The problem isn't hardware, it's that they're using the worst antivirus known to mankind. It's not throwing money at the problem, it's about what can be removed.
* McAfee
* Tanium, which is constantly firing off massive Python scripts
* Aternity
* Windows Defender (which is well-behaved as expected)
The system is effectively I/O bound all the time. The quad-core (8th gen Intel core) idles at 70% utilization, constantly spiking to 100%. The commit charge for getting into the Explorer shell is 13.8GB of the 8GB of physical memory. The laptop itself appears to have a street value of about $240 on eBay. Quality unit with a 1366x768 TN display.
-----
The 30 day discovery period is about to end. I am not supplying an SoW for any further work. I told them the reason nothing gets done by their teams is because the hardware they give everyone is trash, and I can't solve their architectural issues when IT doesn't supply tools to get work done. I wish them the best of luck.
From the time Windows started, my laptop fans would spin like an aircraft taking off. Utterly ludicrous amount of wasted CPU time and energy.
To be clear, I think AV and EDR are valuable tools - but Mcaffee is just shit, and Tanium has really high CPU usage.
Aside from the above, all the security crapware made actually doing work difficult. Want to install software? Nah, nobody gets admin rights, instead submit a request on our shitty help desk, and if you're lucky and very perceivent, you'll get it in a month. Need to run something elevated? Nope!
And the worst of it was that Mcaffee, Tanium, PAM etc was all just glitter on a turd - general, more mundane stuff was a security joke. For example, at least 10 internal spam emails would be sent each day, to let you know about boring and irrelevant shit going on around the company - and every one looked like an actual spam email! Full of spelling errors, silly subject lines, and often the whole body was text rendered as an image. Internal web apps were hacked together by shit devs, and stuffed with security vulnerabilities. The general theme was "more shit on endpoints". Bah.
Trend Micro is the same way. The only thing that eventually made it bearable was getting an SSD, but it still sucks.
But there's only so much you can do with a 7th gen dual core mobile i7
Now...McAfee? a)Was a pig, but b)did we really need to scan the entire disk every Friday afternoon?
That said, I know they have some HUGE deployments in the Military and my piddly little 25000 client install may not be comparable.
But it’s not personal at all. Neither you nor I made Tanium, and I’m sure your deployment is the gold standard of Tanium deployments that would change my mind.
99% of the time it’s not Tanium, but 1% of the time is very much is.
On the upside, you learn every part of the stack as you have to defend yourself at each and every turn.
But be honest, it was Tanium that got my dog knocked up, wasn’t it?! Just admit it!
After years of having terrible, exploitable software on windows, it's the natural result. Some manager gets a pdf exploit, and on windows there's simply nothing you can do about it. But IT has to do something, so to make them look good they throw another anti-virus on.
To me, the whole ordeal screams: software bloat, software misconfiguration, background service overload. You could snappily send mail 15 years ago, and the computational task itself hasn't grown much, besides bloated browser login windows.
Try booting a 2 GB RAM machine to some RAM-preloading Linux thumbdrive and you'll see why the problem is not "spinning rust HDDs" and "only 4 GB RAM"
Reading the article was indeed surprising and depressing - it certainly is a plausible scenario! The question is: is such a disfigured desktop experience an acceptable result, given that the physical hardware enables much, much more productivity?
They're absolutely running some sort of modern Windows so I don't see how this is relevant at all. MS-DOS2.0 would also work like a dream on those specs, who cares?
It destroyed performance. Also it was poorly configured by the checkmark-brigade in their “security & compliance” department.
All I’m saying is careful what you wish for.
Edit: spelling
They can fuck up macs and Linux just as well.
It would have been more cost-efficient and secure to smash our machines with sledgehammers than force us to run this ... junk.