 |
 |
Kaleb, I have been considering those very suggestions. I'm trying to find out if the ILL file location is the ONLY issue with separate accounts, and I agree that if it is, a shortcut or symlink should be an acceptable solution. It's not entirely up to me, but I'll certainly argue for it. ☺ Thanks, Erich On Thursday, December 14, 2023 at 11:20, Sove67 eloquently inscribed: > Hi Elrich, > > Can't say I have any wisdom on securing shared workstations, but that might > not be the path of least resistance here? > > If the ONLY issue with seperate accounts is saving in a specified location, > there are a two ways I can think of to automate that. > > The easy: Create a shortcut to the correct saving location inside the > default saving location. Users will need to double click each time the save > system kicks them back to the default (which sounds like once-per-session) > > The advanced: Create a symlink ( > https://www.howtogeek.com/16226/complete-guide-to-symbolic-links- > symlinks-on-windows-or-linux/) for each user, between the default > prompted save location, and the desired save location. This way, any > files placed in either place should show up in both places. Think of it > like knocking down a wall between two storage rooms. > > Of course, if there are other reasons your library needs this generic > login, this won't address them. > > Best of luck with your setup! > - Kaleb A (Langara LIT Student) > > On Thu., Dec. 14, 2023, 6:36 a.m. Hammer, Erich F, <[log in to unmask]> > wrote: > >> All, >> >> First, I apologize because this is much more of an IT question than a >> coding question, but I come from an IT/desktop support background with a >> particular interest in security. >> >> How are larger, academic libraries securing your employee-used, shared >> workstations -- specifically, the circulation desk machines and the >> back-end, ILL scanning stations? I have been trying mightily for a few >> years to eliminate the shared-password generic accounts because they >> present a real security/privacy concern. I am running into some real >> road-blocks though, and I'm wondering if anyone here has found solutions >> that work. >> >> Having viewed the chaotic state of the circulation desk with the constant >> churn of employees using the stations, I have conceded that it is better to >> use a generic login than to have folks log in/out constantly. >> >> The ILL employees who do a lot of scanning don't have the rapid-fire >> turnover at their workstations, but they (or their manager) is >> insisting on a generic login because the scans need to be saved in a >> specific, network location and Acrobat has no mechanism to set the >> default save location for all users. (I hate Adobe!) When we have >> tried using personal logins, folks forget, don't notice, or don't know >> about watching that the PDFs are saved in the proper location, and >> those scans have to be redone by someone else or are inaccessible >> within the particular employee's private user profile until they return >> to work (which could be days-weeks with student employees). >> >> In both cases, users still need to sign into services as themselves >> (the LSP -- Alma --, scheduling, wiki documentation, ILLiad, etc.), so >> I'm not really sure what the security advantages are with the generic >> account (especially for ILL scanning). I've had to push settings to >> prevent the browsers (Edge, Chrome and FireFox) from saving passwords. >> I also have automated scripts running to regularly blow away the MS >> Teams configuration to prevent users from using it as someone else. >> (Teams "helpfully" remembers credentials for one-click login even after >> logging out of it and rebooting.) I have not been able to find a way >> to do the same with MS Office, so I have been forced to uninstall it >> completely. Otherwise, everyone who uses it while logged onto the >> computer with the generic account is signed into/owns all the M365 >> documents as the user who first used it (and had to sign into M365). >> >> The lack of Microsoft Office is the particular issue that I'm being >> pressed on to prompt me to post this. I should add that I can't use device >> licenses for M365 (where login/registration isn't required) because they >> only work with Azure Active Directory which we do not have. What are you >> all doing? I've been considering trying to set circ desk systems up as >> mulit-app, auto-login kiosks so at least we don't need to share the generic >> password, but the other problems still remain. >> >> Any feedback is appreciated. >> >> Thanks, >> Erich >> >> >> >> -- >> Erich Hammer Head of Library Systems >> [log in to unmask] University Libraries >> 518-442-3891 University @ Albany >> >> "Faith is the unflagging determination to remain ignorant >> in the face of any and all evidence that you're ignorant." >> -- Shaun Mason