Forgot your password?
typodupeerror
Security IT

Should IT Shops Let Users Manage Their Own PCs? 559

Posted by Zonk
from the hairy-question dept.
An anonymous reader writes "Is letting users manage their own PCs an IT time-saver or time bomb waiting to happen? 'In this Web 2.0 self-service approach, IT knights employees with the responsibility for their own PC's life cycle. That's right: Workers select, configure, manage, and ultimately support their own systems, choosing the hardware and software they need to best perform their jobs.'" Do any of you do something similar to this in your workplace? Anyone think this is a spectacularly bad idea?
This discussion has been archived. No new comments can be posted.

Should IT Shops Let Users Manage Their Own PCs?

Comments Filter:
  • by AdamReyher (862525) * <adam@pylon[ ]ting.com ['hos' in gap]> on Wednesday April 02, 2008 @05:04PM (#22944404) Homepage
    In a perfect world this would actually work. But then we'd run into pirating like crazy and companies being sued all of the the place. I certainly support a more liberal approach to what employees are allowed to use on their machines, but restrictions certainly need to be in place.
    • by MooseMuffin (799896) on Wednesday April 02, 2008 @05:13PM (#22944522)
      We already run this way at where I work. We're a small place and there's no in-house IT department. If one of us in development needs more ram or a new harddrive, the procedure is to go buy it and install it yourself and give management the bill. Nearly everyone is savvy enough to handle this on their own, and if you aren't its easy enough to ask someone to help you.
      • by ushering05401 (1086795) on Wednesday April 02, 2008 @05:31PM (#22944734) Journal
        Hardware is one thing. Software, and the BSA, is another.

        Your shop may be small enough to avoid attention, but allowing users to install their own software could put a company in hot water fast.
        • by mapsjanhere (1130359) on Wednesday April 02, 2008 @05:52PM (#22944956)
          People in my shop can tell me what they want hardware wise, but most don't get more than user privileges. For a while I told people they can put anything on their machines as long as they drop off a license, but it just didn't work. Too many people bringing in "free but for commercial use" programs and running them in total disregard of the real licenses. Even worse, one guy brings it in after buying a registration, but 10 people copy it assuming "if he has it, it must be ok". Plus, my time needed for TLC due to user error has gone from 10h/week to 2h/month since all machines are locked down. Selfish bastard of IT guy!
          • by jwo7777777 (100313) on Thursday April 03, 2008 @02:32PM (#22954438) Journal
            In my business, I force my users to submit all requests in triplicate and reject any that aren't perfect in spelling and I allow no smudges, tears, or other obvious defects on the submission. I provide the forms in the building basement and keep the inbox on the second floor.

            Users are required to change their password every login. Only approved software is allowed on the machines and access to our intranet is strictly controlled by a hypervisor proxy installed on each and every machine.

            Our one and only security breach was when my wife slapped me and choked the common network and local admin password out of me after she demoted me to assistant adjutant information technician.

            She will pay for her insolence. I have already connected together the velcro-like fasteners on several of the baby's size 5 disposable diapers, creating a low cost darknet to create a denial-of-diaper attack on the server I used to control.

            She will pay ... oh yes ... she will pay.......
        • That is horrible even if you do manage, license, and track all software installed. What happens if your employee copies a bunch of MP3's to the PC, since they like to listen to music. Hell, what if they accidentally have Windows Media player set to automatically copy all music CD's to the "my music folder". You then have a company owned computer, that is storing music that is not owned by the company.. OOPS.
          • by DRAGONWEEZEL (125809) on Wednesday April 02, 2008 @06:22PM (#22945328) Homepage
            that stored the music. It's pretty reasonable to assume that well, lets see the music is stored under

            C:\Documents and Settings\John User\Documents\My Music\Lita Ford

            I think John User must have done it. I am pretty sure if you spell it out as policy against such actions, that the company would divert *.aa to the actual user that comitted the infraction. No amount of hand holding can really prevent this sort of thing. If they have access to the box, they have root right? That's what we say all the time here.

            They will do stuff like this. It'll get worse as the younger generation grows into working age.

            That's why I don't store too much personal data on my work computer, but access my own music via streams from orb.com

            However, I guess we could just make it illegal to use workstations at work, and make everyone access company infrastructure via a terminal. Yeah GREAT IDEA...

            • Re: (Score:3, Insightful)

              by tha_mink (518151)

              But it wasn't the companies profile that stored the music. It's pretty reasonable to assume that well, lets see the music is stored under C:\Documents and Settings\John User\Documents\My Music\Lita Ford

              Doesn't matter one single bit. Possession is 9/10s of the law. Your file server now has d:\backup\sales_force\docs\John User\Documents\My Music\Lita Ford and so do your tapes. So now, YOU have copied it twice. Not him, YOU. It's bad to let people make their own decisions with your network and hardware when your ass on the line. It always has been and always will be.

          • Re: (Score:3, Interesting)

            by profplump (309017)
            But it's storing music on behalf of the license holder, in a folder for the private use of the license holder. If it automatically copied music onto some public share you might have a problem, but the situation you describe is not any different than putting my CD collection into off-site storage that I don't own while keeping a copy on my computer.
          • by penguin_dance (536599) on Wednesday April 02, 2008 @06:42PM (#22945596)

            What happens if your employee copies a bunch of MP3's to the PC, since they like to listen to music.

            Most employees can probably do that unless it's locked down so tight they don't have access to windows media. Most companies don't do that because they may have their own company programs and training videos they want the employees to view. And then, if the employee has a USB drive you'd better remove the sound card because there are certainly portable apps [portableapps.com] that can just run it from there.

            It's called personal responsiblity. I don't think most people are saying let the users go wild and install any software they want. But if they're dumb enough to install something illegal (MP3s, last time I looked, are not inherently illegal) they should be held responsible. When companies are proscuted is when BSA comes in and finds MS Office on EVERYONE's computer and they can only produce a license for one. (I don't think the RIAA would even bother with this as most companies DO restrict usage of P2P applications so no sharing would be available.)

            But it does remind me of an BOFH (true story) that had the computers so locked down (Win95 days) you could not access Windows Explorer (aka File Explorer then) to try and keep users from installing or using rogue programs. (In fact I seem to remember, Win95 was actually on a server and his users had to log in to it.) Thank goodness I wasn't under his section. But my section taught department computer classes to get employees up to speed which is how we heard about what he was doing. Of course it made the computers unstable as hell....

          • Re: (Score:3, Insightful)

            by Eivind (15695)
            So ?

            You have a written policy against that kind of thing. You tell employees to remove suchlike should you ever become aware of it, and the responsibility lies with whomever actually did the illegal thing. What a concept !

            You're inventing problems that simply don't exist. It's not as if there's any technical barrier to a employee speeding in a company car, calling in bomb-threats from company-phones, hitting someone over the head with a company-owned chair etc etc etc.

            Yet in all these cases, the company as
        • Re: (Score:3, Interesting)

          by spisska (796395)

          Hardware is one thing. Software, and the BSA, is another.

          Then someone should immediately report me to the BSA. Quite contrary to company policy, and without the express written consent of the IT department, I've installed a whole host of questionable software with no auditable license paper trail.

          Unfortunately, I'd have a much harder time doing my job without Vim, Firefox, GIMP, OpenOffice.org, MySQL, and Scribus. I also run a very questionable program called VLC, but that's more of a time waster than a

      • Re: (Score:3, Insightful)

        by canuck57 (662392)

        We already run this way at where I work. We're a small place and there's no in-house IT department. If one of us in development needs more ram or a new harddrive, the procedure is to go buy it and install it yourself and give management the bill. Nearly everyone is savvy enough to handle this on their own, and if you aren't its easy enough to ask someone to help you.

        You my friend are working for an enlightened organization. If more companies adopted this they would save trillions. I/T today now has beco

    • by fm6 (162816) on Wednesday April 02, 2008 @05:17PM (#22944566) Homepage Journal
      There are better ways to deal with piracy than locking down computers. Nowadays, companies face all kinds of legal issues: discrimination suits, corruption investigations, export control laws... The standard solution is to force your employees to attend a bunch of brief classes covering these issues. I had to work through a half-dozen online lessons when I got my current job.

      Piracy has nothing to do with the fondness of IT departments for locking down user computers. Really, it's a response to nitwits who fancy themselves experts and know just enough to get them into trouble. Of course, it's pretty frustrating for those of us who really do know what they're doing, but face it, we're a tiny minority.
      • by DaedalusHKX (660194) on Wednesday April 02, 2008 @05:38PM (#22944790) Journal
        A government institution, to be precise, and the locals were using government computers, government media (CDR's) and various other resources to pirate everything from Windows to Games for Windows... and you know what? I was nearly fired for bringing it up. Taking action with my "superiors" in IT over what I perceived to be a legitimate issue, and being not only stonewalled but also treated like scum, is what resulted in me tendering my resignation shortly thereafter. Total time on job? Less than a year... far less. Reason? Dirty business practices. Yes, this was a SCHOOL... these are the people teaching your kids what to think, and possibly (in rare instances of "good teachers") even how to think. Another example of government "honesty" and examples of justice. Piracy reigned, and when notified, my "superiors" felt offended that I did not remove the offending software. After much correspondence and arguments, and nothing getting done, I finally got fed up and left. There is a reason schools enjoy Linux like pricing on software. So many of the teachers pirate everything in sight, with full oversight of the various officials.

        And then they teach kids that "crime doesn't pay". Talk about hypocrisy.

        Another reason to pick up homeschooling.
        • by cb8100 (682693) on Wednesday April 02, 2008 @05:53PM (#22944964)

          Yes, this was a SCHOOL... these are the people teaching your kids what to think...

          I like to let the TV teach my kid what to think

    • by Gription (1006467) on Wednesday April 02, 2008 @05:19PM (#22944588)
      We have 7 techs supporting 2000+ computers in 800+ offices. We give guidance but we don't tell them they have to run them any any specific manner. The biggest advice is, "Boring is good".

      License compliance is one detail were you can't offer any wiggle room. There are a number of good auditing software (including some free ones!) that will report on the installed software. That will keep you out of legal trouble.
      • by khasim (1285) <brandioch.conner@gmail.com> on Wednesday April 02, 2008 @05:47PM (#22944890)
        1. User just deleted a "critical" data directory/file.

        2. User just deleted an OS directory and their computer will not run.

        3. User kept everything on his/her local drive and it just caught fire.

        4. User wants an email from 3 years ago that user had deleted from his/her last computer 2 years ago.

        5. The legal department wants all email to/from Mr.X, Mr.Y and Mr.Z.

        6. User keeps getting infected with viruses.

        With centralized control, all of those are simple. Once you start allowing users to choose what to run, how to configure it and so forth, all of those become major issues.
        • by Anonymous Coward on Wednesday April 02, 2008 @06:12PM (#22945216)
          1. User just deleted a "critical" data directory/file.
          backups exist.

          2. User just deleted an OS directory and their computer will not run.
          backups exist.

          3. User kept everything on his/her local drive and it just caught fire.
          backups exist.

          4. User wants an email from 3 years ago that user had deleted from his/her last computer 2 years ago.
          see 5. (anyway, even many "managed/locked down" setup (like in small companies) don't have this one solved so, not a huge deal.

          5. The legal department wants all email to/from Mr.X, Mr.Y and Mr.Z.
          email archived server side, without any implication on the client side

          6. User keeps getting infected with viruses.
          enforce running AV

          Letting the users do some stuff doesn't mean not running AV / backup. Of course, one can hack the machine to disable all of this.. but honestly.. these people can be fired too ;)

          I'm not saying it is the way to go, but your points are not really proving it one way or another.
        • by Surt (22457) on Wednesday April 02, 2008 @06:18PM (#22945290) Homepage Journal
          These are all easy to deal with if you have centralized control of the network, you don't have to control the end points.

          1) You design your processes so that important files are centralized. Don't make it possible to do 'work' locally. Backup is handled on the network. Now the user has, at best, deleted something that was important to them (not your business) locally.

          2) Reimage. See #1 in terms of what the user loses.

          3) See #1.

          4) everything using mail protocols recorded on the network.

          5) see 4.

          6) reimage, reimage, reimage until the user learns. have virus checker in the image (I guess user can possibly uninstall, but if you have a user with this chronic problem, respond to them more and more slowly / report them).

          Giving the user control over their pc doesn't mean the same thing as giving up centralized services.
          • by sulfur (1008327) on Wednesday April 02, 2008 @07:50PM (#22946368)
            reimage, reimage, reimage until the user learns

            So you want to pay desktop support techs to re-image users' computers all the time? In our company re-image takes about 8 hours due to hard drive encryption, which translates into lost productivity of the user.

            I've worked as a desktop support tech both in my college where users had admin rights to their PCs, and for a company that had locked-down environment with packaged software where almost nobody had admin rights and no non-approved software could be installed. I'd say on average I spent 3 times longer to put the users in the college back online, and to restore their data. Of course there's the whole issue of weatherbug/toolbars/ActiveX/other crapware that the users installed on a regular basis.
    • Re: (Score:3, Insightful)

      But then we'd run into pirating like crazy

      How silly. TFS said the users got to manage their own PCs, not the routers or switches ;)
    • by homer_ca (144738) on Wednesday April 02, 2008 @05:30PM (#22944718)
      For a microcosm of this problem just look at users with local admin on their computers. Some people do fine. Other are always getting infected with crapware or calling with stupid questions, e.g. when they wanted to install printer drivers, but installed 300MB of printer crapware with 3 tray icons they don't understand.
    • Re: (Score:2, Insightful)

      by Phil_At_NHS (1008933)
      Depends on the user. If a user wants to do something on their own, I determine if:

      1) They REALLY need it to do their job.

      2) It has potential to really screw things up for more then just themselves.

      3) They have the brains to deal with typical issues themselves,

      4) They have the brains to know when they are really about to screw the pooch, and stop before that happens.

      Then, as long as I am comfortable with the answer to question (2), I make my suggestions, and inform them that if they wish to install so

    • by KillerCow (213458) on Wednesday April 02, 2008 @05:39PM (#22944796)
      "I'm trying to make an Internet on my desktop but I can't get the file to program."

      Can those people really manage their own machines?
    • Re: (Score:3, Insightful)

      by rikkards (98006)
      I think it would work, user can do whatever they want... as long as the IT Admin can audit and dole out punishments like the angry fist of god. What's that? you installed utorrent and are sucking up all our intertubes bandwidth? Well I guess we will be unplugging you from the network since you can't act like a grownup and do your job.

      Works for me.
    • by COMON$ (806135) * on Wednesday April 02, 2008 @05:45PM (#22944858) Journal
      It is already widely done, check out college campuses and any college student.
    • by pvera (250260) <pedro.vera@gmail.com> on Wednesday April 02, 2008 @05:58PM (#22945024) Homepage Journal
      Absolutely not.

      The easiest way is to break your users into four groups:

      1. The hopeless. The nice ones are actually thrilled when you can take some of your very busy time to deal with their problem.

      2. The middle of the road. Many of these people are more than capable to turn into power users, they simply are too busy or just not interested. They are usually good about cooperating with IT because they see these problems as a distraction from whatever their job happens to be.

      3. The ones that think that they are power users. These are more dangerous than a real computer illiterate moron. They know everything and will not hesitate to wipe their asses with your IT procedures under general principles. They also work behind your back, giving your users contradicting advice that creates confusion and resentment later. You'll spend an afternoon carefully crafting your business case for buying four brand new whatevers, for example, Mac Book Pros. At the same time, these idiots go behind your back and whisper into the right ear that Mac Book Pros are overpriced, that Mac Books will do fine. The purchase goes for the cheaper item, and when bad things happen, they will blame you regardless, while the weasela keep a low profile.

      4. The real power users. These are the only ones that you can trust to do most of the management, more because not only they display the knowledge and experience, but also a healthy level of restraint. This is the kind of guy that knows what he is doing but won't mess with the equipment simply because he is bored. After all, he is busy enough doing his own job, no time to do yours unless he understands it to be a honest emergency.

      The best combination I have seen so far was at a previous job during the dot com years. They didn't trust anyone, but once they figured out if you were not dangerous, they would yield control little by little. I was running all of the programmers in the company, and from early programmers and IT got along like thieves. As each new programmer got hired, we pretty much threatened to kick their asses if they did anything to antagonize the IT folks. It worked, as a norm my team's IT requests were handled faster and with less hassle than some other group full of prima donnas that treated the IT folks as if they were scum.
    • If you charge the users for support somehow, even if just internal funny-money. And it depends on the business too. In a tech company, I'd want everybody to be able to at least manage their own PC, and wouldn't hire anyone who couldn't. In retail, maybe not.
  • mixed feelings (Score:4, Interesting)

    by the4thdimension (1151939) on Wednesday April 02, 2008 @05:05PM (#22944418) Homepage
    Bad idea for those that run shops with people who are clueless to computers. These types of people are walking disasters for the entire IT dept. Good idea for those young-ins that know what they are doing with computers. These types of people not only already save the IT dept. a lot of hassle(I personally help numerous people in my area with computer problems that might otherwise get relegated to IT), but they will know how to work and manage all the software and tools that they opt to install.
    • Re: (Score:2, Interesting)

      by JJNess (1238668)
      I went from administering a community college to an engineering firm's branch office... big difference in user trustworthiness. As it is now, we only make sure that licensing is respected, but users are Power Users and are still pretty wary about their machines, calling me or my supe up before doing anything major. To not have to hold hands anymore, like the math instructor who didn't know how to copy/paste in Word back at that college... that's a blessing!
    • by qoncept (599709)
      People that think they aren't computer illiterate are a bigger problem. Even if they're right. Thank god cleaning up their mess isn't my job.
  • Sure (Score:5, Funny)

    by Dan East (318230) on Wednesday April 02, 2008 @05:06PM (#22944428) Homepage Journal
    Sure. I'm getting them to write their own software too, but the learning curve is a little steep. We would like to have them fabricating their own chipsets by 2010. Of course we'll have them start with FPGAs first before actual silicon, because that only makes sense.
    • Re: (Score:3, Funny)

      Of course we'll have them start with FPGAs first before actual silicon, because that only makes sense.
      Good idea. And while you're at it why not give them a mint, tuck them in at night and make sure that they have all their stuffed animals. Do you want employees or pussies?
  • Tagging? (Score:5, Funny)

    by fuocoZERO (1008261) on Wednesday April 02, 2008 @05:10PM (#22944476) Journal
    Any idea why this article hasn't been tagged "whatcouldpossiblygowrong" yet?
    • by Nimey (114278)
      Maybe Taco finally blocked the 'tards who kept tagging the same things all the time.
  • by dhavleak (912889) on Wednesday April 02, 2008 @05:11PM (#22944482)

    So the answer is basically, "it depends".

    For security reasons its always important to manage the AV, updates, etc. on the machine.

    If you have important IP on laptops, it becomes even more important to have a good policy to manage machine health, rather than leaving it to individual discretion.

    And finally, if you have well-defined and relatively narrow roles for which machines are required, again it makes sense to lock them down.

    So depending on how much of the above is true, the answer will vary, but in general IT shops should not trust users to manage their own machines especially because users really don't know much when it comes to keeping a machine secure.

  • by elrous0 (869638) * on Wednesday April 02, 2008 @05:11PM (#22944486)
    If I tried to go through my IT department to get anything done, I would never have time for work. Basically, I have to work from my home computer to get anything done. My work computer is absolutely worthless (can't install any software on it, most of the internet is blocked with Websense blocking software, takes months to get any software approved for it). Basically, I just finally told my boss that I would buy my own personal equipment and software and set that up at home. It serves me well, as I do freelance work at homne anyway.

    If I went through IT at work, I would still be using Photoshop 5.0 and some ancient version of Pagemaker. They're so slow (and this is a true story, honest to God) that the last time they approved any work software for me, the company had stopped making the version they approved before they finally approved it.

    • If your IT Department is that bad, surely other users are raising the same concerns?

      What was the response from management regarding your complaints?
    • by couchslug (175151) on Wednesday April 02, 2008 @05:56PM (#22944996)
      "Basically, I just finally told my boss that I would buy my own personal equipment and software and set that up at home. It serves me well, as I do freelance work at homne anyway."

      The vast majority of auto mechanics are expected to provide their own hand tools, and a well-stocked toolbox can run tens of thousands of dollars. Why not have users provide their own computer (cheap by comparison) if they support it?

      I'd be happy to provide my own PC anywhere I worked if it were permitted. I bring my own peripherals anyway.
  • Of course I need *both* those 3870x2's for ... climate modelling? Yes! Climate modeling, if its gonna rain I'll let you know! Think of the money we'll save by knowing... Ah, to dream - I'd probably get a TNT2 instead no matter what I asked for.
  • Fuck no (Score:5, Informative)

    by Nimey (114278) on Wednesday April 02, 2008 @05:12PM (#22944504) Homepage Journal
    Some of my users would and can do a fine job of that, but they're outnumbered by the ones who aren't trained and/or bright enough to be trusted administering their own box. Click on shiny! free tool to clean spyware that it just detected when you visited this website, oh yes. Install all kinds of crap and wonder why the computer's crawling & BSODing. Get us audited by the BSA, etc.

    Maybe for the better sort of user, but gods no for the unwashed masses.

  • by erroneus (253617) on Wednesday April 02, 2008 @05:12PM (#22944514) Homepage
    You can do all the hand-holding you can and they will STILL find a way to mess the machines up. And as long as management sees it as YOUR responsibility to clean up and correct the messes that uses create, you're nothing more than a janitor.

    I have expressed the philosophy to various departmental management people that it doesn't matter whose 'responsibility' it is to get things fixed. It matters that things get broken. The amount of down time suffered happens regardless of who owns the responsibility, but can be avoided with more responsible behavior by the users.

    I express that "these are your work tools. you mess them up and you're losing money until I can fix it again. There is nothing more I can offer."

    I think that hits home with a lot of intelligent leaders.

    So yes, give users control over their machines... but make sure they know that even though you're there to clean up the mess, the mess's fall-out is still on them. They will then take better care of their tool... their source of productivity and income.
    • by asuffield (111848)
      I take the opposite approach: I reduce cleaning up the messes to a minimal outlay of effort (less than a minute to kick off the network-boot-and-restore-from-image process) and make it clear to everybody that if they call me in, I'm going to be burning down anything they have on the system and not even trying to keep it, so they can either store everything on the servers and leave the local system alone (like they're supposed to) or leave me out of it entirely.

      For the cases where user meddling with the work
  • The answer is yes (Score:5, Insightful)

    by Overzeetop (214511) on Wednesday April 02, 2008 @05:14PM (#22944534) Journal

    Is letting users manage their own PCs an IT time-saver or time bomb waiting to happen?
    It is both. I'm not sure about the new kids coming out of school, but us old-school computer guys are just as literate as most of the IT folks. The problem is that when we screw something up, it's screwed up pretty badly. I would venture to say that 95% of those who want to manage their computers can do so far more efficiently than the corporate IT staff. The other 5% will likely cause major grief.

    For those in IT who think this is not the case, consider your power users. Many really can function - even if not to corporate standards of security or conformity - with very little help. They probably will spend an extra $200-$400 per machine for stuff that has marginal use, but they'll feel better about it and be productive. The problem is that there's that one guy - and everyone in IT know who he is - that is way out of his depth and just doesn't know it. You spend a lot of time praying he doesn't screw up more than his own workstation. The good thing is that considerably more than half of modern staffs will likely just want you to set it all up and keep it running.

    In the case for users managing their own PCs, NASA used to be this way where I worked in the 90s. We ordered our own PCs, set them up, installed all software. The IT staff would help get us on the network and keep the network running. There were exceptionally few problems. This was, however, before most people had access to the internet, and predominantly before the web existed.
    • by Bryansix (761547)
      I think it requires restraint but you can let everyone be local admins and still lock down the network enough to they can't take everyone down. I run everyone here on roaming profiles. All the computers have the same software (for the most part) and users can do whatever they want. When they screw it up I just give them a new computer and tell them what they did wrong and then set the old computer back to the base build. They don't lose anything because everything is stored on the server that is important t
    • by Calyth (168525) on Wednesday April 02, 2008 @05:37PM (#22944778)
      I worked as help desk at a bioinformatics research facility, with roughly 200 people, and I can fit the number of power users that I could remotely trust to run their own machine in one hand. And 3 of them have gone over our heads - one wiped his own RHEL Linux (not that I'm a fan, but it's managed) with his own Ubuntu install, causing us grief when we change settings. He also cause a Kent State Computing Science PhD (who's more like a n00b who can't type his password right) to demand the "same" setup, burning up weeks of time for 2 out of 4 IT staff, myself included. The other 2 would routinely try to install pirated software on work computers.

      And we do try to install software in time for our users. We would try to allocate the right software in time, and if there's no reasonable way to do it (i.e. the user can't get the funding), we try to offer alternatives. In the past, yes, the IT department had been sluggish, but the majority of them have left, and we do try to provide good service.

      Apparently, in a bioinformatics research facility, most of the staff who do research don't know jack about computers, or how to maintain them. If the users are allowed to manage their own machine, I would spend so much time fixing machines, I would want to jump off the building.

      Thank god I left that place. It was bad enough with the existing setup. To think that most users can maintain their machines is pure folly.
    • IF we are talking about Windows XP, then just setup a large system restore percentage. If they screw the PC up, revert to a system restore prior to the screw up.

      If this is really such a huge problem, let them manage their own PC's and put the apps on a Citrix/TS type environment.

      We have both. Locked down & not locked down. The locked down one's see viruses, but are defended against them. The non locked down ones get infected. The locked down ones usually just work, while the non-locked down ones r
  • This works great in academia. IT is never going to know all the weird software I need anyway. The only time I've ever needed to call IT in the past 3 years is to get administrator access or fix a hardware problem. But what works for a small biology lab isn't necessarily going to work for a large corporate call center of course.
  • by syousef (465911) on Wednesday April 02, 2008 @05:15PM (#22944540) Journal
    I imagine this could work and work well in an IT shop full of software developers. However it isn't going to work if the users don't know an operating system from an aardvark. You'd still want some minimal rules like keeping the PC patched and good A/V software if you're running Windows. but I'd say it's doable.

    What it isn't going to do is reduce your costs. You might have a very minimal help desk and no specialized staff installing those desktops but that knowledge, time and effort must be spread through the organization. You may also find it harder to get good deals on bulk purchasing depending on how you do it.
    • Re: (Score:2, Insightful)

      by sarhjinian (94086)
      From my experience, developers are some of the worst people in the world when it comes to systems management. Developers develop; they're not network, security or desktop support people.

      I started in end-user support. Developers might be able to write their own mail client, but they're just as helpless when Outlook cheeses itself. The only difference between a developer and an accounts payable clerk in that situation is that the developer (in some of my experiences) can be insufferably arrogant.
  • You need to be able to evaluate this on an individual basis. Most places I've worked have users who we can trust to do whatever they want and get work done, but I've never heard of a workplace it would have been safe to let everybody have free rein.
  • by SparkleMotion88 (1013083) on Wednesday April 02, 2008 @05:16PM (#22944558)
    This sort of thing would never fly at a sufficiently large company. Once you get to a certain size, the pressure to "standardize" becomes too strong to resist. I suppose this is reasonable, because the licensing, support, etc. is much cheaper this way. Oh, and arguing that individual choice makes workers more productive is useless: productivity can't be easily measured -- therefore it doesn't exist.
  • In most (non-software developer) environments, employees are hired for other skills, e.g., process claims, sell new business, operate a shipping machine, etc. They are not hired for their PC abilities.

    In better run companies a centralized IT department can improve efficiency and keep employees focused. It's a waste of money to have some high-paid sales rep, doctor, lawyer, lab tech or financial analyst spend 2 or 3 hours fixing a PC where a trained, less expensive person could do it in a few minutes.

    T
  • Goose versus Gander (Score:5, Interesting)

    by Nakito (702386) on Wednesday April 02, 2008 @05:19PM (#22944602)
    In the days when I was on a large network, I thought it was a bad practice for the IT department to have better setups than the end users. Some IT people had not just faster computers but leaner images with less integration and less overhead. Their machines flew.

    But of course they had no appreciation of how bad it was to be in the trenches. Their computers performed so much better than the equivalent computers of the end users that they often did not realize how hard it was to get work done on a standard image.

    When I reached the point where I ran one of the departments, I kept an old standard-image computer as my main computer and made sure I was always at the end of the upgrade queue. My view was that if something worked well on my computer, it would work on anyone's. And if something didn't work well on my computer, then it meant some of my users were having a bad experience.

    So maybe if the IT department would just use the same image and hardware as the end users, they'd know enough to provide a decent standard image, which would solve a lot of user complaints.
    • That's exactly what I did when I administered a school's computer lab--I ran the standard image on my desktop machine. If we pushed out an update that caused some problems in a particular program, I was likely to run into it myself. Also, it made troubleshooting the more widespread issues a whole lot easier.
  • Users in control? (Score:2, Insightful)

    by bherman (531936)
    In my opinion, there is a vast difference between what a user "thinks" they need to do their job and what they actually need. Just like any other part of the company you need some gatekeeper for cost control and to make sure that purchases don't overlap. If every user could pick what they needed to get their job done I'm sure you'd see a lot more Quad cores being ordered with SLI video cards. Not because the user thought they needed them, but because they were more expensive so it must be better for them
  • madness!!! (Score:3, Funny)

    by jollyreaper (513215) on Wednesday April 02, 2008 @05:20PM (#22944606)
    I have trouble convincing people not to set their beverages on the copier while waiting for jobs to complete. Give these people local admin rights and we're going to have smoke and shrapnel.
    • by Selanit (192811) on Wednesday April 02, 2008 @10:52PM (#22947624)
      Have you considered putting a table right next to the copier?

      Alternatively, if there's one already there, have you put coasters on it, as a hint?

      And if it's got coasters already, have you considered purchasing a cheap mug, drinking coffee out of it just once so it'll have an authentic ring-stain in the bottom, and then setting it on one of those coasters permanently as an added hint?

      Failing that, have you taken a bunch of tennis balls, cut them in half, duct taped them to the top of the copier and spray painted them the same beige as the rest so there's no flat place to put drinks?

      Further, have you considered sneaking into their cubicles by dead of night and supergluing their cups and mugs to the desk?

      If all else fails, have you considered supergluing your coworkers themselves to their desks? I bet their productivity would go up. The smell might get bad after a while, though ...
  • I think most responses to this story will be very critical of this idea. That's because most corporate slashdot readers work in an IT department.

    I don't; and if I had management of my box, I would literally have saved weeks of wasted time last year. I'm still doing some crap manually because I don't have the administrative ability to install a perl interpreter on my machine. Every few weeks somebody from IT tinkers with it for an hour, fails to get it working, I report it as a problem, then wait a few
    • by edraven (45764)
      You are absolutely right. You don't work in an IT department.
      Most incompetent people won't want to mess with their settings in the first place.
      Whooo, that's priceless.
  • by reemul (1554) on Wednesday April 02, 2008 @05:22PM (#22944640)
    Maybe end users have changed miraculously from when I was still doing desktop support, but I doubt it. IT doesn't develop policies limiting supported configurations just to be mean (generally). They do it because that's all they can in fact support given existing staffing and support metrics. Maybe you can get small numbers of users to be sufficiently knowledgeable that they can support themselves, but the overwhelming majority of users don't know enough, and don't *want* to know enough, to do this. They'd come to rely on some absurdly obscure or broken application, then call IT when it doesn't do what they want it to, and IT would have no idea how to fix it. Plus they'd end up with massive amounts of pirated material. The techs aren't going to memorize the manuals for every possible bit of code a user might take a fancy to, and they certainly can't test every possible combination of applications to test for incompatibilities.

    Letting end users choose their own machines and apps sounds like a lovely and empowering idea, right up until the point where they need to call tech support. And find out that it might be days before IT can fix whatever is broken, since they are starting with zero idea what is wrong because of the wacky config. Those days of lost productivity can be hugely expensive compared to the costs of testing a few specific configs that can be easily and quickly supported. Some tech hours of advance testing and some possible minor losses of productivity from using applications that aren't the user's favorite choices are far cheaper than having an employee turn in no billable hours for several days because his computer is down.
  • well... (Score:4, Informative)

    by Dzimas (547818) on Wednesday April 02, 2008 @05:25PM (#22944660)

    It depends on the organization. I used to work in a 20 or so person division of a software company in which the technical staff were allowed to configure and maintain their machines, within certain constraints. The funny thing is that the primary development team ended up with the same software on their machines, the consulting engineers ended up with their own tool suite, and the marketing guys just relied on the support staff to keep them running. There were a few differences as far as text editor and debugging tool preferences, but generally you could sit down at any machine and expect it to have everything you needed - a virgin install contained our core tools and network stuff anyway. That said, it was *really* nice to be able to install a necessary program or utility without having to go through layers of bureaucracy.

    However, I've also done stints at telcos and other massive organizations where things were incredibly locked down out of necessity/paranoia. I never had too much difficulty getting tools/permissions that I needed, but that was probably because of my role within the IT group. Had I been a marketing guy trying to install some sort of whacky video software, things might not have gone so smoothly.

    • by Dzimas (547818)
      One last thought... It was sometimes a challenge to ensure that we had sufficient license for some of our utilities. Typically, someone would introduce a good tool into the team and everyone would want a copy. That could cause headaches, especially as team sizes fluctuated throughout a project.
  • by Weaselmancer (533834) on Wednesday April 02, 2008 @05:25PM (#22944662)

    Is letting users manage their own PCs an IT time-saver or time bomb waiting to happen?

    It's a good idea if your users have a clue. It's a bad idea if they don't. It entirely depends on the users.

    In my shop we're all coders, so that plan would work. In fact it's vital to our work. Originally we were locked down and had to have an admin install pretty much anything we wanted to use. IT became an inhibitor rather than a helper. They eventually had to lift the ban. The policy was in the way.

    On the other side of the coin, I've also held IT positions managing users. Giving some of my former customers the keys would have been an immediate disaster. In that case a lockdown was a lifesaver.

  • Where I work (40 people) we do precisely that: staff select their own equipment and mostly do their own system maintenance on it. There is a support department that can be called for help, and that enforce the use of anti-virus, system updates, etc. For the rest we're free to install what we want as long as it is legal.

    And it works great! But I should add that I work for a software house - you'd expect decent knowledge and strong opinions in such a situation anyway. I wouldn't advise the same strategy to pl
  • by david.emery (127135) on Wednesday April 02, 2008 @05:27PM (#22944690)
    At least the last 3 places I've worked. The Mac community helped itself out, at the largest site we had one formally trained Mac tech support person covering probably 150 or more Macs.

    Then another place I worked, the one time the tech support people touched my Mac, they screwed it up...

    On the other side, I watched an employee of a Fortune 50 company visit another company's location, where the latter would assign you a specific IP address to use. This guy didn't have enough privileges on his Windows box to configure the IP address on it, and of course his corporate help(less) desk's attitude was that they had to have the machine hooked up to the internet to remotely administer it. Catch-22...

    Dilbert's "Mordac, Preventer of Information Services" is unfortunately the way of life for most corporate IT departments. When I'm King, every CIO will provide each employee with a charge number against the CIO's budget, when an IT problem prevents that employee from doing productive work.

    dave
  • Our company lets people pretty much do whatever they will with our workstations and laptops. Luckily though, everyone here comes with a resume a mile long in the tech field, everyone has at least one tech certification, and most of us have spent the past 10+ years in data centers. So, we have the freedom to do what we want. For instance, on this laptop I have bioshock and call of duty 4 installed (for plane flights, etc when I have no real source of entertainment), numerous training software packages, a cou
  • by ZerMongo (1129583)
    I work for IT for a decent-sized department at a university -about 200-300 machines. All purchase requests go through us, but we usually get what they ask for (as long as it's a Dell or an Apple, but mostly because we have institutional deals with them and they're on the cheap). We set up XP (Vista only if the user wants it). We lock down antivirus and things like that, but for the most part the sub-group they're in has admin privileges on all their machines - but no one else's. When things get fubar'd, the
  • by spaceyhackerlady (462530) on Wednesday April 02, 2008 @05:39PM (#22944800)

    Depends on how technically savvy the users are.

    Technically clueless users wouldn't know what to do anyway.

    Technically savvy users need little more than an IP address and a beer to do the right thing. Hell, our sysadmins consult with me to help figure out how to do things right.

    The middle ground is the one that makes me nervous. The nouveau-techie little bit of knowledge types are the ones that scare me.

    I've installed and configured everything in my cubicle, and have root/admin access as well, because I need it. This is as it should be. I do not have root access to our main file server, because I do not need it. This is also as it should be.

    ...laura

  • Slashdot posted this well-accepted article a while back http://www.computerworld.com/action/article.do?command=printArticleBasic&articleId=9050878/ [computerworld.com] and it described the 5 users with whom an admin hates to deal.

    1. The Know-It-All
    2. The Know-Nothing
    3. Mr. Entitlement
    4. The Finger-Pointer
    5. The Twentysomething Whiz Kid

    Given that there are more of these than there are "Dream Users", a "Web 2.0" approach may not be the best idea.

    However, speaking from the lips of one of the "Dream Users", I'd
  • You're lucky if your IT guy even speaks English well. Often times communicating the problem is hard enough. Then you have to wait for them to schedule time. IT has always been a mess. I've always been frustrated when an IT guy had to come over and type in a password to change something on my machine. Two days later it's broken again. It's really pointless. I use IT for network infrastructure and maintenance. Someone has to tend to the server. Individual machines can be handled by power users. Some of us h
  • At my workplace we can do pretty much whatever we want with our computers as long as it's legal. I take my machine home and play games on it all the time. (My work laptop is actually a faster gaming machine than my desktop.)

    It seems to work out pretty well. I haven't seen any big problems from it.

  • In an IT shop, why wouldn't you want the employees managing their own computers? At the very least, it helps to keep them in practice. At the best, it helps them to be more productive. IT people tend to be much pickier about how they have their machines set up and have the ability to get to that point.

    As for everyone else, the percentage of people in an office setting that are competent enough to be trusted is much, much lower. Also, given that corporate environments have a heavy emphasis on conformat

  • We have a small Plone/Zope consulting firm (10-15 developers + project managers + designers, etc). We let our employees and subcontractors do whatever they want. If they want to use vi, emacs, textmate, or whatever the like then they can. We have people running OS X, Ubuntu, Debian, etc. Everyone chooses their own IRC clients, chat clients, etc.

    Obviously this doesn't work in ever environment. You can't have the kid at the register at WalMart saying that he wants to use a different embedded OS in his cash
  • In my last job of six years, and my current job, I'll do whatever I have to, to keep the IT guys out of my work computer. After having to endure poorly thought-out software pushes and strange domain policy choices that essentially crippled computers on the network, I stopped calling them for help with any local-machine issues and just took care of it myself, being very wary of them physically touching the machine on my desktop at all. Guess what? Never had any more issues with it: no trojans, virii, misbeha
  • by Quattro Vezina (714892) on Wednesday April 02, 2008 @05:51PM (#22944938) Journal
    It entirely depends on the company. Small companies, Linux shops, and engineering-focused companies work better with people maintaining their own machines.

    I work at a Linux-based network security startup. Engineers maintain our own Linux boxen, IT maintains the Windows boxes given to non-engineers. Most employees, engineers included, have Windows laptops assigned to them as well; those laptops are maintained by IT. Of course, we're a small company...IT consists of one person in our US office and one person in our India office.

    Not much piracy concerns with Linux; we don't run any commercial distros on our desktops (we run a hodgepodge of Debian, Ubuntu, and Fedora), and none of us have any use for Linux commercial software.
  • by ZZeta (743322) on Wednesday April 02, 2008 @05:56PM (#22945004)

    Like most slashdotters, I'm in IT.

    The last couple of companies I've worked in, have made the decision to allow us -employees- to admin. our PCs. We are mostly semi-senior developers: we have the knowledge to make our computers perform their best, and we know what we want -and need- from them. No one else -not even support dept.- can know what service, application or tool is best for us and, being highly trained, we're the best admins. these computers could have.

    -- For instance, even though we need to use Windows XP, no one uses IE --

    And last (but definetely not least), this is what we *do*. Most of us could hack through the security policies if they were there. I don't think that having over a hundreed skilled developers trying to bring down your security infrastructure is the best way to go.

    Whenever I start my own company (that's right, I still like to daydream), I'll make sure I hire talented, trustworthy people, and grant them admin. rights of their PCs.

    PS: Note that admin. of PCs != network admin. Everyone here should appreciate the difference

  • Yes, we do this (Score:3, Informative)

    by theolein (316044) on Wednesday April 02, 2008 @05:59PM (#22945030) Journal
    I've been at a number of companies with totally opposite ways fo doing things. Currently, where I now work, we let users do mostly as they please. Surprisingly, the amount of support time isn't must greater than when one has to control the IT worker's every move. The greates part of support is still helping users with various software issues. Generally, it works quite well.
  • by hattig (47930) on Wednesday April 02, 2008 @06:05PM (#22945112) Journal
    In tech-savvy teams, yeah, let them manage their own computers, especially programmers and sysadmins. Otherwise they'll have every moment and to be honest their productivity will probably be reduced. Especially because many IT facilities are nazis on a power rush who take positive delight in being obtuse and difficult - especially to those more skilled with computers.

    However other people? Noooooo! Not even with a course in basic computer management.

    I'd still get the former group to take a course in acceptable computer use, of course. Too many universities don't have a proper ethics course on their CS courses these days - then again, too many CS courses are glorified "programming" courses.
  • NOOOoooo (Score:4, Insightful)

    by EvilTwinSkippy (112490) <yoda@e t o y o c .com> on Wednesday April 02, 2008 @07:39PM (#22946250) Homepage Journal
    As someone who has worked for 10 years as a network admin, the answer is NO.

    Yes, there are special cases out there. But they are special cases. By default, the only policy that works is to lock down a machine and grant access as needed. Too many people treat an unrestricted machine like a "rental." They abuse it. They don't take simple precautions because, hey, it's the company's machine. Given a chance, they will treat it as a personal plaything.

    To deny these truths is to deny basic sociology. And as I said, 10 years of first hand experience that is amplified by every competent admin I know.

"Stupidity, like virtue, is its own reward" -- William E. Davidsen

Working...