Sysadmin told to spend 20+ hours changing user names, for no reason

Identity management, no one understands it

No, absolutely no-one ... Even in big IT corporation, you only have a single chap out of thousands of IT people that can differentiate between login, first name, second name, display name ...

I was once in a company using X.500 directory for emails. Names displayed were "second name, first name" whenever looking up in the email directory.

And there was this chap called Pierre (first name) François (second name) working as a designer, and his alter ego called François (first name) Pierre (second name) being an HR director.

And there was this nutball VP assistant picking up the wrong address for sending a file named "factory_redondancy_list.xls" (they're all XLS aren't they ?) and crying foul to the (me) mail admin that the X.500 directory needs to be sorted by order of (people) importance.

Good (not) times it was ...

Two questions...

Why did it take him 20 hours to turn HR's spreadsheet in to a script that can update the various DBs?

(That's not a serious question)

A serious question is - why are the laptops named after their owners?

Any sysadmin that has been a sysadmin for more than a couple of years knows that this is a sure way to be swamped with unnecessary extra work for each swap or breakage.

One place I worked at introduced a new naming convention that had our IT dept working all night to implement. The CEO's newly configured user name became 'sod'. He had the grace to be a sport and live with it at least.

What happens to the audit trail?

If you allow changing of login ids? There is an audit trail I hope?

Another bad idea foisted on an entire nation:

https://en.wikipedia.org/wiki/Unique_Population_Registry_Code

Social hacker heaven.

First of all

Learn how to script, preferably in powershell since you're dealing with AD. Secondly learn how to build error trapping into your scripts. Thirdly you should already know how to script.

I've made this change in the past most often to align login names with email addresses to simplify life in a multi-userid age; more often now to disconnect userid's from email addy's due to security concerns.

Most of all - get a good policy that doesn't rely on random collections of initials and only apply to new/newish users. Always allow employees with lots of time at the company to keep their old ID's/email addy/phone number if at all possible - call it plank holders privilege.

Redacted.

I work for the company REDACTED.

They have an ERP software named REDACTED that we must use on a daily basis, living in a Server somewhere, so they don't have to install it in 3000+ terminals. So everybody must login in it using the RDP feature from Windows 7.

But because the terminals are not "properly registered" within the network, saving the passwords on the RDP won't help you, you have to retype your password. EVERY REDACTED TIME.

On top of that, the software has its own login passwords, instead of just pulling the REDACTED credentials from the network. And the network managers must copy them over from the network to the REDACTED program, every day.

In short, you must login on your machine THREE REDACTED TIMES, every REDACTED day, to reach the REDACTED program.

The kick (in the REDACTED) is, that REDACTED of REDACTED of a program runs on a limited number of simultaneous users, so you better rush in the morning, login before everybody else, and leave it running, if you want some usability out of it.

What happens if you have a John Barton Smythe, a John Barry Smith and a Josephy Barry Smithson?

3 letter usernames

3 letter usernames are terrible, my school used them. You end up with all manner of duplicates - I was AGI for A Gibson. But as soon as Ashleigh Gibley started she had to be AGI1.

Its just as bad with Smiths, you always end up with more than one sharing the same first initial.

Wrong reaction ...

Harold should have reacted by:

(1) Warmly praising his 2IC for brilliant leadership and the will to make hard organizational decision,

(2) asking about the budget that will be available for organizing the transition to new usernames, or

(3) requesting an external review to establish the required effort and budget to make the transition.

Most people only start thinking if it costs money -- so money is the argument against stupid make-do-work.

Futile

So, I agree the approach is futile (user-readable usernames are fine, but ultimately it gets lost over time, John Smith, Jane Smith, James Smethwick all map to the same username).

But, ultimately the 2IC and Harold have been doing different approaches to username allocation. Who's to say that Harold is right with his approach? Suck it up, you've called out the risks and been asked to do it anyway. Refusing to do it because you can't see the benefits is insane. There are always reasons you're not privy to, and having to explain to every sulky admin the rationale behind the request is a ball-ache and unnecessary. Off the top of my head, for all you know there is a DPA related complaint behind revealing personal information (middle initials) without a purpose. The cost/risk/benefit analysis isn't for you to do.

compuserve anyone

All email addresses were originally numbers, no problems with duplicates or funny spellings. From memory it was n.n@compuserve.com. I remember how exited I was when it was announced that names would be supported and we could apply for our name related email address.

The article does bring back memories of 20+ years ago of me swearing under my breath everytime a request came through for someone wanting to change their name due to marriage or divorce, used to take between half a day and a day to sort it all out depending on how many systems their single logon had access to. Happy days.