OT: Inhibiting persistent changes to a workstation

I think that would be harder to set up and maintain.

I figure there is (must be?) a market for the sort of "sandbox the session" products. Even "sandbox the system!" (witness DeepFreeze). And, I would imagine those tools would try real hard to be turnkey -- accommodating the sorts of *expected* changes in a typical environment (e.g., autoupdates, new apps installation) without too many headaches (else folks will complain that the tool just *adds* to their maintenance headaches).

Reply to
Don Y
Loading thread data ...

This sounds like someone just didn't set the system up properly. (though I am making a mental note: "Printers" as I am sure they haven't yet realized that they will want a shared printer set up as part of this site! :< )

As Chico (Freddy P) would say, "Ees not my yob, man!" ;)

Given the typical longevity of most MS machines, I imagine will be called on to replace the machines with OS_du_jour a couple of years, hence. Amazing that 2-3GHz machines are deemed "slow" and hard to imagine what folks will think of them when there ware

6-8GHz boxes available (MS-tax)

In this particular case, I doubt all machines will ever be in use simultaneously. So, a simple matter to busy-out a "defective" machine until ("Remember ? This is a song about ") opts to get it fixed (HW or SW) or *trashed*.

IME, the reason most folks use "public" (or, in this case, "not personal/private") machines is for a good Internet connection. But, they have to balance the inconvenience of getting *to* that location against the higher bandwidth available (vs. their home connection, etc.)

Reply to
Don Y

My understanding was that this was folded *into* W7. So, if it "worked well", then I would be encouraged to just rely on whatever has found its way into their standard product.

Thanks, I'll chase these down. At the very least, may help me avoid things like the "printer problem"

[I am hoping there isn't some *additional* requirement, there, like *metering* printer usage, etc. (sigh) Simple problems aren't.]
Reply to
Don Y

With my business hat on, I wonder if it would be cheaper to just replace the HDD every year and replace the whole computer every 3 years rather than have a maintenance contract. If they're $800 computers and it costs $250 each to replace the HDD with fresh installs (when done 8 at a time), that's $43/month per computer.

Best regards, Spehro Pefhany

--
"it's the network..."                          "The Journey is the reward" 
speff@interlog.com             Info for manufacturers: http://www.trexon.com 
Embedded software/hardware/analog  Info for designers:  http://www.speff.com
Reply to
Spehro Pefhany

If it moves, it breaks.

I have several customers who currently subscribe to pre-emptive hard disk replacements, all of which were inspired by previous hard disk failures. I charge about $150 to $200 for an easy pre-emptive hard disk replacement. That includes $75 to $125 for a replacement drive. Subtract some credit for the old drive, as I use those for my equipment. It's quite easy to image a working drive to a new working drive. For laptops, I generally try to convince the customer that a SSD (solid state disk) upgrade is a good idea. It really depends on the computer. Anything 2-4 years old is a good candidate. Older than that, I run into SATA 1 interfaces, which makes it a marginal proposition.

The difficult part is selecting a suitable replacement drive. HD reliability is quite variable and appears to be almost random. I try to buy 5 year warranty drives on the assumption that they will be more reliable. However, recent experiences with Western Dismal Black drives and their 5 year warranty have proven otherwise. Most failed at about 1 year. To add insult to injury, the warranty replacement drives from Western Dismal arrived with only 1 year left on their warranty. Others are even shorter. Lesser drives (WD green/blue) were replace with even shorter remaining times. Both WD and Seagate have reduced some of their warranties to 1 year, which suggests a problem. Caveat emptor.

I've had much better luck loading workstations with a generic installation, and putting the data, and sometimes the programs, on a file server or NAS (network attached storage) box. If the workstation dies, it's easily replaced with another machine since there's no user data saved on the local HD. Portable software has also been a big help: It's rather slow and marginal with a USB 2.0 flash drive, but quite usable with USB 3.0. Of course, the flash drive has to be backed up.

Full disclosure: I'm really sloppy with my own hardware collection. Mostly, I use cheap older computers, usually with known problems. I rely on image backups to minimize the impact of the inevitable disaster. Convincing customers to do the same has proven futile, thus the pre-emptive HD replacements.

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
Santa Cruz CA 95060 http://802.11junk.com 
Skype: JeffLiebermann     AE6KS    831-336-2558
Reply to
Jeff Liebermann

Sorta. MS took a nicely integrated product, and found that it wouldn't run on Windoze 7 (even though it runs on Vista). Instead, we're expected to cobble together something using the group policy editor: Creating a Steady State by Using Microsoft Technologies My guess(tm) is that MS has a product in development to replace SteadyState.

There are other minor problems. Some programs insist on scribbling temp files and junk in some rather obscure directories. Games and video players like to change screen resolution. If a virus leaks through and is caught by a virus scanner, I've run into deadlock conditions where the kiosk software tries to prevent the virus scanner from removing anything from a protected directory.

Metering, print logging, and billing are best handled by an independent print server and spooler, similar to the ones used at Kinko's. Yeah, I know. Yet another PC to manage. I threw together a print logging system long ago using SNMP and shell scripts but I wouldn't recommend it. Maybe this:

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
Santa Cruz CA 95060 http://802.11junk.com 
Skype: JeffLiebermann     AE6KS    831-336-2558
Reply to
Jeff Liebermann

That's how big business looks at things.

And, is a reason why you can get enterprise class servers for "salvage costs" :>

(my days of "buying new" are LONG past! :> )

Reply to
Don Y

Dunno. I don't deal with any of these things on my own workstations so have no first-hand experience. Seems like bandaids to fix things that were missing in the original system design. E.g., run off R/O media!

I think there are folks (in my case) "nearby" so if someone starts abusing a printer (e.g., printing thousands of pages) there will be someone to *recognize* the individual in question and take action to stop the problem as well as preventing them from using the resources in the future.

If these folks want to make a *business* out of this, then they should *invest* appropriately (and not count on pro bono services to support them).

We'll see. I'll drop by Monday to see exactly what they have (in terms of hardware, facilities, etc.) and the human resources that they can devote to this.

Reply to
Don Y

Correct.

Tim

--
Deep Friar: a very philosophical monk. 
Website: http://seventransistorlabs.com
Reply to
Tim Williams

I would like to see a hardware solution because no software is bug free. And because you think you are save, you are more careless and then you maybe are more unsafe than without the software solution. Would be happy to pay the extra money for a "secure system disk".

A "secure hard disk" is a disk which installs with only half of it's physical size. In normal mode this first half can be use like a normal disk. In save mode, read is done from the first half (even heads) but writes goes to the second half (odd heads). If a sector is written in the second half, further reads of this sector are done from the second half instead of the first half (until the next power up, which resets the tag RAM). This way a virus never could infect the system disk (but only data disks, which isn't a big problem), everything it does is gone after then next power up.

The only additional hardware needed within the disk would be a tag ram (128 Mbyte for a 1000 Gbyte disk) and a connector for an external button to enter "normal mode" when pressed during power on. Anything else would just be a firmware modification.

From the PC hardware/software side the disk works like any normal hard disk. You can use it for the swap file, write to the registry and anything else. There is no way to find out from the PC side, that there is a "secure hard disk" attached instead of a normal disk. But after a new power on, any changes are lost and the disk is reset to it's frozen state. This happens only with a power on and not a reset, because Windows must be able to restart without loosing the modifications done to the hard disk. And if you need to make persistent changes, disconnect from the net, power on the PC with the hard disk in normal mode, make your changes (new software, Windows update, ...) and then restart the system in secure mode.

The only penalty of such a secure hard disk is, that you only get half of the size for your money. But I'm sure most of the PC users wouldn't care to have only a 500 Gbyte system disk instead of 1000 Gbyte disk when in the return they get an absolutely save system which no virus or trojan can infect. And there is also a big advantage for the disk manufacturer, because then there are always two disks in a PC, the secure system disk and an additional data disk.

Reply to
Herbert Kleebauer

Preemptive disk replacement seems a little dumb. IME, once they get past the front end of the bathtub, they'll last longer than whatever they're installed in (particularly laptops). I also question the wisdom of doing *anything* to a 4YO laptop. I'd preemptively replace it! ;-) That's about where all of mine have died. I buy a 3YR service plan on mine. If anything happens to the laptop after that, I just buy another.

In the meantime, backup, backup, backup. AND *test* the backups periodically.

Except, as you just pointed out, emptor can't caveat. It's purely a guess. This is why I certainly wouldn't preemptively replace disk drives that were otherwise working just fine.

...and if you take the laptop where it can't be connected? I don't like that plan at all. Laptops are intended to be portable. NAS isn't.

Why? Hide the backups from them. I thought that's what all corporations (large enough to have IT) did.

Reply to
krw

So, even the "hardware solution" could contain no software? Even if parts of it were *designed* using "non-bug free" software *tools*?

[EXPECT software to contain bugs and it *will* contain bugs!]

You should be able to do this as a stand-alone box that sits *between* a disk and its controller. That should allow you to test if the idea really *can* work. (because such a disk would not want to

*rely* on a particular OS being in use)

How do you handle the disk cache that is invariably present in the OS?

Reply to
Don Y

I presume you have already ruled out the possibility of using a windows terminal server and just having the "workstations" as thin clients?

How about making Windows live CDs:

I haven't used these much myself, except for Bart many years ago (in order to run a specific malware removal tool). It may be possible to run these from a read-only disk partition rather than a DVD.

Reply to
David Brown

Yes. I think that puts the server in the "critical path" -- it goes down and they lose everything. I think these people will be more capable of dealing with the concept of a standalone Windows machine that "erases" all changes that are made to it each time a session ends.

I used BartPE a few years back. But, mainly as a recovery tool. I'm afraid of anything out-of-the-ordinary breaking some silly assumption that Windows or Office et al. makes.

I'll have a better feel tomorrow of the "technical capabilities" these folks have available. E.g., just asking for a *model* number of the machines I'll be using was a challenge, for them.

(sigh) Oh for the days when only the "elite" could enter the Temple of the Machine (and bask in its air-conditioned glory!)

Reply to
Don Y

Not really. I only do it every 2-3 years or so. As long as there aren't any complications (i.e. Advanced Format 4K sectors), it's quick easy, fairly cheap, and in my never humble opinion, a good idea. I've only had to resort to putting the original disk drive back once, in order to deal with infant mortality issues. Since then, I do a bit of a burn in on the new drive, to see if it's suitable.

Good theory, but that's not what seems to be happening. I've seen one infant mortality, several dead on arrivals, but most begin to show problems just after the 3 year or 5 year warranty period. Oddly, it doesn't seem to matter whether the drive is heavily used, or sitting in the box, which suggests construction or deterioration problems. Also, the best way to kill a drive is to power-save every few minutes as in many laptop. I don't know if it's the thermal cycling or the head parking mechanism that kills laptop drives.

I have about 5 assorted laptops. The most recent is 7 years old. I purchased all my desktops about 6 years ago. Typically, I get about 8 years out of my machines and out of those I maintain for customers. I consider one or two pre-emptive HD replacements (also known as upgrades) during this time as normal.

A better question to ask is the wisdom of short cycle laptop replacement, which suggests that the device is little better than a throw away product.

I have some issues with the value of extended warranties and service contracts. The only ones that have worked well for the customer are the 3yr or 5yr hard disk warranties.

Incidentally, I have an SCO Xenix 3.2v4 machine in my office that refuses to die. The hard disk is a Conner Peripherals 1GB CFP1060S which has been running continuously since 1990. The machine has blown a power supply and a video card over this period, but the HD survives. The secret to long life is that it is always turned on. Unfortunately, you can't do that to a laptop because the head (and possibly overcharging) will kill the Li-Ion battery.

Yep. Nobody does backups until AFTER they have lost data. I have one customer that does data-only backups to a flash drive, run Memeo to an NAS box, and does image backups to a USB HD at about 3 month intervals. This level of paranoia was inspired by one of my mistakes. I purchased a backup program, that ran the backup from Windoze. That was convenient but proved to be a bad idea as it produced corrupted backups. When the hard disk failed suddenly, I was stuck with restoring the contents from a scrambled mess and earlier backups. I worked on it continuously for 2 weeks, and consider myself lucky not to have been sued by the customer.

Correct, and that's why I mentioned it. It's not as risky as it seems. I can always reinstall the original drive if the new drive proves defective in some way. However, lacking a better alternative for extending the useful life of the laptop, I find that taking the risk is necessary. A short disk drive burnin has identified some potential losers.

Incidentally, I've been running HDD Tune 2.55 (free) to check for surprises. I just ran it on my desktop, which looks good. Note the scattered collection of yellow dots for the seek time test. The tighter the grouping of the dots, the less slop in the actuator mechanism. If the dots are all over the graph area, it's going to fail very soon. Of course, looking at the S.M.A.R.T. numbers also helps.

That's not NAS. Those are applications that live on a flash drive and can be run on any computah.

Backups are hidden because they contain proprietary and sensitive data. Many years ago, I was involved in investigating at security leak, which turned out to have been perpetrated by someone borrowing the backup tapes, restoring them to a drive array, and returning the tapes before anyone noticed. When I locked horns with the backup software vendor, he declared that encryption was not possible because it would ruin their error recovery feature.

However, that's not what I was talking about. I said that I can't convince customer to make backups. Those that can afford my exorbitant rates are also too busy to be bothered with time consuming distractions like backing up. In many cases, I do the backups, usually at odd hours. Others don't care and assume that no matter what happens to the computer or its data, I will somehow be able to magically recover everything. The few that do proper backups have either an IT staff to do it, or have had a major disaster. My ability to sell customers on the idea of doing regular backups has been dismal. Also, I'm no shining example of conscientious backing up. Most of my machines get image backed up around the first of the month. If I trash a machine near the end of the month, I loose one months of data. Also, please don't say cloud storage or online backups. I make good money recovering from their disasters.

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
Santa Cruz CA 95060 http://802.11junk.com 
Skype: JeffLiebermann     AE6KS    831-336-2558
Reply to
Jeff Liebermann

Wow, I've been *blessed*, by comparison! I've had two laptop drives die and one "Zune drive" (I don't really consider those "drives" even though they are :< ). Both laptop drives I believe died simply from spinning up and down, up and down, up and down (you get the picture?) from 24/7/365 use.

The Zune may have died from being dropped -- or, just a crappy drive to begin with!

Reply to
Don Y

The numbers aren't in your favor. Once you get past the first couple of hundred hours they last many years.

That's my experience. In fact, you're the only one I've heard of that does this. That was the case years ago but time moves on.

Nope. I don't want anything around that long. I have a couple of old ones at work because I need the ports or XP, or something, but four years is about the end of the line.

That's a fact of life. Sorry.

Disagree again. I wouldn't have them on a desktop because the parts are readily available. Laptops, not so much. Service charges from the manufacturer are astronomical. Extended service contracts are cheap. I've used them on about half of my laptops. After, I just junk the thing.

Desktops are a completely different animal. Hard disks are quite different than they were 20 years ago. Stiction is a thing of the past (they no longer park on the surface).

Lenovo's backup works lawlessly. My only complaint is that a backup made on my previous laptop was not readable on this one. Since the old laptop was dead it was a little more work to get everything off the disk and I lost some stuff.

You can't reinstall the changes made since the replacement. No thanks.

I guess I don't understand the point.

If you can't trust IT then all is lost anyway. It seems even the NSA and CIA have this problem.

I take it that you *are* their IT. In that case, it should be done for them automatically, off hours. That was my point. It's not something that the user should be responsible for. It's a management issue.

Reply to
krw

Most of these are dead, dying, or untested. The pile is now about 3 times as big, but about 1/3 of the used drives are quite usable. I clean them off and test them as time permits. I would post a current photo of the pile, but it's currently buried behind a pile of machines that I don't want to move yet.

It's easy to identify a drive that has a problem. Not so easy to identify a drive that will NOT have any problems.

Start-stop (power save) is a great way to kill a drive. It was a feature probably added by machine manufacturers to help reduce product life and inspire sales of replacement machines.

Apple iPods, with rotating memory didn't do any better than Zune. Lesson learned and solid state memory arrived to save the product.

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
Santa Cruz CA 95060 http://802.11junk.com 
Skype: JeffLiebermann     AE6KS    831-336-2558
Reply to
Jeff Liebermann

I've volunteered at a few places where we see (literally) thousands of machines donated each year. The number of machines that come in with "dead" drives is astonishingly few. Esp when you consider there was *some* reason the donor opted to "discard" the machine.

Well, thinking only about power consumption (conservation), spinning a disk down *does* save power -- *if* it's going to *stay* spun down! So, in a laptop, etc. it's a viable way to extend battery life.

Problem comes when you use such a drive in an app that won't let the drive "idle".

I have several (disk-based) iPods that I've had no problems with (so far). The Zune came to me "failing" so I have no idea what sort of life it had before...

Reply to
Don Y

Most probably have Win problems or malware that the user couldn't deal with (or couldn't be bothered). Hardware is so cheap, these days, that, for most, it's not worth messing with.

Agreed but as you point out the system has to have some intelligence. I tend not to allow the disk to spin down unless the system is idle for some time.

Reply to
krw

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.