So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off a Windows workgroup with no users, everything is on a single LAN subnet (no DMZ, no WiFi controls, no VoIP priority), and the "file server" and "backup" were Win7 machines, one of which had a RAID card in it and the whole thing worked over broadcast WINS.
Since taking over, I have set up a real fileserver, some basic network segmentation, VoIP forwarding and other basic stuff. Users seem happy phones sound better and their files are backed up and served faster. Now comes the hard part.
I have set up a domain controller (and SDC), and silently migrated everyone to using DNS resolution for internal lookup - now I'm at the step of getting them all on the domain. The benefits seem obvious to me (centralized control, user management, etc.). I have set up a couple of "shared" desktops and showed users how to log in, but gotten some pushback about it being harder/different than it used to be (it used to be that there was one Windows admin account with auto-login. Anyone who wanted to use any computer just sat down. No mind if someone else is logged into their email or clearly doing something). When ask WHY I am doing this, I have given the following answers and gotten the following responses:
- What if you don't have a password on your computer? Someone could just send a nasty email from your account
Why would someone do that?
- Do you want someone messing with all your settings?
I don't have a password now and no one does that
- I need to know who you are so I know you are supposed to have access to these files
I work here, of course I'm supposed to have access!
- If I do this, then it becomes my fault if we get a virus and you get to blame me
- Well we haven't gotten a virus so far. Our network must be secure.
- It might be my fault but you know how to fix it so I'm not worried.
Having done some company-wide rollouts in my time, I expected this, and am proceeding undeterred. I think people get the value of this (permissions on directories), even if they don't like it. I have also taken to doing some temptation pairing: as users are migrated to the domain, they get access to the slack channel and an updated version of MS Office, which they seem to like.
At the end of the day, I think people see this step as a minor annoyance and are going to pretty much go along with me no matter what I do, but I do worry that if the users see me as doing things they don't like or taking things away from them, they will stop coming to me when they find issues or try to "find ways around me" to do what they want. How can I get some buy-in from users that these sort of changes are what they are looking for?
Quick edit for P.S. - Yes, I did dogfood and test my DC - my intern and I were using it for ~2 months before any users were even aware it existed. - Apologies if this is slightly off-topic - suggestions for edits are welcome.