Ephelyon

Some will be aware that the forum has already had a debate on that particular article here. Suffice it to say I think many would take the view that "balanced" is not exactly what this article is. Contrasting professionals from other backgrounds with "thirteenth-century Vatican lawyers", for example, is humorous but unhelpful when trying to make a point, especially to those professionals in particular. I went down to Berkhamsted with another member and had a very good chat with the author's Deputy to get some background on this. It was written at a time when the Independent subsector was reporting very strong evidence of the "wall of nos" coming from IT staff, with the result that many SLTs began to lose confidence. One of the problems traditionally is that, when IT staff do get this way, nobody ever seems to want to ask why. We discussed how that kind of situation can arise and how a trusting partnership can be built up, with "managing upwards" as a distinct theme. Ultimately, if I recall, we concluded that the article was an opinion piece written to make a particular point at a particular time (especially relevant where the author's view on the cloud is concerned) and that there has in fact been progress on both sides since then. Currently some attempts are underway to build up an evidence base of how things are now with a view to writing a follow-up article, addressing some of the issues with the original from both points of view and providing a commentary on how things have been moving forward more recently.

Thanks, I'll pass that on.

Would you have any guidance on how to move to a single supplier without headaches of various natures... particularly for parents? It looks as if we may be doing that.

If I weren't already importing all form groups and set lists from SIMS into AD, it'd be completely impossible. As it stands, we have one form per house per year (quite standard of course), so I think I'll just have a security group for each house (e-mail enabled in Exchange for extra-crunchy value), containing all forms ending in the first letter of that house's name (scriptable during the import routine), then target desktop background GPPs at those security groups.

Different ties per house here too. And now I find they've launched to the kids this idea of having different desktop backgrounds per house... without asking us if it's possible first of course... :/

Hehe, we were both in the same position last night then. It's a bit like losing an arm when you're in the creative throes!

Add on to the end of your command: | Out-File So for you it might be: Get-ADUser -Filter {(givenName -notlike "*") -and (sn -notlike "*")} -Properties samaccountname | FT samaccountname | Out-File C:\NoNames.txt

On the back of that, here's a handy way to find all users who have never logged on and are not disabled: get-aduser -filter {(lastlogontimestamp -notlike "*")} -properties samaccountname | where { $_.enabled -eq $true} | ft samaccountname It's also useful that you can run PowerShell commands individually without the need to enter PowerShell every time. So from the command line or within a batch script: powershell -command "import-module activedirectory; get-aduser -filter {(lastlogontimestamp -notlike '*')} -properties samaccountname | where { $_.enabled -eq $true} | ft samaccountname" (Note that the double-quotes around the * have become single-quotes because the whole command string is now enclosed in double-quotes.)

As we see here: Field Notes of a Computer Geek: Filtering for $null Values with Get-ADUser You can't filter for $null values. It would have to be something like this: Get-ADUser -Filter {(givenName -notlike "*") -and (sn -notlike "*")} Remember to do an "Import-Module ActiveDirectory" first though! Would've replied last night but school's Internet went down and only had the Mac here, so had nothing to play with...

Did the caretaker get a say in this?

At the moment we're looking at parents ordering uniform online as we simply don't have anywhere to store uniform in school. I don't know if that means it'll be through a single supplier but it's sounding like it might be.

It can also help to prevent "masquerading". During my time in Holland when I was younger, I once went with some friends to their school and managed to actually sit in on lessons and just join in with everyone else. I said I was a new pupil and nobody knew any different. It was an immature 19-year-old prank, and now I work on the other side I can imagine the frantic e-mails when I didn't turn up the next day, but it's scary how that could actually happen. Consider if I'd been someone who was older but younger-looking (and of course they do exist) with, ah... irregular sexual predilections... hmmm, pervert in your classroom? Slightly worrying. It also helps when pupils are in uniform on school trips; you can instantly pick out from a distance which kids are yours as the teacher. That's also why they need to be customised to the school to a certain degree, as there could be a number of school parties visiting e.g. a museum or similar.

I'd use PowerShell's Get-ADUser command as below, searching for what you need: Get-ADUser

How come?

Thread update e-mails will have gone out regardless. I'm sure if the school has anything to add and wishes to respond they will; otherwise maybe a new thread to discuss what we feel an entry-level salary ought to be could be interesting as Elsie says.

What was your position? Just occurred to me I've never asked

You have to be over 16 to change your password. Seriously considering that policy!

There are also free self-service password reset solutions out there. It sounds like this is a primary school though?

That was because of the globalisation of information that began to take root from the 70s onwards, though most particularly from the 90s. It caused people to begin to think more deeply about information, how it is used and why, who ought and ought not be able to see it or change it, etc. Without the attempts and standardisation and protection that have arisen since, none of it would have been feasible on that scale.

Thanks, good to know. I wonder how it would be to work for a Head who'd had a sysadmin background? Would be interesting considering that with the amount of full-time teaching experience needed to reach Headship, I'd imagine they wouldn't have been doing much sysadmin work since about... the 80s/90s?

I said earlier: "Furthermore, there will be some data stored on the system that even members of SLT should not be privy to. This includes sensitive personal data on staff, particularly where e.g. disciplinary meetings are concerned, or disclosures of e.g. mental health concerns that may lead to an OHU referral. Some of you will know that the latter happened to me last year, and the only member of SLT I expect to have access to those stored copies of OHU referrals is the Head. Not the Deputy Head, not the Assistant Heads, not the Business Manager, because they Don't Need To Know™. In that manner, and only in that manner, we comply with Principles 2, 6 and 7 of the DPA." But that could be a different scenario. If there are allegations made against the Head, for example, here they would go to the Governors. The Chair also has an account and may store data (meeting notes etc) in respect of that allegation. The Head may not access this. Put simply, just because you hold X Very Senior Role doesn't mean you get full access to everything. Nobody does. We are the only exceptions and that's purely for functional reasons, e.g. how can you back up all data if you can't access it all? If someone wants to give me a few million and a team of very clever people, I'd be quite happy to go away and attempt to design a security/filesystem model that doesn't require this, but for now it remains an unfortunate exception.

The fact is they can cause problems without meaning to. The concern isn't that they would deliberately vandalise the system, but simply that the use of this skill requires great precision and some of us have careers in - basically - how to use it properly. Surgeons tend to hold onto their scalpels too. To suggest otherwise demeans the profession. As I said, clearly there is a hierarchy but at the end of the day if you believe an instruction is potentially illegal you have the right to refuse. If they have a problem with that, then it's time to go before the Governors, the LEA or a Tribunal if necessary and slog it out.

Forgot about Principle 1. But how does that square with what I raised before about the "can" NOT in fact being the same as the "may" in our case? Surely that must mean that, for us, the requirement for access to all data assets must be included in each of our job specs, otherwise a sysadmin post is always in breach of Principle 1?

I think @witch is talking generically about giving SLT an account with admin access, not necessarily your own. Perhaps "'your' password" refers to "admin access passwords" in general. I do agree that the school IT resources are the property of the school, which in our case is to say they are the property of the County Council with the Head locally in charge. That is the accepted structure and doesn't change just because we might want it to. However, and on the topic of explaining oneself, I'd view it this way: Full access to all data assets within an organisation is nothing short of an occupational hazard. That's because the first question the Police will ask you if your house gets broken into is "Who else has the keys?" If you are a full administrator, you're on that list. In common law, you can do away with the DPA completely and opt for "Malfeasance in Public Office", for which the burden of proof is (VERY broadly speaking) "the preponderance of the evidence". That means it needs to be "more likely than not" that the defendant is guilty of the charge. Furthermore, there will be some data stored on the system that even members of SLT should not be privy to. This includes sensitive personal data on staff, particularly where e.g. disciplinary meetings are concerned, or disclosures of e.g. mental health concerns that may lead to an OHU referral. Some of you will know that the latter happened to me last year, and the only member of SLT I expect to have access to those stored copies of OHU referrals is the Head. Not the Deputy Head, not the Assistant Heads, not the Business Manager, because they Don't Need To Know™. In that manner, and only in that manner, we comply with Principles 2, 6 and 7 of the DPA. Our profession is the only one where it is accepted that the "can" is not the same as the "may" in terms of access to data. The ONLY reason for that is that we have accepted the necessity of this for us to carry out our duties for the past 40 years. Nevertheless it remains an occupational hazard - and not a power trip! - that nobody else should be exposed to unless they can state, and prove, in explicit terms, why it is required. Perhaps it would be appropriate for the Governors or the LEA to intervene in forming an impartial external judgement on the matter. Maybe it's possible to use some of that reasoning when discussing these matters with SLT.

@witch, it's still rather difficult to respect that structure given that a senior management team comprised solely of people from one profession makes no sense and can't work. Naturally there does need to be a hierarchy at the end of the day, but when you're the sole expert in a particular domain it's not unreasonable to expect SLT to justify themselves every once in a while. The IT industry as a whole wasn't created just for them, has standards of its own which exist for very good reasons and rightly demands some degree of respect for them.