Slashdot Mirror
Best Practices in Workgroup Maintenance?
option8 asks: "As the sysadmin for a smallish workgroup (15 or so users) I'm constantly wrestling to balance a regular maintenance regime with the users' continued productivity. As it is, I strive to keep my regular maintenance to a minimum -- optimizing drives, checking for directory and file corruption, permissions repairs, clearing logs, software updates -- after hours, on weekends, or whenever someone goes on vacation. I have a lot of stuff scripted - backups and whatnot go off every night - but there's a lot that requires at least a minimum of my 'monkey clicks the Okay button now' attention. Is this the best way, or do the other BOFHs out there have a better solution to regularly scheduled maintenance for the workgroups/labs/studios they oversee?"
One whip, one master, 14 slaves. "Code, ye dogs!"
I get to take off time early sometimes because I often Remote Desktop to the windows machines (and ssh to the linux ones) to do upgrades/auditing/etc. on Sundays. I don't do that every Sunday, but at least once a month, usually twice a month. So my boss is a little flexible when it comes to coming in at 9, leaving at 5:30, etc.. But without Remote Desktop, I'd have to either a) come in the office, or b) use VNC (which sucks). I have a 12-desktop/9-server setup, so I'm around the same size site as the OP.
. Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.
It seems to me that a good BOFH wouldn't worry about little things like regular maintenance. Or any maintenance. Or users, for that matter. In fact, why do you even go into work, except to delete files?
I've found that UltraVNC is the best VNC. Version 1.0.0 was released on 24 Jun 2005, but it is a quite advanced package. Be sure to install UltraVNC with the video driver, which is not included on Sourceforge.
AutoIt is by far the best open source software for automating Windows installs and other tasks in which the program pretends to be a user. There's an IDE with an Intellisense-like interface and a compiler.
I've heard that OpenVPN is the best software-based VPN, but I have not used it. There are hardware firewalls with VPNs; I suggest you stay away from Netgear's, which I have found to be quirky.
--
Bush lied, 100,000 died. J.C. said not to return violence with more violence.
check out cfengine
Most of my efforts are preventative, putting a lot of thought and fine-tuning into the base software images, to harden them against user abuse and malware, and to automate security patches and definition updates as much as possible. For the Windows machines that's Symantec Anti-Virus with daily updates, Spybot S&D with full Immunization, and MS's auto-critical-updates.
I've found Apple Remote Desktop to be very handy for occasional maintenance on the Macs, such as OS updates and security patches.
For the Windows machines, I usually wait for users to complain about spyware before I wipe them and reload a clean image, rather than doing it on a regular basis during the semester. Mostly that's because the profs don't teach their students good backup habits, and I'm not BOFH enough to go around teaching them painful lessons about not keeping the only copies of their work on the hard drive. Yet. I'm still new on staff, so I'm building up my goodwill reserve before I start doing that.
http://alternatives.rzero.com/
Seriously, you can do everything you've hinted to with VBScript.
I recommend:
The Microsoft ScriptCenter has just launched a new monthly column regarding beginning scripting in Windows; it's called Sesame Script. (The scripting guys are a little geeky.)
Also, point your favorite nntp client at msnews.microsoft.com and do a search for wsh, script, etc, and subscribe and ask! The newsgroups are full of helpful folks!
Remember the motto: If it has to be done more than once, script it!
PS, to get a script to emulate a monkey pressing ok, have it loop, watching for a dialog box of whatever name it will be, then activate that dialog (WScript.AppActivate) and then send an "Enter" keystroke (WScript.SendKeys). Good example is here:
...only, remember:
Use this advice to save yourself time, but don't tell your boss about it. Keep him thinking that you do it all on Sundays, and continue to take the extra time off.
Since you seem to actually care about Things Being Done Properly, you deserve it
Seriously. You are the sysadmin, not a digital janitor. OK, so even if you can do all of this maintenance work from home via Remote Desktop on a Sunday afternoon -- do you really want to? Is this in your job description? As you pointed out, you still have do do the monkey clicks. Even if you script everything, you'll still need to do basic functional tests after the smoke has cleared.
I know of at least one shop in town that has hired weekend help (usually honest and lonely college students) to maintain their end-user Windows PCs. At the end of the year the monkey salary still adds up so little that it's still cheaper than moving to a new platform (Linux, Mac OS X).
I'm not sure which monkey clicks your talking about, but I know for windows patches, if you run them from command line you can put in flags. `KB###### /?` should give you the available options. What we've done at my work on certain occasions is to create a batch file that runs each of the patches, followed by a program that runs at the end to give priority to the proper patches (afraid I can't remember the program, but a google search should reveal). The "At" command also helps with scheduling that batch script. Another option we've explored heavily is PERL scripts.
One thing that is suppose to work well, though we can't use it at my site, is a SUS server. This is suppose to be a middle man for windows update. Allows you to approve patches before installing, and then you point all your windows boxes to the SUS for updates.
I knew a sys admin who could automate just about anything, and was lazy, so if he had to click, it wasn't good enough for him. There are a ton of tools in the windows 2k/2k3 resource toolkits. Hope this helps some.
"And The Geek Shall Inherit The Earth" --Jeff Darlington
I wanted to reiterate how important scripting is for your sanity. Be sure to check out the resource kits that come with each OS & IIS. These have lots of command-line scripts that lend themselves to some time-saving admin scripting fun.
Technology Consulting & Free Downloads
...then 10 systems is about the max for workgroups.
If you plan to grow any larger I'd recommend moving to a Domain instead of a Workgroup. This would give you centralized administration, give you the ability to remotely publish software updates to you systems and the ability to control all your systems via Group Policies.
This will be a hard sell to you boss but, try to provide a detailed cost/benifit analyse looking at the manpower that currently is wasted by having maintain each system seperately and scaleability issues.
If that doesn't work you can still create local policies on each computer to prevent problems.
Good Luck
I think I think, therefore I think I am.