4 ms·

I think the key phrase here is "employee owned Macs". They don't say what the equivalent results are for "employee owned Windows PCs", but I'd bet they're in th

by rhplus 15y ago

I think the key phrase here is "employee owned Macs". They don't say what the equivalent results are for "employee owned Windows PCs", but I'd bet they're in the same ballpark. And when they say "owned" they really mean "administrated", meaning the PC isn't part of the corporate domain and subject to corporate Group Policy.

johngalt 15y ago
Ah so that falls under the umbrella of expectations of IT. E.G. someone brought a machine from home one day and proceeded to work on it, then had a failure and lost "business critical" data. Then management chewed out IT with questions like "How could you allow someone put our data in that situation!!!", "What could you have done to prevent this!"... Hence IT Policy: no personal machines in the building. To anyone else in IT; here's how you avoid that situation, and the resultant policies. Audit your connections, or have an inventory tool which will let you know when new MACs (the NIC addresses) are seen. Then follow up with a polite email to $PersonalDeviceUsers's Boss detailing what you can/can't offer service wise. So long as everyone understands the situation ahead of time (in writing), you'll avoid having to write such policies later.
- sk5t 15y ago
  How do you propose to identify the user associated with an unidentified new MAC? Is there some way that isn't tremendously labor-intensive?
  - yardie 15y ago
    If they are on ethernet smartswitches can do it for you (you only need to know where it terminates). If they are on the wifi then some devices will display their nmb name (for example "Joe's Awesome iPhone(FE-2A-FE-FE-FE-FF).
  - johngalt 15y ago
    If they are connected to a share already... done. Just let the list of open sessions tell you what username is associated. Alternatively dump the FDB on the switch. Really easy if you use voip phones with downstream connections to the computer. Then you can lookup which phone MAC is associated and call it. Depends on your environment but once you find a method. Write a script and tie it to the new MAC alert. So the report would look like. "New device on switch x port 6 given IP y.y.y.y and logged into shares under z."
- yardie 15y ago
  And this is why employees hate their IT department. Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job. 1. If business critical data is lost this is your fault because those backups should have been performed regularly, throughout the day. 2. Unknown devices on the network should have automatically been switched to a DMZed network. If they want it on the corporate network they'll email you and ask how to do it and probably tell you why as well. People bring in all types of devices not related to work; cellular hotspots are one example. 3. Going to the user's boss is just an asshole move. If they are causing trouble, yes by all accounts go ahead. But from an outsider it looks petulant.
  - cbs 15y ago
    >Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job. Oh yes, I forgot. IT budgets are infinite and supporting all existing business computing requirements on any foreign device that show up takes zero time.
    - yardie 15y ago
      There is a world of difference between not supported and not allowed. If you don't support it then don't support but there are some places that are actively hostile to anything but windows.
      - cbs 15y ago
        >There is a world of difference between not supported and not allowed. Allowing any foreign device, even if unsupported, is a serious cost. Not supported but still on the privileged network (or on the guest net and hooking into any privileged resources) is a HUGE security threat. Especially in areas like ours where make or break comes down to our ability to protect our trade secrets. Malware running on a non-privileged account on a personal computer is still a serious data exfiltration vector. Frankly on our network, not supported is the same as not allowed. >If you don't support it then don't support but there are some places that are actively hostile to anything but windows. Actively hostile to anything but windows, or actively hostile to anything they haven't prepared for, which just happens to be windows because that's what business needs demand? I've known admins who only support windows because its all they know, and admins who only support windows only because that's pragmatic for their deployment. Theres a big difference, and if its the former and it bothers you, vote with your feet and fucking quit dude.

by rhplus 15y ago

johngalt 15y ago

Ah so that falls under the umbrella of expectations of IT. E.G. someone brought a machine from home one day and proceeded to work on it, then had a failure and lost "business critical" data. Then management chewed out IT with questions like "How could you allow someone put our data in that situation!!!", "What could you have done to prevent this!"... Hence IT Policy: no personal machines in the building. To anyone else in IT; here's how you avoid that situation, and the resultant policies. Audit your connections, or have an inventory tool which will let you know when new MACs (the NIC addresses) are seen. Then follow up with a polite email to $PersonalDeviceUsers's Boss detailing what you can/can't offer service wise. So long as everyone understands the situation ahead of time (in writing), you'll avoid having to write such policies later.

sk5t 15y ago
How do you propose to identify the user associated with an unidentified new MAC? Is there some way that isn't tremendously labor-intensive?
- yardie 15y ago
  If they are on ethernet smartswitches can do it for you (you only need to know where it terminates). If they are on the wifi then some devices will display their nmb name (for example "Joe's Awesome iPhone(FE-2A-FE-FE-FE-FF).
- johngalt 15y ago
  If they are connected to a share already... done. Just let the list of open sessions tell you what username is associated. Alternatively dump the FDB on the switch. Really easy if you use voip phones with downstream connections to the computer. Then you can lookup which phone MAC is associated and call it. Depends on your environment but once you find a method. Write a script and tie it to the new MAC alert. So the report would look like. "New device on switch x port 6 given IP y.y.y.y and logged into shares under z."
yardie 15y ago
And this is why employees hate their IT department. Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job. 1. If business critical data is lost this is your fault because those backups should have been performed regularly, throughout the day. 2. Unknown devices on the network should have automatically been switched to a DMZed network. If they want it on the corporate network they'll email you and ask how to do it and probably tell you why as well. People bring in all types of devices not related to work; cellular hotspots are one example. 3. Going to the user's boss is just an asshole move. If they are causing trouble, yes by all accounts go ahead. But from an outsider it looks petulant.
- cbs 15y ago
  >Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job. Oh yes, I forgot. IT budgets are infinite and supporting all existing business computing requirements on any foreign device that show up takes zero time.
  - yardie 15y ago
    There is a world of difference between not supported and not allowed. If you don't support it then don't support but there are some places that are actively hostile to anything but windows.
    - cbs 15y ago
      >There is a world of difference between not supported and not allowed. Allowing any foreign device, even if unsupported, is a serious cost. Not supported but still on the privileged network (or on the guest net and hooking into any privileged resources) is a HUGE security threat. Especially in areas like ours where make or break comes down to our ability to protect our trade secrets. Malware running on a non-privileged account on a personal computer is still a serious data exfiltration vector. Frankly on our network, not supported is the same as not allowed. >If you don't support it then don't support but there are some places that are actively hostile to anything but windows. Actively hostile to anything but windows, or actively hostile to anything they haven't prepared for, which just happens to be windows because that's what business needs demand? I've known admins who only support windows because its all they know, and admins who only support windows only because that's pragmatic for their deployment. Theres a big difference, and if its the former and it bothers you, vote with your feet and fucking quit dude.