IT Employment

Tony's advice seems like a good approach to living with such a situation.

This sort of thing has to be taken up with management. If the appropriate people approve then there isn't any legitimate recourse. Try to keep your focus on the best interest of the business, which means, as Tony said, cooperating with the person in configuring the equipment.

My other observation is that system administrators are, by the nature of their job, in a position to see all business confidential documentation. The business management typically takes the position that the system administrator has got to be trustworthy. I question the legitimacy of the ws user's claim that the documents on the ws are too sensitive to be accessible to the system administrator. The only situation where this might be a legitimate claim is if there are classified military documents on the machine and if you do not have a clearance sufficient to access them.

My first thought, however, is that the ws user is either running a separate business and keeping documentation for that on the ws or they are keeping pornography on the ws.

Lines were drawn, responsibilities established, end of conflict.
That's what's got to happen here as well, the current situation is untenable.
I could possibly have lived with being locked out of the data as an admin and provided backup facilities, the virus thing though, I don't understand how that can happen. Well actually I do, but he wouldn't be doing it inside my network.

I seriously think about monitoring what this guy is accessing after all threat and security investigation is definitely an admins responsibility

If he places your network at risk (be it security or viruses), threaten to remove him unless he cleans his machine and can prove it, as stated in the previous post, it's not your responsability for the welfare of his files if he does not utilize the servers that are backed up but it's your responsability if he places your network at risk.

Yes, he has Admin rights because he is one of those users that likes to install whatever he wants.
I'd be in trouble if I tried to limit his actions.

The problem is that with that freedom, he degrades the OS very often.I agree that a net admin must be a trustworthy person and I don't fit in that level for this unruly user.


Ernest

I would have a discussion with the manager if he is holding HIPAA or SOX related data on that workstation.

And I would find out what the policy is on acceptable usage. As soon as he violates it, record the incident, follow the procedure (usually it is notifying IT management and HR and legal that an acceptable usage violation has occured and to protect company assets you are deactivating his network user and machine account. Then turn off his network port.)

If they are not willing to deal with the issue, notify your boss that all issues concerning this workstation will no longer be handled by you, since you cannot effectively administer the workstation. This means that management will be solely responsible for all legal ramifications of the loss of HIPAA or SOX data, inadvertant release of client data, etc.

Then when bozo user gets a virus or corrupts his system and needs help, point him to your boss and politely say, "I am sorry. I do not manage your workstation. You will need to discuss that issue with my manager."

Usually taking a hard line on the issue is the ONLY way to deal with these political games that happen in some offices. If you state clearly that you refuse to play them and management has to deal with it, the games usually quickly go away.

I have been in a similar situation and the only way to handle it (in my not so humble opinion) is to:

1. Inform management and make sure that they are aware of the possible ramifications of letting this "loose cannon" have his way. Put the information in writing. Maybe even have a manager sign-off giving this user the right to be an "exception".

2. Document EVERYTHING! He has a virus; document it. He refuses you access to his WS; document it. Track his network/Internet usage; document it. It can save your hide in the end-run.

up. Does matter how much control he needs on his PC, or how secret the data is, wall him off from your network. If they won't pay for a hardware solution proxy the bleeder off a pc you do control, no way he can argue with that. As far as back up goes all he needs to do is take a copy encrypt it (RAR/Winzip with a password would probably convince this amateur) and then park it on your server for daily back up.

Set it all up looking extremely sullen as though he'd got one over on a mere pleb like you.

Then monitor the clown's traffic. I'm almost positive he'll give you a whole load of opportunities to **** him right out of the airlock.