Best practice for Network password management

In my organisation, only HR knows the passwords. It is forbidden under Company Policy to tell someone your password (if you do, it *has* to be changed).

As you can imagine it makes things really awkward when support is needed (why is it when someone calls me to say there is a problem, the minute I arrive they disappear for a smoke?). I then have to hang around until they return for their password. It also means that if I work outside normal hours (usually Saturday's) on the PCs I'm restricted as I need the user there to type in their password. Some of the time I can get round it by logging on as Administrator, but on occasion I do need to log on as the user.

Plus, HR flat-out refuses to allow me to implement a system where users passwords change on a regular basis because it would make her job "more difficult". I fear there is a control issue in my HR.

I don't want this to be seen as a rant against HR, but I think some people get "high" on control.

I don't want to come off as ranting in response to your first-ever post here, but you're violating the very first, most basic principle of IT security, the privacy of passwords. HR is completely correct, and the policies they are advocating are standard IT practices. Not only should IT not have any users' passwords, neither should an employee's supervisor, co-workers, or anyone else for any reason.

If you know a user's password, you leave yourself vulnerable to charges that you used that account to alter data, send falsely attributed e-mail, etc. You have no proof that you didn't log on as a supervisor, send an e-mail to HR raising your buddy's pay, log on as HR user and respond to the mail by raise his pay, and get a kickback. You have no proof you didn't log on as head of research and forward new product plans to the competition. All anyone has to do is fake a call for service, wait until you log with their password and finish the call, then immediately send an e-mail to the boss telling him ingest feces and cease respiration. "Oh, Jim-Bob was working on my computer at that time. He has my password, he must have sent it." What if that user has the same password for his web mail, ATM, or credit card? If a member of the IT staff gets fired, what's to keep them from sneaking back in and logging on as a user to destroy data? The examples are literally endless.

For these same reasons, there is no excuse for HR to have user passwords, unlike pysces83's company above. If the HR manager to take a dislike to someone, he could log on as that person and start deleting or altering data. All the logs are going to show the account name that entered the transactions, not the person actually using that account.

In short, your @$$ is hanging out in the wind. It doesn't matter how many employees, computers, company annual income, whatever. If I worked where IT or HR had my passwords, I'd be getting my resume together. If I had an IT employee who required users to give him their passwords, I'd fire him.

There is no reason for an IT professional to need user passwords to do his / her job. You should be able to work on a user's computer with an administrative account. This account should be separate from the account you use on a daily basis for your own e-mail, file access, etc. If you absolutely must be logged on as the user to solve a problem and absolutely cannot wait until the user returns, ask the supervisor AND HR to request you change the user's password. This should be in a documented format and require the user to change the password on his / her return.

Edited to blatantly bump this back up the list one last time. tommy needs to hear this from others than jd and I.

To echo Palmetto's words. There is no valid reason for anyone (CEO, HR, IT, etc) to have the user's password. If on the very rare occassion that work cannot be completed from an administrators logon (or through remote tools/scripts), and the user is not available, then it "could" be acceptable for IT to change the password, conduct the work and leave a note to the user. The user then needs to call IT have the password reset to a simple password and be required to change it upon logon. Security for the company extends to protecting the users too.