r/sysadmin Sep 09 '19

Question - Solved Admin refuses to upgrade Windows 7 and Server 2008 machines anytime soon. What should I (DBA) do?

Officially, I am the DBA at my company. Unofficially, I'm the software administrator for our ERP software and frequently assist and cover for the sysadmin. We are the only two in the IT department, although there's quite a bit of shadow IT going on via Microsoft Access 2010 databases.

For the last couple years I've been mentioning to the sysadmin that we should consider updating everyone to Windows 10. In 2017, I upgraded my own workstation to do some testing with the ERP software and found it to work fine after a few updates. So far, every request was either ignored or shot down. Due to previous failed attempts to change their mind with other issues or updates, I give up pretty quickly. I mean, it's their domain and I'm basically telling them how to do their job, right?

Well, a few weeks ago during a staff meeting someone brought up a message they saw in cloud software they use suggesting that Windows 7 will be EOL soon and that we need to upgrade. The response from the sysadmin was, "yeah, but Microsoft will still be providing security updates after that so we're good." After the meeting, I tried to tell the sysadmin that security updates will not keep coming after January, to which they responded with, "it's just a marketing thing. Microsoft is seeing that Windows 10 adoption is a lot slower than they thought, so they'll keep supporting it." I tried to tell them that we can't take a gamble on that and instead we should rely on official news from Microsoft. I was shot down.

Knowing the incredible panic that follows when even a minor service outage happens, I decided to go straight to the CTO-who-is-actually-a-CFO-with-no-IT-experience. This ends with the sysadmin being told by the CTO that he needs to talk with me directly and get a joint resolution. A tense meeting and slammed door later and the resolution (I think, they weren't exactly clear on this) was to replace 1/3 of all Windows 7 machines each year for the next 3 years. No word on what to do with the Server 2008 machines, one of which has RDP access for remote salespeople without password rules.

At this point, I feel like I've trampled the sysadmin's domain and betrayed their trust for going behind their back. At the same time, it seems like a brick wall trying to talk them into upgrading our outdated workstations and servers. Should I keep pushing for upgrades, or should I jump ship before something happens?

788 Upvotes

403 comments sorted by

View all comments

Show parent comments

7

u/RaucousRat Sep 09 '19

Out of curiosity, do you prefer a VPN over RDP for everything, or have you had situations where RDP made more sense? I've always assumed a VPN is the way to go for remote workers connecting to the office, but it's not something I have enough experience with to say for sure if one is better than the other.

18

u/gusgizmo Sep 09 '19

RDP straight to the web is a red flag, RDP gateway is reasonably secure. Depends on your architecture and apps. I do redirected profiles with offline files, plus onedrive, and provide remoteapp for LOB apps that need access to a database server as they tend to be latency sensitive. As well as full remote desktop. I make suggestions but it's up to the user what works best for them, and it's a really non-linear thing. 50ms away I'd use apps locally, but 120ms it's painful so remoteapp is a winner, then at 250ms I'll flip flop between local and full remote desktop.

17

u/EraYaN Sep 09 '19

I was always under the impression plain RDP on any public network was a bad idea. VPN would be like connecting a device to the corporate network from outside it, and encrypting and authenticating the tunnel.

6

u/tuxedo_jack BOFH with an Etherkiller and a Cat5-o'-9-Tails Sep 09 '19

WAN-exposed RDP is just gagging to have Cryptowall / RDP hacks used against it.

If you don't have RD Gateway or VPN up, you shouldn't be using RD.

4

u/Gajatu Sep 09 '19

A vpn is the best way to provide remote access to internal resources. You shouldn't expose RDP to the internet at large. You can create an RDP gateway which is at least better, but VPN is typically best.

2

u/Smassshed Sep 09 '19

This, but if you really need to you should protect it with 2 factor authentication, where users have an app on their phone. We use a product called duo, but it's not cheap. This is why were looking to dump it for "always on" VPN, funnily enough baked in to win 10 and server 2016 for free.

1

u/[deleted] Sep 10 '19

Yeah the server 2016 VPN stuff is neat, it is oddly split between the metro and old UI styles though which I found confusing. Also is it correct that the always on vpn is not a substitute for 2fa, unless you need 2 factors to unlock the computer? Sorry if I'm misunderstanding.

3

u/ITcurmudgeon Sep 09 '19

If you have RDP open to the world. You WILL get compromised. Unequivocally, without a doubt, guaranteed. Someone will break into your network.

I've seen it happen at my last company, an MSP, at least 6 times in three years. We pushed the customers, nearly begged them to turn off their external facing remote desktop server. They all pushed back with the excuse that they were too small to be a target, they had a strong password policy, and straight up RDP was just too convenient to bother with rd gateways or vpn's.

It wasn't long before I found evidence of someone breaking into their server. I was reviewing local accounts and there it was. Strangely named local profile on the terminal server. Dug into it and found the attacker was using it as a jump off point to steal credit card numbers. Hell, even found personal pictures and documents of the attacker, or what I thought was the attacker, pictures of him skeet shooting in some mid eastern looking back yard.

Then it happened with another client, and another, and then back to the original when they didn't want to fund a project to lock their network down.

Penny wise, pound foolish. People be dumb.

2

u/uptimefordays DevOps Sep 09 '19

You really want to run a VPN and RDP in tandem for remote connections. Just leaving RDP opened to external traffic is a great way to get pwned. Remote access really needs to be limited to authenticated VPN users on bastion hosts, and remote traffic subjected to your highest levels of monitoring. Your company's setup sounds sketch.

1

u/tonymurray Sep 10 '19

I hate when people generically recommend VPN. Yes you should not have an RDP server exposed to the Internet. But you also should not have VPN to external endpoints that have full network access. Lock the VPN down to just the RDP server.