So, drilling down to AD for a second: Is the security architecture of Orchestrator such that it impersonates the user making a request, or does it run in its own security context? I'm wondering if it could be a suitable stand-in for something like Quest ActiveRoles Server.
System Center has a whole concept of "run as" accounts. So each "connector" - like to SCCM, SCSM, AD, or something like a Cisco ACE, runs under the context of that specific runas account
So you can grant unprivileged users the ability to run runbooks that execute as a separate account with higher privs
Perfect for things like having helpdesk provision guest wifi account (after you sell them ISE, of course) :)
You can also have multiple connectors to the same resource. So you can have multiple run as accounts that have different privilege levels, so that if there's an unexpected condition in a runbook, you don't trash the whole directory
Overall, would you say that the SCSM and Orchestrator products are built with sane assumptions and limitations in mind? (That's always been an annoyance for me-- some versions of some Microsoft products have been hampered by design limitations that seem arbitrary and "very close to 5 o'clock on a Friday".)
Yeah-- let's go remount this and start over.
DPM 2007 had that feel, for example, of being hampered by its design.
The upper-bounds for SCSM (in a 5-6 server deployment) are over 250k computers objects, and 100k tickets per month in the CMDB
Of course, that would take like 6-7 servers
And the minimum sized install is 3 servers, minimum 4 cores 8GB RAM
so it's a bit of a pig
but it can scale huge
and Orchestrator can have multiple workflow servers, so that if you find one server isn't able to keep up with all of the workflows, you just add more workflow servers and call it a day
That's not too hateful of a minimum today. I assume MSFT doesn't care whether the boxes are physical or virtual, so long as you've got the I/O, CPU, and RAM to handle it.
@Adrian - Oh, yeah. Half-baked features are the best.
SCSM definitely has some rough edges, especially around user notification when things like escalations or ticket reassignments happen, but people have written custom management packs to get around that for now
and MS has those fixes on their roadmap for the "R2" release, from what I understand
@EvanAnderson Especially when written by harried, brow-beaten Devs whose PMs are too busy dick-waving or politicking. That's the biggest problem with MS Corporate for the past few years: they've embraced Agile & DevOps but put the PMs in charge of all the decision making instead of letting Devs fix what they break.
MSFT's internal culture and organization has always mystified me. It has never sounded like a tremendously nice place to work. Too much politics for me.
@EvanAnderson And honestly, how long would a user creation workflow take to run? 90 seconds? Create an account, provision for exchange, provision for lync, add to $groups, create user's network folder and set NTFS ACLs, email manager about account creation.
I have yet to see someone big enough to need more than one workflow server
@MichaelHampton - Oh, I'm sure that it didn't. When you hear the really old-school employees talk about MSFT they speak about it fondly. Bigger isn't better, to me, in terms of employee satisfaction. The larger a company gets the more caught up in their internal bullshit they become. I love being a contractor... >smile<
@MichaelHampton He's been there from the beginning. In fact, I think he was working there before the IPO, iirc. But yeah, no other company would tolerate his performance-level for this long.
@MDMarra - You've definitely got me thinking about SCSM and Orchestrator. I'll let you know if I start scoring some large scale gigs because of them. >smile<
@MichaelHampton Sounds about right. If you believe Paul Allen's story, he was in on the deal that cut Allen out of about 10-20% of MS' net worth at the time.
@EvanAnderson The angle we've worked is get it in for service and change management with the self service portal. Let them keep RT or Remedy for incident management. You'll get a call in about 15 days wanting to know when someone can come out an evaluate moving the rest of the way
I still have 12 years to go before I'm allowed to do such a thing, and by that time it will probably a capital offence to own a car with a displacement above 2 liters
While we're enjoying our teleporters, we'll be checking @Adrian and @ewwhite into a nice quiet old folks home and listening to stories about how they used to do systems automation before systems did system automaton
Tech Blog is back up. It was my mistake, I misconfigured the Xen host and that guest, preventing it from starting correctly. On the plus side, it loads quite quickly now.
Joel Salas Software Engineer, Infrastructure Automation
$job[-1] really kind of cherished publicly-admitted failures and acknowledgments of the lessons learned. I kinda miss that place, just not the crazy schedule.
@MDMarra You and all of your highfalutin Microsoft toys are operating above the level where the majority of the business world exists. There will always be a place to bring basic technology to small businesses.
@JoelESalas First time I ever took the blame for something with one of our new clients, they almost died with appreciation. I believe the email went something like "Mark, thankyou for being honest. Sal (previous guy) woudl always spin up some bullshit story about how it's not his fault and it's because of someone elses mistake. It is refreshing to be spoken to honestly and frankly"
@MDMarra So I have this client..., and they are so far away from the stuff you're doing, it's not even funny. As I said, they're still on Windows 2003 and expanding into a new infrastructure; on Windows 2003. I don't think companies have the staff/knowledge/training to deploy cutting-edge Microsoft technology.
your senior people tweak and poke at it, keeping it current. the managers do the approvals for the requested actions. each department's managers make the actual requests
Think of all of the time you save to train someone to use a system like that when they don't have to deal with account maintanence and other menial tasks
@MDMarra this is what I've heard about Sharepoint so many times. But the thing is: you need people implementing it and people keeping it alive. For both you would need a lot of money upfront, only with the hope for the best. There are a lot of businesses which simply do not work this way. Apparently like @Cole's.
@syneticon-dj The thing with sharepoint is that it's a constant time investment. If you have a good integrator do SCSM + SCORCH it's a time savings the second they walk off the job. That frees up admins to learn how to properly keep it going. Whereas what I've seen with SP is the opposite. An integrator walks off the job and someone drowns trying to keep expanding it
@MDMarra Sharepoint is meant to be self-service too of course. And if you can get enough value out of the orchestrator surely depends on how dynamic your configuration needs to be. If you are fairly static and happy with it (or at least used to it), it might look like it would not pay off
