I have just taken control of a small corporate network with aprox 50 users. They have no firewall, no internet monitoring, thankfully they do have AD set up.... Anyway its just the way its grown up over the last 5 or so years with little-to-no proper IT intervention. it sort of works, but its time to sort it out.
So it has become clear that people are sharing user accounts, using other peoples' accounts, and certainly one team even has a list of their passwords on the desk, as they never change and sometimes need to "nip on" to someone else's account...
My recent background is in slightly bigger networks, say 500-1000 users, where strict IT policies are enforced, passwords are changed by force monthly, and everyone has their own account, passwords are NOT shared.
This needs to change - but i will likely get resistance from the management and teams. So, What reasons can i give to the management to justify the "crackdown" and enforcement of a stricter IT policy?