[juwaack68]

For you BES Admins, I'm curious who has access to your BES servers - just you (or your team), or does your Helpdesk? Or, if you have a BES that is overseas (or in the US, if you are in Europe/Asia), does a person local to the physical server have access to add/remove users?

Reason I'm asking is we have 4 BES servers - 1 in the US (largest with 445 users), 1 in Calgary, 1 in Ahlen, and 1 in Pudong. All of them are v. 4.0.6.

Our Helpdesk has access (via the svc account) to the US BES - but they only perform user administration (add/remove users, change passwords, etc). Although they log in with the svc account, they do not do any other tasks on the server (including modifying the IT Policy, updating or creating software configs, etc). I was told by RIM that logging in with the svc account was the ONLY way to perform user admin, so that is why they are using the svc account.

For the servers in Ahlen and Pudong, local employees (some I.T., some not) had access to the servers (via the svc account). However, due to issues with those people creating new IT Policies and Software Configs, I have changed all of the svc account passwords and said that ALL user admin must go thru our Helpdesk - for any BES.

Big surprise - I'm getting some push back from the local Ahlen and Pudong employees (they will run this up the flagpole to the VP of I.T.).

I see this the same as any other system that users are managed - like Exchange. All user admin for Exchange is done by our Helpdesk. We don't allow local I.T. folks security to do this - it's all managed centrally.

So - back to my original question - who has access to administer your BES? And is it true that the only way to perform user administration is by logging in with the svc account (for v. 4.0.6)?

I am planning to upgrade to 4.1 soon, so will be able to grant user admin access to those who need it, but until then.......

[d_fisher]

Our BES access is limited to the BES/Lotus Domino admin group. Part of this group is responsible for the hardware, software, and the overall functionality of the BES server. The other part of the admin group does the day to day administration such as creating/removing accounts, resetting passwords, etc.

I am the primary support person for ~2500 BlackBerry handhelds and I do not have access to our BES server. In our current model I do the troubleshooting and have a BES admin do what I need done on the server. After the upgrade to 4.1 this should change to streamline the support.

[juwaack68]

Interesting. Our Exchange team doesn't even have access to our BES servers (they don't want it, either). I am the main BES server admin for all 4 servers - hardware, software, overall functionality, but do have a backup.

The Helpdesk does the day to day stuff (and I do some of it when they get the odd troubleshooting issue). Thus far they have not overstepped their bounds with the full-blown access they have (ok, one guy did, but he's no longer here).

[ZeroKool]

As far as BES goes it's me and a Domino Admin that manage the servers. About 6 servers with 300+ people. 1 remote. Anyone who has access (Domino Admins) can get on the server (if they know the password). It's easy having only 10-50 people per server. Makes troubleshooting allot easier and faster.

[juwaack68]

Can either of you confirm that the ONLY way to perform user admin is to log onto the server as the service account?

[Jules166]

If you upgrade to 4.1, you have user groups so can set specific accounts to do specific levels of admin.

[juwaack68]

Originally Posted by Jules166

If you upgrade to 4.1, you have user groups so can set specific accounts to do specific levels of admin.

Yes, I know that....my question pertains to 4.0.6.

[ladydi]

That was the major complaint with BES before 4.1. No roles. If you needed someone to do anything on BES, they had to use the service account and all the permissions that entails. There is no way around it that I know of. Upgrading was pretty painless, so I would just push to do that sooner.

[DarthBBerry]

Being the BES Admin, I have access to the BES Server. The Notes/Domino team has access to the server to monitor/maintain the Domino instance on the box. The Server Team has access to the server to monitor/maintain Windows 2k3 and the actual hardware. There's also a SQL team to monitor/maintain the DB.

Each team has Admin access to the server under their own account. Everybody can do something to the BES instance, but they don't. They leave that to me. If any team has to make changes, perform maintainance or perform a reboot, everybody is notified before it occurs.

Help Desk does not have access nor do they want it.
It's all "me, me me." (props to who can guess who said that.)

[b1g b3n]

we're a one-stop shopping IT department here (7 of us for @1200 users) so we all have physical and network access to the BES, but i'm the primary blackberry guy. everyone else is afraid to touch it so i took it upon myself beef up my BB knowledge and take over BES administration, lol. so far so good.

[juwaack68]

Originally Posted by b1g b3n

everyone else is afraid to touch it so i took it upon myself beef up my BB knowledge and take over BES administration, lol. so far so good.

Sounds like me - thrown into the fire 3 years ago when I was told to get a working Blackberry into our CEO's hands in a month....and I'd never heard of a Blackberry.

[ladydi]

Originally Posted by juwaack68

Sounds like me - thrown into the fire 3 years ago when I was told to get a working Blackberry into our CEO's hands in a month....and I'd never heard of a Blackberry.

I hear you there! I was hired 2 years ago as a PC tech + blackberry admin because nobody else wanted to deal with it. It actually worked out well because its helped me move into more server admin stuff. My boss is giving me the exch server now.

Just last month I made them buy a bb for our other tech so that I had backup and could actually take a vacation. (I have very needy users)

[bertiebassett]

Me.

I am BES server admin, exchange guy, general server admin, phone system, helpdesk, development & training all rolled into one..oh and that's just 25% of my job..

Small companies are fun that way!

[DarthBBerry]

Originally Posted by ladydi

....very needy users....

Redundant statement.

[juwaack68]

Originally Posted by ladydi

....very needy users....

Where's my LART?

[ladydi]

Lol, no kidding

[jtor]

Originally Posted by juwaack68

Sounds like me - thrown into the fire 3 years ago when I was told to get a working Blackberry into our CEO's hands in a month....and I'd never heard of a Blackberry.

Man oh man... does that bring back memories. Flash back to 4 years ago - Boss hands me a project - Domino BES 2.1, 1 server, 80 senior execs to receive 957's, 3 weeks to get it done. Quote: "This BlackBerry thing is only a part time assignment".

Today - BES 4.1 for Exchange 1500+ users and growing daily. Multiple Berry apps. Multiple servers. High availability. Redundant sites.

I love Corporate IT

[juwaack68]

Originally Posted by jtor

Man oh man... does that bring back memories. Flash back to 4 years ago - Boss hands me a project - Domino BES 2.1, 1 server, 80 senior execs to receive 957's, 3 weeks to get it done. Quote: "This BlackBerry thing is only a part time assignment".

Today - BES 4.1 for Exchange 1500+ users and growing daily. Multiple Berry apps. Multiple servers. High availability. Redundant sites.

I love Corporate IT

We're not at the 'multiple apps' yet, but we are at multiple (4) servers.

And does that count is high availability, or just high maintenance when you tell a user you can't IMMEDIATELY replace their lost/stolen/broken device.

[KOR]

Only our IT staff has access to BES, and only me and my manager ever do anything there.

I know we all have a lot to do, but I think the quickest way to screw up your tech is to let a non-IT (or an IT person not familiar with the systems) to get in there & muck around.

[x14]

I think we have the most complicated structure. Our desktop support people can add/remove users. Our Domino mail admins does the Domino/BES management alone with me. I handle the over server management because we are running a complicated disaster recovery setup and switching between servers can be a pain.