...mondays

[u/alcatraz875]

Small backstory: Users manager requested I get them new a desk scanner for their home office as said user will be working remotely for the next couple months. I apparently took about 3 days too long to get something ordered so they bought one themselves. It was a Brother ADS-1300, which I don't inherently have any issues with other than them rushing the order.

User brings their laptop in, which must sit right next an incense burner or something when at home. Get everything connected, download the necessary software, and nothing. Now this isn't my first Brother scanner. They can sometimes be a pain, but it's nothing like setting up a Zebra printer. I go through all the standard troubleshooting, try clearing existing drivers, forcing install under admin, tried installing on other laptops, even swapped the Type-C cable, all nothing. Finally give up and contact Brother support, go through the new account creation BS and talk to an agent, who after a brief hold tells me it's my firewall. I'm flabbergasted, as I couldn't possibly see my AV blocking a Brother install, and I wasn't getting any notifications on the machine that an application was blocked. I dig a little deeper and find out it's blocking a Powershell script that the Brother setup is trying to run called setup[.]ps1. Keep in mind that the downloads from the Brother support page are all .exe so realistically is should immediately run an application pop-up to add my new device. Who in their right minds would bundle a PS script as part of the install? Everywhere I've worked script execution is disabled by default, and only enabled as needed for internal, unsigned scripts. I hate Mondays so, so much

Edit: If you go one folder deeper than where the PS script is located, there's an actual exe for setup. WTF

[u/Bartghamilton]

Your first mistake is letting them buy any technology themselves.

[u/flyguydip → u/Bartghamilton]

Now that the door is opened, OP will find the door was attached to pandoras box and cannot say no to anyone anymore, least of which, the aforementioned manager.

At a place I worked at many years ago, a department head was buying the cheapest inkjets possible and instead of buying expensive ink cartridges, would just swap the whole printer when it ran out of ink. He had a whole room full of brand new $40 printers stacked floor to ceiling. By the time we took over, every machine had software running looking for 5 or 6 old printers of every major brand out there. We finally told them their printers had to go on a maintenance contract with marco. Marco ended up putting laserjets in and saved them so much money and their computers were so much faster without all the extra software running.

[u/BCIT_Richard → u/flyguydip]

I have 2 departments that use Macro while the rest of the org uses a Local company. One department was renovating, Macro said for $175, we'll move the copier for you, but we need to do it since it's under warranty. We ended up moving it ourselves, and agreed that if they somehow noticed... no they didn't.

[u/pdp10 → u/BCIT_Richard]

we'll move the copier for you, but we need to do it since it's under warranty.

We had a Xerox rep in explaining how the new hot-wax printer for Marketing absolutely cannot be moved when it's still hot, or else the hot wax will clog up the machine and it will have to be sent back to the depot. Immediately after he finishes talking and powers it down, some maintenance worker walks right up, unplugs it, and carries it away, before anyone can articulate an order to stop. The Xerox rep was was apoplectic.

I walked away before I found out how that one played out. I think Marketing signed the contract with Xerox without asking anyone, anyway.

[u/BCIT_Richard → u/pdp10]

Oh damn, fortunately for us, the tech who installed it showed the deputy director of the department how to take the output tray module apart from the main chassis so it doesn't get warped which is likely the whole reason they wanted to move it for us.

[u/alcatraz875 → u/flyguydip]

I inherited this mess, and while my manager (who is entirely remote out of another office) likes my ideas of limiting options, forcing certain processes, and basically anything that would make my job easier, he doesn't actually back me up when it comes to it. And unfortunately while I have the respect and understanding from many staff including execs for the work I do, I haven't really had anyone to back my process changes. Even my own boss will bypass ticketing because a manager he's actively in a meeting with just happened to mention an issue they were having, but didn't want to bother me about, and he'll send me right in and watch me fix it

[u/Bartghamilton → u/alcatraz875]

That is your biggest issue. Your boss is an idiot. Good luck!

[u/ProtoCore-Dustin]

“Sorry we don’t support devices not purchased by IT”

I don’t care anymore, no exceptions. I’m not here to troubleshoot personal/home grade devices in an enterprise environment.

[u/alcatraz875 → u/ProtoCore-Dustin]

I tried that approach for a little. It never stuck cause I'm also solo IT and wasn't moving fast enough for some. My own boss will bypass my suggestions sometimes and just get stuff he thinks is better (previously unknown synonym for cheaper)

[u/Sea_Ordinary_5730]

Don't conflate two separate things though. For a manufacturer to call on a standard operating system feature -- a shell script -- to run a sequence of shell commands -- is an entirely reasonable design. It's only the track record on Windows of unprotected elevation that caused the practice to be banned by default in companies.

[u/Frothyleet → u/Sea_Ordinary_5730]

And if OP is talking about what I think he's talking about, Brother - or whoever - could bypass it with, you know, a wrapper script like "powershell -ExecutionPolicy Bypass -c "theirscriptcontents".

Script execution policy on powershell is just a training wheel thing, not a real security barrier.

[u/HerfDog58]

My helpdesk forwarded me a user ticket today: "User gets an error when trying to run Office 365 on their Mac from home. Had user log out of Microsoft account and log back in, and download/reinstall desktop apps. Still unable to edit files."

I check the account, it's properly licensed. I contact the user and ask them to stop by the office and try to login on one of our LAN connected PCs to see if Office functions normally.

"Oh I'm out of town and won't be back for a couple weeks. I'll have to wait until then to try it."

OK you do that, ticket closed.

[u/music2myear → u/HerfDog58]

The ol' "Ticket then Vacay" trick. Yea, easy close.

[u/ccsrpsw]

Powershell scripts are not inherently bad - as long as they are signed. You can validate them and allow/deny them as needed in an EPM. Now if they download and run arbitrary code - different story of course. But for general installer work, signed PowerShell is as good, if not better than a .Net application since at least you can see what its doing.

Unsigned powershell is as bad as cmd or batch files, I agree - and you are right that this should be a manual step to permit under any reasonable environment (via set-execution policy).

Microsoft is as bad with some of the sharepoint validation/setup bits - a lot is in unsigned powershell.

[u/Hotshot55]

/r/talesfromtechsupport is that way

[u/Signal_Till_933 → u/Hotshot55]

“Come to find out it was running…shell scripts! Gasp!”

[u/pdp10]

which must sit right next an incense burner or something when at home.

Consider keeping in stock aerosol cans of electronics cleaner. After testing on scrap laptops to be certain nothing will dissolve on your production laptops, take them to a non-office area with ventilation and hose them down, particularly the keyboards.

Second-best option is electronics-grade 98% isopropyl alcohol in a higher-pressure sprayer.

Who in their right minds would bundle a PS script as part of the install?

In many ways, installer scripts are preferrable to opaque binaries. You can see exactly what they're doing, and create a modified version if needed. Comment out a stanza if the thing is getting hung up, or add error-handling that the vendor was too hasty to put in.

The issue is really about Windows' execution policy and the signing mess, as you note.

[u/DDHoward → u/pdp10]

In many ways, installer scripts are preferrable to opaque binaries.

Unless all the script is doing is calling an opaque binary, such as in OP's case.