Water Resources Division ITAC Home Page

ITAC - Nevada Meeting, action item #3 follow-up activities

Following is a series of email's of AD activities:

Sandy,

I did get your comments. I did not revise the letter but did verbally convey them at yesterdays GIO Leadership team mtg. The discussion on active directory didn't go very well from my point of view. The 3 regional GIOs were against the current plan and I also spoke against it but in the end, the decision was for Donna Scholz and the Light house team to develop a plan for a "starter kit" for Active Directory so that Active directory could be started without incurring the cost of full operations yet. It wasn't agreed upon to implement the starter-kit but to just come up with the proposal. Then we will decide how to proceed. I think the Regional GIOs will be forwarding to the lighthouse team the list of their concerns and the light house team will try to answer the concerns.

Steve

-------------------------------------------

Kathryn,

I fwded my comments to Steve and mikes' at Scott's suggestion, anything else i need to do?

Steve, fyi

-------------------------------------------

Sandy,

There was discussion on AD at the GIO Leadership Team meeting today. I suggest you contact Steve to see if there is merit in providing this revised statement to Donna. I think there is.

Katherine

-------------------------------------------

Scott thank you for drafting this memo. I was hoping that this memo would point out two big items:

1. we think the coordinated (Scott at lease please add this adjective) multiple domain model should be given serious consideration because:
1. other priorities for funding that could better use the millions to be spent on the 1 domain model bureau management.
2. it might be more secure because a hack might have less impact.
3. implementation could begin sooner [several anxious offices, like NV] because we would not need to wait for the national support staff to be in place.
2. that servers are needed at all offices with NWIS servers or significant numbers of employees who cannot afford to not be able to do computer work because the WAN is down.

#1 is buried #5 after a list of 3, so really #8

1a. could be added at the end of the first paragraph

1b could be worked into to the first #3 i think that would explain it better

my #2 could be worked into the 2nd #2- [maybe we should use letters or Roman numerals for one of the lists.] i think it would make us look less parochial to focus on functions we need, rather than '1 at every WRD district office'

If anyone agrees some of these changes need to be made, i would help Scott make them.

-------------------------------------------

Scott,

This is clear and suscint. I suggest a slight modification to emphasise that WRD Districts need to be included in the funding of this as A bureau solution to AD.

Katherine

-------------------------------------------

Brian,

Thanks for these changes.

All,

The first list was a set of general recommendations that I was proposing to GIO LT. Then, in the same "window," I started typing up what we had listed on the wall. We ran out of day, and I sent to Mike without tidying up the entire note. So, I've revised the original draft, as well as incorporated Brian's comments. Comments?

--Scott

DRAFT     DRAFT     DRAFT

To: GIO Leadership Team
Through: WRD Senior Staff
From: WRD Information Technology Advisory Committee (ITAC)
Subject: WRD Position on Microsoft Active Directory Deployment

The Water Resources Discipline's Information Technology Advisory Committee (ITAC) met in Carson City, Nevada, January 15-17, 2002. Most of the first day was devoted to gaining a better understanding of the proposed deployment of a single-domain Windows Active Directory Services (ADS) model for all USGS offices. We reviewed concerns and alternatives related to the proposed single-domain model. ITAC accepts that ADS deployment will occur in WRD cost centers, whether the single domain model is ultimately coordinated across all USGS cost centers or whether multiple domains are deployed autonomously--and uniquely--in each cost center.

ITAC views the GIO Leadership Team as the decision-making authority to whom advisory groups, including the ADS Implementation Team, will make their recommendations. Therefore, ITAC requests that you take the following points into consideration as you make decisions:

1. RFC Process

Utilize a request for comment (RFC) process into your information-gathering/decision-makingprocess. In particular, proposed deployment initiatives--and even proposed policies--should be provided to grass-roots constituents. In the case of AD implementation, constituents include the computer support staff at each cost center.

2. Control and Roles

The cost center computer support staff role needs to be better defined relative to Bureau support staff in the case of ADS implementation, and a clear management chain of command established.

3. Security Vulnerability

USGS should assume that ADS can and will be hacked. The implication is that the accounts and passwords should be considered vulnerable and security should be planned accordingly.

Concerning WRD acceptance of the proposed single domain model for Bureau-wide implementation of ADS, ITAC provides the following requirements on behalf of WRD Senior Staff.

1. An adequately funded support staff must be established, before Bureau-wide ADS implementation begins.
2. The ADS design must provide reliable service to all USGS staff and cooperators. At a minimum, and funded as part of the bureau's implementation, each WRD district office and all 4 WRD cost centers in Florida require a domain controller; see the attached list. Each district reserves the option to deploy, at its own expense, additional domain controllers as warranted.
3. An opportunity to review an updated cost/benefit analysis and implementation plan to include increased number of ADS domain controllers in WRD (and, if applicable, in BRD and GD as well).
4. An opportunity to review test results to determine the impact of the increased number of ADS domain controllers on the network capacity and performance.
5. An opportunity to evaluate the updated Bureau-wide ADS cost/benefit analysis and implementation plan in relative priority to other IT needs in WRD and the Bureau.
6. Training for local Windows administrator at each location where an ADS domain controller is installed.

Address questions or comments to Charles Merk, ITAC Secretary cfmerk on (703) 648-5680