Best Practices in Workgroup Maintenance?

option8 asks: "As the sysadmin for a smallish workgroup (15 or so users) I'm constantly wrestling to balance a regular maintenance regime with the users' continued productivity. As it is, I strive to keep my regular maintenance to a minimum -- optimizing drives, checking for directory and file corruption, permissions repairs, clearing logs, software updates -- after hours, on weekends, or whenever someone goes on vacation. I have a lot of stuff scripted - backups and whatnot go off every night - but there's a lot that requires at least a minimum of my 'monkey clicks the Okay button now' attention. Is this the best way, or do the other BOFHs out there have a better solution to regularly scheduled maintenance for the workgroups/labs/studios they oversee?"

Comments

Remote Desktop and Weekends

[cdwiegand]

I get to take off time early sometimes because I often Remote Desktop to the windows machines (and ssh to the linux ones) to do upgrades/auditing/etc. on Sundays. I don't do that every Sunday, but at least once a month, usually twice a month. So my boss is a little flexible when it comes to coming in at 9, leaving at 5:30, etc.. But without Remote Desktop, I'd have to either a) come in the office, or b) use VNC (which sucks). I have a 12-desktop/9-server setup, so I'm around the same size site as the OP.

cfengine

[Procyon101]

check out cfengine

a pound of prevention, vs. a ton of maintenance

[tverbeek]

I manage about 300 college classroom/lab computers, but I don't really have much "maintenance" for them. Of course shortly before each semester begins, I go around and wipe every hard drive down to the boot sector, and reload pre-configured software images. But not much in between. I do have work-study student employees for "monkey clicks OK" type stuff, but since they rarely actually do what I ask them to do, so that doesn't really count.

Most of my efforts are preventative, putting a lot of thought and fine-tuning into the base software images, to harden them against user abuse and malware, and to automate security patches and definition updates as much as possible. For the Windows machines that's Symantec Anti-Virus with daily updates, Spybot S&D with full Immunization, and MS's auto-critical-updates.

I've found Apple Remote Desktop to be very handy for occasional maintenance on the Macs, such as OS updates and security patches.

For the Windows machines, I usually wait for users to complain about spyware before I wipe them and reload a clean image, rather than doing it on a regular basis during the semester. Mostly that's because the profs don't teach their students good backup habits, and I'm not BOFH enough to go around teaching them painful lessons about not keeping the only copies of their work on the hard drive. Yet. I'm still new on staff, so I'm building up my goodwill reserve before I start doing that.