cryingvalor

Hey guys is it advisable to let users set their own passwords on a network environment office?

crazijoe

Yes it is fine. In fact it is usually recommended. Make sure you set complexity requirements in GP and have it force them to change it frequently (I usually do 45 days and remember up to 10 passwords so they don't use the same passwords.). You, as an admin, can always change the password when ever you need to.

cryingvalor

Should the admin must have a copy of the passwords set by users. what if the admin wants to access their account to check something.

Go The Power

The admin does not need to have a set of the passwords, because they can change the user password if they want to!, and yes he admin will be able to access their account.

Cellus

The official/unofficial policy regarding passwords in an office environment is to push the secrecy of a user's password as much as possible at the user. No writing it down on a sticky and hiding it under the keyboard, no password that's "password", and never ever tell anyone. The last point is important, and is doubly-important when regarding IT personnel. The IT people in the company never need to know a user's password, and as IT you should never be placed in a position where it is revealed to you for three reasons:

1) Security. As a principle, knowing a user's chosen password goes against having the security when you have the power to change and basically do anything the user can. (Addendum: There's a lot more to it regarding security ethics, however for the purposes of this discussion, knowing there's a principle is what is primarily important.)

2) Liability. If you are in the position of knowing user passwords, you are liable for any questionable actions that may occur due to a users abusing and damaging resources and information. While it's true you can be liable anyways in being in a position of power/authority, that is a different type of liability. Compounding it is not recommended.

3) Social Engineering. Users need to be informed and trained never to give their passwords to anyone, including IT. This is because it is not uncommon for people with malicious intent to impersonate IT and try to get users to divulge information that doesn't belong in other hands. This policy is completely justifiable and expected - administrators have greater authority in regards to access control to resources anyway and should never need a user's password.

If a particular thread of troubleshooting and/or repair requires direct access to a user's account, there are alternative actions available. The most common and preferred method in gaining access to a user's account while logged in (in session) is to use Remote Administration. Need to tweak their Outlook settings? Establish remote administration (RDP, VNC, whatever your preferred/required flavour). You can also, if in cases where you can not remotely administer a user and must interface locally, change the user's password administratively, do your thing, then reset to another temporary password and force the user to change it privately.

By the way as a side note, make sure you note these administrative actions in your service log. Do not record any passwords used in the log. I know some like to use certain standard passwords while servicing due to convenience (not recommended security-wise but it's common), that information should be stored in a secure location and not in a log, even if your logs are not shared to non-IT personnel. It isn't good practice.

cryingvalor

You all have shed the light, thanks for the replies

TheMatt

One thing to note with the password complexity. Make it so it is complex, but not to complex that a user will have to write it down on a piece of paper. This is a big security risk.

Also, inform your users that they should under no circumstances disclose their password to anyone, even other employees. The Domain Admins will not need their password, and if someone calls and says they are from the help desk and need their password, they are likely not legit.

Also, it is useful to set the minimum password age as well. If someone discovers a user's password and wants to lock the original user out, then they will change the password before it expires. You can prevent this.

Also, was minimum password length mentioned?

EDIT: Oops, it looks like Cellus already mentioned the part about people pretending to be from the help desk. I guess that goes to show how common it is.