Canonical: "What should I do about this user?"

Question

What should I do about a "misbehaving" user?

This type of question really is one that crops up every once in a while - any sysadmin will eventually come across user behaviour that is potentially damaging, malicious or illegal.

Unfortunately it's been closed and I feel this would be an excellent candidate for reopening.

It falls within the domain of the professional sysadmin to have the knowledge and skills to handle this properly. It most certainly deals with servers and networking equipment as we can be called upon to deal with the resulting situation which may potentially affect the infrastructure and the business.

Answer 1

While I applaud the spirit of that question, it does have two sub-questions that people are alternately answering. To me, the two questions are:

• What do I do with a user who is violating our AUP?
  • Alternate: What do I do with a user who is violating our badly worded AUP?
• Why does my AUP have to harsh my squee? All I'm doing is looking at icanhazcheeseburger and surfing cosplay pictures from SDCC! That doesn't harm anyone! {1}

The first question has a pretty simple response, and that's "respond according to your AUP." Alert their supervisor, alert HR, and alert my supervisor are all valid responses depending on the organization in question. If this is the question being asked, it shouldn't be hard to distil up a good canonical answer.

The second question is more topical on security.stackexchange.com, since that's an IT Polciy issue with significant inputs from the "defend the network" side of the house. Yes, we here on SF are often the engineers who put in things like web-filters but we're generally not the ones advocating their usage (see the comment-thread on the above question for proof of that).

The alternate wording version of the first question is trickier since it drifts back into the IT-policy realm again. If your AUP is short and sweet, like, "Don't do bad stuff, or we'll do something about it," you're in for a lot of back-room lawyering. "Bad" for one manager may be "accessing espn.com", where another manager may see bad as, "You can surf porn so long as no one can see or hear you do it." Long and specific AUPs are enforceable, short common-sense ones aren't.

Dealing with a possible violation of a badly worded AUP as a system administrator is hard and entirely dependent on the organization you're working in. This is the typical, "it depends," answer, and such questions aren't a good fit here. Attempting to get a broken AUP fixed skirts topicality here, and falls under the kind of internal policy advocacy that mid-level and sr-level sysadmins just do as part of their job.

Because the wording of the question lends itself to a policy-based answer, and most of the answers are focusing on policy, this is not topical on SF. Before https://security.stackexchange.com/ was around I'd actually have argued in favor of this question being topical. If it was rephrased into more of a "how do I handle an AUP violation" question, that I see as topical here. This isn't.

{1} Okay, maybe this question got a little example-heavy specific.

Answer 2

I voted to reopen.

Although it's true that the question is largely "a management issue," I think there are aspects that are specific to IT.

To me, the sort of situation that's universal is if one employee sees another stealing, or if someone has posters of naked women (boobs!) on their walls. The thing that I think is more specific to IT is that some of the behaviours that are unwanted in most companies (and possibly illegal) are things that sysadmins often actively monitor. e.g. excessive bandwidth use by people downloading porn, movies, etc.

I think there is a good, subjective question in there that is somewhat specific to IT. I might've phrased it more like: "How do you handle situations where an employee is using the network in violation of your AUP or doing something outright illegal?"

(If nothing else, I'd like to see the question re-opened because I don't see a clear answer there now that says: All those things are likely to damage or cause problems for your network, so it's part of a sysadmin's job to deal with them. In some cases that may require instigating a disciplinary process, in others it might be enough to burst into a person's office, yank their network cable, and say "don't plug that back in until I come back and we have a little chat...")

Answer 3

As professional system administrators we also eat lunch (most days at least) but that doesn't mean discussions about food are on topic. Equally, management issues are off topic. This has been discussed previously.