|
Posted by Miha Pihler [MVP] on July 20, 2006, 11:11 am
Please log in for more thread options
Hi,
Very simple command that will show you which user accounts have been
inactive for X amount of weeks...
dsquery user -inactive 4
where 4 is 4 weeks and you can put in any number...
This should be a good start and it should be now easy to disable or delete
these accounts.
Some other answers from me (my opinion)...
> - The place to approve account creation/ alteration/ deletion. Do you work
> with a security officer responsible for these tasks?
I don't think that security officer should be included in creating /
deleting every account. He/She probably have enough other work to do. What I
do usually suggest is to sit down with security officer and write the policy
how and when to create / delete these accounts. Management should agree with
this policy (sign it) and all you have to do from now on is to follow this
policy (and change it when necessary - again with management approval).
Policies are not written in stone any more ;-).
Another thing that I like to avoid when ever possible is for IT to be in
charge of delegating and assigning permissions to resources. This should be
done by data owners. They have best information on which they can decide if
someone needs access to data (lists and other resources) or not (or when
he/she should be removed from access)... IT can (should) only help set this
up for the data owners (e.g. create groups, teach data owners how to add
users into groups) etc...
I know these can be hard and I still have customers that are not listening
to this (usually smaller ones). On the other hand I have customers that did
this and are very happy with such arrangements...
I hope this helps,
--
Mike
Microsoft MVP - Windows Security
> At our company (approximately 2000 employees) we would like to streamline
> the user account management process. I read the account management guide
> at
> http://www.microsoft.com/technet/itsolutions/cits/dsd/acctmgmt/default.mspx,
> but are still left with some questions some people might want to answer
> to.
> Maybe you're struggling with the same things, in which case we can learn
> from eachother. I'm looking for a practical, procedural or technical
> solution for the following issues:
>
> - Make sure that accounts are disabled the moment people leave the
> company.
> At the moment managers are very sloppy with these kind of things. Accounts
> remain enabled for months after someone leaves (after all, from their
> point
> of view it's more important to get somebody going ASAP). I could go for
> the
> scripting solution (e.g., creating lists of users who haven't logged on
> for
> over 2 months and ask the heads of department who is still around), but
> then
> it's ME again doing all the sorting and searching.
>
> - Make sure ALL accounts are disabled. We don't have Identity Integration
> Server, but I want to be able to track who has an account where, such as
> AD/
> SQL/ backup applications/ LOB accounts. How is this solved? Creating a
> database and (manually) update it every time an approved account request
> comes in? We're not responsible for all LOB accounts, so that doesn't help
> either.
>
> - The place to approve account creation/ alteration/ deletion. Do you work
> with a security officer responsible for these tasks? Right now someone in
> each and every department is responsible for it. Unfortunately, some of
> them
> rubber-stamp almost anything, from account permissions to applications.
> Since we don't have a clear view on their business process, it's hard to
> deny requests, especially with their manager support, even though we
> sometimes raise our eyebrows (more than once really). The Microsoft
> document
> mentions CAB meetings for severe cases, how about other things?
>
> - Who should be the main force behind account alteration? Again,
> management
> is not really interested in employees moving to other departments.
> However,
> if we don't get that info, the user can access his/her old data, can start
> up old applications, remains in distribution lists etc. Some of them
> remind
> us of that, since they don't like the mails (they don't mind about the
> apps
> though). Some of them, however, love to keep their nose where it should no
> longer belong.
>
> Many thanks for ANY input you guys have.
>
>
| 
XML Sitemap