Printable View
recently, a head of one of the departments here in the office came over and wants the internet connection on one of her employee's computer to be disconected. she wanted it to be disconnected from the internet bcoz all she do is chat on the YM, or any other chit chat programs and cant do more on office works. is there any way that i can disconnect her internet connection form my server without interrupting the LAN and do a silent disconnection on her internet?
thanks in advance.
I'm not sure what you mean about silent disconnection from the internet but why don't u block the mac address of her nic card. That way everyone else still has a connection but hers is gone. Or if it is a problem with her being on instant messengers or the like why don't you block the ports they use.
-= |)ark$ynta>< =-
Does she need network access for anything other than HTTP or chat programs? If so, is there a firewall in place, or a proxy server? If not, you can shutdown her port on the switch, unless you are using wireless or hubs. Then it gets a little more complex.
Need a lot more details as to how your network is setup and how traffic routes across your network. A more accurate answer could be posted with some more details about your setup.
silent disconnection for me means disconnecting her connection from the server without going to infront of her computer. any software to scan my network computers with mac addresses? or commands perhaps..?
chimp: yes she needs a network address inorder for her to print files needed by a client. there is a firewall but no prpxy server. there is no way i can disconnect her port on a switch bcoz we are using a hub. and we are using DHCP for the network.
am sorry i was just told to do so a minute ago. thanks again chimp & dark5yntax.
Do you have a firewall in place?
there is. on the server. and an internet security on her computer. i only want to disconnect her internet connection.
Hi,
What operating systems are you using (client & server)?
Does the person need to use a web browser?
Cheers
yes nihil
am using an XP, both client and server respectively.
No, she doesnt necessarily need a web browser.
Well,
I am sure you can block a lot with groups/policies & permissions, but you may like to take a look at this tool:
http://imlogic.com/products/imdp_request.asp
IM Detector Pro...............it is supposed to be free :)
So the problem is that she needs network access to print for clients but you want to remove internet access so she can't chat on an IM all day?
How exactly is your network setup? Is the internet connection running directly into the hub or is it running through some sort of hardware like a router or firewall, or even the server, before it gets to the network segment she's on with the hub?
Also you mentioned you didn't want to go directly in front of her computer? Is it a company computer? If so wouldn't you have access to it after she's gone for the night? You could easily get the mac address off the computer by running ipconfig in xp.
If it's directly connected to the hub then I don't think there's anything you can do without changing settings on her computer to block her from sending data to the internet. A low profile firewall, not something that pops up everytime she tries to get to the internet, would let you block her from getting to the internet without her really knowing why so long as you can restrict access to the firewall software. You could simply not let her send outgoing traffic to any address outside the local subnet or block everything and just allow her to connect to the machines she needs, like the printer. There could be other ways but I don't know of them.
If the connection runs through something that has the capability to block certain traffic, i.e. some form of firewall, then you could just set that up to disallow anything coming from her mac address, this would let her still have access to the local network since you would only be stopping her traffic when something tries to leave the newtork.
Just some suggestions.
block the ports for the instant messanger. Im sure productivity will pick up for all those nice folks who havent yet been caught with IM programs also. lol. Or do as nihil suggested and lock her account down so she cant access the web.
This is the work of a bad manager.Quote:
recently, a head of one of the departments here in the office came over and wants the internet connection on one of her employee's computer to be disconected. she wanted it to be disconnected from the internet bcoz all she do is chat on the YM, or any other chit chat programs and cant do more on office works.
They should alter the security policy to reflect the objection to instant messaging software (and installing unauthorized software) as well as a notification about management's ability to monitor system usage to enforce the policy and have all the employees sign it.
To just kill her connection without discussing it with her will merely breed mistrust and resentment, which will eventually result in additional symptomology.
If the employee violates the policy, give her a written warning (as should be identified as an option in the security policy) and if she does it again, fire her.
Treat employees like children and they will respond immaturely, plain and simple. Treat them like adults, inform them of the consequences of their actions and hold them accountable and everyone will be much happier.
Keep in mind, most people here are techies and their responses reflect that BOFH attitude. ;)
cheers,
catch
Pfft, I haven't seen anyone say much BOFH lovin's here. If she was on MY network and wasn't supposed to be using IM software, well for one, any drooling half wit knows you shouldn't be giving users that much access. What idiot set up her account where she could install that in the first place? You should lock them and her in a room with two bricks, last one standing keeps their network access.
If that doesn't seem to be a show stopper for some reason, just set up mail access on her box so everytime she loads Yahoo, it sends an email to her boss telling them how stupid they are.
Lastly, a sack of thinwire terminators is great for beating sense into a senseless user.... Or beating them senseless, either way works well.
And of course Cat5 cable can make a great choking device.
In other words, when you give users choice / power, you're already in two places:
the wrong damn job
and asking for it.
If you don't know how to use firewalls and set proper rules for them, and if you don't know how to block ports. Why not setting a less power {Privileges) account, like a Guest account. This offers hitherto a great way to prevent her from accessing unwanted applications like YA or MSNM, talking after uninstalling all the unwanted applications.
Again the best piece of advice is to have a less power account.
And if you don't know how to set up a less privileges for accounts, then you shouldn't have been there as an admin anyways.
If you are seeking more control over the accounts that you have just created, there are many free and commercial tools offer this service. Look around and am pretty sure that you will find many.
catch,
To some extentions you are right. But the corporation should not let any of its employees go past the red limits. Not at any cost, and why breaching law would lead to resentment????
We should do our best to prevent {Police} users from acting freely, the have to access what they need to fulfill thier tasks, otherwise it would be bad ao assign them privileges more than they need.
If we are going to give everybody full rights and complete freedom, anarchy would be the first side effect of this practice.
/me I would be very mad and resentment employee as my company won't give me a full access to the main server, Why they don't? I won't harm them! :D
Cheers
Well, in this case the user has not breached any laws. There is no law that states users cannot use instant messaging service, and if the organization in question had a policy against it, then it would stand to reason that the same policy would define a response for breach of policy. This original post clearly indicates this is not the case.Quote:
catch, To some extentions you are right. But the corporation should not let any of its employees go past the red limits. Not at any cost, and why breaching law would lead to resentment????
You cannot punish users for something that you didn't inform them was forbidden.
Another point is that IM applications can be run as guest. YIM and AIM both can operate via the web browser utilizing HTTP protocol (I believe they can also be configured to run over port 80). Reducing the users privileges, blocking ports... lots of administrative hoopla for what? You'll just make the user feel like they are not trusted, and ultimately not valued.
Although I don't argue that technical solutions should be used to enforce least privilege and non-compliance discovery... you first need a policy to determine what privileges and required and what constitutes non-compliance. Additionally the policy will outline consequences for breach. ;)
cheers,
catch
so its a gutless manager.. passes the buck onto the Sys-admin.. so when the worker realises that they are being blocked..what then.. blame the Sys-admin.. or then tell them take it up with their manager.. but the manager is gutless wonder.. you know where the buck will land..don't you..
get some balls ..follow through with what catch advised.. read a tut or two from tigershark.. he has a couple on this matter..
The manager is a gutless wonder.. if they dont have balls ..you had better or your users will get big steel ones and then your screwed..
(gore.. that bag of terminators.. I usually keep a steel crimping tool in the same bag. 300g of added impact)
Yeah that's correct, they can use them still. But not installing them though. I assumed that there is law to prevent them from useing any not-related business applications. I think most companies have this in place already.Quote:
Another point is that IM applications can be run as guest. YIM and AIM both can operate via the web browser utilizing HTTP protocol (I believe they can also be configured to run over port 80). Reducing the users privileges, blocking ports... lots of administrative hoopla for what? You'll just make the user feel like they are not trusted, and ultimately not valued.
Why a good employee will resent or feel bad if the company blocked something that he/she is pretty sure that they would not do even if they were not blocked???? Me myself, I am happy that the company is blocking such things. Because I know that I won't use them even if they were unblocked. They let no chances for bad employees to play around. I still find it of importance to do everything to make a possible sabotage away.
An admin is just like the police, do you feel bad for knowing that the police is around? I think not. They are there for tha bad folks, i think you are not bad!... ;)
Cheers
There is no law against this (at least none that I know of). There may be a POLICY that prevents this. There is a difference. A violation against the policy would mean a violation against what the company considers acceptable behaviour within the firm. A violation against a law means that you are violating what society considers acceptable behaviour within the nation (province/state/city). Big difference.Quote:
I assumed that there is law to prevent them from useing any not-related business applications. I think most companies have this in place already.
Those services use java applets which require no installation.Quote:
Yeah that's correct, they can use them still. But not installing them though.
The fact that the company is now seeking a way to handle the situation indicates no policy is in place. As Ms. Mittens said, there is no law against this. Many companies in fact explicitly allow IM applications.Quote:
I assumed that there is law to prevent them from useing any not-related business applications. I think most companies have this in place already.
Any reasonable person will be a little put off by having their work environment changed without their prior knowledge in response to something that they didn't know was wrong.Quote:
Why a good employee will resent or feel bad if the company blocked something that he/she is pretty sure that they would not do even if they were not blocked????
cheers,
catch
Well Now,
Is anyone else getting a strange feeling about this thread?
Having re-read it, I have a sneaking suspicion that they are all at it, but one particular employee is "taking the p1$$"
Yes, see my comment above...............it seems to fit the bill?.............mind you, this could be something as simple as a personality clash. But the requirement seems to specifically deny one individual, whilst allowing the functionality to remain? I think the "policy" is something like "use it, but don't abuse it"? ;)Quote:
The fact that the company is now seeking a way to handle the situation indicates no policy is in place. As Ms. Mittens said, there is no law against this. Many companies in fact explicitly allow IM applications.
No, that is naive..............even the most moronic employee knows that you pay them to work, not spend your time in idle P2P chit-chat. If they are not aware that it is wrong, they should be doing nothing more complex than cleaning latrines, for which a PC and P2P applications are not required.Quote:
Any reasonable person will be a little put off by having their work environment changed without their prior knowledge in response to something that they didn't know was wrong.
Sounds like "typhoid mary" or whatever she calls herself these days has found a new job :eek: :D
Have you ever been to a real company?Quote:
No, that is naive..............even the most moronic employee knows that you pay them to work, not spend your time in idle P2P chit-chat. If they are not aware that it is wrong, they should be doing nothing more complex than cleaning latrines, for which a PC and P2P applications are not required.
I used to think this as well... my first revelation was about seven years ago when I was walking through a Lockheed-Martin engineering department. About half the employees were literally looking blankly at the ceiling or out the window, with no papers on their desk and no programs open on their computer. The other half was broken into maybe three groups:
1. Actively job searching.
2. Clearly personal phone calls
3. Other non-work related activities (including one manager who was actually developing his personal porn website that he had hosted on company bandwidth)
No, I am not making any of this up.
Your average employee falls into one of a few groups as well.
1. Good worker, works a solid nine hours everyday only stopping for a 45 minute lunch. These people usually have an IQ of about 80 and tend to be quite friendly.
2. Good worker who feels that so long as they finish all their work, they can use their time as they see fit.
3. Bitter worker who feels underpaid for the genius they really are and squander time as they see fit, barely achieving minimum goals.
4. (The most common) An overall good worker, who understands that company time is to be spent doing company work... but sometimes gets bored, or has trouble focusing, has personal business preoccupying them, or maybe they just feel unappreciated after being shunned by a superior, or maybe... just maybe they were having an off day where they just plain don't feel like doing work.
And back to the original point... with no agreed to policy... the work place becomes a totalitarian regime... where punishments are arbitrarily dealt on the whims of the managers. This makes employees uncomfortable, less productive, and more likely to jump ship. (Especially if they feel their employer finds them better suited to scrub toilets everytime they have an off day.)
cheers,
catch
Yes, and rather more than you have I would say :cool:Quote:
Have you ever been to a real company?
Lockheed Martin? I have worked in Aerospace and Defence, these organisations are contract driven..............no contract means no work, but the company accepts that..............they retain core staff to be able to bid for the next contract. These are not "real companies" in the 9-5 sense.
What we have here is a girl working in an office in the Phillipines............she sends stuff out to customers, which suggests sales order processing or customer support.
Where I obviously have far more experience than you is in the management of teams of junior staff. If you allow one of them to not pull their weight, this has a very detrimental effect on the morale of the rest of the team.
Introducing draconian "policies" is also bad management style as you are perceived to be punishing the team for the actions of the individual.
The manager's approach in this case seems to be to "ground" the individual.
Whether P2P/IM applications should be allowed in the first place is not the issue here...........the OP is looking for a way to prevent a particular individual from abusing the system.
Restrictions on the local OS through local or group policies and application level prevention through firewalls (depending on the firewall -- might be as simple as blocking access to a specific set of IPs related to IMing) as well as a verbal discussion about why it's not allowed might be helpful. I have seen environments that Catch describes and I do know that if you just go in and "slam the door shut" you end up with a "us vs. them" attitude. Not very conducive or productive, IMO.Quote:
Whether P2P/IM applications should be allowed in the first place is not the issue here...........the OP is looking for a way to prevent a particular individual from abusing the system.
BOFH is funny but I think in today's environment is necessary. Back in the 80s and early 90s only a handful truly understand the OS and there was a small percentage that use it. Today EVERYONE in the company uses a computer. It's to our benefit, IMO, that we get the user on our side. This can help in regards to troubleshooting, security related issues and just doing their job. I look at a classroom setting and see students regularly surfing and such (regardless of how interested they are or how much their mark depends on their attention to the subject at hand).
On the other hand, I've seen the other spectrum and that largely depends on the environment itself. Some environments with low morale seem to have more "surfers" while those with a tighter nit seem to have fewer surfers and more "true workers". For some environments a little surfing is ok. But I think it does need to be tempered.
It's that old common sense concept. ;)
How's that working out for you?Quote:
Yes, and rather more than you have I would say
Gee, no kidding. They were the most glaring example... and were working on a THAAD project at the time.Quote:
Lockheed Martin? I have worked in Aerospace and Defence, these organisations are contract driven..............no contract means no work, but the company accepts that..............they retain core staff to be able to bid for the next contract. These are not "real companies" in the 9-5 sense.
So much arrogance. Which of the four catagories of worker did I post that would not pull their weight?Quote:
Where I obviously have far more experience than you is in the management of teams of junior staff. If you allow one of them to not pull their weight, this has a very detrimental effect on the morale of the rest of the team.
Who said anything about draconian policies? I merely said that a policy should be in place so the user at least knows what is expected of them and what is not tolerated in as explicit a manner as possible. The policy may state: "Using Instant Messaging programs are fine so long as management feels it doesn't effect the quality or quantity of your work."Quote:
Introducing draconian "policies" is also bad management style as you are perceived to be punishing the team for the actions of the individual.
By not communicating with them? How is simply changing a user's work environment behind their back "grounding" them?Quote:
The manager's approach in this case seems to be to "ground" the individual.
The issue here is that management isn't clearly communicating to the user that they are doing something inappropriate. The user prolly figures that if they are doing their job (customer support or whatever) and still have time to chat, then all is well. Why should they think any differently?Quote:
Whether P2P/IM applications should be allowed in the first place is not the issue here...........the OP is looking for a way to prevent a particular individual from abusing the system.
Basically every single psychology and organizational behavior study indicates that people will act with a maturity level commensurate to the level shown to them.
cheers,
catch
A solution I've used before in a small network that didn't have any rules based solutions was to setup the machine as a static IP with no gateway set, and then restrict the user from being able to access the network setup. The computer can now function only on the local network.
Work Work Work
Job in the Philippines? Let me see… There should be a lot of scenario that I could visualize related to this during my working days back there.
Company 1 – there is this particular department (since I am working in a “Group of Company”), wherein they were just spending the remaining days of their work doing personal chatting in IM. But still they have this style of doing it during break-time (12NN-1PM) while the others sleep (including me). The point is, IM is actually allowed by the MIS Dept., since they use it to communicate with customers and other entities, but for personal use - should not be obvious. Because once the DEPARTMENT BOSS found it out, will screw them all perhaps.
In the scenario wherein the OP presented, I think the problem is (maybe), the BOSS catches the employee one time of doing IMing while waiting for a very important report that is URGENTLY needed. The employee is VERY important to the BOSS since she is capable of doing the JOB (that is why the BOSS don’t want to TELL to STOP IMing directly or personally because maybe the EMPLOYEE will think of this approach as STRICT and may change the attitude of EMPLOYEE including the TEAM once directly told that it is prohibited. The fact is EMPLOYEES are VIGILANT and reacts very NEGATIVELY especially if there are no known POLICIES aside from, let’s say START - DO YOUR WORK - FINISH IT – STOP.
Company 2 – In my last company there that I am working, IM is allowed again. I think the question falls in the ABUSE section. We are in the TECHNICAL SUPPORT environment and IM comes in handy especially when we have SATELLITE OFFICES and PEOPLE on the move. We use IM primarily to communicate with our MOBILE TEAM. FROM-IM-TO-CELLPHONE type of communication. It is FREE and very USEFUL in a fast-phase environment. But about ABUSE of use, we have a RULE for that one. Before we use specific services and facilities in the workplace, the ADMIN should know it. PERSONAL reasons can be tolerated as long as it is not ABUSIVE. Who will decide? Think of it as a mutual understanding between each member of the team. WORK-LOAD is one factor, since we are people on the move, staying in chat for a long time may never occur. Phone ringing here, server needs to be checked there, need to assist the DB ADMIN. Keep the employees busy while enjoying their type of work could solve the issue. The reason why they are there is work. And the reason why they use IM should be related to work.
Company 3 – My job here in KSA. As a secretary, I am allowed to use IM. Even the BOSS see me chatting with our supplier about important matters. The use of such service falls again to the ABUSE section.
In one-way or the other, the BOSS should re-think of the ideas about preventing EMPLOYEES about such SERVICE. If your company is customer-service oriented, perhaps having a POLICY about using the Internet or IM should be moderated but not prohibited. IM could be of use the same way we use it in our company. You can also present to EMPLOYEES about being aware of using IM or the Internet. A good presentation as well as the goal of not abusing such would enlighten them (not scare them). As an Admin, it is your primary goal to secure the network. IM could be dangerous if not properly used.
And at the end, remember that WORK is still WORK, abusive employees even though they are considered as assets could jeopardize the company’s operation if they continue to abuse something.
Yo!
Hmmm?
Just fine thanks............the time I spent as an auditor has given me a very broad experience...........of which I would seem to have some 27 years more than yourself?Quote:
How's that working out for you?
My comments have the intent of demonstration that a "Fortune 500 Company" is not the only approach, and is certainly not appropriate in all circumstances or parts of the World ;)
Glad I don't have any stock...............you do not have a hope in hell of getting the JSF............can I sell you a few Eurofighters :D OH! if your date of birth is correct in your profile, you would have been 21/22 at the time.................fresh out of college and full of "textbook"?Quote:
Gee, no kidding. They were the most glaring example... and were working on a THAAD project at the time.
Errrrrrrrrrr "experience" is spelt just like I have there.............I don't accept your categories............they are gross oversimplifications. When you have worked in countries and amongst cultures different from your own you may well appreciate this?Quote:
So much arrogance. Which of the four catagories of worker did I post that would not pull their weight?
Not all practices are based on formality.............in some environments and societies people actually respect eachother..........they become displeased when this trust is abused?Quote:
Who said anything about draconian policies? I merely said that a policy should be in place so the user at least knows what is expected of them and what is not tolerated in as explicit a manner as possible. The policy may state: "Using Instant Messaging programs are fine so long as management feels it doesn't effect the quality or quantity of your work."
WE have no evidence of communication or lack of it? WE are BOTH speculating?Quote:
By not communicating with them? How is simply changing a user's work environment behind their back "grounding" them?
Comment as above..................if you cannot do something all of a sudden, that might be a hint? and if you are not doing anything that different from your colleagues, you will know, and so will they.Quote:
The issue here is that management isn't clearly communicating to the user that they are doing something inappropriate. The user prolly figures that if they are doing their job (customer support or whatever) and still have time to chat, then all is well. Why should they think any differently?
Apart from a boss/employee personality clash (a very real possibility I suppose?) I think that this could well be a "softly, softly" management style.
;)
I am having difficulty comprehending that you feel no policy is required and the organization should just fly by the seat of its pants.
Whenever management has an issue they should just arbitrarily use technological means to impose their will upon the employees?
You are not going to change my mind on this subject... having a policy IS a best practice!
I guess we agree to disagree.
cheers,
catch
PS. Is RISC an OS? ;)
In the UK it is :)Quote:
PS. Is RISC an OS?
http://www.jellybaby.net/rougol/riscos/index.html
Although I am well aware that it originated from a processor design concept (Reduced Instruction Set) :p
Actually we don't :eek:Quote:
I guess we agree to disagree.
Absolutely, totally, utterly, unequivocally, .............(can't be bothered to get my Roget's Thesaurus), CORRECT!Quote:
You are not going to change my mind on this subject... having a policy IS a best practice!
My "arguments" as you probably see them, are not based on best practice..........rather:
1. We have an existing situation
2. The country and culture are not our own.
3. "When in Rome, do as the Romans do"
In other words they are more "observations"