FHC Logins/Usernames and passwords, administrator access

[schester]

Good morning all,

I was recently called as STS and have been lurking here for some time.

When I was called I was given a list of the logins to the computers, but when I went to do some support on the FHC computers, I found that information wasn't accurate. Each computer was different and took some time to figure out the right combination. Most of the computers had additional accounts created with administrative access such as Admin, Admin2, Administrator5 and so on.

Since there was no way anyone could keep up with that, I changed it to the standard password that I was given and removed the extra accounts.

The next day I got a call and email that they could no longer access the administrative account. I never knew they needed it, and am waiting to hear back about why they need the administrative access in the first place.

Are there any church wide procedures that need to be followed here or should I go with the direction from the stake presidency as to who should have access to an administrative account? I do support computers for a living, so I have my own feelings, but I don't want to make a call on this without understanding what is common procedure.

Who do you share your admin logins with? FHC Director?
Do you create separate accounts?

Thanks,

Scott.

[aebrown]

Are there any church wide procedures that need to be followed here or should I go with the direction from the stake presidency as to who should have access to an administrative account? I do support computers for a living, so I have my own feelings, but I don't want to make a call on this without understanding what is common procedure.

Who do you share your admin logins with? FHC Director?
Do you create separate accounts?

The policy is at Policy and Guidelines for Computers in Family History Centers. If you look at the role of the STS in that document, you'll see that he is to take direction from the stake presidency, coordinate with the FHC director, and maintain a list of user names and passwords for all computers.

When you receive a computer from the Family History Department (or at least the last time I did, which was a couple of years ago), the computer is set up with two accounts: An administrator account called "Administrator" and a user account called "Patron". I don't know of any specific policy that would say precisely how this is to be done, beyond the implied suggestion from those default accounts.

In our FHC, we have used just these two accounts with no problems. The FHC director can do everything he needs to logged in as Patron. If he needed to have administrator access, I'd certainly give it to him (probably by creating a new separate administrator account), but it hasn't been necessary. If you stay on top of installing required software, I don't see how anyone else would need administrator access. Particularly with FHC computers, I think it is wise to keep administrator access tightly controlled.

The stake president has a copy of all our administrator user names and passwords (in case I somehow become incapacitated). Ultimately, these issues are his call, but he relies heavily on my recommendations in these areas.

[russellhltn]

It would be one thing if the Director had the Admin logins, but I sure wouldn't want the staff to have that. It would be interesting to hear why they think they need that.

In our stake, I've knocked the "Patron" login down from the default "Power User" to just "User". It took some tweaking, but it works. I have very few issues with the computers.

One problem you may run into is that some programs only install the icons for the user that installed them. So it's possible the Patron login doesn't display all the programs they use.

[KenRichins]

I have installed DeepFreeze and deleted the Patron account and set autologon with the admin account AFTER the computer has been frozen that way they can do anything the think is important and when the computer re-boots everything is back to the original set-up. They can not amke any changes to the computers. The computers log off each night at 9PM un-freeze with a locked keyboard do updates then reboot frozen again and reday for the next day. Once a month I go into the center and verify everything is properlly updated and up to policy then Freeze them again. Very easy and have NEVER had any can schedual my vists to meet my time frame. VERY EASY! and it's all provided by the FamilyHistory Department from LANDESK!

[aebrown]

I have installed DeepFreeze and deleted the Patron account and set autologon with the admin account AFTER the computer has been frozen that way they can do anything the think is important and when the computer re-boots everything is back to the original set-up.

DeepFreeze is great for guaranteeing a reliable configuration. But it seems somewhat cruel to give people administrator permissions so that they can install software or make other changes, only to find out the next day that their efforts were in vain. And what about the patrons who come later in the day after someone used the administrator access to foul up the computer?

It seems to make more sense to have people use a user-level account so that they are not misled about what they can do. Then still use DeepFreeze to restore the configuration. But if the system you have in place works for your FHC, then that's great.

[Aczlan]

It seems to make more sense to have people use a user-level account so that they are not misled about what they can do. Then still use DeepFreeze to restore the configuration. But if the system you have in place works for your FHC, then that's great.

I agree. That is what we do at work (whole bunch of public access computers in public libraries), but we also use the Deep Freeze Console in each library to freeze/thaw the computers.

Aaron Z

[jdlessley]

As a former STS I counseled with the stake president and the FHC Director. Since our FHC Director was not a computer geek or even computer savy, I and the FHC computer specialist were the only ones to use the administrator passwords. The FHC Director had the administrator password but saw no reason to use it. No FHC workers had the administrator password.

When I was first called as the STS every FHC worker had access to the password and there was a big problem maintaining continuity and standardization of the computer configurations. The computers were standardized and then DeepFreeze was installed. The FHC workers were instructed that patrons could do as they pleased with the computer configurations to meet their personal computing needs and preferences. But when a configuration was changed, all that was necessary was to reboot the computer and it would be back to the standardized configuration.

All requests for changes to the computers were first passed to the FHC who then discussed the change request with me. Only when we both agreed to the request did I or the FHC computer specialist make the change to all computers. Once the FHC workers knew the standards, how DeepFreeze worked, and the procedure to get a change made to a computer configuration there was little problem. Elderly patrons with vision difficulties could change the resolution, desktop, theme, colors, or whatever they needed without causing problems for the next patron - well, a minor wait while the computer was rebooted when necessary.

The Patron user account had power user privileges under the DeepFreeze configuration to permit local installation of off the web applications, activeX controls, and such.

[schester]

Thanks for all the quick responses.

I was finally able to get some more information. Apparently they can't run some Inventory Manager application without administrative rights. I just looked for it and couldn't even find the application, but I understand they use it to check in and out films that are send/returned to SLC. I'll end up having to meet with one of the FHC staff to find out what they are trying to do and why it doesn't work under the patron account.

Any experience with this app?

[aebrown]

Thanks for all the quick responses.

I was finally able to get some more information. Apparently they can't run some Inventory Manager application without administrative rights. I just looked for it and couldn't even find the application, but I understand they use it to check in and out films that are send/returned to SLC. I'll end up having to meet with one of the FHC staff to find out what they are trying to do and why it doesn't work under the patron account.

Any experience with this app?

Yes, Inventory Manager is one of the apps that our FHC director runs on occasion. It works fine under our Patron account, which is a Windows Power User level account. It has its own passwords. I'm not sure why your FHC computers would require administrative rights to run IM.

[russellhltn]

Apparently they can't run some Inventory Manager application without administrative rights.

Yes, IM is a program based on a embedded MS Access run-time. In our center, it's located on a dedicated "FHC Office" PC. There, the staff has "Power User" access. I don't remember having to do anything special.

There are two possibilities:

- The icon doesn't appear in other logins (that's easy to fix)
- The database might be stored on a different machine, requiring synchronised passwords and proper network share right to be set up.

Like most older apps, by default it stores the data inside it's own C:\Program Files directory. If by chance the center is running Vista or Win 7, then that creates some problems since Microsoft is now enforcing their security model of no data in Program Files.

So this problem shouldn't be hard to solve.