Rogue PC
I was looking at my asset form and I saw that I had 3 devices assigned to me, 1 laptop and 2 PCs. I only own 1 laptop and 1 PC, so what is this rogue PC? Has it been assigned to me incorrectly? Is it a security risk? Could it be on the network in my name and used by a hacker.
I logged an urgent ticket with our IT department, telling them I do not recognise the device. The device name didn’t seem correct since I could not remote onto it with the usual domain name.
The response I got back from them was:
as per above details this seems to be in working.
if this is not your systme , pelase let us know for decomissioning?
What sort of question is that? If it isn’t my computer and is someone else’s, why am I in charge of deciding whether to disable it or not? Shouldn’t we work out if one of our employees own this? Could it be that a malicious person has managed to get a PC on the network and assign it to an employee? This could be a major security threat.
Turns out it was my PC, just that the same PC had been entered twice under completely different “Computer Names”. The Head of IT saw my ticket and the response I got and intervened. Surely it should have been easy to see who was signed in. The original technician should have seen I was logged in, and told me more info about the device like the IP address, Make/Model etc so I could confirm.
Can’t Update
Recently, they made a change to remove admin access which is a problem when it comes to installing some software; but that’s their main intention. However, we often get told to update software when there are security updates, but we cannot because we aren’t admin users anymore. It’s a frustrating situation having Group IT on your back telling you to update your software but you cannot because they took admin access away. They should have made sure they can do it remotely before taking your access.
I had switched projects and needed to install some extra software as well as update the couple of Visual Studio versions I have so I logged a ticket.
Sometimes I find that you can install software and then later on realise you needed to install optional components so it was frustrating logging the ticket to do the initial install, knowing I probably need to log another ticket next week.
After speaking to other colleagues, they said they had some kind of admin access override and I needed to request that. All overrides are audited so they can see what you are doing.
I don’t understand how they can say we “can’t have admin access” then it turns out most people in the department do, but it’s inconsistently implemented.
Out of Tune with InTune
As you may have seen in my recent Post, Group IT are now beginning the rollout of InTune Hybrid-Join across our computer estate. This is to ensure we have a consistent view of the security compliance status of our computers. Connecting them all to InTune allows us to benchmark our compliance to determine what work (if any) is needed to improve it.
A week later…
Following on from the below I can confirm that your device has already been successfully Hybrid-Joined into InTune.
This is likely due to your presence at a site where the policy has pulled through from the corporate network or regular use of the VPN in your day-today.
No further action is required on your part.
Couple of days later..
Hello!
Further to the below I can confirm that your device has been successfully imported into InTune.
Apologies in advance if this is repeat information but no further action is required on your part.
Many thanks!
Couple of days later..
Hello!
Following on from the below it looks like your device still hasn’t been imported into InTune.
If you have already followed the below instruction and had it fail, please sit tight – further instructions will follow. You do not need to reply.
If you are still to action the below, please do so ASAP.
Many thanks!
It really sounds like they have no idea if you have been added to the system or not. I think I was added straight away, but I never visited an office like they claimed.
Group IT Windows Update Script
Last year, there was a major Windows Update and Group IT stated it was a big project to update all the employees in the company (around 1500), but they had a script that can run automatically if we left our laptops on out-of-hours and would run at 7pm.
So I left it on, and so no update. Next day, same thing. Next day, same thing.
They posted an update to say what a success the rollout had been so far; 200 computers have been updated. That seems really low to me (13.3% in a month). They then declared there were some known failures but they haven’t bothered looking at why they are happening but they will continue to run the script and won’t contact affected people either. Everyone has to keep leaving their laptops on at 7pm each night.
A few people said they noticed it had failed due to low disk space and I thought that is a great point. If it’s a 5GB update, then they should state people need to ensure there is free space. As it turned out, it seemed like it downloaded 5GB or so, then was copied into a different file format, then installed. So you ended up needing around 15GB, and had to clear the 10GB of files after.
CE+ certification
Quick heads up: we’re making some important changes to boost the security of our systems and get us closer to achieving CE+ certification. Starting tomorrow at 10:00am BST, we’re going to be removing some old .NET software from your computer.
These are versions that have reached end-of-life and are either critical or high vulnerabilities as reported by Nessus. If you’re using Visual Studio and encounter any issues after the removal, please follow this guide in order to repair your VS installations: https://learn.microsoft.com/en-us/visualstudio/install/repair-visual-studio?view=vs-2022
If you notice any other software reliant on .NET has stopped working, please log a ticket with the Group IT Service Desk. Thanks for your understanding and cooperation on this matter.
We have a few products that we make that rely on the older .Net Frameworks. I love how they assume our products are supported and give us 1 day notice. Surely they know exactly what they are removing, they’re so unspecific too; “some old .NET software”. Is it to do with: .NET Framework, Visual Studio, SQL Server?
On the same day, I got added to a chat where they were discussing how upgrading Docker Desktop has broken a tool used by our products. It’s the classic case of just assuming we can update/change things without asking the experts involved.
Anyway, later that day:
Our apologies for the promptness of the previous email, we have made a decision to postpone the scheduled removal of .NET. The decision comes after careful consideration and listening to your valuable feedback and concerns regarding the removal. We understand the importance of providing you with appropriate time to consider the impact this would have on the software you use. The postponement will also afford you the opportunity to inform us of any software currently utilising end-of-life .NET versions, allowing us to address and raise these concerns with Security where applicable. We will be sending out another email next week with comprehensive details on the specific .NET versions that are set to be removed. For now, I can tell you these will be SDK, ASP.NET and CORE versions of .NET and not Framework. Thank you for your understanding and cooperation on this. Should you have any immediate questions or concerns, please do not hesitate to reach out.
Wallpaper
Years ago, we were allowed to change our desktop backgrounds. Some people chose cool artwork and others left it as the default Windows. One day, Group IT decided to change it to our company logo. Many people were outraged by it but I wasn’t bothered. I suppose Matt made a good point here though:
Please can you explain the best practice behind the wallpaper? Unless you do not work all day, you have programs over the top of the wallpaper, so on the rare moment you have to look at your wallpaper: why would we need the company logo? All this is doing is reducing company morale. I would have understood if you had locked down the lock screen image.
I think a sensible rationale is when we worked in the office and could have visitors from other companies. It is more professional. Now we are at home, it is less important.
MFA Policy change – effective today
Good afternoon, as per the Group IT update at the beginning of the month, today we have implemented a planned change which sets all accounts to prompt for MFA each day when accessing Microsoft 365 services. This is in line with many other products and helps improve our overall security.
Some people will have noticed (or may notice as the day progresses) they have been forced to sign out of Outlook or Teams - and may need to restart those (or other) applications to continue.
Existing meetings do not appear to be affected - users will be asked to sign in again once their current meeting ends.
Next week:
Good morning everyone,
As you will know on Thursday we implemented a change to improve our security. Please read the following information carefully to understand what happened as a result, what has happened since, and what to do if you are adversely affected.
The change had the unforeseen side-effect of requiring people to re-authenticate at the point of implementation - between 10 and 10.30 on Thursday. This also meant there would be a requirement to repeat that processes each day at the same time.
Users of Apple Mac laptops may have found themselves signed out of Teams when this happened, even if a meeting was in progress - For Windows Teams users this should not have been the case.
Over the weekend, the policy has been reset, it was re-implemented at 6pm yesterday. We updated the policy setting, to prompt every 23 hours rather than every day.
This means that the following should now be the case:
This morning you should have been asked to re-enter your MFA token
You should not be asked to do this again for another 23 hours
Which should therefore mean - for most - the next time you should be asked to enter your M365 MFA token is when you next sign in for work.
There is an added annoyance on the company phones as it requires your 16 character MS password prior to reauthenticating using the MFA code
I'm having to password and MFA on Outlook and Teams on my company mobile separately.
Is this the way now
Signing into Teams each day appears to take a lot longer than signing into other apps. The ‘One moment…’ dialog is on my screen for around half a minute and it takes another minute or two for Teams to fully load all new messages into it.
Wondering if it’s the same for others, is it expected to take this long?
Annoyed colleague, stating how these apps aren’t even designed for repeated sign-ins
Then a week later, it was fully reverted:
A further update to the MFA policy
On Saturday, the MFA policy was updated again. The frequency with which you should be prompted has been extended to 30 days.
This means, that anyone who authenticated prior to Saturday at 6pm, should not be prompted for 30 days from that date and time.
Anyone who authenticated this morning should not be prompted for 30 days from that time.
We hope this provides an effective balance of security and functionality.
I think AzureDevops always asked us to sign in daily, but after this new change to make things more secure, it was changed to 30 days. So was actually less secure and was probably unintentionally changed as a blanket policy.
Conclusion
I think these stories illustrate a point that you need to consult with the experts and understand the impact of your changes before declaring them. Having to revert policies that obviously would have a negative impact just makes the team look foolish. You also need a good balance between people being able to do their work effectively, and keeping systems safe and secure.