Christian Castro, MCSE, CCNP
07-09-2005, 11:54 PM
I have a program that automates the creation of student accounts from any
database conceivable. You can import into active directory from a counselors
enrollment database or any student management program.
Set School OU's, then Grade Level OU's, the graduating year OU's. The reason
for the graduation year OU is that it technically will never change over the
course of the students stay with the district. You could then set Group
Policy Objects to groups to deny students access to network resources. You
can do it all in one domain.
The program I created will also allow you to automatically update any users
coming in our out of the district at the interval you set, usually every
night at midnight. Typically, usernames for school consist of the students
first 4 letters of their lastname followed by the last 4 digits of their
student ID (school ID or state ID), but do not use their social security #.
This password policy lets teachers easily refer back to a master username and
password data sheet to look up any students.
It works flawlessly as I have impolemented it in many large school districts.
Its called Smart Directories from Smart Admins, LLC,
Email me for more details. contact@atriumrecords.com
___________________________________________________________
"Marlon Brown" wrote:
> K-12 institution, 15,000+ WinXP student accounts, Win2003 AD Domain.
> Helpdesk and local technicians cannot keep up with password reset requests.
> My proposal for password management is a webform that let students input
> answers to 'secret' questions and let them get accounts reset . I would make
> URL available on kiosks and let students themselves handle the password
> resets - OK.
>
> This is the problem that people brought up:
>
> Classrooms are 45 minutes long. Students sometimes go to classroom, and
> because they don't use AD accounts very often, they have a tendency to
> forget passwords very often. So if they go to the kiosk to request the
> password reset, that should take at least 10 minutes to do so. That would
> take too long, according to theachers.
>
> What's your opinion on this ?
>
> I see two things here:
>
> a) I could say "instruct students to double check their accounts prior to go
> to the classroom"
> b) I could say "students cannot handle password policies in the domain. Let
> me justify I need to setup a separate domain for students and do not force
> them to change password". That would be a very weak security policy, but at
> least the student domain would be isolated from the staff domain.
>
> What do you think ?
>
>
>
database conceivable. You can import into active directory from a counselors
enrollment database or any student management program.
Set School OU's, then Grade Level OU's, the graduating year OU's. The reason
for the graduation year OU is that it technically will never change over the
course of the students stay with the district. You could then set Group
Policy Objects to groups to deny students access to network resources. You
can do it all in one domain.
The program I created will also allow you to automatically update any users
coming in our out of the district at the interval you set, usually every
night at midnight. Typically, usernames for school consist of the students
first 4 letters of their lastname followed by the last 4 digits of their
student ID (school ID or state ID), but do not use their social security #.
This password policy lets teachers easily refer back to a master username and
password data sheet to look up any students.
It works flawlessly as I have impolemented it in many large school districts.
Its called Smart Directories from Smart Admins, LLC,
Email me for more details. contact@atriumrecords.com
___________________________________________________________
"Marlon Brown" wrote:
> K-12 institution, 15,000+ WinXP student accounts, Win2003 AD Domain.
> Helpdesk and local technicians cannot keep up with password reset requests.
> My proposal for password management is a webform that let students input
> answers to 'secret' questions and let them get accounts reset . I would make
> URL available on kiosks and let students themselves handle the password
> resets - OK.
>
> This is the problem that people brought up:
>
> Classrooms are 45 minutes long. Students sometimes go to classroom, and
> because they don't use AD accounts very often, they have a tendency to
> forget passwords very often. So if they go to the kiosk to request the
> password reset, that should take at least 10 minutes to do so. That would
> take too long, according to theachers.
>
> What's your opinion on this ?
>
> I see two things here:
>
> a) I could say "instruct students to double check their accounts prior to go
> to the classroom"
> b) I could say "students cannot handle password policies in the domain. Let
> me justify I need to setup a separate domain for students and do not force
> them to change password". That would be a very weak security policy, but at
> least the student domain would be isolated from the staff domain.
>
> What do you think ?
>
>
>