Software

Ask something
Question Locked

When IT Manager breaks policies!

0 helpful
11 replies

by fahimdxb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi guys...an odd question here!! I am mad at my IT Manager, he is such a sissy!!

Being a network Admin in-charge, I want to enforce a few policies at help desk. One of them is, not to create any user account unless an email arrives from HR to HelpDesk, informing of the user's badge ID, the department he/she belongs to. The status of employment and all those things. The procedures are in place but sometimes it so happens that some Head of the Dept. or executive management calls up our IT Manager over the phone, or send him an email directly which is then forwarded to our Help Desk incharge who is then left with little options but to create the account without due processes. All policy compliance guidelines get thrown up in the air.

HelpDesk incharge is bound by his position to, not to defy IT manager and he is scared to tell me (sometimes he does) that IT manager is forcing him to dilute the AD account creation policy.

I don't want to confront IT manager based upon inputs by Helpdesk guys but would rather put a mechanism in place, where I would automatically come to know, that an account has been created and I can ask helpdesk to provide proof of the email from HR arbitrarily and then confront the manager.

I know some Audit trails can be put and they would appear under Securty tab of Event manager ( or so I guess) but I need something more automated that would land in my mailbox.

Is this possible through any automated solution in AD of Windows 2003?

11 replies

by sgt_shultz

sorry but my opinion is if you don't know how to do this you are asking for trouble interfering.
just remind the helpdesk person to keep good written notes when the odd stuff happens.
rules generally are made to be broken.\
you do have my sympathy. my current company is now big into 'information security' but i can't get the to use strong passwords. sigh.

by jamesrl

Don't look to technology to solve your process problem.

You have don't have to confront the IT manager. You have to propose something and get their buy in. Go ahead and propose what you already have in place. Otherwise you will always find they
will work around whatever system you put in place.

James

by dspeacock

I don't know what industry you're in, but if something like SOX applies, you can politely explain to the manager that access controls REQUIRE that processes be followed, regardless of who it's for. Make sure the policy regarding account creation is up to date, and most importantly, APPROVED by senior management/board of directors etc. If it is, you and the help desk manager can then go to him and come to an agreement on following policies (and document the heck out of it). If he still persists in bypassing policy, then a visit to the Security Compliance officer is in order.

by bob.hunt

When rules like this are broken, it usually means that some incompetent is not doing their job.

These people sending immediate requests need to be reminded that based on company security, new accounts can only be created when you receive an email from HR.

Oh yeah, remind HR that you guys are busy and you need 5 days to process the request.

Remember one thing......

I saw this in an office one time,

"A lack of planning on your part does not constitute and emergency on mine."

by fahimdxb

Ok...in order to save embarassment for my Manager, I have decided to go and have a word with both HR and Admin managers. The guys are rational and I hope they will understand and minimise such mails to my (gutless) guy!!
One thing I need some help from techrepublic community. Without exaggeration, what are the major risks of such 'undocumented' user acount creation, that I can put forward, I mean, I need to make a strong case otherwise, the HR/Admin guys can always say, the usual mails follow sooner or later so why not go ahead with account creation and make the user productive from hour one!!?? *just wondering about one of their excuses!!*

Also, I think, installation of Microsoft Operations Management 2005, can be helpful. I have heard it shows the event viewer messages.

Does anyone have any experience with MOM2005?

by dspeacock

If an account is created without the attendant paper trail (needed for audit purposes), and the request is forgotten or otherwise not generated, then you have an account that no one really knows about.

New accounts should be created only after HR, the department manager and the security administrator have verified the hire, their security level/classification, and the sign off that the new employee has undergone security awareness training in the organization's policies and procedures. The new employee must then sign off committing to follow the security standards. This should include acceptable use, passwords, restrictions on data access etc. as well as the penalties for violation of the policies.

Just remember, if it's not in writing, it never happened.

by bob.hunt

Have you ever heard of anybody getting fired for following procedure? Not often.

Usually it's the other way around. You could get some idiot with a bug up his you know what that has you written up for not following procedures. Especially when it comes to IT security.

Are these people so unorganized that they don't have the time to fill out a simple form request?

Besides, I would imagine that there is additional information on the form you receive from HR that is needed to create the account correctly the first time.

What's the next policy that doesn't need to be followed?

IMHO, if it's not being followed, then ask that it no longer be policy!

by mjd420nova

I encountered the same problem with the CIO. So an intermediate level was created that those users were put. It only allows them access to certain areas and not the main data bank or systems until cleared by HR and moved into the mainstream users accounts. This was done as a result of a user who was added by the CIO and they promptly stole a load of info and skipped to a competitor. Don't learn the hard way but be sure you document their over stepping of rules by management.

by wayne m.

I will stand up and applaud the IT manager for doing the right thing in the face of a failed written policy.

A business manager has hired a person to do productive work for the company. This manager has already made the decision that the hired person is capable and trustworthy to do his assigned task. It is inappropriate for front-line personnel to decide that this person should be prevented from doing his assigned task.

If the HR department chooses to insert itself into this process, it needs to ensure that the paperwork needed for system accounts is completed prior to the individual's arrival. If HR is unable to comply with its responsibility, then the policy is simply inoperable. Until the policy is replaced with one that works, it is incumbant upon all to work together to ensure the business needs are met, i.e., provide the working staff with the access they require to do their job as quickly as possible. I am glad the IT Manager described above realizes this.

by willbpl

I took over an account management process that was in the same vein. I would end up with calls, emails and employees walking in for accounts and us - the help desk - responsible for it. It was chaotic with a number of contacts for one individual and we received audit exceptions for account information and documentation problems.

I solved this by letting IT administration know that if I was responsible I was going to set a ?documentation or no account policy? and enforce it without exception; responsibility without authority = failure. Now when we receive an HR notice we send information with the attached New Hire form to the department?s manager and secretary and place the HR Notice in a ?New Hire Info? folder. I informed my guys that with out exception no one receives an account without a signed document from the new employee?s department management. And if they had a higher up push back, send them to me to deal with.

With my director on board, I have had no problems with this policy and process. I now get the documentation we need quickly and without question.

This discussion is closed to new replies.