Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Jewel
May 2, 2009

also maybe fire the dude who said "yeah you can have a mac we'll spend money on that" and not the dude who thought that was okay since their boss said yes. like. what's he supposed to do? "no we dont support macs" "okay, guess I'll suffer because my boss made a stupid decision and almost certainly won't buy me a proper computer for a second purchase"

Adbot
ADBOT LOVES YOU

Grassy Knowles
Apr 4, 2003

"The original Terminator was a gritty fucking AMAZING piece of sci-fi. Gritty fucking rock-hard MURDER!"

Jewel posted:

also maybe fire the dude who said "yeah you can have a mac we'll spend money on that"

Yes

Jewel posted:

not the dude who thought that was okay since their boss said yes. like. what's he supposed to do? "no we dont support macs" "okay, guess I'll suffer because my boss made a stupid decision and almost certainly won't buy me a proper computer for a second purchase"

No. You can fire them both, as long as new employee is documented as having seen the policy. That could be a sign-off, attendance at a training session where the materials were covered, et cetera.

Inspector_666
Oct 7, 2003

benny with the good hair

Thanks Ants posted:

You can have whatever policies you want I guess, but if a network was meant for authorized devices only then I'd expect that to be enforced with some port security. There are policies that only exist to provide BOFH-ammo for the occasional chance to be a massive poo poo to people, and they don't help the organisation in any way.

I'm in line with this, try to err on the side of not firing people for the first offense that isn't malicious.

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

Grassy Knowles posted:

Yes


No. You can fire them both, as long as new employee is documented as having seen the policy. That could be a sign-off, attendance at a training session where the materials were covered, et cetera.

Come on man you know this policy doesn't exist and there was no training. I'd be surprised if there is even a network access policy that restricts non-corporate devices from being plugged in to the network.

We're all in the same world here right?

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Grassy Knowles posted:

Yes


No. You can fire them both, as long as new employee is documented as having seen the policy. That could be a sign-off, attendance at a training session where the materials were covered, et cetera.

That seems a little excessive for a junior employee who got the goahead from his boss. Assume the guy wasn't a total dick that is. He should be fired for being a dick, not for acting on instruction from his boss.

and even then! Boss is dumb, but probably doesn't need to be fired!

e: Actually reading back the junior guy wasn't even being a dick at all. Hell, he was actively trying to make things work despite your intransigence.

Maybe this comes from the fact that I administer and troubleshoot both macs and PCs on a daily basis, and it works perfectly loving fine with AD and our DCs.

The Iron Rose fucked around with this message at 02:02 on Nov 17, 2017

Inspector_666
Oct 7, 2003

benny with the good hair

Judge Schnoopy posted:

Come on man you know this policy doesn't exist and there was no training. I'd be surprised if there is even a network access policy that restricts non-corporate devices from being plugged in to the network.

We're all in the same world here right?

Even if there is a policy, it's a dumb "gotcha" if you don't have port security enabled.

The Iron Rose posted:

e: Actually reading back the junior guy wasn't even being a dick at all. Hell, he was actively trying to make things work despite your intransigence.

I don't think describing it as intransigence is fair either.

Weatherman
Jul 30, 2003

WARBLEKLONK
My Mac dick and your Mac dick
Sitting by the fire
My Mac dick told your Mac dick
I'm gonna set this thread on fire

Talkin' bout hey now (hey now) hey now (hey now) spergout spergout all-day

The Iron Rose
May 12, 2012

:minnie: Cat Army :minnie:

Inspector_666 posted:

Even if there is a policy, it's a dumb "gotcha" if you don't have port security enabled.


I don't think describing it as intransigence is fair either.

Yeah that was too harsh, my bad. Still, actively looking into how to bind to AD is waaaaaaaaaaaay further than I expect most end users to go.

The Fool
Oct 16, 2003


Weatherman posted:

My Mac dick and your Mac dick
Sitting by the fire
My Mac dick told your Mac dick
I'm gonna set this thread on fire

Talkin' bout hey now (hey now) hey now (hey now) spergout spergout all-day

Entire derail worth it for this post

DELETE CASCADE
Oct 25, 2017

i haven't washed my penis since i jerked it to a phtotograph of george w. bush in 2003

The Iron Rose posted:

Maybe this comes from the fact that I administer and troubleshoot both macs and PCs on a daily basis, and it works perfectly loving fine with AD and our DCs.

of course it does, you know how to do your job

MrMojok
Jan 28, 2011

Fire all users and then fire yourselves IMO

Grassy Knowles
Apr 4, 2003

"The original Terminator was a gritty fucking AMAZING piece of sci-fi. Gritty fucking rock-hard MURDER!"

The Iron Rose posted:

That seems a little excessive for a junior employee who got the goahead from his boss. Assume the guy wasn't a total dick that is. He should be fired for being a dick, not for acting on instruction from his boss.

and even then! Boss is dumb, but probably doesn't need to be fired!

e: Actually reading back the junior guy wasn't even being a dick at all. Hell, he was actively trying to make things work despite your intransigence.

Maybe this comes from the fact that I administer and troubleshoot both macs and PCs on a daily basis, and it works perfectly loving fine with AD and our DCs.

I have absolutely no issue with the Mac portion of this. It's the violation of port security and stubborn "I'm going to make this work instead of listening to what I've been told already" that I find unacceptable.

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

Grassy Knowles posted:

I have absolutely no issue with the Mac portion of this. It's the violation of port security and stubborn "I'm going to make this work instead of listening to what I've been told already" that I find unacceptable.

But there is absolutely a point to be made that "we don't support this" can mean both "we won't help but your boss bought you this thing so go ahead and figure it out" and "don't do this on our network it's against the rules"

Dick Trauma
Nov 30, 2007

God damn it, you've got to be kind.

Weatherman posted:

My Mac dick and your Mac dick
Sitting by the fire
My Mac dick told your Mac dick
I'm gonna set this thread on fire

Talkin' bout hey now (hey now) hey now (hey now) spergout spergout all-day

I am a cross-platform dick.

Zil
Jun 4, 2011

Satanically Summoned Citrus


MrMojok posted:

Fire all users and then fire yourselves IMO

Or anarchy option, just fire yourself.

A Pinball Wizard
Mar 23, 2005

I know every trick, no freak's gonna beat my hands

College Slice

MrMojok posted:

Fire all users and then fire yourselves IMO

into the sun

Grassy Knowles
Apr 4, 2003

"The original Terminator was a gritty fucking AMAZING piece of sci-fi. Gritty fucking rock-hard MURDER!"

Judge Schnoopy posted:

But there is absolutely a point to be made that "we don't support this" can mean both "we won't help but your boss bought you this thing so go ahead and figure it out" and "don't do this on our network it's against the rules"

Crowley posted:

Some goddamn idiot boss approved the purchase of a Mac. We don't support Macs.

Idiot-with-a-Mac creates a ticket to get shiny new iMac "Connected to the network".

I reply to ticket that as per [Company policy] we don't support Macs, and that he's welcome to use the BYOD WLAN and help himself. Then I close the ticket.

Today I see a new ticket in my queue. This time he's found a guide on how to join a Mac to Active Directory, and he's been trying to do that himself.. through the wired connection for his thin client, but he doesn't have "the password".

I reply that we still don't support Macs, and close the ticket. Then I write a mail to the network guys and my own boss informing them of the ticket. Network replies 20 seconds later that the network post has been closed for "security reasons due to suspicious network activity", and boss replies 10 minutes later by BCCing me in a letter to HR explaining that we've suspended his account due to breach of security protocols.

Idiot-with-a-Mac is fresh out of college, and still on his 3-month probationary period. I wonder if we'll get an account termination ticket tomorrow. (probably not. He'll likely get off with a note in his record and a stern talking to.)

Holy Haze
Nov 10, 2017

Inspector_666 posted:

Because it happens even when they're not in the office.

Check if they added an AD profile calendar to their Mac.

Holy Haze fucked around with this message at 03:56 on Nov 17, 2017

Samizdata
May 14, 2007

The Fool posted:

Sorry, but when my environment is entirely Windows, and someone decides they want to be a special snowflake I'm not going to spend the time and money on the tools needed to properly manage one workstation.

In addition, the type of user that goes out of their way to acquire a mac when everyone else in the office has a windows machine is guaranteed to be a high support burden throughout their entire tenure.

They can deal with the limited support as a consequence of their choice.

Not only that, but an extra expense in software licensing, since you can't roll them into your Windows based site licenses and such.

Inspector_666
Oct 7, 2003

benny with the good hair

Holy Haze posted:

Check if they added an AD profile calendar to their Mac.

Ooooh, interesting, I'll check that out. Do you know why it causes lockout issues?

Holy Haze
Nov 10, 2017

Inspector_666 posted:

Ooooh, interesting, I'll check that out. Do you know why it causes lockout issues?

It was trying to pull in the calendar with an old cached password.

I used 'Account Lockout and Management Tools' from Microsoft to identify the time and place of the lockout and cross referenced the DC event.

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum

Holy Haze posted:

It was trying to pull in the calendar with an old cached password.

I used 'Account Lockout and Management Tools' from Microsoft to identify the time and place of the lockout and cross referenced the DC event.
But do you know why it would lock the local account on the Mac?

Inspector_666
Oct 7, 2003

benny with the good hair

anthonypants posted:

But do you know why it would lock the local account on the Mac?

Yeah, I don't think that is causing the issue, it has to be something local to the Mac, these lockouts are happening with no connection to the DC, and it's happening way after the lockout would have timed itself out anyway. It's the cached account locking itself.

Proteus Jones
Feb 28, 2013



Inspector_666 posted:

Yeah, I don't think that is causing the issue, it has to be something local to the Mac, these lockouts are happening with no connection to the DC, and it's happening way after the lockout would have timed itself out anyway. It's the cached account locking itself.

Can he access Exchange if he's not connected to the VPN?

I know way back when (prior to O365) using the native apps, the Apple Mail and/or Calendar client would *hammer* the Exchange server with retries even if the password was invalid and lock the AD account. This can also happen (or at least used to) with the Exchange connector in iOS. He could also have kept trying the same old password in Outlook over and over triggering a lock.

Proteus Jones fucked around with this message at 07:03 on Nov 17, 2017

Inspector_666
Oct 7, 2003

benny with the good hair

Proteus Jones posted:

Can he access Exchange if he's not connected to the VPN?

I know way back when (prior to O365) using the native apps, the Apple Mail and/or Calendar client would *hammer* the Exchange server with retries even if the password was invalid and lock the AD account. This can also happen (or at least used to) with the Exchange connector in iOS.

No Exchange, we use Google.

I actually did the issue with Exchange lockouts from calendars at my old job a couple of times!

Crowley
Mar 13, 2003
Jesus Mohammed Andersen I leave for a single day and you run amok with Mac frienzy?

To clarify
  • We're handling GDPR Article 9 data.
  • All users must attend a class on data security before they get their accounts.
  • All users sign off on the IT policies before their account is enabled.
  • We regularly send out mandatory mini-courses (2-3 minutes each) to keep people informed.

My boss went over the issue with the other boss. It turns out that the Mac was purchased only to edit [company related] video on. It was never the intention that it should replace the users' thin client.

In my professional experience It's pretty rare here in Denmark to outright fire someone for messing up like this. It wasn't malicious, he wasn't trying to commit a crime. He was just, well.. an idiot. If it happens again he'll probably get the boot, but for now I expect him to stay in the company and learn his lesson. With a bit of luck everyone else will learn from it too.

Malachite_Dragon
Mar 31, 2010

Weaving Merry Christmas magic
NO HE DARED TO gently caress UP ONE SINGLE TIME, GIVE HIM TO THE SHARKS

Sometimes I have to double-check that some of y'all aren't that Dilbert as gently caress guy. Jesus.

AlexDeGruven
Jun 29, 2007

Watch me pull my dongle out of this tiny box


Jewel posted:

also maybe fire the dude...

lol that people think this kind of stuff actually happens.

The brand new guy who deleted an entire core DNS zone at 3pm on a Tues? Still here.

The guy who directed him to do DNS maintenance with domain admin creds without over-the-shoulder supervision for at least the first time? Promoted.

baquerd
Jul 2, 2007

by FactsAreUseless

AlexDeGruven posted:

The guy who directed him to do DNS maintenance with domain admin creds without over-the-shoulder supervision for at least the first time? Promoted.

You've got to admire the skill inherent in coming out of a poo poo sewer smelling sweet on the other side.

AlexDeGruven
Jun 29, 2007

Watch me pull my dongle out of this tiny box


baquerd posted:

You've got to admire the skill inherent in coming out of a poo poo sewer smelling sweet on the other side.

Yeah, it's called "buddies with the VP"

baquerd
Jul 2, 2007

by FactsAreUseless

AlexDeGruven posted:

Yeah, it's called "buddies with the VP"

Clearly he is a man of vision wasted in the trenches!

xsf421
Feb 17, 2011

AlexDeGruven posted:

lol that people think this kind of stuff actually happens.

The brand new guy who deleted an entire core DNS zone at 3pm on a Tues? Still here.

The guy who directed him to do DNS maintenance with domain admin creds without over-the-shoulder supervision for at least the first time? Promoted.

The DNS thing happened my second week with the company. I sit next to the dude who did it, I don't know how he's still there

devmd01
Mar 7, 2006

Elektronik
Supersonik
I'm glad I work for IT in a company that doesn't fire people who make simple mistakes, and instead works on process improvement and making the systems more robust so human error is lessened.

I hosed up a system refresh a couple of weekends ago, and it had major downstream customer-facing implications. Granted, it helped that I fixed the problem in 5 minutes as soon as I was involved, but it shouldn't have happened in the first place and that's what we try to focus on preventing.

That said, you better have a god drat approved change control in for it or it's your rear end.

Proteus Jones
Feb 28, 2013



devmd01 posted:

I'm glad I work for IT in a company that doesn't fire people who make simple mistakes, and instead works on process improvement and making the systems more robust so human error is lessened.

Yeah, if it's repeated gently caress-ups that's one thing. But a one-strike rule is pretty loving lovely. Especially when the root is usually because the company has piss-poor process documents and/or an apparently non-existent change process with a back-out procedure.

DONT TOUCH THE PC
Jul 15, 2001

You should try it, it's a real buzz.
When someone posts about any professional gently caress-up on facebook, large swaths of people will turn up to tell the world they would fire the person who was responsible.
More often than not most people involved are "Self-Employed" computer people in their late 30s early 40s, who haven't had a proper job.

Sefal
Nov 8, 2011
Fun Shoe
One of the things a old coworker of mine said to me was. "I'd rather you gently caress up and try new things, learn from it , then do nothing but stay in your comfort zone"

Dr. Arbitrary
Mar 15, 2006

Bleak Gremlin
Let's remember how we used to always talk about using the phrase "how did this happen?" rather than "why did this happen?"

If a single fuckup is so detrimental to your operations, the problem isn't with the person making the fuckup.

MF_James
May 8, 2008
I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

devmd01 posted:

I'm glad I work for IT in a company that doesn't fire people who make simple mistakes, and instead works on process improvement and making the systems more robust so human error is lessened.

I hosed up a system refresh a couple of weekends ago, and it had major downstream customer-facing implications. Granted, it helped that I fixed the problem in 5 minutes as soon as I was involved, but it shouldn't have happened in the first place and that's what we try to focus on preventing.

That said, you better have a god drat approved change control in for it or it's your rear end.

Yeah this, I definitely had a major fuckup and brought down internet access for roughly 800 sites, it was fixed fairly quickly and I learned a lot from that. I've also made smaller mistakes with less impact. Everyone makes mistakes, it happens, you just need to make sure you learn from it "Why did this happen" "What can I do differently next time to NOT have something like this happen?" etc.

Everyone on my team has made mistakes, our Architect, prior to being brought into that role brought 2400 sites down for a few hours, it was not 100% his fault, but he could have avoided it by being more careful. poo poo happens, learn from it, don't crucify people unless they are repeatedly making mistakes and showing an unwillingness to learn from them.

Antioch
Apr 18, 2003
We have an idiot here that brought down our entire customer facing presence - website, online/mobile banking, phones, email - for 27 straight hours, because he forgot to back up a config on a core switch before replacing it. His manager got booted, but the dummy is still here, and as the cherry on a poo poo sundae he is more smug now than before.

Adbot
ADBOT LOVES YOU

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal
Had a user call up complaining that guests couldn't use the public wifi. We've had a number of issues with it before but I've resolved them all and test it nearly every day to ensure the problem doesn't come back.

"Ok, did you have the us-"
"I DON'T HAVE TIME TO GO THROUGH YOUR IT STEPS. I need them connected now. The manager here says if public wifi doesn't work she connects them using the staff wifi, I need the password now."
"No, I'm sorry, I will not allow public devices to connect to our internal networ-"
"WHY NOT"
"I can't verify that those public devices don't have viruses or aren't using illegal or malicious software. It will not happen. I tested the public wifi yester-"
"IT'S NOT WORKING. Give me a solution Now."
"I will look into it and call you back."

I then got a call from her coworker asking the same loving thing, and when I pushed back the evil lady took the phone from her hand and demanded the same poo poo again in an even more smarmy and lovely tone. This lady is the worst person in the organization and nobody likes her, but somehow she gets a pass because "she came from the corporate world so she's not used to working in these government environments". loving hell, I came from the financial industry and I'm doing just loving fine here, stop writing it off that she's adjusting and come to accept she's a horrible human being already.

  • Locked thread