User Lock

With User Lock, the school’s staff can deactivate a user’s account and thereby block the user’s access to the school’s IT system, without needing assistance from the IT department. It only takes a moment to deactivate an account, making it possible to intervene immediately, e.g. is a student is caught cheating. In the same way, reactivating the account also just takes a moment. When you deactivate an account, you can write why. This way it is easy to see if, e.g. at student violates the same rules repeatedly.

Prerequisites

Supported administrative systems

All

Module requirements

UMS Academic Web

Testing after setup

Test of an existing user in AD. The user must be able to both disables / Enables again

What to have ready

Active Directory

Installation

Configuration of "Disable/Enable"

The settings can be found under “Web setup\Edit”.

The configuration of “User lock” consist of 2 sets of settings:

• A number of groups (AD groups) which have access to lock/unlock users.

• A number of groups (AD groups) which can have their account locked/unlocked.

First one group needs to added with access to Lock/unlock users:

• Enter a saying display name, and browse for an existing AD group.

• Choose a Service Account with access to the domain in which the group is residing.
• Mark the checkboxes if the users is allowed to see extra userinfo (for the users they can block).

Groups setup

Next step is to choose the groups are can be lock/unlocked with this module:

Click “Add…”

• Enter a saying display name, and browse for an existing AD group.
• Optional an OU search path can be entered. This means that the users both need to be in the group and placed in the “Search path” or below in AD.
• Choose a Service Account with access to the domain in which the group is residing.

Combinations of groups

The last step is combine the 2 groups:

Click “Add…”

Choose the 2 groups.

Now a basic setting is setup.

Remember that it’s possible to add a large number af groups if needed, so the needed resulting combined rights is correct.

Typical example:

In the above example, “All teachers” can block “All students”. And “IT Staff” can block both “All students” and “All teachers”.

Technical settings

Settings for Disable/enable

All setting for UMS Attendance Basic is set through the configurator.

All settings for the ‘Disable/enable’ module is set under “Set web access” or under Modules/UMS Web setup:

The setup consists of three steps:

1. Setup a collection of groups, which have access to disable/enable users.
2. Setup a collection of group that can have their account disabled/enabled.
3. Combine the two settings above to achieve the access level needed.

Group settings

Define any number of Active Directory Groups, which can access the functionality of the module.

File:Userlockaccesstodisableandenableusers.png

Make sure that the chosen Service account have access to resolve groups in the chosen domain.

Now setup a number of groups, which can have their accounts disabled/enabled.

As an extra option, it is possible to specify a “Search path”. If this setting has a value, the users is required to be both members of the group and reside in the specified OU-path or below.

Now there should at least two groups defined: One for the users with access, and one for the users, which can have their account disabled/enabled. The last step is to combine them.