Since your question was rather vague, I've got a few questions for you: - Let's start with your definition of Admin, Technician, or "Support Tech". - What responsibilities do they have within the environmnet? - Are they simply Desktop/End User Support, or do their roles expand beyond that? - Are you lumping all support people into this same category?
Assuming you're talking about strictly Deskop / End User Support (aka. the guys who show up at your desk to fix a problem), the answer depends alot on their skill sets, the complexity of your environment, their responsibilities, level of automation, and a whole series of factors. The Help Desk Institute (http://thinkhdi.com) has a lot of information that can help. Given that you are a Windows PC shop, Microsoft has a bunch of analysis tools that can help you detirmine the complexity of the environment and suggest ways to optimize it. (Google: Microsoft Infrastructure Optimization model (IOI)).
Assuming you're talking about an entire systems support organization, I've seen IT consume up to 60% of a company's total staff (including developers, project managers, and systems analysts). Within that, I've seen up to 30% of those people to be "systems support" (Service Desk, Desktop Support, Data Center Operations, Telcom, Networking, Windows/Unix Server Support, DBAs, and various Architecture and Engineering teams).
Since you're probably looking for a swag, here's what I'd say: For 900 seats and 9-5 operations... 3 persons answering phones 5 persons visiting desks 3 persons managing servers/storage/mail (add 2 more for networking/telcom) 3 persons managing patching and making everyone else's jobs easier (aka, engineering/projects/packaging/scripting/imaging/etc)
If you want to know where my math comes from, just ask. But it breaks down on a few assumptions of having a diverse team with varying degrees of experience and skill sets. Of course, if you have a handfull of rockstars, the numbers change, but in the end, the salaries will probably add up to being the same.
First off, I agree with the article's assessment that it is the developer's fault why UAC is required in the first part. Now, I know this is slashdot, and Micro$oft bashing is everyone's favorite past time here, but, I'm going to defend them for a moment. The reason why I say it's the developers fault is because for YEARS Microsoft has been publishing information on how application's should function to work in as "Limited Users" (aka non-Administrators), at least since the days of Windows 2000. Now, the problem is, most developers I know have never even heard of this! What is this magical mystical document I speak of? Well, it's the Microsoft Logo specifications, aka "Designed for Windows". This talks about all kinds of useful things including separation of user data from application resources; which from my experience is the primary reason why USER applications do not function as non-Administrators.
Now, I also know that Microsoft themselves haven't followed their own rules, and some applications still require administrative rights (and some stupid design decisions such as IE's Code Store Database). Combine that with the fact that they have to support an existing installation base of applications that don't follow those practices and what else can they do? Ever tell have to tell a business user that they can't use their mission critical application anymore because it doesn't work with a proper security implementation? How about telling a Grandparent that have to go buy a new version of some application that they've been using for 10 years because it doesn't work on their new PC? UAC is Microsoft's bridge to go from the old way of everyone running as Admins to the way everyone else has been saying to run, as a "Limited User". It's either that or the proliferation of the fallacy that on Windows you must run as Root.
So, UAC sucks, but can anyone actually recommend a better solution that will work for the install base Windows has? I'm not talking about the "Windows has more users than Unix/Linux/Mac", I'm say that Windows user's and developers are DUMBER than Unix/Linux/Mac users/developers. Now, don't get me wrong, there are extemes on both sides of the fence, but if we looked at percentages, the percentage of dumb users and developers on the Windows side will probably far outweigh those on the other platforms. (Queue the "well switch stupid" comments. And I will, once the industry does as well, it's all about critical mass people.)
While this may not be a general concern for some developers, Microsoft has moved Visual Basic 6 out of "Mainstream Support" (as of 3/31/2005) and into "Extended Support". Extended support is set to end 3/31/2008. How does that affect you? If your application is working now, what's going to cause it to break? Well, it may not, but some companies (or individuals) have policies put in place as a CYA that you may not be able to develop using tools that are no longer supported by the vendor. It gives them someone to hold liable (read "blame") if something breaks.
Then again... you are using Visual Basic on a Windows platform...
(Queue the music as we wait for people to bash MS, VB, or Windows...)
Or, they probably mean they just follow what is written here @ this URL below, taking the 1/2 hour to implement its techniques (fully explained)
Uhh... they did say home pc users didn't they? I'm an IT professional and I got about 4 words into the page (to the word "LAN") before I said to myself "There's no way in hell my grandmother would ever be able to follow these directions much less FIND this page!" Control Panel, what's that? Editing the registry? Hah!
You have to get off your elitist horse and realize that most people's VCR's constantly blink 12:00.
Okay, I don't normally latch onto so such an advert piece of flamebait, but this one I couldn't pass on...
And so can all the malware, spyware, crippleware, middleware, trojans, worms, viruses, and anyone with even a mild desire to make life difficult for people around them.
Do you know what the definition of "malware" is? Any code can be malware. If you sent someone a shell script to shutdown their system and they think its a link to their favorite pr0n site, guess what? Its malware!
Registry + ActiveX + a functional shell (finally) +.NET == cataclysmic user-base catastrophe waiting to happen
Then by using your logic, so is giving someone the keys to a car.... The registry is a centralized database of configuration settings for the OS and applications. Its no different than having 5000 configuration files scattered through a system, other than of course that its in a centralized database. IMNSHO the *nixes can benefit from this concept. Yes, there are limitations, and there should be better security within it, but nothing is stopping someone from hacking Httpd.conf either.
Active-X is a development platform. It can be exploited just like anything else, people create java based virii all the time, the problem is users are dumb enough to just hit "yes install this crap on my system".
.NET is once again a programming API. It's nothing *NEW* its just a uniform model that Microsoft is developing to. Yes, it makes things easier for developers. Yes, this means that instead of the script kiddies having to decipher the Win32API docs, they can use the more developer friendly access methods. But as I said before, any "code" in any language on any platform can be "exploited".
Here's a nice quote for you: 'We fear things in proportion to our ignorance of them.' -- Titus Livius
Now, yes, these things make it *EASIER* for people to take advantage of. However, they were always there, they're there on any platform, its just whether or not people take advantage of them in malice. The better question is "What's MS actually doing to MITIGATE these problems?" Well, I think they finally took a page from the *nix (linux/unix) world and implemented this "revolutionary" feature with Vista: User Account Protection What the hell is that you ask? Well, in simplest terms, its sudo. When UAP is enabled, any action you take that requires "administrator" access, will now prompt you for credentials to do so, even if you are an administrator. Yeap, you guessed it, even admins are no longer admins. What's that do to applications? Well, thats for the developers to fix! But it "fixes" one of the most blatant issues most people had with Windows security: that their grandmother had to be an administrator on her home PC to use her copy of Quicken, and because of that, she also had 5kajillian pieces of spyware installed.
I'm a pretty affluent Windows User who has decided that its time to play with Tux. I'm just as much of a fan of the borg as the next guy, but after a rather recent nightmare in trying to configure linux on my system (... I haven't given up yet...) I've come to a conclusion: Windows has a few things that makes it easier for bitheads and "consumers" alike, and Linux might want to consider adapting these concepts if they want to be mainstream for consumers
1) MFC, Win32API, OLE
Almost every application you see today for Windows uses MFC. Its a common library for Open and Save Dialogs, printing, etc. The Win32API is an all in one bundle of programming calls that make it easy for developers to talk to the OS and other applications. OLE 2.0 was one of the most coveted featuers of Win95, now its known as Active-X, COM+, DCOM, and a whole slew of other names. It took simple cut and paste of text to a new level allowing you to embed data from Excel in a Word document. This framework is also used for application development and the UI.
2) the registry
I'm not saying the registry is the end all be all, but why must I search through 400 config files burried throughout the OS to change a configuration option? A common database for configuring EVERYTHING (OS, Applications, Services, User Prefs) would be nice. That way I dont have to symlink the plugin config file for java to the mozilla plugins directory (which is different on every distro and install base).
3) InstallSheild/WiseInstaller/InstallVise/MSI A point and click install engine would be nice. So far RPM has been treating me nicely, but I want the installer to create links to the applications within Gnome or KDE and then remind me to have a nice day. But one of the reasons that these products can do what they do on windows is common libraries and library/object registration (regsvr32 is your friend).
4) Boardwalk, parkplace, the railroads, utilities, yellows, reds, blues, and everything other then the purples. Sure, "Everything" works on Windows. Everything is developed for it, all the hardware vendors supply drivers for it (ever try getting a canon USB scanner to work in sane?) I guess that's one of the perks of the game when you own everything including the pot and free parking.
No I realize this is a bit weighted towards Windows than many of you are going to like (let the flaming begin). And alot of it may be because of my lack of experience with linux, but for some reason I get the feeling its alot harder then it should be.
Slashdot Mirror
Since your question was rather vague, I've got a few questions for you:
- Let's start with your definition of Admin, Technician, or "Support Tech".
- What responsibilities do they have within the environmnet?
- Are they simply Desktop/End User Support, or do their roles expand beyond that?
- Are you lumping all support people into this same category?
Assuming you're talking about strictly Deskop / End User Support (aka. the guys who show up at your desk to fix a problem), the answer depends alot on their skill sets, the complexity of your environment, their responsibilities, level of automation, and a whole series of factors. The Help Desk Institute (http://thinkhdi.com) has a lot of information that can help. Given that you are a Windows PC shop, Microsoft has a bunch of analysis tools that can help you detirmine the complexity of the environment and suggest ways to optimize it. (Google: Microsoft Infrastructure Optimization model (IOI)).
Assuming you're talking about an entire systems support organization, I've seen IT consume up to 60% of a company's total staff (including developers, project managers, and systems analysts). Within that, I've seen up to 30% of those people to be "systems support" (Service Desk, Desktop Support, Data Center Operations, Telcom, Networking, Windows/Unix Server Support, DBAs, and various Architecture and Engineering teams).
Since you're probably looking for a swag, here's what I'd say:
For 900 seats and 9-5 operations...
3 persons answering phones
5 persons visiting desks
3 persons managing servers/storage/mail (add 2 more for networking/telcom)
3 persons managing patching and making everyone else's jobs easier (aka, engineering/projects/packaging/scripting/imaging/etc)
If you want to know where my math comes from, just ask. But it breaks down on a few assumptions of having a diverse team with varying degrees of experience and skill sets. Of course, if you have a handfull of rockstars, the numbers change, but in the end, the salaries will probably add up to being the same.
First off, I agree with the article's assessment that it is the developer's fault why UAC is required in the first part. Now, I know this is slashdot, and Micro$oft bashing is everyone's favorite past time here, but, I'm going to defend them for a moment. The reason why I say it's the developers fault is because for YEARS Microsoft has been publishing information on how application's should function to work in as "Limited Users" (aka non-Administrators), at least since the days of Windows 2000. Now, the problem is, most developers I know have never even heard of this! What is this magical mystical document I speak of? Well, it's the Microsoft Logo specifications, aka "Designed for Windows". This talks about all kinds of useful things including separation of user data from application resources; which from my experience is the primary reason why USER applications do not function as non-Administrators.
t a/getstartedcert.aspx?LangType=4105
9 29d-679a-4238-8c21-2dcc8ed1f35c/Windows%20Vista%20 Software%20Logo%20Spec%201.1.doc
Now, I also know that Microsoft themselves haven't followed their own rules, and some applications still require administrative rights (and some stupid design decisions such as IE's Code Store Database). Combine that with the fact that they have to support an existing installation base of applications that don't follow those practices and what else can they do? Ever tell have to tell a business user that they can't use their mission critical application anymore because it doesn't work with a proper security implementation? How about telling a Grandparent that have to go buy a new version of some application that they've been using for 10 years because it doesn't work on their new PC? UAC is Microsoft's bridge to go from the old way of everyone running as Admins to the way everyone else has been saying to run, as a "Limited User". It's either that or the proliferation of the fallacy that on Windows you must run as Root.
So, UAC sucks, but can anyone actually recommend a better solution that will work for the install base Windows has? I'm not talking about the "Windows has more users than Unix/Linux/Mac", I'm say that Windows user's and developers are DUMBER than Unix/Linux/Mac users/developers. Now, don't get me wrong, there are extemes on both sides of the fence, but if we looked at percentages, the percentage of dumb users and developers on the Windows side will probably far outweigh those on the other platforms. (Queue the "well switch stupid" comments. And I will, once the industry does as well, it's all about critical mass people.)
Here's some more information on the Vista Logo requirements:
http://microsoft.mrmpslc.com/InnovateOnWindowsVis
Here's the "Requirements for the Windows Vista Logo Program for Software document":
http://download.microsoft.com/download/8/e/4/8e4c
While this may not be a general concern for some developers, Microsoft has moved Visual Basic 6 out of "Mainstream Support" (as of 3/31/2005) and into "Extended Support". Extended support is set to end 3/31/2008. How does that affect you? If your application is working now, what's going to cause it to break? Well, it may not, but some companies (or individuals) have policies put in place as a CYA that you may not be able to develop using tools that are no longer supported by the vendor. It gives them someone to hold liable (read "blame") if something breaks.
r t=PN&alpha=Visual+Basic
Then again... you are using Visual Basic on a Windows platform...
(Queue the music as we wait for people to bash MS, VB, or Windows...)
Visual Basic Product Lifecycle: http://support.microsoft.com/lifecycle/search/?so
Or, they probably mean they just follow what is written here @ this URL below, taking the 1/2 hour to implement its techniques (fully explained)
Uhh... they did say home pc users didn't they? I'm an IT professional and I got about 4 words into the page (to the word "LAN") before I said to myself "There's no way in hell my grandmother would ever be able to follow these directions much less FIND this page!" Control Panel, what's that? Editing the registry? Hah!
You have to get off your elitist horse and realize that most people's VCR's constantly blink 12:00.
Do you know what the definition of "malware" is? Any code can be malware. If you sent someone a shell script to shutdown their system and they think its a link to their favorite pr0n site, guess what? Its malware!
Then by using your logic, so is giving someone the keys to a car.... The registry is a centralized database of configuration settings for the OS and applications. Its no different than having 5000 configuration files scattered through a system, other than of course that its in a centralized database. IMNSHO the *nixes can benefit from this concept. Yes, there are limitations, and there should be better security within it, but nothing is stopping someone from hacking Httpd.conf either.
Active-X is a development platform. It can be exploited just like anything else, people create java based virii all the time, the problem is users are dumb enough to just hit "yes install this crap on my system".
Here's a nice quote for you:
'We fear things in proportion to our ignorance of them.' -- Titus Livius
Now, yes, these things make it *EASIER* for people to take advantage of. However, they were always there, they're there on any platform, its just whether or not people take advantage of them in malice. The better question is "What's MS actually doing to MITIGATE these problems?" Well, I think they finally took a page from the *nix (linux/unix) world and implemented this "revolutionary" feature with Vista: User Account Protection What the hell is that you ask? Well, in simplest terms, its sudo. When UAP is enabled, any action you take that requires "administrator" access, will now prompt you for credentials to do so, even if you are an administrator. Yeap, you guessed it, even admins are no longer admins. What's that do to applications? Well, thats for the developers to fix! But it "fixes" one of the most blatant issues most people had with Windows security: that their grandmother had to be an administrator on her home PC to use her copy of Quicken, and because of that, she also had 5kajillian pieces of spyware installed.
1) MFC, Win32API, OLE
Almost every application you see today for Windows uses MFC. Its a common library for Open and Save Dialogs, printing, etc. The Win32API is an all in one bundle of programming calls that make it easy for developers to talk to the OS and other applications. OLE 2.0 was one of the most coveted featuers of Win95, now its known as Active-X, COM+, DCOM, and a whole slew of other names. It took simple cut and paste of text to a new level allowing you to embed data from Excel in a Word document. This framework is also used for application development and the UI.
2) the registry
I'm not saying the registry is the end all be all, but why must I search through 400 config files burried throughout the OS to change a configuration option? A common database for configuring EVERYTHING (OS, Applications, Services, User Prefs) would be nice. That way I dont have to symlink the plugin config file for java to the mozilla plugins directory (which is different on every distro and install base).
3) InstallSheild/WiseInstaller/InstallVise/MSI
A point and click install engine would be nice. So far RPM has been treating me nicely, but I want the installer to create links to the applications within Gnome or KDE and then remind me to have a nice day. But one of the reasons that these products can do what they do on windows is common libraries and library/object registration (regsvr32 is your friend).
4) Boardwalk, parkplace, the railroads, utilities, yellows, reds, blues, and everything other then the purples. Sure, "Everything" works on Windows. Everything is developed for it, all the hardware vendors supply drivers for it (ever try getting a canon USB scanner to work in sane?) I guess that's one of the perks of the game when you own everything including the pot and free parking.
No I realize this is a bit weighted towards Windows than many of you are going to like (let the flaming begin). And alot of it may be because of my lack of experience with linux, but for some reason I get the feeling its alot harder then it should be.