life in the fast lane...

i am at a university. ever since the kids came back to school - i have been battling spyware & virus infections left, right, & center.

it's amazing some of the stuff out there. if i am to believe my users - and in some cases there is no reason not to - they don't even have to click on anything anymore to get infected. all that needs to exist is a windows host with a slightly outdated patch status and it's hit by just being connected to the network/internet. it's not so much a data loss/security threat issue as it is the tedious grunt work issue of chasing down the machine and cleaning it or worst case scenario re-ghosting it. it's really mind boggling the amount of work this stuff generates.

lately i have been actually thinking that migrating to a linux OS on the desktop actually might make some amount of sense. the thing that sends thunderous shivers down my spine is the support call volumes this would generate from users accustomed to using windows OS for all their computerized business lives. i am of the belief - and i have work experience to back it up - you make the slightest change to anything on the desktop - be it a office app or printing procedure - you will get panicy user calls. i remeber when wordperfect was going down the tubes and we had to force users to switch to ms word - the "hell" that broke loose. you would have thought that a new plague had resurfaced - not a user interface switch from one word app to another.

anyway, i forget the point of my rant. oh yeah. spyware & viruses cause a lot of extra work and linux on the desktop sounds like a good idea right about now.

:-)

These are public computers? Well then first off... there would virtually be no problems if you and home users alike would put some policies in place. Think about it... millions of $$$ in AV and Firewall software yet everyone goes online and does mostly everything else useing full administrative rights and all the default settings right from install. Also the thing about school computers... if your taking care of them then isn't it YOUR job to update? :rolleyes:

First off... these people (and malware) should not have ability to edit the registry or make any other major changes to these systems for that matter, none of these computers should automaticly execute anything from removable storage, all ftp tftp instant-messaging & gaming related connections should be dropped... this really pisses people off the most.

I don't even have the clipboard enabled :D no cut and pasting for you, *******!

Perhaps you could, you know, do your job, and update? Or get rid of Windows.

both you guys seem to have a similar POV. so might as well reply to both - kill 2 birds with one stone.

first of all - i don't work with the students. i support the business units. big difference there. you can't slap them with policies up the kazoo without reason. also, your salary and all the hardware you work on comes out of their budget. (they are paying for it!) the divisional heads tend to feel that it's their equipment so they should have a big say in how it's handled. this is very unique to this place. most internal IT shops do not operate that way. (al least i don't think so!)

we are also expeirencing an overall de-centralization and reduction of dedicated IT support. this is common in some parts of the indistry. it's been going on for years around here. in a nut shell, and this is just my personal take on this - (i might be full of it!) divisional heads are noticing that their direct staff is much more tech savvy than it was say 5 or 10 years ago. new jobs such as business analysts are cropping up. the job entails a lot of tech skill set. the divisional heads feel that their IT needs can be better supported & understood & met by their own direct staff - someone who understands their business - much better than lets say a specialized IT guy who understands IT needs for a whole bunch of different divisions with not much in common. so some functions such as specialized server purchsing, mgtm of those servers at la is being handled by people whos jobs entails doing a whole bunch of different things other than IT. but that equipment is still connected to your network.

we are also seeing some instances of shadow IT. you do one thing. someone else does something else. you can't totally lock down the systems because they have to do their own stuff on them which requires admin privaledges.

we could go on and on for ever. but it's all just cwap one has to deal with and find ways to work with or work around. best one can do it follow the CYA rule and have a healthy sense of humor.

OK, so what does this have too do with patching? Do your part too stop a kiddie, PATCH.

As for the things you just talked about, you must understand that IT management is crap. IT doesn't need management, it needs money, and intelligence, management just get in the way. If all else fails, a little BOFH love won't.


Crash the Routers every 3 hours and blame it on a new problem that only the newest hardware fixes. Then you should have a nice fat budget to play with and some new found respect when you alone fix it.

I am have a few opinions on this matter because I dealt with this until the CEO got mad enough to fire me without probable cause.

Your job as an IT "specialist" is to make sure the CEO, boss, team leader knows what is going on. If this requires you to make charts, log the hours spent on fighting malware and comparing them with what you could be doing so be it. The reason people are bending more towards business professionals with a technical background could be attributed to the reasoning the a business professional looks at things a little different than 0's and 1's they also look at the price and a way to make that price worth it. It is your job to make the company see the reason behind purchasing or implementing new security.

Secondly from what I read I am slightly dissappointed to hear that you would have a system left open that would allow them to even change the registry (like The Specialist previously stated) you as an Admin or IT person should either let those in charge know or if you are in power should make sure these actions are taken so that these regedit changes and other functions are turned off.

Another thing! IMO Windows is not a bad OS. Yes, I know there are some security issues but there are ways to prevent those leaks from happening. In this aspect it is purely the admin's fault if Windows is not secured. And, if you are thinking of switching to Linux I would make pretty damn sure that you should be aware of the problems that could come from it. Migration problems/ different extensions/ compatibility issues it just doesn't seem worth it.

If I was in your shoes I would get off my ass and do something about this problem there is no reason a machine should be unpatched or subjected to Malware.

- MilitantEidolon

When all else fails... grab an automatic weapon. Behold, the greatist and very best tool for security & generally gaining administration over random things in almost any situation.

Problem solved...

If you don't feel like running around to all the machines and wanna check if they are patched here's this.
http://www.gfi.com/lannetscan/

Secure~ you have my sympathies:

Quote:

---

we are also seeing some instances of shadow IT. you do one thing. someone else does something else. you can't totally lock down the systems because they have to do their own stuff on them which requires admin privaledges.

---

We call them "User Mushrooms"..................and the only way I like those is FRIED!!! :cool: Seriously though, you should only need to give them local Admin rights? Please look into that.

As stated, YOU are responsible for the patching and the implementation of policies. Your task is to get definition and agreement of those policies.

There seems to be both an organisational structure and communications problem in your environment. A Business Analyst should be an IT employee with responsibility for business divisions/functional units.

The user areas should have an IT liasion officer.............that's the one with half a brain, and he is not saving it for Christmas :D

I disagree with Gore on this one, you actually need STRONG IT management in the land of the "User Mushrooms" otherwise you will have anarchy, followed by chaos.................and then you will be outsourced :eek:

In a specialised IT environment you only need team leaders and project managers........the rest of the management structure is pretty much irrelevant. In that case Gore is 200% correct, the issue is always going to be resources ($ + skillsets)

My advice:

1. Patch
2. AV, and keep it updated
3. Firewall with sensible policies
4. Needs only base authorities
5. COMMUNICATE!

Good luck!

Patching windows is easily done if you setup a SUS (WUS) server.

http://www.microsoft.com/windowsserv...s/default.mspx

Quote:

---

Originally posted here by SirDice
Patching windows is easily done if you setup a SUS (WUS) server.

http://www.microsoft.com/windowsserv...s/default.mspx

---

i got one of those. it's doesn't provide 100% coverage.

Quote:

---

There seems to be both an organisational structure and communications problem in your environment. A Business Analyst should be an IT employee with responsibility for business divisions/functional units.

---

you can say that again!

but seriously folks. when this kind of stuff happens (and you never know - it might happen where you work) - you got to deal with it is a professional and productive way. (btw - crashing network hardware is not one of them - and if you get caught - you got a lot of explaining to do right before you go off to burgerking to flip burgers for a living.)

i am not divisional head (in my place IT fall under umbrella of another division). if you have concerns with how other areas are doing business - you don't go head to head with these people. you go bring it up with your divisional head and the div. heads battle it out! chain of command (or i like to call it the pecking order!)

but once you do that and your boss comes back and says there is nothing we can do about it - thats pretty much it. all you can do is put a lot of effort into properly documenting and logging the amount of extra work all the stuff is causing your department and submitting it to your boss on a regular basis. as stated earlier, you have to learn to work with and around it - or you look for another job. personally, i don't like to quit. i also look at this as a learning opportunity to learn how to do my job differently.

also need to add. it's not all gloom & doom. there are some bright points. for one, all the divisional heads are very interested in getting their IT staff trained as much as possible in IT stuff, so in any major IT project you have a pool of people you can count on to do the work and functional managers willing to give you their staff's time without much hassle.

Quote:

---

i got one of those. it's doesn't provide 100% coverage.

---

true. But it beats patching by hand....especially if you need to do it a couple of hundred times ;)

As for the "rogue" users....

We have a policy, if the machine isn't ours and we didn't install it, boot it off the network.
Let's see how far they come if I disable their switchport :D

Somebody already noted it but try and keep a log of the time you spend cleaning up because of those rogue machines/users. Then convince your boss how much they will save if you don't spend all that time cleaning up. You can tell him/her you can spend that time improving their network. That usually does the trick.

Another option is to let it slide, hope one of your rogue users brings in a virus and let everything fall apart. Then tell your boss "I told you this would happen". If they lose money because the network is down, they'll suddenly start to listen....

i agree with sirdice. ive been updating the computers on my network using scripts. but after ten new ms patches coming out this month...ive had enough. i installed sus last week. i would have installed it sooner but it needs a server and gigs of h/d space and i didn't want to add anymore load to the ones we have.

i dont know what kind of network you have...but if your using active directory you can set a group policy to point their computers to the update server and schedual it as you think best. the only cost is the space and resources on a server. if you dont have AD it only takes about 30 secs to configure the client with gpedit.msc. even a login script calling a .reg file could set it up.. after that their computers would download and install the updates you approve without any user intervention

My solution.. after getting half the machines running full time on Firefox more to the point NON-IE based Browser.... set up a add filtering Hosts file (this bugger can be too large.. so be careful) ..

only takes a minute to change the file when doing a cleanup.. and I will do this with customers that are regulars (that is they don't listen to advice).. and install FF.. and do a 2 min teach session before sending them out the door.. the return rate is low.. I wnat these guys to come back and order more equipment.. that makes the boss happy.. if they spend their budget on parasites.. they won't be so keen to buy their next batch of workstations..

any changes ..little by little.. and remember why the coffee breaks are only 15mins in many work places.. any longer and the staff will need retraining.. I thought that was a joke.. unfortiunatly it is bloody true..

i hope I made sence.. or it is time for Johnny and Jim to go home..

Quote:

---

Originally posted here by MilitantEidolon
[B]I am have a few opinions on this matter because I dealt with this until the CEO got mad enough to fire me without probable cause.

---

sorry to hear about your job loss. there are a lot of CEO's on power trips out there!

Quote:

---

Another thing! IMO Windows is not a bad OS. Yes, I know there are some security issues but there are ways to prevent those leaks from happening. In this aspect it is purely the admin's fault if Windows is not secured. And, if you are thinking of switching to Linux I would make pretty damn sure that you should be aware of the problems that could come from it. Migration problems/ different extensions/ compatibility issues it just doesn't seem worth it.

---

in response to this. well here is the thing. i deal with & support some very expensive & fancy business vertical apps. when the vendor dumps a major change your way - no questions asked! everyone has to accept the app changes as a must and everyone learns how to work with those changes.

with regards to linux. i do think if one managed to convince the exec's (which will never happen here! we have a M$ mole in our midst and we get M$ products for dirt cheap!) to switch it will happend. as long as the word comes from up above and not from IT, the users will accept the change and the requirement to adapt.

Quote:

---

Originally posted here by Tedob1
i agree with sirdice. ive been updating the computers on my network using scripts. but after ten new ms patches coming out this month...ive had enough. i installed sus last week. i would have installed it sooner but it needs a server and gigs of h/d space and i didn't want to add anymore load to the ones we have.

i dont know what kind of network you have...but if your using active directory you can set a group policy to point their computers to the update server and schedual it as you think best. the only cost is the space and resources on a server. if you dont have AD it only takes about 30 secs to configure the client with gpedit.msc. even a login script calling a .reg file could set it up.. after that their computers would download and install the updates you approve without any user intervention

---

no AD yet. but in the works. and when it happens, that is going to be one big a$$ can of worms!

you think the divisional heads didn't send their staff for MCSE training? think again!
you think the divisional heads aren't going to want their own forests? think agian!

if i manage to convince them that forests with 10 user objects is a stupid idea, then the best we can hope for is them fighting for their own domains.

Quote:

---

you don't go head to head with these people. you go bring it up with your divisional head and the div. heads battle it out! chain of command (or i like to call it the pecking order!)

---

That is you main problem, two ignorant (IT wise) egos jockeying for position.............

You need an IT user group, with regular meetings. Let the guys who actually use the systems have their say..............in my experience guys at an operational level will generally listen to you and understand what you are saying, even if they don't agree.

When they go to their Divisional head and put forward an agreed policy/strategy (from your meeting) and your guy has the same opinion.............they will just steal the idea as their own.

Oh man! I have been there so often! :eek:

Seriously, I think that if you put it to your boss that there is a gap in communication at the functional/operational layer, he will have some ammunition to look cool with at the next divisional bosses meeting.

That coiuld help you? both personally, and job satisfaction wise?

I am sorry to have to talk "dirty" to you (corporate politics) but this is the kind of thing you sometimes have to deal with.

Please feel free to PM me if you wish to discuss specifics that would only bore the forum.

Cheers

Quote:

---

Originally posted here by nihil
That is you main problem, two ignorant (IT wise) egos jockeying for position.............

---

i don't think you have a clue under which "umbrella" my IT area (and InfoSec!!) fall under.

we fall under the same organizationla umbrella as the coffer machine maintenence staff, janitorial staff, and guy that cleans the dumpsters. now close your eyes and picture my "divisional head"!

a healthy sense of humor is a must in life

:-)

a suggestion from me is that there is a program out there called Deep Freeze. This is a program that once you have "frozen" the computer the way you want it, when the computer restarts then everything that has been added or changed it will be deleted and your computer will be the same when you froze it. Read more about Deep Freeze here.

http://www.faronics.com/ - Product Website

Quote:

---

Originally posted here by silent-mage
a suggestion from me is that there is a program out there called Deep Freeze. This is a program that once you have "frozen" the computer the way you want it, when the computer restarts then everything that has been added or changed it will be deleted and your computer will be the same when you froze it. Read more about Deep Freeze here.

http://www.faronics.com/ - Product Website

---

thanks. that's an interesting app. i have never heard of it before. kinda like "take back" or ghost without the ghosting.

Quote:

---

we fall under the same organizationla umbrella as the coffer machine maintenence staff, janitorial staff, and guy that cleans the dumpsters. now close your eyes and picture my "divisional head"!

---

Would you mind if I only closed my left eye (I am right handed)? :D

You are under what we would call "Site Services" over here....................hell man, that is bizzare!...........I was imagining Finance, that was common in the early days over here.

Maybe he needs to arrange meetings outside the normal Divisional Heads ones and bring you and the computer literate representatives of the other divisions along....................like a "working group" that reports back to the main committee?

Actually, status apart he is probably as computer savvy as the lot of them.................you need to get the users involved :)

I would go along the lines of talking "business continuity", "service level agreements", "quality of support", "my customer, my responsibility"..............does he have any worthwhile ambition?

This is a bad one :mad:

Quote:

---

Originally posted here by nihil
...................hell man, that is bizzare!.........

---

you can say that again. :D . okay, my last post to this fun thread - i promise.

the only thing that keeps me here is free tuition for secure_lockdown jr. in 10 years i will collect. and when the time comes, secure_lockdown jr. is going to university 2 times. once because it's an earned benefit and once more because of all the hell i had to put up with. :p