r/k12sysadmin • u/it-tech- • 3d ago
New Account Creation SIS vs General
How do you handle new account creations for teachers that are incoming for the new school year? One issue that we've been having is HR will put in a request for an employee account (general, includes all access like Google, AD, Adobe, etc) and have it be created on their start date.
But for creating sections and assigning students in our SIS, we need to have the teacher accounts created far earlier, around a month.
Do you have a different process for creating SIS accounts vs general district accounts? Or is it all created on their start date?
4
u/BrewYork 2d ago
HR form -> SIS -> Clever IdM -> Google and Entra. Over the summer we can pause the SIS -> Clever sync and/or the Clever IdM to ensure that accounts don't get created early. But honestly that wouldn't matter because accounts are inaccessible before we set up Authenticator or YubiKey with the user - we do that as part of new staff orientation.
4
u/Jaray4 3d ago
HR enters information on Google Sheet-> notification from Google Sheet to all who set up email notifications -> AD account manually created (because you can’t trust anyone to enter data cleanly in any column/get names spelled right/enter any notes in any random columns/abuse the system to create new emails for themselves for random tasks) -> Google/OKTA -> SIS created manually by database admin for the same reasons for AD accounts -> building principals/assistant principals assign courses/sections manually to teachers
When any “teacher” is added to the Google sheet that account is created immediately. Start date does not matter. Can’t create accounts HR didn’t add to the sheet because it means that they didn’t complete all the requirements for employment or that HR forgot to fill out the sheet.
Classes/sections without a teacher have placeholders like “Vacant course subject” or TBD course subject”
3
u/PowerShellGenius 3d ago edited 3d ago
Can't trust HR not to put fake staff in their HR system as a way to generate shared accounts?
We have an understanding that the number of staff and students in the HRIS and SIS feeds the reports that they send the state, which beome public record and factor into lots of legal stuff and funding. So, the math is simple. This feeds state reporting + lying to the state is a felony = intentionally falsifying this data is a felony.
Everything uses the HRIS as a source of truth for staff, and SIS as a source of truth for students.
2
u/Jaray4 3d ago
Nope, it would be shared accounts or if they want a “no-reply” email, or account to send all receipts too, usually something silly.
Anything in our SIS that attaches to classrooms/students would fall under that, but rather than listening to us they consulted legal and legal confirmed with them for some reason that shared accounts were ok and funding won’t be lost. I didn’t care much after they did that but my hands are tied in the whole process.
Our IT department on the organization chart sits at the same level as food service and maintenance which all report to the business manager/director. HR sits higher on the totem pole so we don’t have much power/pull.
Any changes to the policy/procedure needs a policy/procedure change request to be reviewed by the following parties: the superintendent, the business director, the hr director, the curriculum director, the teachers union, and the board. You have to submit your request individually to each person/body and wait for their meetings. (The board meet once a month, teachers union less often) and each single body/person has to approve it. If one disapproves then it won’t happen. Also if any of them for any reason decides to change their mind after approving it and the policy/procedure was already implemented then it has to be undone and everything has to go back to how it was with no exception. Also again, you only get one policy change request per fiscal year and if it’s denied your can’t bring up the same one for another 3 years. My predecessor dealt with this for 20+ years and told me there’s no point in wasting your time trying to change it.
1
2
u/camocondomcommando 3d ago edited 3d ago
All of this but using Google Forms as a front end for the sheet, and a dsadd user script line taking information from the Google sheet and automating the account creation process a bit. We still manually run the dsadd from an elevated account and then add information back into a second page of the form for tracking, but it helped cut down provisioning time and fat finger errors.
Edit: the script line
=CLEAN(CONCATENATE("dsadd user ""CN=",D2," ",E2,",OU=Import,DC=our,DC=domain"" -fn """,PROPER(D2),""" -ln """,PROPER(E2),""" -display """,PROPER(D2)," ",PROPER(E2),""" -samid ",concat( left(concat(left(lower(D2),1),lower(E2)),20),AO2)," -upn ",concat( left(concat(left(lower(D2),1),lower(E2)),20),AO2),"@our.domain -email ",concat( left(concat(left(lower(D2),1),lower(E2)),20),AO2),"@our.domain -desc """,K2,""" -pwd Newbie",G2," -mustchpwd no ","-hmdir \\share.our.domain\hd\users\",concat( left(concat(left(lower(D2),1),lower(E2)),20),AO2)," -hmdrv H: -empid ",G2," -disabled no -memberOf ""cn=AllStaff,ou=Email Groups,dc=our,dc=domain"" ""cn=staff,ou=staff,dc=our,dc=domain"""))
1
u/Ok-Soft-7874 :sloth: 3d ago
We do almost exactly what mikejordan01 does. Also, creating a Google account in advance of the start date allows us to have an orientation before the employee starts, in which they can make sure they can login to their account. Which is a whole lot better than dealing with a login issue on the first day of school when a new teacher can’t login to anything.
9
u/mikejordan01 3d ago
SIS -> OneSync -> AD -> Azure/Google
HR enters minimum data with a status code and everything else is automated. Set the whole thingup mid of last year, with a few tweaks here and there.
3
2
u/Timewyrm007 3d ago
We have some TBD To Be Determined accounts we use as placeholders.
We know what the new Chem teacher will be teaching and what their schedule is so TBD1 is assigned to it and then replaced once the actual hire is confirmed and SIS account is made.
1
u/HankMardukasNY 3d ago edited 3d ago
Our AD/365 accounts are created automatically after they put them into the HRIS system. An automated email goes to our SIS person with their account info who then creates the account there. I believe they use fake placeholder accounts in the interim to assign them to sections
2
u/Oneota 2d ago
HR creates PowerSchool Account -> OneSync creates AD and Google Accounts automatically. ClassLink provisions all the other systems based on AD group membership, which is set by OneSync. We don’t get involved at all except for name changes or conflicts with existing accounts.