Another Power Optons control question

I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.


--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..


--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.



--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

On 8/8/16 10:16 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

If I'm understanding this, we're sort of talking one step up from a
simple network, correct?

And something that concerns me when it comes to the future. These
people don't have an IT position, and don't want to fund one. I would
like to see that position change, but that's quite a ways down the pike.

I'm almost to the position where I think the only thing that will get
their attention is if disaster happens.

--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Mon, 8 Aug 2016 11:02:10 -0600, Ken Springer wrote:

On 8/8/16 10:16 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

If I'm understanding this, we're sort of talking one step up from a
simple network, correct?

And something that concerns me when it comes to the future. These
people don't have an IT position, and don't want to fund one. I would
like to see that position change, but that's quite a ways down the pike.

I'm almost to the position where I think the only thing that will get
their attention is if disaster happens.

On 8/8/16 11:44 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 11:02:10 -0600, Ken Springer wrote:

On 8/8/16 10:16 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

If I'm understanding this, we're sort of talking one step up from a
simple network, correct?

And something that concerns me when it comes to the future. These
people don't have an IT position, and don't want to fund one. I would
like to see that position change, but that's quite a ways down the pike.

I'm almost to the position where I think the only thing that will get
their attention is if disaster happens.

Uhhhhhhh... OK BG

--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Mon, 8 Aug 2016 11:02:10 -0600, Ken Springer wrote:

On 8/8/16 10:16 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:
I asked a related question a couple of weeks ago, and Good Guy gave me
the answer. And I've discovered that only solved part of the problem.

Now, I need a way to prevent standard users from changing the power options.

And if also possible, to prevent a shutdown of the computer from within
Windows period, unless you are logged in an administrator account.

I still need to check the BIOS of each machine to see what my options
are there.

A friend of mine found the answer for me. I can search for an hour and
not find something, she looks for 5 minutes and done.

Via the group policy editor, you can specify a particular power plan,
and then the user cannot change it. The short blurb does not indicate
if there are any administrator issues with doing this.

Thanks to everyone who may have tried to find an answer for me..

Whereas group policy does work on individual machines, if you are administering a number of computers
belonging to a single organization, you would be well served to set up a Windows domain controller and join
all of the computers to the domain. You will then be able to administer all the computers (or subsets)
simultaneously, with consistency and in a far more efficient fashion.

Morning, Norman,

I understand what you are saying, but doing it is way above my paygrade.
And so is using a GUID number for the power plan setting. LOL

For that matter, at least 2 of the computers had W10 Home installed,
which means no Group Policy Editor is installed. I found instructions
on the web as to how to do it, but the first attempt has failed.
Researched since then, and discovered the website instructions I was
following left out one step! LOL I haven't had a chance to try again.

Aside from this, whatever I do, I have to be very selective in what I
pick. Most likely whomever follows me will be less knowledgeable than I
am. So I can't get too technical with what I do.

For the moment, I'm doing what's convenient for me, mostly. I don't
want to find that something I've set up for making the job easier for me
has been undone by a user, and likely done out of ignorance on their part.

Before I go too much further "physically", an IT policy needs to be
developed, and then followed. I submitted a draft last March, haven't
heard a thing.

They do a lot of talking about computers and what they should/need to
do, but not a lot of walking.

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

If I'm understanding this, we're sort of talking one step up from a
simple network, correct?

And something that concerns me when it comes to the future. These
people don't have an IT position, and don't want to fund one. I would
like to see that position change, but that's quite a ways down the pike.

I'm almost to the position where I think the only thing that will get
their attention is if disaster happens.

From a perspective of security, control and total cost of ownership, it most certainly is a step up from a
workgroup. It is somewhat like putting your horses in a coral, the size of which you define and modify as the
situation warrants.

Don't misunderstand me, there is a learning curve associated with administering a domain but as the road side
construction signs say: "The inconvenience is temporary, the improvement is permanent."

Approximately how many total windows machines are in the organization?

On 8/8/16 11:51 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 11:02:10 -0600, Ken Springer wrote:

On 8/8/16 10:16 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:50:05 -0600, Ken Springer wrote:

On 8/8/16 9:21 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 09:09:26 -0600, Ken Springer wrote:

On 8/6/16 8:32 PM, Ken Springer wrote:

snip

I've snipped what comes before this, just getting too long, and folks
can always walk themselves up the thread. :-)

You might want to read this short article and cogitate on it a bit.

http://www.cubittech.com/blog/2015/0...indows-domain/

If I'm understanding this, we're sort of talking one step up from a
simple network, correct?

And something that concerns me when it comes to the future. These
people don't have an IT position, and don't want to fund one. I would
like to see that position change, but that's quite a ways down the pike.

I'm almost to the position where I think the only thing that will get
their attention is if disaster happens.

From a perspective of security, control and total cost of ownership, it most certainly is a step up from a
workgroup. It is somewhat like putting your horses in a coral, the size of which you define and modify as the
situation warrants.

At least I interpreted that correctly in the broadest sense of the work.
LOL

Don't misunderstand me, there is a learning curve associated with administering a domain but as the road side
construction signs say: "The inconvenience is temporary, the improvement is permanent."

I don't mind the learning curve that would go with this, I've got enough
equipment here to play/emulate what there is a the social agency. I've
been doing that pretty much all along, and it lets me learn about W10,
which I've decided I'll never use as my regular OS here at home.

What worries me is the maintenance and upkeep when I'm no longer there.
I'm planning for the traditional "no change" policy Uncle Sam always has
when considering new projects.

Approximately how many total windows machines are in the organization?

At the moment, 8 Windows 10, combination of Home and Pro, and a Linux
Mint 17.3 laptop. They probably need 3 additional systems, one to
replace the Linux laptop, one for a new hire, and a spare. A potential
laptop replacement may come to pass this week.

When you have that shocked look of "What's he doing with a Linux
system??'" off your face... LOL

You have to realize, this place is totally reactive at best. They
operate a food pantry for low income folks, and found a volunteer to
keep track of inventory, who gets the food on a regular basis etc. She
needs a computer. The boss says, "Give her one of those that Ken gave
us." Well, all 4 systems were old XP systems with Linux, with the
intention they would be given away to families that need a computer but
can't afford one. I won't use XP for the agency. When I asked what she
was going to use it for, no one really knew. And of course, no one
knows anything about Linux or computers OSes overall. It was Linux or
no computer.

They want to be compatible, and the Windows systems have a variety of MS
Office packages. Once again, no commonality to make maintenance,
upkeep, and replacement easier.

"Will it run Office?" Of course not. But Mint does come with Libre
Office 5.x.x. So a cohort/conspirator made a whale of a spreadsheet, in
Excel, and imported it into LO Calc. Overall it worked, just had to
make a couple columns wider, etc., to accommodate a different font. A
couple weeks later, errors in the sheet everywhere. They guy who made
the sheet is 110% sure there's a compatibility issue. He can't find the
problem. The user is not Excel literate, just fills in the blanks I
got a copy of the sheet that she was using, and the original blank
sheet, One error was the user somehow changed the cell formatting in
every other row for a single column. Widened the column, problem
solved. Every single other problem was caused by a single text entry in
a cell that should have been a number. Fixed that. All is well and good.

The underlying problem with the spreadsheet is my cohort didn't create a
single data validation requirement. He's now done that for all cells,
and locked down the ones that simply display data or have computations.
It imports into LO Calc perfectly, and copy/pasting the data from the
buggered sheet also works fine.

Add 5 or 6 users with similar calibre as the above, plus one who refuses
to use a computer so has someone else do her computer work, and you'll
have an idea of what I'm working with.

Even my cohort, who loves spreadsheets, has realized the above really
should be a database.

Sorry for the venting, but at least I feel better. LOL

Given what they've told me about what they want to do, and where they
want to go, I've known from the outset that a server is going to be
needed. But, no money, no equipment, and no secure place for the server
such that everyone does not have access to it. :-( I brought this up a
month and a half ago, no movement on it at all.

My cohort/conspirator and I are planning a quiet coup d'état. Make a
little change here, a little on there, to the point they can't go
backwards. LOL




--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Mon, 8 Aug 2016 16:36:22 -0600, Ken Springer wrote:

snipped much information which was tangential to the subject at hand


What worries me is the maintenance and upkeep when I'm no longer there.
I'm planning for the traditional "no change" policy Uncle Sam always has
when considering new projects.

The above is akin to not properly tightening the lug nuts on the wheels of a vehicle out of concern the next
mechanic will not know how to operate a torque wrench.

Proper administrative practice is to document the basic structure of a network. Mission critical computer
networks are not something to be entrusted to people who are ignorant of the technology. In fact, those who
design, administer and maintain the IT infrastructure of any organization should be selected as carefully as
those people whose knowledge is foundational to the core mission of the business.


Approximately how many total windows machines are in the organization?

At the moment, 8 Windows 10, combination of Home and Pro, and a Linux
Mint 17.3 laptop. They probably need 3 additional systems, one to
replace the Linux laptop, one for a new hire, and a spare. A potential
laptop replacement may come to pass this week.

That number of machines and the diversity of your users, justifies the existence of a Windows domain
controller. Without a DC, you will be running around like a cat herder. You will exhaust yourself trying to
keep up with all of the home computer users who "think" they understand what works best, or who don't give a
**** about maintaining the setup you have established because they want a different wallpaper or want to use
an Arabic language and font, etc.


Given what they've told me about what they want to do, and where they
want to go, I've known from the outset that a server is going to be
needed. But, no money, no equipment, and no secure place for the server
such that everyone does not have access to it. :-( I brought this up a
month and a half ago, no movement on it at all.

A domain controller does not need to be a terribly modern machine. In your case, you will be using it
primarily to manage users, and enforce network policies. Some time spent on eBay will show you thousands of
server machines with covers that have a key lock. Combining the physical security of a locked front panel
cover with a machine that doesn't have a keyboard or monitor, you can hide it in a closet or mount it out of
site under a table and it will remain moderately secure.

You can purchase (also on eBay), a small locking rack or cabinet for the DC / server and your physical
security will be pretty decent. If you are a public social service agency, you could probably approach a few
larger local businesses, tell them what you need. Their IT departments might have some retired equipment they
can give you for the purpose. A Windows Server 2008 or 2012 machine would be perfectly adequate. While you
are in the process of getting a DC machine, you might as well get a second machine to serve as a backup domain
controller (BDC).

Also, keep in mind the workstations should be running the Pro version of Windows. Out of curiosity, what
rocket scientist decided that all the workstations should be running Windows 10?

Retrofitting an organizational network is somewhat like eating an elephant, you do it one bite at a time and
you do not roll out anything new until you have fully tested it.

On 8/9/16 8:06 AM, Stormin' Norman wrote:
On Mon, 8 Aug 2016 16:36:22 -0600, Ken Springer wrote:

snipped much information which was tangential to the subject at hand


What worries me is the maintenance and upkeep when I'm no longer there.
I'm planning for the traditional "no change" policy Uncle Sam always has
when considering new projects.

The above is akin to not properly tightening the lug nuts on the wheels of a vehicle out of concern the next
mechanic will not know how to operate a torque wrench.

In your analogy above, the assumption is there will be a "next"
mechanic. I can't assume there will be a "next" me. There was a person
looking out for computer things before me, but she was being paid with
grant funds. When the grant money ran out, her position was terminated.
They had a network, but it went away. The website and calendar was
not maintained. Users went from to Yahoo,
Gmail, etc., because no one was available to take care of things.

They start some very good programs, but when the grant monies stop, the
programs stop.

Proper administrative practice is to document the basic structure of a network.

Agreed, and is on my list. But as of yet, no basic network structure
has been started, unless you want to include in that configuring the
individual computers to be able to remotely administer them from off
site. "Off site" is my bedroom. LOL

Still haven't been able to get to 3 computers because the users are
either behind the 8 ball on something or not there on the one day a week
I'm there.

Mission critical computer
networks are not something to be entrusted to people who are ignorant of the technology. In fact, those who
design, administer and maintain the IT infrastructure of any organization should be selected as carefully as
those people whose knowledge is foundational to the core mission of the business.

I totally agree. But TPTB are ignorant of much of the basic technology
of computers, much less knowing what is involved when you create a network.

And they don't ask for help or advice or thoughts.

As I just typed that sentence, it occurred to me, I wonder if there's
some kind of quick super dummies article about the needs that need to be
met if you go the network route. I'm not saying they shouldn't, I'm
saying I need a good way to educate them, and I don't have one.


Approximately how many total windows machines are in the organization?

At the moment, 8 Windows 10, combination of Home and Pro, and a Linux
Mint 17.3 laptop. They probably need 3 additional systems, one to
replace the Linux laptop, one for a new hire, and a spare. A potential
laptop replacement may come to pass this week.

I forgot, there's a Vista laptop also, but it's use just for the screen
projector, AFAIK.

The screen projector has become another sore spot w/ me, but that's
another issue.

That number of machines and the diversity of your users, justifies the existence of a Windows domain
controller. Without a DC, you will be running around like a cat herder.

I try to do this when it's least disruptive to their daily ops. When
you get involved enough, you realize they don't have enough people, they
are not efficient, they don't want to spend money on themselves, and
they have no basic operating funds.

There are 3 of us there that recognize this, but 1 is a volunteer, one
is hired on grant money, and I'm an outside "contractor" (for lack of a
better word) and I spend a lot of time working on this that I don't bill
for, so I consider myself to be a part time volunteer.

You will exhaust yourself trying to
keep up with all of the home computer users who "think" they understand what works best, or who don't give a
**** about maintaining the setup you have established because they want a different wallpaper or want to use
an Arabic language and font, etc.

There is going the have to be a major paradigm shift to get any major
changes done. "We are a non-profit, we don't need sound business
practices." Honest, I've been told that.

It's possible there's a crack starting here, but it's now "grant
application" time, so there won't be any changes for the next few weeks.


Given what they've told me about what they want to do, and where they
want to go, I've known from the outset that a server is going to be
needed. But, no money, no equipment, and no secure place for the server
such that everyone does not have access to it. :-( I brought this up a
month and a half ago, no movement on it at all.

A domain controller does not need to be a terribly modern machine. In your case, you will be using it
primarily to manage users, and enforce network policies. Some time spent on eBay will show you thousands of
server machines with covers that have a key lock. Combining the physical security of a locked front panel
cover with a machine that doesn't have a keyboard or monitor, you can hide it in a closet or mount it out of
site under a table and it will remain moderately secure.


When I jumped into this, the agency owned 4 desktops. There were 2
personal laptops being used, one with XP. Everything that's been added
since are older used systems I've refurbished to some degree.

It just so happens one of those systems I came up with is probably one
of those server machines.

What I would like to be able to do, is get them on an equipment
replacement program, replacing a couple systems a year. Then I can use
that unit for server type purposes.

FYI, there are places out there where you can apply for donations/grants
that include hardware, and the agency pays a administrative fee. MS
does this, but I've not dug into it very far as of yet.

You can purchase (also on eBay), a small locking rack or cabinet for the DC / server and your physical
security will be pretty decent. If you are a public social service agency, you could probably approach a few
larger local businesses, tell them what you need. Their IT departments might have some retired equipment they
can give you for the purpose. A Windows Server 2008 or 2012 machine would be perfectly adequate. While you
are in the process of getting a DC machine, you might as well get a second machine to serve as a backup domain
controller (BDC).

It's a private social agency, not public. 501.c3. And they may have
burned some bridges in that department. We're talking about a community
population of 1,000, where the only real industries are gambling and
gold mining. Gambling is in decline, and the new mine owner is not as
community oriented as the previous owner.

Also, keep in mind the workstations should be running the Pro version of Windows. Out of curiosity, what
rocket scientist decided that all the workstations should be running Windows 10?

I'm that rocket scientist. LOL And I still think it's the right one.

I would have preferred W7, but if your planned future is to stay with
Microsoft and it's products, you're going to be forced into W10 whether
you like it or not. Any new equipment you buy will be W10. I don't
trust MS to keep their word on their plans.

Might as well try to be ahead of the game.

Agreed on the Pro idea, but I don't think anyone before me knew the
value of having a Pro version, they probably paid more attention to
price than anything else. The same goes with the mish mash of MS Office
versions they have installed.

Retrofitting an organizational network is somewhat like eating an elephant, you do it one bite at a time and
you do not roll out anything new until you have fully tested it.

In this case, I'm starting from scratch, there's really nothing to work
with anymore.



--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Tue, 9 Aug 2016 11:20:18 -0600, Ken Springer wrote:

Snipped crap no one cares about


In this case, I'm starting from scratch, there's really nothing to work
with anymore.

I have done my best to advise you in this matter, without using a sledge hammer and rock drill to make my
points.

You have the choice of acting as a servant or as a consultant. When one possesses confident expertise, one
can, with assuredness, advise those in positions of authority; making sure they understand what needs to be
done and specifically why. It can be very persuasive if you diplomatically convey to these people that you
are in a position to help them should they choose to do the right thing, but will bow out should they make the
wrong choice.

Giving technology ignorant people options when it comes to mission critical decisions is a fools errand,
unless you will get paid gobs of money either way. If you are donating your time and aggravation, why would
anyone allow themselves to be placed in a maze in which the walls and barriers are constantly being moved and
with the ultimate destination being a mine field?

Best of luck.

On 8/9/16 11:51 AM, Stormin' Norman wrote:
On Tue, 9 Aug 2016 11:20:18 -0600, Ken Springer wrote:

Snipped crap no one cares about


In this case, I'm starting from scratch, there's really nothing to work
with anymore.

I have done my best to advise you in this matter, without using a sledge hammer and rock drill to make my
points.

And I do appreciate the help and advice, and thank you for that. But I
think you believe I have more "pull" than I do.

You have the choice of acting as a servant or as a consultant. When one possesses confident expertise, one
can, with assuredness, advise those in positions of authority; making sure they understand what needs to be
done and specifically why. It can be very persuasive if you diplomatically convey to these people that you
are in a position to help them should they choose to do the right thing, but will bow out should they make the
wrong choice.

I am neither a servant or a consultant. That is not my role with them.

I've already mentioned some of the things we've talked about with them
in the past few months. And they realize something needs to change as
far as the infrastructure goes. But I'm not sure their "mindset" has
changed when it comes to daily ops.

But...

Maybe one fact hasn't come through... THERE IS NO MONEY!!!!!!! It
doesn't matter what the IT needs are, if you can't buy it, it doesn't
happen.

I know they've burned some bridges when it comes for asking local
entities for donations. You can only tap that avenue so many times in a
small community. I called a local newspaper about donating some ad
space for computer classes, and got my hat and head handed to me over
the phone. Obviously they were tired of being asked that question.

Giving technology ignorant people options when it comes to mission critical decisions is a fools errand,
unless you will get paid gobs of money either way. If you are donating your time and aggravation, why would
anyone allow themselves to be placed in a maze in which the walls and barriers are constantly being moved and
with the ultimate destination being a mine field?

I've not given them "we can do a, b, or c", I've said this is what you
need to do.

Since it is a social agency, the real goal is to help the "clients" who
are in need of help. That's why you have big outfits that support NPR,
PBS, etc. and other social programs.

At the same time, if you are given the money, you have an obligation to
spend it wisely, efficiently, and those procedures have to change over time.

Regardless of the size of an organization, at some point you have to
figure out how to have some type of operational funds. Grants generally
will not fund that portion of an operation. At this point, that does
not exist. My cohort is trying to find solutions to both long term and
short term funding. Grants for infrastructure like we've been
discussing are (apparently) as easy to find as hen's teeth. :-(



--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

On Wed, 10 Aug 2016 08:41:39 -0600, Ken Springer wrote:

We provide pro bono services to a number of 501(c)(3) tax exempt organizations, although we avoid religious
based organizations and abortion related organizations like the plague. Most of our commercial clients are
always looking for worthwhile organizations to whom they can donate surplus and used equipment.

If your agency has legal or accounting service providers, you might ask them for help connecting with their
other clients who might be inclined to help with equipment and vehicle donations. If you can't use what is
donated, it can always be sold to generate cold, hard cash.

You certainly do not need very much money to establish a Windows domain.

From your description, it sounds like the agency you work with is very poorly managed and as a result it is
probably very ineffective in it's core mission. Maybe your efforts would be better utilized by an
organization that is serious about their goals?

As a tax exempt charity, 40 - 50% of your organizations work output should be directed toward fund raising, at
least until such time as it's basic needs are met. They certainly cannot be effective in their mission if
they can barely keep the lights on or the water flowing from the tap. Which reminds me, local utility
companies usually have very generous philanthropy programs, one need only apply.