This doesn't really solve your "shared login" problem, but I was always a
big fan of using the DeepFreeze software on shared computers. It does a
fantastic job of preventing those changes you were talking about from
"sticking" -- especially if you force a reboot after logout, which isn't
too hard to create a logout script to do that.
https://www.faronics.com/deep-freeze-on-cloud
--Ray
On Thu, Dec 14, 2023 at 9:36 AM Hammer, Erich F <[log in to unmask]> wrote:
> All,
>
> First, I apologize because this is much more of an IT question than a
> coding question, but I come from an IT/desktop support background with a
> particular interest in security.
>
> How are larger, academic libraries securing your employee-used, shared
> workstations -- specifically, the circulation desk machines and the
> back-end, ILL scanning stations? I have been trying mightily for a few
> years to eliminate the shared-password generic accounts because they
> present a real security/privacy concern. I am running into some real
> road-blocks though, and I'm wondering if anyone here has found solutions
> that work.
>
> Having viewed the chaotic state of the circulation desk with the constant
> churn of employees using the stations, I have conceded that it is better to
> use a generic login than to have folks log in/out constantly.
>
> The ILL employees who do a lot of scanning don't have the rapid-fire
> turnover at their workstations, but they (or their manager) is insisting on
> a generic login because the scans need to be saved in a specific, network
> location and Acrobat has no mechanism to set the default save location for
> all users. (I hate Adobe!) When we have tried using personal logins,
> folks forget, don't notice, or don't know about watching that the PDFs are
> saved in the proper location, and those scans have to be redone by someone
> else or are inaccessible within the particular employee's private user
> profile until they return to work (which could be days-weeks with student
> employees).
>
> In both cases, users still need to sign into services as themselves (the
> LSP -- Alma --, scheduling, wiki documentation, ILLiad, etc.), so I'm not
> really sure what the security advantages are with the generic account
> (especially for ILL scanning). I've had to push settings to prevent the
> browsers (Edge, Chrome and FireFox) from saving passwords. I also have
> automated scripts running to regularly blow away the MS Teams configuration
> to prevent users from using it as someone else. (Teams "helpfully"
> remembers credentials for one-click login even after logging out of it and
> rebooting.) I have not been able to find a way to do the same with MS
> Office, so I have been forced to uninstall it completely. Otherwise,
> everyone who uses it while logged onto the computer with the generic
> account is signed into/owns all the M365 documents as the user who first
> used it (and had to sign into M365).
>
> The lack of Microsoft Office is the particular issue that I'm being
> pressed on to prompt me to post this. I should add that I can't use device
> licenses for M365 (where login/registration isn't required) because they
> only work with Azure Active Directory which we do not have. What are you
> all doing? I've been considering trying to set circ desk systems up as
> mulit-app, auto-login kiosks so at least we don't need to share the generic
> password, but the other problems still remain.
>
> Any feedback is appreciated.
>
> Thanks,
> Erich
>
>
>
> --
> Erich Hammer Head of Library Systems
> [log in to unmask] University Libraries
> 518-442-3891 University @ Albany
>
> "Faith is the unflagging determination to remain ignorant
> in the face of any and all evidence that you're ignorant."
> -- Shaun Mason
>
--
*Ray Voelker*
Integrated Library Systems Administrator
Mobile phone: (937)620-1830 <+1937-620-1830>
Office phone: (513)369-4583
E-mail: [log in to unmask]
Cincinnati & Hamilton County Public Library
800 Vine Street Cincinnati, Ohio 45202
*For Minds of All Kinds*
CHPL.org <https://chpl.org/>
|
