School User Refused to Change Password Because Everyone Already Knew It

A network left offline

Daniel told the On Call column that the school’s IT manager had left amid accounting irregularities. The deputy took over and then faced a ransomware incident that knocked out the whole network for three months.

The school brought in outside contractors to rebuild its systems and recover data from its only backup, which was months old. The deputy IT manager later quit without working out their notice.

A password policy approved

Daniel took the vacant IT role. During his first week, the principal asked him to review the network and report on what needed improvement. She approved his proposed password rules, including an immediate password change for everyone. The principal said staff needed to sign into her account to run reports when she was not at school.

The order to reverse course

As Daniel introduced the new rules, complaints came in. Within two days, the principal went to his office and instructed him to undo the policy and remove the requirement that everyone change their password.

The principal left three months later, and a nonprofit took over the school. The account does not say whether the school adopted another password policy.