Small shop admin thread: IDK, pretty sure my predecessor was just a fucking moron

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Small shop admin thread: IDK, pretty sure my predecessor was just a fucking moron

«‹›11 »

Dans Macabre: Apr 24, 2004

This thread is basically for people that support systems for companies under 100 users, under 5 staff, MSPs, and people with shoestring budgets.

Dans Macabre fucked around with this message at 16:11 on Aug 8, 2016

# ¿ Jun 3, 2015 18:40

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 02:37

Dans Macabre: Apr 24, 2004

My first question is what are you liking for online backup ("as a service")

# ¿ Jun 3, 2015 18:40

Dans Macabre: Apr 24, 2004

Yeah I'm working with about 10 servers on two ESXi hosts. I have one SQL server I need to worry about everything else is saas or flat files or I don't care about backing it up.

I've used barracuda before as well and it was okay but haven't looked at other options in a few years.

# ¿ Jun 3, 2015 18:47

Dans Macabre: Apr 24, 2004

KS posted:

I consider that completely normal for every enterprise software vendor. Even the vendors like VMware or Solarwinds that provide pricing on their website, that pricing isn't accurate at all. Seems like a silly thing to complain about.

yeah but why even call it "pricing" instead of what it really is, "feature comparison"

# ¿ Jun 5, 2015 17:13

Dans Macabre: Apr 24, 2004

I wouldn't sign it. IMHO if they can't offer enough incentive to keep you after you get your cert, they need to solve that problem. Your boss should do something like "get your cert and you'll get X bonus/salary increase" along with of course continued pro dev.

# ¿ Jun 10, 2015 17:47

Dans Macabre: Apr 24, 2004

How are you handling contact sharing for external contacts? We have a bunch of external contacts and external distribution lists that we want to access from iphone as well as Outlook. Currently we're on public folders + Exchange 2013.

Two options I'm considering:

- Move from public folders to GAL, and allow specific users to manage the recipients so I don't have to. Cons: workflow change, users can't view contacts as contact cards

- Move from public folders to a shared mailbox, give everyone the password to that mailbox, and have them add it as a second exchange account on their phones (yuck) this would also mean anyone would be able to edit it

Not able to pay :20bux:

for a third party unless it's amazing.

# ¿ Jun 11, 2015 19:33

Dans Macabre: Apr 24, 2004

I'd give all the info to your client and have them contact the police. You don't need to initiate that conversation.

# ¿ Jun 12, 2015 01:20

Dans Macabre: Apr 24, 2004

Beefstorm posted:

So, if we have 6 IT staff, banned from thread?

webmaster doesn't count :smug:

# ¿ Jun 15, 2015 21:58

Dans Macabre: Apr 24, 2004

stevewm posted:

Ubiquiti Unifi... https://www.ubnt.com/unifi/unifi-ap-ac/

The AC capable models are about $260 USD. Management software is free and does not require a subscription/support contract/yearly extortion fee. Runs on Linux, Mac, Windows.

For even cheaper, the 2.4Ghz only models (UniFi UAP) are only around $80USD each..

I was looking at ubiquiti but I'm really concerned about the apparent lack of support. I understand that they ~just work~ but if/when there's a problem it's basically email support only, or use their forums lol. I need to pick up a phone when wifi isn't working.

# ¿ Jun 22, 2015 21:57

Dans Macabre: Apr 24, 2004

Walked posted:

Small IT shop; medium sized environment.

What would you guys suggest for tracking inventory and network devices? Spiceworks has never been a hit with me, personally.

Really just want something lightweight that's not excel, and maybe that can track relationships and site association of devices. Bonus points if it can be tied to an end user in AD for end user devices.

Or should I give spiceworks another go?

I've used lansweeper at one job and I found it pretty great. http://www.lansweeper.com/

# ¿ Jul 9, 2015 14:01

Dans Macabre: Apr 24, 2004

Central font management!

We have a team of about 10 people who work on Macs with InDesign and need to share fonts amongst each other. Right now people just source their fonts individually and I'd like to provide a solution to centrally manage them, e.g. have a central server that has all the fonts and whenever someone adds a new font everyone can access it.

I've used Extensis Suitcase Fusion before and it looks like they have a Universal Type Server that will do the trick, but it's $1400 and I want to spend like, $500. Are there other options?

Server side needs to be a Windows VM or it's going to have to be one of the iMac workstations

# ¿ Jul 10, 2015 13:30

Dans Macabre: Apr 24, 2004

EoRaptor posted:

UTS Lite is pretty much the only product that is standalone. You'll also eat it on upgrades if you use Creative Cloud, because you'll need to upgrade the client every year to maintain compatibility with the latest adobe apps.

It is agnostic, and the windows server version will happily serve mac clients and deal with mac type 1 fonts.

If you have creative cloud team edition, and you actually care about font licensing, you can take a look at Adobes Typekit offering. Fonts purchased/licensed there should be available across all team members. I never went that route, so you will need to research and confirm it will suit your needs.

Thanks, I also saw font agent server but that requires mac server

# ¿ Jul 11, 2015 20:06

Dans Macabre: Apr 24, 2004

Jeoh posted:

"that's how it's always been done" is also the attitude at a lot of small shops, though

Yes but in smaller companies you can do things like have lunch with the owner, push CTO to change procedures whilst being in tier 1 noc, etc.

# ¿ Jul 17, 2015 21:49

Dans Macabre: Apr 24, 2004

Guy Axlerod posted:

I'm looking for a new Security Gateway that will handle Site-to-Site and Client VPN. I'm no expert in this area, and neither is my coworker.

We have about 15 people at my site, and about 5 at the other, and we'd be connecting to AWS as well.

I'd really like it if the client VPN would work with the OS native VPN clients on both OSX and Windows. Failing that, the client needs to be readily available and not be garbage.

I'm asking for a thing that probably doesn't exist here, but it would also be really nice if they somehow used Google Apps to authenticate, because that's the closest thing we have to single sign-on at the moment.

sonicwall + netextender is honestly fine. for that number of people you could run it on a sonicwall firewall itself or do it off a vm.

# ¿ Jul 19, 2015 02:23

Dans Macabre: Apr 24, 2004

Speaking of Macs when I join macs to the domain (just vanilla no centrify or admitmac) boots go heeeeellllla slow. When I was troubleshooting this it was talking about the workstations looking for domain controllers that no longer exist but even when I tried to specify a one specific very-physically-close domain controller, no help. I ended up having the Macs not on domain and making the users authenticate when they want to connect to network share.

This is obviously the wrong way to do this so what do I do to fix? Will Centrify solve my problem? Is my problem totally weird?

Second question, "we" now want to back up all the workstations in addition to the servers. For Windows we do folder redirs so that takes care of that, but I know Mac home folders are just trash when it comes to Windows. I don't want to get into using something like mozy/crashplan/carbonite but maybe that's the best for desktop...

# ¿ Jul 29, 2015 14:14

Dans Macabre: Apr 24, 2004

McDeth posted:

What version of Mac OS? We've run into a ton of problems with the loading bar taking forreeeevvveerrrrr (if at all, most of the time the computer freezes) to get to the password screen. Apparently that was a known bug in 10.10.1-3 that's sense been fixed. Although it wasn't a bug that reared its head a ton, the only solution was to reboot the machine, reset PRAM until it decided to get to the loading screen.

Although to be honest a problem with slow loading only when bound to AD is likely a DNS issue...

This is exactly what we were seeing... but again only on domain. Why is OSX looking for DNS before even getting to the login screen though?

quote:

We use CrashPlan ProE for all of our servers & desktops. It's honestly probably not the best solution for servers because of the lack of bare metals recovery, but for desktops it is bad rear end.

do you find crashplan causes some undesired behavior with users (as in they just save everything on the desktop because "it's backed up")?

# ¿ Jul 29, 2015 21:30

Dans Macabre: Apr 24, 2004

Thanks Ants posted:

What happens if you nslookup / dig your AD domain? E.g. nslookup corporation.local ?

Are all the addresses returned valid?

Will check tomorrow

# ¿ Jul 30, 2015 00:49

Dans Macabre: Apr 24, 2004

Swink posted:

Cross posting from the poo poo thread - is dirsync still the in-thing for O365? What don't I get that I would get if I rolled out ADFS?

Also could someone describe when a user would need to talk to the O365 server? Is it every time they launch Word or is it a once a month licence check like Adobe?

I really need a good primer on this whole 365 business.

I'm using ad connect it's fine

the desktops apps will phone home to o365 constantly and I don't know how many days it can go without throwing a warning.

If you're posting in this thread I'm going to go on a limb and say you absolutely do not need ADFS.

# ¿ Jul 30, 2015 16:22

Dans Macabre: Apr 24, 2004

Thanks Ants posted:

What happens if you nslookup / dig your AD domain? E.g. nslookup corporation.local ?

Are all the addresses returned valid?

yes it returns 3 domain controller IP addresses that all exist irl

# ¿ Jul 30, 2015 16:26

Dans Macabre: Apr 24, 2004

Swink posted:

He doesn't know anything and I only know slightly more so I can't allay his fears that well.

Ten-four on ADFS. Thanks.

Well if you DON'T do password sync with AD connect then users will have a separate set of credentials to log in to o365, which will be stored with Microsoft anyway. If he doesn't want passwords with Microsoft then O365 is off the table, or you use ADFS. If you use ADFS and your domain is not available to Azure for some reason then users won't be able to authenticate.

# ¿ Jul 31, 2015 16:30

Dans Macabre: Apr 24, 2004

Thanks Ants posted:

If you're worried about stored hashes then just enforce a maximum password age.

well except that's not enough because if the max age comes about, you can still log in to office 365 until the user authenticates with real AD and changes the password.

# ¿ Aug 3, 2015 22:00

Dans Macabre: Apr 24, 2004

Swink posted:

We're only doing office. Mail is staying in-house. I'm only interested in this stuff as in pertains to staff using The office suite.

oh so in that case literally who cares

# ¿ Aug 3, 2015 22:01

Dans Macabre: Apr 24, 2004

Here's a common request I've seen over my years of working for/with small business. I'm sure it comes up in larger companies but anyway:

CEO of the company is jasshole@company.com and his assistant wants to send emails on his behalf. The assistant also wants to manage the replies instead of the president.

So what do you do

option 1 - create second mailbox john.rear end in a top hat@company.com. Internal users start emailing that address by mistake because they pick it from gal

option 2 - have assistant send from real address, create mailbox rule to move the replies to a sepcific folder in the same mailbox and have assistant look in there. then deal with that for the rest of my life.

# ¿ Aug 6, 2015 20:29

Dans Macabre: Apr 24, 2004

Gerdalti posted:

I generally grant the assistant rights to the mailbox and rights to send as the CEO. CEO either trusts the assistant, or you don't and you do not grant this level of access. A good employment contract for the assistant is a must here, as they will have access to sensitive company data.

CEO trusts the assistant, not a problem. The problem is the CEO does not want to see all the replies to this specific email.

Example: assistant sends an email from the CEO wishing merry christmas. But it's going to VIPs so he wants it to be from his "real" address not noreply@ or assistant@. But he also doesn't want to go through all the responses saying "thanx you too" he wants the assistant to look at those and flag any that require action.

# ¿ Aug 6, 2015 20:42

Dans Macabre: Apr 24, 2004

adorai posted:

Give him a second alias and set the reply to address to that. Make a mailbox rule to match messages sent to the secondary reply to address. Jasshole@ vs j.rear end in a top hat@.

nice yeah I should just set the reply to

# ¿ Aug 9, 2015 00:27

Dans Macabre: Apr 24, 2004

Tots posted:

Hey guys. I have a chance to get into a sysadmin job for ~80 users. As far as I know, I would be the only one there although I've been told there's budget for temporary consultants if I need help with something. This is for a new contract in a new building and I'd basically be setting things up from the ground up.. Nothing is in place yet. No domain, no ticketing system, etc.. Does this sound like a good opportunity or a death wish?

for 80 staff you can limp along with 1 sysadmin and 1 helpdesk bro.

are you going to be expected to do other "IT stuff" such as writing sql queries for people, or do they understand that's a third hire

# ¿ Aug 9, 2015 02:04

Dans Macabre: Apr 24, 2004

madsushi posted:

I've worked with this before, what we did was include a code (like #X3010Q) in white at the bottom of the email (in the signature) that indicated it was sent from the assistant. The CEO has a rule that auto-filters anything with that word into a special "you don't have to read this" folder and auto-CC'd the assistant so she could read them. Nobody saw it because it blended in with the background. The assistant had a selection of signatures they could use, to either make sure replies were hidden, or make sure they were seen, or flagged as important when they came back, etc. So basically codes + Outlook rules.

There was a whitebox in the basement running Outlook all day to ensure that the rules were always processing (this was in the old days). We also did the same thing with the CEO's BlackBerry, using custom signatures so that he could send messages from his BlackBerry and the messages would still end up in his "Sent" folder.

I like this - nice.

I mean I hate it but that's probably the best solution considering.

# ¿ Aug 13, 2015 13:49

Dans Macabre: Apr 24, 2004

Return Of JimmyJars posted:

Sigh,

I'm at the hospital where my wife is in labor with our second kid. My boss has sent 6 texts and a dozens emails knowing that I'm at the hospital with my wife.

Pretty sure I'll be using paternity leave to find a new job.

Turn off your phone! Or at least disable work email sync. Literally everything can wait.

# ¿ Aug 13, 2015 13:52

Dans Macabre: Apr 24, 2004

Beefstorm posted:

Also, what is everyone's favorite task and ticket management system for a small IT contracting shop?

Do you want something that also does client management and billing and all that? I think connectwise and autotask are the two big ones.

# ¿ Aug 13, 2015 21:29

Dans Macabre: Apr 24, 2004

unruly posted:

I can almost see this if the person isn't a power user or in IT. It's sad how few people know about Spotlight or the Applications folder in general. They just mash the buttons until it works, and I guess that works for them

First of all keychain sucks.

Secondly I seriously think it's okay to expect Mac users to be a little more technical than the Windows users if you're running a mostly-Windows shop. For example the other day someone on a Mac gave a Windows guy an HFS+ formatted flash drive and Windows guy got mad that he can't open it. Mac guy should be aware of things like that and adjust accordingly.

Don't get me wrong I love my Macbook Air (and would use it more often it vsphere had a fat client for it or if the vsphere web client wasn't poo poo (is it still poo poo?)) but if you're in the minority you need to know how to remain compatible with the rest of the org.

# ¿ Aug 14, 2015 18:47

Dans Macabre: Apr 24, 2004

Rhymenoserous posted:

I simplify by just not letting people use macs. If someone insisted on a mac as a work computer I'd just sip my coffee and say "Nope."

That's weak.

# ¿ Aug 28, 2015 03:40

Dans Macabre: Apr 24, 2004

Internet Explorer posted:

Yeah, I don't really see any reason not to turn down people who want to use Macs in a Windows shop unless you use published apps or VDIs. That's basically unsupportable.

As long as you clearly define where IT department support ends and user responsibility begins, having Macs in the environment isn't bad. These days you can run win7+office 2013 in a vm on a mac with barely any slowness, and of course published apps. If an employee has been using Mac their whole life and is going to be more productive on a Mac then they should have one IMHO. Just make sure they know they need to fix their own keychain.

# ¿ Aug 31, 2015 21:29

Dans Macabre: Apr 24, 2004

adorai posted:

You are still required to patch the machines on your production network. A compromised mac is still going to be a hazard to the network. It needs to be on an untrusted vlan if you aren't supporting it.

So patch it what's the problem? I feel like most patch management solutions can do OS X at this point. The RMM we use does, I know KACE and altiris do in theory...

# ¿ Sep 2, 2015 00:24

Dans Macabre: Apr 24, 2004

Man you guys really hate Macs. Except for skipdogg you're my bro.

# ¿ Sep 3, 2015 02:34

Dans Macabre: Apr 24, 2004

Just took over an office. 15 servers, 50 users, and the subnet mask is 255.255.224.0. ugh. why. also I've had so many idiot problems because I keep typing 255.255.255.0 by mistake.

# ¿ Sep 3, 2015 02:37

Dans Macabre: Apr 24, 2004

OK so this is exactly the point I was making originally - don't flat out say "no", clearly define what the expectations are from IT vs. expectations from the user, and let the user choose. If working on a Mac is going to make them more efficient then let them do that. As an IT admin it's not your job to decide what will make the user more efficient. You give recommendations based on your experiences and let the user decide. At least that's how it's been at most small orgs I've worked with.

So for example

IT responsibility
* Software updates - the stuff like SMB breaking happened with a "major" release (like I think from 10.8 to 10.9). So IT dictates what you update to in that regard. Smaller updates control with RMM or get a Mac server if you have budget.

* Hardware procurement - you buy it, order applecare for it etc.

* Initial configuration - install admitmac/centrify if needed, office, vmware fusion + throw your windows image on there as a vm, antivirus, management tool, bind to domain

* Network side stuff - I'd say best effort on making sure printer/MFPs are Mac compatible, file shares are accessible.

User responsibility
* Anything hardware related, on them. You can give them a loaner PC until they get their Mac to the mall to fix.

* Anything that doesn't "just work" in Mac environment, on them. They have a Windows VM for stuff that requires Windows.

* Obviously desktop-level backup falls on the user just as it would with Windows

# ¿ Sep 3, 2015 18:22

Dans Macabre: Apr 24, 2004

skipdogg posted:

12" Dell Ultrabooks

supremacy

# ¿ Sep 3, 2015 18:23

Dans Macabre: Apr 24, 2004

Swink posted:

Thread title for any thread in this forum.

I posted earlier about deploying O365. Where do I get the installers from? I can only find a bunch of cab files that are downloaded by the OCT, which are the 'click to run' variant.

Thanks Ants posted:

https://technet.microsoft.com/en-us/library/dn782860.aspx

Enterprise licensing only (e.g. I don't think you can do this on the Business plans).

Nopers. You can do this for other versions.

Swink you will want to use click to run. Here's what you do

1. download click to run http://www.microsoft.com/en-us/download/details.aspx?id=36778

2. edit the xml file that's in there. then run it setup referencing the xml, once with /download to download to local path you specify, then once with /configure to actually install.

Now since you are not using ProPlus you need to change the PRODUCT ID value. What do you change it to? Depends on what you have. Here's the reference: https://support.microsoft.com/en-us/kb/2842297

So for example if you are on Business Premium, you need to use O365BusinessRetail. HOWEVER that won't install everything for you as a business premium user, because you also get Lync and Lync isn't part of O365 Business Retail install. So you would need a second product ID for lync. So your config file will look like this:

code:

<Configuration>

<Add SourcePath="\\poop\Office" OfficeClientEdition="32" >
    <Product ID="O365BusinessRetail">
      <Language ID="en-us" />
    </Product>

    <Product ID="LyncEntryRetail">
      <Language ID="en-us" />
    </Product>
</Add>

<Display Level="None" AcceptEULA="TRUE" />

<!-- if installing on TS:
 <property name="SharedComputerLicensing" value="1" /> 
-->

</Configuration>

Reading your original post I'm guessing you will want to use ProfessionalRetail but idk.

That's all the config you do here. Everything else you manage over GPO.

The other thing to note is this won't uninstall existing Office versions for you. So you'll need to make a script that uninstalls the old version of office, and then runs clicktorun.

Dans Macabre fucked around with this message at 16:03 on Sep 4, 2015

# ¿ Sep 4, 2015 15:53

Dans Macabre: Apr 24, 2004

Aunt Beth posted:

IBM provides onsite repair services for macs now that it's best friends with Apple.

do you have more info on this pls

# ¿ Sep 4, 2015 15:59

Adbot: ADBOT LOVES YOU

# ¿ Apr 29, 2024 02:37

Dans Macabre: Apr 24, 2004

Crowley posted:

If you have a Business Agreement can't you download Office from VLSC?

If you want to activate with an office 365 subscription, no.

# ¿ Sep 4, 2015 19:09

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Small shop admin thread: IDK, pretty sure my predecessor was just a fucking moron

«‹›11 »