Shared Accounts at Riverside Health Post
Riverside Health Post has six laptops running Windows 10 Pro. A national patient-record program requires Windows and a report-printer driver certified only for the current build. Staff share one account named Reception because the previous nurse left and no one knows the administrator password. Each laptop stores the daily register in a folder on the desktop, and a free antivirus trial expired 14 months ago. Windows Update has been paused indefinitely after one update disabled the printer. The health post has no dedicated IT officer, but a district technician visits monthly. The clinic handles confidential patient data, has intermittent mains power, and cannot stop services for a full day. The district requires weekly backups and an audit trail of who opens patient files. Staff sometimes take one laptop to outreach clinics with no internet.
1. Explain what changes you would make to accounts and permissions, and how you would recover administrative control without losing patient data.
Read the worked answer
First make a full disk image of one laptop before changing accounts, because the old shared profile may contain the only copies of registers. Using the district technician's recovery media, enable the built-in Administrator account offline, set a long unique password, and record it in a sealed envelope held by the clinic manager and district office. Do not keep using Reception. Create individual standard accounts for each staff member, migrate desktop files into a protected patient-records folder, and only then remove the old profile after verifying the files. Give administrator rights to the technician account only; staff should not install software. Turn on object-access auditing for the patient folder and review logs monthly. For the outreach laptop, enable BitLocker and require a standard account. The trade-off is a slower login and more setup, but it gives accountability and protects confidentiality.
2. Propose an update, antivirus, and backup strategy that keeps the legacy printer working and meets the district requirements.
Read the worked answer
Build a small test ring: image one non-critical laptop, install the latest quality updates, then verify the certified printer driver and the patient-record program before touching the other five. Use Windows Update for Business to defer feature updates for 180 days while allowing security updates after about seven days; do not pause updates indefinitely. Keep the certified driver package offline so it can be reinstalled. For antivirus, use Microsoft Defender with offline definition updates monthly and scan any USB drive; do not rely on an expired trial. Back up weekly to two encrypted external drives kept in different locked locations, and test a restore each month. Enable audit logging and review who opens patient files. The district link can carry encrypted backups if the monthly cap allows, but local backups must work during outages.