Slashdot Mirror
Should IT Shops Let Users Manage Their Own PCs?
An anonymous reader writes "Is letting users manage their own PCs an IT time-saver or time bomb waiting to happen? 'In this Web 2.0 self-service approach, IT knights employees with the responsibility for their own PC's life cycle. That's right: Workers select, configure, manage, and ultimately support their own systems, choosing the hardware and software they need to best perform their jobs.'" Do any of you do something similar to this in your workplace? Anyone think this is a spectacularly bad idea?
In a perfect world this would actually work. But then we'd run into pirating like crazy and companies being sued all of the the place. I certainly support a more liberal approach to what employees are allowed to use on their machines, but restrictions certainly need to be in place.
The Computations of AdamR
http://www.adamreyher.com
So the answer is basically, "it depends".
For security reasons its always important to manage the AV, updates, etc. on the machine.
If you have important IP on laptops, it becomes even more important to have a good policy to manage machine health, rather than leaving it to individual discretion.
And finally, if you have well-defined and relatively narrow roles for which machines are required, again it makes sense to lock them down.
So depending on how much of the above is true, the answer will vary, but in general IT shops should not trust users to manage their own machines especially because users really don't know much when it comes to keeping a machine secure.
If I went through IT at work, I would still be using Photoshop 5.0 and some ancient version of Pagemaker. They're so slow (and this is a true story, honest to God) that the last time they approved any work software for me, the company had stopped making the version they approved before they finally approved it.
SJW: Someone who has run out of real oppression, and has to fake it.
You can do all the hand-holding you can and they will STILL find a way to mess the machines up. And as long as management sees it as YOUR responsibility to clean up and correct the messes that uses create, you're nothing more than a janitor.
I have expressed the philosophy to various departmental management people that it doesn't matter whose 'responsibility' it is to get things fixed. It matters that things get broken. The amount of down time suffered happens regardless of who owns the responsibility, but can be avoided with more responsible behavior by the users.
I express that "these are your work tools. you mess them up and you're losing money until I can fix it again. There is nothing more I can offer."
I think that hits home with a lot of intelligent leaders.
So yes, give users control over their machines... but make sure they know that even though you're there to clean up the mess, the mess's fall-out is still on them. They will then take better care of their tool... their source of productivity and income.
For those in IT who think this is not the case, consider your power users. Many really can function - even if not to corporate standards of security or conformity - with very little help. They probably will spend an extra $200-$400 per machine for stuff that has marginal use, but they'll feel better about it and be productive. The problem is that there's that one guy - and everyone in IT know who he is - that is way out of his depth and just doesn't know it. You spend a lot of time praying he doesn't screw up more than his own workstation. The good thing is that considerably more than half of modern staffs will likely just want you to set it all up and keep it running.
In the case for users managing their own PCs, NASA used to be this way where I worked in the 90s. We ordered our own PCs, set them up, installed all software. The IT staff would help get us on the network and keep the network running. There were exceptionally few problems. This was, however, before most people had access to the internet, and predominantly before the web existed.
Is it just my observation, or are there way too many stupid people in the world?
This sort of thing would never fly at a sufficiently large company. Once you get to a certain size, the pressure to "standardize" becomes too strong to resist. I suppose this is reasonable, because the licensing, support, etc. is much cheaper this way. Oh, and arguing that individual choice makes workers more productive is useless: productivity can't be easily measured -- therefore it doesn't exist.
In my opinion, there is a vast difference between what a user "thinks" they need to do their job and what they actually need. Just like any other part of the company you need some gatekeeper for cost control and to make sure that purchases don't overlap. If every user could pick what they needed to get their job done I'm sure you'd see a lot more Quad cores being ordered with SLI video cards. Not because the user thought they needed them, but because they were more expensive so it must be better for them.
If you were in a technology company this might be different because in theory the users would be more knowledgeable about tech products. However in most companies I would guess the users don't know the difference between XP Home and XP Professional, so how can they pick what they need?
Error: Sig not found.
Maybe end users have changed miraculously from when I was still doing desktop support, but I doubt it. IT doesn't develop policies limiting supported configurations just to be mean (generally). They do it because that's all they can in fact support given existing staffing and support metrics. Maybe you can get small numbers of users to be sufficiently knowledgeable that they can support themselves, but the overwhelming majority of users don't know enough, and don't *want* to know enough, to do this. They'd come to rely on some absurdly obscure or broken application, then call IT when it doesn't do what they want it to, and IT would have no idea how to fix it. Plus they'd end up with massive amounts of pirated material. The techs aren't going to memorize the manuals for every possible bit of code a user might take a fancy to, and they certainly can't test every possible combination of applications to test for incompatibilities.
Letting end users choose their own machines and apps sounds like a lovely and empowering idea, right up until the point where they need to call tech support. And find out that it might be days before IT can fix whatever is broken, since they are starting with zero idea what is wrong because of the wacky config. Those days of lost productivity can be hugely expensive compared to the costs of testing a few specific configs that can be easily and quickly supported. Some tech hours of advance testing and some possible minor losses of productivity from using applications that aren't the user's favorite choices are far cheaper than having an employee turn in no billable hours for several days because his computer is down.
You're just jealous 'cuz the voices talk to *me*
It's a good idea if your users have a clue. It's a bad idea if they don't. It entirely depends on the users.
In my shop we're all coders, so that plan would work. In fact it's vital to our work. Originally we were locked down and had to have an admin install pretty much anything we wanted to use. IT became an inhibitor rather than a helper. They eventually had to lift the ban. The policy was in the way.
On the other side of the coin, I've also held IT positions managing users. Giving some of my former customers the keys would have been an immediate disaster. In that case a lockdown was a lifesaver.
Weaselmancer
rediculous.
We ended up putting them on their own network and cutting them off the WAN fairly often because they couldn't patch, protect or resuist opening every random attachment they came across. Yes, they ran Windows by and large (one guy had a four-processor box with eleven VMware images, all infected with something), but these were supposedly "young" and "tech-savvy" people who didn't need to be controlled and could be trusted to patch their own machines.
At least they didn't place many support calls.
In a big shop, someone needs to either rule with an iron fist, or self-adminned machines need to be sequestered into the own network and allowed exactly zero access to company data. Heck, even in a small shop there has to be one person designated to kicking ass and taking names. People have day jobs--even IT people--that would get in the way of proper maintenance and someone needs to ensure that:
- Stuff gets backed up
- Stuff is secure
- Stuff doesn't screw up other stuff
Yes, even "Web 2.0 aware hipsters" need to do this, and it's not their job any more than bookkeeping or balancing cash would be.--srj/mmv
I work for IT for a decent-sized department at a university -about 200-300 machines. All purchase requests go through us, but we usually get what they ask for (as long as it's a Dell or an Apple, but mostly because we have institutional deals with them and they're on the cheap). We set up XP (Vista only if the user wants it). We lock down antivirus and things like that, but for the most part the sub-group they're in has admin privileges on all their machines - but no one else's. When things get fubar'd, they call us to fix it. If it's something they could have avoided, we'll try as hard as we can to fix it. If it's something stupid ("I opened an e-mail attachment") it may take us a while to get to it. YMMV.
From my experience, developers are some of the worst people in the world when it comes to systems management. Developers develop; they're not network, security or desktop support people.
I started in end-user support. Developers might be able to write their own mail client, but they're just as helpless when Outlook cheeses itself. The only difference between a developer and an accounts payable clerk in that situation is that the developer (in some of my experiences) can be insufferably arrogant.
--srj/mmv
Depends on how technically savvy the users are.
Technically clueless users wouldn't know what to do anyway.
Technically savvy users need little more than an IP address and a beer to do the right thing. Hell, our sysadmins consult with me to help figure out how to do things right.
The middle ground is the one that makes me nervous. The nouveau-techie little bit of knowledge types are the ones that scare me.
I've installed and configured everything in my cubicle, and have root/admin access as well, because I need it. This is as it should be. I do not have root access to our main file server, because I do not need it. This is also as it should be.
...laura
My old(as in previous) boss is finally retiring at the age of 80. he was still working a 55-60 hour work week.
He didn't need the money, but did it so he wouldn't get bored. I have another friend who is 63 has 4 seasonal jobs to keep himself busy and gives him just enough extra cash to play. he doesn't need the work, but he works to keep himself going.
You don't have to stop hard when you retire, you just change priorities.
i thought once I was found, but it was only a dream.
1. User just deleted a "critical" data directory/file.
2. User just deleted an OS directory and their computer will not run.
3. User kept everything on his/her local drive and it just caught fire.
4. User wants an email from 3 years ago that user had deleted from his/her last computer 2 years ago.
5. The legal department wants all email to/from Mr.X, Mr.Y and Mr.Z.
6. User keeps getting infected with viruses.
With centralized control, all of those are simple. Once you start allowing users to choose what to run, how to configure it and so forth, all of those become major issues.
Like most slashdotters, I'm in IT.
The last couple of companies I've worked in, have made the decision to allow us -employees- to admin. our PCs. We are mostly semi-senior developers: we have the knowledge to make our computers perform their best, and we know what we want -and need- from them. No one else -not even support dept.- can know what service, application or tool is best for us and, being highly trained, we're the best admins. these computers could have.
-- For instance, even though we need to use Windows XP, no one uses IE --
And last (but definetely not least), this is what we *do*. Most of us could hack through the security policies if they were there. I don't think that having over a hundreed skilled developers trying to bring down your security infrastructure is the best way to go.
Whenever I start my own company (that's right, I still like to daydream), I'll make sure I hire talented, trustworthy people, and grant them admin. rights of their PCs.
PS: Note that admin. of PCs != network admin. Everyone here should appreciate the difference
In tech-savvy teams, yeah, let them manage their own computers, especially programmers and sysadmins. Otherwise they'll have every moment and to be honest their productivity will probably be reduced. Especially because many IT facilities are nazis on a power rush who take positive delight in being obtuse and difficult - especially to those more skilled with computers.
However other people? Noooooo! Not even with a course in basic computer management.
I'd still get the former group to take a course in acceptable computer use, of course. Too many universities don't have a proper ethics course on their CS courses these days - then again, too many CS courses are glorified "programming" courses.
I work for a large engineering company (50k+ employees) and it seems to work reasonably well. There is no way that the IT dept can enforce a standard operating environment, since we are client driven. Our clients demand, and we supply, solutions to problems. This requires the principal developers and systems engineer need support a raft of different platforms, OSs, software and skills on their own. The IT department manages the corporate infrastructure (e.g. LAN,WAN,VPN, file servers, access control, backups, email, etc...) but they're not responsible for determining development and test tools. We develop and integrate complex Control Systems for our clients. So the engineering/project departments are responsible for selection of software, server, workstations, embedded controllers, switches, network sniffers, protocol analysers and anything else that is required to support that function. The system works, as the IT support and engineering sections work together to iron out problems. It's not anarchy, because key "experts" in each domain are tasked with making the system work. Communications is the key point.
that stored the music. It's pretty reasonable to assume that well, lets see the music is stored under
C:\Documents and Settings\John User\Documents\My Music\Lita Ford
I think John User must have done it. I am pretty sure if you spell it out as policy against such actions, that the company would divert *.aa to the actual user that comitted the infraction. No amount of hand holding can really prevent this sort of thing. If they have access to the box, they have root right? That's what we say all the time here.
They will do stuff like this. It'll get worse as the younger generation grows into working age.
That's why I don't store too much personal data on my work computer, but access my own music via streams from orb.com
However, I guess we could just make it illegal to use workstations at work, and make everyone access company infrastructure via a terminal. Yeah GREAT IDEA...
How much is your data worth? Back it up now.
Saying that "backups exist" does not address the question of HOW the backups are made when the user can put any file anywhere on their system.
With a centralized system, the users can be restricted to ONLY saving files on their TEMP directory and the servers. Those are MUCH easier to backup and lots of packages exist for that exact purpose.
There is not much difference, really... in the end results.
The Lotto is a big gamble where stupid people pour in a lot of their hard-earned money, only to see it ultimately end up in someone else's hands.
A 401K plan is a big gamble where stupid people pour in a lot of their hard-earned money, only to see the all the stocks it was invested in dry up and blow away, and all that money ends up in someone else's hands.
As someone who has worked for 10 years as a network admin, the answer is NO.
Yes, there are special cases out there. But they are special cases. By default, the only policy that works is to lock down a machine and grant access as needed. Too many people treat an unrestricted machine like a "rental." They abuse it. They don't take simple precautions because, hey, it's the company's machine. Given a chance, they will treat it as a personal plaything.
To deny these truths is to deny basic sociology. And as I said, 10 years of first hand experience that is amplified by every competent admin I know.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming