* Posts by GoodOldHarold

6 publicly visible posts • joined 9 Dec 2016

Sysadmin told to spend 20+ hours changing user names, for no reason

GoodOldHarold

Think I may as well address of couple of issues that people have raised, which without more information would be perfectly reasonable to mention.

The reason for the usernames as they stand is that they reflect what's called a "staff code". This is used in schools as a shorthand for each member of staff, and it's also what appears on e.g. the timetable. For anyone who left school in the last couple of decades or so, cast your minds back to the way your timetable looked. You'd have a subject (or subject code, e.g. Ma for Maths), room number and then... something like ABC - generally speaking, that's the teacher's initials as students shouldn't know staff's first names (very old British tradition, I know, but it's very common). They already know their own staff codes, so it makes sense to have that as a username as it's one less other thing to remember and these are people who can't deal with plugging a computer in... ;) Believe me, we have to make a LOT of compromises in education!

So people are used to referring to John Smith as e.g. JBS, and you'll see that on e-mails, timetables, pigeon holes, requests to form tutors etc. Some schools even name their forms after the form tutor - we don't because tutors can change and then it's a faff... :P

What I would point out is, as long as you're actually using the middle name as a differentiator, you don't really get any duplications in our staff size (93 FTE count). Exceptions were where a member of staff actually didn't have a middle name, in which case we used what's now being proposed as the new system, but that was rare.

You only begin to get these duplications when you stop including the middle initial, and that's really why I object to this. Yes, I do object to the fact that it's against best practice and I'm busy anyway, but what's REALLY bugging me about it is the fact that it's a stupid system he wants to move to. I can already tell we're going to have two VCHs, two AMOs and... three SDEs! He hasn't proposed a system for how to handle duplicates at all, never mind one that could handle THREE people being the same!

Also, teachers get very attached to their staff codes, you know. It's a bit silly and sentimental but when you've been e.g. JBS for 20-odd years, you do get attached. Personalised number plates are very common too as people ascend up the ranks... :P

So basically this is annoying everyone and achieving nothing... and why? Because he doesn't like the fact he's been given Timetable & Cover as a senior management responsibility and can't cope with remembering who's who just like everyone else.

He has a list of who's who on the wall... I've created documents indexed by surname and staff code that auto-update every midnight from the MIS and linked to them on the Start Menu... plus he can always just look them up from the MIS himself or ask a colleague... and apparently that's still not enough! And then, the only response I get when I point all this out is "hmmm... I think you just need to accept that senior leaders require this change to promote SMART working!"

Sooo... that's why I was pissed off enough to write in about it... :/

GoodOldHarold

Re: Why not just do your job?

"Nobody is going to blame you for someone else's decision." </naivety>

"or maybe you have a bigger plan in mind that you don't want to disclose just yet" ;)

GoodOldHarold

Re: Email alias

By "alias" I don't mean an additional SMTP address - I mean the Exchange alias, which is used in Address Lists and is the Exchange equivalent of a "username".

GoodOldHarold

Re: Two questions...

It's for creating a local admin user account for the teacher to use at home, with the same username as their AD account, and then setting that up automatically so I don't have to do anything manual per each teacher's laptop. Literally just name it "after" them and the script does the rest. I have a lot of scripts like that in place, including for dealing with automatic staff laptop encryption. I maintain the view that I shouldn't really be having to do anything :P Although, of course, you have to put in all the legwork first in order to get there... :)

(In practice, of course, their username off the network will be ".\abc", but hey-ho...)

GoodOldHarold

There's a slight error in the article - the person who's asked for a written statement and then sat on it is actually the 1IC, not the 2IC. That's why we're still here.

GoodOldHarold

Re: Two questions...

Because of a script! ;)

So if a user is ABC, then his laptop will be called LAPTOP-ABC. The GPO script linked to the Staff Laptops OU parses the computer name, finds the bit after the hyphen and then:

1) Creates a local user with the same username and makes them a local admin;

2) Queries AD for that username to get their forename and surname and adds those to the new local account;

3) Calls PSExec to run "cmd /c" as that user and then terminate, causing their local profile to be created for the first time;

4) Calls PowerShell to use the [ADSI] WinNT:// namespace to expire their local password;

5) Shares their local profile folder with Full Access permissions for that AD user only - then there's a GP Drive Map for when they're logged on with their AD account that maps a drive pointing to that share on \\127.0.0.1, so they can access their local documents when logged on to the network (there are heavy GP restrictions and they can't otherwise access the local hard drive);

6) Copies our Remote Access .wcx file to their local desktop so they can set up their RemoteApp access.

For those commenting about scripting: this whole system is held together with my own (documented) scripts, all of which work perfectly fine as long as there is complete consistency across the board with principles like "profile folder name matches AD username" etc.