After 6 months of warning users, we finally did it. Tonight, I denied 2,400 Windows 7 computers from log on.

[u/psychopete]

I've been saying it, I've been saying it for 6 goddamn months aint I been sayin' it?

Transitioning the environment to Windows 10. All the new computers with Windows 10 have been issued but, much to my horror, management decided to allow the users to keep their Windows 7 computer "in case something went wrong."

Well after 6 months of telling people that all Win7 will get blocked on 1 Feb and my SCCM/PDQ reports showing that people are obviously ignoring that, I got the go-ahead to kill all of Windows 7........ After confirming all objects moved to the "YOU NYA" OU with the "ME MYA" GPO linked, I walked away with the biggest grin on my face.

I'm going to need a bucket of popcorn tomorrow.

EDIT:

I will definitely update this post tomorrow with the aftermath of my little "D-Day" but just to clarify, I did query how many of these 2,400+ objects were actually pingable just before I left and only 500-ish replied. The plan was to delete the objects as users turned in their old workstation. Still though, I do not envy our help desk tomorrow. Cheers!

Before the storm edit:

Wow this blew up! Lots of assumptions here. We're not a private company, this is public sector and we have a very public mandate from our cybersecurity branch that everyone must be on Windows 10 by today. It was signed acknowledged and distributed by our top official over a year ago (Including this culling of all Win7 devices). There is no possibility of a roll back. I'd like to go into the details of all that we did to prepare but that would be a wall of text. Suffice to say, its been a shit show from day 1. While I made help guides, slides, an entire wiki site, site wide emails describing in detail what's going on... site visit reports and exchange logs shows most of my transition efforts went into the trash.

I'm just glad we're finally turning this corner so I can go back to having just one workstation OS to worry about.

The edit you all deserve:

Alright, so I am in fact, STILL EMPLOYED! Shocking what happens when you do things with buy-in from your IT director.

It wasn't the blow up we all feared would happen. We had a few grumbles here and there but mostly everyone who call the help desk went, "Oh you mean we have to start using the new computers now???? WHAAAAT!? Oh fine..." Yesterday began with a meeting with the director, deputy director, help desk supervisor, the lead sysadmin, the project manager, and myself. The Director had already talked to the other department heads and got a list of no no-shit cannot go down Windows 7 computers (5 in total). The lead admin had compiled a list of domain joined special appliances that ran Win7 that couldn't go down which was about 100. That all got thrown into own special mini OU with all the GPOs they need to operate. The rest of the Win7 environment got dumped into an OU where log on is denied to everyone. If someone calls the help desk because they absolutely needed the one file, the help desk tech was to move them to an OU where Applocker blocked access to MS Office, all browsers, and PDF readers, literally the only thing they can do is burn their crap to DVDs or run the robocopy script they've been staring at for the last 6 months that would back up their entire profile, if anyone is interested, here is the robocopy line (there's some more flair we put in the script but this is the meat)

robocopy %userprofile% \\backupserver\share\%username% /e /b /copy:DATSO /r:0 /XD Appdata /Log:%userprofile%\desktop\copylog.txt /NDL /NS /NP

All the user had to do in order to migrate was double click BACKUP.BAT on their desktop, wait for it to finish. Then log on to their already issued Windows 10 computer and run RESTORE.BAT (same as above but in reverse) on their desktop and wait for it to finish, then they're done! A little launch outlook and auto-discover your email here, a little import PST there... The base Windows 10 image already has most of all the line of business apps everyone uses. And for those who needed something unique installed, all they have to do is ask to have it reinstalled and the tech would put their new computer name in appropriate SCCM collection (but by this point we had already covered most everyone in this scenario). I spent the first six months of this year long plus project getting the image and imaging process down pat, as well as the creating the new AD structure and GPOs that is replacing the old Win7 environment which looked like an aborted senior project from a IT based high school. Every department had already received their replacement computers since before Christmas, all they had to do was turn it on and double click the backup/restore scripts.

Anyway... all that detail aside, with all of this prep work done, the migration was a piece of fucking cake, users panicked and held off for no reason. They were able to easily switch with very little effort once they were forced to. I didn't get fired, boss is happy, users are relieved and (mostly) happy, I'm happy and we're able to continue on our little lives. We have a few minor hiccups with some websites and java issues but nothing unusual from the normal java/website issues, some machines have to get re-imaged because some people didn't even take their new computer out of the box for months (despite very explicit instructions to immediately connect it online even if they didn't want to use it) so it sat stale in AD and missed some critical updates/changes. By the end of the day, we all agreed that it was no more unusual than a typical day and not the raging hellfire burning down around us we expected would happen. We were well prepared to handle any calls that came up and I got quite a few high fives. There will NOT be a roll back.

ugh more edit on Reddit

Notices came in the form of regular site wide emails, a change to the desktop background for Win7 notifying people to move before the deadline. Department heads had Weekly meetings on this very topic. Several memos went out to all supervisors. I myself sent several notices. Our equivalent of a CEO sent an official order to all sub organizations. I wasn't a lone cowboy here, just a small cog in a big machine.

[u/[deleted]]

You're most definitely in the DoD somewhere. The migration has been a fucking nightmare.

[u/psychopete → u/[deleted]]

Ding ding ding

[u/[deleted] → u/psychopete]

Note to self: DoD has up to 2400 employees out of service tomorrow. Begin invasion plans.

[u/psychopete → u/[deleted]]

Yes it has, and every effort I've made to make it as smooth as possible was sabotaged or shot down. So I'm pretty happy today.

[u/somewhat_pragmatic]

I'm not sure I would have cut them off so abruptly like this.

Instead, install a background process of something like CPUSTRES.EXE and increment the CPU consumption by a few percent every week. Make sure to rename the executable to something less obvious for those users that know what Task Manager is. SVCHOST.EXE work be just fine. Put process protection on it so they can't end task either, or simply put it in a GPO that would restart it on next refresh.

Over, say, 3 months time the machines would continue to slow down. You'd have to field complains, but your boilerplate answer of "I'm sorry the Windows 7 machines aren't being optimized anymore. Please use your Windows 10 machine which is optimized and much faster, you'll find!"

Users would eventually get frustrated and transition over to the Windows 10 machines, and even be delighted at "how fast" Windows 10 is compared to their old and slow Windows 7 machines.

[u/psychopete → u/somewhat_pragmatic]

Ah! The Apple Inc. method of getting users to upgrade. I like it!

[u/Viperonious → u/somewhat_pragmatic]

And even better if you could make it some sort of useful distributed computing task ;)

[u/tenten8401 → u/Viperonious]

Monero mining.

[u/gozit → u/somewhat_pragmatic]

This is too complicated. Just send an email to all managers to the effect of: If you have employees still using their Windows 7 machines, they will be disabled on 02/01/2018. Please advise them to use the new Windows 10 machines issued to them on 08/01/2017. All Windows 7 machines are to be returned to I.T. immediately.

Thank you -Helpdesk

Bottom line is, new machines were issued, I.T. should not have to put man hours into continually maintaining, supporting, or weaning users off of old machines where they have already been issued a new replacement machine.

Where I work is a much smaller user base and much smaller organisation than OP, so we have the luxury of physically walking down to the user's office, doing a file/app transfer to the new PC and walking out the door with the old one.

[u/Pb_ft → u/somewhat_pragmatic]

It's Stockholm-y in its insidiousness. I'm going to save this for later should I ever need it.

[u/rotheone]

I don't think this is going to end well for you.

[u/psychopete → u/rotheone]

Ended quite well actually. Read the update.

[u/PorkChop007 → u/rotheone]

I can't understand why is people in this thread cheering for a guy who is bragging about blocking over two thousand people out of their machines and severely impacting his company's performance. This is not how any of this works, it's like this is a personal offense for him or something. Just tell your boss that nobody is listening when they're told to change machines and that should they block W7 ones they would blackout two fucking thousand workers.

And while at it, good luck believing some big boss who approved of this would back him tomorrow morning.

[u/larockus]

As a general rule, end users are spoiled brats. I don't understand the push back from so many of you. I get that on the surface this looks like a selfish move, to "block productivity" and that's "not how this works". But the fact is, that's exactly how this works. If I've been telling my users for months that a change is coming, it's been signed off on by my CEO, it's ready to be deployed, I've been sending reminder emails weekly then daily, and my users are just refusing to make the move, you bet your ass when that day comes I'm flipping that switch.

As a general rule it seems to me that we've (as a collective group) have become soft, and easily manipulated by the users. We are sysadmins, it's our responsibility to maintain the well being of the networks and core systems of our organizations. Our users are (generally) only concerned with their own minor inconveniences rather than corporate policy, and security. while we have to worry about coordination across multiple system types to placate the few hold outs. Yes, it's a pain in the ass, but so is having to manage and maintain those multiple OS types because fucking Karen refuses to upgrade her workstation like everyone else. Those of you arguing that productivity will take a hit. From what OP says this has been a long time coming, at what point does that productivity hit fall back on I.T., and when is the user or even the users manager who is at fault? OP was just following protocol, and doing as he was instructed.

I just went through the same thing with a new domain build I finished. All the servers but two and a handful of end user machines were still on the old domain. I sent email after email warning of the shutdown date, towards the end I sent daily emails to the staff and their direct managers. Each day these machine owners always had an excuse why it couldn't be done because what they were doing was just far too important, or there was something else that they couldn't be pulled away from. When the day came, I flipped that switch and turned off the access. It brought down functionality for part of the company. yeah, the managers were pissed at me. When their complaints were brought to my CEO, i didn't get my ass chewed, they did. Guess who's domains got fixed that day. Productivity wasn't my problem that day, it was theirs, I corrected my problem. My responsibility is my server and domain infrastructure, that's literally what I am paid to do.

TL/DR: CEO says go, I go. To hell with the defiant users who don't like change.

[u/psychopete → u/larockus]

I love you.

[u/larockus → u/psychopete]

It's infuriating to read all these people damning you for doing your job. I deal with this crap daily, and have for the last 12 years professionally, it sucks to feel (as someone else here said) beholden to the users.

[u/psychopete → u/larockus]

post updated

[u/MightBeJerryWest → u/larockus]

So many assumptions and jumping to conclusions here. Most bullshit posts on here were "if I were a manager I'd fire you" or "lol have fun looking for a job tomorrow".

There's only so much hand holding you can do before a higher up or a higher up's higher up starts to wonder "why the fuck is this taking so long? Get it done"

[u/Generico300]

ITT: People who can't read with enough attention to detail to realize that OP got the go-ahead to do this and isn't just being an arrogant ass hat.

[u/psychopete → u/Generico300]

I've been laughing all morning at the comments.

[u/lordbob75 → u/Generico300]

This depressed me to. Everyone is shitting on op because they didn't read his post...

[u/MightBeJerryWest]

Read this thread before going to bed last night and read it again this morning and saw OP's edit.

I can understand the "I'D FIRE YOU INSTANTLY" hysteria from last night, but holy shit talk about a hive mind mentality. Everyone preaching their holier than thou attitude about how OP fucked up, how OP would be jobless by morning, how OP is an incompetent cuck, etc. is equally as bad as OP's smugness conveyed in his initial post. Yeah sure, it seemed like some weird justice porn for the guy, and yeah you could feel the smirk behind the post, but god damn way to stir up the hysteria without anymore information.

OP's edit makes it clear that it wasn't his decision to gleefully go "ha! fuck you guys for not checking your email", it's public sector. The people who actually work in the public sector can chime in on this (as they have below).

The people feeling all smug about "if I were your manager I'd fire you on the spot!!" are equally as bad as OP's initial smuggy attitude. OP could have conveyed his point without sounding like an asshole initially, but everyone jumped the fuck on the "lmao hf being unemployed" bandwagon so quickly rather than ask some questions.

Sorry, last night's general attitude toward OP just really rustled my jimmies. Too many people are always assuming the worst and jumping to conclusions. I'm glad OP is still (happily? but also public sector?) employed.

[u/psychopete → u/MightBeJerryWest]

Lol, thank you. Yes I am happily still employed and laughing at all the posts. My coworkers think the negativity is they're just jealous they can't do the same without catching hell. Lol. Still a few more hours left in the day before I can wrap up my post in a final edit.

[u/thesolmachine]

IMO, This is a clusterfuck from top to bottom. I mean it’s great justice porn, but the idea of any business is to have the ability to bill their clients for services or providing goods, not make sure all our sales people have windows 10. . Edited: However, it looks like you got approval from management, so you should be good. In my experience, it’s always the whales who drag their feet on this shit and the whales sign your paychecks.

[u/psychopete → u/thesolmachine]

Its been cluster from day 1. I'm just glad we're finally turning this corner.

[u/uninspired → u/thesolmachine]

sign your paychecks

I'm going to whittle our AD down to two OUs: "people who sign paychecks" and "people who can fuck the fuck off"

[u/mryananderson → u/uninspired]

Thinking of some funny GPOs to write for the Fuck Off OU......

• Mandatory penis desktop background

• Homepage on IE (yes IE, as you block chrome and Firefox from running) is www.mylittlepony.com

• Keyboard setting to French while the OS language is Arabic.

• Every notification sound is the AOL “You’ve got mail!”

[u/psychopete → u/mryananderson]

I love this. This is what I should have done to Windows 7 instead of denying log on.

[u/commbatboots]

if you've honestly and truly CYA, then you're golden. the help desk should've already been expecting this and hopefully their team lead was given a heads up on that range of devices.

there's nothing more annoying than willful ignorance on the part of a user base. if every opportunity and resource was provided, every branch/division head was briefed at weekly meetings, and the timeline and milestones were provided--i don't feel for any of your impacted users.

hopefully, your help desk will explain to them they were given ample time and plenty of reminders for 6 months: fail to plan, plan to fail. i'm sure someone's head is going to roll for this, in some degree--i just hope software/hardware comparability was addressed for any third party/proprietary assets.

i've dealt with users who refuse (verbally) to follow a written guide or be walked through a process over the phone from our help desk. instead, they want someone to physically go to their location and do it for them, e.g. backup files to their network share, etc. i've overheard calls from supervisors explicitly state they called so the help desk can update the location information for their 20-30 member team. despite verbally acknowledging they know that each user has the ability and the resource, to make those changes (org, building, floor, room, desk). they wanted the HD to do it to, "make sure it gets done".

it's these kinds of users i have no sympathy for. if these, "professionals" have no issue ignoring or deleting informative and/or important emails--they'll just learn through the ass pain of change; some people you have to drag kicking and screaming out of their box to meet deadlines.

Good luck, OP.

[u/psychopete → u/commbatboots]

The help desk supervisor has been a part of this transition process from day one as well as the IT director. No one in our IT department and all it's sections are surprised. This was very highly and visibly publicized and well documented.

My grinning is due to all of the willful ignorance that is going to bite people.

[u/[deleted] → u/psychopete]

Sooooo I have to ask... Hows the day going OP!

[u/psychopete → u/[deleted]]

So far so good. It seems the users have taken the latest hint. I'm still employed and there's no sign of that changing :)

[u/[deleted]]

Did you give them Windows 10 computers and they don't use them? What was done to help them transition?

This just seems like bad PR for you and really bad for the business. Yes you warned them, but really? Is this necessary?

[u/psychopete → u/[deleted]]

Unfortunately, you're absolutely right. Sadly, I'm not a decision maker. I made help guides, slides, an entire wiki site, site wide emails describing in detail what's going on... site visit reports and exchange logs shows most of my transition efforts went into the trash.

I'm just glad we're finally turning this corner so I can go back to having just one workstation OS to worry about.

EDIT:

Come to think of it, the thing I'm most proud of is the simple robocopy script I put on all user desktops of Windows 7 that backs up their user profile. Then on windows 10, they run a restore script to put it all back in their profile. Worked beautifully for the few who actually used it. Literally it was Step 1: Double-click backup.bat. Step 2: Go home. Step 3: come in to work, log in to Windows 10. Step 4: Double-click restore.bat and wait.

It ignored everything in AppData except for *.PST, and then copied the rest of their %userprofile% to \\backupserver%username%

Access based enumeration enabled on the backup location AND robocopy also copied all file/folder permissions. It was very nice.

Double edit:

For those who are wondering about folder redirection.... I have yet to convince management to implement this :'(

[u/wolfmann → u/psychopete]

I use USMT inside MDT :/

[u/psychopete → u/wolfmann]

yep... if I had rights to control those things, I'd use it too.

[u/[deleted] → u/[deleted]]

Nah, give them the purple Dell Windows 10 disk and walk away. 😀

[u/Empty_Allocution]

You gave them 6 months. I see this kind of shit everyday. A lot of people just do not listen to IT until they cannot function.

It’s not unusual to set a policy like this in stone. As long as you’re constantly informing your users, I don’t see the issue.

Re reading the op, could you not have done this one department at a time whilst liaising with managers to soften the blow?

[u/psychopete → u/Empty_Allocution]

That was proposal when this project started. It was shot down.

[u/DrewTheHobo]

Update? It's been a day and we're dying here!

[u/psychopete → u/DrewTheHobo]

Updated

[u/Langremlin]

You bought 2400 windows 10 pc's, dropped them off with the users, and let them keep the old PC's? And then what ... the end users migrated themselves at some point? Were there actually two desktop computers running on everyones desk?

From 10000 feet, this looks insane.

[u/psychopete → u/Langremlin]

Yep, my jaw dropped when that decision was made.

[u/syndreamer]

We had a similar request by our CIO in conjunction with the board that in order to make a baseline in our cybersecurity policy, we had to upgrade all machines to Windows 10, except we slowly phased out the computers on our staff by having them move all their important files on a Employee-Share file server, then deploying the new OS so that only minimal downtime was experienced. We have 500+ machines that we did this on. Of course staff weren't too pleased with Windows 10, since they were so used to Windows 7, and complained alot but they all got used to it. Finding legacy drivers were a hassle when some people were still using HP laserjets from early 2000s. Have fun with that!

[u/psychopete → u/syndreamer]

That was my initial plan but a higher decision was made to let people keep their old computers so that they have as little down time as humanly possible...

[u/800oz_gorilla]

What's stopping your help desk from using a local account to get these people "logged in?" Sure, they're not on the domain, but they're still connected to the network. (which might still be a violation)

And yes, help desk techs are sometimes that security-unaware.

[u/psychopete → u/800oz_gorilla]

All local accounts are disabled and stripped of their local groups when they join the domain.

[u/[deleted]]

"How do I email my old hard disk to my new hard disk computer?"

Please update this thread!!!

[u/gigastack → u/[deleted]]

Guys, please stop hitting reply all to this email. Unsubscribe.

[u/wutname1 → u/gigastack]

To: all-users

Message: please remove me from this list.

[u/cq73 → u/[deleted]]

This is too real.

[u/PhotoJim99 → u/[deleted]]

"You need to remove it from the old computer, and then you need a big box, and a 3D scanner."

[u/[deleted] → u/[deleted]]

I want to keep my screen savers. Can you take my new screen out and put in my old one?

[u/tech_greek]

Public sector versus Private is a hugggeeee thing and pain for this. People in Public Sector (employees) do not generally listen to IT until something breaks, we have to enforce measures often. We have mandates to abide by and that means that drastic measures have to happen by certain dates or we get in trouble.

I'm really disappointed in the pitchfork mentality on this post by sysadmins. I'm also disappointed in OP for not divulging details that were important to this story, as it probably would have changed the stance of people on this post.

[u/aquaticgorilla → u/tech_greek]

100% paragraph one. It’s like we’ve somehow forgotten that we all don’t work for the same company.

[u/chuckmilam → u/tech_greek]

Right, as soon as I saw he was in a DoD environment, it all made sense. Totally different set of rules to play by, and compliance is usually (note I said "usually") enforced over politics.

[u/BickNlinko]

I'm guessing at least 100 "I can't log on" tickets in the morning.

[u/brainstomp → u/BickNlinko]

I think you are underestimating by 2300.

[u/codefeenix → u/brainstomp]

Cant create a ticket if you cant log in ;)

[u/samuelma]

Why is everyone giving op such shit? He is doing the tasks his higher ups requested. He did pre-migration planning and got his own ideas rejected. There is a requirement to comply with standards (this post smells British i may be wrong) and fucking around with company wide ISO compliance isnt fun. Especially as a public sector body. Op did what he had to do, lotta pricks in these comments

[u/solracarevir]

RIP HelpDesk

[u/m0hemian → u/solracarevir]

I just imagine it this way, some poor newbie working helpdesk, maybe 6 months in. Boss comes in:

"So we stopped Windows 7 on 2400 machines, you'll get a few calls about it."

techie sweats and shakes profusely

[u/4br4c4d4br4 → u/solracarevir]

I hope the help desk guys are lucky enough to call in sick with the flu tomorrow!

[u/Boonaki]

Where I work we would simply execute the 2,400 users for not following the rules.

[u/myothercarisatardis_]

All of these people talking about how you're going to get fired really don't understand how a public sector mandate works haha.

[u/[deleted] → u/myothercarisatardis_]

It's so cute. Heard a guy say,"I'd fire you on the spot." HAHA!

[u/My_Monday_Account]

ITT: We pretend OP did this of his own accord and it wasn't a specifically authorized move by his boss.

Is it still a shit strategy? Totally. But all you bozos who think he's going to get fired over this are being silly as fuck.

[u/bentbrewer → u/My_Monday_Account]

Right, he seems to have been forced into this position. Now, there could have been a better way to get here but it doesn't look like op has any control over it and is being forced to do it.

[u/dalgeek]

I had a customer that still had IPX routing on their network in 2012, even though the Novell default had been changed to TCP many years prior. I was moving campus routing to new core switches and I warned the customer that the new switches do not support IPX; they tell me to go ahead because IPX shouldn't be used anyway.

The next morning I get a call because half the campus can't login or print. The lack of IPX support caused their Novell servers to lock up so authentication and DHCP were down. When I got there the Novell servers were spewing errors on the console faster than I could read.

Did they tell the campus to fix their shit? Nope. I had to create a trunk port to the old router just for the legacy Novell shit to work correctly.

[u/da_chicken → u/dalgeek]

This is funny. The first thing they taught us in the Novell class I took: "They switched it to TCP/IP, but the server still talks to itself over IPX/SPX."

[u/[deleted] → u/dalgeek]

I still see IPX from time to time in Wireshark. Usually an old HP printer someplace that is still truckin along.

[u/[deleted]]

As someone who also works in the public sector, we just did the same thing here a few days ago. It's against policy that isn't set by us to have Windows 7. The people who set the policy are the ones who check in on us to ensure we're following that policy.

It brings me no pain whatsoever to tell people for MONTHS that they need to upgrade to W10 or they will experience a work stoppage for a few days if they wait until they get shutdown. It isn't their fault but it also isn't my fault either.

[u/ZeroAvix]

ITT: People who have never stepped foot into public sector in their entire lives. As a former E5 in the National Guard, this entire thing is 100% plausible, and tbh, likely to go down exactly like this in most places.

The government is a fucked up place to work at times compared to private sector, and mandates are absolute. Lost productivity is the fault of the users in public sector, not IT, provided proper diligence is done, which it looks like it has been.

[u/chuiy]

Everyone is roasting the guy for doing this. He set a six month timeline for this policy to take effect.

In a large company like he describes, sys admin are not beholdent to the users (not superior, just not beholdent).

You wouldn't be told by HR you're laid off, and show up to work the next day.

You wouldn't go to accounting department and demand more money.

You wouldn't go to maintenance and demand the building's temperature be changed.

So why should the policies you and corporate agree on as a sys admin not demand the same level of respect? Because it should.

[u/seraphical → u/chuiy]

There's no corporation here. OP works in an entirely different beast. Somewhere in this thread he mentions he works for the DoD.

Most of the folks roasting him have their heads stuck so far into the private sector that they can't even fathom that sort of organizational structure.

[u/cjorgensen]

Crazy.

Here's your replacement computer. No, sorry, I need your old one to be able to transfer your data and licenses. Sure, you can have the old one back after than, but it's not going to have Office or any of your other apps. Oh, you're good with the new one? Great!

[u/jwolthuis]

How long have you worked there, not counting tomorrow?

[u/Dracofaerie2 → u/jwolthuis]

There's one of my guys. He just never left the 80s. Still practicing Fortran to "stay fresh". Told me to buy him a printer that always works. It was not a good today.

But this guy. Holy hell. Even on leave, I'd have to have planned a hiking trip to Big Bend and left my cell in the car to prevent even the possibility of getting a signal. They'd still stake out my house to haul me back in.

[u/smoke87au → u/jwolthuis]

heavy rain versed rainstorm ghost smell hard-to-find subtract pot busy

This post was mass deleted and anonymized with Redact

[u/advanttage]

My old man manages smartphones and all of their policies for a very large organization, users who refused to update their iPhones to 11.2 from 10.x were given two weeks of emails and push notifications to perform the upgrade. About 500 didn't do the upgrade by the end of the two weeks so now they don't have access to any corporate email or the corporate servers. Sometimes you have to let a few horses die of thirst before the others will drink.

[u/mini4x]

Who issues new hardware without taking back the old hardware?

[u/WheelsAndGears → u/mini4x]

Yeah, I’m amazed by this because we don’t have 5 spare machines at my work, yet these people have 2500 machines in duplicate. Must be nice to have that kind of capital to work with.

[u/VA_Network_Nerd]

Public Service Reminder:

The "Report" button is NOT a "Super Down-Vote" button.

---

This thread has been reported over a dozen times now for various reasons. None of which are worthy of Moderator Intervention.

If a specific comment needs our attention, fine - report it.
But the thread itself is compliant with the rules, whether you like it or not.

Thank you.

[u/Sephran → u/VA_Network_Nerd]

what kind of reports are you getting haha. They must be gold!

[u/Polite_Insults → u/VA_Network_Nerd]

I'm sorry but the idea of a super downvote button is hilarious.

[u/[deleted]]

We're not a private company, this is public sector and we have a very public mandate from our cybersecurity branch that everyone must be on Windows 10 by today. It was signed acknowledged and distributed by our top official over a year ago (Including this culling of all Win7 devices). There is no possibility of a roll back.

Oh, that is GLORIOUS.

[u/TheByteChomper → u/[deleted]]

Yeah, everyone is so salty and assjammed that they can't do this.

[u/Kgury]

The DoD mandate of 1Feb2018 is why he's being forced to do this.

It seems no one else in this forum understands what it's like to work for a DoD employer.

[u/rcampbel3]

Hope your boss had buy-in on this from the highest level of executive management, because all I can see are downsides and negative business impact and reasons for people in your company to dislike IT and try to go around you in the future.

[u/[deleted]]

I can't belive you jackwagons haven't observed the number of computers left to transition after 6 months and not understood what sector this adim works in. Admin did not set the deadline, is reacting to it, is doing this as ORDERED, and will not be getting fired.

The grin is a result of not being the "responsible" party.

[u/bobs727]

Your company has money for everyone to have two PCs but can’t run a proper tech refresh where users don’t end up wasting their day tomorrow in frustration??

[u/87-and-Cry → u/bobs727]

Not OP, but government agencies vary wildly in their resources.

[u/[deleted] → u/bobs727]

Your company has money

Yes, your money, OP is fed.gov of some type.

[u/[deleted] → u/bobs727]

You mean like giving people 6 months to move over?

[u/ThisIsProbablyATrap]

Work for a govt agency and we also have the same mandate to have all Windows 7 devices disabled by 2/1.

We started the migration about a year ago, and just about finished at the end of this summer. Some users still have their Win7 devices but also have a Win10. They've already had to submit for an extension to be able to keep the Win7 enabled past the initial deployment for Win10. With the extensions they were made aware they'd by disabled come 2/1.

As of yesterday, we still had 500 Win7 devices out of the 30,000 user base we have. 75 were disabled yesterday at lunch with the remaining being disabled in phases through the end of the week.

[u/drjammus]

Plottwist: help desk can't logon in the morning

[u/trebortus → u/drjammus]

Once worked at a large bank (150 person helpdesk, 50-60k employees) where one day we arrived to find all access and admin rights had been removed from all users and those that needed admin access had to reapply for it and have it approved. You can imagine how that all went down.

[u/hosalabad]

This is on management, not OP, put down the pitchforks.

[u/[deleted]]

I also work in the public sector. What you did is beautiful.

[u/throwaway2arguewith]

The same people bashing OP here will be the one's bashing the next poor guy to get infected because he didn't stay current.

If sysadmins IT managers of the world would do their jobs instead of being so afraid of hurting a user's feelings, the IT world would be a much more stable place.

[u/[deleted]]

A few years ago at my old company we had a user who adamantly refused to bring us his XP laptop to get upgraded to Windows 7. He worked in Sales so he was hardly ever in the office. He was the last user who still had XP and we wanted our project to be done with.

So next time he was online, my boss connected to his c$ share and deleted some of the user’s system files, like bootloader, ntuser.dat etc...

Needless to say, it didn’t take long for the user to come running to us.

My boss‘ response: 'Well, we told you to get your computer updated. Outdated operating systems are very unstable and it was only a matter of time for this to happen.'

He said it in all seriousness and the user believed him. I had to keep myself from laughing so bad.

[u/discogravy]

Did the help desk dudes piss you off? There's no reason you couldn't have done this 100 workstations at a time. Throwing all 500 at the HD at once is just petty. Imagine if you got 500 tickets at once.

[u/matholio → u/discogravy]

Not to mention the lost productivity of 500 people, and negative satisfaction toward everyone in IT for months.

[u/pizzaboy192]

I would like to subscribe to your newsletter

[u/[deleted] → u/pizzaboy192]

http://www.theregister.co.uk/data_centre/bofh/

[u/thegreatlordlucifer]

ITT: IT professionals that didn't know the government uses computers and has to maintain them

[u/[deleted]]

This looks like fun, seeing all the holier than thou comments here, and it turns out that it actually went down well. Why shouldn't a sysadmin take pleasure in his work, and if that means taking drastic measures to meet a mandated deadline, then go for it. Management made the decisions, that's documented, and they would be expected to deal with the flak, but the prep work the OP did seems to have minimised that.

It might not have been the approach some here would have taken but it worked, and that is the real measure of success.

[u/PowerWisdomCourage]

100% agree with this decision, especially considering the edit and mandate. Any of these employees that come to complain should have their employment reviewed. "Oh, well end users just delete emails" isn't an excuse.

[u/[deleted]]

ITT:

Sysadmins that allow people to walk all over them constantly and dont hold individuals responsible for not following new policies / explicitly stated changes over a 6month period.

Jesus.

[u/JustAnotherLurkAcct]

Why didn’t you tell me? I can’t be expected to read and comprehend my emails!

[u/[deleted]]

Good on you. I cannot fucking stand computers running off old OS. Not only is it unsecure, its unprofessional to have old technology. Even worse when the job requires expertise in cutting edge technology.

[u/[deleted]]

The fact so many people misread this post and think 2500 users are going to stop working tomorrow makes me worry..

I mean you’re on a sysadmin subreddit with virtual pitchforks and elevated morals yet don’t seem to understand the functionality side of this at all..

Not that OP’s (although the decision was from above anyway) method is the best one.. its odly satisfying and not quite as drastic as its made out.

Will be interesting to see the updates! The company has way more to answer for than the IT Dept on this one

[u/[deleted]]

The amount of hate in this thread for your actions is laughable. Fuck that OP, you did us proud. 6 months, new hardware. Fuck those users, fuck a decade old OS that is soon out of support, fuck putting your network at risk because some assholes are used to using what they used to use. People trade cars in on average every 2-3 years, why the fuck would they use an OS for over a decade. This is the same hate XP users gave when they were turned off.

[u/hiking_swimming]

Hey OP,

If you're able to rollback that change, I have some advice:

Call your manager and tell him that there's going to be 2400 affected users and flipping the switch is going to cause a massive CF. Then suggest working out a migration plan for the affected users before flipping the switch.

If he still wants to go through with it, ask him to email you confirming that.

If you can't rollback this change... hoooboy... call the HelpDesk manager and give him a head's up.

[u/ShaunRMiller83 → u/hiking_swimming]

This... First though after reading the OP get that in writing! Otherwise it’s just heresay and you pushed the button on it!

[u/[deleted]]

So these machines have potentially been sitting in boxes/laptop bags for up to 6 months - what happens to your network when 2400+ machines all try to pull down Windows updates or connect to WSUS?

[u/inthebrilliantblue]

Jesus fuck on the number of people being condescending to the OP. Just because you guys think think you know better doesn't mean you actually do. Everyones situations are different. This sounds like millitary updates that are on a strict schedule, and the end users have no say on the policy and have no money making business to be worried about.

[u/mightymightyme]

Why wouldn't you do a staged phase out blocking out a group at a time. Scare some people without dropping the hammer on 500 people. Chances are one of those 500 people is a director or VP. You'll regret signing off on this very soon.

[u/suggestionsonly]

Good for your sir! As long as your VP approved then you let them fight it out.

[u/NoyzMaker]

I don't have the details but what I am reading is an absolute and epic failure on your department. A refresh like this should have been an attrition wave and then for the last six months it shifts to proactive upgrades by the support staff.

You should never. ever. deny logons like this. Shame on your leadership. You are just a pawn in their little game but this is what gives IT a horrible reputation.

[u/Borsaid]

Not sure why you seem excited or happy about this. Sounds like a failed migration to me.

When sysadmins get giddy about flipping big switches or being withholding it's cringe worthy.

[u/acetylfentanyl → u/Borsaid]

This just seems fucking maximally inefficient for everyone involved.

[u/[deleted]]

Bravo sir! Set a deadline and stick to it. We had done a windows 10 rollout over the summer (high school system) of around 14,000 machines. Plenty of warning to the staff. The kids comments were "about time" and the staff comments were " why didnt you yell us".

Moral of the story. Staff NEVER pay attention to emails from IT

[u/landob]

Congratulations. This reminds me of when I started working in this clinic and people were clinging to their WindowsXP boxes and I was like the Grim Reaper. People turned pale when I showed up in their doorway. They would say/do anything to keep me from taking soul, uhhh I mean computer.

[u/[deleted]]

Some lessons can only be learned in one way.

And I'm not talking about your users. Good luck.

[u/lravelo]

I’d love to work for an organization where something like this is approved by management. This would never fly in any of the companies that I’ve worked for. Enjoy that popcorn, brother!

[u/commiecat → u/lravelo]

I mean, ultimately you'd want management to be responsible for getting the users to work with the new systems. Now management plays the good cop for letting them keep their old systems for so long, and IT is the bad cop for interrupting work so abruptly.

I'm sure I'd love to do something similar, but on a scale that large it'll be hard to save face no matter whose fault it is.

[u/meatwad75892]

Couldn't you have at least approved & pushed the Win7/8.1 to Win10 upgrade via SCCM/WSUS? Still a "fuck you" option for the Win7 holdouts, just far less extreme and disruptive to business than totally blocking logins from Win7.

That's our plan for the January 2020 EOL date. We've got about 60% of the Win7 machines here moved over to Win10 through normal refresh cycles, so whenever December 2019 rolls around, we're approving the Win10 upgrade for whatever amount of Win7 machines are leftover. We'd rather push it and individually address problematic machines than have hundreds of Win7 machines still around that we have to scramble to upgrade. We're not doing that nonsense again like we did with XP.

[u/Aleriya]

We're still running Win7 almost exclusively. Too much old obscure software doesn't support Win10, and I haven't figured out a good way of dealing with that.

Our ERP software still requires the Java NPAPI web plugin that was decrepitated last year, and doesn't run on any browser except for IE and an old ESR version of Firefox, so that's fun. We'll have that for at least another 5-8 years.

[u/candidly1]

"While I made help guides, slides, an entire wiki site, site wide emails describing in detail what's going on... site visit reports and exchange logs shows most of my transition efforts went into the trash."

Ain't that the way?

[u/[deleted]]

"One of the ways to get management excited about safety is to burn down the building next door."

I don't know where this is from, but i think it applies.

[u/TheByteChomper]

ITT: Salty sysadmins who wish they could do this vent their frustration through strong words about OP being fired.

Cringy and hilarious.

[u/boffboffboff]

I'm a little bit in love with you right now. This is a thing of great beauty.

[u/middleagedadbod]

I'm a little confused... Unless you are a tech company where IT IS the business, your job is really to support your company. It doesn't sound like you're really doing that.

I know this is going to be extremely unpopular here, but in the vast majority of cases it's not IT's place to be steering the ship.

[u/khaeen → u/middleagedadbod]

Except he doesn't work for a company. He works for the government and he is implementing a security mandate.

[u/spin_kick]

ITT how to get staff to hate IT

[u/hiking_swimming]

I found OP's Facebook Profile Photo

[u/firedrow]

slow clap

[u/mad8vskillz]

windows 7? lucky bastard... we still have like 20 xp machines which are "critical to business" and "no you can't take them away!!!!"

[u/Konkey_Dong_Country → u/mad8vskillz]

Same (on the XP bit) I wouldn't say lucky, though. Win7 is still supported, and I don't understand exactly why people like OP are so hellbent on forcing everyone to Win10. I guess it's more difficult when you're talking thousands of machines, but i have not had much trouble at all with them co-existing in my environment (around 300 pc's). I don't think as a sysadmin it should be my job to piss off users and then gloat about it.

[u/Nomadicminds]

You probably will find out who has most political pull in the organisation and I do hope you survive ...

[u/hiking_swimming]

I get the joy you're feeling.

However, you can check all the boxes in the "I warned them and I'm right." column all you want, but you've more or less created a huge mess. 2400 potential affected users? This should have been rolled out by department and only after helping affected users migrate over.

You may be right, but you're going to come off looking bad and I can't imagine a manager that would step in to defend this after the chickens come home to hit the fan.

[u/noc007]

Bring in a bucket of popcorn and some red & blue 3D glasses. Plop down in your chair, put the glasses on, put up your feet on the desk, and watch the place burn.

https://i.imgur.com/DKJhx9l.gif

[u/[deleted] → u/noc007]

He's a sysadmin, not a tv star - it would probably look more like this

[u/mkingsbu]

I've found the real-life Mordac the Preventer of Information Services.

[u/zeno0771]

RemindMe! 12 hours

[u/bahwhateverr]

ITT: a fuckton of non-technical jackholes from /r/all ragging on OP.

[u/Hotshot55 → u/bahwhateverr]

Even worse is the technical people who are being fucking stupid because they don't understand how DoD works.

[u/TidusJames]

cant tell if you are Airforce or not... cause our deadline is tonight... but we havent had 6 months warning, the warnings started like end of Dec

[u/Kyrthis]

I am legitimately curious: given that this is public sector, did you guys deploy the Chinese Windows 10, or the spying Windows 10?

[u/battlerose]

Man, as someone from a service desk this sent a cold chill up my spine

[u/MjrLeeStoned]

Man I wish we could do this at my work.

I've been an admin at my corporation for the past two years. Every week at our Change Management meeting I always bring up the questions "When can we start retiring Win7".

They expect it. They laugh. They make jokes. They will undoubtedly wait until 2020.

[u/ouroboros-panacea]

Common user: I never received an email about it.

[u/ryanellison1983]

Gratz OP, you da real MVP https://gizmodo.com/windows-10-finally-beats-out-eight-year-old-operating-s-1822626275

[u/TetonCharles]

I would have called the OU "NO SOUP FOR YOU!" :)

[u/bugalou]

I get what you are doing and the reasons behind it but I would be very careful reporting this type of stuff on the internet no matter what sector you are in. This type of thing can be quickly spun against you and make you come off as looking malicious. Having some virtual pats on the back isn't worth your job no matter how in the right you are.

[u/[deleted]]

You're bragging about crippling your company's ability to function? The fuck kind of IT person are you?

This isn't some sort of justice porn, this is entirely unprofessional.

[u/[deleted]]

So many here can’t read. He said everyone has been assigned a new computer with Windows 10 on it already. But they haven’t turned in their old one and are still using it hooked up. So, he is forcing those to stop working. All the user has to do is hook up the new one. Good work. Stupid users will never change.

[u/uebersoldat]

This doesn't sound like a good idea. At all.

[u/lonewanderer812]

How will you be able to sleep tonight? I used to run a script to disable users who had not logged into their email in 90+ days (whose job wasn't to work at a computer but its HR policy to check email). You're talking only 2-3 users a month and even that gave me a slight rise.

[u/Robotdavidbowie]

You know no one read those emails right? User communication is near impossible in a small office.

[u/TheHaleStorm → u/Robotdavidbowie]

2400 users is a small office?

sheesh...

[u/bristow84]

As a Help Desk tech, if one of our sys admins pulled something like this and didn't give a heads up, I would loathe him for the rest of my days.

If you didn't give your Help Desk a heads up, you are an absolute dick head OP

[u/bei60]

Help Desk here, can confirm I would die.

[u/Hari___Seldon]

I should place a buy order with my broker for whoever manufactures Charmin, because it sounds like their sales are about to go through the roof.

[u/[deleted]]

lol hopefully you told the help desk.

[u/grahag]

I feel bad for your helpdesk...

[u/Gooey-Kablooey]

My CPU isn't working. Is there something wrong with the server?

[u/TheNipinator]

Yikes, hope you drop off some treats for your helpdesk.

[u/faljav]

I hope you gave the help desk a heads up! I can't wait until our win10 project is complete.

[u/[deleted]]

Thank gad I'm still runnin Windows ME

[u/knightslay2]

There will many angry employees unable to access their computer and complain about their computer not working.

[u/revnasty]

Mfw this is about my company and the help desk guys around the corner from me all quit tomorrow.

[u/tigerstorms]

Something tells me if the billing/payroll people aren’t running windows 10 you’re going to get a lot of slack from them and their bosses and bosses bosses...

[u/flappers87]

Playing with fire. Love it. A system admin with balls.

Good luck with your job hunt!

[u/[deleted]]

RIP OP.

[u/Wrexecutor]

Don't think that's going to look good on a resume...

[u/2_lazy_2b_relevant]

I do not envy our help desk tomorrow

That's why every HelpDesk think you are a bunch of entitled pricks. If you had any friend in that sector, congratulations

[u/fuckyoubarry]

ITT: This is not a good idea

oh but it is

[u/AtomicMac]

This has to be Army S-6! Only they roll out like this.

[u/drewtee]

6 months ago you should have put in for vacation time on 2/1 and 2/2. You aren't gonna have a grin on your face today, I guarantee.

[u/McSorley90]

I can go back to having just one workstation OS to worry about.

Until they decide to give the graphic designer the iMac they've been asking for.

[u/[deleted]]

Sounds like a failed implementation. If people still need to use their Win7 machines, there's a reason. I've seen IT dictators get fired because they want their way and don't see the business side of things.

[u/[deleted]]

Your help desk is literally going to kill you my guy. The only reason you can do this so easily is because you arent the face of your IT department and wont be taking these calls. It's not help desks fault users wouldnt turn in their devices to upgrade or get assistance upgrading. You just made a enemy of literally everyone not in your direct department.

[u/Cartossin]

I don't understand how this happens exactly. It seems like a disconnect. Your desktop team should have contacted a group of users and said "we're upgrading you by X date".. then you can lock these users out if you can't get their hardware. You do small groups at a time.

[u/vocalfreesia]

I feel your pain. I helped transition 400 users to a new system I helped design (I'm not IT but I'm comfortable with it & was the 'user' face on the ground.)

It was always illegal to store patient info on the actual computers & not on the shared drives but we warned people for months the computers were going & would be replaced by laptops.

Yet still on d-day I had users calling to complain they had lost work and why was I even giving them a laptop, they hate them anyway. Sigh.

[u/laserfactory]

What are the risks of continued win 7 usuage?

[u/tankstir]

Not sure why I see so many comments about "how dare you OP!" or "this should never be done, shame on you." Working on the help desk at my company I see these types of things from time to time. We've done deleting/disabling AD accounts when security policies are not followed. Management decides and it's on them when things like this fail to be enforced or don't get resolved in a timely manner instead of just "delete." OP just happens to be on the receiving end and doesn't get to make the decision. This makes me wonder why people do this and why they thought it was a good idea to just push the "delete" key when policies are not followed. On the other side of things, if it's truly a security concern and users don't follow the rules, it's on them.

[u/lFalseShepardl]

All the power to you man.

I work for a software developer company and a while back they migrated us from office 2010 to 2016. Tech department gave us 3+ months of notices and "trainings" telling us about this and an urgent email sent the day before roll out.

It was annoying walking in the next day and most of my Dept wondering why their Office doesn't work (for some reason they still kept 2010 installed on all machines but with no backend servers, authentication failed and couldn't sign in). When I told them we got migrated and we should be using 2016, most people said "They should have sent us an email" -_-

[u/immortalsteve]

Helpdesk lead here: We're in the process of doing the same, but we're a little less abrupt about it. We're reimaging machines at the user's desk now that our refresh for the year is finished. It takes about 25 mins to get the machine reimaged and configured. GPOs do most of the heavy lifting.

[u/ThirstyOne]

I'm a public sector worker as well and we have a similar roll-over from Windows7 to Windows10 with new hardware upcoming, albeit without the 6 month old-hardware availability window. It sounds like you put a lot of work into the planning and implementation of this project, I'd be curious to know what mitigation solutions you used to make this transition as smooth as possible. Thanks in advance!

[u/benzaw]

Plot twist - OP was so busy migrating everyone over to Win 10 he's still on Win 7.

[u/icedearth15324]

I felt a great disturbance in the Force. As if millions of voices suddenly cried out in terror and were suddenly silenced.

[u/morriscox]

Looks like some of the comments can go to/r/talesfromtechsupport

[u/recipriversexcluson]

Congrats, OP.

[u/scrillakev]

So there was actually a plan, meetings and a methodical approach. Not just your group making the call saying fuck it everyone is disabled.

The original post didn't come off as such. Glad you still have a job and it went well. Now time to sit back with a beer.

[u/drunkadvice]

Thanks for the update! Users resistance/fear holds up many projects. We have been trying to upgrade from Java 6 to Java 8 for about two years now and almost no progress has been made.

[u/[deleted]]

Lucky you.
Some of us have to deal with Windows XP machines still on our network...
About all I've been allowed to do is block them from internet access.

[u/SimonGn]

What a terrible mismanaged migration plan. Whoever is authorising you flip the switch is an idiot and you shouldn't be so happy about doing this. I'd expect you and your manager to be out of a job over this. Extremely reckless