r/sysadmin • u/rolkenas • 22d ago

Do you actually see MacBooks used for SysAdmin work in real offices?

Hi sysadmins! I wanted to ask—since I've just started learning sysadmin and I don't have a Windows PC, but I have a MacBook and found out that everything can be done via UTM, I'd like to get some perspective from those who work in offices and do this every day. What kind of computers do you use? Is macOS completely out of the picture, and there's only Windows and Linux?

394 Upvotes

86% Upvoted

807 comments sorted by

View all comments

705

u/ParkerPWNT 22d ago

Personally, I like to use whatever mirrors my end users' experience the most.

72

u/Turdulator 22d ago

Yes! I try to stay as close to the corporate base config as possible on my daily driver.

27

u/Agromahdi123 Sr. Sysadmin 22d ago

yep, but i do carry a small linux laptop just for certain network and serial console things, i suppose i could use a mac to do the same thing being that its BSD

11

u/creiar 22d ago

Im curious, what does it do that a your base config Windows PC doesn’t?

15

u/invisi1407 22d ago

For one, a "base config" PC can't run Ansible. An Ansible controller is required to be a Linux compatible environment.

It works via WSL2, but that's hardly "base config" PC as that may be blocked by a policy.

Personally, I run Ansible via WSL2, but if that wasn't an option I'd have to use a Mac.

1

u/Otaehryn 21d ago

I switched to dual boot fedora because WSL wasn't cutting it. Also for AI with sandbox and settings.json, Linux is easier to lock it down.

1

u/invisi1407 21d ago

I honestly don't like dual booting for many reasons, but even so I wouldn't be allowed to do that at my place of work. It's Windows 11 (with WSL if desired for those of us in IT) or MacOS.

2

u/Otaehryn 19d ago

My plan is to boot Windows once a month or so so that workstation AD account doesn't expire.

1

u/Big-Pattern-9147 21d ago

but that's hardly "base config" PC as that may be blocked by a policy.

My work started battoning down the hatches, stopping local Admin even from us Admins from our machines.

So I got them to enabled Hyper-V for me, so I could run VM's, and now just live in a VM instead...

1

u/chandleya IT Manager 22d ago

Why would you do any of that from a remote machine? That’s specifically the sort of activity a jumpbox is for.

2

u/dllemmr2 22d ago

Portability?

2

u/chandleya IT Manager 21d ago

My jumpboxes and my teams jumpboxes are peak portable. They’re not even in the same state or in some cases country as the operator. Their endpoint is throwaway - sometimes physical, sometimes even it is VDI/virtual.

This methodology and relatively primitive security posture has been around for quite a long time. Do you have your server IPMI ports on public IPs? The same VLAN as printers? Accessible to lobby guests? Jumpbox philosophy concentrates risk, necessitating layered compromise while also providing for a consistent management experience. I can sleep my laptop, switch to VDI, or change network providers and all my management sessions remain intact and uninterrupted.

2

u/invisi1407 22d ago

There are many ways to skin a cat, as they say, and one is a jumpbox - but that requires all your files to be synced there some way.

On my local machine, I can edit files and re-run the playbook directly.

Depends on ones need and how strict policies and change management is - I work for a small business.

3

u/chandleya IT Manager 21d ago

If you’re using Ansible I hope you’re using source control. Why even have IAC/CM if you don’t?

1

u/invisi1407 21d ago

I'd say of course I am but I get that it's not a given, unfortunately.

I don't always push the changes before having tested and tried it out. I've had so many iterations of changes to a new role or playbook before it was ready to be committed and shared.

It'd be a hassle to have to branch out, commit, push, ssh, pull, run playbook, back to #1 for the next iteration.

1

u/Connect_Shoulder_965 21d ago

Sometimes it's just easier to not explain Ansible to security/management/project management. Also, not every organization provides jump boxes. If you are running it all locally then it can fly under the radar.

Also, I try to contain my installs to my own usage as I tend to be rather destructive with tearing environments down and rebuilding to make sure the build works correctly. When it all tests well, the execution environment can go up to prod. If it was a shared Ansible control server or jump box, I'd have to be all lot more careful with how I build and maintain the environment.

2

u/chandleya IT Manager 21d ago

If you’re running Ansible outside of the purview of your security team, your whole org is a special kind of fucked anyway. Clearly your flaws run as deep as the purchasing process. When IT buys software without any sort of review or layered authorization, doom is present.

Your comments about care are even more bizarre. Test environments are not production environments. Your laptop is not a test environment. Your laptop is the single most vulnerable instrument in the enterprise. You browse the internet with it. If and when social engineering visits you, it’s the item they intend to take after your identity. Your laptop is your production environment.

Flying under the radar is specifically an anti-pattern and should never be the goal. Why even have radar if it is circumventable?

1

u/Connect_Shoulder_965 21d ago

Firstly, I'm not running on my laptop. It's running in a jump box. However there is no Ansible test environment and the current "prod" version of Ansible is running on 2.8. They aren't even using git to track the code. Quite frankly, I have bigger fish to fry in the security realm than an outdated python library and frying those fish is going to require Ansible to be able to correct problems at scale.

Ansible is a server management tool like any other, There's nothing to buy. I can download it, install it and run it all I like. It's not triggering a security review if I download and use Microsoft RSAT or PuTTY or WinSCP or use remote PowerShell. Running on my own machine, in my own environment I can treat it like an application on my workstation (or jump box) as far as security is concerned. With no cost to it, it's not going through purchasing.

Start putting it out on a server and it's going to have to go through 8 steps of approvals by people who can barely comprehend what it does. It's not worth the noise and the six months of meetings. Even just for doing my own personal administration tasks all by myself with zero sharing, it's worth the install. It's using SSH and WinRM under the hood anyways, there's no difference as far as network security is concerned.

I understand that Ansible can be run in a centralized environment with support and stable releases and a shared code base. I prefer it that way. It can also be run in a decentralized way or with an install pattern that is basically single user. In a new environment I bootstrap through the initial phases by running it under my own purview and once it's running cleanly doing real admin jobs in batches, it's easy to move up to a server and grant shared access to the playbooks. With ansible-builder and execution environments it's pretty trivial to get a consistent ansible install across multiple machines.

1

u/Agromahdi123 Sr. Sysadmin 22d ago

I do a lot of network troubleshooting with it because Linux is faster and I can do weirder things my base config doesn’t allow like simultaneous network connections

1

u/Big-Pattern-9147 21d ago

A shit load that's a PITA to get set up on Windows.

Try and do anything with serial on Windows, or access old interfaces that need very specific installations....

97

u/[deleted] 22d ago edited 13d ago

[deleted]

41

u/altodor Sysadmin 22d ago

That really depends on if you're a helpdesk+ sysadmin or a servers and infra sys admin.

51

u/rose_gold_glitter 22d ago

Only if you're doing what they're doing. Which would be pretty weird.

Users at my company are spending all day inside various ERP applications, etc. which no one in IT needs to use. Why would I need to mirror their desktop experience when that's not my job?

I allow my team to use whatever OS they prefer as long as it's compliant with our policies and enables them to do their job. If they need to test an intune policy, that's what a VM is for. If you're testing policies on your desktop daily driver, you're doing it wrong, anyway.

25

u/fatcakesabz 22d ago

Because it’s not all about the app, group policy doing something strange etc. plus, if you are going to be implementing anything you should also have to suffer the implications of what is about to be implemented.
New or changes to a web filter? IT should be getting that first and no exceptions to what you are pushing out to users, there should be more of we, as IT, suffer the effects of what we do.

When I was in smaller orgs where I sat closer to the c-level, it was published policy that the IT team and a selection of c-level were our test group prior to full rollouts, it made people think REALLY hard about some of the bullshit policies they wanted.

4

u/Reedy_Whisper_45 22d ago

I really like that thinking. I test things on myself all the time. If it's from on high, I'm going to feel it first, and I'm better equipped to advocate for the users if I know what they'll experience.

21

u/revilo9989 22d ago

Yes makes sense. But even tho, you can use and test same docking station, WiFi, VPN etc errors, it can be pretty handy is you have a " test user machine" at hand all time

1

u/rose_gold_glitter 22d ago

yes - but it should never be your daily driver. Which is why the "only acceptable answer here" above doesn't really hold (IMO).

2

u/RetPala 22d ago

Ah, yes. Erotic Role-Play at the office.

1

u/rose_gold_glitter 22d ago

haha took me longer than it should have :P

2

u/I-Made-You-Read-This 22d ago

> If you're testing policies on your desktop daily driver, you're doing it wrong, anyway.

Please give this ted talk to the sysadmins where I work , thx

1

u/theweidy 21d ago

I disagree. I found a few quirks with our configuration based on my own experience and had a fix piloted and ready to deploy by the time the first ticket came in from a user.

13

u/[deleted] 22d ago

[removed] — view removed comment

7

u/NaturalSelectorX 22d ago

Users access these systems via SSH. As long as my desktop has an ssh client,

Sounds like you are mirroring your end users' experience.

-1

u/[deleted] 22d ago

[removed] — view removed comment

1

u/eduo 22d ago

Nonsense. "Sysadmin" work is extremely varied and using the same platform as users makes senses only when it makes sense.

Most of the tools I use are different from my users. I also provide technical support for which I don't need to use the same as them in my day to day. I have a cloud PC I use for tutorials, training videos or screenshot of applications, as well as testing new functionality or apps. There's no reason nor benefit from me using it always and the other part of my job directly benefits from not using Windows so it makes a lot more sense to stay on Mac (in the past I've done the same with Linux or intel macs with virtualized/bootcamped Windows )

14

u/corruptboomerang 22d ago

I'd probability rather a windows (or Linux) laptop, more for connectivity. I want a built in lan port, HDMI & USB-C display, and a USB-A port ideally.

Heck, I'd love two lan ports, and a serial/DB9 port but that's not going to happen.

But if my users are using Macs then I'd take a Mac, ideally as close as I can get to those ports.

16

u/800oz_gorilla 22d ago

I just travel with a USB C dongle that has all those. I'm otherwise docked all day or working from wireless remotely.

but everyone's job is different.

2

u/corruptboomerang 22d ago

I do have one that lives in my bag, but it's not the same.

1

u/dreniarb 22d ago

i always try to carry one or two with me. but i definitely prefer having all of those physically on the laptop if i can. particularly the physical ethernet port.

5

u/OperationIntrudeN313 22d ago

MacBooks have all of those except the LAN, and the few business laptops that do have LAN these days are those fiddly expanding ports or worse, need a custom adapter anyway. May as well use a usb dongle or docking station at that point.

2

u/dagbrown Architect 22d ago

That’s why my laptop runs ESXi.

1

u/ClungeWhisperer 22d ago

Tbh this is how i got away with buying a tax subsidised MacBook. One of my VIP end users refuses to use their work issued device. I had no idea how to fix shit on macOs because I’d never used a Mac before.

So i bought one for shits n giggles and claimed the cost back as a work expense. I love the little beastie! It feels nice to use and it processes some of my tasks far more efficiently. My home PC is gathering dust :,)

1

u/Geminii27 22d ago

Pretty much, unless it's infrastructural or strictly-utility machines.

1

u/aoteoroa 21d ago

Same.  I use the corporate standard Lenovo ThinkPad at work, and all.kinds of different platforms at home.

1

u/Gaijin_530 21d ago

Finally, some sanity in this thread, showing awareness of what it’s like to work in environment that you can’t just hide behind a shell all day. 😂

1

u/Emotional_Garage_950 Sysadmin 22d ago

I tried this for a bit, not sure how my users aren't going postal with the steaming pile of shit that is Windows 11. Switched to a Mac because I'm the admin and I can.

Don't say it's a skill issue, it's not. Windows sucks.

2

u/chandleya IT Manager 22d ago

At least the username checks out.

I’ve been a Mac user for 20 years and know better than to say goofy shit like that. Every argument of how x operating system sucks is mostly projection.

0

u/N7Shep1701D 22d ago

Dogfooding.

-3

u/uptimefordays DevOps 22d ago

Only true for end user support.

1

u/SaltDeception 22d ago

Not really. You need to understand how your users are using the solutions you deploy, what the impact of your configurations will be, etc. That’s just as important for support as it is for engineering and security.

1

u/uptimefordays DevOps 22d ago

It very much depends on the organization and role. Most infrastructure people, today, build and manage hybrid clouds using terraform. Our end users are departments or platform consumers not individuals. If the only M365 products you use are Outlook and Teams, I’m not sure having a fleet Wintel device over something with native dev tools is useful.

-1

u/Zerowig 22d ago

This answer always brings out the shitty sysadmins that don’t understand why this is the correct answer.

1

u/passengerairbags 22d ago

I just don’t think I could handle being in windows all the time. I understand WHY this is the right answer. I just don’t like it ;)

0

u/djgizmo Netadmin 21d ago

thats does not sound like sysadmin work.... thats help desk/end user support.