Helpdesks - Unlocking Accounts

[XTR]

Ever logged into a PC at work.. entered your password 3 times and locked yourself out of your account.... Then you need to phone up your IT helpdesk and get your account unlocked.

So you give them your username and they unlock your account, but your still unable to login.. so you ask them to reset the password and then the 1st time you login you have to change your password.


So then......... your logged in...

but how secure is that... NOT VERY!!!!!

How do other IT departments work and deal with this?

[Steve]

At my College you have to submit a slip at the guidance desk about it - then at *some point* in the next 24hrs it'll get sorted, lol.

Still, security is a big problem and things like what you have stated are the reason it's so easy to gain access to systems.

[XTR]

At my College you have to submit a slip at the guidance desk about it - then at *some point* in the next 24hrs it'll get sorted, lol.

Still, security is a big problem and things like what you have stated are the reason it's so easy to gain access to systems.

Cant exactly do that with 7000 users across 4 sites.

[scottyman]

I always used to get them to come along and sit outside the office until we were ready to help them.
I never had repeated offences.... except for one guy who we ended up sacking as he was such a muppet - he forgot his password every week, and tried to get around password policies - we were pretty relaxed, 90 days, 8 chars of which two must be capitals, 4 lower case, 1 numeric and one special character.
He just couldn't get his head around it!
I basically made him wait half a day to get his password reset the last time around - he complained to the MD, who effectively told him that if he can't remember a simple password he shouldn't be working there in the first place!
A couple of months after I started working there (3 1/2 years ago) - implemented a "48-hour lockout" - didn't implement it properly - just said that it was a new security feature, and that if people entered their passwords wrong three times in a row, they'd be locked out for 48-hours - total lie (but you can do it) and just ignored them after that.

Cruel and unusual punishment, but an effectively way of getting people to learn regulations!

[Moby-Dick]

at the last large helpdesk I worked at - we had a user verification system , whhen their account was created , we'd ask for somethign like a favourit colour or birth town , if there was any security related issues , they'd have to answer the questions 1st.

[Richie]

Cant exactly do that with 7000 users across 4 sites.

Ours does that but then they have local IT on-site as well as "national" IT (for want of a better word) that is basically a call logging desk.

YOu have to submit a form so its documented,.....

[Atomic]

I like working at a University, someone forgets the password they have to take their campus card to the helpdesk in person to get it sorted.

Even if they are offsite, its their problem that they caused so they will get the inconvenience.

[Jiff Lemon]

When I helped look after 35,000 users, the system was based on your payroll number. Confirm your payroll number and we'll reset it for you. (amazing that staff could remember in an instant, a 14 digit letters and numbers sequence, but struggled with a 7 character or more plain text password!)

[scottyman]

LOL -
Just reminded me of working for Mirror Group -=
We (Engineering) took responsibility for a couple of servers which Mirror ran for us -
Every time I wanted access - they asked for the day's password to the server room...
Which of course, there wasn't one. They just didn't want to let me in!

They really didn't like me very much for some reason - especially when I got one of their techs sacked! We had a mail server with a 4gb primary drive and 36gb Raid for the mail files -
I discovered that the 350 users were being capped at 8 mb of mail each - so a little under 3 gb - once a few of us went over that limit, the mail server crashed.
Went down to investigate (they really didn't want us in there!) and found that the mail files had been moved onto the C: drive, and the D: drive (raid) was filled with porn!
Complete joke! This was about 2 weeks after I finally got responsibility for our servers...
Same company, same staff - just different SLA's.

[5lab]

at ours we have to authenticate ourselves with personal info

[MD]

easy, authenticate with user ID and email address, password is sent automatically to that mail account. the IT staff have no access to the passwords. Only to user ID's which we not give out unless 20 security questions are answered.

m@

[DaBeeeenster]

I wrote a security audit for a company a few months back. First thing I did was mailed the system admin asking for the root password (so I could see what security stuff they had on their public facing web servers). He replied a few minutes later with the root password in plaiin text. LOL!

Error #1...

[MD]

ROFL!!!! Now thats funny.

[Blub2k]

I wrote a security audit for a company a few months back. First thing I did was mailed the system admin asking for the root password (so I could see what security stuff they had on their public facing web servers). He replied a few minutes later with the root password in plaiin text. LOL!

Error #1...

He wasn't by any chance the guy who thought they needed an audit was he?

That was 1337 h4X0r stuff