Archives: Service News

Security improvements don’t get a lot of attention because often they silently protect you. And in many cases we silently implement security improvements. But every once in a while, it is worth recognizing these security improvements, even if you don’t see them.

Here’s a recap of some of the recent security improvements MWS has made:

• Microsoft’s Local Administrator Password Solution (LAPS) has been implemented for Managed Workstations. This solution provides and manages a complex unique password for the built-in administrator account on each managed workstation to reduce the exposure from a single managed workstation being compromised. Many years ago, the Managed Workstation service had a compromise that affected hundreds (Coreflood). This solution would have prevented that. 
• Based on a data-driven request from the Office of Chief Information Security Officer, we recently added a firewall rule to protect managed workstations from off-campus access of Remote Desktop. Customers should first connect to the VPN before using Remote Desktop to their managed workstation. This improvement protects all UW accounts from compromise and protects your managed workstation.
• SMBv1, an insecure protocol, was disabled across all managed workstations in April, and disabled on domain controllers last month. This helps to protect interception of your data.
• Upgrades of the MWS file servers this year were prompted by a variety of vulnerabilities in their software. This also helps to protect interception of your data.
• Annually, 1-2% of managed workstations have some kind of compromise, and we’ll continue to invest in security improvements to drive that down further. But when it does happen, we’ve eliminated reimaging costs to help get you back to working on a safe computer.
  

The preliminary FY18 rates for Managed Workstation services are now available. The annual rate change for UW-IT services was postponed this year to be effective 9/1/2017. Management Accounting & Analysis (MAA) provides final approval of rates for all cost-recovery centers at the UW, and these preliminary rates are still pending their approval.

All rates associated with the Managed Workstation service are documented at: https://it.uw.edu/service/managed-workstation-services/#Price.

Rates

The new FY18 rates are:

• Managed Workstation rate: $30.00/workstation/month
• Managed Workstation file storage: $.25/GB/month
• Consulting Services: $104.43/hour
• Managed Workstation training room: $60/hour

Changes

In conjunction with these rate changes, there are some changes to the services provided. These changes include:

• Managed Workstation training room use is a separate rate, not included in the Managed Workstation rate. This change was mandated by University practices to ensure fair access and use.
• There is a single file service rate, regardless of the underlying platform used.
• Support assistance for MWS file services is now included in that rate.
• There are a few previously defined consulting activities that we will now provide as part of the Managed Workstation rate. Notable examples include:
  • 1 hour of complimentary business needs IT consulting per year per customer account
  • 1 hour of complimentary computer hardware recommendation consulting per year per customer account
  • OS imaging for compromised managed workstation

Requests for the complimentary consulting will result in an in-person visit to discuss your needs.

More details about these changes are available at https://it.uw.edu/wares/mws/design/what-does-the-managed-workstation-rate-include/.

If you have any questions or concerns, please contact Dawn Cullerton or myself via help@uw.edu with a subject line of “FY18 MWS rate questions”.

Brian Arkills
Managed Workstation service owner
UW-IT

99.9% of all managed workstations have been migrated to the NETID domain, and today we’ll be removing the 5 remaining workstations still in the Nebula2 domain. We greatly appreciate your partnership in both the user and computer migrations over the past couple years. Your patience while we completed this large undertaking has been amazing.

I’m also happy to report that new computers can be enabled for Managed Workstation services without the Nebula2 domain. https://it.uw.edu/wares/mws/hardware/adding-computer/ documents the steps needed to do that—it’s available today. In a nutshell, you now can “claim” your computer before joining it to the domain.

If you join a computer to the NETID domain without first completing that step, you’ll end up with a workstation that isn’t usable until someone on the NETID domain service team has intervened (send an email to help@uw.edu if you end up in this situation). This behavior is part of the design of the NETID domain service, and is a consequence of sharing the NETID domain with hundreds of other UW organizations. We are working on a more streamlined way to enable the workflow, leveraging the Managed Workstation imaging process. For resource constraint reasons, that work has had to wait while we focused on workstation migrations, but I’m hopeful we’ll have an even better option in the near future.

Now that the users and computers are in the NETID domain, there will be some minor planned outages over the next month to complete migration of remaining infrastructure. We’ll also start adopting the optional capabilities the NETID domain service provides, which was part of the value proposition behind undertaking this migration. An early candidate is the Local Admin Password Solution (LAPS) feature (https://it.uw.edu/wares/msinf/ous/laps/), which will reduce the risk to all Managed Workstation customers from a single computer being compromised. We’ll share more about that when we’re ready to release it.

Brian Arkills
Managed Workstation service owner

Approximately 2,428 managed workstations, or about 78%, have been migrated from the nebula2 domain to the NetID domain. We will continue to attempt to migrate every managed workstation at 5:00 pm daily.

We are still unable to offer a self-service option for workstation migrations at this time. The technical issues that may be encountered are unlikely to lead to a positive experience.

What’s Next:

Migration are still taking place at 12:00 pm (noon) and 5:00 pm Monday – Friday for any non-migrated workstation.

We encourage customers to send us a migration request via help@uw.edu with “MWS Migration” in the subject line so we can migrate your managed workstation during this period.

Monday 7/10/2017 we will begin reaching out to Technical Contacts with non-migrated workstations to facilitate the migrations.

What do you need to know?

Computers that have not scheduled a migration date by 7/31 will be removed from the nebula2 domain.

If you have any questions, please send an email to help@uw.edu with “MWS Migration” in the subject line.

Dawn Cullerton
Service Manager
Managed Workstation
UW-IT

Approximately 2200 managed workstations, or about 66%, have been migrated. Every non-migrated managed workstation has been a candidate for nightly migration and has been attempted at least 3 times. At any given point only 75% of managed workstations are manageable over the network, so customers will need to work with us for further progress to occur.

If you have questions about the workstation migration, a FAQ is available and updated regularly.

There were a number of problems over the last 3 weeks, some with our workstation migration approach, others related to unanticipated file service issues. We’re sorry for any inconveniences this may have caused. We’ve worked hard to address these issues and adjust our approach.

We’d love to provide a self-service option for workstation migration, but the technical details make it extremely unlikely to lead to a positive experience.

What’s Next:

During the Workday go-live period, June 16th – 30th, we will not initiate any mass migrations of non-migrated workstations. However, our offer to schedule noon migrations on a given date for any non-migrated workstation still stands during that period.

We encourage customers to send us a migration request via help@uw.edu with “MWS Migration” in the subject line so we can migrate your managed workstation during that period. Department contacts will get a list of non-migrated workstations in their department via an email later today.

After June 30, we’ll go back to attempting to migrate all remaining non-migrated workstations each night. Beginning the week of July 3, we will begin to contact customers with an non-migrated workstation to facilitate migration.

Unmigrated computers left in late July will largely be those which are not regularly on the UW network. Computers in this state are not a good candidate for the Managed Workstation service, as they receive very little of the regular value we provide. We’d like to better understand that choice and whether there is a better option needed, so we invite customers who find themselves in that situation to have a dialog with us. Feel free to send an email to help@uw.edu, or start a dialog on mws-discuss@uw.edu.

Managed Workstation is migrating workstations from the Nebula2 domain to the NETID domain. The impact to you is very low. Please ensure your managed workstation is on the UW network during the noted period.

What and When:

Beginning Monday, May 22nd at 5pm, and every night through Friday, June 2nd, we will attempt to automatically migrate managed workstations to the NETID domain. Any given managed workstation will be scheduled for one night during this period, as documented at https://it.uw.edu/wares/nebula/news/migration/schedule/.

Computers which are unavailable will be retried on every successive night during this period until successfully migrated.

There are two noticeable impacts of this work:

• computers that are being migrated will be rebooted, with a visible 5 minute warning message when the migration agent is ready to initiate the reboot. A second reboot will follow the first, approximately 15-45 minutes later.
• the computer’s name will change from existingname.clients.nebula2.washington.edu to existingname.clients.uw.edu

After a workstation is migrated, you will continue to log into your managed workstation with your NETID user account, and there is no other impact.

What you need to do:

Please plan to ensure your managed workstation is turned on and on the UW network on the night it is scheduled for migration. If your managed workstation is not located on the UW network, please bring it in and leave it on the network for its scheduled night.

If your managed workstation can not get on the UW network during this period, we will contact you to work out a solution, but it will require a little more effort.

If you remote desktop to your managed workstation, please adjust your practices after your computer is migrated:

1. First, connect to the VPN,
2. Then, remote desktop to your computer’s new fully qualified name (existingname.clients.uw.edu).

More info:

If you have a question about this change, please first see if your question is addressed in the frequently asked questions: https://it.uw.edu/wares/nebula/news/migration/faq/.

UW-IT has a lot of experience with this type of change, and the number of issues caused by this type of change are extremely low. However, if there are problems which result in an unusable workstation, we will treat it as an urgent issue and prioritize returning the workstation to service. You can call 221-5000 or send an email to help@uw.edu and let the UW-IT Service Center know that you are experiencing an incident with your managed workstation.

If you have a significant scheduling issue during this 2-week period, and need your managed workstation to not be migrated, please let us know and we will try to accommodate you.

A notification like the following one was sent to the primary user, last user, and department contacts for the ~380 computers with a name that included an underscore character (_).

———–

You are listed as a contact for the Managed Workstation (Nebula) department MAA.

The computers listed below all have the underscore character (“_”) in their name, which is no longer permitted in the name of Managed Workstation computers. This Wednesday, May 17, at 5pm we will be automatically renaming these computers to remove the underscore character from the computer’s name. In most cases, the process will simply remove the underscore and everything to the right of it (i.e. TK421_SW would become TK421). In some cases, we may have to change the name more significantly. The process will, unfortunately, require a reboot.

Once completed, we will send you an updated list that includes the new name for each computer. If the process fails for some reason, such as the computer being turned off, we will be following up on these on Thursday.

Where we have it, we will be notifying the primary user of each computer about this work later today.

We apologize for the short notice on this work, but we have to get it done before we can star migrating computers to the NETID domain next week. A separate notice about that work will be going out later this morning.

Please contact us immediately if you have any questions.

Managed Workstation Service E: help@uw.edu | V: 206.221.5000

Managed Workstation is migrating workstations from the Nebula2 domain to the NETID domain.

What and When:

Beginning Monday, May 22nd at 5pm, and every night through Friday June 2nd, we will attempt to automatically migrate a set of managed workstations to the NETID domain. Any given managed workstation will be scheduled for one night during this period, and we will publish the schedule next week.

There are two user impacts of this work:

-computers that are being migrated will be rebooted, with a user visible 5 minute warning message when the migration agent is ready to initiate the reboot

-the computer’s name will change from xxx.clients.nebula2.washington.edu to xxx.clients.uw.edu

Users will continue to log into their managed workstation with their NETID user.

Because all Managed Workstation customers are impacted by this work and may need to take action, we also plan to notify all users via the mws-users@uw.edu mailing list. That notification is planned for Wednesday, May 17th and will include a link to the schedule so users can take appropriate action when needed.

What you need to do:

If you are a department contact, we’d appreciate if you make sure folks in your department know to expect a notification from us via the mws-users mailing list. We don’t often use that mailing list, so there may not be strong trust associated with it. It also wouldn’t hurt for folks to hear about this planned work more than once.

Plan to ensure your managed workstation is turned on and on the UW network on the day it is scheduled for migration.

If you remote desktop to your managed workstation, adjust your practices after your computer is migrated. First, connect to the VPN, then remote desktop to your computer’s new name.

More info:

Domain migrations are a pretty standard activity, and UW-IT’s Microsoft Infrastructure service (who we are leveraging) has experience doing tens of thousands of these migrations using the same automated toolset as planned here. Failure rates are extremely low. So we do not expect significant problems, but with ~3500 computers to migrate, there will be a few which encounter problems. if there are problems which result in an unusable workstation, we will treat it as an urgent issue and prioritize returning the workstation to service. You can call 221-5000 or send an email to help@uw.edu and let the UW-IT Service Center know that you are experiencing an incident with your managed workstation.

Managed workstations, which have an underscore character (_) in their name, will need some extra preparation. Early this week, we plan to send a notification to the primary user and contacts of the 381 computers, which have an underscore, character in their name, to let them know about our plans to resolve that.

If your managed workstation cannot be migrated on the day it is scheduled, it will be for one of several reasons. We will attempt to contact customers to resolve any issues and re-attempt a later migration.

Migration scheduling is not planned to follow department boundaries. This is for several reasons, which include avoiding the potential to impact an entire department. If your department has a significant scheduling issue during this 2-week period, please let us know and we will try to accommodate you.

Dawn Cullerton

Service Manager

Managed Workstation

UW Information Technology

Phone: 206-685-3071