controlling a wannabe admin

Your wish to "terminate" the wannabe is rather draconian, at least given the info in your posting. First try talking to him, seriously, one-on-one, about his job. Find out why he is trying to go around the policies. Does he not know what they are or understand why they are there? Is his boss asking him to do something where he needs more privs? Have you talked to his boss? Does he not know what his job really is? What is the business problem he is trying to solve? Is the policy itself appropriate?

You may need to educate him and make him an admin in order for him to do his job, but his boss has to buy in to that idea. Overall, I would try to address the underlying issue and correct that before declaring him insubordinate and terminating him. Of course, it might come to that in the end, but it should be the very last resort.

Good luck with the problem, the non-technical ones are always the hardest.

i'm currently in college studying network-management-admin, and from what you say, your wannbee is a straight out of the textbook security
flaw waiting to happen

Here is a thought - give that office a "local" administrator password with some limited, although added, capabilities. Let the guy have his way with machines in that office (set it up so only machines in that office have that account), and track any complaints or problems outside the normal paths.

Good Luck!!

I don't want to be a System Administrator. However, I want to be able to do my job. As an outside consultant, I'm often called upon to provide complex technical documentation on a very tight deadline in "camera-ready" or other final format.

I'm simply amazed at the lack of understanding of my needs that I get from System Administrators. Often the PC they provide is one that will not handle my needs. When I ask them to load an application and to do a "custom installation," for example, invariably they do not and I'm left without the tools I need to perform my job. They usually take 6 or 8 visits to "get it right." When you have a 4 week start-to-finish deadline, this makes it impossible to do the work without a workaround.

To meet my deadlines, I usually bring my own laptop, loaded up with my own applications, and work "off line." I show the sys. admin. or other rep. who shows up exactly what I'm using and for what. They usually don't pay much attention because they are so sure that they "know" that they don't want to hear anything I have to say. The bottom line is that I work on my PC so that I only have to load my work on to their network (or burn it to CD and let them load it) by the time I leave. Frequently I leave the CDs.

I don't mess with people's networks or PCs that are not mine. Can I? Yes. I do so on my own network and my own PC. Will I? No. I'm not being paid to do so and it's no skin off my nose since I can burn CDs to give my work to my customers.

But I'm appalled at companies who call in consultants and request that the consultant prepare stuff that uses specific software they do not own or that is not loaded on the PCs they provide to work on. A common example is a company that specifically requests files in Word format and in Adobe Acrobat or one that requests Visio diagrams, etc. And it turns out that the Sys. Admin. will not load Visio or Adobe Acrobat--and sometimes they do not even "own" the application!

I've found that IT people do not understand why certain users need some of the seldom-used functions or why users may need certain fonts loaded, etc. Guess what? If you hire someone to do a translation into/out of a language with a different alphabet, you need to load those language fonts, files, etc. These people need a "custom load" to do their jobs!

I'm amazed that most of the IT people I have encountered over the years know much more than I do about how to do MY job and what tools I need to do it. I wonder why the IT person isn't doing the job I just got hired to do. It's got to be a better job than theirs.

Because I'm an outsider with a high $$ rate, my manager tends to be pretty high in the tree, and a call to IT gets attention. However, I'm often amazed at how employees of a company get bulldozed.

I was at a company with a stupidly slow network printer and one morning we were all standing around waiting for the print queue to spit out our jobs and I mentioned to the division president that this particular morning wait around the printer was costing him in the thousands/hour range (we'd been there about 15 minutes--and 5 of the people earned in the 3 figures, and 3 others in the high 2 figures. The IT department had "done a study" and found there were not enough users on this printer to justify a better printer! Stupid! Stupid! Stupid! But how does a division president let himself get blindfolded by the IT guys?

I can well understand why employees get frustrated by IT and take things into their own hands and play sys. admin. I can understand it if an employee is asked by his/her manager to provide Visio diagrams for next Thursday's meeting why they get hold of a copy of the program and load it. The managers, for the most part, don't understand why the employee can't go the store and buy Visio, expense it, load it up and get the diagrams done! First, the managers don't really understand the IT department needs--they just know that they want Visio diagrams. The employee does not undertstand that the boss doesn't understand the IT policy--he just knows he will get punished if he/she does not have the diagrams by Thursday.

As long as IT Systems Administrators continue to play god and disregard the needs of their users, the "power users" out there will do what they have to do to play "sys. admin." if they don't have the workaround of their own personal well-configured PCs to use to meet their boss' demands.

I am not excusing people who load up games, download MP3s, etc.

I am not condoning people who load pirated software on their work PCs.

I am saying, however, that if sys. admins. don't learn to listen to user's business needs, and don't have a mechanism in place to load software quickly (within hours--not weeks) when it is needed for business deadlines, then this problem will persist.

If an employee goes to the sys. admin. with a request for a software load that the sys. admin. truly thinks should not be loaded for whatever reason, then the sys. admin. should be willing to explain this to the employee's manager! There should be a genuine technical or business reason for the refusal and the sys. admin. (or his boss). My experience and observation is that generally this does not happen.

As an aside, if a company has more than one location, there should ALWAYS be someone on site to serve as a deputy sys. admin. I like the notion of training a true power user or "Wannabe" Administrator for this role. The bottom line is that there needs to be someone on site who can respond quickly to needs for new software, reloads, etc.

How do you know who used that workstation after hours? If two or more people know a common USERID and password, then neither can be held responsible for its use. More importantly, you cannot prove that the person in question was at his terminal when the admin logged on. While it probably was the person involved, proving that becomes problematic in the face of shared USERIDs and passwords.

If you gave him admin rights in the past, then it seems possible that he cracked one or more passwords while he had the rights. At the very least, I think it prudent to change all administrator passwords and eliminate any shared USERIDs.

As I understand it, administrators should use USERIDs with administrative rights. They should not use the Administrator account. In addition, turning on strong passwords seems like a good idea if it is not in use now.

Well, I kept reading and saw many posts that talked about the wannabe's political clout. And, many have suggested coopting.

Meanwhile a thought to keep at the back of your mind, if your company is real small, and the wannabe knows your stance regarding him (I'm sure he must have an idea about it by now)... can he replace you? Is that possible? If yes... maybe time to update the resume.

I couldn't help but laugh at this "Oz_Media" clown. By the sounds of things, you're either one of those wannabes yourself, or you clearly have some mental disorder whereby you enjoy having other people making your life miserable.

Regardless of what terms the original poster used, whether it's "CONTROL" or "WANNABE", it doesn't change the fact that HE is charged with the duties and responsibilities of being the system administrator. It's not his company. We know that. He never made any such claims. But when there's some yo-yo running around the office causing you grief which then forces YOU to work overtime and takes you away from your friends/family/girlfriend/wife, then yes, you have every right to be upset and to try and do something about it.

I am truly astounded by the number of people in this thread who seem to be taking such a "who cares" approach. Just because the guy hasn't yet caused serious and irreversible damange to the company doesn't mean that he won't do it tomorrow or the next day. If you have one of these ass-clowns running around doing things that go BEYOND their job description which directly interfere with YOUR own job, then yes, you have every right to be pissed off and take matters into your own hands.

Ultimately, matters are made ten times worse when you have an idiot boss who doens't understand the issue, or in this case, the remote office boss who either doesn't get it or simply doesn't care enough about it.

But to say that this is a power struggle is ludicrous. The guy is simply trying to do his job, and not allow some moron to cause him further aggravation. Yes yes I've heard the argument that maybe the wannabe is eager to learn. But that doesn't sound like it's the case here. If someone is eager to learn, I would tell them the following:

- go pick up a book
- go take a course
- set up a network at home and practice
- ask questions before you touch something

But I would definitely NOT be giving him the impression that it's somehow "okay" to go and screw around with a production server all because he wants to "learn". Learning is fine and is to be admired, but you don't LEARN by taking apart a running car on the highway.

I have more than enough experience in dealing with matters such as this, and all I can say is that if you've already documented all your problems and you've approached your boss and he talked to the moron in question, and you're still not getting results...then it's time to make it clear to them (in writing) that it's only a matter of time before that "wannabe" does something which will have serious reprocussions on the company, and in such an event, YOU will not be held responsible because you went out of your way to warn them months in advance and you did everything you could humanly do to prevent it from happening.

Very few people understand what's truly at stake in these situations because they're nothing more than arm-chair admins. They haven't done a single day's work of looking after a network, and yet they go on to give their "advice", and some clowns even go so far as to say you should ENCOURAGE the troublemaker because the poor guy is just trying to learn. Please, give me a break. When the guy does one day cause a major problem which will screw up something seriously, not only will your job be on the line, but if the company you work for is stupid enough to let this go on, then believe me - they will be stupid enough to want to hold YOU accountable and may even try to take legal action against you, claiming that YOU were the cause of the problem because it was YOUR job to make sure things like this didn't happen, and it was YOU that ended up costing the company tens of thousands of dollars, and it was YOU that should be held liable and be made to pay compensatory damages. Think it can't happen? Think again.

The absolute worst thing you could do in this situation is to do nothing and to keep letting it happen. If all else fails and those in charge refuse to listen to you, put down all your grievances in writing, and make it clear to them that it's only a matter of time until this blows up in their faces and you refuse to be around when it does - and then resign. There are plenty of companies always looking for knowledgeable, talented people who know what they're doing, and don't have this idiotic mindset that we can just "let it go because it hasn't hurt anyone (yet)".

In the UK we cut their hands off. Or we give them a damn good bashing in some obscure broom cupboard.

Getting technical or even caring and explanatory is a complete waste of time. Some of these people still think that digital watches are a pretty neat idea!

Seriously.

I see both sides as I have been on both sides. I am now Manager of IT Ops and know the benefits and risks of users that know less than they realize.

Although having technically skilled assistance at a remote site is useful, it must be managed with care and common sense. Most users that are technically literate like to play with settings in an attempt to boost performance, secure a box, block "Big Brother", and the sort.

When they start playing with settings that can have devastating effects, like going to the root of a system drive and setting all file/folder access as everyone "read only", this becomes a serious problem. I have actually seen this happen.

All you can do is document the event, report it, resolve it and move on.

You must remember that Management does not care about emotions, just facts. Management is always looking for people to become sub managers, people that can be neutral, calm and deal with issues with minimal intervention.

If you can prove this person is taking unauthorized actions; document it, ask your boss for advice on how to approach the culprit, advise the culprit of the situation and what you have been instructed to do and keep a running document with a log of dates and times of all events.

If this person is such a threat that systems are being blasted, then remember you must do your job, and only your job. This includes keeping your boss informed of all related matters and how you tried to resolve them professionally without escalation.

Also, remember that all communications between you and the other party must be professional; you must ?stay above the fray?. Keep your tone and inflection (both in conversations and emails) courteous and professional.

You should appear as more the victim than the killer.

If not, you are also part of the problem.

The password doesn't have to have been writen down. I caught a guy who had PHYSICAL access to his fellow employee's workstations - using a HARDWARE keylogger from http://www.keyghost.com!

Your best bet with dealing with the net admin wannabe, is by reading the company policy that has been placed for the employees, using the company's computers. If there is none, then you will not know whether what you are trying to install on the computers is right or wrong, maybe the company has strong security issues that are being implemented without your knowledge, which basically leaves you on a need to know basis. As long as your net admin leaves you with enough rights so that you are capable of getting the job done then that is fine, but if you have further need for more resources, then you should submit a letter of request to your manager and he/she should inform the net admin to give you what you want. It's not a solution for getting rid of the net admin, but it is a solution for atleast trying to get what you want.

I agree that the best way to communicate with upper management is through recourse to cost vs benefits.

However, I would prefer to work for a company that considers the opportunity costs of hiring average workers.

The equation given,

(value of the work product) - (employee's salary + cost of bad behaviors) > 0
=> employee improves company value

does not take this into account because an employee may be bringing only $5 a month into the company but ALSO taking up a valuable employment "slot" that could be filled with a more productive employee.

I had an installer come in, hired by a Vice-President of a production department and I, the administrator, was called in after the fact because he could not get any of the veep's workstations to talk to the server.

This bozo set up his document imaging server as a PDC of its own domain! He did not consult with the admin to find out anything about the existing network, but guess whose job it was to make it work after he set it up however the hell he wanted?!?

I challenged the installer as to his knowledge and, surprise surprise; it turned out he had none.

His product was removed, my company exercised its option to fire them and cancel the million-dollar contract and go with someone else. Lesson learned by both parties.

You say don't point the finger yet that's exactly what you did when you "challenged the admin to his knowledge and credentials" in an open meeting. Let me know who you work for so I can avoid you like the plague you are.

So you see class, one antecdote provided by one tech boy does not provide the one-size-fits-all solution to a complex problem. Next?

All these suggestions to "offer to let him help" seem to come from people who missed a crucial part of the story, to wit: "He is not interested in learning how to do things the right way, so there is no point in trying to use him in any sysadmin capacity."

For those who were napping, he is not interested in learning how to do things the right way, so there is no point in trying to use him in any sysadmin capacity.

Now, in case you missed it, he is not interested in learning how to do things the right way, so there is no point in trying to use him in any sysadmin capacity.

Did you get it that time?

I have a headache...

Enable the auditing feature on his computer. This will allow you to track his successful and failed logon attempts and even privelage usage. You can then export those entrys into a text document and submit it to his supervisor. If you're running a windows 2k or 2k3 server, you should be able to administer this feature from your server so you won't have to make up some excuse to use his computer.

Good luck!

Your company obviously allows your net admin wannabe get away with what he does, so why not pay him for the work he is supposed to do and if he knows a bit about assigning rights and permissions its an added bonus, for not paying the right people to do the job. Or maybe you company's management is not so clued up on how important company data can be.

I agree with the sentiments that you need to lock the wannabe's account down as much as possible. You need to track everything you do and come up with contengency plans for anything he might be able to access and mess up. It's not like you're going out of your way as you should be doing this anyways as the admin. But I think documentation is the key.

I am the engineer at the HQ of my company and have to deal with an Admin in the India office. We are polite to each other and that's about all I can say about him personally. Professionally we bump heads all the time when those grey area's arise. One of the more bitter fights we got into was about fixing poor video conferencing settings over the routers. To make a long story short, we both consulted Cisco on our own and came up with our own code. It got into a nasty back and forth. Rather childish and stupid, so it's not like I don't understand where your frustration comes from. In the end my Boss suggested I just bite my lip and be the one to back off the argument first. I did and allowed him to use his code first. In the end he calmed he fixed it it, but he used my code with one minor syntax tweak. I used documentation to prove whose code fixed the problem. My boss understood, so even if that wannabe thinks he got the upper hand, my boss knows the truth and I have the documentation to keep my butt gainfully employed.

Like the others said, don't take it personally, but protect yourself from an intrusive user if management is unwilling to do something. If and when the fit hits the shan, then they can't touch you with a ten foot pole. You warned them, they ignored your warnings. You tried to stop him, but he persisted. You have a backup plan ready to go, but the inconvenience is their own fault for not listening to you in the first place and taking your advice more seriously. You end up saving the day and hanging him out to dry.

Not saying you should set a potential disaster up for him to fall in, but be ready for anything that might come your way. Your increased readiness will only make you a sharper admin.

Good Luck,
Mike

From the discussions I get the feeling that trying to fix the problem by dealing with the "Wannabe admin? side is not going to work for you.
Your best bet is to manage his actual role, not the role he is playing with. As fas as his management is concerned, if he completes his official work there is no problem. It's his official role you have to "manage". If he fails here, his management will take notice.
Why is he playing at a "Wannabe admin", what are his reasons? Why does he think this way? How is he dealing with the official role?
When you know these points you can manage him right out the door.

I knew I'd get that oh-so-smug remark regarding the "PERSONAL in PC" :-).
Of course, I don't think that I OWN the workplace PC. I just want to use my tools to do my job.
Sometimes it's like an adult riding a tricycle.
What really irks me are inane admins!

Simplest solution is a key stroke capturing program installed on his machine. Have th results ent to you via email. The program will be hidden your mail will be hidden from the user. Had same problem - you migh get more than you suspected - and cretainly it is info that can be shown to tjhe boss! Have fun see example program below:

WinWhatWhere Investigator by WinWhatWhere Corp.

Download WinWhatWhere Investigator (7.64 MB)
WinWhatWhere Investigator monitors all PC activity in Stealth including every keystroke, mouse click and application run on the PC and can send that data remotely via email. Version 3.0 adds the capability to monitor "both sides" of Instant Messaging, Chat and Email applications for unprecedented monitoring reach and detail. Granular detail monitored by Investigator 3.0 include, date, time, elapsed time, window titles, URL's, dialog boxes, file activity and both formatted and unformatted keystrokes. Investigator can selectively monitor applications or time periods and provides an optional Notification Banner to let users know they are being monitored.

While hacker attacks and virus outbreaks grab headlines, many security experts consider disgruntled insiders as a greater security threat to an organization. WinWhatWhere Investigator's stealth and forensic detail make it ideal in these investigations for law enforcement, government, business, and private individuals. Used in corporations and high profile FBI cases, Investigator can also be used to discover computer abuse in the home. Other uses for Investigator's powerful monitoring capabilities include; providing audit trails, software license verification and emergency back up data.

Stealth Installation: Investigator runs silently in the background
Stealth Email: Email Investigator data in Stealth
Notification Banner: Let users know they are being monitored
Hi an Low Detail: Provides different levels of monitored detail
Selective Application Monitoring: Monitor only certain applications
Email, Chat and Instant Messaging Monitoring: Capture both sides of these sessions
File Activity Monitoring: Monitor changes to files
Deploy Utility: Standardize your installations
Auto Summary Reports: Convenient Summaries of Investigator Data

Found this on Wugnet

Have Fun - Good hunting

Harry

One of the departments I had serviced in the past had so much restriction, a legit programmer couldn't even install his products without making times and requests and having some there to allow installations of setup and runtimes as they wouldn't let him install things on his own. Worked in the same department but the IT administrator does have a big ego to contend with. He believed nothing could challenge his pride and joy, so keeping some things secret helped stop giving a feel of threat to him. If he invited me to demonstrate how easily it could be done on his system, he would freak and would refuse to acknowledge it.

If someone has "power" or "administrator priv" on their own computer, all you do is use LC4, a product that can read virtual passwords and find all accounts, and decode it to find out the Administrator's password within a short time - with the cable unplugged from the back, then later clear all logs just in case. I've used this on rogue users' computers who had changed the admin local password and so on - works well.

The piece of paper bit may have occured but one could have used a hardware logger - the unit can be plugged in between the keyboard and computer - the computer won't sense it and some models can take up to 1 million keystrokes or more. To retrieve it, you enter a unique password - one that noone else could ever type and the unit stream the keyboard capture data to wordpad etc and the computer believes it is coming from the keyboard itself. There isn't anything available to combat this let alone detect it! So why you are all saying this and that, if someone wants to get in and has a fair amount of info OR have one of these units, they will get in - like it or not. With the unit, I can carry away some bosses Confidential report if I had installed the unit before they come in, and take the unit home to my PC - all is revealed...

Well, I sometimes feel like I'm god in my work as an administrator for a Unix server and network of around 30 computers...

You have to understand that sometimes, locking up the network is a way to make sure that people don't go looking into what they aren't supposed to. While my network used to be completely static and locked to specific IP for each of the frozen workstations, we had to add access for laptops that could change locations from time to time... And so security had to be loosened. What's i've seen though, is that as soon as the security went down a bit I could notice people looking around, poking at stuff they should not really be checking out.
What I mean is, while users want to be able to perform efficiently, it is the same thing for the network administrators. As the infinite amounts of problems of the type "non-working mouse" and the more complex network downtimes arise, we just want to make sure that we don't have to give in 5 more hours per day monitoring all the traffic that we had during the day.

Well, I must admit I do not have that much knowledge of the workings of Windows Server and the like,
but through my Unix server I would have taken the rogue game server down and locked up the IP ranges and MAC addresses to be able to connect... Then again, the net I administer is pretty static and simple.

Google NT Password Recovery Domain Contoler

There are about a millon sites showing you how to do it, takes about 90 seconds to do it with the "linux NT rape disk" and 3 minutes with 2K Recovery Console. You must do it localy.

I am not sure what type of work you were doing that required the command prompt, or customized desktops, or the ability to uninstall software the company has paid $$$ for, or install software that the company hasn't paid $$$ for. I am sure, that if these things were actualy required, you would have had the ability to do it.
All of this "Ask your self honestly, don't you admins have this major control issue...?" crap is obviously from none sys/net admins. Or, if they are admin's it is of a very small or insignificant network with nothing to lose if it all went bye-bye right now due to the mistakes of the many users. Someone else said it earlier, you're not taking away privlages if he shouldn't or didn't need/have them in the first place. The admins must protect the intrests of the company and if that includes restricting your browser favorites and the command prompt, then that is what they should do. The Admins should exercise least privlage untill a user has a legitimate complaint about work related productivity and then ease up on security and tighten till they complain again, repeat.

As I said before, I don't know what you do, but not every workstation needs internet access, or to be able to "administer" the company's workstations and network access.

Oz, I agree to what you said, teach this to the guy, and so and so. Especially on the 2nd to the last paragraph. We share the same thoughts.

But let us make clear that the guy is being disrespectful to other people's job. I guess we have been long enough, most of us, to recornize this. Even if the guy is in the top management, he should have respect on the job assigned to him, and others.

I've had similar cases for the past years. Instead of being the police, I became a friend, or mentor. But first, again, respect. That guy must know what kind of ground he is standing in. That is where the company's management kicks in. Even if he is treated as the golden boy. After some "lively" discussions, the management decision should still be adhered. Of course, the management can become lenient at sometimes, but it will still serve you and make your point be heard.

Then things will workout fine afterwards. And it will keep you on your toes.

Sounds like you did the right thing, whereas the rogue in this situation from the discussion did not have your wisdom. If, he sought help or tried to off assistance then this would just be a case of he tried to help(when asked/offered) and it didn't work out-move on. But, in this example, the case is he tried, he failed, he was asked to stop and thank you for your effort, and he continues to do his own thing. That is the problem and difference from your positive and valuable actions in your own company.

I am all for help and techie newbies, but everyone should know one thing before they start something new-"You know nothing, and from here you can learn everything."

I have to deal with a three week wonder who thinks he is a programmer but lacks any degree of coding skill. Yet he is assessing my and others work informing us and the boss of what is right or wrong with our code. He is thoroughly documented but the company refuses to fire him because he has an attorney deal with his human resource issues. Worst yet he got promoted and a pay raise.

You'll have to do the psychological thing on him. Begin by limiting rights and priveleges to manage this guy. I would innocuously turn on system auditing and track everyone's behavior including his. (Strongly suggest that a independent pc do the tracking so the servers are not tasked) They all should be notified of the auditing system in use to track security issues. Flash a banner on login and cite Federal Reg's or local code in the text on the banner. ie:

"This is is for official company use only. Use of the system constitutes consent to monitoring pursuant to CFR xxx.xx.x and City ordinance 123-123. Regular system reports will be submitted to management citing website, software installation, virus, and other dubious activities. If you do not agree with this policy then LOGOFF the system IMMEDIATELY addressing your concerns to proper management."

Other psychological things you can do:

1. Trumph up a computer incident. Have a investigation into some security issue closely similiar to this guys activities. Have independent auditors - private investigators (ask a friend unknown to the others) to come in to conduct the forensic investigation. Have the investigator get all excited about his findings and grab you in front of this guy for a private conference. Make sure the investigator sort of leans forward and looks at this guy kind of eyeing him.

2. Write up an draft incident report discussing the circumstances around a problem. Cite in the draft report some activities closely similiar to his. Accidentally leave it in the clear for him to see.

3. Get a pager and have the system page you when software is installed or certain other activities are conducted. Have the pager go off in front him once or twice then run to the computer room.

4. Have monitoring messages pop up on his machine accidentally because you forgot to set some things. Then apologize for the disruptions. Heck use net send to pop a message up if you don't have the monitoring software.

5. Have the company attorney on retainer draft a letter stating the law regarding computer law and legal actions. Have him stipulate in the letter that his firm deals with employee misconduct and he looks forward to working closely with you. Leave the letter in the clear to be seen.

If you are a technology guy you are already demented enough to do these kinds of things with a great deal of skill. Technology guys are known for being psycho's and you can have this guy so paranoid that he'll be fearful of logging in if you are even slightly skilled at this.

First, if he's a "wannabe" how come he's getting past your security or if he's unsuccessfully attempting to gain access to features not available to him, so what! Either way if he's not supposed to do these things it's up to you to stop him.

Everyone administrator has dealt with this situation and yes it can be very frustrating. But you have to look at this as just another security issue and find a way to deal with it. It's best to handle this between yourself and the person involved. I promise you, upper management doesn't want to be bothered with this type of non-productive flack between IT and the users they are there to support.

Your statement about trying to get the person fired is what shows you're not considering what's best for the company. You have a personal problem with the individual and that would be evident to anyone you bring this up to. Unless he's really breaking the law or some serious company rules you won't get him fired. Why would the company spend the money, time and effort to go through the new hire process?

You mentioned what may be the solution. If he's got some experience and is interested in helping you may be able to use that to your advantage. You're saying he doesn't want to do things the "right way". IMO you really mean "your way". Establishing a workable solution to this situation shouldn't be that hard. Get rid of the hostility and look at it by considering what's best for the company and this will work out just fine.

Remember, by trying to get him fired you may end up loosing your own job.

Your solution is simple and takes multiple paths.

1) Start from scratch. Know what apps he needs and do a fresh install of the OS and apps. Also do a recon of all hardware and servers for anything amiss.
PS You do have locked server room don't you? Or some sort of physical server security

2) Write a policy toward machine use...... No outside apps, no personal email, no installs except by the authorized people. (use names or titles).

3) Have your other admin using a password policy that requires change on Tuesday and Thursday and make them aware that a misused password is grounds for termination. And turn on all appropriate logs.

4) You cannot reprimand the rogue BUT you and your boss can sit down with him in a meeting with his boss and layout what you know and the new policies. Make him sign a statement that he understands them. Good old paper stands up well when having to fire someone.

Finally, the poster that suggested using this as a security drill had a VERY good idea.
We all have those mundane tasks of adding users and password changes, and we ALL read about the cool things others are doing with their gear (I admin. OS X myself), well you've been handed a sweet piece. You can use this as a reason to go to security demos/seminars. You can also use this as a reason to demo new security software and hardware. http://www.csoonline.com
Biometrics anyone? http://bssc.sel.sony.com/news/puppy/
Give your other admin. a fingerprint log in and a portable reader. Viola.
Yes, if they are plotting together it can be defeated with a Jell-O mold but key it to a specific reader.
You are monitoring the rogue's outgoing email for large attachments aren't you?

It's a remote office so it makes some of this harder, but if takes a drive/flight to the remote office that may be what you have to do.

If he's doing data entry/scanning he should have little or no need for diskette or cdrom access or internet access. You need to configure the bios so he can't boot from other devices besides the HD. Assign a BIOS password, lock the computer case shut. Make sure he's only a member of groups he needs to be. Use group policy to limit which apps he can run.

All of this should've be done before he got access to the computer - since it's after the fact you'll have to either restore from a clean image or search the best you can for any extra software he's installed or has downloaded.

The same should be done to other computers in the remote location. I know the other users aren't the problem but if you take away the options on his computer but leave others open he'll use theirs.

I know this is quite a task and will take time/money. But without doing this you won't be able even start keeping him out.

If he were to take over and restrict your access what would you do to get it back. IE you've gotta start thinking like a hacker to get out in front of this guy and start blocking him - rather than playing catch-up.

If you can't do anything crank up the auditing on the local admin account and his for that matter.

You are making two contradicting statements. On the one hand you say that he does not know much about computers/networks/etc and he is not interested in learning how to do things the right way, so there is no point in trying to use him in any sysadmin capacity. On the other hand you say that he has not quit trying to mess with things!
If he doesnot have sound knowledge of systems, how he could mess with things, that too in W2K environment where virtually everything is under system administrator's control.

It seems you are afraid of his knowledge capacity and because of his managerial influence you fear about his becoming your substitute. That is why you want him fired by any mean. I have seen so many system administrators trying to scuttle learning curve of users. Almost all require dumb users who should be completely dependant over them even for simpler tasks like copying a file. I suggest you change your attitude from negative to positive and encourage him to understand the underlying principles of systems. He can be very useful for you in the long term by assisting you in managing your systems efficiently by lightening your workload. He is closer to other users than you are. So he can teach others how to use systems efficiently and more productively for ultimate gain of your organisation.

Your problem is a political/managment problem and cannot be solved through technology. You must make it clear to the senior level management that you support employees developing their skills, etc. but there has to be limits that will not affect the operation of the business. A reference to the effect of a disaster upon stock prices and the subsequent involvement of auditors in your boss's boss's operation will allow him to take action.

First, stop looking for a way to fire the guy, that's not your business you don't have time. Second, find out what it is his office thinks you not providing. Third go to his work stantion, lock him down to a user only, so he gets the message, don't fool around. Stop trying to do it from your consol, visit the work station.

I agree with those who have cautioned you about making this a personal crusade. You need to rein in your emotional reaction to this clear affront to your authority. If you have already taken the issue to management, then you did your job in warning them of the threat to security. Your next step is to improve your security procedures and document any further attempts to violate security policy. (You *do* have a written security policy that has been approved by management?) I would be most concerned that an admin password had leaked. You may have more than one security problem here.

The most important thing is that your conduct and attitude be kept at a professional level. If you come off to management as petulant, petty, and vindictive then *you* will be viewed as the problem and not the wannabee.

Good luck.

I have a slightly different view of this. I am essentially a DB admin, but I also provide support to a unit. My unit has been partly moved under the jurisdiction of a new group of Network Admins.

Where I previously had order, they have brought in chaos and inconsistency. Previously working software (and I'm talking Word and Excel here so nothing unusual) does no longer function as required (e.g. can no longer save to the network!, can't use VBA, not patched etc...)

They change their rules every five minutes and end up causing twice as much work for others as they resolve. To add insult to injury they are now trying to tell me how to manage my database when they clearly don't know how to manage a database. They have messed up my system so much that no-one, especially me, knows what's going on any more. And if I need them to do something e.g. a simple login, it can take months and months. One computer has taken them nearly a year to configure, so long that they have had to do it again with a newer OS!!! I'm not the only one who complains but as their boss is next door to them and "pop's in when something is wrong and they deal with it quickly" there is not a percieved problem. In addition my manager isn't interested without hard evidence.

What ever happened to the good old days of 1994 and prior when we had a very firm computer use policy? It seems the more technically advanced we become, our tolerance for this type of behavior rises. One large mistake of horse playing by a 'wanna be admin' is enough. The third mistake by this individual is the mistake of the management staff.

I agree that working in a tight-locked environment can be a stress factor but, unfortunately, a lot of users think that They Know... and they don't.
I remember one guy always connected with a p2p network with his "business consultant's workstation" and complaining 'cause the network was slow; i told him that p2p was not supposed to be part of his workstation's sw equipment and not to reinstall it after the tenth HDD format.
You know what? He is the boss'daughter's boyfriend and has The Power.
If you have to fight with that kind of animals, better to look for another job; it takes a very big liver to hear the boss telling you that the guy is a very important figure in the company and he should be allowed to play in the afterhours...
So i told them twas not my business and, please, pay my bill...
A few days later they wanted me to tell'em if i could track a suspect insider sabotage... they wanted to hire me... lol! I prefer to work in a shop where all the trouble comes from a few customers than go to bury myself in a position "between anvil and hammer".
If one has to work on a pc he/she has to work; i can admit playing a CD but nothing more. To make stupid/dangerous things they have another pc at home.
My dream is to admin a *nix network, so that i can rm -rf /home/stupiduser whenever i like (sounds like BOFH?)
Just kiddin'; ciao.

Let's put this in a different department, Accounting perhaps.

We now have a rogue accountant, a "CFO Wannabe" if you will. He steps into the office of the CFO and changes financial documents, approves funding requests, and cuts funding where he feels is needed.

When the CFO returns, many departments are upset with changes instituted by the CFO that he has know idea about. The CFO then has to work extra to resolve these fires.

Upon finding that employee X had done these things the stuff would hit the fan. The employee we be removed before he could put down the pencil! There would be no "taking the person in", or "training their passion". Simply, ADIOS!!

Now let's twist the story a little bit. Employee X is the bosses relative. He is covered by "Daddy". The CFO makes known the ruinous ways and actions of Employee X. "Daddy" defends Employee X and passifies the CFO.

From now on the office of the CFO and all documents therein remain tightly secured as this is the only recourse.

Why any different here?!

We are entrusted with the network and all attached devices (or our sphere of responsibility). We are tasked to make performance enhancements, maintain stability, and minimize loses. Any threat to this responsibility must be mitigated and removed.

If Employee X wanted to be a CFO, he would need to study and practice elsewhere, and wait for the opportunity; not just assume the role. Same in I.T.! Like the cliche says, "Just because you can, doesn't mean you should".

If like the CFO your hands are trully tied, LOCK IT UP! Put Employee X on the SH*& LIST and make him have to ask permission for everything. If or when he learns to follow these rules you can back off a little.

If questioned about the tightened security explain that you have taken steps to minimize a security threat, and will loosen restrictions upon removal of said threat.

You said you're in charge of everything "electron". You said he's a wannabe and messes things up systems-wise obviously.

You cannot lock him up. You need paper trail and we're dealing with "electron". Have you heard of logging? Have you heard of remote computer administration? If you can't do this you're not the real admin. Perhaps, the other guy will be once he gets your administrative privileges.

In this situation I would rather let him do things below the critical line of trespassing corporate policies. How critical is server screen-saver locking anyway?

As I gather, you already had a brush with him and it provoked enmity. Maybe it's not too late to patch things up and make him earn your respect.

I remember during the early 80's when I had an interest in computers (and like your nemesis) knew enough to be dangerous. But NO ONE would bother TRAINING ME for the career that I was obviously interested in!! In fact, it was quite apparent that they were really more interested in keeping me from learning how to do their job simply as "job security". Why not approach your nemesis and ask a few pointed questions, such as:
What do you want to do career-wise?
Do you LIKE working on the network?
Are you INTERESTED in learning how to do it right using proper procedures?

I personally think that it is a good thing to have a PROPERLY trained person at a remote site. Saves travel. Be a mentor.

Regardless of whether the person being discussed should or should not be sacked/supported you are right there is way to much ego flying around here so typical of the tech community. A holier than thou attitude that the rest of humanity is in some way inferior to themselves and therefore should be treated as such. This was something i have witnessed and despised over the years and something i have tried to prevent in my workplace. Wouldn't it be nice if everyone was able to show patience and understanding with those less "knowledgeable" than themselves instead of the automatic and often nasty destruction of ideas and confidence of those deemed "less worthy."

I agree with OZ_Media Completely. AND I am definitely not a newbe when it comes to Administration. I have had my quota of antacid tablets and wannabes. BUT the author and many of the posters IMHO are taking a egostical approch to this whole issue.

Why does it have to be me or him ? You know very well that as far as senor management is concerned, you are not much of a ROI compared to that other guy. So take a deep brath and keep Sr. Management out of this.

If you can't manage this scenario with the admin resources at hand then may be you don't deserve to be a admin. C'mon how much does it take to lock him down ?

But rather than taking such a drastic step, I'd rather talk to him one on one. Have a decent discussion and make him understand the things. If his activities are causing problems that you need to fix then I will make him fix it himself. (Certainly not on my free time. I will make sure I get paid to fix it. ) In my experience, when these guys see the amount of rework they have to do to fix it then mostly they will take care not to cause trouble and get noticed by you. If they are wannabes then they have a pretty goos idea of what you are capable of. Last thing they'd want is to get you mad.

Lastly that bit about rogue Game Servers, which is a real sore point for many of us. Well it seems many take the view that If I don't get to play why should he ? Or how dare he plays when I am working ?

Well I have one piece of advice to those. either join him or forget it. The senior management must be aware of it. They are not blind. If they are turning a blind eye then why don't you ?

So, this is what I think:
Most (maybe not all) "wannabe netadmins" want to improve performance and usability of networks for their company.
When they cause malfunction, it's a lack of internal net security management or educational information, and no reason to try to get rid of them. (See my post some pages down).
Andreas

I remember a time, not so long ago, when a computer geek wouldn't DARE have an attitude. It would great just to be accepted by mainstream society. When I was climbing the corporate ladder I often saw these geeky dudes get hired and they'd sit quietly in these 'computer rooms' and keep my networks operating. They never joined the rest of the crowd for beers after work or even managed to socialize on the most primative levels.

Now we see 'geeks' actually throwing their 80 pounds around and expectnig to be heard, I guess that's what happens when a repressed responsibility is finally aknowledged as useful to the company. Sales reps used to have a similar attitude, as a sales manager I often saw the guys with the over inflated ego thinking they were going to sell your company into the next level of success, only to find out they were human all along.

Well now it's the geeks turn to have an overinflated attitude. My god I just can't escape it, I also manage a couple of bands and run a promotional/management company, belive me when I say, musicians are the biggest bunch of over inflated Prima Donna's on the planet.

It seems our newer admins are right there in line behind the musicians now. What's the world coming to??

THe guy wants his hands in everything but is then said to not want to learn anything? I think not.

It is probably just that he doesn't want The_Admin to teach him anything, I've seen that before more than once.

I know nothing about The_Admin and no nothing about his personality, going simply on what information is provided here and the varbage used in the original post, it doesn't take a brain surgeon to figure out that The_Admin may not be the easiest person to work with or under. Again, this is mere speculation and I don't want to defame the admins achievements but it is a VERY common issue with the "this is MY domain" and I am the great Domain Ruler.

You know the Saturday Night Live sketch with the computer guy who just steps in and rolls his eyes at all the users? Well they got that concept from somewhere, it isn't just fabrication.

ive been on both sides of this scenario before - as a newbie to admin duties years ago to a current admin. my best advice is this. continue to do your job in securing the network. document and file your logs to track any security breach, internal or external, including this one. and don't take it personally if someone wants your job. take that as a compliment and consider mentoring newbies (not necessarily this one).
remember that its your job to provide data security and integrity. if your boss doesn't understand this guy could be a potential problem, give him a "what if" explanation - what if he gained access to sensitive information and leaked it out. im sure your boss wouldn't want that.
ive worked along side a lot of intelligent admins, as well as a lot of ego-driven admins. make sure your ego is in check here too. don't be puffed up with pride and taint your view of this newbie if in fact its just a problem inside yourself. i've always appreciated the apprentice working for me.
K.

Set up a dummy node and have him mess with it and in way when you show it to the boss make it appear that the entire network is corrupt by his actions. This is a simplistic idea that you may want to try. Plain old way just set him up somehow.

It seems to me that if the person has some IT ability, and obviously IT interest, why not encourage cooperation and assistance, rather than alienation and confrontation. Having been on both sides, I've seen IT people that think they know better than anyone else what a person should and should not have access to. If it is not violating company policy (not IT "law"), and it's not hurting anything, what is the big deal? If it is a problem, explaining the reason (not just "ordering from on high") might get better results. I don't think trying to fire a good employee for changing their screen saver is good management.

re:
He refuses to accept this and management refuses to fire him for the things he has done/attempted to do.

If you can't lock him down, and he has admin privledges - he's not just a wannabe. He IS the admin - YOU are the wannabe. Your management team confirms this by tacit approval.

You claim that he does all kinds of bad things to the network, but that you have no way to document it. If you're not capable of DOCUMENTING a network, you're certainly not capable of ADMINISTERING one.

Not quite in the same realm, but we had one guy who constantly jiggered with the thermostats. One night, after he left, we put in a computer-controlled thermostat, locked the keyboard and hid it behind a calendar. After a few days of suddenly non-responsive "working" (we never removed the old thermostat-- partly to see what would happen), he took it upon himself to call a repair service-- a call we quickly quashed once we found out (he did not have the authority to do so). Eventually, we had to get rid of him.

In my company I am labeled the wannabe on many occasions. I am a central office phoneman. I am responsible for the flow of data related to the phone service and the maintenance of that service. Unfortunately my stuff rides across the IT network to get out to the wild wild web.

I think this convergences thing is going to get nasty before it gets better. Whenever a problem arises our management will always side with IT whether or not it affects customer service.

I could tell many stories of me losing control of the phone network and even lost hardware that was purchased under my budget. Imagine losing a $200K system to the IT department because I am just a phoneman. I'm not bitter.

I don't have a great solution. All I can say is once we implemented strict user access policies, 90% of our software issues went away. I used our helpdesk requests statistics to document the increase in IT's efficiency. I made sure management was aware of any IT accomplishments resulting from not having to spend time putting out fires.

...are crazy or want to lose their jobs as network administrators.

Yeah, it would be nice in a "Waltons" kind of way to turn this joker into a friendly "underling", but that is not, and should not be, your primary focus and you should feel absolutely no obligation to.

Based on your description of him, I'd dare say he wouldn't respect that role anyway. I?m telling you this is a classic ?give 'em an inch and they?ll try to take a mile? kinda situation and kinda guy.

Forget all this armchair psycho-analysis mumbo-jumbo some of these crackpot posters have been spouting. Lock down your network as best you can and push management to define clear roles for both you and this annoyance. CYOA, man! CYOA.

What it really all boils down to is your paycheck. You have been given the responsibility to maintain your company?s network infrastructure. Behind basic functionality, security is the most important aspect of what you do. Your compensation is dependant upon how well you do this job. Don?t let this joker take that away from you.

If he has aspirations to become a network admin, let the guy approach learning through proper channels: suck up to you, take a class and get a clue, learn at home on his own P.O.S. network or, better yet, hack someone else's network (maybe the network of one of those ?feel good? network admins that advised you to ?give him more power?).

Quoting:Difference between "wannabe admin" and power user?
"I'm sick of admins who lock down the network so tight that I can't use the PERSONAL computer in a manner that's so crippled that it's impossible for me to perform efficiently."

I simply can't believe that response...ie: PERSONAL computer.
Did the Admin come into your home and lock down your PC? No. It's a WORK computer...not your personal toy to do with as you will.
If you can't work efficiently due to security measures, SPEAK UP! Let it be known what you need to do your job and LISTEN to why it can or cannot be done that way.
I'm not saying your personal experience has been fair as I don't know what it is; the response of a PERSONAL computer is simply ludicrous. It is a piece of company equipment, just like the fax machine and the copier. While many of us abuse the use of these systems (nonwork related issues)
using the computer in this manner is STILL a violation of MOST companies policies.
I've read most of this thread since it started...
The admin is *NOT* being egotistical or arrogant...he has an end user who is doing things NOT RELATED TO HIS JOB FUNCTION that is having a detrimental effect on the network.
So the admin has to fix it, right? So what, it's his job, right?
TO A POINT that is correct, but what do you do when you are always fixing things that one guy is constantly is screwing up. What this user is doing is not allowed, nor is it authorized.
It's already been tried to give him more authority and he abused it...the next step is to see what can be done to lock him down and prevent unauthorized access, etc.
The *BEST* thing to do would be to bring up the companies computer usage policy..hopefully you do have one. If not, it's time to implement one, get with HR and have *ALL* employees sign it.
Once that's in place, full documentation of each infringement leads to disciplinary action, up to and including termination.
There should be no axe to grind towards this guy, but if his actions are taking me away from other, valid projects continuously, I feel a correct remedy is to get rid of the guy.
Breaking rules should get you hammered...if you have a policy in effect, it really helps when you go to HR with your issues.

Management can be shown how your time is being wasted fixing this guys problems....that means they are losing money..and THAT will definitely get something done....

What I did when I was MIS Director of 4 radio stations here in Phoenix was simply use Ghost.
All our systems were the same platform, so I was able to make a Ghost image of needed apps.
Users were told that all necessary files were to be saved on their network drives (set to save there automatically)
If I ever had someone installing anything nonwork related that caused an issue it was a simple matter of Ghosting their machine....problem solved and I didn't need to waste time trying to dig out what they've broken.
Every time this happened would be logged and tracked. Users who were constantly breaking their systems by 'tweaking' their machine would get more and more restrictions. They couldn't gripe about it as our policies and SLA's clearly stated what would happen if this occured.
And I was *very* lenient with software they wanted installed. It *is* a control issue..I wanted to be sure that anything running on MY network wouldn't cause issues I was unaware of.
I say MY network since it was. An IT manager/admin job is to ensure that the network is safe, secure, and running properly at all times. If it broke, it was I that the responsiblity ultimately fell on.
Joe Blow doesn't get in trouble if the servers crash or computers fail....the admin does, even if it is due to someone 'tweaking' something or installing something not approved.

True..it's is the companies network...but it is MY responsiblity to ensure it's working properly.
That includes everything from a Palm pilot hooked up to a PC to the AS400's in the server room.
And no, I'm not one of those IT ogres who wields power because I'm a geek with a salary.
I would have regular meetings with all department heads to determine their future needs so IT could plan for it. I also had an open door policy to *all* users. If they wanted something 'frilly' on their system, I'd get a copy and test it. As long as their direct supervisor had no issues with using/purchasing it and it didn't affect the computers performance or the network it would get loaded *and* supported.
Too many companies have this problem with their IT departments. Everyone is trying to do their job to the best of their ability. Being an IT Nazi doesn't help anyone and just makes your life more of a pain.

Pefectly stated....

I do not know if you can still read this but, I am writing this anyway.

Wannabe admins only do it in 2 ways. Doing it the right way, and, over-doing it. In your case, you are doing it the right way. In the case stated by the_admin, that wannabe is overdoing it.

But the point here is that, the sentiments posted by the_admin is clearly justifiable. That wannabe is just plainly overdoing it. Instead of helping the IT, that golden boy wannabe just became an additional baggage that IT proffesionals can do with out.

The whole point in this discussion has little to do with policies, rights and everything else. It has something to do with job decription and respect onto others. Being an IT works in many ways. Instead of being like the police, why not instead became a friend to everyone, which involves a give and take relationship, or think of something else better. If that wo'nt work, then it is time for an administrative decision on the boss' part.

Years ago the non-IT "boy wonder" of the company was accessing my system after hours (not remotely, but on-site). I let his boss know. His boss told me what a good worker "boy wonder" was and that he even worked 20 hours a day (that I knew because he was staying late and accessing the system). "Boy Wonder" was always curious about what tracking was available - I told him none and then tracked all his activities. His boss did nothing, but I documented that I did report it. After I left the company I found out that "boy wonder" had stolen much electronic company information, actual physical maps and embezelled millions of dollars. They discovered this when he went on vacation back to his homeland and did not return to the US. Although I didn't work there any more, I visited his bosses's boss and told him that I had reported the employee. I got the satisfaction of watching the boss being escorted to the door that very day.

Since I am like every other tech in the trenches I hate that work. I like to be the "fixer" who comes and just makes everything work. BUT I always get 1 or 2 people who think they know networking or computers and want to change things like thier default gateway, then tell everyone else to change it, and off I go to fix 100 people who listen to the village idiot. After doing this week after week, month after month, for the same people, I started relying on a tracking system to do my work with. Enter a ticket, put down the resoution and the people involed. Nothing is better than waking into a managers office with a pound of papers from his one employee, and usually its the one employee that is giving him a problem also.....

You are not bright/skilled enough to lock him out or have a candid conversation with him and his supervisor so you want him fired?

Work on your leadership skills that from the evidence here do not yet exist. You may come across other curious employees. If we fire them all, we will not need the system so much.

Hello, i wont go too far into this, as you probably know way more than I do. I am only a PC tech at a mom and pop pc repair company. I on ly have my A+, and net + certs.

However, i do have a copy of a piece of software that allows a user to boot to CD, and run a program that tells him the admin user names and passwords.

YOu may want to look into the possiblitly of that happening!!

I cannot remember the name of the program off the top of my head, but it does come in handy when a customer drops there computer off to us to fix, then have password protection on it. I can get into their computer w/out them even being bothered by a call from me. Also, its kind of cool to tell them, that i did that. If you need to know the name of the software, email me at zekeallmon@yahoo.com

Hello, i wont go too far into this, as you probably know way more than I do. I am only a PC tech at a mom and pop pc repair company. I on ly have my A+, and net + certs.

However, i do have a copy of a piece of software that allows a user to boot to CD, and run a program that tells him the admin user names and passwords.

YOu may want to look into the possiblitly of that happening!!

I cannot remember the name of the program off the top of my head, but it does come in handy when a customer drops there computer off to us to fix, then have password protection on it. I can get into their computer w/out them even being bothered by a call from me. Also, its kind of cool to tell them, that i did that. If you need to know the name of the software, email me at zekeallmon@yahoo.com

Hi, I found a great program called Spector Pro, that can help you with the papertrail issus.
I have employed it on several occasions to prove that someone is "messing" with things that they are not allowed to.
This program will record screenshots, emails and keystrokes. Ideal to print out and show the Boss if their is any doubts as to what the guy is doing. http://www.spectorsoft.com/
Your Boss needs to understand that you cannot be held resposible for the security risk to your network with this guy messing with the systems.
I'd also get a policy in place very specific as to what a user can and cannot do with your companies equipment. I downloaded one from TechRepublic last year and it has served us very well with the employees.
Hope this helps!

We have a Service Level Commitment as opposed to a Service Level Document due to lack of manpower to meet most time constraints...but, we refer to it whenever our users want to "balk" the system. We have one user in particular who has wanted Admin rights ever since he started because as a remoter user in his previous employment, he was allowed to do his own pc work. We have repeatedly told him for three years now he cannot have admin rights or install software himself, spoken to his supv many times, etc. We simply continue to tell him he cannot install software & that it must come through our helpdesk. Sometimes you cannot ever get the user to understand your policies or reasons for not letting them do the work themselves!

It sounds like 99% of your users play within your policies and rely upon you standard IT solutions.

This fellow is either being tasked to do stuff he is not suitable for or he is acting off his own initiative. The solution is the same.

The pain he is causing is not being felt by his boss in a meaningful way. Once pain can can be quantified ($$$), the message will come through loud and clear.
Account for the time taken to fix the mess he causes and bill his office/cost centre.

His boss will have a choice of using the 'preferred solution' (you), at no charge or paying a premium for using someone else and their 2nd rate solutions that will need to be re-worked anyway.

I am sure that once you add up the costs of you as a resource (a qualified SysAdmin + ad-hoc responses + the opportunity cost of having you diverted from your propper job + the time involved in tracking exactly what this guy is up to) it will far outweigh the cost of a data entry resource, no matter how fast he types.

The remote office can then have the choice of a direct impact on their bottom line.

Money has a funny way of making a manager face up to their responsibilities. If they still persist, at least the IT department is recovering costs.

EM