Remote Access to an on Campus PC Terms and Conditions

In addition to the University's IT policies (it.leeds.ac.uk/policies) there are specific terms and conditions that people who remotely access campus PCs must agree to abide by. These are to ensure the ongoing security of the campus IT systems and the health and safety of University colleagues.

Prerequisites

If you are not the primary / sole user of the computer to which you are requesting access, you should:

Discuss whether remote access is appropriate remote access with other users of the computer as it may interrupt their work
seek permission from the person responsible for that computer (e.g. PGRs must seek permission from their supervisor)

Where the purpose of remote access is for the remote management of instrumentation or control systems, a local risk assessment should be undertaken to cover risks such as a robotic arm striking a person working in the room or a chemical pump that could cause a spill etc.

If the use of a computer changes and remote access continues, it is your responsibility to ensure that a new risk assessment is completed where necessary.

Authentication and access

It is essential that the University keeps a clear audit trail of computer use such that the use of any University computer for inappropriate activity can be traced.

Any computer for which remote access is requested must be part of the University's Active Directory domain. This ensures the username providing access is traceable to an individual.
IT are unable provide remote access when using a local / shared / project account unless a robust mechanism for user identification is in place.
External agents, such as support engineers will need individual university credentials.
Guests and visitors would not normally be given remote access to devices. If this is needed a compelling case will need to be made by the hosting department or service.

Where a user's account has direct administrative (root) access, this will need to be reviewed and wherever possible removed or separated to minimise the security risk to the computer and the wider campus network.

If you are provided with remote access to a shared computer, you should understand how your use may affect other users of the computer. On individual desktop computers, use is likely to be exclusive to one individual and a loss of data may occur where additional unplanned access is facilitated.

Operational responsibilities

If remote access to a computer is provided there are additional operational activities and responsibilities that the person(s) requiring access will need to fulfil.

If a device is accidentally or otherwise turned off (for example by a planned or unplanned loss of power) it is the responsibility of the person needing access to arrange for the the computer to be powered on. IT are not able to assist with powering on PCs.
The computer must be rebooted regularly (at least monthly but ideally weekly) to ensure important updates are applied. This article gives information on how to check your computer is up to date. Remote access may be revoked if a computer is found not to be up to date with Operating System, application and / or system software patches.

Relevant existing policies

There are several other policies that govern the acceptable use of University computer systems that are relevant to remote access:

Use of Computer Systems policy: https://it.leeds.ac.uk/it?id=kb_article&sysparm_article=KB0011153

Access Control and Account Management Policy: https://it.leeds.ac.uk/it?id=kb_article&sysparm_article=KB0011141

Password Usage and Management policy: https://it.leeds.ac.uk/it?id=kb_article&sysparm_article=KB0011143

Security Patching policy: https://it.leeds.ac.uk/it?id=kb_article&sysparm_article=KB0011150

If you can comply with all of the requirements listed above, then please complete the 'Remote Access to Campus Device' form which can be found in the 'Related Requests' section of this article.