Office PCs

[Hyburnate]

Hi all,


I've recently taken over all of the IT at work and have started a roll out of upgrading the aging PCs by installing SSDs and upping them all to 8GB RAM just to future proof them. However with this comes a fresh install of Windows and am now wondering what software to load onto them to minimize the damage they can possibly cause and also to aid me.

I currently have a USB stick of lots of diagnostic tools, and all user accounts will only be standard users with me overseeing all installs of software. I'm also going to setup remote control so should anything happen or stuff needs sorting I can do it from a remote location.

What does everyone put on business PCs just to protect them etc

 

[Stoner81]

Decent anti-virus would be the first thing I think, after that lock out anything that could cause problems. So disable Run commands and prevent CMD prompts from being run by the users.

Outside of that I have no idea.

Stoner81.

 

[Cleisthenes]

My company uses Sophos if that looks like the kind of thing you may be interested in.

Remote access is very handy, you could even start working from home if you fancied

 

[Hyburnate]

My company uses Sophos if that looks like the kind of thing you may be interested in.

Remote access is very handy, you could even start working from home if you fancied

Thanks, I'll give that a look.

Haha remote control has been established on them all

 

[Armageus]

Look into Group Policy, even if you are only applying it Locally (as opposed to full Windows Domain). You should be able to set up a default policy on one PC, export it and then apply it to all of the others - can't remember the exact method, but we used it on a few PCs at work that weren't on the main domain.

 

[Hyburnate]

Look into Group Policy, even if you are only applying it Locally (as opposed to full Windows Domain). You should be able to set up a default policy on one PC, export it and then apply it to all of the others - can't remember the exact method, but we used it on a few PCs at work that weren't on the main domain.

I did consider that, but then I remember that the people I work with struggle to find a server/NAS drive without it being mapped. They're currently setup with remote access, decent anti-virus and no admin rights and hopefully, that should be sufficient. I'm also going to create a system image of each PC so that in the case of failure I can minimize downtime and losses (they should know to not store important files on the local machine)

 

[kirbz]

How many computers and do you have a domain? GPO is the best way of managing things and you can use it to map drives etc...

 

[D3K]

Hi all,


I've recently taken over all of the IT at work and have started a roll out of upgrading the aging PCs by installing SSDs and upping them all to 8GB RAM just to future proof them. However with this comes a fresh install of Windows and am now wondering what software to load onto them to minimize the damage they can possibly cause and also to aid me.

I read your post as reinstalling windows purely because you're switching to SSDs. If so just image them over.

I currently have a USB stick of lots of diagnostic tools, and all user accounts will only be standard users with me overseeing all installs of software. I'm also going to setup remote control so should anything happen or stuff needs sorting I can do it from a remote location.

What does everyone put on business PCs just to protect them etc

Give them local admin at least...

 

[Raumarik]

With that small an estate if you have active directory, us Group policy to lock the PCs down as much as possible, do not give anyone local admin rights, or if you absolutely have to for whatever reason give them a normal user account to use and a local admin account to be used only when they need to do something (and keep tabs on whether they're logging in as admin all the time).

lastly and for malware quite important - use application whitelisting if you can, it's an utter pain to set up initially but can save you an unbelievable amount of trouble later on.

Personally if you are happy with AV I'd still put on a full version of malwarebytes.

 

[Hyburnate]

How many computers and do you have a domain? GPO is the best way of managing things and you can use it to map drives etc...

There is no domain as there is no server currently and to my knowledge I'd need a windows server to establish it - if the amount of PC's was to grow I'd use active directory etc but currently it's under 10 so not worth the money really.

I read your post as reinstalling windows purely because you're switching to SSDs. If so just image them over.


Give them local admin at least...

All files were sat on a 500GB hard drive - full of crap might I add to, this gave me the opportunity to boost the PCs and also get them to use the external NAS instead of clogging the local machine.

With that small an estate if you have active directory, us Group policy to lock the PCs down as much as possible, do not give anyone local admin rights, or if you absolutely have to for whatever reason give them a normal user account to use and a local admin account to be used only when they need to do something (and keep tabs on whether they're logging in as admin all the time).

lastly and for malware quite important - use application whitelisting if you can, it's an utter pain to set up initially but can save you an unbelievable amount of trouble later on.

Personally if you are happy with AV I'd still put on a full version of malwarebytes.

I agree with you on all points and I'm looking in to Malwarebytes


It's all been done now, all PCs upgraded however having major issues with one with it now accepting the two new sticks of RAM - its got two DIMM Slots and is currently running a 2x2GB Configuration however when I put in 2x4GB of the same spec it fails to boot however the CPU was running at 90c and I've now learned that it spent a chunk of its life locked in a cupboard - think it's going to die to be honest

 

[paradigm]

There is no domain as there is no server currently and to my knowledge I'd need a windows server to establish it - if the amount of PC's was to grow I'd use active directory etc but currently it's under 10 so not worth the money really.

Wholeheartedly disagree, but I can understand if the business doesn't want to spend the money.

 

[Hyburnate]

Wholeheartedly disagree, but I can understand if the business doesn't want to spend the money.

Yeah, it's mainly that - I'm currently working on getting a server for files etc. so may propose Windows for that

I seem to have ruffled a few feathers with one of the staff already anyway - I will refrain from saying more on a public forum

 

[Quartz]

Take a look at getting a box running Windows Server Essentials. Not for Active Directory - that's just gravy on top - but for the backup functionality: you can set it to back up every PC every day and you can do bare metal and individual file restores. You can also run WSUS on it which will save bandwidth and make managing updates a cinch.

 

[Akagi]

Sophos, Sophos Console, teamviewer running on all machines at all times, detailes documented for instant remote support.