Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Where I work there is a practice of adding a t_ prefix to all temporary employees logins (sAMAccountName).

When someone switches from temp to perm or the the other way the prefix is add/removed.

While is ok with Windows and AD, this practice is messing most (if not all) other systems that are relying on AD/LDAP for authentication, as they are not able to detect a renamed account.

Is there any strong reason for having such a practice, aren't other alternatives that would play better with other systems?

share|improve this question
10  
I'd think just having them in a specific OU (i.e, "Temporary Employee") and restricting their access based on company needs would be a much better approach. –  Nathan C Sep 3 at 13:06

2 Answers 2

Does the sAMAccountName rename practice based on employment status makes sense?

No, it doesn't.

Don't overload any Name fields with other purposes. A name is supposed to identify an individual. You don't try to stuff their company, department, or payroll info into the name field.

aren't other alternatives that would play better with other systems?

Use an OU, a group membership, or one of the extensionAttribute* fields to indicate temp-vs-perm status.

share|improve this answer
2  
There are roughly a billion fields that could be used for holding auxiliary data. Not to mention having a "Temp_Employees" Group or setting an expiration date on the user account to match their contract end-date. –  gWaldo Sep 4 at 12:22
1  
What's funny is that Microsoft themselves do this. –  MDMarra Sep 6 at 14:16

It seems that you have already experienced the consequences of why your current practice of using the naming convention to distinguish between temporary and permanent employees isn't that well thought out.

I've found that often the temporary employee has the same responsibilities and restrictions as a permanent employee in the same role and only real technical differences between the two you might want to implement in their AD accounts are:

  • temporary employees get an account that expires at the end of their contract
  • permanent employees get an account without expiration date
  • temporary staff often come in though a purchasing department rather than HR, meaning they don't receive the normal employeeID numbers through the HR systems and there you'll need to set up something different for temps.

You may also have business requirement to have multiple flavours of an all-staff mailinglist for company-wide announcements (e.g. one for everyone, one excluding temps and one only for the temps) and should be able to manage that and other business requirements with groups.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.