Help Decide on the next Feature Set!

Coordinator
Jul 14, 2010 at 7:35 PM
Edited Jul 14, 2010 at 7:37 PM

Hi!

We have narrowed down the next feature list into something we can accomplish.  However, we need feedback from System Administrators on what they think the best implementation of some of the features will be.  There are obviously some feature requests that are open as part of this however we wanted people to be able to provide feedback on what the end product will look like.

1. Adding new Employees

A couple of things we are struggling with here.  First is how the username should be picked for the new user.  Obviously there are lots of other formats and options and more importantly opinions on how usernames should be formed.  Below is our list we plan to offer:

  • <First Initial><Last Name>
  • <First Name><Last Name>
  • <Last Name><First Initial>
  • <First Initial><Middle Initial><Last Name>

Are there others?  Are there some that are pointless?

We made the decision that new users would be created in the default AD location.  After all someone in HR will not know what an AD Tree structure looks like anyways.  We figured it was better to create the user based on the information someone in HR submitted and then notify the administrator who can then move the user to the proper OU and assign group permissions which uManage is not going to do.  The argument was that the departments could be used as the OU indicators.  For instance if someone was in a department called "Sales" it could be mapped to  the OU called "sales".  We decided that this implementation if we decide to do it will not happen until a future release.

2. Managing Existing Employees

A few things here too.  First, there may be some user accounts that HR employees should not be able to manage or modify, like administrative accounts or service accounts.  The only possibility we can think of for this one is to create a AD Group as part of the install process and only members of that group can be managed, however all employees can ALWAYS manager their information.  The only problem here is that someone will need to add every single employee to be managed to the AD Security group.  We are looking for opinions from the uManage community on this one.  Do you really care if someone in HR can reset the password to a service account, especially since everything is logged?  If so does our solution sound like a good balance between restricting the changes to a user account while still reducing the burden on someone in IT?

The plan is to allow anyone who can access the admin portal to Reset passwords, unlock locked accounts, and re-enable accounts.  Objections? Missing anything?

Think that is all for now.  Thanks for the feedback!

 

Jul 14, 2010 at 8:55 PM

Hi!

Where I work, we use the username format <First Name>[space]<LastName> - I wasn't sure if the space was implied above :)

Creating new users - is it possible to select an existing user as a template? For example, to copy group membership. and populate some info that would be common (such as the Address)?

Managing existing users - I like your idea of using a security group to define which users can be managed. I would hate my HR guy to 'accidentally' change a system account! Where I work, users are already into departmental groups, so for us, we would simply add those groups to the uManage group et viola.

Awesome work! I look forward to the new features.

Kind regards,

 

Geoff

Coordinator
Jul 14, 2010 at 11:07 PM

Geoff,

Interesting ideas.  I had never heard of anyone using the <First Name>[space]<Last Name> format.  Anyone else use this one?  Glad to hear you haven't run into any problems with AD choking with the space, especially with the UPN format.

As for creating new users from a template copying the group memberships may be a little complicated at first.  We had the notion of having a "company profile" so when new users are created the base address is filled in as well as the company name and phone numbers.  Is this a fair compromise?  We would have to look at group memberships at a later time.  Again, trying to put ourselves in the mindset of an HR employee who just needs to enter base information in.

What you said makes sense.  I guess the simplest solution for admins will be to add the Domain Users group to the uManage group.  The only issue there is I suppose some people setup service accounts to have the domain users right.  If we do set it up with the uManage group more than likely the person doing the setup will need to configure AD after running the installer to add the users to the new group.

Aug 11, 2010 at 12:51 PM

Some companies use <First Name><dot><Last Name> or something like that. What about letting the admin create templates, then they can customize it however they want. For example, you give them a list of availible variables <First Name>, <First Initial>, <dot>, <underscore>, etc. Then the admin can choose how to setup user accounts.

As for managing users, maybe it would be possible to determin who the user is a manager of from the AD attribute. Then a manager can go in and modify their direct reports.

I have lots of ideas I would love to help out with, maybe I will contact you guys about participating.

Eric Jensen