Re: New employee, same computer -- what to do?

Thanks, see my comments below.

"Oli Restorick [MVP]" <oli@xxxxxxxx> wrote in
news:#eDOeL9QGHA.5116@xxxxxxxxxxxxxxxxxxxx:

Hi there

"DWalker" <none@xxxxxxxx> wrote in message
news:eh14Cj8QGHA.2536@xxxxxxxxxxxxxxxxxxxxxxx
By "local account" I mean there is a local username that is created
when the computer is set up... When you first install Windows (or
turn on an OEM computer for the first time) it asks you for "your
name". Doesn't that name become a local logon? There is a list of
users who are allowed to log on to the local computer, and that's
what I meant by local account. Don't you HAVE to have a local
account? Maybe my terminology is wrong (I am a programmer but I
don't have formal network or AD training).
The only local accounts you have to have are administrator and guest
(the latter is disabled by default). When you set up an XP machine to
be part of a workgroup (rather than a domain), you are taken through a
wizard that asks you to create local accounts. If you join the domain
during setup, you don't get this. If you are prompted to create user
accounts, just create a dummy one and delete it when you're joined to
the domain.

It is not considered good practice to rename user accounts to deal
with peopel coming and going. I have never heard of people doing
that before.

Never? No one does this? Not even in small companies?
Never seen anyone do it in practice.

How do you name your computers?
Personally, I use the asset tag (serial number) of the machine as its
names. Other naming shcemes I've seen are based on location. For a
small company, how about naming machines after something abstract
(e.g. moons of Jupiter), cartoon characters, or something like that?

When giving permissions to various resources, use groups. As a
general rule (home directories being the exception), never assign
permissions on a resource to a user directly. Give a group (e.g.
"Marketing department") permission to a resource, and make the
relevant users a member of that group.


There are 7 people in the company; everyone does marketing; and
basically everyone has an occasional need to see files stored in the
various subfolders on the one shared directory on the server. So we
don't make big use of groups. Maybe we should, and everyone does
have a good domain logon password, but everyone has access to all the
shared files on the server. (That is, we actually do use groups, and
everyone is a member of the one group.)
In which case, there's no real need to rename user accounts to ensure
people have access to the correct resources, since everyone pretty
much has access to the same things.

We have always named a computer after the user who is sitting in
front of it. Usually the user outlasts the computer (the employees
have generally been here 10+ years, while the computers last about
three). I didn't know of any other logical way to assign things; as
I said, when I have reinstalled Windows on a computer, it asks "what
is your name" so I gave it the user's name, and that became (I think)
a local logon. There is also a domain logon for that user.

I want to preserve the icons on the desktop, as I mentioned before,
and those seem to change when you log in and out using different
names.
This is always an issue when people want to migrate from workgroups to
domains (or in your case a hybrid kind of setup).

So bottom line, the computer is *currently* named after the previous
person who sat in front of it. I really can't go back in time and
change that. Now, I would just as soon name the computer after the
new person who is sitting in front of it, so that we know that it's
Jane's computer when we see it in network neighborhood, or want to
connect to it to use her label printer, or whatever. That's the
easiest and most logical way to name a computer, it seems.
It can be, but then you come up against issues where people come and
go. It's a compromise.

In bigger environments where you never hang printers off the back of
PCs, and have better processes to keep track of machines, the computer
name is often irrelevant.

Even if I decided to no longer name it after a person, but instead
want to call the computer and the logon Reception or whatever, I
would still have the same question. How do you rename a computer and
change the local logon and preserve the icons on the desktop and the
files in the My Documents folder?
Renaming a computer doesn't affect user settings.

I am not so concerned about getting access to the
domain resources (the one shared folder); I know how to do that.
(The important files are on the server, but a few not-so-important
files are in My Documents, which is local to the computer, and I
would like to keep them there.)
I hope they're being backed up regularly.

So probably we have done things non-optimally, but now that things
are the way they are, how can we rename the computer and the logon
and keep the icons and local documents?
Renaming the computer isn't an issue in this regard. Just go ahead
and rename it. Of course, if you have printers and other things that
are shared, there will be a bit of trauma as this changes, but with
only 7 PCs it should be fairly easy for your people to work things
out.

I would, however, recommend that the way forward is to dispense with
the local accounts and just use domain accounts, certainly for any new
employees.

Regards

Oli




Thanks for the suggestions.

Let's see, I want to print to the $100 label printer, which *is* hung
off Mary's computer, since she uses it 90% of the time, and so it needs
to be within arm's reach of her, and we didn't want to buy an Ethernet
printer adapter for a $100 label printer, nor did we want to install a
separate computer just to run a $100 label printer. So it's on Mary's
computer. Now what's her computer called again? Was it Europa? Let's
see what shared devices Europa has. No, not there. Maybe Callisto?
Yes, that's it! Stupid IT department, it would have made more sense for
them to name the computer Mary so I could find it!

I wanted to:

Rename a computer so that user A is not logging on with user B's name.
And make sure that this renaming process would not affect the computer
desktop and icons. In your zeal to criticize the way we have done
things for 8 years, you didn't say much about that part of my question
or answer how to avoid the problem.

Rename a computer and also have the folder path name inside C:\Documents
and Settings\Whatever change to the new user name, just so we don't have
folders named after former employees. You also didn't address this part
of my question.

Another company I work for (as a programmer, not as a network admin) has
180 employees, and their computers are named after the users who are
there, mostly so you know who to VNC into when you are helping them with
a problem. If the computers were named after asset tags, using VNC
would be one hella pain.

Your suggestions are noted, but I don't see any answers to my questions.

David Walker
.

Relevant Pages

  • Re: New employee, same computer -- what to do?
    ... The only local accounts you have to have are administrator and guest (the ... "Marketing department") permission to a resource, ... good domain logon password, but everyone has access to all the shared ... there's no real need to rename user accounts to ensure people ...
    (microsoft.public.windows.server.active_directory)
  • Re: Re: How to allow any domain user to logon to a XP Pro PC
    ... Server or advanced server and you create a domain by using DC promo ... (goes with logon hours). ... Local accounts should be limited to only those that need to be there - ... ie best case scenario -- local administrator. ...
    (microsoft.public.windowsxp.security_admin)
  • lsass.exe takes cpu times for a few minutes
    ... I posted this to security and administration group, but I had only one response so far. ... When I logon to my XP Pro box, the logon process runs very slowly. ... And when I logon to the box with other local accounts, ... I was advised to install and scan spyware, ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: avoid set password prompt/Elem. School
    ... unless these pc's are not part of a domain and have local accounts on each ... > Obviously the user accounts have been setup to ask the user to change ... > password the first time they logon. ...
    (microsoft.public.win2000.security)