12

I am in charge of maintaining around 25 PCs with various versions of Windows (Vista, 7, 8).

I was thinking something along the following lines:

  • Every 4–6 months:
    • Take an image of the system partition so that installed programs with their various license requirements can be restored easily if a hard disk fails. (I am thinking of Clonezilla for this.)
    • Physically clean the machine, get rid of dust on the fans etc.
  • Every 2 months:
    • Do a software check on things like backups still running ok, anti-virus up to date, Windows updating itself, firewall set up correctly.
  • Every day:
    • Automatic backups of things like emails and documents.

What kind of schedule do you recommend?
What kind of software tools to use? Ideally I would like to automate as much of this as possible.
What other things should I be doing?

UPDATE:

Thanks for all the great answers so far, the advice to not do backups/images of individual machines doesn't really work in my case.
The licensing costs would be prohibitive, since there are at least 5 different software configurations for the different roles in the company -- finance, sales, management, production (3 types here alone) and having licenses for everyone for everything wouldn't make sense.
Also we have to keep some old versions of software for compatibility with some of our customers - the installation disks (with the license keys) have been lost or buried before my time.

4
  • 2
    Whatever schedule you use, if you have a spare PC, try restoring one of your backups to it. Go through the sequence at least once. You'd be surprised at the number of sys admins who have been backing up systems for years and don't know how to restore them. Even worse - there is only one tape drive and it only lives on the backup system.
    – cup
    Jul 10, 2014 at 6:53
  • 2
    @Loopo - I'm not suggesting you install every application on every computer. I'm suggesting that you should create automated software installations to apply to "generic" images. The more specific images you have to maintain the worse off you're going to be, in terms of sinking time into image maintenance. Insofar as the old software you no longer have media or keys for: You're going to be in trouble when you need to replace machines. You can't keep that software running forever. You'd do well to start figuring out a mitigation strategy now before it bites you. Jul 10, 2014 at 15:56
  • This is, as others have suggested, a perfectly simple problem that has already been solved. There are plenty of methods for trivially creating a simple to deploy baseline OS image, possibly with one or two apps on it that you use everywhere and then adding (or for that matter removing) packages as an automated part of the deployment process to account for machines having different roles. It might take a day or two to set up and test but the time will be paid back when it takes 40 mins instead of half a day to deploy a new machine.
    – Rob Moir
    Jul 10, 2014 at 21:02
  • 2
    ... and while it's easy to say "this deployment stuff don't apply to me, I just support a small business with 20 or 30 machines", I would suggest that if anything, fast deployment of a machine might even be more important to a small business where you might not have lots of 'spare' machines that can easily be put on someone's desk the moment they report a fault.
    – Rob Moir
    Jul 10, 2014 at 21:04

5 Answers 5

28

Here are some "pages" out of my personal "operations manual":

  • All user data is saved on servers, period. It might be replicated to client computers via functionality like "Offline Files" (for laptop computers, particularly) and Outlook's "Cached Exchange Mode", but there is no primary storage of data on client computers, ever.

  • No recurring backups of client computers are performed. No data is stored there. Users are instructed (ideally by corporate policy documents) to save data in approved areas and that anything saved outside those areas is not backed-up.

  • Software should be automatically installed via an automated mechanism wherever economically feasible. (The "break even" has been, for purposes of my Customers, a program being installed on five (5) or more computers. If it goes on fewer I'll probably just do the installation manually.) The Active Directory security group membership and location (OU) are sufficient to determine a machine's software load.

  • I have taken an image of a client computer being used in a very business-critical role now and again, but in general the majority of client computers I work with are built-up from their factory load and automated software installs. Where I've seen it done I've felt that maintaining a "library" of disk images of client computers has been cumbersome and error-prone.

  • Since Windows 7 added software RAID-1 to the "Professional" OS I have made use of that, increasingly, for client computers that are in more "mission-critical" roles. Windows software RAID is much more forgiving and workable than "motherboard RAID" (which is nothing but trouble).

  • Antivirus software should use a "management console" that can provide centralized, automated alerting for fault or anomaly conditions. This often means buying "enterprise"-oriented antivirus software.

  • Computer environment settings (firewall, security options, etc) are pushed out via Group Policy. (Anything that can be done with Group Policy is done that way.)

  • No maintenance of the hardware (fans, etc) is done except when the environment is harsh, and even then only in a reactive manner. Hardware has gotten pretty solid in the last 10-15 years.

  • Updates are installed via WSUS. Compliance is tracked in WSUS and, if the environment warrants (for PCI compliance, for example) with whatever auditing tool is financially appropriate. (SCCM is nice, for example, but not always appropriate from a cost perspective.)

Edit (now that I have a couple more minutes to write):

  • My definition of "user data" includes user profiles. I use Folder Redirection to get the big folders out of the profile. I generally redirect AppData, which seems to be heavily discouraged throughout the industry (because dimwit software developers make assumptions about the AppData folder being local that may not be true... >cough< Apple >cough< iTunes >cough<).

  • Users never have "Administrator" rights on client computers for their day-to-day user accounts. Dealing with small privately-held businesses, as I do, can often require some finesse in explaining to the owner why their user account doesn't have Administrator rights. (With the advent of scary-as-heck malware, though, making this argument has become a lot easier. Score one for malware, I guess...) I do create secondary local Administrator accounts for users who are technically competent and who have a legitimate need on a case-by-case basis (after consulting with my contact and weighing the pros and cons). Making this one change drastically decreases "software maintenance". If you do nothing else, do this.

Some of the goals of this methodology are:

  • Allow for a user to "hot desk" if they have major failure (smoke rolling out of the computer, etc). All their software might not be available (because of licensing limitations that limit installed seats, etc), but they should have basic functionality. (I support a reasonable number of client computers throughout my Customer-base. I need a simple PC failure to be a non-emergency event or I can't scale to any significant number of Customers.)

  • Reduces most troubleshooting for user issues simply to determining if the problem is user profile-specific or machine-specific. User profile-specific issues are resolved either by restoring the profile from a known-good backup or, in drastic situations, starting with a clean profile. Machine-specific problems are resolved by bringing out a spare machine or wiping / re-imaging the failed computer.

  • There is no data loss impact when the eventual failure of client computer hard disk drives occurs.

  • Computer replacement (and keeping the Customer sticking to a computer lifecycle plan) is easy.

9

Keeping a separate image of each machine sounds like a very labor and cost intensive plan. How are you going to store all those images and keep them matched to each machine. Will you even be able to restore them properly when the old hardware dies and is replaced with new, different hardware?

I don't backup end user machines. All their important data is stored on our file servers, exchange and sharepoint. Each user has their own personal network share as well as departmental ones. We educate all the users not to store data on their local machine.

All the machines are imaged with the software they need when we deploy them. Microsoft offers tools to do this for free, like Microsoft Deployment Toolkit and Windows Deployment Services. Or you can get System Center Configuration Manager which also monitors the health of the machines, allowing you to ensure updates are applied and unauthorized software isn't installed. All the machines are set by domain policy to automatically apply updates from our WSUS server.

When a machine dies or gets a virus, we just replace/repair the hardware and reimage it. The new machine already has all the software they need, their network drives get automatically mapped by group policy as soon as they login. Printers are automatically installed, etc. So the machines are basically disposable.

For the most part I don't do ANY maintenance to the end user machines unless their is a problem with them. System center helps identify problems that the users don't report. WSUS and our antivirus software give reports on which machines are missing updates. When there IS a problem with a machine, it gets dusted out and hardware checked over while we repair it.

1
  • 1
    WDS saved my company countless hours! The previous guy did the clonezilla thing, and it took at least 4 hours to refresh a system. Drivers were a nightmare, and every ran horribly. Now with WDS, I can do a full system prep in 45 minutes with all software installed and registered. I ended up replacing the other guy, he was let go. Jul 9, 2014 at 21:10
5

Rethink your strategy. Don't backup client devices.

Spend your time doing the following:

  1. Create an OS image that can be deployed automatically over the network with WDS/MDT. When a computer gets hosed, just reimage it. This image should have all of your software/configuration in it.

  2. Centralize your user data on servers. This means having a proper mail server and not using POP3 with individual user backups. Just backup the mail server and you're done. This also means centralizing user files on file servers. You can use Group Policy to transparently redirect the desktop, documents, appdata, and other folders to this file server. You can use offline files to sync this data locally so users can still work remotely. Now, you have one machine to back up and not 25.

  3. Centralize your patching. Use WSUS so that you can generate reports on what clients have which patches. Then, you only need to "spot check" machines that aren't compliant. You should do this every month after Patch Tuesday.

As for physical maintenance, unless you're in an exceptionally filthy environment (factory floor, inside of a vacuum cleaner, etc) don't open computers and dust/vacuum them out. In some instances, this can potentially void the warranty. In other cases, it's just a waste of time. If you must do this to sleep soundly at night, do it every few years.

4
  • 1
    25 computers with 3 OS versions suggests adhoc computer procurement. I suspect Loopo probably has a mess of different computer models and would end up having to create almost as many clean images as individual computers. Under those conditions prepping images for all the existing machines in advance seems like a lot of work that will mostly go unused. Save clean images for any new systems or old ones that need fresh installs; beyond that is probably more time than it's worth for non mission critical machines. Jul 9, 2014 at 19:41
  • 4
    Not sure what you're talking about. OS images have been hardware independent since Vista. A single image can be used across any number of hardware models.
    – MDMarra
    Jul 9, 2014 at 19:42
  • @MDMarra, methinks it be depending on what he's using to backup the image, I'm not sure if Clonezilla will handle hardware independent images, using imagex (or now DISM) yes, but who knows what kind of format clonezilla will do it in. With that said, not only the creation and maintenance of images would be more of a hassle than a help in such a small environment, but with 25 computers, I can't imagine you have more servers to set up the infrastructure for a decent imaging system. Yes, maybe you can install the WDS role on your exchange server too, but still, no. Jul 9, 2014 at 20:20
  • 1
    You can use MDT which is a glorified file share. I think you're overestimating the work and underestimating the benefit. But, to each their own.
    – MDMarra
    Jul 9, 2014 at 20:22
3

(Wow-- I've never added a second answer to a question before... This is surreal!)

Everything else that I said in my other answer applies, pretty much, except that I'm going to go out on a limb and suggest client computer backup. (Yikes!)

The Client Computer Backup functionality in Windows Server 2012 R2 Essentials might just be up your alley. Functionally it's a block-level deduplicated backup store that sits on a server computer, combined with a client application that performs the backups and uploads data to the server. It's actually pretty slick, as solutions like it go. There is a bare-metal restore ISO image that will allow you to restore a machine from a empty hard disk drive. (I've used it before and it works rather well.)

Windows Server 2012 R2 Essentials requires no Client Access Licenses (CALs) for up to 25 clients. If you needed more clients than than (which it sounds like you might) you should look at licensing Windows Server 2012 R2 Standard, purchasing the necessary CALs, and adding the Essentials Experience feature to the server.

Planning for disk utilization is going to be difficult because you're not going to know how much "win" you're going to get from the deduplication. Your environment is going to determine how well that will work so there's no guideline to give you here.

For the cost of some software and a small server computer you could cobble together a pretty good PC backup solution. While I am somewhat "morally opposed" to the idea of client computer backups I think it could be a viable strategy in your environment given the amount of work it would take to transition it into a more "normal" corporate Windows environment.

If you perform backups of the server computer itself (which you should, obviously) you can also get an effective off-site backup of all the client computers using this tool. That would certainly be an attractive add-on, given that right now a fire or flood in your office would probably represent complete destruction of all your company's data.

1
  • Thanks for this second answer. Pity I can only accept one of them. I will accept your other answer as it applies more generally.
    – Loopo
    Jul 11, 2014 at 10:17
2

I don't use windows, but a lot of the basics carry over, and the main thing that you should try to do is set up a system that will alert you if a part of it fails.

For instance, if I was backing up a folder to another computer every day, I might have a separate script running on the destination to check the latest timestamp, and if no file has been modified in the past day it sends an email to say the back is no longer running. This is just a vague example, but in general you can't remember to do everything yourself - murphys law says the one thing you forget will usually be the wrong thing that goes wrong, so it's best to have some sort of automation to detect failures.

Similarly, set up an automatic testing suite for system stuff, like antivirus version, firewall functionality, etc. I'd back up any important files on an hourly basis if at all possibly, daily as a minimum, but it depends on how fault-tolerant your business is - how much will losing a day's worth of emails cost you?

If you're worried about hard disk failure, look into RAID. Backups are for catastrophic failures (flood, fire, etc) and user-error (help, I deleted the wrong file!). Raid is for disk failure.

2
  • 1
    RAID on desktop class systems often causes more problems than it solves, causing data loss when the controller or motherboard fail and identical replacements aren't available. Sometimes even WHEN identical replacements are available.
    – Grant
    Jul 9, 2014 at 15:59
  • I've been really happy with Windows software RAID-1. Since becoming available for the "professional" class OS in Windows 7 (or Vista, I can't remember-- and never used Vista in Customer sites anyway) I've been happy to use it for machines that need some fault tolerance for hard disk drive failure. I certainly wouldn't deploy it to just any ol' client PC, but for more critical machines I like the feature. OTOH, "motherboard RAID" is nothing more than a device used to destroy data and I wouldn't wish it on anybody. Jul 9, 2014 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .