Why have more than one admin user?

[edwinlloyd]

Under Tools/Admin Settings is the capability to add more than one user who has admin access. Why is this feature built into Zen cart?

I have just employed someone to help me pick and pack. If I process an order, changing the status from processing to Shipping, the username is not added to the screen showing that I did it. So there seems little point in setting up a new user for this employee.

I know there is an add-on which can change the rights for each user, but I am curious to know what an out of the box Zen cart install offers for multi admin users?

[Ajeh]

I own a nice online store ...

I have 1 login for my admin ...

I fire 3 disgruntled employees ...

I forget to change my login information for a week ... :eeks:


I have problems with my site ...

I have 3 people working in the Admin but no one recalls doing anything to several products with problems ...

Gosh ... if I just knew who was working on those problems ... maybe we could figure this out ...

Oh lookie! There is an admin_activity_log ... and it shows who was working on the products in question and now we can work through what might have happened ...


I like to use certain password patterns ...

I fire 3 employees and remember to change my password ...

Sneaky fellows figured out my new password based on old password patterns that they were aware of ...


Multiple Admin logins are a good idea for a number of reasons ... security and tracing problems being the main issues ...

Later, adding something like an Admin Manager also keeps people from being able to jump in where they shouldn't ...

[Javier]

Leaving aside the naughty possibilities, it's also handy in case an admin forgets their password. If there is only one admin account, you're screwed (at least for a while).

[edwinlloyd]

OK. That figures, and I thought that might be the reason.

Then my question should be: where are these logs? I can find logs that have long lists of [GET] commands but I do not see a log that shows which admin user has accessed or changed things.

Is there a configuration setting that determines if this is logged, and where?

[DrByte]

Admin Logging is *always* on.
Another reason for having different admin users is for PCI compliance. All admin activity must be logged in order to know who has had access to what information and when.

There's an Admin Activity Log Viewer addon available if you need to read who's done what.