Chapter 2 - Workstation Management
Page 4: Workstation Architecture
Workstations are computers used by people
Workstation architecture determines the experiences people have when using their workstations
Page 5: Workstation Architecture
Important issues for customers:
Locality: availability of workstation where and when needed
Reliability: workstation's stability and frequency of crashes
Productivity: ability to work with minimal obstruction
User agency: control over the workstation environment
Current-ness: lag time between new feature availability and installation on the machine
Page 6: Workstation Architecture
Workstations should be fungible resources
Limitations to achieving full fungibility:
Variations in hardware
Variations in login access
Variation in applications and software installed
Page 8: Fungibility
Storing data remotely requires network access
Network access may not always be available to laptops or workstations in remote or disaster areas
Primary elements of workstation architecture: hardware, operating system(s), network configuration, accounts and authorization system, data storage, host security, and logging
Page 9: Hardware
Workstation hardware options: laptops, desktops, mobile devices, tablets, etc.
Choice between physical workstations and virtual workstations
Consideration of company-provided workstations or bring your own device (BYOD) strategy
Page 10: Operating System
Workstation architecture can provide a single operating system or multiple ones
Different vendors and versions of Linux distributions
Microsoft and Apple have server and workstation variations of their operating systems
Standardizing on one operating system is beneficial
Page 11: Network Configuration
Workstations are connected to a network via wired or wireless technologies
Decision between hardcoded or dynamic network configuration
Network configuration parameters include IP address, subnet mask, default gateway, and DNS servers
Page 12: Network Configuration Dynamic Configuration
Dynamic configuration allows the machine to ask the network for its configuration parameters using DHCP
IPv6 has the additional option of using Neighbor Discovery (ND)
Dynamic configuration enables centralized control of network configurations
Page 13: Network Configuration Applicability
Storing a static configuration on a host makes it less generic and limited to a specific subnet
Dynamic configuration reduces the skill required to deploy or move a PC and is less error-prone
Page 14: Network Configuration Hardcoded Configuration
Configuration parameters are stored on the machine itself
Works even if the DHCP server is unavailable
Servers generally use static configurations to minimize external dependencies
Hybrid configuration combines local file-defined parameters with periodic DHCP checks
Page 15: Accounts and Authorization
Workstations need a database of usernames, passwords, groups, and related account information
Decision between storing this information locally on the machine or accessing it from a central database over the network
All machines have a local account database (e.g., /etc/passwd and /etc/group for Unix)
Page 16: Accounts and Authorization
Network directory services provide account information to all machines
Examples of network directories: Microsoft Active Directory, Apple's OpenDirectory, Red Hat Directory Server
Having account information available to all machines is important, even if the user doesn't have login permission for a specific machine
Page 17: Accounts and Authorization
Important definitions:
Identity: storing information about a user
Authentication: using information and secrets (passwords) to prove someone's identity
Authorization: determining what a user is permitted to do
Page 18: Data Storage
Workstation users need to store information or state
Three ways to configure storage: local, stateless, and diskless
Making workstations stateless contributes to their generic and fungible nature
Page 19: Data Storage
Stateless configuration options:
Remote file storage: accessing storage from a remote server as a "network disk"
Network-synced or cloud storage: local files copied to a network service (e.g., Dropbox, OneDrive, iCloud Drive)
Page 20: OS Updates
Software updates (patches) are necessary for new features, bug fixes, and security improvements
Updates can be installed manually or automatically
Considerations for workstation architecture regarding updates: centralized control, testing, user delay option, SA ability to stop updates
Page 21: Security Theft
Priority is to prevent unauthorized access if a laptop is lost or stolen
Laptop tracking software and full disk encryption are protective measures
User accounts may be disabled until passwords and security credentials are reset
Page 22: Security Malware
Malware subverts system security and can be detected using antivirus software (blacklisting) or application control software (whitelisting)
Network firewall enforces network access policies for workstations
Page 23: Security Malware
Qualities of security defense software:
Centralized control
Centralized reporting
Silent updating
Hidden from view
Negligible performance impact
Page 24: Logging
Workstation architecture needs to make workstations error observable
Logging events and making information accessible
Microsoft Windows calls it the event log
Unix/Linux systems call it the system log or syslog
Log analysis tools like Logstash and Splunk interpret log information
Page 25: Workstation Hardware Strategies
Strategies for workstation hardware:
Physical machines (laptops and desktops)
Virtual desktop infrastructure (VDI)
Bring your own device (BYOD)
Page 26: Physical Workstations
Laptop vs Desktop:
Desktops are more expandable
Laptops are more expensive and require more ruggedness
Laptops are easier to support
Vendor selection:
Minimize the number of vendors used
Multiple vendors permit price competition but increase support cost
Page 27: Physical Workstations
Product line selection:
Choose based on lowest initial cost or purchase price
Lowest total cost of ownership (TCO)
Emphasize performance
Lowest initial cost sacrifices features
Total cost of ownership refers to all costs related to the machine for its lifetime
Performance includes features required by engineering applications
Page 28: Virtual Desktop Infrastructure
VDI turns workstations into a centrally managed network service
User's applications run on a virtual machine (VM) in a VM server cluster
User interacts with the VM through a "thin client"
Benefits of VDI: reduced hardware costs, increased ease of management
Page 29: Virtual Desktop Infrastructure
Reduced costs with thin client hardware
Ease of maintenance with VM server infrastructure
Additional CPUs can be added to the VM infrastructure
Page 30: Persistent or Non-persistent VDI?
Non-persistent VDIs: created from scratch using a standard golden image, no customization
Persistent VDIs: one-to-one mapping between users and virtual desktops, customization allowed
Page 31: Non-Persistent VDI?
Advantages of non-persistent VDIs:
Easy for administrators to patch and update the image
Minimizes storage and backup requirements
Simplifies deploying company-wide applications
Improves security
Disadvantages of non-persistent VDIs:
Not all software supports use in a non-persistent VDI
Reduces personalization and application flexibility
Difficult transition for users, increases complexity
Page 32: Persistent VDI?
Advantages of persistent VDIs:
Ease customization
Easier transition for users
Support is similar to desktops
Disadvantages of persistent VDIs:
Larger storage and backup capacities required
More support overhead due to image management
Fewer security benefits
VDI thick client gives access to incompatible applications
Page 34: Bring Your Own Device
BYOD is a service model where users supply their own hardware device
Strategies:
BYOD-only strategy
BYOD mixed model strategy
BYOD-lite strategy
Page 35: Bring Your Own Device Pros and Cons
Pros of BYOD:
Benefits users' comfort and productivity
Improves productivity without full responsibility for hardware support
Cons of BYOD:
Increased support cost due to complexity
Complexity can be mitigated by adopting classes of support
Page 36: Bring Your Own Device (BYOD) Security
Mobile device management (MDM) software secures and controls BYOD devices
MDM features: deny access without approved anti-malware, end-to-end encryption, remote wipe
BYOD can be a source of data leakage
Page 37: Workstation Software Life Cycle
Installing and maintaining software on computers
Life of a machine
Page 38: Workstation Software Life Cycle
OS installation process erases existing OS and installs a new one
Installation best achieved through automation
Five states: new, clean, configured, unknown, off
Page 39: OS Configuration
After installation, subsystems and components need to be configured
Configuration techniques: Configuration Management Systems, Microsoft Group Policy Objects (GPO), DHCP Configuration, Package Installation
Page 40: Updating the System Software and Applications Workstation Software Life Cycle
Software-update systems should be general enough to deploy new applications, update existing applications, and patch the OS.
Lack of updates over time can result in security issues and other problems.
This creates more work than initially saved.
Benefits of updates include reducing variation.
User-initiated updates mean the user of the machine is required to update the system.
Automated updates with user approval are best to automate updates.
Updates need to be coordinated to avoid service interruptions.
Page 41: Rolling Out Changes . . . Carefully Workstation Software Life Cycle
An automated update system must have a process to manage the risk of causing massive damage.
Create a well-defined release candidate to be distributed to all hosts.
Roll out the change to a small group first.
Establish success criteria for an iteration.
Page 42: Disposal Workstation Software Life Cycle
Disposal of a machine involves accounting, technical, and physical tasks.
Accounting tasks include removing the machine from capital inventory and hardware maintenance contracts.
Technical tasks involve decommissioning services, transferring data, and resetting management systems.
Physical tasks include disconnecting cables and removing the machine from the rack.
Page 43: OS Installation Strategies
There are various strategies for installing an OS, from fully manual to fully automated.
Lack of automation in OS installation leads to time-consuming setup for each new machine.
Consistency is more important than perfection to avoid unexpected differences.
Manual OS and application installation result in inconsistent configurations.
Page 44: Installation Strategies OS Installation Strategies
OS and initial application installation can be done through automation, cloning, or manual methods.
Automation involves using tools like Microsoft Deployment Toolkit (MDT), KickStart, or Debconf.
Cloning involves creating a golden image of a configured machine and using it to install on other machines.
Automated image creation can mitigate disadvantages of cloning.
Hybrid cloning and automation combine minimal OS install with additional automation.
Page 46: Installation Strategies OS Installation Strategies
Manual installation and configuration of an operating system is the least preferable method.
Manual configuration leads to inconsistently configured machines.
Manual installation is done when automation is not yet created or for remote employees with limited bandwidth.
Page 47: When not to automate OS Installation Strategies
Lack of automation can be justified if there is only one host of a particular OS/hardware combination.
Cost of automation may be larger than time savings.
Vendors should make it easy to automate their OS installation procedures.
Page 48: Basic Service Definition Workstation Service Definition
Service definition starts with requirements and translates them into technical specifications.
Hardware, operating system, and accessories are deployed based on requirements.
Refresh cycles are needed to identify and replace older hardware.
Page 49: Refresh Cycles Workstation Service Definition
Hardware becomes obsolete over time, requiring replacement.
Approaches for refresh cycles include generational, hiring date, and departmental strategies.
Short-sighted approaches include foregoing upgrades, ignoring hardware standards, or buying models with low initial purchase price.
Page 50: Tiered Support Levels Workstation Service Definition
Tiered support system provides full support to specific platforms and limited support for others.
First tier machines receive full support, while second tier machines receive best-effort support.
Ad hoc support means no direct support, and forbidden machines are not permitted on the corporate network.
Page 51: Workstation Fleet Logistics
Workstation fleet logistics involves physically delivering new workstations to users.
Efficiency is achieved through economies of mass-production.
New employees receive their workstation on their first day.
Existing employees know that machines are replaced with newer models.
Page 52: What Employees Don’t See Workstation Fleet Logistics
Many processes work together to deliver the entire service.
Teams involved include purchasing, prep, delivery, platform, network, tools, project management, and program office.
Page 53: Configuration Management Database Workstation Fleet Logistics
The configuration management database (CMDB) stores information about all machines in a fleet.
CMDB stores machine information, desired state, and other details.
Page 54: Small-Scale Fleet Logistics Workstation Fleet Logistics
Small companies may not have a dedicated fleet organization.
Part-time fleet management can be done with ad hoc procedures and good notes.
Full-time fleet coordinators or two-person teams may be necessary as the company grows.
Page 55: Workstation Standardization
Standardizing workstation configurations in an organization is difficult.
Involving customers early and releasing early with iterations are key points.
Maintaining old and new systems simultaneously during a transition interval is important.
Moving in one direction and setting a cut-off date for legacy machines are recommended.