Skip to content

Entra ID device join

The UW Windows Infrastructure has limited who can join devices to our enterprise Entra ID . This capability is more broadly possible with the release of Windows 10.

 

What and When:

The UWWI service is following the decision/guidance of the Entra ID governance team, put into place by the UW Enterprise Architecture program. Many thanks to the sage advice of that team.

 

Entra ID device join has been put into a limited, exploratory stage. It changed from the default setting where anyone with a user account in our enterprise Entra ID (currently anyone with a UW NetID) could join any capable device, to a very small group.

 

What You Need to Do:

No action is required. If you Entra ID joined one of the 50 devices already Entra ID joined, we’ll be contacting you to ensure you know the implications, our guidance, and that you have the option of disconnecting from Entra ID. See https://cloudpuzzles.net/2015/03/disconnecting-a-windows-10-device-from-azure-ad/ for a walkthrough of disconnecting.

 

More Info:

This notice will be sent to techsupport@uw.edu on the existing Windows 10 thread.

 

Our enterprise Entra ID is uwnetid.onmicrosoft.com, but has domains such as uw.edu, u.washington.edu, and washington.edu associated with it. So when a user enters a username of <uwnetid>@uw.edu in the Entra ID device join experience, they end up in our enterprise Entra ID.

 

The Entra ID device join capability has:

-no delegated administration

-requires InTune licensing or another MDM product to realize the same device management value as AD join

-the ability to centrally do a partial device wipe

-the ability to join mobile devices which are incapable of AD join

 

While there are some new and exciting capabilities here, we believe this represents an immature offering for our environment, so are limiting its availability at this time. We will continue to explore this capability, reviewing it for positive steps in maturity and utility for the UW.

 

NOTE: This capability is different from Workplace Join (which we don’t currently support), and also separate from the Entra ID Conditional Access capability which can use AD joined devices as part of access control decisions.

 

If you’d like to read more about the Entra ID Device Join capability, we recommend the following:

-http://blogs.technet.com/b/in_the_cloud/archive/2015/05/28/managing-azure-active-directory-joined-devices-with-microsoft-intune.aspx

-http://blogs.technet.com/b/ad/archive/2015/05/28/azure-ad-join-on-windows-10-devices.aspx

 

If you have reason to partner with us to explore this capability, please contact UWWI via help@uw.edu.

 

Brian Arkills

UW Windows Infrastructure Service Manager

 

 

1st Nebula billing cycle for FY16

We are approaching the 1st FY16 monthly billing cycle for Nebula. This is an informational update so you have a chance to update information feeding that billing cycle. We are also providing an update on our plans related to removing Nebula resources that are not claimed (paid for).

 

What and When:

Earlier today, Nebula processed all the eligibility groups for departments for the first time, re-assigning users based on the membership of your eligibility group.

 

This was the bulk user “purge” we asked everyone to patiently wait for—thanks for waiting, it saved us a lot of time and kept our costs down. For many reasons, we didn’t actually purge any users—we simply just marked users who no one claimed for their department for later action (more about that below). If you review your users in MyIT, you will see that it reflects your eligibility groups.

 

Nebula will submit billing charges for July 2015 at the end of the month.

 

You can review your expected charges for Nebula file services and Nebula desktops via MyIT. What is represented in MyIT is based on 3 things:

  1. Which desktops are assigned to your department
  2. Which users are in your department’s eligibility group, which by extension determines which Nebula home directories are associated with your department
  3. Which shared file service paths or Windows file service paths are assigned to your department

 

You can expect that what you see in MyIT is what we’ll submit billing charges for.

 

With respect to our plans for Nebula resources who have no one willing to pay for them, here are our intentions:

  • We will remove access to the home directories of users who are no longer in an eligibility group. All Nebula home directories have a snapshot with a 1 year retention beyond deletion, so even if something is undesired now but you later need access, this is a fallback. We plan to delay deletion of undesired home directories for a month to provide a grace period for mistakes.
  • We will remove access to shared file service paths which have no department assigned. Prior to doing so, we plan to contact all users who have access to the file service path to let them know of the impending action, so there is an opportunity for a department to step forward and pay to continue. Again, we plan to delay deletion for a month to provide a grace period.

 

There are other Nebula configuration we will take action on in the future. Future actions we’ll take include removing “unclaimed” user accounts (and by extension access) on the shared file services, removing access to Nebula VPN services, and removing the “Nebula supported” flag which the UW-IT service desk uses in routing requests.

 

What you need to do:

The mechanisms we’ve created over the last 4 months and may not be as accurate as everyone would like. Since there will be billing charges based on these soon as well as the additional actions I mentioned, it would be best to fix up any inaccuracies now.

 

If you are a contact for a Nebula department, here are the specific things you should do to review:

  • Go to MyIT and review the ‘Users in My Department’ report: https://support.nebula.washington.edu/myIT/myNebulaUsers.aspx. This should only include the users in your eligibility group. If there are missing or additional users, you need to update your eligibility group. NOTE: if you visited MyIT this morning, you are very likely to see a different set of users listed now because we processed the eligibility groups for the first time today. We plan to process eligibility groups once daily, so if you do make changes, you should expect MyIT to reflect those changes the following day.
  • Go to MyIT and review the ‘File Services’ report: https://support.nebula.washington.edu/myIT/fileServices.aspx. This should only include those group directories and home directories for your department (i.e. that you will pay for). If there are missing or additional paths, then send a request to help@uw.edu to resolve the file service assignments. If the amount of usage for a given file service path is unexpectedly large, you may want to take action to reduce the use to reduce your cost. If there are home directories you do not want, you can adjust your eligibility group membership. If you do not want to remove a user from your eligibility group, but also don’t want that user to have a Nebula home directory, we have a solution for that, but at this time you’ll need to send a request to help@uw.edu for that solution.

 

We are aware of a number of eligibility groups which have no members, and have separately already contacted departments where this is the case. You may need to take action if you were contacted about that.

 

We are aware of several shared file service paths which have no department assigned to them because our initial assignment was requested to be removed. As noted above, we plan to contact the users with access to these locations. You may need to take action if you are contacted about that in the future.

 

More info:

If you are wondering what a Nebula eligibility group is—see http://www.washington.edu/itconnect/wares/nebula/tools/view-and-manage-nebula-resources/#What.

 

If you are having problems getting your eligibility group to have the right set of users, we can provide a list of which users were associated with your department prior to today.

 

That document includes a variety of assistance for departmental contacts who use MyIT to review their Nebula use. We are happy to help you if you need further assistance or explanation—just send us a request at help@uw.edu.

2015 July

Here’s our semi-annual newsletter update on recent happenings with the UW Windows Infrastructure.

 

==== New Capabilities and Improvements ====

 

* Self-service SPNs for Application UW NetIDs. This allows an application UW NetID to set its own SPN values, just as a gMSA can, and like an OU admin can for a computer object. See https://wiki.cac.washington.edu/display/UWWI/Delegated+Service+Principal+Name+values for more details.

 

* Domain based DFS replication is now supported. This allows replication of file content across non-clustered Windows file servers. See https://wiki.cac.washington.edu/x/obv5Aw for more info.

 

* Active Directory snapshots. We now take a daily snapshot of Active Directory and retain the last 7 days. This provides an additional recovery option on top of Active Directory Recycle Bin, and daily backups of the domain controllers. This solution gives us a better recovery option for some scenarios. When an object is recovered from the recycle bin, not all attributes are recoverable, so we can augment object recovery with snapshot data. We also had an experience several years ago where a domain controller had some corruption in its local AD instance and we had to manually remove it to prevent further damage. If we had another similar experience, but corruption on a subset of all objects was replicated to other DCs, an AD snapshot would help us recover without taking the entire AD offline for an authoritative restore from backup (which would also mean some AD data loss).

 

* Monitoring improvements. We’ve made a broad investment in collecting and reporting performance data from our systems into a visual data platform called Graphite provided by the emerging Monitoring service. This platform is not restricted, so you can access that data, and might want to do so to answer questions you might be shy to ask us like “were the domain controllers really busy just now?” or “is there a problem right now with group sync?” or other questions where additional visibility on operational performance would be useful. Here’s a list of relevant UWWI performance graphs:

-ADFS Stats and Performance: https://graphs.s.uw.edu/dashboard/#services.uwwi.netid.adfs

-Group Sync Stats: https://graphs.s.uw.edu/dashboard/#GroupSync

-DC Performance including LDAP response: https://graphs.s.uw.edu/dashboard/#UWWI-DCs

-Kiwi Stats: https://graphs.s.uw.edu/dashboard/#services.uwwi.netid.kiwi

-Simple Binds: https://graphs.s.uw.edu/dashboard/#simpleBinds

 

Note that you can adjust the time period of data displayed, which can help to show interesting trends. For example, if you view the simple bind graph with the right time period, you can see the drastic effects of our efforts in the next item …

 

* Simple Bind abatement. We’ve created a reporting infrastructure that allows us to identify customers who have misconfigured their systems or application. We’ve also done the work of contacting relevant customers and reduced 99% of all simple binds. We are exploring blocking some misconfigured applications on shared systems who are difficult to identify, as well as notification to UW NetIDs whose password has been exposed.

 

====Spotlights====

 

* UWWI service staffing availability has been down over the past 6 months—this is because other UW-IT services have had higher priority work and staffing shortages. You may notice a smaller amount of new capabilities in this 6 month period, which is partially attributable to this smaller investment. We’re in the process of trying to hire someone who can backfill this staffing gap.

 

* Internal improvements. We’ve deployed a new HyperV cluster, refactored our internal documentation, and made changes to support changes to two services we depend on.

 

* We are in the midst of deploying a new security capability from Microsoft called Advanced Threat Analytics. This leverages machine learning capabilities to evaluate activity on domain controllers to identify anomalous events. This tool was acquired from a company called Aorato, and is capable of identifying pass the hash attacks and persistent “hidden” compromises of highly privileged accounts.

 

* We are also in the midst of deploying an AD-integrated certificate authority (AD Certificate Services). This is a result of exploration work we’ve mentioned in previous newsletters and will enable automatic certificate enrollment for computers in delegated OUs to support specific use cases like web servers for UW only audiences. This new infrastructure will be required to support new “Next Generation Credential” capabilities coming with Windows 10 like Windows Passport.

 

* A new governance team for Azure Active Directory has been created. This team is exploring the diverse capabilities provided by Entra ID, and guiding our direction in terms of which capabilities and configurations we enable.

 

==== Trends ====

 

* Since January, UWWI has: +9 delegated OUs (103 total), -3 trusts (53 total), +~1000 computers (10635 total), +50k users (754k total), -19k groups (108k total).

* UWWI support requests have returned to saner levels. 241 UWWI support records resolved since the last newsletter (vs. 347 in prior period and 188 in the period before that).

 

You can see metrics about UWWI at http://www.netid.washington.edu/dirinfo/stats.

 

==== What’s Next ====

 

Our objectives for the 6 months ahead include:

* Continue deployment of an AD-integrated Certificate Authority to enable a variety of multi-factor scenarios and easy internal website certificate renewal.

* Continue deployment of Advanced Threat Analytics to provide pass the hash and insight into anomalous threats

* Continue Entra ID governance team investment, with possible new objectives generated from that

* Deploy some Azure Rights Management infrastructure to support RMS pilot exploration

* ADMT 3.2 upgrade

* UW firewall GPO template to provide customers with a simple way to leverage Windows Firewall

* Explore privileged user risk mitigation–we’re interested in Microsoft’s “Just In Time” admin capability

* Explore requiring LDAP signing

* Explore providing authentication use restrictions for privileged user accounts in NETID domain

* Preferred Name (assuming this work moves forward as part of the HR/P project and has investment from other services)

* Partner with Nebula to support new Software Deployment Service via SCCM deployment in NETID (assumes depleted Nebula resourcing levels are resolved)

* Support growing Nebula migration efforts into the NETID domain

* Support Authentication service in exploring Multi-factor Authentication solutions for Windows (assumes project is launched)

* Support emerging Monitoring Service by sharing Windows expertise

 

Of the 14 forecasted objectives we listed in the last UWWI News, here’s a review on how they turned out:

  • 5 were successfully completed: Simple Bind, internal doc refactor, AD snapshots, HyperV upgrade, 3y MS tech roadmap
  • 5 were started and continue: AD-integrated CA, ATA, ADMT upgrade, SCCM exploration
  • 1 was started by dependent service, but hasn’t yet reached the point where we can start: Preferred Name

 

Note: Last summer UWWI conducted a customer survey, http://ontheroa.uservoice.com/forums/258239-uwwi. Given our current reduced staffing level, we haven’t pursued a refreshed customer survey this year, but I believe we will get some new customer input via the Entra ID governance team, and will generate a new survey when staffing permits. We will continue to use your input from that survey plus the AAD governance team to guide our investment priorities, limited by dependent service investment decisions. In some cases, lack of investment for long periods of time by dependent services may mean we choose to deploy a tactical solution instead of a strategic solution.

 

==== Your Feedback ====

 

Supporting your needs for UWWI capabilities offered via the Basic Services Bundle is our priority, so we welcome feedback on how we can make the UWWI service more valuable to you.

 

The UWWI service has a backlog or roadmap visible to customers at https://wiki.cac.washington.edu/display/UWWI/UWWI+Roadmap where you can see more details about current and some future work items.

 

You can voice your support for future objectives to help us rank priorities by voting customer surveys when we have them, ask for things that aren’t yet on our radar, or simply contact us via help@uw.edu.

 

Brian Arkills

UW-IT, UWWI Service Manager

 

 

Nebula billable time infrastructure changes and the demise of ‘Budget Approvers’

Changes to the underlying billable time infrastructure Nebula uses to support Nebula consulting charges have occurred. This email outlines some of the consequences for Nebula customers.

 

What and When:

UW-IT began retiring the help request tool called RT a year ago, replacing it with a new system called UW Connect. Up until June 30, 2015, Nebula used RT to report billable time for consulting. On July 1, 2015, UW-IT discontinued the billable time capability of RT and replaced it with a similar capability in UW Connect. The new billable time capability in UW Connect does not work exactly the same as the old billable time capability in RT. The most notable difference is that there is no “budget approver” functionality. This was a functionality that allowed someone previously designated as a “budget approver” for a given budget to be alerted to new billable time records by automatically adding them to the email interactions.

 

What you need to do:

There is no action you must take, this announcement is informational only. You might choose to implement workarounds to meet any lost value due to this change.

 

More info:

Nebula billable time results from consulting charges when a request isn’t covered by the core Nebula desktop rate and we bill for the time spent to bring such a request to resolution. When this is the case, we ask for a valid budget and notify the customer that the request will result in additional charges.

 

For billable time, you should see the same level of detail in the monthly TSE bills that are generated.

 

The billing mechanism is owned by UW-IT Business and Finance. The decision to not provide an authorization/notification mechanism was made by UW-IT Business and Finance due to the lack of a central authority for all UW budgets for billable activities, as well as technical constraints in customizing the new help request system. Nebula’s previous authorization/notification capability was unique among UW-IT billable charges and required a highly customized tool to support it.

 

I recognize that this change represents less functionality, and many customers relied on the notification mechanism to have a higher degree of confidence about charges being incurred or to intercept requests for which your department has special procedures. UW-IT will definitely work with customers on charges that are not appropriate or excessive. If you’d like for us to track specific kinds of requests for your department and redirect those kinds of requests for help to you, please do let us know about those–we do track that kind of information already and are happy to expand this. Another workaround you might consider is to ask your users to copy you on their email to help@uw.edu–you would then be part of the interaction if we need to ask for a budget.

 

On a positive note, this change means Nebula support staff are no longer using two different help request systems to track your requests. Using both for a year has been a strain on us.

Temporary eligibility groups for departments which haven’t provided one

Back on 5/7, Nebula first asked that every department provide an eligibility group to update our records so we can accurately grant access and bill only for your current users. Many departments haven’t yet been able to provide an eligibility group. This has blocked our ability to purge old users, even for those departments that have provided an eligibility group. So Nebula is taking action on some department’s behalf to enable the service to move forward by creating temporary eligibility groups.

 

What and When:

This week we’ll be creating a temporary eligibility group for those Nebula departments which haven’t provided one to us yet. Initial membership for this temporary eligibility group will be based on our existing user department data at the point the group is created.

 

What you need to do:

When your department is ready to provide and assume management of an eligibility group of your Nebula users, we can rename and assign administration of the temporary eligibility group to you. Until that point, the membership and management of that temporary eligibility group will be frozen. Just send in a request when you are ready to do that.

 

Alternatively, you can also supply your own eligibility group and override the temporary eligibility group we’ve created. In that case, our temporary eligibility group will go away. If you’d like to provide your own eligibility group for your department, contacts for Nebula departments should visit https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx to supply that information. http://www.washington.edu/itconnect/wares/nebula/tools/view-and-manage-nebula-resources/#changeeligibility steps you through the process, if you need additional help.

 

If you are in the process of creating and populating your eligibility group, you’ll know we’ve created a temporary one if you see the field populated when you visit https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx. Feel free to override the value if that’s the case. J

 

More info:

Creating these temporary eligibility groups will allow Nebula to move forward on purging a large set of old users. This purge won’t be as complete as it could be with department provided eligibility groups from every department, but it will meet the service needs.

 

MyIT budget release

A MyIT release which permits adding budget information for group directories and default budgets for users and desktops is now available.

 

What and When:

As of this morning, MyIT includes new capabilities to set budget information along with some other updates. The changes include:

  • On the “IT Things I Own/Manage -> Nebula File Services” page, aka https://support.nebula.washington.edu/myIT/fileServices.aspx, there is now the ability to set budget on a per file directory basis.
  • On each individual department page accessible from the “IT Things I Own/Manage -> Nebula Departments” page, aka https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx, there is now the ability to set a default user budget and a default desktop budget. The default user budget applies to any user in your department who doesn’t otherwise have a budget assigned—this would apply to a user home directory. The default desktop budget applies to any desktop in your department that doesn’t otherwise have a budget assigned.
  • On the “IT Things I Own/Manage -> Nebula Users in My Department” page, aka https://support.nebula.washington.edu/myIT/myNebulaUsers.aspx, there is now a column indicating whether the user is a current faculty/staff.

 

What you need to do:

You can now review the budget information assigned to group directories, home directories, and desktops and adjust them as needed. For group directories and home directories, there is no existing budget so you will need to assign a budget to those items. Keep in mind that for home directories you can leverage the default user budget to assign a budget to all user home directories in your department.

 

More info:

Nebula is providing drop-in visit times to help customers navigate what they need to do. The drop-in visit times are listed here:

http://www.washington.edu/itconnect/wares/nebula/news/

More times will be added as necessary.

 

A general page that provides more detailed assistance on how to View and Manage Your Nebula Resources is at http://www.washington.edu/itconnect/wares/nebula/tools/view-and-manage-nebula-resources/.

MyIT release includes estimated FY16 costs

A MyIT release which includes estimated monthly FY16 costs is now available.

 

What and When:

As of Wednesday, MyIT includes new information on the “IT Things I Own/Manage -> Nebula Departments” page, aka https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx. Department contacts will see 4 new columns on that page for each department representing estimated FY16 costs for desktops, group directories, home directories, and a total FY16 monthly cost. The total is side-by-side with the current monthly cost allowing for easy comparison.

 

NOTE: estimated are based on preliminary FY16 rates for the Nebula Managed Desktop service and are subject to Management Accounting & Analysis (MAA) review and approval.

 

What you need to do:

You can review your estimated costs and if necessary take actions to reduce your usage to reduce your future costs.

 

NOTE: Estimated home directory costs are the least accurate component. This number includes users associated with your department which are long gone. Those “old” home directories will be purged in the future after you give us an eligibility group. In the coming weeks, we plan to purge “old” home directories in bulk across all Nebula departments, removing any Nebula account not in those eligibility groups. So take this into account when reviewing the home directory estimated cost. Except for urgent user removals, we ask that you not ask us to delete “old” home directories at this time—it’ll save us all a lot of time and costs to defer that to a one-time purge. J

 

More info:

Getting us that eligibility group is important. If you need help getting a Groups Service home group under “uw”, e.g. “uw_pottery”, for your eligibility group, we can help streamline that process. Send us a request and we’ll facilitate the request fulfillment process with the Groups Service team for you. We’d like to purge your old home directories. Help enable us to do that. J

 

NOTE: the eligibility group is intended to represent any of your users which need access to Nebula resources. This would include people in your department but might also need to include accounts that are not people, such as a Shared UW NetID. If the user needs access to one of the following, then it should be included: Nebula VPN, Nebula home directory, Nebula group directory, Nebula desktop.

 

A future MyIT release will provide the ability to input budget information for Nebula file service costs.

 

In the future, after the future MyIT release just mentioned, Nebula plans to call department contacts that haven’t provided an eligibility group and budget info for Nebula file service costs, to help make sure we have that information to enable continued service.

 

Our existing assignment of group directories has some inflexibility in its design. We are working on a more flexible design. We don’t believe this affects a lot of customers, but it is important to us because it is important to some of you. We hope to have a solution to this before we bill at the end of July. If we don’t, we’ll provide a workaround which will minimize the impact to customers.

 

Preliminary FY16 rates

Preliminary FY16 rates for the Nebula Managed Desktop service are available.

 

What and When:

As of late yesterday, preliminary FY16 rates for the Nebula Managed Desktop service were submitted to Management Accounting & Analysis (MAA). MAA provides final review and approval of rates for all cost-recovery centers at the UW.

 

We believe these rates will be approved, but they are not final until MAA approval. We will notify you only if these preliminary rates are not approved.

 

The preliminary rates are:

  • Nebula desktop rate: $34.50/desktop/month
  • Nebula file storage: $.25/GB/month

 

The other Nebula rates (Consulting, Nebula Windows file service, and Nebula training room for non-Nebula customers) are unchanged.

 

What you need to do:

If you haven’t provided an eligibility group for your department (and very few of you have), you really need to do that. Contacts for Nebula departments should visit https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx to supply that information. This will tell us who your active users are. If you need help with this, please contact us for help.

 

More info:

Our desire is that no one manage user removals manually by contacting us with a long list of users to remove, unless there is an urgent need to disable access. If there is no urgent need, then you should use the new process we are establishing. That new process is that you give us an eligibility group. In bulk across all Nebula departments, we remove any Nebula account not in those eligibility groups.

 

We plan to make those removals before FY16 starts, and there should be more communication about that.

 

We plan to have an update to MyIT next week which provides you estimated costs for FY16 based on existing use. There will be more communication about that.

Update to MyIT portal published–please verify department contact and provide active users for your department

The MyIT portal has been updated.

 

What and When:

This morning, several changes to the MyIT portal were published.

 

The changes included are:

  • Nebula Departments page – new. You’ll find this under the left-nav bar, under ‘IT Things I Own/Manage’.
  • Department Detail page – new. You’ll find this under the left-nav bar, under ‘IT Things I Own/Manage’, under ‘Nebula Departments’, when you click on a department listed.
  • Group Sync Info page – new. You’ll find this under the left-nav bar
  • ‘Export to csv’ capability sprinkled across more pages.

 

What you need to do:

We have a variety of things we are asking those that consider themselves a contact for a Nebula department to do.

 

  1. Help us get the Nebula contacts in order. Go to https://support.nebula.washington.edu/myIT/myNebulaDepartments.aspx and review what departments are listed. Our contact information is in a sad state of affairs, and we need your help to get it updated. There is more info below which may be useful.
  2. Provide a list of active eligible Nebula users for your department. These are users that your department is willing to pay for the associated costs, and for which you would like their access to Nebula resources to continue. Create a group in the Groups Service (https://groups.uw.edu) which has all of these users as members. Then add it to your department via the myDepartmentDetail page noted above (e.g. https://support.nebula.washington.edu/myIT/myDepartmentDetail.aspx?department=pottery if your department was pottery).

 

We’ll be sending a separate email to anyone currently listed as a contact, to ensure that all who might need to hear about this get the message.

 

More info:

 

General Questions/issues you may have

  • “I don’t know why you think I’m a contact for a Nebula department, please remove me.” We’d ask you to provide a better contact, if you are able. Maybe your manager knows? If not, you can remove yourself or ask us to.
  • “Our department hasn’t had that name for several years, can you rename it?” Absolutely. Just send us a request via help@uw.edu.
  • “We’ve had reorganizations and this Nebula department is now spread across several department you don’t know about.” We can help with that. Just send us a request via help@uw.edu.

 

Department Contact Info

The state of the Nebula department contact information is not good. We worked hard at populating some best-guess contacts for Nebula departments which had none recorded–relying on service team experience and some data analysis, but I am certain that much of our contact information is faulty. Having valid information about the contacts for your department is important so we can provide you the services you need. We really appreciate your time helping us help you. J

 

Here’s a reference for choosing which individual fills the following roles for your Nebula department:

  • Billing contact: this is the person who gets bills for this department. They may need to access MyIT for billing data.
  • Owner contact: this is the person who makes decisions for this department. They may need to access MyIT for a variety of data.
  • Tech contact: this is the person who provides local IT support for this department. They may need to access MyIT for IT management data.
  • Tech contact alternate: this is a backup for the tech contact.

 

Department User Info

Similarly, the state of our information about Nebula department users is not good. But don’t take my word for it—see https://support.nebula.washington.edu/myIT/myNebulaUsers.aspx, which lists all the users we think are “active” for your department. I think you’ll agree that we need some help getting that cleaned up. That’s why we’re asking you to provide and maintain a group of users associated with your Nebula department that are eligible for Nebula services. We’ll use what you provide to clean up, and looking ahead to FY16 only charge your department for the users who you tell us are active and eligible. In the future, you’ll maintain that group to remove Nebula services for that user at the time you choose or to add additional users.

 

We suggest that the group name (the group id) end with _nebula_eligibleusers, e.g. uw_pottery_nebula_eligibleusers might be all the Nebula eligible users from the pottery department. If you need help using the Groups Service, help@uw.edu can assist, or you can read the documentation noted at https://groups.uw.edu.

 

One tip to consider with regard to maintaining that group: if all your eligible users should be employees, you can use a dependency group of “uw_employee”. If you do this, when a member of your group drops out of the uw_employee group, they will automatically be removed from membership in your group. The uw_employee group is automatically maintained based on university data around employment, with members removed at the 2nd pay period after their termination date.

Nebula Managed Desktop service catalog update

A change to our service catalog entry occurred.

 

What and When:

On Saturday, March 21st an updated service catalog entry was published at https://depts.washington.edu/uwtscat/manageddesktop.

 

What you need to do:

Nothing. This is purely an advisory to you that we’ve updated the catalog entry that describes the service, so you aren’t caught off-guard.

 

More info:

This update isn’t intended to introduce any significant change to what the service provides, but rather was a refactor of our catalog description to more accurately represent what we are providing. As an example, one topic that came up recently on the nebula-discuss mailing list—OS support practices–is now clearly called out.

 

I plan to update the catalog entry when we make service design changes that impact what’s there. So for example, assuming we separate Nebula file services from the core package, we’d update the catalog to represent that change at the same time we adjust the FY2016 rate information tied to that change.

 

If you have concerns or questions about this update, please send email to help@uw.edu with “Nebula service catalog update” in the subject line.