controlling a wannabe admin

I had a guy that was actively distributing viruses through a game server he set up. Every time we removed it, he set it up again. I documented it and sent it up the food chain. It generated quite a stir and some zealous sounding emails...then nothing. This guy was the pretty boy of the R&D department and could not be fired. He knew that, so he could do literally anything he wanted to. Shortly thereafter the job cuts came through and now I have a job elsewhere.

Short of setting him up for destruction, ala the BOFH, all you can do is lock things down and set your permissions and group policy as best you can.

I would caution you against an information reconnaissance mission. That practice is merely an effect of the problem that could easily consume you and distract you from your core responsibilities. Focus your energy on a solid solution.

Is this person a subordinate, or a peer?

It seems you may require clarity on your titles/roles/responsibilities. Good upper-management should support this and provide to you both. If his duties include IT administration (of any kind), they should be clearly defined and bordered ... as should yours. If personnel conflict arises, or system damage occurs, management should act accordingly. If your organization does not have management of this caliber, perhaps your talent and integrity could be better utilized by another. Best of luck.

I agree whole-heartedly with the advice DC_Guy presented in his post.

And the most imporant rule is "DO NOT TAKE IT PERSONAL". I've been in the admin field for a decade now, I knew next to nothing about admining when I first started -- I was lucky to be taught by someone who really knew their stuff..kind of like I was an apprentice admin. So I have full respect for the knowledge and responsibilities of being an admin today. Also, yep - we just got rid of a "wannabe" type last June. He was his own downfall though, he gradually spent more and more time "trying" to do admin like things (without authorization btw) that he eventually wasn't spending any time do the job he was actually paid to do! lol.

Oh yeah his real job responsibility? Data entry and scanning work orders into a database.

First of all you have said a couple of really bad things for someone in your position, that tells me this has to do with YOU wanting control and having it shared (even if not by choice) is not giong well with you.

You say you want to "CONTROL" a net admin "WANNABE".

This speaks volumes in itself. First, I'd say sit down and realize it's not YOUR company, yuo don't have to CONTROL anybody and every net admin is a WANNABE to another netadmin.

Now this guy doesn't know what je's diong, did you when you first got your knees dirty or were you just as curious as to how things worked?
That WANNABE interest builds some of the best admins around, convince your boss to let you either train him or send him to school. I know many guys who thought they knew it all and caused nothing but problems, but then the users came to me to fix things and it was soon apparent exactly who knew what they were doing. After a while, they would never ask the other guy and would always call me first, knowing from my demonstarted ability that I could resolve their issue without creating further problems.

If I was you, I would take advantage of someone so eager to get into IT. Teach him the simple redundant crap you can't be bothered to do. Actually don't teach him, just send him info and ask him to do thingsm, he will soon be over his head and realize it, at that point he will either back off and let you do the work, or take an interest and come to you with questions.

It is quite a common issue in several offices I have worked with in the past as well as one of my existing customers.

So instead of trying to STOP him, encourage him, once he realizes that you want him to help you work and not just to play around, he'll either be scared off and bee TOO BUSY from no on or he will become a great help.

Do me a favour, come to Canada and try to take over my job duties, you're more than welcome to. If you screw up, my contracts pay me to clean up the mess so you're just feeding me while proving that I know best.

So, do you still think this is just about squashing a "wannabe"?
The password was changed and the account disabled immediately after discovery.

I will think about your advice to write notification letters. I've already suggested something similar to my boss.
However, I already know what my "employer" will think. Although my boss is understands and is furious, the big boss doesn't understand networks/computer security breaches or why it is an issue and may not ever. My boss might be able to get it across to him that we could lose clients if this continued and/or they knew about it, but even then, I don't know that he would do much. So that goes back to my second post about gathering more evidence before anything is taken seriously.
The only thing that would quickly get the attention of the big boss is if his ability to check email is impacted by my "wannabe".
He would probably also pay attention if systems are downed.

But at that point, isn't it too late?
Clients will complain, management will be angry about lost productivity and they will all want to know why it wasn't prevented. It may impact the bottom line, which is unacceptable. So, I have to disagree with letting someone "have at it" just because an upper manager doesn't understand why it is a problem. He didn't understand the need for the server UPS either, but that didn't mean I didn't push to protect my servers from power problems.

I will seriously consider if there is a comfort zone issue here too. Although I do enjoy reading it, I do not want to turn into the BOFH.
My first thought (besides the bottom line/client impact) is that I have recently spent a lot of long hours cleaning up the remote office's network, documenting, upgrading and securing things, etc, etc, etc.
So, I think if there is any comfort zone issue, it has to do with potentially watching hard work be obliterated. For example, documentation becomes obsolete fast enough without someone making unauthorized changes.
I think that the key is to take earlier advice and back off a little, tighten security/auditing further and watch the guy hang himself. If the situation points out security weaknesses and I learn something in the process then that will be even better.

That's my guess

"for a good hack, call "aDmIn@911!!"

I totally agree with Oz. Almost every company has one or more of such person. Even worse, these people are arrogant, has no respect and no responsibility. It's a nightmare when they acquire more knowledge. They turn abusive and pathetically, the upper management thinks they r heroes. Whoever who takes the previous admin work that the person is still in the company, you will know what i meant.

What do you do if you're in my shoes which is you are also facing? Find another job. You will find you days clearing up his mess and you don't have time to advance your career. Of course, if all your attempts failed. It was mostly failed due to upper management decision making.

You can find a lot of programs that can track him down, eg attacker from the server that he tries to intrude to.

Hope this helps.

As frustrating as his behaviour apparently is, any paper trail you create would need to be company wide rather than just for him. Personal 1:1 audits without good reason could be construed as part of a constructive dismissal strategy on your part. Does your company have a Human Resources department? That's a good route.

Good Luck

Hi

I had the same problem last year. The only way we found to successfully deal with the problem was to give the "wannabe" very basic rights (not even installation rights/web access), each day, give him a list of duties, at the end of every day, ensure that they had been done. If anyting else was arried out over and above the prescribed duties (without authorisation), a formal disciplinary was carried out. Eventually (after 3 disciplinaries), we had to fire this guy.

You must get him to sign a "compliance" document, which clearly defines his/her EXACT role, what duties are authorised, what duties ARE NOT. It should be made clear that any unauthorised activities will lead to disciplinary action (you should check with your personnel department, what the disciplnary rules are etc).

Off the record, you should also have a chat with this person and again make it very clear what could happen if his/her actions continue.

Not very nice (I sympathise with you), but, lfe is stressful enough isn't it!!! Good luck.

If you try to fight this guy it will only get worse for you, it sounds like you are getting consumed by it now, keep it simple, give him the rights to what he has to to do his job and that is it, nothing more and nothing less. You have recieved alot of good information in all the posts. I advise that you take the Security + Course you will get alot of insight into what this guy could do to the network if you do not take control now. www.manasi.com this guy is the Windows 2000 God, the best Tech write ever and he has everything you need to know about W2K Good Luck
Michael
Network & Internet Support Specialist, A+
Working on my MCSA for 2003

There are 2 ways to look at this... he's a pain and needs to be got rid of... and the ensuing arguments, legal battles or maybe... just maybe.. use his potential....

I had a similar problem, and instead of locking him out, had him commit to training, examinations (the first he failed thinking it was all easy) and yes, he finally saw what we knew and the effort we went to and the reasons.. and became a useful remote admin tool for me when I needed hands on the console..

Motto"When life hands you a lemon - turn it into lemonade"

Why are tech admins so negative about educating people, its not YOUR network - it belongs to the company.

Some of our collegues write like socialist revolutionaries. In a corporate environment where equity is generated by investor capital and wages and benefits are dependent upon worker productivity, no one has the "right to dabble."

Ever since the advent of the Certification Movement and Tech-TV, the number of pseudo-techs has proliferated to the point that it is becoming akin to an infestation. Nowadays, everyone seems to think they can manage a complex information management system where security, network traffic throughput, and user productivity are issues subordinated to the "wizbang nifties" associated with the clever switches Microsoft has integrated into their operating systems. The result is often a disasterous slide into the undocumented region of ad hoc configurations.

I'd say begin by interviewing all of the people in the organization who have been victimized by this weenie's meddling. Find out how their productivity has been affected. See if you can get the financial people to help you put a dollar sign on this trend and then submit your findings to management in the form of an objective report that states these facts using empirical evidence and scientific observation.

Strategic management usually responds to this approach because it is their job to protect the assets of the organization. If this fellow has violated the company's trust, they won't expose themselves OR the company's potential for too long a time. Be prepared to offer a remedy that takes him out of your sphere of responsibility but allows management to deal with the issue on their own terms. I don't know how serious his interference has been but I wouldn't think dismissal is the most appropriate first response.

Interesting possition your in.

No one person can tell you how to handle the problem, but I can relate a story and tell you the out come.

I installed a system for a company and the "administrator" was called in after the fact. The system became corrupt with in a week. I was called to a meeting and in the meeting the problems were addressed. I challenged the admin to his knowledge and creditials becouse of the communication skills. I then challenge to prove what he stated in the meetting and show all parties how he came to the conclusion.

I still have the contract and last heared he was working at a car repair place.

Sometimes a bad situation can become a good resolve. It's all in how you handle yourself. Don't point a finger, find a solution, and respond with back up data.

Good luck

I have a problem with network admins who want to hold all the keys to kingdom. Users want to have a degree of freedom and I believe they must have a degree of freedom to continue to be of value in the workplace. If you have someone who wants to flaunt "policy," instead of working to get him fired, have a chat with him and give him additional rights.

I have worked in one organization that had everyone on lockdown and I have worked in another that allowed power-users. In the tight organization, users could not install or uninstall any software, could not get to a command prompt, could not customize their desktops, nor could they change their browser homepage or add to their browser favorites. In the loose organization, after achieving power-user status, such users are able to administer their own boxes in line with overall company policy.

Obviously, I prefer the latter.

Every Sys Admin was once in a Junior position where they had to learn. In this case you should accept that somebody is trying to help. You can provide them with a little education so that their work is productive and not generating negative work.
Most importantly: RELEGATE. If this person wants to help, let them do the menial, time consuming tasks. Have them collect some data for reports on a daily basis. Find the boring, tedious things that you can offload and have them do it. If they can learn these things, you can create an ally within the company.

Documentation:
What changes were made that you can confirm in documentation that have caused down time or production interruption.

Frequency of these occurences, has this happened more than once? Documented?

Tracking of the problem user and their activity on the network. Document actions, resources, and time consumed by the problem user performing these unassigned tasks. Documented?

Policies

FIRM policies on proper computer access and usage.
Are these stated in company handbook or agreements that user has been assigned.

Update policies and agreements to include job title, responsibility, and expectations of users.

Included in policies statements should be made to directly address issues on PROPER and APPROVED company computer and network usage.

Also it should be addressed and approved on the ramifications of crossing or ignoring of these policies.

Sometimes you will have to take the fight to management and HR to make sure that these issues are included in employee handbooks and agreements so there is not any misinformation on what is and IS NOT approved company computer and network usage. It would also be very beneficial to provide management with documentation and statistics on what causes the most damage to company networks and data, internal threats and lack security.

That being stated there is a lot that still weighs on the management that you have in place. If they are lackadaisical as to the issue of network security and data integrity, go ahead and update your resume, because in today's environment they will not be in business for long.

What exactly do you want to stop him from messing with? It looks like you got the right to install software restricted and a lock on the servers.

Let me know what it is you want to deny him?

Is this guy being held back by overly restrictive policies, especially at a remote site. I was at a remote site and we had a sys admin at the main office. He locked everything down so we could barely see our own files let alone work as a group. He was also very unresponsive to our requests for help. We finally had to have management force him to give admin privilages to someone on site just so we would not loose days of work waiting for him to change a file's permissions so we could work.

Take some time to learn why he wants to be an admin. Maybe there is a good reason.

Assuming you have an ITIL based change management process, all changes must be be made via the defined change process.

Therefore if "the _admin" wants to make a change he must submit a request for change, it will be reviewed logged approved or rejected as approprate.

If he make a change without following the defined process he has commited an act of Gross missconduct, and he gets fired.

This assumes you have a change management process, and "the_admin" is not your CIO.

I agree with several concepts discussed here with a few exceptions. I'm not a firm believer in locking down desktops and have found that countless hours have been spent discussing the merits of "controlling the user" vs. controlling the user's environment. The power user or wannabe will always find a way around the locked down desktop and the productive user will not try. You design a client configuration in order to optimize the employee's effectiveness and call it a "build." If the employee messes with the "build" in such a way that they are no longer productive then you reinstall the baseline (deleting any additions by the way) and log the time it took you for that user.
In your status report you attibute the excess time to that user and ask your boss to copy the radical's superior. Your job is to keep the department running. If your boss and the wannabe's boss think that your time is best spent supporting this one individual then document it and don't worry about it. Make sure their actions are visible and the wannabe will be hoist by their own petard. Also ensure the common systems are locked out so this individual cannot do harm to any other "productive" employee. My guess is that after the third time you reload their machine they will be gone and you will have done your job without conflict.

We dont know the level of skill this wannabe has but maybe he has not seen the admin password written down.
He works at the remote office, if he has unrestricted physical access to the system, knowledge of how use, and a copy of, NTFS DOS he could simply be extracting the SAM file and decrypting it off-site. Is he this smart?
Finding the source of his passwords is the key to starting to keep this hacker out.

Dear Admin:

Its hard to find someone with a drive like this guy has ... you've done your job in locking down the network and protecting the servers. Now go to management and get him on some training courser. Take him with you to conferences. Place ADMIN training requirements on his plate. He'll either step up to the plate, or leave the table.

In any case, if he "wants" to be an admin, take advantage of the fire that burns within him ... direct it, refine it, and benefit from it.

Obiwan (just kidding)
Seriously, he could be a good asset to have at "that end" of the spectrum. People are your most valuable asset. He needs to realize what you've had to go through to get to where you are today. If he is "really" interested in what you do, place it on his plate ... as a "requirement" for continued employment. Force him to learn so he becomes an asset and not a liability.

You be the mentor ... the teacher, if you will, and help him grow.

Gool luck!

-rich-
Rich Allcorn
Computer Consultant

(I was once a "wannabe" too!)

In reading through some of the responces I see that it appears upper and middle management dont see the problem with the unauthorized access through the admin accounts. It could be time to do some homework on the effects of hackers on company infrastructures and present it to them in a way that they may understand. Maybe they should add to the job discription of a network/security admin, educator as well. Sometimes education has to begin at the top. Show them in a well put together report how hackers both interneal and external have affected other companies, the dammage done, downtime logged, etc. Much of this information is available if you look for it.
Then set up a packet sniffer on the network to document traffic if you have to.
If all else fails you might have to think like a hacker. Get into this guys head if you have to, to figure out what makes him tick. Set up a dummy admin account and let him have at it, make the settings to record all actions taken or apparrently taken through that account and keep it all on the QT and record all the logs to both file and hard copy.
Sometimes to stop a hacker you have to think like a hacker.

If your approach to Mngt was anything like the title of your article than maybe that was your problem. I wouldnt listen either if you called one of my employees a newbie because it sounds personal. Calling someone with data enty expierience a "net admin" is another problem because data entry and administration are completely differnt things that in no way need to overlap generaly speaking. If the guy doesnt know what hes doing then why was he hired anyway?
Calling someone with less expierince than you a "newbie" is pretty stupid in my opinion because I have no doubt you were probably a stupid newbie who couldnt leave well enough alone also at some point. It Seems to be how the most expierinced admins develop there skills but it goes without saying they shouldnt learn these skills on a company network. While management may be to blame for the hiring and lack of firing this person I see a opportunity for you as the admin to "shine" by proving the irresponsible nature of this employee and how his actions could compromise the entire company.

Dear Admin,
I sympathize with your siuation, BUT as you rightly put it, management refuses to let him/her go. My advice, try and find out WHY - if the person has family ties upwards in the company, here's your answer.
But I would certainly make a record of each and every unauthorized change attempt, BUT also keep it to myself... I might choose to let my manager know, at a suitable occasion, that you are doing your job well, as part of which is to log any unauthorized change attempts. This should certainly be part of your job, and it would neatly empower you to deal with any problems caused by this other person. Documetation counts - that's my experience.

Hope it works - all the best, Henning C. Denmark

Others identified some good paths.

Present your business case to your manager and request a meeting with the manager of the individual creating the problem. Perhaps you have not found the root problem. I see 24/7 repeatedly, and over time this leads toward a perceptual blending of personal and work life. It is said that this blending is not good even for an owner of a business. I assume you want to depersonalize and resolve the issue, thus remove the stress this creates. Put the responsibility back where it belongs. Right back into your management?s lap.

Communication is the first step. Communicate IT best practices in context of their daily business operations. Do take the time to explain to non-IT managers that IT is like their business operations, we try to become as efficient as possible given the time and financial constraints we operate within. Standards help keep their systems up and running smoothly. Relate the problems that you are sure were caused by non-IT personnel actions to time and cost. Demonstrate the wider impact of the problem, show them how this affected the other departments. It is a quality issue as well. You can focus time on fires or assisting managers move ahead on their future objectives. If they fail to understand your point, identify the problems you would create by hiring someone to perform non-IT functions in their department without their knowledge or understanding.

Back to 24/7, it would appear that technical resources are short at times. This could be interpreted as the need to hire qualified full or part-time personnel. Unspoken and assumed are the end-users and their management?s tolerance or promotion of the novice?s activities. Provided that a computing use policy is accepted and understood, this detrimental practice is allowed to continue out of ignorance or perceived as a need for immediate on-site response. For the practice to continue, either management is unaware of the problem, or perceives some benefit by allowing it to continue. Ask them questions that help you understand the best way to proceed. Educate them by identifying both the risks and benefits.

As far as really wanting to get this person fired, stop that, you have enough on your shoulders. Check your emotions at the door before any discussion. Do what Network Administrators do best, operate based on the facts. The root cause of your problem is not directly that offending person. It is your job to determine where the root cause responsibility resides and address your efforts to your manager, and that person?s manager and supervisor. Let them do their job of removing this barrier to your productivity, their profitability, and lastly your job satisfaction. The network is the thread that touches every part of the organization, your are in a unique position to educate them on the wider impact.

Good luck!

You are the official Network Administrator, correct? You have a staff of how many? Perhaps you should appeal to your boss, that it might be interesting to use this person as a junior network guy with several strings attached.

First, they come to the main site and learn how the company wants things done. Your boss grades his work, not you. So that if he doesn't do things correctly, you are not critized for nitpicking the guy.

And if he does learn to do the job properly, and works out at the main site, then with a year of real network experience, he would be the fellow to send out to clean up other wanabes.

If it works, you get a trained worker. If it doesn't, he gets to be unemployed like the rest of us AND you get the credit for finding a potential network leak.

Or you can be a controller and off the guy. The result will be how management perceives you.

In my opinion if ?the wanna be" has not been reprimanded in this situation then I?ll have to assume he?s more important to corporate then the network itself. I had a similar problem at work. After numerous written warnings nothing was done about my ?wanna be? until he brought the whole network down. To add to frustration your ?wanna be? is in a branch office which makes it more difficult to control.
We all have understand ?IT?( other then R&D) is considered by most corporations as pure overhead.
In other words we are not part of the corporate structure that actually earns the money!!!!!!!!!
Be careful of your actions towards this person. It?s very plausible that one day he may be in a position to harass/fire you.

Corporate America considers us as technicians??a necessary evil for a new type of communications system?. To them we are the ?AV/TV repairmen of the 21st century?.
When economies get bad we are the first to get going??That?s right?get going right out the front door with a pink slip.

I don?t care what title they give you? 99% of us don?t actually run our departments.
We all answer to man hating Ms. Synergy. Our boss, the one with the business degree from a lame local community college. The one who is 100lbs overweight and chokes us with bad perfume and cigarette breath.

GUYS/GIRLS LETS STOP KIDDING OURSELVES??..WE NEED A UNION

www.techsunite.org

As for the ?wanna be? you should tactically leak the admin password for the branch to him and let him hang himself ?

An internal breach of security is serious - even if your boss's boss doesn't think so.

Personally, I wouldn't even name names. I would simply announce to those that I'm accountable that there has been an internal security breach and begin to tighten up security. This might mean that I disable the Administrator account and use my user name with Admin privileges only. If there is one other person who has Administrative privileges, you can safely suspect that they are the source of the password. I would give them a separate user name and password stressing that it is for their use only and turn on logging for all user logins so I can the activity on that account.

Now, your "wanna-be" doesn't have access...but if he is able to break back in using one of your two user names with Admin privileges, you have more information as to how he's getting the password.

If my backup Admin was giving away their password, I would force frequent changes and reduce his privileges drastically. If he isn't giving it away, his workstation may have been compromised and you should look closely for key loggers and other tools that might be the give away.

Last, lock down your "wanna-be" to the nth degree. Flex your muscle a little and show him that you are the Admin. He can't complain that you've taken away privileges he isn't supposed to have.

Just keep saying that there was "an internal breach of security" that concerns you deeply and ask your users for patience and understanding as you expire passwords more often and require more complex passwords, etc. Security is very serious and you would be remiss to let this issue pass.

The point is that you should be tightening security accross the board and not appear to be picking on him. Other users may be budding "wanna-bes" too and you should nip that in the bud.

If you have already established what policies are for IT staff and if your ?wannabee? is not following those guidelines AND if management does not wish to do anything about it, I certainly sympathize with you too. There are a number of reasons that management may not wish to intercede ? as some have stated, it may be due to the way you presented this problem ? but I have no way of knowing that for sure. Or there may be some internal political issue that makes management reluctant to discipline this employee. And unfortunately sometimes management is just afraid or disinterested in getting involved until after some disaster has occurred. This could be a good opportunity to help educate your management team about the implications of your company?s information and systems.
In any case, I agree with chenning that once you?ve presented the situation to management, and they?ve showed no interest - there?s not a lot left you can do and that your job now then would be to document any information that shows how this loose canon can potentially hurt the company ? financially, security-wise, legally etc. Provide that information to management and KEEP that documentation!
But you can?t make management do something they don?t wish to do (however unfortunate it is that they?ve turned a blind eye to the situation). At least by documenting and keeping management informed you?ve got a track record available to illustrate how you tried to remedy the situation if something catastrophic DOES occur. (Yes this is a ?covering your butt? task ? but if management is not responsive to you NOW ? they may turn around and blame you if things go south.)
But there are also some questions that might be looked at prior to the situation getting to this point:
Have you really (unemotionally) spoken with this employee and have let him know that this is a problem for the company? Have you (as others have suggested) gone out of your way to remove any ?personal? component from these interactions? What kind of team-based meetings does your IT Department regularly have with all staff involved? What kinds of policy and responsibility issues are raised at these meetings? If YOU are a team player ? you?re doing all you can do. Continue to document everything, keep your management informed, and then take a deep breath and keep trying to be the most ethical and responsible person YOU can be. That?s all any of us can do!
GOOD LUCK!

...LOL just kidding. It should be in some kind of hall of fame (as far as I am concerned).

I am not an admin... but by just reading the first 20 odd posts... I have gained so much respect for what the admins do, office Politics (maybe somebody should make OfficeSpace vX.x.x movie), Ego issues, career, how to create paper trails..... man it is just awesome...

I will keep reading and keep learning from you guys.

BTW, good luck the_admin!!! Your sense of duty amazes me... i like the point where you gave an analogy of pushing the UPS on the servers.... you are a good guy.

OK, so I read the article and some of the responses. I was left with more questions than answers, most of which I will not bore you with. But one really big one stands out: what kind of rinky-dink little IT operation are you running, anyway? Congrats on finally migrating to a 4-plus-year-old OS. Way to have servers accessible so they can be tinkered with by staff. I'm so sure you let him get ahold of an important password. Nice department where all problems come to you personally, are you ever allowed to sleep or take vacations?

Obviously I don't know what the real situation is. But I've been around the block enough times to suspect that the following conditions pertain:

1. You're probably the lone IT support person in a small company.

2. The management doesn't understand computers but can't live without them.

3. Any "policies" that exist about desktops and software were written by you and you have no real recourse when they are ignored.

4. Other people in the company, particularly your rogue pseudo-netadmin, have more pull with upper management than you do, and the likelihood of their violating your "policy" causing them personal harm is approximately zero.

If most of the above points are true, you have little choice other than to co-opt this person and turn him into your tool. You know you can't get rid of him and it wouldn't surprise me to find that, if it came down to "him vs. you", you'd be packing up your desk. So learn to deal with it.

Most requests of this nature are caused by the apparent unresponsiveness of the System Administrators. By formalizing the process you may be able to reduce the cross-organization sniping while at the same time increasing the awareness of your role.
It's highly unlikely that the financial / accounting people would react positively when they encountered a request for some kind of supplemental funding for "Additional SysAdmin Support for J. Blow's Department", especially after the reasoning behind the request is laid out.
A request outlining the potential cost and security risks should be crafted. It should show that it is being originated by J. Blow, and that he has secured the appropriate departmental authorizations.
In most cases, the J. Blow you are dealing with will not have the desire to proceed with the request.
If your J. Blow does manage to get it through his chain of command you should still be able to express your disapproval when it arrives in your department.
The overall goal is to improve: you may simply end up educating J. Blow about unseen perils, or you may become more responsive to users. In either case, it should result in better communication.

I went through admin hell with a new office manager. Spent the first four months being micro-managed by her. Had to explain and justify everything I did in detail. Spent the next four months looking over my shoulder while the management committee made a decision about getting rid of me. (I found out by accident that they thought they could manage without an Admin) She told it was coming from management, later I found out it she was the instigator.
I simply stayed focused on the job of securing data and keeping everything working. I made sure that I documented everything. She was finally fired for pissing off the wrong Attorney in our firm. Knowing I am not real good at office politics, simply concentrating on the primary job worked well in this instance.

One thing everyone is overlooking is the setting.

All of us were "wannabe admins" at some point in our lives. Everyone had an abundance of desire, limited knowledge, and no experience.

But, what did we, the now educated do. We purchased scrap equipment and software, went home and practiced. We blew up our systems, we gave ourselves viruses, we took down our switches.

Image if you took a web dev team and gave them only a live server, no development server. Every thing they tested was live, every change effecting all users ... There is no way anyone would do such a thing.

Same here!

If this person wants to learn/develop, do it at home on your time. NOT ON MY PRODUCTION NETWORK OR SYSTEMS!!!

First, it is not the job of IT to fire users. That is for management to decide.

To manage rogue users requires a little more work.

I recommend:

1. Enable full logging on the user?s system

2. Log all user activity on the servers

3. Restrict user admin level access on workstations

4 If you do not have a formal security policy, implement one immediately

5. Once a policy is in place (management approved), release the document to all users via email and hard copy

6. Generate an email with portions of the log files and send it to the user with copy to management, reminding them of the policy

7. If abuse continues, repeat this process until management either says to let it go, or takes action on the user

Some users are considered valuable and thereby given special privileges. In some cases they are protected to the point that an adversarial IT person could be soon unemployed.

Your best defense is a solid one with a non aggressive approach. Gather facts, report the facts and keep all emotion out of it. Do not make it personal! Remember, it is not a matter of "how do I get this person fired", but rather "how do I get this person to stop violating the corporate security policy".

Regards,

Danny H. Cox

hi,

we have a server nt 2000 and we forgot the password, how can i have access to the server to change the password?

thanks

When assigning your rights (ESPECIALLY as ADMIN) it is a BAD practice to use the Wqual to: feature.

The worst is creating an "equal to:' admin account.

If th eadmin account is damaged and unrecoverable, you have no way of logging in unless the object is available. You will be shut out of your own domain. Someone told me a long time ago to ALWAYA create seperate folder access rights and NEVER use the equal to feature. I did it anyway. Then for some ODD reason my admin account was damaged one day and I couldn't access the server because I was equal to admin an there was no object to compare my own rights to. It took three solid days of copy and pastnig a gazillion files from one server to another to recreate the account without starting over.

So now I will also warn anyone who does this "
!!!NEVER!!!! USE 'EQUAL TO:' for assigning rights. It is a bad mistake and a very lazy one at that.

If you feel this strongly about this you are going to have to do some work to stop the problem.
The strongest way to get managements attention to terminate the problem is to show the intruder as a security threat.

Its going to boil down to how much time "you" are willing to put in to the problem. Take advantage of this problem and use it as a learning expirence to strengthen your skills and your networks security.

Review your networks security policies, make sure it covers this type of activities and have the target sign a policy statement that they have read and understand the policy and what will happen if they violate this policy. This should be standard practice anyway. This may scare him off it may not but you will have it in writing that they are in violation of company security policies.

Log his work stations activities.

Mirror his hard drive so you can examine it at your leasure for any unauthorized material he may have pilvered from the company, any unathorized software he may have added to assist in his activities, such as loggers, password crackers, etc. The courts have said this is fair game since its company property and a security issue.

Lock down his work station to only what he needs to preform his duties and log his violation and attempts to circumvent security, etc...

There are a ton of ways to build your case; Its up to you as to how far you are willing to go with this.
Don't let yourself get carried away with it either in that you begin to neglect your regular duties.
Use this as a learning expirence. Examine the problem and build a network profile to find your network weaknesses and correct them. It will only make you better at your job in the long run.

It sounds like you haven't gotten the support that you need for this issue from above, so my response assumes the perspective that you might have to establish (manipulate) an environment where this guy can hang himself, while riding out the duration by continuing to protect your realm of responsibility.

I've become somewhat of an operations guy and moved out of the IT-specific arena but a few things are constant no matter what we're talking about:

Every second this guy is spending on your turf, he's NOT doing his own job. IT funding comes from the stakeholders - the business units - so, surely, that's got to translate into being a bottom-line budget consideration for the productivity of your (& his) unit. I'm sure you can think of many ways to approach the issues of "success" and "productivity" initiatives (even by just planting a spark that makes your boss think they're his idea), that will have to uncover:

(1) Why does this guy have time to play with someone else's toys?
(2) How is he held accountable for the time he spends on his own work? It must not be sufficient.
(3) Where is the failure in our security procedure, if the world's security 'best practices' state that the greatest risk management issue involved in security are within the operations of the company, not in the way it protects its outer shell.
- Who's responsible for security?
- Does you company have a Computer Use policy?
and, more specifically,
- Does you company have an IT Staff-specific
Systems Use policy?
(Published complete with the repercussions for specific actions?

You can't (or shouldn't) waste time on all the dweebs that can hinder your operation. Your job is to create an environment where they can't matter. Ya might as well score some points while you do it.

I appreciate the straightforward approach. At some point determine how the want-to-be is still beneficial to the company. Weight the training alternatives (cost) and figure a payback (first years cost /first years savings) in years. Now figure the losses in time (avg) you all spend thwarting the want-to-be. These 2 figures will give you a baseline. The person has drive and ambition but no discipline.

So maybe I will present you with the best points of the most highlighted reasonable ideas thus far.

We will use a 2 stage using an existing idea of training and testing for certification. The first stage must present a small project (user rights, print admin etc.) to the want-to-be and the existing network staff approved by at least one principle. Do not let the want-to-be know that someone else is working on the small project, whom maybe given to an intern or sysadmin in training. Reason for this is never depend on just one person for an important job to be done. The point being "Is there any reasonable common sense of the what-to-be has regarding good decisions. Asking the want-to-be the question "Do you really think that we would risk our very business and jobs so you can try and learn computers on company time?" .Then ash the want-to-be "If you were the business owner, would you risk your business and job so you could train some want-to-be with your computer system?

Second stage is a summation and debriefing to the want-to-be and the concerned staff. You have lots of options here. Just remember how happen stance networking all was when we started and we will all be better off if the want-to-be is lemonade.

If you have to develop a paper trail of violations to "prove to the boss", something's wrong with the boss and no "proof" is going to solve the problem. Sit down with the boss and have a heart-to-heart talk about what the boss expects to be accomplished through network admin and WHO IS RESPONSIBLE. A reasonable person should understand that the people assigned to the jobs are the ones who must be responsible.

Be nice. The boss probably has some political problems limiting resolution of the problem. Plan to solve the problem together. Without this commitment, you're doomed.

Hello and Good Day. I happen to be also a wannabe and currentlt unemployed. But I do not accept or apply to a position which I can't do much. I am more exposed on the computer system as a freelance computer technician but not as a netword admin or a system admin.

In view of the issues concerned, he should know that it is not under his job description to fix systems or network. He may give comments but not touch the system or network at all.

As an advise, try telling him that he should wait for the IT staffs to do the job and not argue with him. Try convincing him that it would be better if the staffs of the IT department does the things. If your company has an employee relations staff or officer, try asking for an advise about the scenario. Maybe they could help with the paper works you wanted to prove to the boss. Supported with the IT department, meaning the IT department should investigate the damages done to the system.

If he the case is that he is violating the corporate policies. Then it is unprofessional and unethical of him to do such a thing.

Hi, my name is Andreas.
And I?m a ?wannabe? netadmin in my company.
Why?
At first, a few words relaying the company I work for.
It?s a company in media industry, and Europe?s biggest.
It has about 45.000 employees in 40 countries all over the world.
It has a unique, compatible network structure all over the world with at least 50.000 computers and servers (estimated), all reachable on my computer?s mouseclick.
This company has a few hundreds network admins all over the world, and a bunch of them in our local place in Germany.
Policy is (understandable for me) very strict, when rights-management is concerned.
In my second job, I?m (beside other functions) a network admin for a couple of small, local companies.
What made me really angry sometimes:
Rights management can be so strict, that I thought, I have to call the local admin to have the toilet door get open.
What was/is my strategy?
Do become useful for the admins.
It started with local admin rights on my own workstation and others around me.
Now I have the rights to at least read and write on a few Unix Servers in my direct environment and to combine data for some very useful queries.
So this is my advice:
Lookout for some wannabe netadmins, there might be some very helpful persons among them. Avoid ignorance and help them to understand the network infrastructure and their security policies.
Not all ?just data input idiots? are too dumb to understand your job!!
Andreas

Hi Admin,

I used to manage 30 people in the IT department in a bank/stock broker in Mexico.

I need more info about your problem,

Is this wanna be in your department?
If yes then his boss is at your level? higer? lower?
If no then why he can have somo access to the network infra? How you manage the security issue?

If you can give me this answers we can discuss furthermore abou it, and I'll be glad to help you in the way I can.

Arturo