Administrator's Responsibilities

Spurred on by this thread That I didn;t see until after it was closed I have the following to say:-

The most basic principle of computer security is that if it isn't Explicitly Denied then, ergo, it is Implicitly Allowed.

Therefore, any administrator who allows anything to occur on his network that he didn't want to have happen has no-one to blame but himself.

An admin who has no-one to blame but himself yet goes ahead and lies and makes up "issues" in order to hide his/her own screw up/inabilities is more akin to the twelfth grader he is trying to screw over.

The kid issued a command, (a non-malicious command at that), on a system which, per the admin's policy, executed it....... If it did cause network issues it wasn't the kid who caused them - it was the admin himself.... he needs to take a serious look at his network. The sad thing is, from this story, I get the distinct impression that the admin won't have the skill set required to determine if his network is running correctly in the first place.

Sephiroth: I agree with others in the other thread that you shouldn't have been messing about in class. You are there to learn - if you don't learn you won't be working for me or many other of the professionals that haunt these forums. OTOH, feel free to show this to your dean or whatever if you like, but they should probably know what kind of a network admin they have.... Less than competent, unable to accept their own shortcomings, prone to bending the truth with a heathy dose of imagination thrown in. He/she needs some counselling and some professional development.

People like him/her bother me..... Why?..... It is this kind of admin that leaves his boxes unpatched and then doesn't even recognize that his boxes are attacking the whole world constantly... for months..... like many still do.... Then he/she will lie about it...... That's why he/she bothers me!

I agree 100%, its so easy these days to throw lingo around about "serious network latency" and such, but hopefully when the young tech saavy generation grows up, stupid little human errors such as the command line being enabled would occur less. But then the exploits may become more complex and harder to handle, givin that this generation will be smarter than the last. So situations like this would just get more and more complicated.

"serious network latency"

:rolleyes:

I haven't pulled anything like that since 1982............and that was on a CEO, not a schoolkid!

Where are his logs to prove it?..................if he hasn't got them, how can he call himself an administrator?............he obviously runs "Microsoft somthingorother"? Where are his certifications, his previous job references................or is he related to someone ::hide-beh

Would he know what a log was? the sailing records of HMS Bounty perhaps?

You may have freedom of choice (well we do if the parents can afford it).........but one thing we DO have is public accountability in education..........the dean would be fired, his sidekicks as well, and the administrator would be throwing trash for the rest of his life.

"Vox populi, vox Dei" is a nice concept..........until the lynch mob comes along?

Well said Tiger..................I would give the guy a red card for a professional foul, a true professional either would not need to, or would do it so he would not get found out :D

Cheers
l

The problem with an administrator like that is they are dangerous both for the company(school in this case) as well as for the end users. They know that as they are seen as the experts their word goes.
I have had the experiance where I had to suspend two techniciens on one of my teams because of an administrator like that. The basic story was I sent them out to put in place a remote Desktop on a very sensetive site. They talked a bit too much to the local admin about how many security loopholes he had. The admin the same day updated Norton.
The two techniciens came back to the central saying every thing was in place, tryed a couple of tests and went on to the next project.
In the middle of the afternoon I got my ass hauled up before the IT director who was screeming about firing the two techniciens for having hacked the site. the local admin was on the other side of the line screaming about someone taking controll of his work stations and opening windows and copying files. I managed to convince the director to only suspend the techs till I figured out what was happening. They got escorted out of the building by the security. The case was closed very quickly after i went to the site with the IT security chef. The admin kept saying someone was attacking the machine while I was standing in front of him with the network cable in my hand. We downloaded the proper updates for Norton afterwhich everything worked fine.
All that to say a little knowledge in the hands of an incompetent is a dangerous thing.

Gotta say,

"Therefore, any administrator who allows anything to occur on his network that he didn't want to have happen has no-one to blame but himself."

Is in general a crock. So you are saying that, I as admin, didnt want my IAD to fail, so putting it in a locked room, on it's own breaker, while good ideas, it was still my fault that we lost voice/data for two hours the other day because a guy from Maintence decided to unpull the unit, then go to lunch. Surely the DO NOT TOUCH sign was for everyone BUT him. :O

We as admins, walk into new jobs everyday, and find a wild mix of OS's, hardware, and software, that have been tacked onto our networks since long before we ever worked at a location. I have been at my current job 18 months, and I am slowly but surely getting everything locked down.
Case and Point. about a month ago, I had a major database app to upgrade on my apps server, requiring the server be accessable, BUT the app could not be used during the upgrade period. At each tracking station I unpluged the workstation, unplugged the NIC from the network, posted a 8x11 sign saying the app was down and not to try and access the tracking app. As I was running the update, a user reconnected the machine, removed the sign and proceeded to log in and crash the update, resulting in a day of restore and rebuild time.
The company owner proceeded to tell me it was my fault. I told him the same thing I will tell you about that statement: Kiss my fuzzy oversized butt.
Admins write procedures, email and tell everyone how to operate, lockdown what they can, but in the end, the USERS make it or break it, as well as the 2 or 3 guys that worked the job before them and left it in such a mess that it was amazing it ran at all. If people dont follow the admins recommendations, procedures, and rules, then no amount of work on the admins part will make a difference.
My network here has no less the 7 servers, workstations running, 98, NT3.51, Dos, NT 4.0, Win2k, RedHat 9, Lantastic, Advantage database, Exchange, Genesis CAM, AOI, and a number of other elements that make life interesting all the time. Not even including the remote offices. Between users that dont listen, past Admins not knowing what the heck they were doing, vendors leaving wholes in there products, and supervisors/owners that do not want to pay for updating/upgrading, you can NOT just blame the admins.
Sloppy work, and carelessness will destroy any job you do, network admin or not. So will lack of knownledge, understanding, and foresight. Doesnt matter if you are a network admin, or the guy changing the tires on a car at Wal Mart, sloppy work will get you every time.

In general, I agree with most of your post, and yes, reading what the 12th grader had to say, he got screwed. Curiousity is often rewarded with a slap in the face (just as my ex-girlfriend). If he facts were straight, then indeed, his network admin, is scared of his own shadow, and ill informed. And of course, probably gun shy, since highschool computer labs are a hackers heaven. Or so the media and press have lead the world to believe.

There is my $.22 cents worth. It is easy to blame "the lousy network" the "stupid admin" the "PC guy", and admins to blame everyting on I/O error (Idiot Operators). A lot of times Admins take it on the chin, take the blame and do the best they can to fix the problem.

Cheers!

MrCoffee:

>>Is in general a crock.

If you are going to call what I have to say "a crock" please, at least, have the good sense to use an example that is relevant. Having a maintenance man enter an area he is allowed into _and_ ignore a "policy", (the do not touch sign), is in no way the same as an admin applying an "unbreakable" policy enforced by the operating system that says that you can't run cmd.exe. If you had not allowed him a key he couldn't have got in, could he?

>>I had a major database app......

Had you been smarter you would have unplugged the cable from the switch _not_ the user's computer. You prove my point really, don't you?

>>The company owner proceeded to tell me it was my fault.

He was right..... See above

>>Kiss my fuzzy oversized butt.

"Oversized"...... Maybe we sat on it too long during your 18 months..... You could have your network locked down by now.......

If you are going to flame someone please make sure that you are wearing your retardant suit rather than the highly inflammable bikini you are currently wearing, (looking cute is one thing but you should think more before you do things......)

Kids......... :rolleyes:

Thanks for the replies guys... Im saving this to show a few people.....

Everything is the admins fault. After requesting another 60amps and a new UPS in one of my server rooms - Company purchased another AS/400, I was told that the cost was not justified. When the newly installed 400 brought total power usage to 59.9 amps, the UPS blew up and all servers were "Off Line" The reason this was my fault: I knew exactly what was going to happen and did not prevent it. (I did have a disaster recovery plan in place that worked perfect)

When luser A booted with a floppy disk and pulled his workstation off the domain, disabled antivirus and proceeded to F**K with the network - That was my fault. I'd been watching this guy for weeks as he tried to bypass security and said/did nothing. Didn't think the guy was smart enough to do what he did.

When I started working at my current job there was no AUP, Firewall (T-1 Connection) and antivirus was on a few workstations. The mail server was nothing but a spam relay.

The moment I accepted this position - all of the above became my problem/fault - responsibility. Blame the users or the guy before you but as the admin - It's all your fault.

I'm sure that this network is not secure. I know that users can access things on the network they shouldn't. I'm working on this and many other projects. When luser A tells me luser B read their review. It will be my fault.

Dino: Can you see the difference between the admin in the original thread, MrCoffee and yourself?

The admin of he original thread and MrCoffee both placed the blame firmly at someone elses door when clearly it was the two of them in the wrong. You aren't blaming anyone and you are working to fix or have already fixed the issues you have inherited. Ok, you had a lapse of judgement re: the luser who booted with the floppy disk. You admitted it was your fault - Bravo..... Next time, log it all - remove his connection at the switch and wait for his supervisor to call. When they do simply tell them that it is your responsibility to protect the network and that is exactly what you are doing. After some negotiation you can let the luser back on the network with the strict rule that if he "plays" _once_ more he is off for good.

Don't worry, you'll be a fine admin......

Tiger Shark:

I guess that was my point. Every admin makes mistakes and has to own up to them. I've been working in this field for almost 25 years. The admins/managers/directors I've come into contact with - that placed blame on someone else; did not have even the basic networking knowledge or skills needed to prevent or fix what ever issue arised. There wern't many but everyone runs into at least one blamer.

Dino: Allow me to re-phrase......

Don't worry, you _are_ a fine admin.... ;)

Tiger Shark:

It was a poor example but I was trying to make the point of "When is it the users fault"? Clearly the IAD was in my area of responsibility. But when someone denies common sense, ignores a posted sign, I feel that person should be held responsibile for it. Clearly it would have been best if the IAD was in a different, secure location, or if the maintence guy didnt have a key to the room. But that isnt possible. Neither choice was mine, so why should I take the blame for his action.

With the 12th grader from that other post, had he been instructed not to use the command line? If not, clearly the admin is at fault... but if he had....?

With with the database app I had the crash with, I did unplug the workstation from the switch when I ran the next update (water under the bridge etc...). But my point on that is SHOULD I have to? I clearly did not want to have problems with a main application, I took what I consider very reasonable steps to prevent a problem. Should not the user who 1) ignored the sign, 2) ignored the instructions sent via email, 3) who reconnected a machine he had no business touching, and 4) logged in after being told not too not have to take the blame for his/her actions?

I am not a "kid". I have been doing this as long as Dino has, and like all network admins, I have had my share of mistakes, blonde moments, and just plain... damn... I just screwed the pooch. I too have overlooked possible problems, security risks and other actions, because it didnt occur to me that a user could be that stupid, or I understimated someones abilities. I have no problem taking blame for my action, short commings or lack of knowledge, just the unreasonable and stupid actions of others.

"Therefore, any administrator who allows anything to occur on his network that he didn't want to have happen has no-one to blame but himself." If you look at your own network, and think about the possibilites of someone either thru stupidity or intent to harm it, would you really want to take the blame for all those actions?

Either way, the example I gave was a poor one, and the last thing I wanted to do was start either a flame war, or set a bad impression of myself my first day on AO. I disagree with your statement, until you add the words, "with in reason" to it.

oh and Tiger Shark?

>>I had a major database app......

>Had you been smarter you would have unplugged the cable from the switch _not_ the user's >computer. You prove my point really, don't you?

>>The company owner proceeded to tell me it was my fault.

>He was right..... See above

Actually no he was wrong, and so are you. The user in question is 28 years old. He is a adult, working in a place of business. His actions were directly opposite of the Acceptable use policy he himself signed when he joined the company. And once the owner calmed down, and found out that a week later he tired to log in again (ignoring the warnings and signs and etc) he was fired. Do you really believe that no user should be held to blame for his/her actions within the networking environment?

>>Kiss my fuzzy oversized butt.

this was ment to add a bit of humor to the post.....

>"Oversized"...... Maybe we sat on it too long during your 18 months..... You could have your >network locked down by now.......

If in your own personal judgement, you feel that you could have and can do better with this staff, the equipment, no budget to speak of, and work environment here, you are welcome to come here and put your money where your mouth is. I am one person, dealing with 4 NOS plateforms on 3 different networks within this building alone, 7 Server and over a hurdred workstations, 150 employees running 24/7. Not to mention the specialized CAM and manufacturing areas. That comment as just as cheap as what the school admin did to the 12th grader.

MrCoffee:

First I'll say that when you start a message with "thats a crock" it's kinds difficult to see the humor in "Kiss my ass"..... Don't you think????

To address your concern that people break your written policies and do things you don't like. You always have two choices:-

1. Physically secure your assets
2. Adminstratively secure your assets.

In both the cases you cited you administratively secured them when they could have been physically secured. An administratively secured asset is akin to a restraining order on a crazed murderer. It does _nothing_ to prevent the act except tell the person(s) that it is naughty!!!

Had you had a lock installed that the maintenance man does not have the key to and had you removed the connection at the switch, (which should be physically secured also), then neither of these situations would have been possible.

Firing the chap after the damage is done is nothing more than "closing the stable door after the horse has bolted". Having said that I am fully aware that I am not perfect and also that there are situations where there are no technical solutions to certain administrative problems. Example: User A must have unfettered access to the internet in order to carry out his job functions but he also spends six hours a day surfing porn in full view of his co-workers. You can't remove all the porn, (tried it.....), and you can't cut his internet access. There is no viable technical solution to this problem so an administrative solution has to be sought. Ok. we'll schedule a report of his daily activity and have it sent directly to his administrator every night. If he screws up we fire him.....

Do I believe that "no user should be held accountable for his actions". Of course not! But we both know, (both of us through experience), that a restraining order, (which is what a policy is), isn't worth the paper it is printed on if the user dosn't want to obey it. Therefore, whenever you are presented with an issue your first research should be to find the technical solution not just any old solution. Administrative solutions are your _final_ resort.

I work for a non-profit so I don't know what dollars are! I have some 30 fileservers and 350 workstations that I am directly responsible for in eight locations in three counties. In addition I am, to all intents and purposes, the internet service provider for 4 sister organizations which adds another 300 workstations and servers in another seven locations. All locations are connected by T1 so I have some 650 assets on a single WAN across three counties. I am solely responsible for the security of all those assets yet I have administrative control over only about half. I support access from the internet, (VPN), to some 50 remote workers in addition who mocve from contratcor location to contractor location at will. I have staff, 5 of them at varying levels of technical ability but it is still a daily grind to accomplish normal maintenance let alone be "flashy".

So, my wiener is bigger than yours........ (Humor detector on please..... ;))

Tiger Shark:

Clearly it is a difference of opinion, between you and I, but the result we would like to see is the same. You network is a great deal larger then mine, with it's own chanllenges, no doubt.

The maintence guy BY LAW had to have access to my IAD. He is in charge of the electrical equipment, and is required to have access, by VT law. Administrative step where to explain to him what the IAD was, and why it needed to be apart from the other equipment, and explain why it wasnt to be touched. I asked the power to be to move it and the power to my secured server room, but it was not worth the $$$ to them. I guess in this case, my failure as an admin was not being able to justify the cost before the problem.

In the case with the employee that was canned for trying to log in during the next update, he got what he deserved. He wasnt fired for causing the first crash, but for repeating the same exact behavior a second time. After being warned. In the case with you guy surfing the porn sites, if you have set policy, warned him, and told him straight out that he is not to do it, or he will be fired, and he does it again anyways, then he should be fired. Period.

When you can not solve a problem technically, you must resort to administrative solutions, but those too will fail, if you 1) do not have the management, or administrative authority to take actions or to enforce policy, and 2) if those who do have the authority choose not to use it, or will not take action to prevent the problems. (i.e. not allowing my to secure the IAD).

For me, I stop taking the blame when people openly disreguard the instructions, policy, and proposals I have given. I had to beg and plead for several months with the management here, to replace an aging and flaky backup drive on our accounting network, and I was turned down until the server's hard disk died and they lost several weeks worth of work. THEN and ONLY then was I allowed to install a new drive. Stupid, yes, but since there never HAD been a problem with THAT server, why worry about it? I guess the case could be made that I should have found a creative solution to backing up the server to another system or something, but if memory serves, that same week I was trying to track down an intrmitten faiure on a section of cable in the production area, and ended up replacing a couple hundred feet of cable that the acid fuses had eatten the cabling because the former admin here hadn't bothered to run the cabling thru the protective piping. And I was also trying to find out why one section of 10base2 cabling was completely dead in programming.

I guess the point I am trying to make, is we as administrators can only prevent issues which we have some degree of comtrol over. While the are assets on my network which I am responsibile for, I have no real say how they are used, or in some cases abused, due to management of this company. Case and point. I had a network server that was running really low on drive space. On that drive I found a user directory filled with about 12 gigs of porn. This user is one of the orginal owners of this company and insists on having full administrative rights on the entire network. So he can adjust his quotes, hide and protect folders on the servers at will. I have asked him to remove the files, and he wouldnt. I couldnt get premission to buy the additional storage, so all I can do is move other files to other locations. This kind of thing is where the "with in reason" comes into play. I am clearly responsible for the network storage, but have no authority to enforce policy. So when the server run out of storage, and the users got errors, I steadfastly refused to take the blame for it. The best i was able to come up with in this case was to bring in a 40Gig I had at home, install it into the user's machine, and moved his stuff there. Had I ignored the quotes, and let the machine fill up without ever checking it, until it run out of storage, then yes it would have been my fault, and the blame placed on me.

Either way Tiger, I believe because of our different network environments, and different peronalities, we are not going to agree on this subject. I read your central logging paper late last night, and I am going to read it again today. Clearly from the text you have a much higher security and admin skill set then I do. But I can say without a doubt, that if I can get approval to put some of the info in the paper into action here, it is going to save me a butt load of work... :) :)

Cheers!

Tiger Shark:

>So, my wiener is bigger than yours........ (Humor detector on please..... )

Yup, maybe... but then again, I can lick my eyebrows... :)

Tiger shark useualy you have good points, this time you are wrong. It seems that you are forgetting that there are to types of security mesures put in place on local systems, the mesures that are inforced by computer policyies that block your access and those inforced by pink slips. Esxample, we don't allow viewing of ofensive sites at work, sure we have a proxy that blocks the sites, but it wont catch all of them, if you find a site that is open it dosn't meen that you are allowed to view it and you will be terminated. If a school says that you are not allowed to do x and you find out that it isn't actively blocked don't go and do x (or if you do accept your punishemnt without too much whineing please.)

MrCoffe.
I can see why you might be frustrated. In the type of situtations you describe I make sure that all my sugestions are sent by e-mail with more than one person in copy. In my experiance the problem in a lot af cases is how you are able to present the information. For the disk space for example I would run a little audit on the different types of files on the disk and how much space is used by each type. Then I would present the information in a nice little pie chart in Excel for example. Explaining that it is much more cost effective to have a proactive network administration than a reactive one.
This type of action might make the management take a bit more notice then again it might not. In the worst case when the sh*t does hit the fan you can always say that they were warned of the dangers.
Obviously this is a very simplified view on things. If the management really doesn't want to listen they wont.
What it come down to is an admin is always responsiable for his mistakes, sometimes responsiable for the mistakes of others but should not , as in Sephir0th case, give false information to justify his mistakes.

edit Maestr0 you post came in just as i was finishing mine and i am totally in agreement with you. If you expect all your end users to be mature, sensible adults then you are just asking for it. :eek:

I think the point Tiger is trying to make is that what a user is (or more often is not) allowed to do should be defined in an AUP (Acceptable Use Policy) which would be the administrative equivalent of a security policy, however if you rely on common sense and administrative policy to govern users behavior you are in for a good corn holing with no vaseline, so here is where we decide to implement other forms of access control and security measures to insure our network operates smoothly. If the system administrator does not have a policy enforced by either management or the network itself (hopefully you have both) then you have no one to blame but yourself when something goes horribly awry (as it will). Will users actively and maliciously try to circumvent policies put in place by management and/or the network? Of course they will, and they should be held ressponsible for any transgressions of these policies when these policies have been explained and laid out clearly for the user. Will users do something inconcievably stupid or bizzare out of ignorance or even just curiosty? You bet your ass they will, and although I would like to be able to hold people ressponsible for ignorance I have not had much success so far. Of course it is impossible to forsee every action an ignorant or deranged user might perform (alas, not for want of effort), so there will be cases when someone sets a precedence for a new policy (administrative or otherwise) to be put in place to prevent such problems in the future, it is at this point the admin must accept it and move on, and not cry about how some kid destroyed his network with a net send (which we all know is total horseshit anyway) to cover up the fact he had no idea someone was going to do this sort of thing.

-Maestr0

One of the things that Tiger Shark and other posts has made me think about differently, is now looking at my net, I look at the assets and think, ok, now how can I (meaning end user) mess this up. While I did this to some extent before, I hadnt approached it from a point of view of circumventing the protection/measures I had in place. Now I look at it and say, are there steps I should take? If there are measure I can take to improve the security/operation, and I can do it within the limits of my authorization, I will do them. If I dont, then any failure is my own fault.

Muracu: Your right, and as a rule I document everything. In scientific circles, if you dont document it, it didnt happen, is a rule of thumb. In my case it is more simple then that. I have so many different projects and problems going on at the same time, that I document everything in order to remember exactly what changes I have made and when and why. In the case with the drive space, I had the graphs and reports all ready, and I even showed the Managing members on a 27" monitor in the conference room the Win2k drive properities pie chart. You know the saying... you can lead a horse to water but ya cant me him drink.

Maestro: Your right, and AUP is very important. My point was more that unless the Network Admin has the authority to enforce that policy, you end up in deep sh*t every time. I may be foolish (which is most likely the case) but I believe I am in a business environment, and expect people to behave like professionals. It is also amazing how intelligent, well trained professionals can do truly stupid things when placed in front of a PC. If a user doesnt know any better, and makes a mistake that causes a network issue, that is one thing. In one case, I had an employee delete a folder on one of my servers because in my haste, I added her (instead of the user name above her in the list) to have premission. Clearly it was my own fault. If however you are an adult working for a company, you have had the AUP explained to you and you sign it, you ignore the Network Admins instructions, and you cause a networkwide problem, then it is time for you to find different employment. IMHO, there is an expected level of professionalism, a level of assumed (bad choice of words but.....) behavior when someone is given both a job and AUP they they should follow it. PERIOD.

if I got up now, and walked down into the cleanroom downstairs, ignored the sign on the wall, didnt both to put on the lab coat, the hairnet, and use the compressed air to blow the lint and dust off my clothing, and as a result, a complex product we were making was damaged, who's responsibility is it? The manager of the Imaging department, or mine for not following clear policy? Mine of course. Same for that network users. They have clear written and verbal instructions, and if they chose to ignore both. Why should the network admin be held responsibile for that?

BBallad: Welcome back... long time no type....;) The example you gave was _exactly_ what I said in my previous post, ("there aren't always technical solutions to administrative problems). Our AUP begins with "this is a business network and is to be used for business purposes only"..... Wherever I can this policy is enforced through "physical" rules, (Group policy etc.), but I have the AUP to fall back on when _I_ fail..... ;)

Muracu: I'd go one step further, (but this _is_ me speaking.... <LOL>), I would send out an email to all upper management stating that "the disk space on the master server is running out and that during an audit of the filesystem I discovered that there is 12Gb of space being taken up with pornography but the owner of the files has instructed me _not_ to remove it. This being the case I will need to spend $X for the purchase of additional HD's to increase the space. Do I have your permission to make this purchase". Then I would sit back and wait. The Porn king isn't going to rush to tell everyome else that he's the pervert so you will be removing it in a matter of hours. Then, before you delete it you go to him and offer to cut it to CD for him. Result: You are happy, the board is happy and the porn king is happy resulting in a lower liklihood that he will come after your @$$.

MrCoffee: The only difference we have is that you trust people to do what they are asked/told. I don't! People are, for the largest part, morons where computers are concerned. Not only are they morons, they are selfish, ("I want to do this so I will and they'll never find out"), and stupid, (the "they'll never find out" bit). Since you read my treatyse on logging you can see that a lot of the goings on on my network are logged and archived but the (L)users don't know what we are capable of seeing....... So show them......

A typical example: From time to time I will watch the "real time" monitor of my SurfControl and I will come across someone shopping for handbags, (this happened the other day). So using GenControl written by Slarty here on AO I connect and can watch their desktop without them knowing, (it's in my AUP and we remind them every three months). If they are shopping away I will "net send" them the following:

"The log of your little shopping trip is getting rather large. Should I send the first installment to your supervisor now?"

You'd be surprised how quickly IE closes.... <ROFL>. But you'd also be surprised how quickly that little incident gets around the office and whispers of "$hi7, he can do that????" can be heard.

Lastly, I get one very specific frustration from your posts. Your lack of authority on your own network. I do understand how frustrating that can be. Personally I would _gently_ inform them that without the authority to act and determine what happens on your network then all they are doing is paying for a glorified help desk. Point out that the reason they employed you was because you know what can be done with a network and, as such, it is a better use of their money letting you manage it. I like to point out that "it is their train set and they can play with it any way they like - It's my job to make it work for them". But in order to make it work they need to work with you and you need to work with them. They tell you what they need, but let you make the final decision on HOW that is acheived.

If they won't bend I would start looking for another job..... 'Cos you won't get anywhere in this business working for people who know nothing yet insist on micro-managing you......

If they won't bend I would start looking for another job..... 'Cos you won't get anywhere in this business working for people who know nothing yet insist on micro-managing you......

Tiger Shark: Sighhhh I would, except, welll.... ummmm I hate to admit it, but even with the bitching in my post on the limitations of my position here... err well ummm I love my job. :O
The entire work environment is a challenge, and everyday there is a new puzzle waiting to be fixed or solved. It pushes my to aquire new skills and reuse old skills in a lot of different ways... I have been here over 18 months and I still come in early and stay late whenever I can. From a techie point of view it is a really good job, from an admin well there are a *cough* few changes I would like to see made....

As far as trusting my users or not goes, I guess I have standards to which I except them to live up to. Silly as it my seem.

Anyways, TAG! your it... :)

thats what i get for being to lazy to read the entire thread :) Personly when im at the smaller compnaies I prefer the physical security of an aluminum basball bat to fall back on :) it makes a wonderful LART