Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly recruited employees (immediately before their first day at the company):
- they generate a password for the user (NOT a change-at-first-login one)
- they login on their laptop (impersonating the final user)
- they apply some configuration (e.g. they access their Outlook email in order to check that everything works)
- they change again the password (this time with a change-at-first-login one)
- the laptop is delivered to the user
It appears that this procedure is quite common also in IT companies.
I cannot say if the initial configuration, "in the name of user", is absolutely necessary or just dictated by convenience reasons (a fully working laptop is delivered to a non-IT user, preventing a lot of requests to the IT for fixing common issues), but there a few things that smell:
- if I should never tell an admin my password (as it has been answered to the cited question) there is no reason that an admin knows my password even at the very beginning of my work in that company
- I can accept that an admin knows my password (when he first creates my account or when he resets it) provided that it's a change-at-first-login password (so that I have evidence that it's not been used before). I suspect anyway that most legacy systems (like AD) allow admins to reset passwords with great freedom (for example resetting passwords without notifying the user, or without forcing them to set a change-at-first-login one). Is it an accepted practice? This seems completely different from what happens for example in Google (no one knows my password, if an activity is detected I am notified).
Edit: to answer many comments that state that "the computer is not yours, it's the employer's computer, you should not have personal information on the company computer" I would like to point out that it's not a matter of personal information, but reserved information regarding the company business. So, if it's correct that I should not use my company email to receive my blood analysis results from my doctor, it's perfectly common that some reserved information about the company is exchanged between employee A and employee B.