Ask HN: Is it reasonable to ban Windows OS from our workplace? This is mainly due to security concerns and secondarily for ease of maintenance of network/systems. |
Ask HN: Is it reasonable to ban Windows OS from our workplace? This is mainly due to security concerns and secondarily for ease of maintenance of network/systems. |
It's reasonable to limit what OS people can use for maintenance and security reasons. There are tons of windows only shops.
If not having it is getting in the way of your work, you should talk to your company about it and discuss how it would help you. (Edit: or if it's you doing the banning, have the same conversation and make sure it's not harming anyone's work)
It reminds me of the old atheism discussions: all companies limit the number of OSs they support, yours just limits one more.
Also, I'm not a huge fan of Windows anymore, but it's device management capabilities via Active Directory and Intune are far and away the best in class. Yes, Windows suffers from success (by way of getting targeted for exploits all of the time), but it is really really easy to lock down, encrypt, and wipe Windows laptops and desktops en masse.
I work at a large corporation, my email (outlook, which we also use to book resources and rooms), password management, desk phone, software updates, identify and privileges are all tied together with a Microsoft stack (I don't pretend to know how it works). Do you need this? If so, is there a Linux equivalent to this holistic management? Do you need full MS Office (eg macros)? Are you happy with the variable compatibility that LibreOffice/online suites offer?
Not to hijack your thread or anything, but I just discovered Window's MSIX Packaging Tool takes snapshots of your desktop shortcuts (and other files) and then distributes them to complete strangers when you upload a package to Microsoft's store.
It's a reproducible phenomenon, too. Just pack something with this tool, right click the resulting .msix file, choose Extract with the Packaging tool, and then look at what's inside these three files:
UserClasses.dat User.dat Registry.dat
Those three files and all the content inside of them goes straight to Microsoft and the strangers who have access to your .msix package!
If these assumptions are correct, then in the interests of maintaining your secured environment and avoiding support issues you have a valid reason to ban such Windows laptops from your workplace. The new hire should be issued with a correctly configured PC.
If the issue has arisen during negotiations with a new hire, then it's up to them to walk if they are so attached to their Windows devices. Is it some new manager or sales person? If they can't handle working in your environment then they will be more trouble than they are worth.
However, in very large scale environments, I'm not sure the alternatives to Windows are quite mature enough yet to deal with the less common situations encountered there. M&A, localization, and offline access to files all come to mind.
Personally, I think Windows is not a great OS. On the other hand, some developers of commercial software only have limited knowledge and produce apps that can only run on Windows.
I don't know if the principle has been changed or not, but several decades ago the sequence was:
Analyse the task.
Get software to perform that task.
Get the operating system that will run that software.
Get the hardware that will allow that operating system and app to run.
Quite often, people will reverse the project and buy the hardware first. Then try to match up the rest. It doesn't always work optimally.
Windows will be the dominant OS for our entire lifetime. Put stock on it
Under who's authority do you seek to act. Who are the stakeholders who oppose the notion? How many people already use Windows? How many applications that are in use require it?
Before anyone can answer with authority I feel we need to know a lot more about your situation.
Banning windows servers from use would be more reasonable.
That doesn't mean a Linux/macOS network is more secure inherently - I find people patch their macOS and Linux devices a _lot_ less than on Windows, so I find a lot of older bugs and exploits work really easily.
Entirely depends on how good you actually are at your job & keeping stuff locked down and patched.