1

Well just wanted to ask for some ideas of where to start. I moved to a new state and therefore left my job at a University. Where, as you can imagine, had basically everything in place, active directory, profiles, permissions, basically a structure. I got hired for a small company that in the realm of IT is a mess. It is like everyone has a person laptop that the company bought. No restrictions, only 1 user and password for every laptop, no structure or organization at all. There are so many wires going everywhere with no way of knowing what goes to what. So my plan was to re wire, and label the wires that way at least my OCD can calm down and make it easier to start with. But after that, I have no idea what to do. Never set up active directory, if it is even needed in our instance. Basically I just need help to know where to begin and steps people think would be helpful.

Thanks in advance.

3 Spice ups
2

Dont’ start with AD. Start with determining needs. Very few SMBs need AD and those that do normally have had it for a while. Why do you feel AD would be worthwhile in this case? Start there… think of this as greenfield, don’t jump in with brownfield solutions.

2 Spice ups
3

Fixing up wiring does make sense, probably safe to assume that wires are needed and need to be supportable.

4

Where to begin is planning… and a lot of it. Or even before that, with inventory. Let’s answer some questions…

  • How many users are there?
  • How do they work today?
  • How do they need to work individually?
  • How do they need to work together?
  • What is their mobility?
  • What applications and tools do they use?
  • What applications and tools do they need?
  • What works well today?
  • What works poorly today?
  • What doesn’t exist today that users want?
  • What is the value of IT potentially to the business?
  • What is the risk aversion vis a vis security of the business?
  • What is the risk aversion vis a vis data loss of the business?
  • What is the risk aversion vis a vis uptime of the business?
  • What does the business picture as IT needs?
  • What do users picture as IT needs?
  • What technologies are they used to?
2 Spice ups
5

How many users are there? Total of 10 users and 1 admin user.

How do they work today? Right now there is one password that is the same for all computers.

How do they need to work individually? The break down is that 2 users/laptops are for parts/service department, 3 are for sales, 2 are front desk/accounting 1 owner/CEO and 2 install managers.

How do they need to work together? They all work independently, mainly, but we have a share folder that has peoples documents, if they use it. The only part that everyone deals with is our ERP system that is installed on one server and everyone has the client versions installed on their machines that connect to that server with all the database and all.

What is their mobility? Unfortunately the stations are all laptops, except the 2 servers and 1 desktop in the computer room. The rest are 10 laptops that are used by only 4 of them needing to take it home or be able to make it mobile. We have cell phones but they are all personal phones so we do not monitor or do anything with their phones.

What applications and tools do they use? Mainly Office software, Adobe reader, and the ERP, Sage 100 along with internet browser. I have one user that has AutoCAD, a software that connects to program machines we sell. Those are really the only necessary programs/applications they use. But they have full control to install whatever they want to.

What applications and tools do they need? See above

What works well today? All works well from a user side.

What works poorly today? Form the admin side, its hard to deal with small problems that come up because there is no structure. A problem I am having right now, is we just got a new laptop and trying to see if we have a office key that is not in use to install on the new laptop. Problem being I have no idea which key is used on what machine. So like I said very unorganized. Also, I have little problems here and there, such as outlook issues because someone set things up themselves and didn’t do it correctly or has an error but just closes it, and expects that I know what it was. Also, the ERP system we have is constantly in use, whether or not they need to, it is always open on the clients machines, meaning any maintenance I need to do has to either wait till everyone leaves at the end of the day or I have to come in on my own time when we are closed and work on it.

What doesn’t exist today that users want? Not sure, we all here just use what we got and deal with that.

What is the value of IT potentially to the business? Well here it is more of a as need basis. I am not only the IT department, I help run the parts, service, accounting, and secretary department. basically I am a glorified secretary who did IT before coming here and so they use that to their advantage. But thats a totally different problem.

What is the risk aversion vis a vis security of the business? Right now there needs to be more security, because we deal with credit cards and client information, which is on the server. And the main security is just not knowing the wireless password to that specific network. The server probably has firewalls and some security, but I haven’t been able to really look.

What is the risk aversion vis a vis data loss of the business? We have, or are supposedly have, our server database/ shared folder backed up to a dropbox account. Anything on the users machines, which should be none, but we all know people love saving to their desktop, has no backup.

What is the risk aversion vis a vis uptime of the business? The machines need to be up when we are open, so 8-5 M-F is basically the uptime. The machines are always up, and accessible via Logmein but not many if any use that.

What does the business picture as IT needs? When something breaks, that is what they want in IT.

What do users picture as IT needs? Same as company

What technologies are they used to? Windows is what all machines run, be it server edition, or 7,8 or 10.

6

For all intents and purposes, that rules out AD right there. AD isn’t considered appropriate till you have more than ten users, even by Microsoft, and they are so adamant in that that the require it in the Windows training materials. It’s a test question. Are you allowed to use it with ten users, absolutely. Should you? Not unless you have an extremely niche use case and/or are doing it just to learn AD.

So we can start by taking AD off of the table. It’s the least of your concerns and likely does not apply.

1 Spice up
7

Wow, okay, that needs to be addressed.

2 Spice ups
8

Alright, good, cause I’m not very well versed in AD.

9

Yes, I agree there needs to be users, which there are only local users that are all set up to the same password. That is why I was thinking of AD to solve the user management so that way they can log in across the different computers with their own user id. Also, they are all working under the default domain, so not sure if I’d need to set up one for the company.

10

Any chance to get those all updated and patched? Windows 10 gets Azure AD for free, no need for a server or anything on your end. That is a nice feature that can be well worth it.

11

There is no default domain and no domain at all until you introduce AD. A workgroup is just a name, it doesn’t really do anything. But they should all match. That they are default does nothing special.

12

I wasn’t sure if making it something other than Workgroup, if that would help be able to manage or not.

13

TO make it something other than a workgroup, you have AD. AD is the alternative.

14

Ah, understood. So with no domain, or just being in workgroup, can I create users that can log on different machines using their own password? That way to get rid of the same password and local profile problem. Or in this small of a situation are local profiles what is needed?

15

Some options…- Use a workground model, you have to manually create each user on each machine and tehy maintain their own passwords. THis is pretty easy at this size and why MS recommends it. Can be done with Home licenses.

  • Move to Azure AD and Windows 10 and get password controls for free. This requires Pro desktop licenses.

  • Have everyone sign in with a consumer Windows account, this can be done with Home licenses.

  • Use a free AD system from Samba4, requires Pro desktops.

  • Use full price MS AD, requires Pro desktops.

  • Use something other than Windows for desktops :slight_smile:

1 Spice up
16

Another option is to move then to thin clients and move the logins to RDS. But that seems unlikely to make sense.

17

This right here is your game changer. Everything else you can chalk up to “it’s just not important to the business.” This one carries the potential for criminal and almost certain civil liability. You have to meet PCI compliance for this or you are in breach of your CC processing agreements which means big lawsuits that will put you out of business. Any breach because of intentionally skipping over security (like every allowing a shared password) would open the door for criminal action under negligence laws.

Because of this you have to overhaul the network for security. You don’t have to have central password control for that, but you MUST identify your users (username/passwords) that are not shared. The moment that they are shared, you have nothing between you and an epic lawsuit.

Basically here is how a court will hear this in the case of a breach…

“The owner gave out his identity and authorized everyone in the company to act with de facto power of attorney within the scope of the business on his behalf.”

That means if an employee uses the computers for theft, it’s the owner’s fault. If they commit a crime, it’s the owner’s fault. If they divulge customer data, it’s the owner’s fault. If the computers are used illegally, it’s the owner’s fault. The owner has required his staff to “act as him” as far as their identity when computing. He has given up, quite voluntarily, the protections that come with identify within the company. And is violating PCI while doing it. So it’s a really, really big deal.

1 Spice up
18

That’s not aversion, that’s “what they are doing.” It tells us nothing as to whether they are averse to losing data or really don’t care. They don’t seem to be doing a ton to protect anything, so I’m guessing that they dont really care. But maybe they care and just can’t figure out what to do.

19

We have a PCI compliance scan every month by the company we use for taking ccs and we pass each month, so not worried there. As far as aversion, it is very big deal that we do have backups of the system, but it is more of a care if something goes wrong, not a care enough to make sure it is all working correctly.

20

That means, quite literally, nothing. Some yahoo scanning your network and not catching huge security holes does zero to remove your liability for not meeting minimum requirements. Zero, nada. That’s just some guy running a scan. Sure, you might be able to sue that guy, maybe. Good luck there. He easily has a contract that protects him or a description of his scan so that you know what liability he is scanning for.

I’ve been dealing with PCI for a long time, scans are sometimes useful for finding glaring holes. They will skip right over major ones, though. I’ve had PCI people totally lie about things being locked down that were wide open because they didn’t know basic networking and didn’t even check for the issues. Who’s liable for that? The customer.

So, back to square one, you have PCI liability here and a major problem. ANd I’d find a new auditor, too.

1 Spice up