HomeIndustry Commentary

What to tweak in Windows 8: User rights and privileges

Like Tweet Pin it Share Share Email

Saturn was supposed to be a different kind of car company with a different kind of car.

It was, more or less. Mostly less. As Toyota discovered when it dissected one, the car’s engineering wasn’t all that good, and its construction wasn’t any better.

Once again, the Edison Ratio reigns supreme: Genius is only one percent inspiration. The rest is sweating the details.

Not that Windows 8 is as bad as you might have heard (how’s that for a segue?). Even without a touch screen it’s far from horrible.

It’s just that The User Interface Formerly Known As Metro (TIFKAM, which, not that it matters, we should introduce to the performer formerly known as “the performer formerly known as Prince”) is pointless on a laptop or desktop system, leaving us with a Start-button-free desktop that is otherwise just like Windows 7 only with fewer cosmetic flourishes.

Microsoft’s Windows 8 design dilemma began with its decision to create a new device classification — the “laplet,” or convertible laptop/tablet computer.

I love the idea, right up until, when I’m traveling with my iPad, I have to use LogMeIn to do something on my computer back home. That’s when I realize a tablet-size screen is too small for how I work on a laptop or desktop system. So I try to do the work using native iPad apps instead. That’s when I realize just how much less productive I am when I can’t have multiple windows open.

There might not be a better solution than the dual-mode user interface Microsoft ended up with. If there is one, I have no thoughts on what it might look like. I’d suggest Kinect, but can you imagine a business meeting where everyone in the conference room gestures to interact with their tablets?

But this week’s topic isn’t TIFKAM. Our issue this week is that, while both Apple and Microsoft have been busily focusing their time and attention on the user interface, they’ve been ignoring, for more than two decades, what business needs most when it comes to personal technologies.

That’s finally figuring out how to preserve user autonomy for personal computing while simultaneously integrating personal technologies into the enterprise technical architecture.

The original personal computer was a 100 percent detached device. It stood alone, with no connection to the rest of the enterprise technical architecture (which, back then, consisted of one or more mainframe computers) beyond re-keying data from printed reports into an electronic spreadsheet.

No integration with anything else meant there was no need to restrict what employees could do with the gadget, any more than there was a need to restrict what they could do with a 10-key calculator or typewriter.

But then, local area networks happened, followed by the widespread adoption of electronic mail and the advent of n-tier software architectures. We woke up to discover that desktop computers now interacted directly with … everything.

With PCs so thoroughly integrated into both the enterprise technical architecture and business processes and practices, “do whatever you want” was no longer a viable approach to information security and enterprise risk management.

Most businesses, following the advice of an army of consultants whose sole concern was security, adopted a lock-’em-down philosophy for personal technologies. The result was membership in the Value Prevention Society, where risk prevention trumps everything else, including the cost of lost innovation and overall organizational effectiveness.

Businesses that resisted this trend, doing what they could to leave the “personal” in personal computing, faced the same trade-offs. They just accepted more risk in exchange for more employee freedom to fiddle around.

But why should they have to? Establishing multiple log-ins or virtual machines for employees that provide more flexible levels of freedom shouldn’t be all that difficult: In addition to total lock-down login, another might include install-level control coupled with restrictions on what corporate data can be accessed, and yet another might be completely open, except for being totally walled off from any corporate resources.

Maybe you can do this now. I’m not a master of Windows administration. The technology might already be in place, and all that’s needed is the right combination of settings.

But whether the problem is missing technology or missing guidance, Microsoft’s customers would benefit more from its providing this sort of industry leadership than from it further tweaking the laplet user interface.

Comments (2)

  • I totally agree. I sometimes think that Microsoft has been spending the last few years racking their brains trying to figure out what to add to either Office or Windows that would really compel anyone with XP and Office 2007 to upgrade. There’s a huge market out there for “Instances” where one is used for accessing Financial sites (like banking and investing), and another “Instance” for general web surfing/game playing/etc. I say “Instance” because I’m thinking of a walled garden. Something that would ensure if a virus got into your “public surfing” Instance, it won’t have infected your “Financial” Instance. It’s a little more ambitious than what you were proposing, but I think we need it. Yes, patching is a pain, as is installation of software (now I have to install Chrome on both instances). But if Microsoft could create walled gardens that were EASY to setup and use, I suspect large scale adoption at both work and home. I know my company would take advantage of that concept, and I would at home.

  • In the world where a corporate PC is little more than a fancy terminal, what you are proposing is possible… but the corporate network folks would need to do more than minimal work. (Yeah, I’m being sarcastic, my negative past experience with unimaginative but lazy corp service types has jaded me. But I digress.) All you need is to do exactly as you specified. You establish virtual environments using active directory as the control… sign on to service A, its the corporate lock down, service B, only email/scheduling is accessible, service C do what you want but no corporate resources are connected. Want something moved from one to the other? Follow a standard request, test, and migrate protocol. Can be done, but no one will because how can we monitor they’re actually doing work in environment C? Its the early 90’s all over again.

Comments are closed.