Stop the Insanity

I see a lot of different things in a lot of different environments done by different Windows and ConfigMgr administrators. Sometimes, I just have to shake my head and press on … because if I didn’t I’d go insane. So, here’s a short list of things that drive me bonkers or at least run away screaming (emphasis on “a” because I’m sure there are many more lists of things I’ve forgotten, have yet to encounter, or are just eluding me at the moment — or maybe I already am insane):

• Admin shares. Drive letter admin shares, e.g., D$ and C$, should only be used for one-off administrative tasks. Using them for anything else, like in scripts or in content source locations in ConfigMgr is a terrible practice. Using admin driver letter share implies that whomever uses the script or location has local admin rights on the target system which should not ever be required to simply access a file on system — principals of least user privilege should always be followed. Also, the permissions on these shares cannot be changed and these shares can be turned off completely by a policy or simple registry value change. Whenever a UNC is required for a non-one off task, you absolutely and always without exception should use a dedicated share where you’ve explicitly set and control the permissions as well as the content.
• Task Sequences. Task Sequences should be used for OSD and complex sequences of tasks. Running a batch file or a simple command line is *not* a complex sequence of tasks and thus not appropriate for a task sequence. For that matter, if you can put the series of tasks into a batch file, you should not use a task sequence. Yes, task sequences are often easier to visualize, but they also require more overhead and are subject to various failure points that a simple package and program is not. Complex conditions on tasks and surviving reboots are two good reasons for using a task sequence; not knowing how to script or create a batch file (or being afraid of them) is not.
• Disabling UAC (on workstations). Almost without exception, every organization I’ve encountered that has disabled UAC has done so because they feel the UAC prompts will annoy or disrupt their users. While the spirit of this statement is certainly worthy, it’s completely misguided and indicates that the organization has no idea what UAC is or does. Basically, if your users ever see a UAC prompt, it means they are doing something privileged; if your users are doing privileged things, you’ve got much bigger issues. Even if your users don’t have local admin permissions, leaving UAC enabled allows easy elevation by folks that should be doing privileged tasks (like desktop support) when those privileged tasks are required. UAC absolutely is your friend and is completely unobtrusive in normal scenarios.
• Unchecking IPv6. Unchecking IPv6 from the list of protocols on a Windows system does not disable IPv6 and it does not speed anything up. In fact, it will more likely break something. Here’s a great summary post on this topic (although there are others): Should I Disable IPv6? No…. If you still feel you must disable IPv6, then at least do it correctly: How to disable IPv6 or its components in Windows.
• Tab Completion. Stop typing in full path names at the command prompt or in PowerShell — you’re wasting away your life (and mine if I’m waiting for you to type in the path). To get to the SMSTSLog directory in WinPE, type cmtrace  x:\W <tab> \Te <tab> \SM <tab> <enter>. If the directory you need has a space in, tab completion will automatically surround the path with double quotes. Tab Completion is your friend. Similarly, if you are choosing a content location in ConfigMgr, the UI includes auto-completion as you type. Use the arrow keys to select the next folder from the drop-down and then type a forward slash to show the next set of sub-directories.
• Log files. Read them, don’t just look for highlighted red or yellow lines in CMTrace. Not every highlighted line is something fatal or even an error and not every problem is the result of an error or warning. Log files are like maps, simply finding a city on the map is meaningless when trying to figure out how to drive there — it’s a part of the process, but it is only a part. Also, If I ask you to look at a log file, don’t just send it to me, look at read it for yourself first and actually try to troubleshoot the problem.

OK, time for some Karmeliet … Kenny, where are you at when I need you?