Summary of Responses to Desktop Standardisation Question
There were 23 responses to the question. Every response indicated that they locked student PCs tightly. Some responses said that they allowed students to write to specific parts of the local hard disk. This was usually because some applications required it. For staff, there were a number of different arrangements. Some responses indicated that they either had or intended to lock down staff PCs to reduce support costs but one indicated that they had opened up staff PCs to reduce support costs. All those who had made changes to reduce support costs had noticed such a reduction.
There were three broad types of response about staff PCs: those who had totally locked down every PC, those who let staff have full access to the PCs they use and, the largest group where some staff had restricted administrative access to the PC they use. Within this group there were variations such as granting “administrative rights” or equivalent to staff in certain circumstances or allowing staff to have unlimited access to the local hard disk”.
The numbers within each category are as follows. Those who are actively locking down staff PCs are counted in the “Fully Restricted” category. Where a standard PC configuration is provided but departments can chose to modify it using local IT staff, it is counted in the “Some Restrictions” category
No Restrictions / Some Restrictions / Fully Restricted5 / 12 / 6
Most of those who responded recognised that there could be cost savings associated with restricting administrative rights to staff PCs. One respondent quoted a 30% reduction in Help Desk calls since introducing a complete lock down of staff PCs. On the other hand another respondent had found a reduction in Help desk calls by granting administrative rights to staff. Despite this most accepted that some staff need to have high levels of access to the PC they use. The main reason given was so that such staff can install software by themselves. No respondents said they provided staff with 2 PCs – one for day to day work and the other for research presumably because of the cost and perhaps the amount of desk space occupied. However, several respondents mentioned the use of VMWare to provide a virtual PC on which staff could install any software they chose.
Within the “Some Restrictions” category there were variations in what was provided.
Standard Image but Local IT Staff Can Have Admin Rights / Standard Images With Different Levels of Admin Rights and Support / Standard Image but Any Staff Can HaveAdmin Rights
5 / 2 / 5
Those respondents who provide a standard image but grant local IT staff in departments administrative rights over the PCs in their department (column 1 above) said they either provides no support at all to PCs that had been altered or re-imaged the PC back to the standard desktop before providing any support. Those respondents who provided a standard image but allowed any staff to have administrative rights if they asked (column 3 above) also said that support was only provided to standard desktops. Two of the respondents in this group said that staff must make a case for having administrative rights to their PCs before they are granted. Two respondents said they provided a range of “levels of PC” by which is meant anything from a completely locked down PC to one that the user has full access to. One person from this group said they provided either Managed PCs which were locked down or Flexible PCs which were the same as Managed PCs but staff with such PCs could install their own software. Only managed PCs were supported. Flexible PCs with problems were rebuilt to their original state. The other respondent said they provided 5 levels of PC ranging from completely locked down to PCs that are not connected to the network. Those staff who chose a level that allows them to load their own software must show that they have the technical knowledge to support it and get signatures authorising it.
Many respondents said that there were big cost savings to be had by locking down PCs such that staff could not make changes. However, it was also recognised by many that some staff had to have the ability to make such changes – Computer Science and Engineering were two disciplines that were mentioned several times.
Many of those who had some form of restriction whether it was a total lock down or a lock down that people could opt out of said that most people liked the arrangements once they were used to it. However, several respondents said that it was difficult to integrate mobile devices such as PDAs with PCs where the person did not have administrative rights.
Respondents were also asked about laptop arrangements. The results are summarised in the following table.
Standard Laptop Image With Admin Rights / Standard Laptop Image Without Admin Rights / No Standard Laptop Image / Did Not Say or Not Started Yet1 / 8 / 5 / 9
Where laptops were supplied with administrative rights, the staff member could ask to have such rights so the figure shown above (1) is really the configuration as supplied initially. Once it is issued it may be changed. Once again, the problem of attaching mobile devices such as PDAs was seen as a problem if administrative rights were not granted.
Several respondents recognised the problem of supporting laptops which might be connected to the University network today and an ISP network tomorrow. In some cases different images were supplied on the laptop depending on what type of network it would be connected to. There was also concern expressed about the danger of laptops which are infected by viruses being connected to the University network.
Colin Bruce
28th October 2005
Appendix – text of original questions
From: Universities and Colleges Information Systems Association (UCISA) [mailto: On Behalf Of Paul Dimmer
Sent: 26 September 2005 14:14
To:
Subject: [UCISA-DIRECTORS] Desktop Standardisation
Colleagues,
I would appreciate any feedback on the following matter. We would like to impose greater standardisation of the PC desktop configuration for staff at Coventry University. There are obvious benefits to this, the main one being lower support costs. However, there are drawbacks to this as well and some staff say it will prevent them working. There are bound to be exceptions of course but for most PCs we would like to remove the ability to write to the local hard disk apart from some temporary space and withdraw administrative rights to the PC so that the registry cannot be updated and other system changes are prevented.
1. Have you considered this approach for any categories of staff?
If yes - was the decision to apply restrictions, and if so, what restrictions and to what category of staff?
If not - why was it rejected?
2. If restrictions are applied: is it proving to be successful?
what are the main problems encountered?
do you have any figures for changes in support requirements?
3. If there are no restrictions: how are support problems dealt with?
4. Have you adopted any alternative method which reduces support costs but allows staff greater freedom on their PC?
5. Finally, what approach do you have for laptop standardisation?
A summary will be sent back to the list. Thanks for your help.
Regards,
Paul Dimmer
------
Dr P R Dimmer
Director of Computing Services
Coventry University
e-mail:
tel. : 024 7688 8262
fax : 024 7688 8919
------