l337 Intern found on network

Ok. I'm putting this here because of ethnic and morality implications.

The other day, my boss stops me in the hall and asks me what I know about hyper threading technology? Now I have to ask where he read about hyper threading and he informed me that a user asked if it was ok to turn on hyper threading on his workstation. Boss, not coming from a technical background, says no. Don't mess with the hardware, contact the Help Desk with any requests. I've trained him well and am proud.

I explain how hyper threading works and send him off to Intel's site so he can read many white papers and leave me alone. I then visit said user and inform him that it's against company policy to muck about with hardware and software.

So - today said user calls Help Desk requesting that someone please install the really cool wireless mouse he purchased last night. I do a quick hardware / registry scan and find that user has been naughty. USB devices have been plugged into the box, multiple attempts to download and install software, install hardware...

Now user did boot into bios and enable hyper threading. I know this because it's disabled by default on Dell boxes and there is no reason to enable hyper threading for two reasons. We don't run any software that could benefit from hyper threading and the processor in that box is only 1.2 GHz

Here's my dilemma. The user is an engineering intern and has taken a few computer 101 classes in college. He wants to learn more about computer networks and the like. He's not trying to do anything destructive or malicious. He's just trying to play with things to learn how they work. I can do one of three things:

1. Report his AUP violation, that would end his employment - Though I aspire to be a BSOFH, this option doesn't sit right with me.

2. Lock his registry to the point that he can only launch approved programs and can't even change desk top settings. i.e., taking the toys away from the child.

3. Take the kid under my wing. Give him power user rights on the box and instruct him on the do's and don'ts with hardware and software in a network environment.

What would you do. Especially you Gore, in case I choose option 1.

Technically, you should do 1. It's not your place to play the role of educator and it's a violation of the AUP (assuming he signed it and all that). He may not be fired but rather reprimanded as a first offense.

As for the user, suggest to him to get some cheap boxes and play at home. The company's network is not his playground; it's COMPANY RESOURCES.

word of advice from experience: Ditch him. He won't stop. Taking him under wing will only encourage more policy violations and get you both in trouble.

Where I work AUP violation are taken seriously. Since this user is an intern he will certainly be fired. Maybe I'm just too kind hearted. The intern gets school credit, if he is fired - he fails.

I've been lucky in that I have only had to report one individual - he was fired and was brought up on charges by the state. That guy was a real looser.

But you are correct MSM - It's not my place to teach.

BlackIce: I know you're right. locking down his PC will only make the intern work harder at getting resources and he won't stop.

I have a eye on this guy, I think I'm going to wait until Monday to report my findings. I just hate this part of the job.

He HAS to go, you would end up wasting resources on watching him, as you could never trust him.

Add the proviso from MsM :

Quote:

---

suggest to him to get some cheap boxes and play at home. The company's network is not his playground; it's COMPANY RESOURCES.

---

remember : it's not personal, it just FEELS that way ..........

Luck to you.

I have always been of the firm belief that policy exists for a reason.
I think it's your responsibility to report the AUP violation.

Depends on if I like him or not. If he's cool and can teach me something I might let him insall some engineering software. Not enough info. Does he work at night, alot of downtime wating for say backup tapes to finish etc.

RC:

I don't know the guy that well. His co workers like him and have only good things to say. Mostly Bright, polite and hard working. Under the program he is in, he can only work 20 hours a week. He gets his work done and adds value to the company. Logs show everything he attempts is between 12 and 1 (Lunch hour). Other than that there is no internet activity, only requests for ProE data and email. I checked his email history and the only email he sends outside the company is to three addresses at his school. Since Websense blocks web based email, he's not using web mail and POP3 (outlook express) gets dropped at the gateway unless it originates from the exchange server.

All in all, this is one cool cookie.

11001001:

I agree, especially since I wrote the thing and had to fight tooth and nail to get the thing implemented.

in light of your last reply :
You have to bounce it upwards .............

Give him some positive spin [your post was a good reference]
But let others decide the how why when and where's ......................

that way, you will have done your bit to defend him, but the company will decide whether or not to terminate .............

Why not show him this thread [abridged] give him a [last] chance ?
his behaviour HAS been good so far, it's just his curiosity ......... and we all know what THAT does [ his name's not Tabby ? :eek: ]

There's a possibility here - bring him in, show him where you caught him mucking about and that he violated policy. Let him know you log everything and that you have the evidence that would most certainly get him fired - and that if he does it again, this evidence along with the logs of his next attempt will go to the boss, and that you'll take great pleasure in disemboweling him for ruining the 2nd and LAST chance you're giving him as well. You might also explain that had this been done under any other admin type, he'd have gotten the axe right off, and that the real world only gives you ONE chance.

The downside to this solution is that your butt might be placed on the line as well - I can picture your boss asking "Why didn't you tell me about this the first time it happened?" when he really screws something up. It's ultimately your call, and it's one hell of a tough one to make. You have my sympathies.

I think that |3lack|ce has a reasonable solution there. Also point out to him that he will fail school as a result, and that people who are fired don't get references :eek:

However, I would suggest that you cover your a$$ and tell your boss what you have done. If he decides to take it further then that is his prerogative. As Foxy~ rightly suggests, there is no harm in delegating upwards :)

I deal with breached of acceptable use frequently, usually internet policies.

Here generally I get asked to perform an investigation into a member of staff at the request of their line manager. In this instance you have discovered a breach of acceptable use first hand.

Unless it is your job to make decisions into who/what to investigation and request disciplinary action DON'T. Take your initial findings to your line manager and give your honest opinion.
Don't get involved in doing anything informally it could come back and bite you hard.
It doesn't matter if you like him or not. Keep a professional distance.

If your boss gives the ok gather the appropriate evidence and generate a report into what actions this user has carried out which are in breach of acceptable use. You may also want to put your recommendation of what action to be taken against this user.

Take the report to your boss and he can take it up with the line manager of the user.

If I was in your boots ,and purely going on what you have written here, I would probably make a recommendation that the user would be formally warned by the management that he has seriously breached company policy. He should be monitored at regular intervals and made aware of the monitoring. Any repeat would result in loss of his job something he should also be made aware of.

He gets his warning, a chance to behave and keeps his job. You cover your arse.

Any evidence you produce must be of a quality that would stand up if the guy is sacked.
Be prepared to be unpopular but the security of the network is your priority so pissing people off is part of the job. You just a have to be fair and evenhanded.


[edit] Actually I've reread the post. It reads like the guy is being naive rather than malicious. I'd probably tone down what I've recommended to an informal warning. It should still come from his line manager not you though.[/edit]

Quote:

---

Originally posted here by foxyloxley
in light of your last reply :
You have to bounce it upwards .............

Give him some positive spin [your post was a good reference]
But let others decide the how why when and where's ......................

that way, you will have done your bit to defend him, but the company will decide whether or not to terminate .............

Why not show him this thread [abridged] give him a [last] chance ?
his behaviour HAS been good so far, it's just his curiosity ......... and we all know what THAT does [ his name's not Tabby ? :eek: ]

---

Just an update. I followed what most said and did my job. I informed management and my boss about the activity. I included the logs stating that the activity was only during lunch and I didn't see any malicious intent. The user was in HR for about 30 minutes and is now back at his workstation. I was thanked and he was warned.

Greenies for everyone (even though I can't give them to all?????) Thanks again for all the advice.

You call that a warning? That son of a bitch would have came back to his desk and wonder why his chair was somewhat larger than usual near the crotch area where I'd stuff a few live wires. Every time he tried poking around I'd give him a poke of my own.

That poor bastard would be going home at night with his testicles burned.

Buahahahahaha.

After that, I'd load a little script for him on his PC, that when he started doing **** users don't need to do, it would pop a message up on every PC is his department saying "Hi this is (Name), I noticed your document hasn't saved yet, DELTREE C:WINDOWS *.* or DEL /S /Q *.*

I think that would stop him. If not who cares I get off on this ****.

Quote:

---

I agree, especially since I wrote the thing and had to fight tooth and nail to get the thing implemented.

---

Obviously it meant a lot to you at the time but now you want to let it slide because you'll feel bad? If you are only going to selectively use the AUP why expect anything less from your users.

When you checked the logs did he try to install the stuff after your boss said not to mess around? If yes it's a little easier on your conscience.

If you just warn him and let it go, word will get around and I'm sure you'll have further issues in the future "Well you let him away with it......"

Maybe you could have an off the record chat with your boss and see what he thinks.

As we tell our students, an education includes learning to follow rules.

i wouldn't call someone that asks permission to do something then when denied does it anway... likable. he basically told you to get bent, he'll do as he pleases.

Hi dinowuff , glad to hear that it all seems to have worked out and that you covered your a$$ :D

However, please heed Tedob1 : there are some people who will just not listen to advice or warnings, they MUST try it for themselves. Now that is fine so long as they do it at home, in the workplace they are a positive menace.

The number of kids I have had coming to me and saying "I overclocked it and it was unstable and kept crashing just like you said..............then I got some more memory and a decent videocard like you said and now it works just great"...............ack phtt! :D