Mountain Climbing

My role, my job, it’s like climbing a mountain. You look at it from afar and you think it’s a glorious thing, but then you see it up close and you wonder what you have just committed to. The first leg is so difficult because you’re new to this mountain and need to learn new skills to climb it. In time things get better as you gain some experience and get more comfortable at the elevations, but then the role changes, there are new challenges, and you can’t enjoy a plateau for too long, you meed to forge on, there are people counting on you. You do, but you feel like you have before, like a complete idiot, completely unworthy, but you have a drive to learn, adapt, and progress. You have people counting on you. Lives depending on you, and this is no joke or assumption, the systems we help people make functional are absolutely involved in EVERYTHING in this world. You look for the wins, however small, and you enjoy them quietly because you can see and have challenges all around you that terrify you. You use your skills to keep climbing and your intuition to guide you, but you rely on your team, and pockets of knowledge found along the way to figure out your next foot or hand hold. Often you feel like you’re dangling from a ledge while reading a how-to guide. This is what it’s like when you’re on the hook with a customer and you need to figure it out so they can get a mission critical system up and running. The gravity is that you know the concept but haven’t quite had the success or experience to live through this before so while you’re coaching the customer, you’re just trying to hang on. This is no place for pride.

You’re not alone, your team has your back. While other jobs are competitive, this role is collaborative. You have a belayer, and others within earshot that will help, but they’re climbing the same wall. You’re a team focused on the success of the customers you support. This is a place to learn, and grow, and they KNOW it will take time. There’s pressure to succeed, but they know it’s a mountain you’re climbing and they don’t want you to fall. They know because they’ve been there.

At 48 years old, I’m a junior again, I’m SO fine with that. I know nothing and I am not worthy. If I were to have jumped from Microsoft to here years ago, as good as I was then, I would still be a junior. My job at Microsoft was NOTHING compared to this, mere foothills, a hike in the woods. The stresses are different though, the stress then was volume and stupidity as the company transitioned from campus to business sensibilities. This place has a degree of campus left, but it’s focus is on the success of the customer, not the success of the business or that race to senior or principal-level support. You’ll get there through persistence, through actual effort, rather than social climbing. There is no easy path, only experience, and being willing to be part of something bigger than yourself.
The thing about this mountain, there is no top, there is only the point at which you finally jump off. I can’t foresee ever wanting that. Few of my co-workers can, and those that have left, fell.

I simply cannot fall. It’s just not an option I will allow myself.

The PC Image Project

When building a PC image for an enterprise roll-out, your goal should be to build a consistent experience across all PC variants, with as few discrepancies as possible. Building an image that allows for a quick recovery or deployment even when experienced technical staff are unavailable, where possible, even remotely.

The goal is not only to minimize the time it takes to build a PC from new, “out of the box,” but to provide a tool to recovery of a system in the event of a failure or infection, minimizing downtime for the end-user. Of course all of these mandates should translate into a reduced cost in performing these actions.

Some key points to remember in building an image are that you need to build the image correctly, using SysPrep and the necessary precautions to ensure that while you may be distributing this on a DVD (one more than one, or (preferably) a USB key. Ideally your image will be small enough to fit on a reasonably-sized (affordable) USB-key because as much as you want to distribute the keys quickly there are considerations to keep in mind. Once a PC is imaged, how do you get it on the domain? What access does a newly imaged PC have on the network, and is the image itself a security risk (does it contain a password or network access that might put your company at risk if found.

Licensing is also a concern Symantec Ghost, Acronis TrueImage, and other such tools are licensed for use on a per PC basis. There are alternatives to licensed products, but may require some futzing around. Clonezilla and the FOG Project (Free OpenSource Ghost) may be your best solution, but the key is reliability and efficiency.  The less reliable a solution is, the less efficient it is. You want a solution you can trust and that even an end-user can walk through without significant risk to data, usability, or extended downtime.

If you’re in a large organisation you may not be able to afford the liabilities of an open source solution, the simplicity and support of an enterprise product would be best. If your organisation is smaller, less than 200 PCs, you may have the time and reap the cost benefits of the no-cost option. Choose carefully, but make sure that you are licensed for whatever you finally select.

As I’d said before, use SysPrep, this ensures that your machines do not become replicas of each other, causing nightmares of PCs with identity crises, The SID is configured at the initial install and is unique to each PC, simply cloning a PC and duplicating it is asking for trouble down the road. In addition to this level of duplication you’ll want to consider the software that’s pre-installed versus that which is installed after a newly imaged PC is configured. Some applications may base their interaction with the server on the SID or another identifying electronic stamp. While pre-configuring the PC with Microsoft Office may work, pre-installing your anti-virus solution may be ill-advised; especially it is managed from an enterprise server.

One Image for many machine types is preferred but this is a compromise, while Windows 7 accommodates this much easier that Windows XP, the reality is that you may end up spending more time in the testing phase if you make one image that works for all of your systems. If you refresh your PCs and laptops on a yearly basis (i.e. 1/3 of all systems annually), you could end up with 6 or 8 different PCs to keep in sync and ensure the right drivers are installed for each of these models. Yes, you could write a scripted installer that will install the correct drivers and applications based on the machine type/model, and this can work very well, but you’ll spend s significant amount of time testing and tweaking these install steps and even driver versions because there are subtle difference that creep into the mix over 4 years. Also, now you have new systems coming with Windows 7, yet many companies are still deploying Windows XP, which OS do you load is only part of the question, what applications (i.e. CD-Burning software) do you pre-load, or load once the PC type has been determined? You can only load that which was included on (licensed for) that PC originally. Let’s just hope you’ve stuck with one brand of hardware.

The installer script, a helper of sorts can be developed using many possible tools, but you will need information found using the WMI, otherwise known as the Windows Management Interface. This API of sorts will source a multitude of information, including the critical manufacturer, model which will assist with determining what drivers and applications to install and prepare the machine for first use. The level of automation you elect to use will be inverse to the simplicity of the user experience, and this is key in large organisations. Remember to keep the size of your organisation in mind when setting the scope of automation. If you have a few hundred PCs in one or two locations, you may not need as much automation because your Desktop Support staff will be on hand to assist, but if you have thousands of PCs you will want to leverage automation to reduce costs due to hand-holding when a new or re-imaged PC is deployed.

What can I Script?

The driver and applications can be installed, dependent upon the WMI results, but sometimes the order matters. Silent installs and monitoring the progress of each install will be critical. This can be a time consuming task in this process.

Naming the PC can be automated; if your company’s PC naming convention can be derived on the fly. For example, the use of a PC’s serial number, perhaps HASHED to a unique ID to make it short enough when it’s too long, can be combined with a short prefix. You can also ask the user for identifying information even requesting a Windows AD (via LDAP) login and location information. The user cannot log in, they cannot proceed, but this is a double-edged sword. What if someone is off-site?

Location, location, location: Of course if your network is well organised you can determine location based upon the IP Address, you can also conclude you are not on your network and respond accordingly. If you have many mobile workers this can also but you may look to a public facing web service that can help with identification and authorisation, this can also accommodate the automation of the connection of the PC to the domain. This you will want to guard carefully. Not just any PC should be allowed on your network, or domain.

Asset Management: You have access to the make, model, user who is setting up the PC and you may have access to a web or SQL server through this process you can capture these details if you’re online. If you’re not online you can store the information locally, a good plan anyway, in a file or the registry. You can later poll this information and you may wish to have a timeout if PCs move around without your knowledge that will pop up occasionally to update the ownership, etc.

Encryption tools, such as McAfee’s Endpoint Encryption product, can cause challenges to this process, you can certainly deploy the base image without encryption. While you can get the PC up and running and the user productive again, the user becomes a risk if any sensitive data is left unencrypted on the PC. There may be options to cover this threat.

Multi-boot and the use of Linux may provide a quick recovery through either a secondary boot partition or a Linux on a USB key that accommodates connection to your network via your VPN solution and a Terminal Services connection. If your network is protected by physical a VPN solution using RSA keys this may be a reasonable workaround to having a dead hard drive while out of the office. The user can connect to either a desktop PC, virtual machine, Terminal Server, or virtual desktop solution (VDI). Frankly there’s real merit, and security, in the use of solutions that can be run from a ChromeBook-based laptop. You infrastructure is safe in a datacentre, the computing happens there, and the users have nothing more than a terminal in effect. 

COMPUTERNAME=

The naming of PCs in a large corporate environment is always a hot button to push, everyone has the best solution and yet everyone is wrong. Okay, that’s not quite true, but let’s look at the reasons we have to name a PC: 1) It’s a unique identifier for your hardware, 2) it tells you who, in some abstract way, is using network resources, 3) It allows you easy remote access to a PC for troubleshooting and user-assistance purposes.

Which of these things is the most important? They all are, but some people would like to know who “owns” the PC, they try to integrate system, department, or geographic information into this character-limited space. This is a fool’s errand, but perhaps it can be accommodated with minimal pain of your PC’s serial numbers are a reasonable length.

DELL has a convenient serial number system, a 7 character alpha-numeric code, that is located in an easy to find location on their PCs. HP has a similarly easy-to-locate and use solution, and is short enough that if you wanted to prefix the code with something that’s easy to determine by a remedial look at the PC (by asking a user) you should be in good shape from a support point of view. If you have a very large organisation you may include something geographic like NA, IT, CA, GB, TO, or MQ, but don’t get too granular. A letter for Laptop, Desktop, NetBook, Tablet, or Phone (L, D, N, T, or P) can be integrated to help with troubleshooting too. You should definitely integrate the serial number though. 

The department doesn’t really matter if you’re managing assets effectively, and I’m a firm believer in I.T. owning the hardware and departments being charged back for deployments. The key objective of naming a PC should be support. If you have a PC that’s become a threat, then you can co-ordinate with the network team to find the network port and turn off the port, but being able to determine a machine’s name for remote access is the most important task when they call for help. If my user tells me they have a DELL 755 with a Serial number of 6X6S513 in Toronto, I can determine that the machine name is TB7556X6S513 and commence work, but ideally I would rather see a name like TOD6X6S513 so I know where the PC is, that it’s a Desktop, and the serial number. A naming convention like LT510OPS01 is ineffective and a challenge to automated deployments because you need to ensure the COMPUTERNAME is unique. It also doesn’t (normally) matter who owns the PC, but how to connect to it. 

Automation and the Registry:

In I.T. we should always be looking at automation, or at least thinking ahead to automation by defining standards and procedures, then following them. The key here is to plan for automation, even if your process is not automated on any grand scale as yet. Use batch (command or .cmd), PowerShell, or VBScript scripts, to put the right information in the right place. That place, the Registry. Okay, if you’re nervous about that, put a file in C:\ and call it techinfo.ini or something, but the point I’m trying to make is that the details of who is using this PC, a log of changes by technicians, and the history can be stored on the system with very little effort. You can make an automated script very effective and look safe and corporate using HTA applications and storing them in self-extracting executables, for this you can go cheap (7-Zip) or do it right with a product like WinRAR (http://rarlabs.com/) at a reasonable price.

Re-Imaging a PC:

This is no longer a last resort, in fact to protect your environment you can quickly re-image a PC identified as a threat. Following the processes laid out by Microsoft to SysPrep an image and automate the re-install process can be simple or very complex, but if you have the resources to do it right, one image across all PCs is viable and saves an incredible amount of time. Do it right an an end-user can rebuild their own PC in less than an hour (excluding data backup). This is where automation can really pay off, especially when you have a significant number of remote offices or road-warriors. The automation of rebuilding a PC from scratch to recover and regain productivity is the key to lowing the costs and impact of issues such as virus attacks, or hardware failures.

 

Communication Is Key

This should be no surprise but the key to having a harmonious and peaceful relationship between the business and I.T. is clear, concise, communication. The user-community should be informed of choices that affect them, not told after the fact. Even if the change is unlikely to have a negative impact, the change should be published if not discussed. 

What it comes down to is that people hate change but they get downright upset if the change is unexpected and interferes with their lives.

A Clean Environment Is A…

… healthy environment, but we can extend this to more than simple cleanliness. I am not going to talk about my house, it has clutches of dust-bunnies, but at work you need to keep things looking and functioning as a clean environment. PC’s should be dusted out and cleaned, preferably with a vacuum, but canned-air will work in an open area (where you don’t just re-distribute the dust to the whole office), but there’s also the simple act of wiping down a monitor, keyboard, mouse, or system case with a slightly damp micro-fibre cloth, then another to dry it. especially with an LCD. Do not use detergents! No alcohol, and nothing abrasive. Even the gummy-gooey stuff off from those “Intel” and “Microsoft” stickers that someone peeled off can be handled with persistence, and a micro-fibre cloth, or and erasure.

If you’re a desktop support tech, keep your area clean so that the business is not regarding I.T. as an eye-sore. Where possible store machines, like loaner-laptops, clean, in their bags, and ready-to-go. Worst-case scenario, have the re-image process down to an art, able to back-up a user’s data, re-image a PC, and re-deploy within a 2-4 hour window.

Document, document, document…

You will never be able to get every fine detail of your role, but if you create a “manual” of your role and responsibilities as you learn the role you will not only find that you have applicable notes should you need to explain yourself or the demands on you, but if you do decide to move on it will make the transition easier. The best way to do this is to simply open Microsoft Word create a title page, table of contents, and then start building the sections of the document, organize them from time-to-time but rely on simple text management and Heading Levels 1 through 3. Include pictures and screen shots where necessary. Use your cell-phone’s camera to take pictures of issues at a user’s desk and use these in documenting the solution where possible. This also applies to printers and network configurations. For screenshots you could go buy Snag-It, but if you’d like to save a few bucks try Greenshot (http://getgreenshot.org/) and make the end-result really easy to understand.

Yes, there will be people that believe this is a sure way to make it easy to get outsourced, and yes, it does make it easier for the transition, but it won’t rush you out the door. If it’s going to happen, it will.

Information Technology…

… the never-ending chaos that people cling to as a false saviour or best friend in a rapidly changing society. If you’re not connected you do not exist, or so it might seem to the casual observer. Life does exist outside of this reckless race towards technical oblivion, but…