Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Internet Explorer
Jun 1, 2005





Sounds like a great opportunity but I would also push for a junior guy to help blunt low-end tickets, answer phones, deal with walk-ups. Plus when you're the only IT guy, good luck ever taking a day off let alone a week.

Adbot
ADBOT LOVES YOU

Internet Explorer
Jun 1, 2005





NevergirlsOFFICIAL posted:

is it still poo poo?

It's still poo poo.

And yeah, I extend that logic to any special snowflakes. If you are one of one or two people who use a special piece of hardware or software, congrats, you're the expert. Especially in a small shop. And well, this is the small shop thread.

Internet Explorer
Jun 1, 2005





Yeah, I don't really see any reason not to turn down people who want to use Macs in a Windows shop unless you use published apps or VDIs. That's basically unsupportable.

Internet Explorer
Jun 1, 2005





NevergirlsOFFICIAL posted:

I'm trying to look at this from a policy perspective. Is our policy going to be "users can remote into their machine if they have specialized software"? I don't know if I want to set that precedent. Or someone might just say "oh I save all my stuff on the desktop so why can't I do this too". But I think you're right in this instance I don't really have a way around it.


Yeah with adobe licensing you can have two installs per one concurrent user. Getting the files is the tricky part.


I PERSONALLY love dropbox but again from a policy perspective if I'm adopting this, I need to let everyone use dropbox. Which is honestly probably what I should do anyway, get dropbox business, find some sort of backup solution for it, and let whomever wants to use it use it.

Weren't you the one just hemming and hawing that not allowing something isn't good customer service or something? LOL

Just let him have full admin rights so he can install TeamViewer / LogMeIn and Dropbox and then he can use his Mac to make his beautiful Adobe files!

Practice what you preach!

Internet Explorer
Jun 1, 2005





SneakyFrog posted:

its like someone just walked over my grave...eeerie

I actually just had a software vendor tell me they needed full admin rights in TYOL2015. I almost laughed them out of the building.

Internet Explorer
Jun 1, 2005





LabTech, Kaseya are two other popular ones.

Internet Explorer
Jun 1, 2005





Mimecast. Not worth having a device on site. Has other neat features like archiving and email continuity as well.

Internet Explorer
Jun 1, 2005





Zakutambah posted:

Worse. Finance sector. Non-profits at least understand why they -should- upgrade, even if they can't afford.

It's actually not too bad a place, it's just grown fast and never had much need for real infrastructure before. It's just trying to convince those with the purse strings that the investment is necessary if you want anything to work right. Currently trying to juggle VoIP traffic over a couple of bonded ADSL lines, fun stuff.


Awesome, cheers. I'll check them out.

Finance should understand you need to spend money to make money. Sounds like a terrible place, financial sector excluded.

Internet Explorer
Jun 1, 2005





Maneki Neko posted:

Has anyone actually found a PC with this on it in a business environment? We touch a multitude of Dells and so far no one has actually been able to find a PC with it.

We had a couple of laptops with one cert or the other. We're a VDI shop and just keep a handful of laptops on hand to loan out if needed. Since we have VDIs we are lazy on reimaging, but it's on the list of things to fix.

Swink posted:

VDI tech is cool but given the expense it's gotta be pretty rare that it's the most cost effective solution.

I work for a small company (under 100 users) and we are a VDI only shop. I can't say it is the most cost effective solution when only looking at hard costs, but when you look at soft costs it starts to make more sense.

Some Pros:
-Remote work
-DR is a lot easier
-Apps that don't do well across a WAN from their data
-Consistent master image
-Easy to maintain once it is up and running
-BYOD

I definitely qualify as a generalist, but I have been a Citrix admin for most of my career. I prefer this type of setup to alternatives. Even as we look to more cloud products, VDI / published apps / published desktops are just an easy way to ensure a consistent experience for end users.

Internet Explorer fucked around with this message at 23:43 on Nov 25, 2015

Internet Explorer
Jun 1, 2005





Yes, it definitely requires an internet connection. Working on a plane is mostly limited to doing word processing or whatever on the local machine and then uploading the file when you get back to the office. This is probably one of the biggest drawbacks of VDI in my mind, but most workplaces can get over this limitation.

YouTube works fine these days. Our users have non-Windows thin clients, so minimizing to a local desktop is not a choice.

Most of the environments I have worked at are the very definition of office workers. If you have developers or CAD users things get much more complicated, to the point where VDI may very well not make sense.

Internet Explorer
Jun 1, 2005





I don't mind at all. People don't really seem to talk VDI too much here, even in the virtualization thread. Like I said, I consider myself more of a generalist so I don't comment about stuff too often.

Our VDIs run off a 3 host VMware cluster, nothing special. Dual-processor Xeon's with 4 cores each from 2-3 years ago. Shared infrastructure with our other 3 VMware hosts that host our servers: Some lovely Dell PowerConnects from probably 5 years ago and some equally lovely Cisco Catalyst 2960s. All backed by a NL-SAS filled Equallogic PS6100E. All of this is due for an upgrade, which is waiting on our upcoming DR project. I have only been with my current company for a year and it was a disaster, so I am playing catch up.

And by now I'm sure you are wondering how any of that translates to a decent user experience. The secret sauce is Citrix Provisioning Services, which serves up the actual master image. When VDIs boot they stream the disk down from one of our Provisioning Services servers, there is a lot of intelligent caching that goes on for reads and writes. Very little VDI IO hits the SAN. Here's a pretty interesting write-up on the whole caching thing, we use cache to RAM with overflow to device HD - https://www.citrix.com/blogs/2015/01/19/size-matters-pvs-ram-cache-overflow-sizing/

I will tell you that this stuff is not for the feint of heart. Citrix is a curseword to most end-users, and hell, most IT admins for a reason. I think you really need to know your stuff to get it right and Citrix is a terrible company. But if you know how to hold your tongue just right, it can be a well oiled machine.

[Edit: Oh, and since you were asking about specs, I also wanted to say that in my current setup the Catalyst 2960s are definitely the weak link. Provisioning Services causes most VDI disk traffic to go over your LAN switches. These are definitely not up to the task and I regularly see buffer overruns and excessively high disk retries (through Provisioning Services) on our VDIs.]

Internet Explorer fucked around with this message at 09:33 on Nov 27, 2015

Internet Explorer
Jun 1, 2005





We have 100/100 right now, but we rarely use above 10 for Citrix traffic. RDP is fairly similar to ICA these days. They are working on a new release called "Framehawk" that will add a lot of improvements. More here - https://www.citrix.com/blogs/2015/06/30/our-first-release-of-framehawk-technologies/

Unless your users are streaming 1080p videos remotely all day, Citrix traffic is fairly minimal.

Internet Explorer
Jun 1, 2005





I've never had to tackle that either but it's something that at least seems to be getting easier for your average sysadmin type. I know Synology actually makes their own cams that connect to their NASes. I would definitely look at the Ubiquiti ones too. I'd be interested to hear where you end up.

Internet Explorer
Jun 1, 2005





PRTG is good. Stay the gently caress away from WhatsUpGold.

Internet Explorer
Jun 1, 2005





Don't leave RDP open to the Internet.

Internet Explorer
Jun 1, 2005





People who use static IPs for printers are Hitler.

Internet Explorer
Jun 1, 2005





This is the part where I go back a page or two and quote myself when I said do not allow RDP from the Internet. Administrator should have been disabled. I'm betting it was an easy password that never expires? Good times!

Internet Explorer
Jun 1, 2005





Zakutambah posted:

Ah, that was a fun fact. I thought it was administrator at first glance, it was actually 'abministrator'. The domain administrator account actually was disabled, that's why I thought it odd when I saw a session active with it's name.

It appears there's a few known exploits for Server 2003 that allow remote user creation over the open RDP port. So, it creates a new user called something generic like 'abministrator', or 'tasks', or 'sql'. It appeared these users were quasi copies of the SYSTEM account profile as well, having the same elevations. Then it logs in via RDP with this new account. It didn't appear to touch any of the existing accounts.

These particular ones, once they were logged in, seemed to then deploy mail server software to the desktop and keep it running. So, we were being a mail server relay for Nigerian spam :v: Yay
Still nuking the whole thing though.

The few months since I've started here have been plugging security issues like this all over the place. The previous admin must've been an absolute dickhead.


Oh, we're actually pretty lucky as well that none of the customer data is kept on here, and I'm checking with finance to be sure, but none of the employee data either. Those are on a mix of our CRM and a couple of Google Drives; and as the previous admin had never heard of SSO either, none of the accounts are linked. Still requiring all the passwords to be reset though, just in case.

You mentioned domain administrator. Are you sure the local administrator account was not used? Would not be the first time I've seen that.

Although Windows 2003 with RDP open to the Internet? Ouch. Good luck with that network revamp. Sounds like you have your work cut out for you!

Internet Explorer
Jun 1, 2005





aol keyword party posted:

I always do static, because I don't trust any printers not to gently caress up getting an address via DHCP.

I can't remember the last time I had a printer fail to get a DHCP address. And I have set up a lot of printers in a lot of different environments. If your printers (or really any devices) are having trouble getting addresses, you have DHCP problems.

Internet Explorer
Jun 1, 2005





Just replace the hardware and fix the actual problem, God drat. You should not be rebooting your firewall once a week.

Internet Explorer
Jun 1, 2005





I have worked with plenty of small shops and that is bullshit. If you can't get a few hundred dollars to replace a vital piece of infrastructure, find a new job.

Buy 2 of these. One to put in production, one to keep on the shelf - http://www.amazon.com/Ubiquiti-Edge...ds=edgerouter+x

Buy a handful of these, whatever you need for coverage, since only 1 user uses the wifi - http://www.amazon.com/Ubiquiti-Networks-Enterprise-System-UAP-AC-LITE/dp/B015PR20GY
If you have to, buy these instead - http://www.amazon.com/Ubiquiti-Networks-Enterprise-Unifi-UAP/dp/B00HXT8R2O

If all of that is too expensive, get the gently caress out.

Internet Explorer
Jun 1, 2005





Calidus posted:

I have Veeam setup to backup to a Synology NAS nightly. Then that NAS backs up to aws glacier weekly.

How do you handle the roll-up into the full? Wouldn't the backup to AWS need to do an entire full every week? Or is that not a problem for you?

We use Veeam as well and I like it quite a bit. My biggest beef with it is how it handles GFS and "archive" backups. If you want to keep something like 5 weekly, 13 monthly, and 5 yearly backups they insist on a full for each one of those. No, I do not want to keep 23 full copies of my production data (plus my 'production' backup chain), thank you!

Internet Explorer
Jun 1, 2005





Morganus_Starr posted:

Actually they kind of hide the "server" pricing, which is what you want if you build and host your own on-prem Confluence instance. Cloud pricing is if you have Atlassian host your Confluence instance.

https://marketplace.atlassian.com/plugins/com.gliffy.integration.confluence/server/pricing

It's $10 for 10 users for the Gliffy license - I believe that is a per year pricing. That's what I've been paying.

FYI Confluence can be a bit annoying to install yourself, just make sure to follow the install guide, particularly if you want to enable HTTPS/SSL and change the default port. I've been rocking out PostgreSQL on the backend so I didn't have to pay for SQL licensing or use SQL Express. Seems to work pretty well.

Setting up HTTPS was a huge pain in the rear end. I actually set up Duo as well to add 2-factor. It was really the only reason I didn't go with their cloud route, because as far as I know they still don't support 2-factor.

Internet Explorer
Jun 1, 2005





Haven't used it, but maybe something like this? https://mover.io/

Internet Explorer
Jun 1, 2005





HP's website is the loving worst.

What is everyone doing for phones these days? I'm loathe to do cloud-based phone service due to past experience, but I'm also looking to get rid of our Cisco UC system. It's way overkill for us and maintenance / upkeep costs are entirely too expensive for our size. I've used 3CX in the past and it wasn't fantastic. Worth looking into now? Any others?

Internet Explorer
Jun 1, 2005





What are decent options for Hosted VOIP these days? I really have no intentions of rolling my own Asterix box as phones are critical infrastructure at my company.

Internet Explorer
Jun 1, 2005





Thanks Ants posted:

ThinkingPhones, 8x8, any number of BroadCloud partners. I think it massively depends on where you're located as latency is obviously a potential issue, and any on-site element that's required will vary by region as to how competent they are.

It looks like ThinkingPhones was rebranded / merged with Fuze and seems fairly interesting, considering we also have a conferencing revamp project on our plates. Seems worth looking into. Thanks!

Internet Explorer
Jun 1, 2005





Fourteen posted:

Anyone have any experience with Logitech GROUP for small office video conferencing?

https://secure.logitech.com/en-us/product/conferencecam-group

Or have any other recommendations? Seems like there isn't really much in this space.

I have some similar Logitech hardware set up, maybe a generation older, and it is great so far.

Internet Explorer
Jun 1, 2005





The quality on the video and audio both seem great to me. Other than a camera that zooms in to the individual who is talking, I don't really see the need for anything more. And I have implemented very expensive Polycom systems from as recent as 3 years ago. I would say at this point the hardware you use matters less and less, the software that ties it all together is more important. I can't see any reason a small or medium business would do one of the traditional video conferencing systems these days. It's just not worth it.

Internet Explorer
Jun 1, 2005





... Why?

Internet Explorer
Jun 1, 2005





Yes, you should definitely keep touching the poop.

Internet Explorer
Jun 1, 2005





Spectorsoft is pretty much the go-to for this type of stuff. It was renamed Veriato and is in your link - http://www.veriato.com/

Just make sure you run it past legal before you implement.

Internet Explorer
Jun 1, 2005





Make sure whatever route you go they are coming in over distinct copper/cable/fiber. Something in the same physical run to the building isn't super helpful against the ever-vigilant backhoe.

Internet Explorer
Jun 1, 2005





"The ability to pronounce LibreOffice."

Internet Explorer
Jun 1, 2005





Speaking as a long time Citrix admin... If you are a small shop can you switch to cloud products to sidestep this issue? What you are talking about doing is total possible. But standing up a single terminal server and then having people VPN in isn't the most awesome or scalable thing in the world.

If I was starting a new company I would look long and hard at cloud offerings before going to RDP/ICA route.

Internet Explorer
Jun 1, 2005





Yeah, XenDesktop is the same thing. My point is that if your company is small and growing quickly, unless you plan your remote work strategy smartly you can put yourself into a corner. Standing up a single RDS server is a quick fix that becomes a pain once you grow a bit. The AWS Workspaces suggestion is a good one. I still think if you are still small enough to make major changes, it is worth looking at what you can do with just cloud services these days.

Internet Explorer
Jun 1, 2005





Constant Contact is also worth looking at. Don't do this in house. This is one of those things that is easy and cheap enough to do the "right" way and never have to worry about it again.

Internet Explorer
Jun 1, 2005





Oh god, you've summoned a monster.

Internet Explorer
Jun 1, 2005





Well, isn't that fun. One of the latest Windows updates for Windows 7 just broke our printing GPOs. Just bog standard GPO printers via Policy (not Preference.) Thankfully we only have a couple of physical PCs left and I haven't applied updates to our VDIs yet.

Adbot
ADBOT LOVES YOU

Internet Explorer
Jun 1, 2005





Maneki Neko posted:

Just to clarify, this only appears to occur if you are using security filtering and authenticated users do not have read permissions to the GPO. Still, I'd expect Microsoft to pull/revise the update, as they haven't given consistent guidance on whether or not authenticated users should always have read permissions to GPOs.

One of our users has a policy without read permissions, but the other all had GPOs with authenticated users. [Edit: I'm a dummy and forgot all of our printer policies use Security Filtering and posted without checking.]

[Edit: Any idea what KB it was specifically? Have not had a chance to dig deeper into it.]

Internet Explorer fucked around with this message at 21:46 on Jun 15, 2016

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply