IT Legacies or IT Curse: Epilogue

IT legacies: Epilogue

So what happens when you're the guy tasked with fixing the mess someone else left behind?  In my case the best course of action was to take it one step at a time.

In the precursor to this post, IT Legacies, IT curse, I described an IT organization focused heavily on data but blind to the fundamentals of networks and Windows servers.  In the succeeding weeks since I wrote that article I found a multitude of evils compounded by daily demands that only served to highlight the tasks before me.

There was no area of IT that I didn't have to address but  for now I'll focus on what I found to be one of the most serious issues.

One of my first tasks was to straighten out the Windows domain.  Any admin worth his salt knows that the decision to use Active Directory(AD) automatically invokes the prerequisite of having a second Domain Controller (DC) somewhere in the organization.   Reason being, a second DC allows authentication tasks to be balanced across two servers and ensures you're not relying on one copy of the AD database for your entire Windows network. 

It's common sense if you understand how AD works.  In short, if your deployment doesn't merit a second DC then you don't really need AD.  It's that simple.  Think of it as a the law of AD regardless of the version of Windows Server you're running.

That said, I knew a lone domain controller in an organization of any size was asking for trouble.  Worse the one I found  was seemingly deployed as an afterthought.   On reflection, it probably was.

If you're going to run a Windows AD DC (I know a lot of acronyms) there's going to have to be a DNS server somewhere and with one DC on the network it wasn't a stretch to figure out where it would live. 

Remember that Active Directory is heavily dependent on the information contained within DNS.  If we accept that DNS functions as a kind of phonebook to allow easy lookup of the information contained within the AD database then we begin to see how critical it is for it to be functioning correctly.

Imagine my surprise when my investigation into the DNS information living on this solitary DC found that it was not being integrated into AD at all.  It's a basic configuration step requiring little more than a checkmark on a properties page of the DNS zone's configuration. 

I was mystified at this which led me to investigate why someone would choose to depend on an easily corrupted  text file to store critical information when it could be safely stored within the AD database and replicated at the same time as other AD data. 

Well ok, that's assuming there's something to replicate to.  I began to doubt my own procedures for a moment.  Perhaps there was something special going on that I just didn't understand.  Perhaps some weird 'Nix server had a problem with AD integrated DNS zones.  Perhaps the moon was in the 7th house and Jupiter was aligned with Mars...

I found nothing, so if for no other reason than to comfort my own ego I turned to Technet for validation of my own beliefs. 

In the end my convictions were vindicated.  There's nothing that precludes an AD integrated zone from interacting with other non AD DNS servers or clients.  I really do try to keep an open mind but when we stray into the ridiculous my verbalizations immediately become colorful and it's best not to be around me.

By the way, at one point there actually was another DC in the domain but it disappeared into the ether well before I arrived.  I never did figure out where it went.  Perhaps this was why the DNS zone wasn't integrated into DNS although that would solidify my belief that the previous IT team didn't know what the !&@*! they were doing. 

Considering the existing non-Ad DNS zone was still referencing a now absent DC it's apparent the removal wasn't graceful.  In fact the event log was filled with failed messages about replication.  Perhaps the DNS server complaints in the event logs caught the attention of someone on the former IT staff and their solution was to rip DNS out of AD. 

Now remember, the second DC should never have gone AWOL in the first place but if you're going to take it out at least do it right.  They didn't...

What I was left with was a server that had been searching in vain for a companion that hadn't existed for at least a year or more.  Considering this lone DC had a full office 2007 installation and two different resident user applications running that no longer served any purpose it was no wonder that this server would sit at 99% CPU load for hours on end. 

It was a DC that was treated like a workstation managed by an IT team that didn't have a clue.  It's really that simple.

The net effect were logon times that could take minutes in an organization where there would never be more than 10 simultaneous logons ever.  Logon scripts frequently failed, mapped drives disappeared and resources would remain inaccessible to users for up to 15 minutes after logon.

So, in my second week I began scrounging for parts and built a second DC out of cast off hardware.  That was the easy part.  Getting an operating system on it, however, was no easy task.  I can build Windows servers in my sleep but only if I have access to the necessary resources.  Of course with this client, I didn't.  Nobody knew where the server licenses were let alone the installation media yet I knew they had to exist because at some point there was at least one more DC. 

That led to a weeklong treasure hunt that was only partially successful but highlighted another issue with the IT organization.  I ultimately came up with a legal but kludgy solution that I won't go into here.  Suffice it to say that Peter was left the poorer for Paul's needs.

That was pretty much the order of the day during my tenure and was a necessary modus operandi if I wanted to get anything done.  As bad as it was, however, every upturned rock was an opportunity to change things for the better and in reality that was my role.  It's one thing to complain but another to do something about it. 

I was fairly well clued in on my first day when I found a backup job stuck in error status for 6 months and had to get my supervisor to call someone outside the company for the Administrator password.

By the way, that thing about the backup isn't an exaggeration.  There had literally been no data backup for almost half the server resources in 6 months.  The first request for file restoration I received took the better part of a day to satisfy and only after intense digging within old backup catalogs and a bit of luck. 

That's one thing Backup Exec is good for, endless catalogs.  At least Backup Exec's Continuous Protection server was good for something for a change because I didn't have as much as a shadow copy to work with otherwise.

Instead of going into any more lengthy diatribe on the specifics of what else was wrong with this organization, for brevity's sake I'm just going to list the issues.  See if any of them look familiar...

1. One domain controller
2. Messed up DNS configuration
3. 192.168.1.x  ( Yep, just like at your house)
4. Broken backups (Running on Backup Exec 11D - one of the buggiest versions BTW)
5. Paying  support fees for software no longer used
6. No documentation or obsolete documentation
7. Slow logons
8. Bad password policy
9. Using Domain administrative credentials to run application services
10. Outdated desktops (average 5 years old)
11. VMWare ESXi deployed in an enterprise environment
12. Lack of an enterprise management application suite
13. No redundancy...in anything
14. Backup tapes stored onsite
15. No standard workstation model
16. No accountability for outside vendors
17. Obsolete Server and Network resources
18. No or obsolete IT inventory information
19. No update policy
20. No control of IT budget (Not really that big of surprise these days but this was REALLY bad)
21. Inconsistent licensing for all IT resources
22. Reliance on outside vendors for critical IT functions (Proprietary DB systems, What' s the Admin Password?, etc)
23. No network diagram
24. Critical offsite servers that IT had no access to
25. Inadequate broadband connection (5Mbits to handle everything including 2 busy DB's and a web server)
26. New IT resources deployed without testing
27. IT projects planned and scheduled without notifying IT
28. Business phone system on its last legs (was purchased for $300 on EBay after the last one blew up...no, really)
29. Haphazard IT planning (or NO IT planning)

I know I probably forgot something but that list is pretty damning.  If you've been in the field for awhile you probably have a few of those items on your list too maybe even a few more.  Hopefully not all at the same time!

The point is that the key to fixing problems in IT is to identify them in the first place.  This particular organization was a victim of ad-hoc management.   In short, IT was repeatedly blindsided by issues that wouldn't have existed if someone was paying attention. 

You know, stuff like what the administrator passwords are and where the server room key is...

As the demands of the business were shoehorned into a dysfunctional IT methodology more and more time was spent putting out fires and less on ensuring a reliable environment.  Users eventually got used to doing less with less simply because there wasn't any alternative. 

But hey, at least the databases worked, if you could access them that is...

It's a common problem in IT but that doesn't make it acceptable.  I'm a firm believer in the KISS (Keep IT Simple Stupid) principle.  Things only get complex when you stop paying attention.  If you've got a mess, just break it down in to it's most basic parts instead of trying to do everything at once.  You're only human and the fact is, everyone's suffered this long so they can wait a bit longer for things to be done right. 

My immediate predecessor apparently couldn't embrace that philosophy as he left after only 2 days.  Admittedly it was one of the worst IT shops I'd ever walked into but nothing's impossible if you put the problem in the right context.  I was allowed to do that so when I left I felt good that I'd not only addressed the most egregious issues but laid out a framework to  build on.  That'll keep you from spending all your weekends babysitting servers and crossing your fingers Monday morning. 

I know I keep talking about "The Basics" and "Foundations."  You may be wondering what I mean by that.  Time for another list but don't worry it's a short one this time.

THE BASICS

1. Document EVERYTHING and make sure everyone knows where it is
2. Critical IT procedures need to be codified (you know, like water on a burning server is a bad idea...)
3. Keep track of your resources
4. Don't be cheap! Get what you need to get the job done consistently and reliably
5. Remember your place, IT is a service job and your users are your customers so keep them in mind in all you do
6. Don't let anything or anyone interfere with Rule 5

You wouldn't blame your car for running out of gas if you never looked at the gas gauge so why would anyone think that ignoring the basics of your IT organization would have any better result? 

A week before my departure the business hired on a full-time IT manager and I was glad my efforts were able to provide him with more than horror stories.  Having laid out the issues, current configuration and procedures put in place he had a better starting point than I did.

I spent my last few days composing a document outlining everything I'd learned about the organization as well as common procedures and recommendations for improvement.   He's got a long road ahead of him but at least he's got an idea of where he's going.

I was just glad to provide the roadmap...

IT Legacies or IT curse

Legacy, whenever the word comes up I think of characters like Don Corleone, Michael Jordan and Bill Gates.  Legacy means at some point you've left something that will endure long after you've moved on.

In IT, legacies are usually synonymous with curses and lately I've been doing a lot of cursing.  I've inherited a legacy of sorts with the start of a new contract. 

It's with an industrial electronics company with an IT history that stretches back at least as far as Novell Netware from the piles of old software I've found.

From what I've been able to gather from sources inside the company as well as former IT employees (now acting as fair weather consultants) there was a time when IT was ruled with an iron fist.  The head of the gang of six, as I now refer to them, was an unpleasant database administrator.   His rule was absolute because databases and specifically the data within them are this company's lifeblood. 

In case you haven't gotten the picture yet, he who holds the keys to the data holds the company by the short hairs.  A legacy that's persisted to the present day.  A legacy that now haunts my every billable hour.

To say that the previous IT manager abused his position would be an understatement.  The only force that could displace him and eventually the entire gang of six was when technology began to make it possible to bypass him. 

The tipping point? When someone made the decision to move a critical resource, messaging, out of his control and into the cloud.  Not that it was ever of any real concern to him but this sudden defiance of his rule was taken as a bad omen of things to come.  For him it was time to abdicate the throne.

Remember, up to that point, his rule was absolute like some tyrannical overlord.  User concerns were of no concern with unbridled shouting matches the norm if any dared question the authority of the gang of six.  By the way, the primary duty of the gang of six was to massage the data.   Everything else was secondary and it's still evident in the present day.

Not long after the overlord's departure the remaining gang members found themselves in an uncomfortable position.  Instead of tightly regimented tasks assigned by their overlord they now had to support an unpredictable user base.  A role they seemed unsuited for from the evidence I've uncovered so far.

There was even one who did nothing all day except "cleanse" the data.  Which for all intents and purposes involved little more than editing spreadsheets produced by the overlords many data mines.

Say what you want about Microsoft's Office 365 but I for one have a new found respect for anything that would get rid of that kind of IT organization. 

Shortly after the overlord exited the company in a huff due to the peasant revolt and subsequent embracing of cloud democracy other members of the gang of six soon fell away. 

Fast forward to the present day and open on me sifting through the remains of an abandoned IT department.

Surprisingly, instead of boxes or assorted refuse piled up in some kind of dilbertesque cubicle nightmare,  I find dedicated office space.  There's actual doors, desks, rooms and even a workshop with the remains of long abandoned projects still waiting for attention on the workbenches along the wall.

It's a little spooky, like someone let loose with a neutron bomb.  I keep looking for those outlined shadows on the walls that look like the photo negative of somebody's shadow.  Thankfully, I haven't found any yet.

Somebody was trying to be organized at some point but like the old saying goes, the proof is in the pudding.  I'll put it to you this way, I don't think Bill Cosby will be doing any commercials for these guys.

As I start my third week I already have bad memories.  One of the worst was working on what should have been a relatively simple project with one of the former gang of six (now a consultant).  It was a simple PC swap but the wrinkles became evident all too soon.  The now "consultant" refused to come onsite turning what should have been a day's work into three.   When things went wrong it wasn't the disembodied voice on the speakerphone that had to bear the brunt of a fuming department head.

 Unforeseen complications that should have been addressed in a lab instead of on the production floor almost cost the company thousands in lost revenue.  Quick and dirty fixes instead of solid solutions ruled the day. 

It's not that he didn't mean well but the lack of planning and laissez faire attitude toward the critical nature of this aspect of the business bothered me.  When I discussed it with the site supervisor he recognized the attitude immediately.  It was no different under the rule of the overlord.

IT is a dynamic affair and no one day is like the next but there is always ample opportunity for good planning that includes a fallback position if something goes wrong.  At this company it seems things going wrong are the order of the day. 

As I traverse the lonely halls and rows of cubicles I see evidence of the same kind of haphazard deployment and lack of planning that have crippled IT in the organization.  In short, the tyrants didn't need to burn the castle as they fled, it was already crumbling.

By now it's become obvious to me that IT people that massage databases for a living aren't always the best qualified to make decisions for an entire organization.  Some things are better left to those of us who'd rather not spend our time memorizing SQL queries and worrying about primary keys.

Let me be blunt.  I respect someone who has the ability to manage huge volumes of data and understand the intricacies of how it all relates to each other.  In the end, however, these people are power users not network or system administrators.  There's simply too much to keep track of in both disciplines for anyone to perform both functions competently.   Defy that logic and you end up with an organization like the one I'm trying to piece back together.

Shortly before I arrived the company suffered something largely unheard of in IT these days.  A rampant virus infection.  Caused by ineffective security policies, lack of management tools and outdated security software, it was an inevitable event just waiting for an opportunity.

Token gestures of security like a recently implemented mandatory password policy are good but trivial in the context of a broken IT organization. Make no mistake, this is a broken IT organization.  Its most poignant  symbol,  a four foot high pile of discarded rack servers numbering in the dozens just inside the door of the abandoned IT workshop.  With the relative dearth of IT services available it seems more like evidence of a scorched earth policy than evidence of a virtualization project. 

Truth be told many likely became unnecessary with the move to cloud services and a "sort of" consolidation of physical servers into virtual.  Ultimately, however, it seems more like evidence of retaliation than consolidation.  Ask any system admin, for example,  how many Domain controllers should exist in ANY Windows network and the answer you'll get is 2. 

We currently have one and it lives on a virtual server with no backup and no failover.  That's one of my priority projects by the way.  I'm utilizing a discarded hulk and parts scavenged from the carcasses of similarly afflicted hardware.

Questionable licensing, inadequate resources and a lack of documentation are all symptoms of an IT organization in disarray.  When the answer to "What's the admin password" requires a phone call to an outside party for the answer you know you have issues. 

In short, my job is to try to rebuild an IT organization while trying to convince a wary executive suite that I seek no term as the next IT overlord

The most significant hurdle has little to do with a new server or software, however.  Years of abuse from a bad IT organization has made every purchase and every policy change, no matter how insignificant, an exercise in bureaucracy.  A trait that has seen others (not of the gang of six) leave after only hours.

There's such distaste for the way things were that I'm relegated to cubeville, far away from those cozy IT digs.

My story is ongoing and luckily much of my remedial work can take place after hours where I'm free to curse the names of my predecessors without concern for delicate ears. 

The lesson here can be summed up in one of the first meetings I had with my site supervisor.  We were discussing how the IT organization should be structured in the future.  Remember, right now I'm the entire IT department apart from a few specialized "consultants" still massaging the data.

He thought the organization should be headed up by yet another maestro of data to which I replied, " So you're ok with the way things were?"

He replied, " Well, no, it was awful" 

Don't get me wrong, data's important and this company lives and dies by it.  Thing is, I see a future with at least two people to keep this place humming along.  One a data specialist, the other concentrating on the network and server infrastructure.  Both can offer support and with a properly running IT shop, both will have plenty of time to support the user community instead of putting out fires and making excuses.

...and both will be equals.