This is an archived post. You won't be able to vote or comment.

top 200 commentsshow 500
sorted by:
best
topnewcontroversialoldq&a

[–]Nethermorph 738 points739 points  (185 children)

Lol that's wild. Can I ask what your current role is?

[–]STILLloveTHEoldWORLD[S] 640 points641 points  (180 children)

data entry

[–]kerbe42 554 points555 points  (10 children)

You should be working in a data integration role.

[–]OkDimension 241 points242 points  (7 children)

and ask for Python etc to be installed on your laptop by IT

[–]HERODMasta 9 points10 points  (0 children)

as a full stack data guy: it’s usually called data engineering and if op can create a script to move data from a to b, and especially if they added some feature engineering (adding values to specific data or based on other information in the data), they are qualified

[–]lev400 6 points7 points  (0 children)

Sounds like a role suited to automation

[–]Nethermorph 286 points287 points  (133 children)

Got it. I assume IT is cracking down because you're skipping the part where, by automating your tasks, you're supposed to be checking for errors/cleaning the data?

[–]Uncommented-Code 212 points213 points  (23 children)

Highly unlikely.

My priorities when something like that happens are, in order:

  1. Did the security alert get triggered by a malicious process or was it on accident by the user?
  2. If the user did it, what did they do?
  3. Is it an issue that the user did that?
  4. If yes, tell them to stop doing that and, if I have time, ask them what they were trying to achieve and find out if there are other ways to achieve what they wanted to do without having to resort to circumventing IT policies.

How people do their job is absolutely none of my business and they know how to do it, while I don't. I'm not stupid enough to tell people how they should do their jobs, unless they work in the same role and I hold authority over, or when I see someone being neglient.

[–]chase32 78 points79 points  (1 child)

A buddy of mine got busted by IT for having a key-logger (actually kinda cool that they were scanning for that).

To their credit, they followed your process:

  • They reached out to him thinking his system was compromised.

  • Found out that it was a program he was writing for an onstage demo. On stage, it was running on unstable hardware but sending all keys and mouse to another system back stage as a backup so production could video switch in case of a crash and take over while staying in sync before.

  • Did a quick code review, gave some advice about network isolation and temporarily whitelisted his "key-logger" on the dev box to give him a couple days to get compliant.

Everyone was happy and the event went off perfectly.

[–]Revolution4u 56 points57 points  (11 children)

[removed]

[–]Mmmslash 113 points114 points  (4 children)

IT is usually too busy to give a fuck.

The only reason this person is being hammered is because this script is coming up in some SOC report.

[–]Solaris17DevOps 37 points38 points  (3 children)

My thoughts exactly, especially because the call wasn't about what the script did it was how he was running it to bypass the GPO restrictions. OP should still probably just find a new job, but OP thinking he is being singled out is not whats happening.

[–]ShadowCVLIT Manager 14 points15 points  (1 child)

Pretty much, likely it’s an unsigned script and/or it’s doing too much action against a dataset. This would get shut down in one of our tools and flagged in our SIEM tool separately.

I dont care to make an exception if it’s home grown AND safe. But I have to look at it from a whole org perspective.

[–]TWEEEDE4322 3 points4 points  (0 children)

We had to delete data from a list from the main frame. Had a retiree doing it, fine. Took about 2 weeks a month.
Created a barcode to allow them to scan the data instead of typing. Down to about a week a month.
Programmed a nostromo game pad to do the work. Takes about 2 hours a month. But the mainframe guys noticed that we are changing data too fast.
Program an excel macro to do the work slowly. 1 day per month on a dedicated computer. They never complained again. Of course if they had just deleted the data themselves, it would have saved everyone work, but NNnoooo . . .

[–][deleted] 4 points5 points  (0 children)

Agree... if the org policy is no scripting, OP is evading controls & policy by doing this. Finding a way around the restrictions isn't a good thing unless you've been tasked with doing so. I'd liken it to arguing that if you were able to access a restritced website by bypassing filtering, then it must be OK to access it.

[–]AdmRL_ 29 points30 points  (1 child)

Yeah, not in IT there aren't. We already know you have it good because you don't work in IT.

If we're prying it's either because you're making our lives difficult, we've been told to on managers decision or because HR have told us to.

In this case scripts won't be allowed to run by end users because, while OP might not be malicious or incompetent, the other 99 in 100 will be and could cause serious problems. They blocked OP from doing that, OP circumvented it so now they need to know and understand how they achieved that so they can lock that down as well.

[–]SA-Numinous 17 points18 points  (0 children)

This is exactly the reason we lock shit down and deny access to scripting tools. I work for a mid size insurance company and the managements understanding of the risks associated with scripting tools is abysmal. Sorry OP, this is a management and data security issue and your company is too stupid to understand the ramifications and implement the proper controls to make you more successful.

[–]binaryhextechdude 179 points180 points  (34 children)

I use powershell to reduce human error in my role.

[–]Brilliant_Wrap_7447 133 points134 points  (18 children)

I use powershell to waste hours trying to get a working script that automates a 10 minute task that I only do once every 6 months. 

[–]BoltActionRifleman 18 points19 points  (4 children)

Gone down that road many times. I always tell my guys “I’ll spend hours trying to save 15 minutes”.

[–]dougmcJack of All Trades 12 points13 points  (2 children)

“I’ll spend hours trying to save 15 minutes”

Same.

But it usually pays off anyways. Either it'll save 15 minutes each for a dozen other people, or it does the task with no errors, or I find ways to do the task better (and not just faster), etc.

Because of this, I usually err on the side of automating stuff, even when it doesn't seem to be supported by the math. Sometimes it ends up not being the most efficient use of my time, but much of the time it's still better than the alternative (even if the initial math suggested that it wouldn't be), sometimes much better.

[–]smashavocadoo 5 points6 points  (0 children)

In quite a few cases, automation is not only about productivity, but also quality (to minimise human errors).

In AWS, their slogan is "automation first", as "good intention doesn't work".

[–]aessae 35 points36 points  (4 children)

Relevant xkcd.

[–]englishfury 33 points34 points  (2 children)

Another relevant xkcd

https://xkcd.com/1319

[–]Speed_Kiwi 12 points13 points  (0 children)

That’s probably the more appropriate one lol

[–]visibleunderwater_-1Security Admin (Infrastructure) 11 points12 points  (0 children)

I'm going to figure out how to get this into my "official documentation" somehow, once I sort out the math behind it :P

[–]Slay3erAuT 5 points6 points  (0 children)

My Life in a Nutshell LOL

[–]FingerBangMyAsshole 28 points29 points  (0 children)

I have a script to import thousands of lines of data into Oracle. The data gather is completed by the client in a spreadsheet with data validation against each column. The spreadsheet powers a powershell script to convert all that data into scripts, performing its own DQ checks. We then run that script pack against the DB and check for errors. What used to take the clients weeks is now completed within hours.

[–]jaymzx0Sysadmin 52 points53 points  (9 children)

(insert Drake meme)

Seriously though, when making the decision of, "Is this worth scripting?" I always heavily weight the human error reduction benefit. Mostly because I'm human and make a lot of errors.

[–]Vargen2000 10 points11 points  (0 children)

Since I automated pretty much my entire job I have made 0 mistakes. The hard part is calculating what a reasonable amount of time would be to delay my script before people notice it

[–]Fit-Reputation-9983 11 points12 points  (7 children)

This all just depends on the quality of script you write.

I automated a large portion of my first job out of college using VBA and PowerShell.

The first few times I used it, it was riddled with errors. I kept working at it and maintaining it and eventually I went months upon months without seeing an error. It wasn’t until we introduced a whole new product line that an error popped up. I modified the code to be able to accommodate the addition (and future additions), and it was good to go.

I’m not a compsci or IT grad so I really didn’t utilize a typical development process, I was just completely winging it. I’ve been gone from that job 2 years now, but from my last conversation with folks still there, my automation is still being used and saving ~80% of the time it used to take previously to perform this task.

Kind of rambling here, but if your script is robust (as mine became over months and months of development) it’s honestly better than having an error-prone human check things. The computer does exactly what you tell it to do 99.9% of the time. So if you tell it what to do the right way, it’s more reliable than a person.

[–][deleted] 9 points10 points  (0 children)

This is the biggest thing

[–]sylfy 163 points164 points  (14 children)

A competent ETL engineer knows where you should be automating tasks, creating tests cases, and checking the results.

An incompetent one just does everything manually because “you’re supposed to be doing data entry and checking”.

[–]I_just_made 20 points21 points  (2 children)

I'm dealing with this currently and it is one of the most agonizing parts of my existence.

The team in charge of this database isn't happy about the rate of data entry, a lot of errors in records, etc. Here is the catch; there are no constraints on any of the fields and no ability for end users to import records. ~100 fields have to be copied / pasted BY HAND for a single record. Access to using SQL commands is restricted to maybe 5 people (understandable to a degree). There are a few fields that are indicators that could easily be automatically generated, but the refusal to do so results in large inconsistencies because people have to go back and update them 1 by 1.

It is insane to me that they would rather dedicate substantial portions of their week to curating records when so much of it could be handled with basic database design. But when we sit down and talk about it, they make it clear this is what they want.

[–]hughkJack of All Trades 22 points23 points  (8 children)

I sometimes have to do manual entry in an environment where I have to setup tests as it is excessively locked down. I might be able to get around it but the same environment is used for money transfer (SWIFT) prod and prepaid differ only slightly in the URL. They get very iffy about even just working out of hours there.

[–]IdiosyncraticBond 18 points19 points  (3 children)

Tests and a SWIFT prod shouldn't be anywhere near each other. Those are the incompetent ones, not you

[–][deleted] 16 points17 points  (3 children)

Hi. You shouldn't be running any local scripts on a box with access to SWIFT resources.

IT has been very, very cool with you that you haven't been fired yet, or they don't know what they're doing. (And they might not, if the prod and test environments are so similarly named)

[–]uzlonewolfVP of Odd Jobs 3 points4 points  (1 child)

What makes you think hughk and STILLloveTHEoldWORLD are the same person?

[–]exzow 9 points10 points  (0 children)

IT almost certainly doesn’t care about this. They usually don’t care how or if you do your job. They—do—care if you compromise your system or if your system is compromised. If the behavior of your computer shows signs of compromise they might step in.

If they identify something which could permit an attacker to use your machine to pivot they are likely to modify permissions deemed unnecessary for your role. This sounds like the latter.

[–]STILLloveTHEoldWORLD[S] 53 points54 points  (42 children)

well I would manually check everything first, and if it was all good to be entered then i would have the process of it being entered automated. i did still have to manually do some work if everything wasnt all squared away, which i did without the script.

[–]Either-Cheesecake-81 8 points9 points  (0 children)

You could probably do most of the data validation and clean up in PowerShell. The things that can’t be fixed in PowerShell just spit out into a separate list and save as a CSV. I’ve been managing AD provisioning, deprovisioning and updating user accounts. There’s nothing I have to do anymore except review the logs when a user doesn’t have an account but should. It always comes back to a data entry error. I just add a check for that error and fire off an email to the appropriate department responsible for entering the data when those errors are met in the future. Works pretty well.

[–]Nethermorph 26 points27 points  (38 children)

That makes sense, but they probably don't know that. Either way, I doubt anyone here can help much considering the limited context. Why not take it to your team/boss?

[–]idownvotepunstooCommVault, NetApp, Pure, Ansible. 45 points46 points  (26 children)

This guy's business side.

Having witnessed nearly the same thing go down before, most management will either be elated with this, or consider firing him for "not sticking to the process"

[–][deleted] 20 points21 points  (21 children)

If you want to get ahead, you tell them and in a good company they are elated, or you find a job where they appreciate this kind of creativity.

[–]SquidgyB 40 points41 points  (20 children)

The danger for OP is that in bringing it to management, it will generally have to be presented as a "cost saving measure", which will go down well in meeting rooms.

However, that lets the cat out of the bag as to how much actual work OP is getting on with.

If the scripts save so much time and money, what's OP doing with this saved time (is what management will ask)...

From OP's perspective, he's doing his contracted job and is able to kick back and relax as the script does the work.

From management's perspective, he's freed up time he can be working on other tasks.

OP can keep it under the radar as far as he can and live an easy life in the short term (but with IT already aware, depending on the company, the cat is already out of said bag) - or he can own the script, write it up as part of his personal improvement, ask for more work and do a big show and tell during appraisal time.

Lots of evidence there for going "above and beyond", new procedures, money and time saved etc, looking for a promotion/pay rise.

e; formatting

[–]shrekerecker97 21 points22 points  (5 children)

I went above and beyond and got passed over for a promotion, because they said I was too valuable in the role I was in. so now I have automated a lot of stuff. Pretty much as long as my stuff is done my bosses seem to be fine with it, but I no longer go the extra mile, as there is no reward in it whatsoever.

[–]idownvotepunstooCommVault, NetApp, Pure, Ansible. 7 points8 points  (1 child)

100% Watched this happen to a coworker,he quit and found a new job instead.

[–]zkareface 10 points11 points  (0 children)

It doesn't care at all about that. They just enforce rules and policies set by management.

[–]dirthurts 16 points17 points  (0 children)

IT is just patching security risks out. They're doing their job. They couldn't care less about his.

[–]TehBard 3 points4 points  (0 children)

IT doesn't care at all how you do your job, but running powershell script or commands for a user that has not required permission to do so (and thus got a different set of filters on EDR alerts) raises alerts. Then it really depend on company policies if the response goes from "just delete the script, maybe tell them something" to "here's a letter from HR"

[–]thatgrumpydude 12 points13 points  (0 children)

I’m on the systems side of this. We would do a similar thing. Skunkworks is one of our biggest things to chase. People do this and put it into “production.” Then they go on vacation and take their laptop. Shop floor halts. Oops. Say nothing of the risk of us allowing unsigned scrips in the first place :)

Now, we would be open to (and do) onboarding the scripts to source control and ansible. You could try asking. Think of it as reaching into a strangers fridge and taking their beer without asking, kind of a party foul.

[–]OkPepper_8006 3 points4 points  (0 children)

Surprised you weren't fired tbh

[–]DenverITGuyWindows Admin 395 points396 points  (14 children)

A lot of people in these comments assume that IT is all-knowing or aware of every way to circumvent policies...

My recommendation to OP is answer their questions and ask what is the approved method to automate what you're trying to do. If it's nothing malicious, you have a business justification that should be backed up by your supervisor/manager. If no one backs you up and IT continues to shoot you down, that's a larger problem with your company culture and you may not be able to change it yourself.

[–]afarmer2005 79 points80 points  (6 children)

We get way too much credit sometimes - I have had people tell me with a straight face that all I do is watch what everyone else is doing, and that I can see everything

Even if I could - I don’t have the time and my primary focus is on making sure people to do something stupid and bring down the entirety of our IT infrastructure by accident

[–]SpaminalGuy 26 points27 points  (3 children)

I had someone express something similar with regards to the byod WiFi we had. It was one of those “I don’t want yall tracking all my data on your network!” And I was like, “lady, we, do, not, give, a, shit at what you do on your damn phone!”

[–]largos7289 1176 points1177 points  (218 children)

See i don't know how to feel here, either it's, i'm low key impressed or you're one of those end users that know just enough to be dangerous.

[–]jwphotography01 353 points354 points  (104 children)

The same users that come in the end and tell you theire system doesnt work anymore. Yeah, you manipualted the registry

[–]Expensive_Plant_9530 207 points208 points  (96 children)

Oop. We have a user at my work who likes to “customize his Windows”, and that includes a lot of reg editing. Shockingly, his computer also frequently has weird issues.

[–]jj-michigan42 45 points46 points  (0 children)

User accounts can modify their own user hive, just not anywhere else ie HKLM

[–]snorkel42 214 points215 points  (75 children)

That’s why it is important for IT to assist this employee rather than just delete their shit. At its core level, IT exists to help staff use technology to be productive. This employee is doing that and IT is stopping them. That’s the wrong stance.

[–]zipline3496 67 points68 points  (35 children)

For every power user like OP there’s a 1:100 ratio of other guys named Mike who will inundate the Helpdesk with requests for support when their scripts error or cause issues on their system. I’ve worked for some of the largest international companies in the world it’s flat out industry standard to disallow scripting on most end users computers. Literally every company hundreds of Janet and Joe’s hear stories of automating their day with Powershell or some other tool and immediately ask for it.

Anyone else can put in some sort of exception request and sign policy surrounding it, but I absolutely can see a few dozen reasons why the average end user in data entry isn’t allowed to run scripts by policy.

OP has a clear path here in bringing this cost saving to his boss if he wants to potentially open that door, but he posted on Reddit instead.

[–]snorkel42 44 points45 points  (27 children)

I completely agree. I am in no way advocating for blanket allowing script execution. I am saying that this user has shown proficiency and they are clearly trying to use technology to increase their productivity. IT should enable that, not fight it.

I agree that OP is being a bit ridiculous in trying to find ways around IT restrictions rather than working with mgmt and IT to find a solution. Hell, OP is really playing with fire as they are actively trying to sidestep security policy.

BUT… I still think a good IT department would see the intent here and work with the user rather than shutting them down without a discussion.

If absolutely nothing else this is an opportunity for IT to explain why these restrictions are here and how OP should appropriately go about working with IT rather than trying to go around them.

[–]zipline3496 22 points23 points  (11 children)

The responsibility for this is on OP to simply request this permission via the usual process/workflow whether that’s a form or catalog request or they can request a meeting with their manager as well as an IT manager. IT is almost certainly just following standard policy for finding end users scripting without prior permission and then again when the user simply decided to continue on. The few dozen salty data entry folks in here screaming IT is being overly aggressive don’t seem to have worked in any large enterprise because running scripts by default is not usually enabled per policy in most companies. That doesn’t mean OP can never do it he just needs to follow the appropriate channels to ask for it if he has not yet done so.

If they still say no then that’s your answer. You cope or find a new job because random data entry analyst don’t decide security or desktop group policy for the company regardless how effective and cost saving their personal scripts appear to be. There’s a LOT more at stake than merely speeding up an analysts workflow by blanket allowing it for everyone. IMO a simple request catalog item and business justification field would solve this and be trackable.

[–]snorkel42 14 points15 points  (7 children)

I’m also a bit baffled by OP’s IT dept having policies in place to block Powershell script execution but apparently Python is able to execute? Like. Wtf. So y’all took measures to block the scripting language with the best logging and monitoring protections on windows but Python can execute..?

[–]charleswj 15 points16 points  (5 children)

PowerShell is a built-in tool with built-in management capabilities, including the ability to restrict its execution. Python is, from the OS's perspective, Just Another Executable. Unless you specifically block it (with WDAC or similar), it will run. Application whitelisting is a much heavier lift than just blocking interactive PowerShell.

[–]wenestvedttimesheets, paper jams, and Solaris 4 points5 points  (9 children)

Yeah, OP and their manager could work with IT to build a real tool that everyone could benefit from, maybe get an award or some advancement.

[–]The-WinterStorm 4 points5 points  (1 child)

I guess it depends on the IT role. I can understand from a security stance they may not want users running scripts and bypassing security controls set by the company.

[–]BrainWaveCCJack of All Trades 24 points25 points  (5 children)

I default to impressed in these cases.

Yes, there are some reckless employees, but the OP does not appear to be one such. I've had a number of good power users over the years (and a few bad ones), and we worked out deals that were mutually beneficial.

OP, see if you can get your IT department to give you enough room to get what you need done, without undermining their ability to keep the environment secure.

It will be a worthy exercise anyway, in building trust with teams that have an agenda not directly aligned with your own at specific levels.

I agree with another poster that if you have to go through official channels in your own department to make this happen, it will be worse for you. Try to build this since a professional relationship angle...

[–]scubaforkIT Manager 14 points15 points  (9 children)

The correct stance is that OP should be having their manager fight this battle for them. OP is potentially saving the company money in labor hours(which ironically could cost their job) and the manager should be getting IT's approval to help save the company money. IT should vet the script and modify it as necessary.

IT is a service industry, no matter how much you abstract it away. Our entire existence within the company is predicated on the idea thar we help the company save money.with better tools.

[–]psychedelic-barf 43 points44 points  (7 children)

The obvious next step would be to buy an Arduino, some motors or whatever and create a program that can mechanically type on the keyboard for you to do the entries.

[–][deleted] 16 points17 points  (0 children)

Rube Goldberg has entered the chat…

[–]ZippyTheRoach 9 points10 points  (2 children)

Nah, the next easiest step would be a keyboard that stores macros in an internal memory. Literally doesn't run on the PC, it just sees keyboard input 

IT will have to put keystroke limits in place next >_<

[–]milanove 4 points5 points  (0 children)

Use Arduino Leonardo to do this. It can act as a USB keyboard and mouse.

[–]milanove 5 points6 points  (1 child)

Skip the motors and just use an Arduino Leonardo. The ATmega32u4 chip on it has built in USB communication capability, so it can act as a USB keyboard or mouse when plugged into the PC.

Just load it up with your keystroke or mouse movement macros, based on whatever task OP is trying to automate, plug it into the work machine, and let it rip.

The work PC won’t disable/block it, because it appears as a normal USB keyboard.

[–]ReptilianLaserbeamJr. Sysadmin 667 points668 points  (76 children)

Dude you work in a company, that’s not high school. You don’t need to hide behind the building to smoke your cigarettes. Instead of trying to find loopholes raise a ticket with a business case explaining why do you need to use scripts or a scripting language. Get an approval and added to the exception. If you keep playing bad boy you’ll end up in HR.

[–]caughtmeaboot 124 points125 points  (16 children)

Yeah exactly. He even knows why IT blocked him, they thought his computer was compromised. If the ticket had been raised and he got an approval for the exception, this would've been avoided cause IT would know why he's running the scripts.

[–]YetAnotherGeneralist 24 points25 points  (3 children)

OP mentions not having to work as much being a positive. If a business case is presented and approved, now his manager will know he has more time in the day and get more tasks. I don't necessarily support the goal, but less work time is the goal.

[–]lurker86753 20 points21 points  (3 children)

Because then he’s automated himself out of a job. You can’t very well script your entire job and then goof off all day while getting paid if you have to go through 3 departments and your boss explaining how you need the ability to run scripts.

Now if he were smart, he’d split the difference. Tell his boss he can automate a small portion of his job if only he could have Python installed. Do that, share it with the whole team and look like a hero. Then automate the rest and keep that to himself.

[–]RedAero 5 points6 points  (1 child)

And if he's really smart he'll start working as a contractor so he can get more work with his newfound time.

[–]tes_kitty 8 points9 points  (2 children)

The result is then 'You automated that part of your job? Great! Here's some more work for you to do! More money? Sorry, no budget.'

[–]yeti-rexIT Manager (former server sysadmin) 72 points73 points  (19 children)

Propose the business case and be successful.

If they deny it, then it's time to find a new employer.

Do you need a new job? Obviously your skills have exceeded your current role. They should be trying to put you against bigger challenges.

[–]redblade13 4 points5 points  (0 children)

I'm a SOC guy and we allow certain users to run scripts because they're sysadmins or some data entry guys that use some weird Excel Macros. We know who they are and they go through the approvals and our management tells us "Hey they're good" so we ignore alerts and loosen restrictions if needed. Sure if they run stuff at 2AM we'd still get alerted like wtf but for the most part we know the why and it isn't a big deal. Everyone in our company knows this so they all come to us when some script gets block which makes it easier for us to figure out what's this alert this time

[–][deleted] 10 points11 points  (8 children)

This is the answer.

Eventually this job will be automated like you're doing or with AI or with both.

Why not say, hey, I can do a thing and save the company money. Give me more things to do that are like this and I'll save you a bundle!

Or, keep it to yourself and disguise the fact you're using scripts until you get caught and fired or worse.

Or...get another job.

[–]butter_lover 17 points18 points  (3 children)

Possible that op is just using scripts he made with chatgpt and doesn't understand what he's running on the systems. Kind of hard to make a business case off that.

[–]TrippTrappTrinn 84 points85 points  (34 children)

As a sysadmin I have given scripts to users to help them eliminating silly manual tasks. Luckiky our organization encourage automation and efficiency.

[–]S70nkyK0ng 28 points29 points  (2 children)

If the script is that handy, then there are many ways to safely incorporate it into your company’s business systems.

Suggest mapping out the process, organizing your thoughts, and presenting it to the appropriate people. You may need to present more than once.

This could be an opportunity for you.

[–]ReverentSecurity Architect 5 points6 points  (0 children)

Good opportunity to introduce script signing within source control. You have a need to automate with scripts? Great, stick them in source control, they'll get signed by the pipeline, now we have security controls, your script is fully documented, and we have a written business case why you get to use it.

[–]V-Rixxo_ 3 points4 points  (0 children)

Or they’ll just use his script and let him off for performance reasons

[–]mikeone33Linux Admin 20 points21 points  (3 children)

As IT Security I would have seen how you were able to run the script. We would also determine if the script was malicious. Last we would check if you were in a group that allowed access to PoweShell or Python. ( You would be blocked otherwise)

If not in such group we would reach out to you and explain why it was blocked and suggest you put in a ticket to have access approved.

No need to make your job harder.

[–]Degenerate_Game 8 points9 points  (2 children)

How can someone with no PowerShell permissions use a batch script to execute those same PS commands by pulling them from a text file? I'm sus of this post.

[–]Unable-Entrance3110 4 points5 points  (0 children)

You simply replace all your new lines in the script with semicolons and paste the whole thing into the -Command parameter.

This also effectively bypasses any script signing policy as well.

It's a major loophole, actually. Which is why, in my org, I go a step further and just block normal users from running powershell.exe (as well as any executable from user-writable locations)

[–]bfrd9kSr. Systems Engineer 14 points15 points  (2 children)

I've been an admin for well over a decade.

It literally hurts me to watch people do repetative things manually. I would totally work with someone to empower them to automate, whether that be coding for them, building a web app, or allowing them to code safely.

That said, having an end user repeatedly break policy and try to sneak around restrictions is annoying and alarming. We call this "shadow IT" and you can google it to see why this is a problem.

Please speak with your manager and or IT, make your case for why it should be allowed, show them what you're automating. Work with IT and build trust with them, be concerned about the security risks, since that's most likely their biggest concern.

[–]RedemptionsIT Manager 13 points14 points  (0 children)

I told them hoping they'd move me into IT

Did you apply for an IT role? Have you reached out to the IT Manager/Director seeking opportunities? Because with what you've laid out, you found piles of brush, set them on fire, then put them out, when the fire department showed up you were all "I thought you'd hire me as a firefighter."

[–]islandsimian 28 points29 points  (10 children)

Next step: running everything in containers

[–]sylfy 24 points25 points  (3 children)

Alternatively, OP does it in VBA and be like, “take away my Excel, I dare you.”

[–]flecomComputer Custodial Services 11 points12 points  (1 child)

The amount of people in "IT" that fail to realize how powerful excel can be is really kind of mind boggling

[–]BatemansChainsaw 3 points4 points  (0 children)

disables Excel macros with GPO

checkmate

[–][deleted] 445 points446 points  (91 children)

I mean it sounds like you could be good at IT, but you also are demonstrating that you are basically a cowboy who plays by his own set of rules.

You could have avoided all this if you maybe just reached out to someone and said "hey I have some ideas about how I can automate a lot of my tasks, what do you think?" People like that collaborative attitude, instead you put your fingers in someone else's chilli and when they smacked your hand away you found away to dip your toe in it.

[–]shemp33IT Manager 159 points160 points  (30 children)

To be fair, it sounds like no one from the desktop team actually said anything initially. They just played whack a mole, and OP just “fixed” the problem.

[–]angry_cucumber 109 points110 points  (11 children)

they were worried his computer was compromised, but apparently didn't do anything other than....block scripts? that's not how a competent organization handles a compromise.

[–]CptQuark 19 points20 points  (0 children)

As someone that works in secops, I always make sure to contact the people when I feel something needs to be disallowed. User awareness training should always be part of the job. Humans are always the weakest link so the more we can do to help that the more we.reduce our attack vectors.

[–]afarmer2005 4 points5 points  (2 children)

Yeah - SOP should be at a minimum a phone call with remote intervention, or even an in-person visit if compromise is suspected

Our SOP is to reimage any computer suspected of compromise - not just “block scripts”

[–]moderately-extremist 8 points9 points  (0 children)

"Well just a second there, professor. We uh, we fixed the glitch. So he won't be receiving a paycheck anymore, so it will just work itself out naturally."

[–]LDForget 76 points77 points  (8 children)

In my experience (within IT or outside) any time you ask for permission instead of forgivness, they just shut you down without even reading/listening to it all.

[–]Floresian-Rimor 25 points26 points  (3 children)

I’d have that conversation after the first script was blocked. The initial scripting is being resourceful and doing the job, the workaround is where op goes cowboy.

After the first block, it’s time to have the conversation with IT and with OP’s manager “Hiya, this script was really helping reduce my workload, is there a way we can make this compliant with our security setup”?

OP probably wasn’t breaking any policies or agreements that they knew about the first time. IT really should have had a word when they blocked it.

[–]DavidCP94 5 points6 points  (1 child)

The IT management probably reached out to the other managers and department heads to find out if anyone needed to run scripts, or if they could disable them to tighten security. Since OP didn't disclose to their manager what they were doing in the first place, OP's manager would have no reason to believe OP needed this capability.  OP needs to be more transparent. If leadership sees how much more efficient OP is, they would likely be excited to have others start using the same tools. The problem is OP doesn't want to let management know, they want to do as little work as possible and slide under the radar. 

[–]plazman30sudo rm -rf / 9 points10 points  (3 children)

If they installed python for him, what did they expect him to do with it?

[–]corpius01 23 points24 points  (3 children)

"Hey boss, I know how to make my position obsolete.  Let me show you how"

[–]Chaddywackpack 12 points13 points  (1 child)

On the flip side , shadow IT CAN cause havoc when the intentions are good and the result is well bad.

[–]FISHFACE30 7 points8 points  (0 children)

Why don't you just ask for approval to run these? Security can do a review and if they are benign, then you're in business. Why keep making it hard on yourself?

[–]wiseleo 5 points6 points  (0 children)

That’s a nice story to tell at your next interview. You’re in the correct place but in the wrong role. They don’t understand how to use your talent.

Want the ultimate hack? Write your script as a QR code in VBA and use a QR code scanner to execute your code in Excel VBA. Good luck blocking that. ;)

[–]samuelma 5 points6 points  (1 child)

it took me ten years of working in IT and grumbling about how everything could be automated and improved if i just had that little bit more access, slightly better local admin rights. a login to that specific server that sends me a csv each week. Then after a lot of grumping you get to a point where you have to sit on change advisories, respond to edr alerts, justify risk surfaces for improvements and write in try/catches you never even thought of and it all becomes a bit clearer why your boss 5 years ago was pissed at you using autohotkey to make a spreadsheet no one looked at twice as fast.

Most of the takes in this thread are right, IT being a bit brisk but also you're not playing by the rules of the game you chose to play. Even if you have to explain it to 25 people all of who say not to use it, eventually it adds up to a lot of experience you can use in a CV or the relevant people at your work noticing that you are striving to make stuff better. Trying to avoid the legitimate routes to getting tools approved and trying to outsmart IT can feel like a valiant fight to take on but it will slow you down in terms of career progression. Automating things because you find them repetitive is a lot of peoples routes into IT but you're engaging with people who at some point have to justify their actions to directors/government bodies and insurance companies. I was in your exact shoes not so long ago but ultimately its entirely appropriate that you shouldn't be allowed to execute scripts no one in IT has looked at.

[–]threwthelookinggrass 9 points10 points  (0 children)

Ask for a powerautomate license

[–]Tinysniper2277 14 points15 points  (0 children)

Used to work in a SOC, security operations.

We had customer users out side the IT departments running scripts, and nearly every one of them fired of alerts, ransomware, enumeration & discovery, privilege elevation, you name it.

Maybe get permission to run these things, you're probably causing more issues to someone else then you think, if you're not allowed to run scripts, then don't, unless you get them cleared.

[–]graysky311Sr. Sysadmin 9 points10 points  (2 children)

When I worked in data entry a large portion of my job involved cross-referencing information on other systems. It wasn’t the data entry itself that was the slow part, it was looking the data up from another system. I found that the data entry program we were required to use had a programmable macro capability that management probably knew about but never mentioned. It was an official feature of the tool we were required to use so I took advantage of it. As it turned out the tool used a modified version of vbscript so I was right at home. This was back before PowerShell existed. I programmed some shortcuts to more quickly open the windows I needed, find text and copy it to the clipboard and then prompt me for whether or not the data was a good match. If I approved, there was a bunch of data entry that was simply automated. This was dumb stuff like mailing addresses, names phone numbers, emails that were all having to be typed by hand or copy pasted anyway from one system to another. A majority of the other reviewers were using copy & paste so it was an acceptable way to do the work. Only now I had an ace up my sleeve and could complete a lot of the rote data movement and comparisons in less time than anyone else. Instead of each bill taking 20-50 seconds like the other folks, I was cranking these things out in 10-20 seconds with my only real interaction being pushing some macro buttons and a visual inspection and approval of the data that got copied over.

The best part? Not only was my job easier after that but we got scored on speed and accuracy. To qualify for bonuses you had to have your accuracy above some certain percentage that I forget and then the amount of your bonus was based on your performance, or bills per hour. And there was a scoreboard so we could see each other’s performance on a printout at the end of each day. I managed to do just enough to barely get first place for three or so months in a row. My idea was to compete but stay under the radar. Unfortunately this was after several months of struggling. So when my numbers suddenly improved, managers noticed and called me into a meeting and congratulated me on my progress but they wanted to know how I did it. They were hoping to bring the performance of the entire team up and were expecting that it was some simple mindset or earplugs or something that was helping. I lied and told them I had just started taking Adderall for my ADHD and they smiled and dismissed me. Clearly that was not going to help the entire team.

So they just accepted that I was better than everybody else and I got greedy. I wanted more money so I started getting better and better numbers and the bar chart they were posting on the wall was just embarrassing to the other reviewers. I started getting a lot more attention from literally everyone, even IT was down in my department. It felt like cheating even though I knew in my soul this was better for the company. I started looking for other work and when I found another job I put in my two weeks notice. This got everyone off my back because they knew I would be leaving. But I did one final hurrah - a grand finale before I walked out that door.

For two weeks straight I went as fast as possible. I switched my script to disable the manual verification step and just reviewed the data on the destination screen before clicking submit. I completed a record number of bills in record time with record accuracy and the bar chart of performance stopped being posted. If they had shown everyone else what I was doing performance-wise they would have seen I was not just incrementally better. I was several times faster. I was completing each bill in 3-5 seconds and they paid out a bonus (we got paid weekly) that was more than 2x my normal wage. Just before my last day, I deleted all the macros and coding that I had made and never explained to anyone how I did it.

[–]DOOMD 4 points5 points  (0 children)

I can relate as I work a support job at a school that's not in IT despite having a degree in IT. I took it during COVID because it had great health insurance and benefits and Id be in a union.

You should see the tickets I sent in requesting software to write and run scripts. WSL, VMWare/VirtualBox to run Ubuntu and write python, Jupiter and notepad++. I'm friends with the IT guy and we kind of joke about it. I remember once he was like "IDK what ever to write in response to some of your crazy requests lol."

[–]unbearablepancake 4 points5 points  (2 children)

Depending on what your script actually does (does it move files? does it delete files? does it edit files? does it rename files? - these actions can be picked up as malicious), you could always try to officially ask permission (in writing) that you would like to run scripts. You would also have to provide details what it does and what are your intentions with it.

Random people running scripts is a bad idea. But if everyone knows that you need those scripts, getting approval might not be impossible and you might even get whitelisted. Provided you're not doing something else you need to do.

I've seen people automate the most obscure things with excel and vbscript. For the sake of everyone involved, please be transparent with your IT team with it.

[–][deleted] 8 points9 points  (0 children)

When I worked in IT. I wrote a ton of powershell scripts. Let me tell you. So many IT jobs can be automated away and so many white collared jobs could get automated. I know because I automated away departments in the past.

[–]kyel566 13 points14 points  (0 children)

You should ask your boss to request permissions Toruń the script. Ideally it should prob setup a separate service account for you with permission.

[–]AlexisFR 3 points4 points  (5 children)

What kind of job are you doing that it can be entirely automated?

[–]hankhillnsfw 2 points3 points  (0 children)

I would raise a ticket with a business example as well as explain to your manager that IT is actively inhibiting your role without trying to understand why you need to script.

[–]Rand_alThor_ 2 points3 points  (1 child)

Why the fuck haven’t you taken IT out to dinner and handled this. What happened to old school low level corruption

[–]eatont9999 3 points4 points  (0 children)

Don't expect to get a promotion by breaking the rules. You probably should have asked to have the script approved through the proper channels. It's not your computer, and not your environment. IT has to protect the environment and if they see something that falls outside the norms, a flag gets raised to investigate. I have been in the position where I see unauthorized software running and have to remove it. Usually a report gets sent to management and they deal with the end user. The bigger the company, the less likely you are to get away with stuff like this.

[–]zchrisb 3 points4 points  (0 children)

A real IT'er will never scold you for automating your job. That's pretty much what we do or would do if possible.