7

I've been hired at a smallish company to be the sole sysadmin. I'm supposed to take over, among other things, responsibility for Active Directory. I've had a look at the current setup, suggested a few improvements and said I'd need a dedicated administrative account within the Domain Admins group with an explanation of why I'd need it and what it would be used for.

Bossman gets visibly worried and asks if I'd also have access to a file share with some confidential employee documents. "Not explicitly, but being the administrator I could grant myself the necessary permissions", I explain. Bossman says I need to figure out some sort of process to make sure any administrative tasks get supervised by a manager.

I honestly find this approach quite offensive. I can understand I'm new and he doesn't know me, but he hired me to do precisely THIS job and I am after all an experienced system administrator with excellent references!

Does anyone have any experience working in such an environment? Should I get worried about my future here? How can I get my boss to trust me with the tools I need to do my job?

Please note I don't work for a government/defense/security contractor, there's currently no legislation requiring me to be supervised and the company does not handle PII except for that of it's employees.

closed as unclear what you're asking by paparazzo, Mister Positive, gnat, mcknz, Lilienthal Mar 10 '17 at 19:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    I think you may want to explain to your new bosses what it is that a sysadmin does. A manager won't be able to tell what the heck it is you're doing even if they did have permissions that were equivalent to yours. That's the point of you being a trustworthy person. Sigh. – AndreiROM Mar 10 '17 at 15:05
  • 1
    Even with supervision, if you wanted to do something sketchy you'd most likely be able to find a workaround... I'd reassure them that everything's gona be fine and just carry on doing my job. – Иво Недев Mar 10 '17 at 15:11
  • 2
    Is Bossman comfortable letting an unknown number of unknown workers at the MSP have unrestricted access to the file share with the confidential payrolls, personnel files, and whatever? – A. I. Breveleri Mar 10 '17 at 15:13
  • 1
    Don't take it personally, and don't get offended - many people are surprisingly ignorant of what power and access a sysadmin really has over information in a company like yours - and you're probably replacing the guy who set it all up, so no-one knew he had access. But down with your boss and explain why you need such access, and that sysadmin all over have similar access, and then take great pains not abuse it. – HorusKol Mar 10 '17 at 15:14
  • 3
    Cross posting is discouraged. You have way more tech stuff here than is needed for the workplace aspect of the question. – paparazzo Mar 10 '17 at 15:16
5

I basically agree with jbh's answer, but would go a bit further.

Your attitude should be "I'm a professional sysadmin. I use only the minimum privileges necessary to do my job and keep things working. I will be able to deal with problems sooner if I don't need a manager to supervise me. However, I understand I'm new here and it will take time for you to learn to trust me."

Embrace the supervision. Design a configuration and a set of protocols that ensure you cannot do the actions that worry your boss without a manager supervising you. Suggest that they should have an outside consultant review the configuration and protocols to check they do what you say they do. Of course, you can have absolutely no involvement in selecting the consultant.

Keep a log of your activities, including every time you request a manager, and when the manager was in fact available. Do you need to do any of the supervised activities on an emergency basis outside working hours? If so, suggest there should be an on-call manager to supervise you.

Included in your reporting to your manager the cost of the supervision in terms of delays in solving urgent problems.

One of two things will happen. Either you will very rarely need supervision, and it will be unimportant, or it will collapse under its own weight. I don't think sitting watching a sysadmin at work is going to be a fun and interesting activity for the typical manager.

  • thanks! I'll mark this one as answer precisely because you went a bit further than jbh. I'll present it to the boss ASAP and see it this is something he'll agree to. Thanks for your help! – Throwaway456789213 Mar 13 '17 at 7:17
7

You've just told your new boss that your position comes with some business risks/liabilities that he didn't know about. It might be that these are necessary liabilities that enable you to do your job, but all your boss is aware of right now is the risk. You need to show him the benefit - tell/show him how the value you add to the company by having those permissions outweighs the risk that it carries.

If your boss is not convinced, you may have to make do with having what you may view as unnecessary supervision for a time. If this is the case, I would not make any efforts to circumvent the supervision. Make every effort to show yourself to be trustworthy and above-board. Ideally, your boss will see that supervision is not needed for certain tasks. If not, you can bring it up after an appropriate amount of time (as a new hire I'd probably wait at least 90 days) and see if your boss agrees that the supervision is not an effective use of everyone's time.

  • Good point jbh, but how am I going to get out of the "You need to be supervised by management" trap? – Throwaway456789213 Mar 10 '17 at 15:29
  • Does it benefit the company for you to be able to perform certain tasks unsupervised? If so, then explain why/how to your boss. If not, I added a second paragraph to my answer that might cover that situation. – jbh Mar 10 '17 at 15:46
  • I'm afraid that's the route I'll have to take (consent to being supervised), and I have absolutely no reason to circumvent it. The only issue I have with it is that things move at a glacial pace here, so by the time somebody is available to supervise me the issue will already have escalated and I'll be blamed for being slow/inefficient/not a team player. Sounds a lot like a catch 22 as far as I'm concerned, can't win either way. – Throwaway456789213 Mar 10 '17 at 15:54
  • 4
    @Throwaway456789213 Not sure if you have an issues log, but you need one, and you need to log the date/time each request for supervision is submitted. That way you can show them that it is their own incompetence causing the problem – JohnHC Mar 10 '17 at 16:06
  • how am I going to get out of the "You need to be supervised by management" trap? -- Quis custodiet ipsos custodes? (Juvenal) -- How many people does Bossman want to trust with unrestricted PII access? – A. I. Breveleri Mar 10 '17 at 22:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.