It also depends on your security policy, if you have document classification then this would have a high level of classification because the information inside the document could be potentially harmful.
If the document contains login details including passwords then I would suggest getting rid of it. There should be no need for anyone other than the user to know the password to his account, the administrator can reset the password to one of his choosing if access to the account is needed, this way the user will know the password has been changed and his account potentially accessed.
Having more than one person knowing the password to an account removes accountability tied to actions carried out by the account user.
Document management is also an issue here, what if the document is printed? This removes all technological access controls.
I would strongly recommend that this practice is stopped and is not usually essential in supporting user accounts.
Main Topics
Browse All Topics
by: mkline71Posted on 2009-09-17 at 10:14:50ID: 25358574
Are you talking about taking an export of your AD users into a spreadsheet for example and having that file somewhere?
I don't think it is a security violation if you are using it for support and you need to to help your users. Where the violation comes in usually is if that file gets compromised, especially if you have things like employee # or social security numbers.
My point here is to make sure that file is protected and can't be accessed or seen by anyone that doesn't need to see it.
There are also different regulations in different countries/regions.
Thanks
Mi