I think the key phrase here is "employee owned Macs". They don't say what the equivalent results are for "employee owned Windows PCs", but I'd bet they're in the same ballpark. And when they say "owned" they really mean "administrated", meaning the PC isn't part of the corporate domain and subject to corporate Group Policy.

Ah so that falls under the umbrella of expectations of IT.

E.G. someone brought a machine from home one day and proceeded to work on it, then had a failure and lost "business critical" data. Then management chewed out IT with questions like "How could you allow someone put our data in that situation!!!", "What could you have done to prevent this!"... Hence IT Policy: no personal machines in the building.

To anyone else in IT; here's how you avoid that situation, and the resultant policies. Audit your connections, or have an inventory tool which will let you know when new MACs (the NIC addresses) are seen. Then follow up with a polite email to $PersonalDeviceUsers's Boss detailing what you can/can't offer service wise. So long as everyone understands the situation ahead of time (in writing), you'll avoid having to write such policies later.

And this is why employees hate their IT department. Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job.

1. If business critical data is lost this is your fault because those backups should have been performed regularly, throughout the day. 2. Unknown devices on the network should have automatically been switched to a DMZed network. If they want it on the corporate network they'll email you and ask how to do it and probably tell you why as well. People bring in all types of devices not related to work; cellular hotspots are one example. 3. Going to the user's boss is just an asshole move. If they are causing trouble, yes by all accounts go ahead. But from an outsider it looks petulant.

I think we have a tone mismatch here. For instance if a user brought in a Mac the email would be something like "Hey, just saw $newdevice connected to corpLAN. Remember that all company data needs to be saved to a share in order to be properly backed up. Also here's what you'll need to connect to email etc..."

1. Backups are performed regularly on devices I have control over. If someone stores their info on a personal usb flash drive and loses it what should I do?

2. So you're advocating an automatic kill of any unknown devices and then calling me a obstacle? "If they want it to work then they will call me". Does that sound helpful?

3. It's not a complaint, just information. The boss is responsible for that employee and would expect me to know when devices change. If the manager doesn't approve of personal devices that's between you and him. Most bosses don't have a problem.

I'm trying to be helpful towards other IT people with methods I've learned to allow the users to BYOD while still managing expectations. Your response is "this is why everyone hates you! Because you won't do things the way I think you should have!"

Sorry I might have been mistaken then. I've been both user and admin of the IT department and the amount of bullshit handwaving that comes from some of them is infuriating. I honestly believe that 25% get their jobs through nepotism because there is no way that IE6 should still be a requirement for any PC.

1. I share the same view. Once it leaves the network you're on your own. I encourage our users to backup to our servers because storage is cheap and if they are going to be using it for work might as well.

2. DMZ doesn't mean killing it just means your unknown device has a connection to the internet and that is all. Some users just want to bring in an iPad and aren't looking to get 802.11x certificates, 26-character WPA passswords, etc.

3. Unless someone is being a nuissance on the network I try not to get involved and even then I fire off an email directly to shut them up.

I work for a software company so most users are really computer competent so I haven't encountered the "problem" user that most IT workers love to make fun of.

>Instead of helping them do their job better they dictate and put up roadblocks so IT guy has an easier job.

Oh yes, I forgot. IT budgets are infinite and supporting all existing business computing requirements on any foreign device that show up takes zero time.

There is a world of difference between not supported and not allowed. If you don't support it then don't support but there are some places that are actively hostile to anything but windows.

>There is a world of difference between not supported and not allowed.

Allowing any foreign device, even if unsupported, is a serious cost. Not supported but still on the privileged network (or on the guest net and hooking into any privileged resources) is a HUGE security threat. Especially in areas like ours where make or break comes down to our ability to protect our trade secrets. Malware running on a non-privileged account on a personal computer is still a serious data exfiltration vector. Frankly on our network, not supported is the same as not allowed.

>If you don't support it then don't support but there are some places that are actively hostile to anything but windows.

Actively hostile to anything but windows, or actively hostile to anything they haven't prepared for, which just happens to be windows because that's what business needs demand? I've known admins who only support windows because its all they know, and admins who only support windows only because that's pragmatic for their deployment. Theres a big difference, and if its the former and it bothers you, vote with your feet and fucking quit dude.

How do you propose to identify the user associated with an unidentified new MAC? Is there some way that isn't tremendously labor-intensive?

If they are on ethernet smartswitches can do it for you (you only need to know where it terminates). If they are on the wifi then some devices will display their nmb name (for example "Joe's Awesome iPhone(FE-2A-FE-FE-FE-FF).

If they are connected to a share already... done. Just let the list of open sessions tell you what username is associated.

Alternatively dump the FDB on the switch. Really easy if you use voip phones with downstream connections to the computer. Then you can lookup which phone MAC is associated and call it.

Depends on your environment but once you find a method. Write a script and tie it to the new MAC alert. So the report would look like. "New device on switch x port 6 given IP y.y.y.y and logged into shares under z."