resetting them, but got so much agro from finance and the SEN lot that had to give that up.

 

So I went for pre-set passwords, with a list that teachers could look up - I did it by grepping out 7 letter words from a dictionery file into a spreadsheet of the login id's and then bodging the spreadsheet to contain the command line instructions for setting the passwords, save as a text file, change to a bat and run it. Then teachers let the kids use the PCs on their logins and the list got nicked.

 

Now we've reset again - but nobody gets the list. More hassle

[kearton]

We set the password to their postcodes, and force them to change at first login

[gnarlyc]

In the past, our students just used the last four digits of their state ID number, which all of the teachers and staff can look up. This worked ok, except as the kids get older, they tend to 'find' each other's passwords and start logging in with other student's accounts. (Teachers tend to leave lists of students and ID numbers lying around...) It's also not a very secure password system if someone tried to crack the passwords.

 

This year, we are starting them off with a three-letter school abbreviation (first letter in caps), followed by the last four digits of the ID. They will then have to change their passwords at first login. We are also implementing password complexity requirements for the first time! I hope this goes ok. We are allowing all of the staff to reset student passwords, so there will be plenty of people who are able to help with that. We are also implementing the limitlogin.vbs script that I found here. We already had a very similar script to track who logged into which PC, so this was failry easy for our developer to do - although testing has not been completed.

 

This forum has been a great help so far! Thanks.

 

Alan

[srochford]

We now print the username and password on the student learning agreement which they get when they enrol; not all of them lose this before they get to a computer :-)

 

When I was in a school, I used to print out small cards containing the name, form, username and password and give these out to the new pupils at the first lesson - some of them like this and treasure the cards; others, of course, leave them behind (which defeats the purpose of trying to give unique passwords to each child!)

[limbo]

For the last couple of years we have been experimenting with setting the students passwords, and not allowing them to change them without requesting it.

 

This means that all their teachers can have a list of their username and password and give them out s necessary.

 

But - most importantly it means we can give them out to parents, which means that they can actively log in to the extranet as the student and see everything they can see, which means they have the option of monitoring email, documents, blogs etc.

 

Obvisouly not in the sixth form though - we give them the option of whether they share it with parents or not.

 

We randomly generate the passwords, but to make them easier to remember instead of single characters making up the password we use three letter words and numbers, so a password may end up something like dog4cat7

 

With a list of hundreds of three letter words this makes enough combinations to prevent guesses but easy enough for a student to remember.

 

On the whole it has been very well received by teachers and parents for the control it gives them, and not a single complaint from any student - and we have 1800 of them.

 

All the usernames and passwords will be generated automatically on the first day of the new CMIS data set and emailed to the relevant form tutor for wach student, as well as their IT teacher.

[plock]

We're thinking of printing the username and password on the welcome pack. Anybody found this isn't working for you?

[Marvintpa]

We use a little bit of software called UMRA to extract the DOB from SIMS and paste that into the AD meaning that each student only has to remember thier DOB. This is then changed at 1st login each year... or when ever we decide that we want to reset all the passwords.

 

We have found that UMRA is a good little tool that does what we want.

[sqdge]

We do the same as most of you - use the same password for the new intake at the start of the year and get them to change it on their first login. It's usually based around parts of the body (last year was "foot" - I haven't decided what to use this year).

 

However, once they've changed their password that's it for the four years unless they ask me to reset it.