Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×

Remote Management and User Consequences? 139

Posted by Cliff from the battle-between-adminis-and-computer-saavy-users dept.
NNWizard asks: "I work in a large university in Belgium where the people in charge of university computer systems want to install LANDesk on every single computer connecting to the university network. The aim is to be able to manage software and provide centralized remote user support. In the old days, every department had computer guys dedicated to the department, and they knew all about the users and their needs. Now, they want to make the management of computer resources global. In most non-engineering faculties this is well accepted, however in the Applied Sciences Faculty the users are computer savvy -- they do not like the idea of giving out control of their computers to people they don't know. What experience does Slashdot have with such a situation? Was the deployment of LANDesk (or a similar software package) a good or a bad thing for the users? How were the privacy issues tackled? Were people still able to use their computers the way they wanted to use them?"
This discussion has been archived. No new comments can be posted.

Remote Management and User Consequences? More

Remote Management and User Consequences?

Comments Filter:

  • At my company... (Score:5, Interesting)

    by parasonic ( 699907 ) on Wednesday March 08, 2006 @10:51PM (#14880357)
    We simply use the freeware version of RealVNC. When employees first join, they have to give up rights to "privacy" for the I.T. people. We respect official business, but unless it's someone high up in the company is working on some sensitive information, we typically assert our authority as our workers should only be working on official business.

    If you are concerned about privacy, I'd look into something simple like VNC if you have the management software to know who's using what computer when. It works VERY well with us and is very versatile--I can't tell you how many times it has saved our butts from having to drive 300 miles when we just put a VNC connection over an SSH tunnel at a remote jobsite.
    • ssh provides ample access, and if you need access to a GUI then remote X will do the job (we use an NXClient connecting to a FreeNX server). All over an ssh tunnel.

      • Re:At my company... (Score:3, Informative)

        by BobPaul ( 710574 ) *
        I don't understand why remote X is brought up every time someone mentions VNC... VNC runs on windows, too. I'm sure his company probably has primarily (if not all) Windows machines. Remote X doesn't do so well on windows (by nature of the lack of X).
        • I was assuming they have the same setup as me, all Linux. At home and work. I use NXClient (remote X with additional compression) and it's great.
          • How did you get modded to a 5 for saying that you are an idiot who assumes everyone uses the the same setup as you? Especially when the summary says that they work in a large University in Belgium! Sure it would be nice if everyone in the University were using linux, but there is a better chance that like most schools and large businesses that the majority of the machines are using Windows 2000 / XP and that there are few if any linux machines that IT actually administrates.

            When I did work at a University t

            • Why is he an idiot? VNC runs on Windows, until I read this thread I didn't even know that it could run on Linux. We used it at my High School to keep tabs on the users in the labs.

              Now-a-days, I use the Remote Assistants feature in Windows/MSN Messenger. This would probibly work better in a company using LiveCommunication Server to acutally run their messenging client though.

    • and who looks at the IT people? (Score:1, Insightful)

      by Anonymous Coward
      oh wait, youre more equal

    • Re:At my company... (Score:5, Informative)

      by glorpy ( 527947 ) on Thursday March 09, 2006 @12:07AM (#14880674)

      Academics are a very different beast from for-profit corporations. Faculty are effectively BOFHs, as they are absolutely vital (they bring in serious outside funding and desirable students and press) and are very tempermental. Faculty do not appreciate or enjoy administrative work. Schools are generally lucky if they can get them to teach well, let alone learn anything not directly related to their research.

      The software used in labs tends to be poorly coded at best. Downright hacks from the Stone Ages are not uncommon, even on $50K microscopes (how many of your microscopes run Windows 95?!), so IT is going to have to be very careful in defining "computers".

      Have the heads of IT, along with engineers and project managers, meet with Department Chairs, Deans, the Faculty Senate, and any star faculty. Individually and en masse. Throughout the planning, implementation and follow-up stages. Keep clear lines of communications open at all times. Be prepared for quick, courteous responses to irate and unreasonable faculty. Whatever you do, though, do NOT allow the faculty to define the terms of their relationship with IT. They are horrible clients; they don't know what they want, communicate it even worse and have the power to make your lives miserable. Perhaps the Marketing department can be hired to help out?

      I wish the OP the best of luck with this endeavor. And with the future job hunt when faculty come back screaming at the Deans, only to have them turn around and blame IT.

      • Re:At my company... (Score:2, Informative)

        by slonkak ( 648358 )
        I agree with the "keep them involved" idea. However, you are also correct that they do not know what they want. Bottom line is, those computers are not their personal computers. When they were hired, they, like myself, should have signed many papers, one of which basically says that absolutely nothing you do at work is private. Whether they like it or not, it's not their call.

        We use Altiris where I work. Through Altiris we have two different ways of controlling a computer. First, through the Notifica

    • Re:At my company... (Score:2, Interesting)

      by Anonymous Coward
      Too bad that vnc is not permitted [devhood.com] or here [realvnc.com]by the windows XP EULA, or maybe you are just
      need to purchase another XP license? [realvnc.com]
    • UltraVNC [sourceforge.net] is the best VNC, in my experience.

      --
      Loose Change [google.com]. Interesting free movie.
    • My company does not permit non-company machines to connect to the corporate LAN. Since they control the machines which connect, they can install whatever they want on those machines.

      If you decide not to agree to that, you will not get a laptop. :-)

  • I don't think so.... (Score:5, Interesting)

    by jipis ( 677451 ) on Wednesday March 08, 2006 @10:51PM (#14880359)
    I gotta say: As an admin, I enjoy having the ability to remotely see what's going on on my machines. If they're users' desktops, it's much easier to just get a view of their screen (think PC-Anywhere) than to keep asking them what they see now only to get half answers and useless replies.

    That having been said, what the university wants to do is 1) completely different and b) a Very Bad Thing. In my case, *I* am the admin and the machines are *MINE* . The university is looking to force anyone who wants to use its network to give them root on their machines? Puh-lease. It's time for departments who don't want to lose control of their PCs at this university to start looking for an outside ISP. Chances are there's already money in the budget for it: they probably kick in to the general IT infrastructure budget already.

    -J
    • if what you're advocating is that every individual department is allowed to break away from the main network, setup their own infrastructure, and service it any way they like, then it's a dangerous road to go down. sure, it may appeal to the freedom-loving geek in you, but it has a lot of downsides: no economies of scale (e.g. licencing, helpdesk, etc), difficulty in communication across departments, loss of standardisation etc. all this probably *doesn't* translate into a lower Total Cost of Ownership.
    • All too often, real maintenance and security can get replaced by "checking off boxes on the form," and the higher up the company it goes, the more likely that is to occur, IMHO. Moving maintenance and security higher up the company also tends to pressure things into "one size fits all."

      This isn't universally true, and in some circumstances, it's probably the right model. But at a research facility or University, other than administration, it's probably not.

      • This isn't universally true, and in some circumstances, it's probably the right model. But at a research facility or University, other than administration, it's probably not.

        Exactly. This policy might be fine for clerical staff, but for researchers - especially those working in the computer field - it's a non-starter.

        Giving a remote, central IT department control over the computer engineering faculty's computers is like putting the agricultural research tracts under the control of university groundkee

    • it's much easier to just get a view of their screen (think PC-Anywhere) than to keep asking them what they see now only to get half answers and useless replies

      Absolutely. Nine times out of ten, when we ask a user over the phone to read the error message and title in a dialog box that pops up, we don't get the complete picture, even though we ask for the user to tell us EVERYTHING that is on the screen. That makes telephone troubleshooting annoying. It's why we use remote management whenever possible, and

  • They're full of crap (Score:5, Insightful)

    by ltbarcly ( 398259 ) on Wednesday March 08, 2006 @10:52PM (#14880365)
    People who believe that they 'know about computers' are the biggest problems from an administration standpoint. Of all of my users, the ones who don't think they know how to manage their computer end up doing a lot less damage than those users who think they know what they are doing.

    And the worse part is, people who THINK they know all about computers are also the ones who will blame YOU when they hose their installation of Windows. Frankly, I find it unlikely that these engineers need the control of their computers. More likely they want to install unapproved software and various adware bullcrap which will bring your network to a crawl.

    I say this from experience. Initially I thought it would be OK to give some 'expert' users local admin rights, so that they wouldn't have to call the help desk in those situations where they simply want to install real player to listen to Rush Limbaugh or whatever else these dopes do. However, they instantly manage to get spyware, trojans, keyloggers, and other worms and viruses. They do this despite fully updated Microsoft Spyware (granted, it is a beta) and fully updated antivirus software.

    It is only recently, as we moved to managed antivirus software, that I began to understand the amount of damage these people were doing. I now get reports of virus activity, and I am never going to make the mistake of giving a user local admin rights again. It is easy to do, but they will abuse it, and taking it away is 1000x as hard as just sticking to a policy of never doing it. Once you give in they will know that you can bend the policy, and when you take it away you are telling them through your actions that you don't trust them to know what they are doing.

    And the one thing these people always think is that they somehow know what they are doing.

    Let me make it a simple maxim: 'If you are not responsible for the maintenance of a computer, you WILL NOT UNDER ANY CIRCUMSTANCES have administrator rights on said computer.'

    • Re:They're full of crap (Score:4, Informative)

      by ltbarcly ( 398259 ) on Wednesday March 08, 2006 @10:55PM (#14880372)
      I am only talking about computers owned by the institution. Obviously nobody should give up root access to their personal computer.
      • I'll agree to this. Mostly. The admins of a machine should be at the level of ownership of that machine -- unless the level defers to a higher level. That is, if the Applied Math Dept or the Computer Science Dept wants to admin their own machines (ie, have admins to take care of all dept machines -- not to have each user take care of his/her "own" machine), this should be allowed.

        Truly "personal" computers on the university network are another story. I don't know the best ending to that one.

        -J

        • Re:They're full of crap (Score:4, Insightful)

          by rah1420 ( 234198 ) <rah1420@gmail.com> on Wednesday March 08, 2006 @11:57PM (#14880623)
          Truly "personal" computers on the university network are another story. I don't know the best ending to that one.

          "No." Meaning that such devices are not allowed.

          That's the way my company does it. If it's an asset owned by the corporation, it is allowed to get Ethernet packets. If not, it's not.

          I bring my personal machine in, but there's no cat5 going into it even though it's safer by far than any corporate machine.

          • "No." Meaning that such devices are not allowed.

            That's what I was thinking initially. However, this is a school we're talking about. Many (most?) schools allow students to plug their desktops into the network ethernet and use their laptops on the school's wireless LAN. We are talking about private machines here. Of course, there is the acceptible use policy (or whatever a given school calls it) dictating what is okay for the student to do. I can't imaging it saying "no running viruses", though.

            -J

            • “That's what I was thinking initially. However, this is a school we're talking about. Many (most?) schools allow students to plug their desktops into the network ethernet and use their laptops on the school's wireless LAN. We are talking about private machines here. Of course, there is the acceptible use policy (or whatever a given school calls it) dictating what is okay for the student to do. I can't imaging it saying "no running viruses", though. ”

              Well, maybe it's true for big universities l

            • I'd have thought that "an effective, up-to-date, virus checker" would be an excellent start to an AUP.
          • We had that setup, with some wacky ass login script that would pull the smbios info from the machine and if it wasn't in the asset register then bye bye ip address...
            That worked great for them until we changed the smbios of all the systems we wanted on the network to old systems that had never been removed from the asset register... =D
            But then again our IT people are smart. They left a voice message on my cell phone when I logged a call about my cell phone being faulty.

      • I am only talking about computers owned by the institution. Obviously nobody should give up root access to their personal computer.

        Well, the summary says any computer connected to the university network.

        When I was in school, many profs/departments bought their own machines out of their own budgets/research moneys.

        I can't see someone who paid for the machines being willing to hand over hand over control to remote people. Such uniform policies work for the lowest common denominator, but not for everyone.

        And,

    • Re:They're full of crap (Score:5, Insightful)

      by jipis ( 677451 ) on Wednesday March 08, 2006 @10:58PM (#14880383)
      I think you're missing something important here. The admin rights are being taken away from the local heretofore admins in favor of giving them to the corporate-level admins. As an admin to whom this has happened, I can tell you that this policy change / procedure change / whatever marketing-speak term you want to give it is a Very Bad Thing. The corporate IT people -- even if they know what they're doing (personally, I've found that too many ppl at the "corporation-wide" IT support level know less about computers than my dog) -- cannot do as good (good at all??) a job at the admin stuff as a local admin could.

      -J

      • Re:They're full of crap (Score:4, Insightful)

        by jonwil ( 467024 ) on Wednesday March 08, 2006 @11:05PM (#14880410)
        This is especially true if (as is likely the case) the department involved is using specific software (e.g. the science dept might have scientific or math software that they use).

        Allowing the department to manage it means that the guys who know the most about how to keep Matlab or LabView or whatever they are using running are the guys keeping them running.
        • Not only that, trusting other people with the machine you depend on for your work requires trust.
          Trust is built by personal relationships - i.e. sharing lunch or at least anecdotes. The central guys,
          as competent as they may be, will simply be too far away from most end users.

          Once the remote admin thing is in operation, and end end user can see them working on their own
          machine, and fixing things, the air my clear. But my feeling is that the hurdle will be too big for most users.
          And I certainly wouldn't wan

    • Re:They're full of crap (Score:1, Interesting)

      by Anonymous Coward
      This is why I locked the "central" computer support people out of the computers in the tiny lab I manage. I dont know about you, but all my user accounts are limited accounts, and they still manage to get infested with spyware. Every machine in the entire organization gets spyware. I do know what I'm doing, and I resent people who come in like ghosts, mess with my configs without telling me, try to lock me out of the systems I'm responsible for supporting and then refuse to tell me anything about what they

      • Re:They're full of crap (Score:1, Informative)

        by Anonymous Coward
        How the hell do you still get spyware if you've properly maintained the machine? Why are your "limited" accounts allowed to install software on the system?

        I maintain a mix of about 300+ Windows, and Unix stations. None of the 100+ Windows Boxes I've ever maintained ever got spyware/adware/malware on my watch. I don't let users run IE carte blanche. Since I don't completely uninstall IE, I secure it with group policy. I set a group policy to disable features and block out Bad websites at the firewall.
      • You locked them out of your lab PCs? Is this like the classic "You're Fired", "You can't fire me, I resign!" conversation?

    • Re:They're full of crap (Score:2, Interesting)

      by Anonymous Coward
      This cuts both ways, you know.

      I'm working in the developer group of an IT hosting services company. Until recently we had always been local admins of our own boxes, we had "direct" (read: 3 layers of firewalls) access to the internet so we could download patches, etc. and everything was rosy. With all the deadline pressures we hated *any* downtime so we made sure we didn't f**k-over our own machines, installed and maintained our own anti-spyware and anti-virus software (almost uniformly Ad-Aware, SpyBot and
    • > ... People who believe that they 'know about computers' ...

      How do you distinguish between people who believe they know about computers from those that actually *do* know? After all, you would (presumably) also claim to 'know about computers', right? ...or is it all about where you work? IE, if you work in the "IT Department", then you 'know', otherwise you don't.

      • Re:They're full of crap (Score:3, Interesting)

        by Anonymous Coward
        People who think they know about computers fuck things up. It does not matter where they work. I've seen people in IT royally Fuck up, because they only thought they knew. People who know about computers know not to patch so and so server or workstation to a certain level because some app breaks. I kept 150+ Windows workstations running because I kept notes.

        You don't always need the Service pack to be securely patched. You need to know what is a critical patch and what is just a bug fix that might fuba
        • I have no idea why my immediate parent posted as an AC, but I agree with him 100%. I wanted to add though is that you never really know which IT people are knowledgeable until they actually do some work on your workstation. With that said, farming out the IT work makes it impossible for any client to know who is working on their workstation. At my current job, they use DameWare to assist with the quick problems and I have no issues with that, but when something even semi-major happens they send down Lero
      • it's not what you think you know, it's what you're responsible for. Your IT department are responsible for the integrity of the IT systems. Someone who works in a lab but likes tinkering may have knowledge about the IT systems, but they're not responsible for them: it's not their job.
        • Ah, so it's not that they think they know (since IT dept people also thing they know), nor whether they actually know or not (since IT dept people can also not know), but whether they are responsible if things go wrong. IE, it's because the fingers only point at the IT dept that's the problem.

          Lets face it, people in IT departments are just as capable as screwing things up as anyone else. It's just because they get the blame that they claim they should have (type-A) 'control'.

          IMO, the system should be change
          • whilst you're at it, you should take some responsibility for the power in the building, and perhaps the cleaning the toilets: after all, you know something about those activities, too...
    • Parsing through all the attitude in bluster in your post it is clear that you are not dealing with the same user base as the author (engineers or scientists). Although I'll get it if I ask, I don't want root privs on my machine, because when I ping my admin I want it to be his problem, not mine. Furthermore, I can build and install most code myself in ~/ without root privs.

    • Re:They're full of crap (Score:1, Interesting)

      by Anonymous Coward
      Oh, Mr. Insightful.

      How glad I am, to be out from under your Reichstag ways.

      We have many of you, where I work, MCSE BOFHs by the bucketfull, stomping about in your big important boots.

      Our department got around you by running Macs, which you are inclined to preternaturally fear and loathe. Every drone in the office installs whatever they want, does their own maintenance, and helps the others when things go wrong. The only time we have a problem is when your IIS servers crash. Needless to say, your scary spywa
    • My last job was in a software company that gave everyone who wanted it admin on their own PC.

      People were a lot more productive because they could use the software they were happiest with (e.g. Firefox rather than IE makes a huge difference to anyone who uses the web for research rather than entertainment).

      On the other hand the place I worked at with the most central control, had some obviously badly configured PCs - e.g. access to a remote serve was given to anyone who logged in to a particular PC, rather t
    • It should be noted that utilites like ntpasswd can grant any user access to any local account, including Administrator. Of course, the users who know how to do THAT generally fall into a more select group, and are probably working on the wrong side of the IT line.

      • and? (Score:2)

        by RMH101 ( 636144 )
        local admin can still be restricted by group policy in the windows world. our users can crack local admin, but they still have account restrictions that stop them doing anything *really* bad that might threaten the integrity of our network.
    • Microsoft Spyware

      ...

    • Here, hold on to these wires, one in each hand. Our department is doing a study of the feasibility of replacing the dump resistors in our high-voltage capacitor banks with IT nazis.

      Unapproved software? What makes you think you have a clue as to what software a scientist or engineer needs to do their job?

      • It's easy. They submit a list of all the software they need, and it gets installed. If they need more software, it get's installed. If they're using UNIX, they can install it locally.

        From your post it is clear that you are one of the people who 'know what they are doing'. I'm a nazi because every time some person ruins their computers installation I have to take time out of other important things to image their hd, although sitting around waiting 20 minutes for a hd to image does give me an excuse to g
        • And in the meantime, they've wasted two weeks while you get around to their software, and then you've done it wrong because you don't know anything about the package they're trying to use.

          If you complain about taking 20 minutes to image someone's HD, I'm surprised you don't complain about taking half a day or more to install all the custom software each person needs to do their individual research.

          This is not a company with thousands of identical worker drones. Your perspective is incorrect here.

          (Even at m

          • I haven't met anyone who has hosed their windows install and needed a respin.

            You also have no idea what is installed on your network. Probably almost all of your IP is going out the door, straight to competitors or hackers.

            People don't need to install software on a daily basis. If they do need custom software, you dispatch a 'worker drone' to them and they can install the software while the person looks on and helps if necessary. The point is that commercial software will rarely cause a huge security p

            • Probably almost all of your IP is going out the door, straight to competitors

              Odds are, so is yours. The difference in your case is that it's carried out the door by pissed off ex-employees. Most of it innocuously, in their heads, as they take their accumulated experience and expertise to go work for your competitors, but at least some of it deliberately and with malice aforethought.

              As a consultant I've worked for a lot of different companies and I've noticed a very strong correlation between companie

            • Even with a fully locked network, what's to stop the employees from walking out the door with data?

              If your competitor wants your data, he will have it.

              Lock the network, prevent software installs?
              USB stick, done.
              DRM the files to a machine?
              Steal the machine. Blame the cleaning crew.
              DRM the files to the local network?
              Print em, stick it in a folder, walk out the door.
              Lock the network, DRM the machine, break USB, DRM to a license server, search your employees?
              Throw it away in the trash. Pick a break room, toss i
    • You might install spybot and turn on the Tea Timer on these machines, also
      any other security app that monitors processes and has lockdown on new registry
      entries without authorization might work in it's place .

      http://www.safer-networking.org/en/faq/33.html [safer-networking.org]

      Tea Timer can be a bit annoying if you install a lot of new software/plug-ins/extensions
      or other bits of code that engage the monitored regions, but the alternative is being
      "owned" by the latest method of backdooring the M$ OS yet again .

      Ex-MislTech

    • Let me make it a simple maxim: 'If you are not responsible for the maintenance of a computer, you WILL NOT UNDER ANY CIRCUMSTANCES have administrator rights on said computer.'

      A good way to control that while not appearing inflexible is to say that ANYONE may choose to have admin rights, but if they do, support is limited to wiping and re-imaging their PC (Gee, I sure hope you have backups!) coupled with surrender of admin rights (now that they've demonstrated that they are not qualified admins). If a PC

  • Seems alright to me (Score:5, Interesting)

    by BobPaul ( 710574 ) * on Wednesday March 08, 2006 @11:05PM (#14880408) Journal
    I don't have any experience with LanDesk, but I think remote management/remote control software in general isn't so bad. If it's just remote control, that really isn't any big deal and comes in quite handy if you ever do have to call them for help.

    If they completely lock down the machines and take away your admin privilges, well that's life and it can be good or bad. Most often this is only a problem if need to install software and once this has been deployed for a short time and things are running more smoothly again this, too, should be relatively painless; just call or send an e-mail and someone can type in the password and install it. This kinda depends on the strength of your IT department, though. When I was in highschool the instructors machines were secured tightly and there wasn't enough staff to assist in installing software, preventing teachers from getting work done occasionaly. That was an extreme case, though (1 guy, hired as the Video Productions instructor, doing IT for the whole building...) I would expect that in your case it shouldn't be too painful.

    As a disclaimer, I am an IT guy and our engineering college at the university has it's own IT group that engineering student fees pay for. I know our professors (and students) were less happy when IT was managed by the main campus group; we're more responsive and less politically hampered.
  • Users have no expectation of privacy beyond "We don't go digging into your files unless you ask us." To wit:

    Access to the University computing resources is a privilege and must be treated with the highest standard of ethics. The University expects all members of the community to use computing and information technology resources in a responsible manner, respecting the public trust through which they've been established, the rights and privacy of others, the integrity of facilities and controls, and all per

    • On Windows machines, our remote access software asks for permission. It's a hassle in we-the-supportings' eyes because if someone decides to get up and grab a cup of coffee or something we're stuck with our thumbs in your pie until you get back.

      if that's using the built-in remote control, it is possible to adjust the policy under the user's profile in active directory to allow administrators to remote control without asking permission first.

  • Dial-out assistance (Score:3, Insightful)

    by phorm ( 591458 ) on Wednesday March 08, 2006 @11:23PM (#14880468) Journal
    What I'd prefer, is something cross-platform that would let my user's dial me. Really, there's not much need to poke into a user's machine when no help is needed, and for the mostpart I have a heck of a time dealing with friend's who have VNC, but haven't configured the router, etc to let me in.

    I control my own inbound routing, so having the ability to control which connections are sent through the routing machine to my PC would make it much easier for me to have other's "dial-out" for assistance from me... rather than having them configure a router to allow me to "dial-in" to their machine.

    • Re:Dial-out assistance (Score:2, Informative)

      by cjunky ( 89004 )
      VNC can do this. You start the "Viewer" in listen mode (on your computer), and have the vnc server do a remote connection out to you from their computer. I have had to walk people through doing this when their router went poof @ one of our offices one day, and was able to get back in and redo the routing since I couldn't get it from the outside. Of course, it doesn't have a good way to wrap ssh around it, but nothing can be perfect.

      • Re:Dial-out assistance (Score:5, Informative)

        by BobPaul ( 710574 ) * on Wednesday March 08, 2006 @11:47PM (#14880559) Journal
        Of course, it doesn't have a good way to wrap ssh around it, but nothing can be perfect.

        Simple! Just install an SSH server on your computer and create an account for them to connect to.
        1) Have them download putty
        2) Send them a PDF showing exactly what to configure (for the port forwarding)
        3) have them connect with the username/password you created
        4) Have them send the request to local host.

        You could blend steps 1 and 2 togther by creating an MSI or something that pre-configures putty with a connection for your computer with the proper port forwards.

        Oh wait... you wanted a good way, not just a way...

        If only there were a windows vnc that bundled the ssh somehow...

      • Re:Dial-out assistance (Score:3, Interesting)

        by Baricom ( 763970 )
        UltraVNC [uvnc.net] does one better - they provide a small server app that only runs when the user is calling in to you. All of the settings - IP, port, you name it - are custom-compiled into the EXE, meaning they're locked out. You just double-click the program and push the shiny "Connect button." It even supports built-in encryption.

        I've run into two problems that make it a challenge to use, for now: the encryption is buggy and sometimes won't connect, and as far as I know, the VNC protocol it serves has some non
    • Hey you, RTFM!

      Vnc has supported this for quite a while.

      The mods must be on crack today...
      • Erm... no. If I RTFM on every since application I used I'd be done in about 20 years from now, assuming I didn't find new ones to RTFM from.
    • I don't know about software, but Copilot [copilot.com] is a service that's designed to simplify the whole process of remote support via VNC.

      Although their server-side proxy software isn't available, the source code to their "client" (which is based on the VNC client and server) is available under the terms of the GPL [copilot.com].

  • HIPPA and Remote Control (Score:4, Interesting)

    by GJSchaller ( 198865 ) on Wednesday March 08, 2006 @11:37PM (#14880508) Homepage
    Something to consider that may not directly apply here, but will in related fields, is the legality of a non-authorized person having access to data, even though they administer a system. Specificaly, it is against HIPPA regulations for someone to look at medical records without permission or need for their job. For example, an IT guy would not be allowed to look at a medical record on someone's screen, if, say, they remoted in (or walked by, or had network access to a share).

    This is a tough line. Someone other than the authorized personnel needs access to the files to be able to do the techie admin stuff. At the same time, they should not be looking stuff up, as it's illegal and an invasion of privacy. The whole thing of "Who's PC is it, ITs or the User's" adds another party, the person profiled in the data on that system. (Usually, it's the employer's PC, but that doesn't stop users, esp. ones with Dr. sized egos, from feeling & acting otherwise.)

    I've worked in a hospital using Seagate / Funk Software Proxy. We had it set so that we could remote to a desktop, but the user had to grant permission to see the screen. Usually, this resulted in a decent situaton and an understanding - the user would clear all sensitive data from the screen before accepting, and if they got surley and decided not to accept, they got pushed to the bottom of the priority list (and they knew it). In return, the IT staff didn't abuse this ability, and for the most part would rather read slashdot than check out someone's PC. ;-)

    • Specificaly, it is against HIPPA regulations for someone to look at medical records without permission or need for their job. For example, an IT guy would not be allowed to look at a medical record on someone's screen, if, say, they remoted in (or walked by, or had network access to a share).

      Now, IANAL, but I think you've just shown yourself the loophole. If there's a reason for the admin to log into that machine and he sees information that's there that he "shouldn't see", it's actually ok. Why? He nee

      • You hit it on the head i think. I'm in IT at a hospital myself. If there's something going on with somebody's machine and they call me, i don't care whats on their screen. It doesn't concern me, because all i care about is getting them back up and running. Our entire network is nothing but patient information. If we weren't allowed to see anything at all, we would grind to a halt.
    • Hmm.. I'm the database admin for a hospital over here in the UK, and there is absolutely no restriction on me seeing any medical data.
      It all passes around the hospital on the networks, is intercepted by the interfaces to the internal databases, and ends up on my servers.
      Now, I've signed many a form which amounts to "If I release any of the medical data, I'll never really be able to work in IT again", which I consider a fair clause.
      Everyone in the tech department is basically bound by the same agreement.
      If a
      • The UK sounds more lax than the US in regards to medical record privacy - we're not even allowed to look at the stuff, w/o clearance. There was a good cartoon at a nurses station where a wife came to pick up her husband from the hospital - by the time she cleared security, identification, and all the paperwork acknowledging she was indeed his wife, he had gotten tired of waiting and took a cab home... The sad part is, it's pretty much accurate.

  • THEIR jobs (Score:5, Insightful)

    by msbsod ( 574856 ) on Wednesday March 08, 2006 @11:41PM (#14880526)
    The whole thing is not about better support, privacy, security, whatsoever. People are using the Internet since two decades. No, those who deploy such software and restrictions only want to secure their jobs. It is that simple.
    • and the number of viruses and crap on the internet has gone down in two decades? i think it's the otherway around. management wants to reduce the cost of support. we don't use anything like this, but stopped giving users admin rights on their desktops a few years ago. we used to have 4-5 ppl staffing the helpdesk, now we only need 1. i think this is the way support will happen in the future. though i don't agree that just anyone connecting to the network should have to install it. if they are responsible fo
    • absolute crap. consider the following:
      1) excessive restrictions are bad
      2) excessive support calls are bad
      3) your network being compromised or going Foom! is bad
      4) restricting some areas of a client PC reduces likelihood of users messing with stuff on their client that will need fixing
      5) restricting some areas of a client PC reduces likelihood of users messing with stuff that will threaten the integrity of the network

      it's all about balance. IT are there to do a job, just like you are.
      Let's take on

  • STAFF... Autonomy... privacy... (Score:5, Insightful)

    by tverbeek ( 457094 ) on Wednesday March 08, 2006 @11:56PM (#14880616) Homepage
    One of my first questions to those mandating this change is how many more people they're going to give my department to perform these duties, and how you all are going to be trained to be familiar with the other department's apps. This is a pile of work being dumped in your lap.

    As for your questions, I don't think the privacy question needs to really become an issue. Pretty much every place I've worked in IT or Tech Support, I've had system privileges that gave me access to damn near anything on institution-owned equipment, from the president's e-mail to the custodian's bowling-league stats. And I've told them that... with the assurance that even though I could get at this stuff, I had no intention of doing so. I'm too busy to monitor people's private stuff and it's none of my damn business. I tell them that techies are just like janitors: we have keys to everything. {shrug}

    What's likely (hell: inevitable) to become an issue is autonomy. If people have to come to you to do things they're used to being able to do themselves, they'll understandably resent you for it. The only solution I can suggest to that problem is to give them the same level of service they're used to getting from themselves. e.g. If they want some software installed, you get the software installed. ASAP. (This is why you probably need more staff.) If you make it clear to them that you're trying not to get in the way of their work, they'll resent it less. And when you can't deliver, or have to say "no", they'll hopefully be more understanding if they know it's not just you being a control freak or lazy or not caring.

  • We lock them down, and have remote access (Score:3, Interesting)

    by phoenix_rizzen ( 256998 ) on Thursday March 09, 2006 @12:08AM (#14880682)
    We do something similar. All the computers that go out to users are locked down with DeepFreeze, with TightVNC installed (with a nice Helpdesk icon on the desktop). We don't do remote management, just remote control and remote support.

    The staff just love it. When they have a problem, can't remember how to do something, or come across a strange error message they don't understand, they just call the helpdesk, start TightVNC, give us their IP, and we take control of their desktop. We can show then how to do things, read the error messages for ourselves, watch as they go through the steps. Cuts our call times down, gives the users a greater sense of support, and virtually eliminates the "spend 20 minutes driving to a site to spend 5 minutes fixing the problem" kinds of workorders. Now, the onsite techs are only sent out for major problems.
  • The choice to shell out money for what's essentially VNC?

    Or, what's the difference?

    Maybe there's some cfengine-like stuff going on? But in that case, why not use cfengine?

    I would not want to give control to a bunch of admins who jump over the first shiny product that comes along, without being aware of the free (as in beer) solutions that already exist. If they make stupid purchases, they'll probably make other stupid decisions.
    • I'm not familiar with LANDesk, but I assume it's similar to VNC. I do use DameWare at work, which is VNC on steroids.
      It can install itself on the client, and you can do a lot remotely without bringing up the screen of the luser. I respect their privacy and often try and fix stuff in the background while they do their job. If I need to have their screen I phone them up and ask for permission. Then I go in and they see a big warning that I remotely took control.

      In the beginning I was worried that the lusers w
    • The choice to shell out money for what's essentially VNC?

      Or, what's the difference?

      If you google LanDesk you'll see it's a full desktop support package, along the lines of Novell's ZenWorks product line: remote control, application deployment, desktop imaging, etc, etc, etc. VNC only fills one piece of that puzzle.

  • My experience is only anecdotal, (Score:5, Insightful)

    by munpfazy ( 694689 ) on Thursday March 09, 2006 @03:00AM (#14881243)
    But, I've worked in three somewhat different academic research environments.

    1 - One central admin for all the desktop machines in a massive department, no one else gets root on any machine.

    2 - One central admin who is mostly an advisor, people are allowed to administer their own desktop machines if they want.

    3 - Free-for-all, in which most groups have one or two principle computer gurus who handle multi user servers and almost everyone administers their own desktop machines.

    #3 is far and away the best. In #2, no one that I knew of actually took them up on the remote administration option, essentially reducing it to #3. #1 was a nightmate for everyone. When the deparment computing committee tried to talk everyone into switching to something closer to #1, we all resisted fiercely and eventually they backed down.

    In an environment where people are actually using their computers as research tools, rather than as expensive notepads with which to writeup the results of their research, it pays to place control at the lowest feasible level. Every time a user is forced to ask someone else to fiddle with software, it adds *days* to what should be simple tasks.

    Sure, you create an occasional security risk when a bad user fails to install patches. But, there's no comparison between the number of man hours spent on dealing with those sort of incidents and the amount of wasted energy in trying forcing every minor change to go through a central administrator.

    In a computer lab or a corporate environment, you might be able to make a case for central administration. For academics, it's just crazy. (And I suspect enforcing it will just drive everyone to switch to personal laptops instead, in addition to pissing them all off.)
  • But at our company we use Netsupport Manager, which amongst many useful features has an option to require the user sitting at the computer to click a button to allow the support engineer to connect. This allows us to reassure the user that we won't take over their computer without their knowledge.
  • I wonder if the LANDesk client runs under Windows under VMWare.

    A honeypot of sorts.
  • My experience working in a R&D role in a major corporation with outsourced centralized support was very frustrating. Support was geared towards secretaries and business managers using MS-Office and some AS-400 applications over a terminal emulator. Anything other than that and you had problems because it wasn't covered under the support contract. If I needed to run an NMR modeling tool that required extra RAM on my PC, forget it. That was a non standard configuration and thus you weren't allowed to orde
  • I have to manage three physically separate offices, so remote administration is the only way to go. Almost everyone is on Windows XP so we just use a domain policy to allow us to offer unsolicited remote assistance to the users. They get a request for us to connect and a chat window to talk with us (although I do prefer to call them on the phone first, or have them call me). If it isn't a problem directly related to their session, then we Remote Desktop in for software installs and other administrator level
  • Everybody is going on and on about remote access, which is fine and should be a topic to be disucssed and not a policy handed down from on high. Unlike VNC, LANDesk is a remote MANAGEMENT package. Yes it has remote control software built-in, but it is also an inventory system (which is an absolute godsend when you can't find a PC) and a software distribution system. I work for a very very large company and LANDesk allows us to deploy software in hours in what would take days to do by hand. Instead of doing
  • i believe the way to calm thier nerves is to point out the benefits to them. remote control, whether they use a central helpdesk or thier own the users can get better and faster service via remote control. Security and patch manager, explain the time consuming procedures in updating security and patch fixes. explain how letting individual users do this on thier own can cause inconsistent results from machine to machine. explain that using the software monitoring tools can help when deciding on purchasing li
  • Sounds like you have a bunch of people who don't understand the meaning of "corporate assets." If people are concerned about what administrators can access on their computers, they should use a standalone computer that doesn't connect to the network. Administrators have to be able to do what they need to do for the good of all users on the network. The school's IT policy should have made this very clear.
  • The SMS client is included in the image that we provided to Dell for all of our new desktops. When the SMS client is borked, or when we simply get tired of the SMS remote control console, we use Dameware. When Dameware doesn't work we get the user to fire up Net Meeting. We're migrating from SMS to a product that doesn't provide remote control, CA Unicenter, I believe, so we'll be installing PCAnywhere on all desktops with SMS. On servers we use a mix of Terminal Services, PCAnywhere, and VNC.

    Our desk

  • If users on *your* network have a problem with their pc being managed, regardless of the tool you use, then they should not be allowed on your network. This isnt their home network, its yours. You are responsible for its upkeep and the only way to keep your network safe, and your users productive, is to keep control.

    Sounds like its time to set some policies and enforce them.
  • In most non-engineering faculties this is well accepted, however in the Applied Sciences Faculty the users are computer savvy -- they do not like the idea of giving out control of their computers to people they don't know.
    The computers don't belong to the users of the Applied Science Faculty. Those are not 'their' computers.

    They are the Universities computers.

  • The company I work for (well over 1000 users) has regional IT folks who have access to all desktops in their sphere of influence, and have also:

    1. Left the indication that the PC is being viewed remotely always in the taskbar, so the user knows if an admin is on their system. It's a simple Red/Green thing.

    2. They have all IT personnel make a serious attempt at not ever connecting unless asked to, or until they've spoken with the employee in person before connecting.

    This gives the IT group the visibility th

Slashdot Top Deals

A morsel of genuine history is a thing so rare as to be always valuable. -- Thomas Jefferson

Close