IT Department refuses to use windows servers

[sideh]

I just wanted to get some opinions from people on this.

I work at a branch office of a medium-sized business where we have about 150 odd desktops. All winxp pro. The IT manager has banned the use of windows servers entirely due to "security concerns".

So here I am having to manage 150 odd machines without being able to push out applications (manual installs for everything), no group policies at all, no WSUS for updates, nothing like epolicy orchestrator etc etc etc.

Has anyone ever come across an IT department like this? It's really starting to do my head in.

[PEO]

sounds to me like he dosen't know how to setup server, or he is just plain incompitent.

most software has its fairshare of problems and always will do.

Have you spoken to the network managers line manager?

[kmount]

That's a stupid rationale and I'm a linux advocate!

[sideh]

Have you spoken to the network managers line manager?

Yeah, although it wasn't much help. Now it's being taken up by someone more senior than me who can hopefully resolve this. And if it doesn't get resolved soon I'll have to start looking for another job.

And I totaly agree. Every OS has it's problems. I use the best tool for the job. If I need a simple file server, linux+samba. If I need to manage 150 staff machines, win+AD domain. If I need a webserver, bsd+apache. etc etc

[Michael]

Has anyone ever come across an IT department like this? It's really starting to do my head in.

No I can't say I have to be honest. If it's going to be an internal facing server to simply manage workstations, deploy applications/updates and manage users then you should be using Windows Server. Using something else is really going to push up your workload, especially doing everything manually. Absolutely ridiculous and counter productive. If security is an issue, properly managed hardware firewalls is the way forward.

If you were hosting a website then I would recommend a second server hosting Linux/Unix with Apache, MySQL etc. Public facing Windows Servers still require more security updates, and this can mean more downtime.

[Arcath]

Sounds to me like hes read one over biased linux fan site. I am a big linux user at home, but you cant use it by itself to manage windows PCs anywhere aswell adn easyily as windows server can.

If he has security issues then tell him to put a proper firewall machine in and tell the staff not to use "password" as a password

[t_h]

I'd try to find out in detail what these "security concerns" are and then take it from there. It really doesn't make sense when you have 150 XP boxes anyway to exclude Windows Server.

[localzuk]

Oh dear. Managing Windows machines from Linux is not easy - but it can be done.

If you can't get anywhere with your boss, there are a few things you can do to improve your life:

1. Set up a software repository on your linux server (ie. stick all your msi files and the like in there).
2. Use Auto-It scripts to install things from those locations.
3. Use scripts again to deploy different packages to different people/different machines

Can't really help on much else - but the above should cut some trouble out of the mix.

You may wish to point out that without proper group policies, security on your windows xp clients can be seen as very weak, and as such a lot more insecure than running a windows server.

But as others have said, I doubt security is his fear.

[sideh]

Oh dear. Managing Windows machines from Linux is not easy - but it can be done.

If you can't get anywhere with your boss, there are a few things you can do to improve your life:

1. Set up a software repository on your linux server (ie. stick all your msi files and the like in there).
2. Use Auto-It scripts to install things from those locations.
3. Use scripts again to deploy different packages to different people/different machines

Can't really help on much else - but the above should cut some trouble out of the mix.

You may wish to point out that without proper group policies, security on your windows xp clients can be seen as very weak, and as such a lot more insecure than running a windows server.

But as others have said, I doubt security is his fear.

Cheers for the info. I'll have a look at Auto-it.

I've already partially done 1. I'm using wpkg to get newly imaged machines up and running. I use nlite to get xp installed then wpkg installs office 2003/pdfcreator/firefox/flash and a bunch of other stuff. Even some settings. However, I'm not even supposed to be using this hence I can't keep machines updated. I have to remove the wpkg client before I give someone a machine. I was told to use ghost console instead...

Thanks for all your input btw.

[localzuk]

Cheers for the info. I'll have a look at Auto-it.

I've already partially done 1. I'm using wpkg to get newly imaged machines up and running. I use nlite to get xp installed then wpkg installs office 2003/pdfcreator/firefox/flash and a bunch of other stuff. Even some settings. However, I'm not even supposed to be using this hence I can't keep machines updated. I have to remove the wpkg client before I give someone a machine. I was told to use ghost console instead...

Thanks for all your input btw.

If you use the newer Ghost versions (solution suite), you can do application management in that too. Though it isn't as easy as deploying an MSI.

Another thing to note is that Samba 4, which is currently in alpha, will have more AD related features - including GPO's IIRC. However, the development process for this has been slower than a slug moving up a hill covered in oil...

[MattMitchell]

It's not really such an issue these days, windows has come a long way from NT now, and certainly central management and deployment is much easier using windows servers IMO. Linux has a lot of great benefits as a platform but managing a few hundred windows clients is not one of them.

[CyberNerd]

Oh dear. Managing Windows machines from Linux is not easy - but it can be done.

If you can't get anywhere with your boss, there are a few things you can do to improve your life:

1. Set up a software repository on your linux server (ie. stick all your msi files and the like in there).
2. Use Auto-It scripts to install things from those locations.
3. Use scripts again to deploy different packages to different people/different machines

Also consider that Group Policy is essentially just a bunch of registry settings. If you check the adm files you can easily see which registry key is being set. With the samba server you can specify logon scripts and can set the keys.

Also consider that if you have unskilled and untrained people managing the servers then they will be inherently insecure . If the staff are comfortable with their non-windows servers it may end up being a cheaper and more secure option if you can afford to re-skill them.

[somabc]

You could use samba as a Domain Controller. You wouldn't want to though either you use XP and Windows Server or just use Linux full stop. Taking his argument to its logical conclusion nobody should be using windows on the desktop due to 'security concerns'.

Using 150 XP machines in workgroup mode is more insecure than adding a windows server.

[budgester]

So how about recommending Novell with Zenworks then.

150 desktops doing what ?

For instance a call centre with 150 use could all feasibly use linux thin clients.

Or is it a budget thing, he can't get the budget for the multitude of windows servers that is required.

Like Windows servers have more security issues than the 150 XP desktops.

At least the server would be managed by competent people i.e. sysadmins.

Whereas the XP machines are in the hands of who knows what skill level of users.

[Tallwood_6]

Have to aggree many large organistaions use SUSE Open Enterprise Server with groupwise and Zenworks which will do everything a windows server setup will do and more.