joeware - never stop exploring... :)

When people tell me MSFT or some other software vendor supports something why don’t you as a service provider support it I chuckle and say

"Oh really, what kind of SLA guarantee do they offer? What kind of penalty for not meeting the defined goal agreement?"

Plain and simple… Service Providers and Software Vendors have very different definitions of supported.

I live in both worlds, my real job is in one space and personally, you probably know this, but I offer software. Look around the site, you will find it all over. I even support the software, but I don’t guarantee it will do anything for you nor do I even guarantee it won’t scratch the paint on your car, for the full body of the joeware warranty statement see http://www.joeware.net/freetools/warranty.htm. Service Providers generally, usually have support contracts that specify SLAs/Os as well as penalties for not meeting those goals. If you want Service Provider type support for my software, let me know, if your pockets are deep enough we can probably make a deal.

So, when you are about to tell some professional in the Enterprise Service Provider support space "Vendor X supports Y done in a Z way, why don’t you?" you should first ask yourself…

1. What is the SLA?
2. What is the penalty for SLA failure? How much money will you get back for every 10 minutes past the SLA that something isn’t working as it was previously and should be?
3. Are they charging you for every minute they are helping in the failure or is it all part of the existing support agreement and will be until the issue is fully resolved and you are back to where you were before the failure?
4. Does the support mean they will get "SOMETHING" up and running again so you can start putting your business back together again or is it that you will have what you started with so you can start working as if nothing happened again?

1. e.g. Your AD Forest goes pear shaped, you can’t restore from backup because backups are screwed too, you build a brand new forest and now the basic product is working again but you still can’t work the way you did before the outage.

1. That fits the supported definition of most Software Vendors but generally not Service Providers.

I had heard several times that Windows 2000 won’t join a Windows Server 2012 R2 Forest, especially in Windows Server 2012 R2 Functional Mode.

I did not find this to be the case. The hardest part was finding the old Windows 2000 MSDN CD in the basement (I ISO’ed it so I can lose it on my NAS now) and getting Windows 2000 Professional to load into a Windows Server 2012 R2 Hyper-V VM. Once I got past that point it joined the Active Directory with no issues. I even used the GUI without a pre-created machine account.

And to boot… Both the current version of AdFind and the current version of AdMod both worked fine on the Windows 2000 Professional SP4 machine… PowerShell AD Cmdlets didn’t seem to work though… 😉

Do you or don’t you?

I am trying to gauge use/interest in the MSA technology so thought I would reach out and ask.

Please respond to these polls if you get a chance. If you don’t see your answer please feel free to add an answer or respond in the comments. If you visualize some specific functionality in the management space around MSAs and gMSAs please let me know in the comments or emails to support@joeware.net. I am starting to visualize a tool or tools in this space.

joe

[yop_poll id=”11″]

—-

[yop_poll id=”12″]

I have never successfully been able to stabilize an environment while someone thinks they have god given rights to have Domain Admin rights based on any number of perceptions they have about themselves and their abilities but no real feet to the fire responsibility for the Directories core functionality.

You know those people, they complain that things aren’t done fast enough or to their standards or they have some application that absolutely requires it (go get a different app then). They think that there really is nothing to being a Domain Admin and that anyone can do it or at least they could and a damn sight better than those doing it now. They may be right, they may be very very wrong. My experience has been that if they are loud or insistent about it, they are usually very very wrong.

Personally, I never want any Admin access when I walk in the door of any company I go into. I usually have to say no, take that access away… If I must have an ID, I want a normal user ID, not an admin ID. If I need something I can’t reach as a normal user (a surprisingly small list usually) I will reach out to someone who is an admin and truly responsible for the environment and ask them to help. And this is with me generally being the best, or one of the best, most knowledgeable, most informed AD people involved with that company at that or possibly any time.

I am not trying to be boisterous, I am trying to be honest about it and you will find many of your best Windows/AD guys are in the same boat. I have been doing this AD thing a very long time now (since beta of Windows 2000 and beta of VMware Workstation in the 90’s) and Window NT before it and computer programming going well back into the 80’s. I have been a Microsoft MVP for Directory Services since 2001 which says MSFT says it is worth listening to me about AD and they often do so internally. In my day jobs over the years and through conferences and people contacting me via email I have worked directly and indirectly with hundreds of companies’, governments’, and militaries’ AD’s including probably most of the Fortune 50. Generally when someone is clamoring for the admin access, I often feel they are someone who truly shouldn’t get it. When deciding if someone should have Domain Admin access I ask myself, is that person the last line of defense before calling Microsoft when everything goes pear shaped at 2:00AM?

In a previous Fortune 5 company I worked in, ok it has been long enough that I have been away now, it was Ford Motor Company, we set up a process by which someone could get Domain and Enterprise Admin rights when HIRED to be on the Enterprise Admin team (the name of the group that ran Ford’s Active Directory).

How long do you think it took for someone to get Domain Admin? A day? A week? A month? If they were good it would take at least 3-6 months. They spent that time learning the environment and how we did things there and more importantly why we did things the way we did them. We beat "be scared but not too scared to react" into them. The idea being that you may think you know it all but you can still screw up so take things slow and make sure you know what you are doing for sure from all angles first. At the end of their "internship" they would have to run the gauntlet which involved sitting in a conference room with the current Enterprise Admin Team for several hours and being questioned by them and the team manager on any and every possible thing including their favorite color if a team member so chose to ask that question. We had a list of questions but that was a minimum bar guideline.

If anyone on the team wasn’t comfy at the end of it knowing full well they were giving a gun to someone who could quite figuratively shoot all of them in the head with one stray bullet the person went back to internship for another month or two before they could run the gauntlet again. Note this wasn’t a brain pissing match or my AD junk is bigger than yours; it was about truly and completely doing what we could do to safeguard who got critical access rights that we would at some point be completely depending on some night at 2:30AM when the Domain Controllers were burning to the ground. The team was such that if something really bad happened, you could get anyone on the team and you would be in great hands.

    joe

https://winworldpc.com/library