In almost every 10–50 person company we walk into, there's a computer in some corner where "someone from reception", "someone from the warehouse" or "someone from the workshop" logs in. One account. Password on a sticky note. Changes once every three years, because "Ms Krysia won't remember a new one". It works — until the first incident.
The first incident comes the day something goes missing or something gets entered wrong, and someone has to figure out who did it. The logs say warehouse. Really useful. Then the owner calls a meeting, asks around, nobody knows, it ends with "let's check the camera", and the camera at that spot has been off for six months. We know this scene.
The problem with shared accounts isn't that they exist — in some contexts they're genuinely the most practical answer. The problem is that most companies don't separate three layers that sound like one but are actually three very different decisions.
Three layers worth separating
When you say "the reception account", you're saying three things at once, and each one has different security requirements.
Layer 1 — the device. The physical computer sitting at the workstation. Its Windows account doesn't have to be separate for every employee. Honestly, often it shouldn't be, because making Ms Krysia wait 90 seconds for her first logon while a customer is standing in the doorway is a weak recommendation. One local account, auto-login, locked session — these are legitimate patterns for shift workstations.
Layer 2 — the operating system and its services. What happens inside the Windows session beyond the one app: access to network drives, browser, email, USB. This is where it starts to get warm. A shared Windows account with full office-worker permissions is where the real problem begins.
Layer 3 — the business applications. ERP (Comarch Optima, enova365, Subiekt), WMS, point of sale, CRM. Here you need a trail per person, even if Windows has a trail per workstation. Any decent business app supports separate users with their own login — the only question is whether someone actually turned it on.
The whole solution is really about consciously deciding what you share (layer 1), what you restrict (layer 2) and what you absolutely separate (layer 3). Most companies collapse these three into one — "it was set up that way" — and that's where the pain comes from.
How it looks in practice
At one of our clients — a 40-person food wholesaler — two shift workstations in the warehouse were used in rotation by 6–8 pickers over a day. Everyone logged into Windows as magazyn01 or magazyn02, and then into the WMS as… also magazyn. Once a month, when inventory variances came out, reconstructing who moved which pallet took one person around 4 hours — phone calls, questions, guessing. The warehouse manager called it the "detective tax".
The rebuild took two working days and cost nothing in licenses. The two Windows accounts stayed — kiosk-mode, auto-login into the WMS, lock on idle. Inside the WMS itself, every picker got a short personal PIN. The PIN is punched in once at the start of a shift; from there the app knows who clicked "receive" or "move". Within two months the "detective tax" dropped from 4 hours to around 20 minutes a month. As a side effect, two out of three "warehouse losses" turned out to be location-entry mistakes by one specific picker, not — as everyone had quietly assumed — small-scale theft.
A second story, for contrast. A 25-person car service with three workshop workstations, mechanics bouncing between them through the day. There was no way to enforce per-user Windows login — a mechanic halfway under a hood isn't going to type a 10-character password. But per-user login into the work-order module of the ERP? That worked. Each mechanic got a four-digit PIN and one rule: before you add anything to a work order, hit "me". Audits of "who estimated labour on this job" stopped ending with "someone in the workshop".
What to avoid
Three patterns we see regularly, and that always backfire sooner or later.
- A shared Windows account with domain access. If the same account everyone logs into has drive Z mapped to the finance folder, something is going to leak out of there — it's a matter of months, not years. A shift-workstation account gets access to its application and to nothing else.
- Treating the shared password as a "company secret". If 15 people know the password, that's not a password — it's public information. Accept it, and design the setup so that knowing the password does nothing (no remote access, no VPN, no mailbox attached).
- Auto-login into an admin account. We see this more often than we'd like. A shift-workstation account is NOT an administrator. Ever. If some application requires admin to run, that's the application's problem, not a reason to escalate the account.
What to do this week
If reading this you've noticed that some of these things look suspiciously familiar in your company, you don't need a big project. Start with three things you can do in a week.
- List every workstation where more than one person logs in. Write down what's done on it and what it has access to.
- For each one, answer a single question: "If something goes wrong on this workstation today, can I say who did it?". If not — that's your real security deficit, even if nothing has been stolen.
- Turn on per-user login in the business application that holds your most important data (ERP, WMS, POS). A PIN is enough — you don't need to put every operator under the same password policy as the accountant.
This isn't a sprint toward full identity segmentation. It's one decision: what we share on purpose, and what we separate because we need a trail. Most of the risk evaporates right after this step.
What next
Shared accounts aren't bad in themselves. What's bad is when they pretend to be personal accounts, and in the process you lose both the shift-friendliness and the ability to hold people accountable for their work. Once you've separated the layers — device, system, application — it suddenly turns out you can keep one without the other, and in practice neither the operators nor the shift manager mind at all.
If you don't know which workstation to tackle first in your business, we're happy to sit down with your list for half an hour and tell you which one is the "detective tax" waiting to happen and which one is just a sensible shift pattern.
If 15 people know the password to a workstation, that isn't a password. It's public information — and the setup needs to be built as if everyone already knew it.