Microsoft's flawed update strategy

Let's talk about updates.  Specifically, lets talk about updates in the context of Windows 10.

When Microsoft launched Windows 10 it was supposed to be the cure-all to the Woes of Windows.  It was to be everything to everybody regardless of your chosen device.  It would be the gateway to what you wanted to do instead of the sandbox (or litter box) for the things you HAD to do.

When it works it can be all that.  Unfortunately, it really isn't.

I've listened to the pundits and Microsoft apologists for over a year now.  How they go on touting its merits while in the same breath decrying their frustrations.

Simply put, Microsoft can't be trusted with the power Windows 10 gives them.

I've had my own frustrations with it having seen my production machine blue screen for no apparent reason over a dozen times in the past year.  In the 3 years prior the same machine running Windows 7  may have done it twice.

I'm tired of constant updates churning in the background while I'm trying to do actual work.  Sick of waiting 15 minutes for a system shutdown because Windows decided it was time to do some housekeeping.

My eyes bleed at the sight of full event logs warning of failed telemetry connections.  All because I refuse to turn my daily workflow into an episode of The Truman Show.  Spybot Anti-Beacon takes care of that but the price is endless bitching.

My PC is not a lifestyle device, my data under my and nobody else's purview. I expect to control my own environment.  I have no use for Cortana.  Quite simply, I don't have the buying or search habits to make it or anything like it benefit me.  Meaning I have no reason to be so forthcoming.

Am I a troglodyte?  Hardly, I just prefer to not have Microsoft curating my search results or my computing habits for that matter.  Even if they do consider it a "Feature."

But Microsoft doesn't see it that way.

The best example is the update process.  It's common knowledge that Windows 10 has essentially taken away your ability to exercise any disposition of updates.  Even if they brick your device.

Take the recent update that disabled millions of webcams.  We've come to find out that it was all due to one lone Microsoft Engineer who took the unilateral action to remove a codec without bothering to pass it through Q&A.  ( Thurrott said that on Windows Weekly 487 BTW)

I appreciate employee empowerment and all.  It works great for the auto industry in fact most auto workers have the power to stop an entire assembly line if they see a problem.  What comes next is a structured process to address it.  

But nobody makes the ultimate call by themselves.  Unless they work for Microsoft that is.  Where one poorly executed update can be unleashed on millions of devices worldwide without as much as a peer review.

If you're using Windows 10 there's no doubt you've spent at least a few minutes observing the update process.  It's all very clandestine: even the event logs won't provide you any illumination as to what's going on.  You just sit and watch that screen, cross your fingers, and hope the update goes well as it reboots 2, 3, 5 times...

The latest atrocity?  The endless loop of death from KB3194496 that for many users will never install correctly without first manually applying an out of cycle patch ( <--that links to it BTW) 

We reap what we sow and the crop is a load of manure.  In the old days we could just simply uncheck the update once we found out it was problematic.  Today we have to beg the good graces of Microsoft to acknowledge the problem in the first place.  Meanwhile our workflows and production goes to hell while Microsoft whitewashes it's official response.

I could care less what Microsoft's "telemetry" is telling them about the severity of the issue.  If they can't get a patch right why should I trust their telemetry as an indicator of anything?

Laissez-faire may be great for Free Market policy wonks but it's got no place in a platform that 20% of the planet relies on to actually accomplish something.

The user base should demand that the next patch they release give us back control of the update process.  At this point it's obvious Microsoft can't be relied upon to do it themselves.  

Here's a proposition...

I'll meet you half way Microsoft.  Let the users curate their own patches but turn off Cortana or the Store while it's disabled.  

I think that's a fair compromise and for those invested in the Microsoft way of doing things, it would be a reminder to turn the updates back on when the inevitable storm has passed.

Cheap (as in free) desktop video capture

If you're anything like me you've found the need to capture your desktop activities more than once and the options out there tend to either be prohibitively expensive or woefully inadequate.  Being an IT guy AND an avid gamer I've been on both sides of the fence when it comes to trying to grab video from my desktop.

It's the whole desktop thing that's been a stumbling block.  That was until I figured out how to make a free video capture app, MSI Afterburner, grab my desktop and not just my game footage.

MSI Afterburner isn't just a video capture app, it's a unified suite of apps that include video card monitoring, tweaking and logging.  

Of course its video capture capabilities are geared toward gaming but a little digging found a simple solution to leverage the considerable muscle of Afterburner's video capture capabilities.  

Check out the videos below to see the secret I've unlocked....

Windows 10 on ESX with all the uglies...

I've just completed the first in what I hope to be a short series of videos in the vein of the Windows 8 videos I did a few years ago.  This one is about installing and configuring Windows 10 on an ESX 5.5 virtual host.

Come along and see what it's like with all the uglies left in!  I don't know about you but I hate tutorials that never tell me what to do when something bad happens!

Without further adieu I give you Windows 10 on ESX!

PC upgrade or replacement (nostalgia version)

The following is from my old website.  It's a little humorous in light of where technology is now and product cycles are much shorter.  Even though the article is 5 years old a lot of it is still relevant.

Enjoy a bit of geek nostalgia!

March 2008

The question of upgrade or replacement.

Could it be the software?

Often times I’ll be working on a project at a client’s site and will be asked to look at a pc that just doesn’t seem to be working as well as it used to.  In almost every case the primary complaint is poor performance with reliability issues running a close second.

When I spend some time with the afflicted “patient” I often find the performance issue has less to do with the hardware and more to do with an errant application or overdue maintenance tasks. 

In many cases the offending pc can be restored to acceptable performance by performing simple maintenance tasks such as defragmenting the hard disk, applying operating system and application updates and removing unused applications that load a portion of themselves into memory but are never used. 

Many Internet security suites are guilty of this behavior.  Perhaps you bought the security suite to protect you from spyware and virus infection but ended up getting extra pop-up blockers and search toolbars that you either didn’t need or didn’t use.  They’re installed and enabled by default and will use memory and slow performance.  This will be more evident on pc’s with less powerful processors and smaller amounts of RAM.

At this point you may be asking, “What does this have to do with upgrading or replacing my pc?”  The answer is that software issues can often appear as a hardware problem.  Often just addressing maintenance and software issues can return a pc to better than new performance.  This is especially true if there are applications present from the original pc manufacturers configuration.  This is a common practice and these applications can eat up system resources unnecessarily.

I recently had just such an issue with a brand new pc preloaded with extra applications that would never be used in a business setting.  One of these was a proprietary encryption program that the client neither wanted nor needed;  even worse, this application used 25% of the processor’s resources! 

The net effect was to make a brand new pc act like one with a serious hardware issue.  Removal of the extraneous applications greatly improved system performance.

It’s not the software…

Ok, so we’ve gone through the pc, got rid of all the extra software clutter, updated all your programs, defragmented your hard drive and tweaked settings in the operating system.  “Great! Now we’ve done all that and it’s still too slow!”

Now comes the question of whether a business pc should be upgraded or just replaced.

The criteria for making this decision should include the age of the pc and your current and future usage. 

The short answer is that if the pc is over 3 years old it’s best to replace it rather than attempt an upgrade.  The lifecycle for computer hardware is still very short and often parts availability for an older pc can be limited.  These parts can be quite expensive especially when the hardware was based on a platform that was only available for a short period of time such as INTEL 850 chipset based pc’s using the RAMBUS memory platform.  Once the industry moves on to the next hardware platform, the previous platform will be abandoned rather quickly by parts manufacturers.  

I recently had a client with an ailing 2 year old pc.  It had performed satisfactorily until recently when it began to exhibit reliability and response issues.  Finally this pc completely failed and would no longer boot.  Fortunately I was able to obtain compatible hardware to repair this pc but had this problem occurred 6 months later the outcome would have been much different.  In that case I would have advised replacement as the availability and cost of parts as well as the downtime caused by limited parts supply would have been more cost effective.  This pc was, in effect, on the cusp of the repair/replace trigger.

In a business setting it’s not uncommon to see a three to five year replacement cycle for desktop pc’s with shorter cycles for larger firms.  Most manufacturers offer one year warranties with longer terms available at an additional cost.  Rarely do these warranties extend past 3 years.  The reason for this has to do with the rate of technology change and the cost to the manufacturer maintain a service inventory on platforms that become relatively obsolete within one year’s time.  The computer industry has very thin profit margins and a business model based on having just enough inventories to process active orders.  The major players don’t want to maintain a large cache of inventory that they can’t immediately liquidate. 

Businesses know that after the warranty expires on a pc; the cost of repairing hardware issues can exceed the costs associated with replacement.  It’s more than simple hardware costs; it’s the cost of lost productivity from the end user as the problem is addressed as well as the cost of labor to deal with the hardware issue.  It’s far more cost effective to replace rather than repair or upgrade a pc in this case.

What works for a larger business doesn’t always work for a smaller one, however.  A larger business will usually have the capital to absorb the initial costs of hardware purchases over shorter periods of time.  Many times a larger business’s assets are depreciated over shorter periods of time than those of a smaller business.  Computer hardware tends to lose its value quickly and thus quickly erases any depreciation benefit past one year.  Couple this with potential costs mentioned earlier in this article and it’s easy to see the reason for the turnover.

What's different about a small business pc??

A smaller business may not have the luxury of short turnover periods and may choose to depreciate the cost of a new pc over a longer period of time.  In this case the best path is to buy as much pc as you can reasonably afford.  That means a better processor such as the Intel or AMD Dual or Quad core based processors ( Leave Single c
ore an
d Semprons out of the mix as their presence in a configuration  indicates a low-end system), at least 2GB of RAM and a Hard disk at least 250GB (preferably 500GB or more) in size. 

For newer pc’s that will eventually run Windows Vista or Windows 7 a good mid level graphics card such as the current Nvidia GTX 250 or ATI 5650 is mandatory.  While thought of as mainstream gaming cards, these cards actually handle Microsoft Vista and Windows 7'’s 3D graphics capability much more effectively than any integrated graphics options.  Vista makes use of the 3D capabilities of these cards and can offload much of the image processing duties from the system processor.  While not the only Operating system option available it’s likely that any new pc in the near future will come pre-installed with Vista and applications expecting to make use of it’s more graphics intensive interface.

The advantage of buying as much pc as you can afford is of course having a faster pc and a longer depreciation period.  What you also gain is a bit more “future proofing” allowing the possibility of upgrades in the future as your needs change.  Changing the video card, adding memory and even processor upgrades are much more likely with the higher end configurations.  Manufacturer’s higher end pc offerings often use more robust system level components that are unavailable in lower end models.  This can help extend the useful life of the pc and may be offered with a longer warranty term.  The rule of diminishing returns still applies however and eventually any upgrade potential will evaporate.  

^{For a small business that time will likely occur in the 4th or 5th} year due either to major hardware failure or requirements of a critical business application that the hardware cannot meet.

I should mention that there is such a thing as “too much of a good thing” when it comes to buying a pc for business.  Generally speaking, a well-equipped business pc should not exceed 1200.00 base price.  Extra network adapters, High End video cards, special paint jobs and the like do nothing for the business user.  On the opposite end of the spectrum a pc offered for 399.99 is likely to have insufficient RAM, a low-end processor and video system and offer disappointing overall  performance. 

As an example; I own three pc’s not counting my laptop. Two are used exclusively for my business and one is reserved for Saturday night recreation driving a virtual Ferrari ENZO around Hawaii J

The cost to build the gaming pc is within a few dollars of what it is going to cost me to replace my two production pc’s.  That’s because my business machines do not require the level of hardware of my recreational pc.  In fact the gaming pc would be overkill for anything but gaming and an inefficient use of resources.  That doesn’t mean I plan to have inferior hardware in my production rigs, quite the contrary.  My production pc’s are purpose built for the jobs I need them to perform.  Luckily those purposes don’t require the hardware expense of a dedicated gaming pc.

What about laptops?

For the most part many of the above rules apply but the time periods are much shorter.  Laptops are not designed to be long term and their design severely limits upgrade potential as well as longevity.  For business use most laptops are outmoded within 2 years with the only upgrade path available being RAM, Hard Drive and wireless adapters.  Some models do have modular video cards but these are generally reserved for the high end enthusiast market with little value for the business user.  Again, buy as much as you can afford but realize that after a few years items such as batteries, power supplies, keyboards and LCD displays will often fail.  Replacement can be costly and often more than the cost of a replacement laptop with the added frustration of poor parts availability and user downtime.

Final Word

The choice of upgrade or replacement of a business pc is governed primarily by practical factors.  Time is always a factor no matter what size the business.  Generally a pc that is over 3 years old that is no longer performing adequately for the applications installed should be replaced.  Often, the cost of upgrade will likely exceed the value of the pc and bring little or no improvement.  While many pc’s will function reliably after the 3 year mark; their viability will decrease as software places increased demands on hardware and replacement parts become scarce.

Your best option for upgrade of a brand name pc is at the point of purchase when the pc is new.  Often, hardware upgrades can be more economical when the system is initially configured than after delivery.

In troubling economic times it more important than ever to get as much as you can out of all of your business assets.  As with any purchase, the best value isn’t always the cheapest option.  I hope I’ve been of some assistance.  Feel free to contact us if you’d like assistance with this or any other IT need.

        

Are Macs invading the enterprise?

"Better watch out, better not cry Macs are gonna make your IT guy sigh..."

Set to "Santa Claus is coming to town"

Usually I ignore the daily LinkedIn updates in my inbox informing me of the goings on of people who may know people that were once in the same state as a guy I sat next to in Burger King 1o years ago.  Wow, that whole 6 degrees of separation thing must be true...

So one of those strangers in my inbox was recommending a link to a story on Business Insider talking about the increase of Macs in the workplace.  The cliff notes version goes something like; Rich professional people are really creative and like Macs more than PC's and because of it they want to use them at work. 

I've actually seen evidence of this in action at my last employer.  The entire organization was run on PC platforms but there were a few Macs floating around as well as some Mac "servers" Which were glorified 1U server chassis' running Snow Leopard.  AKA, not a server.

True to the assertion of the article, our Mac users were in the executive suites and generally didn't want to do more than get their email and browse the web.  Anything else required running terminal server sessions a la' Parallels just to edit a word document. 

I remember on my first day I got called to the office of the regional manager whose only complaint was that the terminal server session and desktop wasn't like his Mac desktop.  Great first impression I made that day.

By the time I came along the Mac users already accepted the fact that we could never be a pure Mac shop mostly because everyone else had to do lots of boring uncreative stuff that didn't work on Macs.

I've written other articles about Macs in business environment so I won't belabor the point here.   Suffice it to say that as long as Apple treats all their products  as consumer devices (even if it says "pro" on it) with no regard for business  process, there will always be resistance by IT departments.  In this case, resistance is not futile because the bottom line is that Macs don't play well with most enterprise networks and applications.

This isn't meant to be derisive it's a simple statement of fact.  Remember that the sandbox that is Apple rejects conformity.  99% of enterprise networks are running non-Apple hardware and operating systems.  They conform to the evil IBM model because they have to, there isn't a good alternative.  Linux is still somewhere around the level of Windows 98 for the desktop and Macs have to use Microsoft office because they still don't have a good productivity suite. 

If you live in a sandbox, sometimes you gotta order out...

I'm sure the Mac enthusiast is thinking, "Well, the enterprise needs to change then"  Yes, maybe it does but right now it hasn't and honestly it can't.  As long as the bulk of corporate America doesn't produce anything more creative than a suggestive photo at the Christmas party nothing will change.

Until corporate America finally decides to drop its 19th century labor model and realize that people don't have to be under your nose to be productive, nothing can change.  Journalists, consultants and others not dependent on a corporate cubicle have figured out how to excel without the chains of corporate IT conformity.

That works out fine for them but if you go to work in a cubicle decorated with pictures of places you'd rather be don't expect the revolution any time soon. 

Mac's by their very design are non-conformist.  From the ambivalence of the file system organization to its lack of support for common enterprise applications Macs are meant to accommodate the user not vice versa.  That's the way Steve Jobs wanted it so don't expect it to change.

With the advent of cloud services, Google docs and online meeting options , it's possible that someday we may not have to waste years of our lives in pointless commutes to some dreary office building.  This is where Macs can become a viable option.  To make a Mac work for business you have to get it out of the office and give it an Icloud account. 

Apple is all about creativity and connectivity.  Everything from the sandbox is meant to work with everything else with an Apple logo.  Online experiences are supposed to be ABOUT the content not the process of getting TO the content. 

Enterprise IT doesn't work that way.  Enterprise IT has to control all the channels if for no other reason than to protect its information assets.  It's not about WANTING to control everything it's about HAVING to.  IT departments don't have a choice in the matter.  If given the choice without repercussion most IT guys would let the free for all happen if for no other reason than to be hated a little less. 

But we all know the corporate network would be in flames in 20 minutes.  It's human nature to be freeform which flies in the face of any IT organization trying to secure and provide reliable resources. 

So it is, so shall it be.

Macs are to Enterprise as Smartphone  is to Blackberry. 

Similar function, different methodology. 

There's nothing wrong with using a Mac if it fits your style of work but it's very design is guided by the premise to NOT be like a PC.  That's why they never seem to fit well into enterprise IT architectures. 

I'm not anti-Apple, I just know it doesn't work well in the prevailing IT construct. 

If the world decides to throw away the construct and do it Apples way, however, then it's conceivable that Apple could become a catalyst for finally abandoning an outdated work methodology that says work only happens in an office.

Article first published as Are Macs Invading the Enterprise? on Technorati.

Why malware works

I've just returned from a late night session at one of my clients. 

It all started with an email from a user at the site informing me that another user was having issues with their PC running slowly and not allowing their email client to function.

Most of my client sites are small offices with less than 10 users so reporting issues to me is an informal process.  So while I got the report about the other user I also had a few requests from the user that sent the email.

Turns out the other user's problems were related to a rather nasty piece of malware (TDS4 rootkit) that did all those nasty things that rootkits tend to do. 

It was polymorphic so it evaded the virus scanner...
It denied access to task manager and loaded the CPU to 100% with constant attempts
to download more malware...
And finally it tried to open random nefarious web pages.

I've been dealing with this kind of issue a lot lately but usually it's the XP 2012 Fake AV that fools users into installing the malware then digs itself in, destroys the user profile and in some cases downloads more malware allowing the infected pc to become part of a torrent serving botnet.

I had just cleaned up both the reporting user and the other user's pc 3 weeks before.  They knew what happened and why.  They were given admonition against trusting anything they didn't already use on a regular basis and shown what it was that caused the problem I had to fix.

So I got the obligatory nodding of the head and promise that they'd be more vigilant because after all security is everyone's responsibility right?

Well, I guess I should just accept that it's just my responsibility.  You think I'd learn after almost 20 years...

The sad fact is that users can care less about the damage a malicious trojan or entrenched rootkit can do to their PC.  After all, that's what you're there for and they expect you'll fix it before they're back from lunch.  The next killer app that promises endless coupons or installs a cute dancing cow on their desktop will quickly nullify every attempt to counter such social engineering.  It's not unlike a speeding driver who when caught blames the car for his actions because it goes too fast.

Not the best analogy, I know...

So the battle for social engineering is lost.  It must be because we've been droning on about responsible use of computers for decades now and our advice is still largely ignored or at least quickly forgotten. 

So now we have to take preemptive action.  That usually involves the installation of a layered protection system consisting of not just Anti-Virus but also anti-malware software to save the user from themselves. 

At my client sites I currently use Sophos for Anti-Virus and Malwarebytes for malware protection. I find it a good combination of security software that keep a small footprint and don't fight with each other when doing their jobs.  This part is important.  Avoid bloated packages that get in the way of workflow and perform only marginally.

I'm not afraid to say openly that I find Most Symantec and McAfee products to be absolutely useless when it comes to malware and rootkits.  Worse, if the consumer versions end up in a business setting. They become almost completely ineffective and are sure to cause user complaints as these lumbering giants steal system resources and get in the way of every mouse click needlessly. 

The KISS principle is very relevant here.  Stick with products that do the one thing they do well and don't try to be anything else.  I used to recommend AVAST! until it contracted the Symantec bloat disease and became an ineffective security solution. 

If you find yourself at an infected user's PC searching the Internet for another software package to do what you thought you had already paid for it's a good indicator that it's time for a change.  Sounds obvious but it's surprising how much an IT department will put up with just because they have a history with one vendor.

In some cases a user will figure out how to shut off the security software if they feel it's too intrusive.  Try to avoid that scenario if possible.  Unfortunately if your clients are still using Windows XP and have legacy software then you'll have a hard time keeping them out of the settings since there are still far too many applications that require administrator privileges.  Since an Administrator account trumps all else, any pc with user running as local administrators is at risk.  Expect some type of security issue at some point in this case.

In spite of all your efforts to deploy the perfect security suite, you're bound to get complaints from users that they can't get their favorite site to work anymore. What they don't tell you is that it's the same site that almost destroyed their PC on their last visit. They'll scowl and complain regardless of the evidence or they'll claim the security software interferes with their work. 

Unless their work is collecting coupons or evaluating dancing cow version 2.3.2 I can honestly care less.  I'm not draconian, I just don't want to bankrupt my client fixing the same problem over and over again.  It's boring and hurts your credibility in the long run.

This is where communication comes in.  You have to let your clients (the ones who sign your check) know what's going on and why you're doing it.  Explain to them the implications to their business and stress the costs involved including: lost productivity, lost data and of course the cost of having you waste more time fixing the same problem.

The only way to fight entrenched bad habits is irrefutable evidence that it's costing your client/business money.  Nobody in their right mind is going to argue your logic especially if they sign your checks