Re: User authority controls

Are you using grpprf's, autl's, both?   
 
-----Original Message-----
From: mcunning@xxxxxxx
To: midrange-l@xxxxxxxxxxxx; midrange-l@xxxxxxxxxxxx
Sent: Fri, 16 Mar 2007 3:10 PM
Subject: RE: User authority controls


This sounds like exactly what we are doing, trying to figure out what HR is 
doing. We give ourselves notice of a title change but right now our network 
admins don't do anything with it because they say they don't know what to do. 

From a title change they can't tell if the person actually changed jobs or 
not. 

When you say you "take appropriate action" is that calling someone to find out 
what happened and then making whatever changes are necessary? 
 
p.s. In order to be sure thet SSMITH is  Sally Smith and not Sam Smithfield, We 
created a cross reference table that mapped userid to an employee number so we 
don't have to guess what two go togeather. We scan all userids weekly and look 
at the linked HR records and see if the person is still employed just as a 
double check of the e-mail notifications our HR office sends out. We also do 
the 
opposite and scan HR files and look for active emplyees who don't have accounts 
(in our standards all employees get an account) and report those as problems 
also. Sometimes (rarely but it heppens) the HR notification of a new hire does 
not come out until after someone has been at work for a week or more. We are 
also scanning Active Directory LDAP accounts to match them up to iSeries 
userids 
(standard is both userids will be the same) and HR files and tell our network 
admins what accounts they should disable/delete.

________________________________

From: midrange-l-bounces@xxxxxxxxxxxx on behalf of Roger Harman
Sent: Fri 3/16/2007 2:14 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: User authority controls



When I started here, they used the concept of naming a user profile by
the job type.  I converted to using names a few years ago and everyone
has loved it.  Besides matching the network & email naming, it just
makes life easier.   Can you remember who RMBY11 (Retail Merchandise
Buyer #11) is?  I can't, but I can easily know who SSMITH is.

As to job changes....  we run a SQL report over the HR transaction
database nightly.  We look for job code changes and cost center changes
and match the name to user profiles.  If we get a hit, we take
appropriate action.  The job change may have no effect on their access
or we may disable the profile if they've moved, say, from Merchandise to
Foods - particularly important for Time & Attendance access.

BTW... we also run a daily termination list and match it to user
profiles (iSeries and network) and disable those.

We review both manually since there is a good possibility of false
positives - SSMITH user profile may be Sally Smith but it was Sam Smith
who left the company.  I hope to improve the process by adding a
notation for computer access to the HR record to eliminate the false
positives - track it like we do special licenses, company issued
property, etc.

mcunning@xxxxxxx 03/16/2007 8:30:15 AM >>>

We have a good handle on authority setup for new employees and on
removing authority for  employees who are leaving. What we struggle with
are those employees who change jobs within the college. Sometimes those
are people leaving one department and going to another, sometimes those
are people just getting a title change. Our HR office is very good at
telling us who new hires are and who is leaving but not so good at jobs
changers. I am curious to know how you handle these people from an
authority control perspective. One idea we had was to look for any title
changes and treat them as if they left the college and are coming back
in as a new employee. Disable their account and revoke all authority
then grant just the base level of authority to the new job until we hear
from that persons new supervisor. Of course this then requires going
into all the systems where mcunning has an account and disabling it.
Another thought was to stop creating accounts based on someone's name
but use their position instead. So my userid would not be MCUNNING but
ITSDIR. ITSDIR is granted authority not MCUNNING. When MCUNNING changes
jobs the ITSDIR account would be disabled and my new job account would
be enabled. When the new ITSDIR comes on board we reactivate that
account. We use to use this method a long time ago but our users
revolted because it is sometimes very hard to turn a title into 10
characters and have it make sense. Try coming up with 10 characters for
Director or Desktop  Computing/Academic Computing/Media Services.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.