Should IT Shops Let Users Manage Their Own PCs? 559
An anonymous reader writes "Is letting users manage their own PCs an IT time-saver or time bomb waiting to happen? 'In this Web 2.0 self-service approach, IT knights employees with the responsibility for their own PC's life cycle. That's right: Workers select, configure, manage, and ultimately support their own systems, choosing the hardware and software they need to best perform their jobs.'" Do any of you do something similar to this in your workplace? Anyone think this is a spectacularly bad idea?
in the perfect world... (Score:5, Insightful)
One Size Cannot Fit All (Score:5, Insightful)
So the answer is basically, "it depends".
For security reasons its always important to manage the AV, updates, etc. on the machine.
If you have important IP on laptops, it becomes even more important to have a good policy to manage machine health, rather than leaving it to individual discretion.
And finally, if you have well-defined and relatively narrow roles for which machines are required, again it makes sense to lock them down.
So depending on how much of the above is true, the answer will vary, but in general IT shops should not trust users to manage their own machines especially because users really don't know much when it comes to keeping a machine secure.
I should be so lucky (Score:5, Insightful)
If I went through IT at work, I would still be using Photoshop 5.0 and some ancient version of Pagemaker. They're so slow (and this is a true story, honest to God) that the last time they approved any work software for me, the company had stopped making the version they approved before they finally approved it.
Middle ground is a good place for me (Score:3, Insightful)
I have expressed the philosophy to various departmental management people that it doesn't matter whose 'responsibility' it is to get things fixed. It matters that things get broken. The amount of down time suffered happens regardless of who owns the responsibility, but can be avoided with more responsible behavior by the users.
I express that "these are your work tools. you mess them up and you're losing money until I can fix it again. There is nothing more I can offer."
I think that hits home with a lot of intelligent leaders.
So yes, give users control over their machines... but make sure they know that even though you're there to clean up the mess, the mess's fall-out is still on them. They will then take better care of their tool... their source of productivity and income.
The answer is yes (Score:5, Insightful)
For those in IT who think this is not the case, consider your power users. Many really can function - even if not to corporate standards of security or conformity - with very little help. They probably will spend an extra $200-$400 per machine for stuff that has marginal use, but they'll feel better about it and be productive. The problem is that there's that one guy - and everyone in IT know who he is - that is way out of his depth and just doesn't know it. You spend a lot of time praying he doesn't screw up more than his own workstation. The good thing is that considerably more than half of modern staffs will likely just want you to set it all up and keep it running.
In the case for users managing their own PCs, NASA used to be this way where I worked in the 90s. We ordered our own PCs, set them up, installed all software. The IT staff would help get us on the network and keep the network running. There were exceptionally few problems. This was, however, before most people had access to the internet, and predominantly before the web existed.
For small companies only (Score:5, Insightful)
Re:in the perfect world... (Score:5, Insightful)
Piracy has nothing to do with the fondness of IT departments for locking down user computers. Really, it's a response to nitwits who fancy themselves experts and know just enough to get them into trouble. Of course, it's pretty frustrating for those of us who really do know what they're doing, but face it, we're a tiny minority.
Users in control? (Score:2, Insightful)
If you were in a technology company this might be different because in theory the users would be more knowledgeable about tech products. However in most companies I would guess the users don't know the difference between XP Home and XP Professional, so how can they pick what they need?
Re:in the perfect world... (Score:3, Insightful)
How silly. TFS said the users got to manage their own PCs, not the routers or switches
Did web 2.0 magically make end users not stupid? (Score:5, Insightful)
Letting end users choose their own machines and apps sounds like a lovely and empowering idea, right up until the point where they need to call tech support. And find out that it might be days before IT can fix whatever is broken, since they are starting with zero idea what is wrong because of the wacky config. Those days of lost productivity can be hugely expensive compared to the costs of testing a few specific configs that can be easily and quickly supported. Some tech hours of advance testing and some possible minor losses of productivity from using applications that aren't the user's favorite choices are far cheaper than having an employee turn in no billable hours for several days because his computer is down.
The question is too broad (Score:5, Insightful)
It's a good idea if your users have a clue. It's a bad idea if they don't. It entirely depends on the users.
In my shop we're all coders, so that plan would work. In fact it's vital to our work. Originally we were locked down and had to have an admin install pretty much anything we wanted to use. IT became an inhibitor rather than a helper. They eventually had to lift the ban. The policy was in the way.
On the other side of the coin, I've also held IT positions managing users. Giving some of my former customers the keys would have been an immediate disaster. In that case a lockdown was a lifesaver.
Re:in the perfect world... (Score:5, Insightful)
Re:In a young company, maybe (Score:2, Insightful)
We ended up putting them on their own network and cutting them off the WAN fairly often because they couldn't patch, protect or resuist opening every random attachment they came across. Yes, they ran Windows by and large (one guy had a four-processor box with eleven VMware images, all infected with something), but these were supposedly "young" and "tech-savvy" people who didn't need to be controlled and could be trusted to patch their own machines.
At least they didn't place many support calls.
In a big shop, someone needs to either rule with an iron fist, or self-adminned machines need to be sequestered into the own network and allowed exactly zero access to company data. Heck, even in a small shop there has to be one person designated to kicking ass and taking names. People have day jobs--even IT people--that would get in the way of proper maintenance and someone needs to ensure that:
- Stuff gets backed up
- Stuff is secure
- Stuff doesn't screw up other stuff
Yes, even "Web 2.0 aware hipsters" need to do this, and it's not their job any more than bookkeeping or balancing cash would be.Re:in the perfect world... (Score:5, Insightful)
Your shop may be small enough to avoid attention, but allowing users to install their own software could put a company in hot water fast.
Limited superpowers (Score:2, Insightful)
Re:Could work if the users are technical enough (Score:2, Insightful)
I started in end-user support. Developers might be able to write their own mail client, but they're just as helpless when Outlook cheeses itself. The only difference between a developer and an accounts payable clerk in that situation is that the developer (in some of my experiences) can be insufferably arrogant.
Re:in the perfect world... (Score:2, Insightful)
1) They REALLY need it to do their job.
2) It has potential to really screw things up for more then just themselves.
3) They have the brains to deal with typical issues themselves,
4) They have the brains to know when they are really about to screw the pooch, and stop before that happens.
Then, as long as I am comfortable with the answer to question (2), I make my suggestions, and inform them that if they wish to install something, they can, but I am not supporting it, if it screws up their system, fixing it will be a low priority for me.
I generally find that few people who are not really up to the task of self support decide to install, and the few that go on are generally not much of a problem.
Of course some things, like P2P, are a "Flat No Way in Hell," period.
This is coming from someone responsible for about 70 workstations, 20 of them laptops.
Letting everyonee do it "free for all" style? Only if I am not supporting them, and I would feel truly sorry for those that are...
Clueful, Clueless and those in-between (Score:4, Insightful)
Depends on how technically savvy the users are.
Technically clueless users wouldn't know what to do anyway.
Technically savvy users need little more than an IP address and a beer to do the right thing. Hell, our sysadmins consult with me to help figure out how to do things right.
The middle ground is the one that makes me nervous. The nouveau-techie little bit of knowledge types are the ones that scare me.
I've installed and configured everything in my cubicle, and have root/admin access as well, because I need it. This is as it should be. I do not have root access to our main file server, because I do not need it. This is also as it should be.
...laura
Re:in the perfect world... (Score:3, Insightful)
Works for me.
Re:Select own software? (Score:4, Insightful)
He didn't need the money, but did it so he wouldn't get bored. I have another friend who is 63 has 4 seasonal jobs to keep himself busy and gives him just enough extra cash to play. he doesn't need the work, but he works to keep himself going.
You don't have to stop hard when you retire, you just change priorities.
Re:in the perfect world... (Score:4, Insightful)
How do you handle the following issues? (Score:4, Insightful)
2. User just deleted an OS directory and their computer will not run.
3. User kept everything on his/her local drive and it just caught fire.
4. User wants an email from 3 years ago that user had deleted from his/her last computer 2 years ago.
5. The legal department wants all email to/from Mr.X, Mr.Y and Mr.Z.
6. User keeps getting infected with viruses.
With centralized control, all of those are simple. Once you start allowing users to choose what to run, how to configure it and so forth, all of those become major issues.
Re:I should be so lucky (Score:5, Insightful)
The vast majority of auto mechanics are expected to provide their own hand tools, and a well-stocked toolbox can run tens of thousands of dollars. Why not have users provide their own computer (cheap by comparison) if they support it?
I'd be happy to provide my own PC anywhere I worked if it were permitted. I bring my own peripherals anyway.
In IT, they should, and they must (Score:4, Insightful)
Like most slashdotters, I'm in IT.
The last couple of companies I've worked in, have made the decision to allow us -employees- to admin. our PCs. We are mostly semi-senior developers: we have the knowledge to make our computers perform their best, and we know what we want -and need- from them. No one else -not even support dept.- can know what service, application or tool is best for us and, being highly trained, we're the best admins. these computers could have.
-- For instance, even though we need to use Windows XP, no one uses IE --
And last (but definetely not least), this is what we *do*. Most of us could hack through the security policies if they were there. I don't think that having over a hundreed skilled developers trying to bring down your security infrastructure is the best way to go.
Whenever I start my own company (that's right, I still like to daydream), I'll make sure I hire talented, trustworthy people, and grant them admin. rights of their PCs.
PS: Note that admin. of PCs != network admin. Everyone here should appreciate the difference
Re:in the perfect world... (Score:5, Insightful)
The easiest way is to break your users into four groups:
1. The hopeless. The nice ones are actually thrilled when you can take some of your very busy time to deal with their problem.
2. The middle of the road. Many of these people are more than capable to turn into power users, they simply are too busy or just not interested. They are usually good about cooperating with IT because they see these problems as a distraction from whatever their job happens to be.
3. The ones that think that they are power users. These are more dangerous than a real computer illiterate moron. They know everything and will not hesitate to wipe their asses with your IT procedures under general principles. They also work behind your back, giving your users contradicting advice that creates confusion and resentment later. You'll spend an afternoon carefully crafting your business case for buying four brand new whatevers, for example, Mac Book Pros. At the same time, these idiots go behind your back and whisper into the right ear that Mac Book Pros are overpriced, that Mac Books will do fine. The purchase goes for the cheaper item, and when bad things happen, they will blame you regardless, while the weasela keep a low profile.
4. The real power users. These are the only ones that you can trust to do most of the management, more because not only they display the knowledge and experience, but also a healthy level of restraint. This is the kind of guy that knows what he is doing but won't mess with the equipment simply because he is bored. After all, he is busy enough doing his own job, no time to do yours unless he understands it to be a honest emergency.
The best combination I have seen so far was at a previous job during the dot com years. They didn't trust anyone, but once they figured out if you were not dangerous, they would yield control little by little. I was running all of the programmers in the company, and from early programmers and IT got along like thieves. As each new programmer got hired, we pretty much threatened to kick their asses if they did anything to antagonize the IT folks. It worked, as a norm my team's IT requests were handled faster and with less hassle than some other group full of prima donnas that treated the IT folks as if they were scum.
Techy people - yes with caveats. Other people? NO! (Score:3, Insightful)
However other people? Noooooo! Not even with a course in basic computer management.
I'd still get the former group to take a course in acceptable computer use, of course. Too many universities don't have a proper ethics course on their CS courses these days - then again, too many CS courses are glorified "programming" courses.
Works in large companies. (Score:1, Insightful)
Re:How do you handle the following issues? (Score:4, Insightful)
backups exist.
2. User just deleted an OS directory and their computer will not run.
backups exist.
3. User kept everything on his/her local drive and it just caught fire.
backups exist.
4. User wants an email from 3 years ago that user had deleted from his/her last computer 2 years ago.
see 5. (anyway, even many "managed/locked down" setup (like in small companies) don't have this one solved so, not a huge deal.
5. The legal department wants all email to/from Mr.X, Mr.Y and Mr.Z.
email archived server side, without any implication on the client side
6. User keeps getting infected with viruses.
enforce running AV
Letting the users do some stuff doesn't mean not running AV / backup. Of course, one can hack the machine to disable all of this.. but honestly.. these people can be fired too
I'm not saying it is the way to go, but your points are not really proving it one way or another.
Re:How do you handle the following issues? (Score:4, Insightful)
1) You design your processes so that important files are centralized. Don't make it possible to do 'work' locally. Backup is handled on the network. Now the user has, at best, deleted something that was important to them (not your business) locally.
2) Reimage. See #1 in terms of what the user loses.
3) See #1.
4) everything using mail protocols recorded on the network.
5) see 4.
6) reimage, reimage, reimage until the user learns. have virus checker in the image (I guess user can possibly uninstall, but if you have a user with this chronic problem, respond to them more and more slowly / report them).
Giving the user control over their pc doesn't mean the same thing as giving up centralized services.
But it wasn't the companies profile (Score:4, Insightful)
C:\Documents and Settings\John User\Documents\My Music\Lita Ford
I think John User must have done it. I am pretty sure if you spell it out as policy against such actions, that the company would divert *.aa to the actual user that comitted the infraction. No amount of hand holding can really prevent this sort of thing. If they have access to the box, they have root right? That's what we say all the time here.
They will do stuff like this. It'll get worse as the younger generation grows into working age.
That's why I don't store too much personal data on my work computer, but access my own music via streams from orb.com
However, I guess we could just make it illegal to use workstations at work, and make everyone access company infrastructure via a terminal. Yeah GREAT IDEA...
They are valid ONLY for centralized operations. (Score:5, Insightful)
Saying that "backups exist" does not address the question of HOW the backups are made when the user can put any file anywhere on their system.
With a centralized system, the users can be restricted to ONLY saving files on their TEMP directory and the servers. Those are MUCH easier to backup and lots of packages exist for that exact purpose.
Re:Middle ground is a good place for me (Score:3, Insightful)
As far as I'm concerned, IT is a glorified janitorial service... at least where PC systems service is concerned
Well, it should be better than *that*. A good IT guy, to me, is a critical team member who helps us keep running smoothly and gets us out of jams. To go with your analogy, the good IT guy isn't like the janitor who routinely sweeps the floor, he's like the good plumber who fixes your overflowing toilet before you're swimming in crap. Can't put a price on that. Unfortunately, most of our IT guys are like the plumber who gets to your house and tells you he doesn't do toilets.
But IT can only do so much.
True. Which is why I'll go out of my way to point out to the higher ups how chronically overworked our good IT people are. I'll also get a read on how busy our good IT guy is and understand if he can't get to my stuff immediately. He's got enough jackasses who claim everything they need is "critical". Funny thing is though, he usually gets to my stuff before theirs. Treating people well usually gets you farther, funny how that works.
And my people seem to appreciate my loose grip on their machines. Most of them are mature enough not to screw things up too badly.
I certainly would appreciate it! We need more guys like that. 95% of our IT guys are assholes who quote policy as if it were written by Moses, and can't be bothered to go out of their way to help you do anything unless you get a VP on their ass. Oh, and they're generally incompetent to boot.
If you're ever looking for work, we gots offices all over the place!
There is not much difference, really. (Score:1, Insightful)
The Lotto is a big gamble where stupid people pour in a lot of their hard-earned money, only to see it ultimately end up in someone else's hands.
A 401K plan is a big gamble where stupid people pour in a lot of their hard-earned money, only to see the all the stocks it was invested in dry up and blow away, and all that money ends up in someone else's hands.
NOOOoooo (Score:4, Insightful)
Yes, there are special cases out there. But they are special cases. By default, the only policy that works is to lock down a machine and grant access as needed. Too many people treat an unrestricted machine like a "rental." They abuse it. They don't take simple precautions because, hey, it's the company's machine. Given a chance, they will treat it as a personal plaything.
To deny these truths is to deny basic sociology. And as I said, 10 years of first hand experience that is amplified by every competent admin I know.
Re:in the perfect world... (Score:2, Insightful)
With all that said, there are downsides of which the CIO should be aware. I had one self-proclaimed networking expert that brought up a DHCP server with a 16-address range on a 3,500 computer network. For those of you that don't know the technology, what that means is the next morning, 3,484 computers were denied network connections by his (idle) server because it was out of available addresses. His VP and I did not agree on his skill set, and the result was her entire network was down. She and I managed to reach an accord, in which his 12-node office became isolated from the rest of the network, and firewalled. His later disruptions impacted far fewer of her people.
Generally, though, getting groups of super-users together with the IT staff can, after initial shock, result in strong alliances, reduced friction, and some really positive and healthy changes in support.
Re:How do you handle the following issues? (Score:5, Insightful)
So you want to pay desktop support techs to re-image users' computers all the time? In our company re-image takes about 8 hours due to hard drive encryption, which translates into lost productivity of the user.
I've worked as a desktop support tech both in my college where users had admin rights to their PCs, and for a company that had locked-down environment with packaged software where almost nobody had admin rights and no non-approved software could be installed. I'd say on average I spent 3 times longer to put the users in the college back online, and to restore their data. Of course there's the whole issue of weatherbug/toolbars/ActiveX/other crapware that the users installed on a regular basis.
Re:How do you handle the following issues? (Score:2, Insightful)
I have one rule on users who want "Administrator" permissions on their Windows system: if I determine they have been irresponsible with their system, I will image the system immediately with no chance of data recovery. After the first imaging whereby no quarter is given to recover data, I never have a problem with that user again
Re:in the perfect world... (Score:3, Insightful)
We already run this way at where I work. We're a small place and there's no in-house IT department. If one of us in development needs more ram or a new harddrive, the procedure is to go buy it and install it yourself and give management the bill. Nearly everyone is savvy enough to handle this on their own, and if you aren't its easy enough to ask someone to help you.
You my friend are working for an enlightened organization. If more companies adopted this they would save trillions. I/T today now has become butt kissers to the inept and dysfunctional of an organization. They load spyware, bots and crap on their PC and blame I/T in fits of irrational rage. They treat their PCs worse than their dogs, often ignored and abused, I/T treatment is worse. They watch porn during the day, while managing other people and bitch because bandwidth isn't enough. Managers ignore the pleas from I/T, cut the crap and do business. Managers fail to deal with the issues on their own employees are doing and keep on pissing on I/T for bad employees. Maybe they too are just too stupid to know?
Time to cut the employees on their own. Like car mechanics, give them a $1000/year to buy their own tools and maintain them. Thus they may take care of them and realize the CD/DVD player is not a coffee cup holder. At the network switch, when they get puss infected with the Trojan of the day, cut their MAC address of and cite, "You are endangering the company and are cut off until you fix your PC. We suggest you reinstall and add AV and good practices as well as patch up. This will help us in enabling your PC to again communicate. A report has been sent to you manager, and their manager on your activities abuse in the system. It has also been added to your personnel file for the annual review".
Oh if management only knew the crap that specific people do...I/T systems have the dope. Management has their head stuck up their asses for not using it. Yet beat people up on the production floor for 10 cents an hour while the boss watches porn.
If you are a CEO, and you want to know who to lay off that isn't adding value, look at you companies firewall logs and proxy servers. They have nice lists of the people that have too much time and mischief on their minds to be valued employees. Warning though, you many find the CFO or the CIO watching the competitors stock more than your own.
I work for a dysfunctional company, just waiting for the severance, perhaps 2 months away from asking my best friend and my boss to lay me off. I hope to do better next time.
Re:I should be so lucky (Score:4, Insightful)
I also wonder how well your "big boss" knows the work required and whether or not micro-managing his staff's PC configuration might be a bad use of his time. It certainly speaks volumes of what your company thinks of its employees.
Re:in the perfect world... (Score:3, Insightful)
You have a written policy against that kind of thing. You tell employees to remove suchlike should you ever become aware of it, and the responsibility lies with whomever actually did the illegal thing. What a concept !
You're inventing problems that simply don't exist. It's not as if there's any technical barrier to a employee speeding in a company car, calling in bomb-threats from company-phones, hitting someone over the head with a company-owned chair etc etc etc.
Yet in all these cases, the company as such has precisely -zero- responsibility aslong as they did not encourage or assist the crime, or at the very least could be shown to have a policy of silently accepting. (it would, for example, perhaps be different in the case of the speeding if one could show that the company had encouraged employees to speed in order to manage more in a day)
Re:in the perfect world... (Score:3, Insightful)
Why not let them use their own headphones? They probably sound better than $20 speakers. Also, they can turn the volume up louder. Unless all your employees have offices?
Re:But it wasn't the companies profile (Score:3, Insightful)