Security

Ask something
Discussion Locked

Asking Users for their Passwords

0 helpful
7 replies

by bettynumb1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A statement was made at my company that we (1st, 2nd and 3rd level IS support) should never have to ask a user for their password for any reason because this conflicts with IS's statement that a user should never give out their password. Today we use this as one of our main troubleshooting tools. Can we recreate the problem on a different PC logged in as the user? A feature works for me but not someone else - let's log in as that person so we can troubleshoot without camping out at the person's workstation and prohibiting further work. What does everyone else think of a policy where the user is never asked for their password? Is this do-able?

7 replies

by snuggles

I guess asking for the password to log into Win-- won't be sooo bad, if you make sure that the user in question change it to a new psw. afterwards.

But I would never, ever give away a password if there are any sensitive issues on my computer. Butthen again, I haven't been at a support yet, that doesn't have a contract that say; "keep yer big mouth shut, or else..." SO, in any case a customer should feel totally safe.

Afterall on a helpdesk you recieve ALOT of calls. Would you remember your third customer yesterday?

Of course, I should add: Noone should LOG a password!

Regards
Snuggles

by rwc

I was once told by our own IT Consultant that you should not let users make up their own passwords. Not only is their computer the company's property, but so is the information on their computer.

by al macintyre

One user remembering their own password is reasonable to expect. Some IT person remembering the passwords of hundreds of users leads to them being written down.

Our security system allows us to break user security when they leave our employ.

Our application software is setup so that anything we do on the network has OWNER that is a company owner & everyone is in user groups who are AUTHORIZED to access everything that is created.

Thus the defaults are ... suppose I am a user. I create something new on the network. Because I am in a user group, the OWNER is the user group, not me, and everyone else in the user group is authorized to access whatever it was that was created.

This is really related to application design. You have to recognize that in any company there will be employee turn-over & you want to manage your security resources to minimize any hassle involved.

by al macintyre

This really depends on how your security is structured. We have some dummy users with the settings in theory same as some other user & our security software will also let us COPY an existing user in which the only difference is we assign password to the copy without knowing what the original was.

Some software is sensitive to the USER ID.
Some software is sensitive to the WORK STATION address.
Some software is sensitive to settings on a PC that is being used in terminal emulation mode.
There should be system documentation that identifies where stuff is stored that is relevant to the USER, or the WORK STATION, or other things that we might expect to work differently for different combinations, but this can get extremely complicated.

by al macintyre

Consider the simple case of a print-out on e-server i-series. I have a user who works several days a week in different facilities & he wants his reports to print at the facility he is in ... easy for me to fix ... not easy to enforce. The traveler is using reports created by another person.

The other person wants the reports to print automatically one place whenever generated, The traveler wants them to print where the traveler is located. 2 users with different desires. Ok - tell me what you want to run & I will create copies JUST FOR YOU then you run the copy that moves.

Well they do not understand.
The system has a default printer.
Each device that generates reports can over-ride this.
Each unique work station address can over-ride this & that is where we store most of this stuff.
Each user id can over ride this.
Each sign-on session library list job description can over ride this.
Each program printer file can over ride this & that happens to be where the conflict is ... company policy is that all Queries should be created to be ON HOLD because queries override all above to go where the query creator selected & some people at other facilities need to print them ... Jerry was asked by a bunch of people at facility-2 to have their stuff print automatically not go on hold & now Dave from facility-2 is at facility-4 & he wants these same reports on hold so he can release to print at facility-4.

Easily fixed ... not easy to explain ... and it is primarily a communication problem between the users about some technical options, and not always easy for IT to remember what overrides what.

by bobby gillette

This is along the same lines as people in HR or Accounting losing their minds when they realize that network administrators have full access to sensitive data housed on their servers. Bottom line is if you can't trust your IT team with such data (including passwords upon request) you shouldn't have hired them in the first place. Ethically IT staff wouldn't use a user's password for any purpose other than providing a solution. In my estimation you have every right to request a user to tell you their password in order to help them. This is not to say your policy is in any way wrong or lessens its importance...simply that in some cases your company's IT staff is somewhat exempt from the policy.

-B-

by rblprd

the company I am currently employed for is instituting a new passwaord policy to keep people from knowing everyone else's passwords, but we keep a master list just for the purpose of trouble shooting and only admins have access to the database, being that they control and keep the network up and nothing should be restricted to them if they need to check it. But in the case of trouble shooting, I found a simple program on the net that we now use to diagnose user problems. It is called VNC fromAT&T research. It allows us to "see" what is cuaseing the problem and see what errors they get, it also allows us to fix some of these problems remotely, again only admin and certain MIS people have access to the viewer of this program, but the server program (which the viewer connects to on the users PC) is on everyone's PC. Hope this helps a bit.

John

This discussion is closed to new replies.