Re: Secure Password Distribution for Exchange Migration

[David Treble <dtreble () CC UMANITOBA CA>]

Thank you all for your feedback.

Considering our tight timelines (250 user pilot starts in mid-January),
and upcoming Christmas break we've decided to go with sealed envelopes.
 We do have admins with scripting knowledge but as I'm sure you can all
empathize, the key folks are getting a little burnt out as we near the
rollout.  Not to mention, our Email Admin just retired in October after
43 years of outstanding service.

Our campus mail service (snail mail) has some great bulk mail tools for
large jobs and it's pennies a unit.  Our communications and learning
development people are going to take the opportunity to include some
info which should help a little more with awareness and give users
something tangible about the new mail system they can file away.

We also have a number of staff with no workstation or accessible
computer rep (ie caretaking) or in remote locations, who may not check
campus mail on a regular basis.  It was thought that they might
appreciate the sealed envelope method.  This should also reduce Help
Desk calls a bit.

I will follow up in the new year on how it was received and if we would
do it again.

Phase 2 (likely Sept 2012) is moving our 30,000 student accounts and
retirees to either Google/Live@EDU.  We'll be sure to have our IDM
system fine tuned by then!

Thanks again, and assuming the majority of you get some time off over
Christmas...enjoy your upcoming break!

DT


+++++++++++++++++++++++++++++++++++++++
David Treble    IT Security Coordinator
E3-640 EITC     University of Manitoba
dtreble () cc umanitoba ca -- 204.474.8340

     Follow @uminfosec on Twitter
Ask me about the Infosec Mailing List!
http://blogs.cc.umanitoba.ca/ist-alerts/
+++++++++++++++++++++++++++++++++++++++

On 11-12-08 9:27 AM, David Treble wrote:
> We are in the process of migrating 7500 staff accounts from Cyrus Mail
> to Exchange.  There has been some debate on the migration team on how
> best to handle the password distribution.
>
> Issues creating some complexity to the problem (politics/staffing/budget
> are at play here):
>
> - we don't have a mature AD infrastructure in place (currently on
> Netware).  AD accounts will be created and then mail enabled just prior
> to the migration.  The full AD migration for desktop file/print is Phase
> 2. (probably should have been Phase 1)
>
> - the AD adapter for our Sunguard Identity Mgmt system which would allow
> self-service resets or password synch will not be ready until mid or
> late in the migration
>
> - aggressive timeline for migration 7500 accounts (3 months) potentially
> 100+ accounts per day
>
> - Help Desk cannot process 100+ password resets per day with current
> staffing (10 minute avg per call)
>
> Options
>
> 1. Seed AD account with random password, hand deliver sealed envelope by
> unit Computer Rep just prior or at the time of migration.
>
> 2. Seed AD account with known value (ie DOB 12Mar1965 or Emp# umE123456)
>
> 3. Trust Faculty/Unit Rep with list of passwords for users in their area.
>
> 4. Decrypt users Cyrus mail password and migrate that to AD/Exchange
>
> 5. Force all users to call Help Desk for password reset
>
> User would change password in OWA as part of the migration checklist.
>
> We would appreciate any feedback or suggestions for other options if
> you've gone through a similar migration.
>
> Regards,
> DT