Friday, May 6, 2016

Tech Support Chat Sessions, Norton and Windows Defender

[* last updated 5/18/16]

As someone with a PhD in MIS, not to mention over 20 years of professional IT experience, I have a pet peeve against the frequently patronizing, incompetent help desk personnel I've had to deal with. They usually can't cope with anything that doesn't fit in their solution scripts and want direct access to one's PC.

One experience was when I worked at an IBM business unit. I had to install some software which had to be downloaded from a server. I couldn't access the source file and reported the issue. The help desk person assumed it was due to something like a misspecified scp/sftp command. I repeatedly asked him, "Are you sure the source file is available on the server?", and he sidestepped the question. I was getting nowhere as he basically threatened to end the call if I didn't give him access to my PC. It was more trouble than it was worth to fight the issue, so I finally let him take the session, when, of course, he discovered I was right; he couldn't find the source file, even with a privileged session connection. He laughed nervously, annoyingly, "I guess it's not there. Ha, ha. Let me go find out where I can find a copy." This is just unprofessional; as a DBA, I've always tried to replicate a user's reported problem, not through a privileged session but a test user account. In this case, I had to work unpaid overtime for 2 hours (I had a good hour's drive commute home) over something he should have checked from the get-go.

A second fond memory involved a software publisher employer just over a year later. I had gone to Malvern, PA for new employee training (the job allowed me to work from home or at client sites depending on account preferences). We had VPN connections to our company's servers. In any event, I ran into an issue at home after bringing my work notebook home, finding on my first time use of the corporate licensed Microsoft Office product that I was getting timeouts trying to get the product registered. I suspected an issue with the standard VPN connection. Basically the desktop help desk people were in a typical state of denial (e.g., nobody else has experienced the problem; maybe it's an issue with your ISP). He wanted to remaster my PC; I refused, because I needed the PC for training in Memphis the following Monday. Long story short, there were a couple of other VPN options, and after the phone call, I discovered I could get the software to register in an alternate mode. I reported back to the help desk how I got the problem resolved; they were in a state of denial insisting I should have been able to register through standard mode and changing the mode wouldn't have a difference. Facts are stubborn things. The help desk analyst complained to his boss I was difficult to work with (he was still trying to remaster my PC even though the issue was resolved), and his boss escalated to my non-supportive boss.

In the particular scenario for this post, I have Norton software protecting a backup notebook PC. I use the PC on an irregular basis, and so usually I need to update my security software, various applications, and check Microsoft Update for any interim patches. (Yes, I know it eventually checks on default but at an unspecified interval.) In this case, it found Windows Defender needed an update and seemed to stall about 6% of the way through a download.

An important relevant note: Defender is  freeware security, and Norton's software provides similar functionality. Moreover, there's usually a performance hit running redundant functional security software, and Norton basically transparently shuts down Windows Firewall and Defender.

Now just a side note here; at least in Windows 10, there's a Windows Defender setup under tab Settings for Windows Update. In my case, there are toggle switches basically greyed out and stuck on, presumably an artifact of the Norton software install. My inference is that whatever Norton does to micromanage Defender is impacting Defender updates, but Microsoft will attempt to update Defender if it thinks Defender is in use. It's not immediately clear why the Norton install would have effectively frozen Defender toggle switches in an on position.

I did some searching on issues of Norton with Defender and saw on a user thread a relevant discussion, that it's a known issue between Norton and Microsoft that will be resolved any day now. One tip I saw in response to an issue like mine was to the effect that one needs to uninstall Norton which should release the toggle switches, turn the Defender switches off, and then reinstall Norton.

I think the original discussion involved running the Norton removal software to deinstall Norton, and there's when I ran into an issue, because the links to download the removal tool didn't seem to work.

So this is the context for my doing a Norton chat session where I got connected (surprise, surprise) to an Indian agent. This isn't intended to be a rant about Indian help desk people; the previous two examples were both Americans. I've also had my share of issues with non-Indian Oracle tech support in an operational setting. Senior analysts could resolve my issues within 5 minutes, but rookies were very difficult to work with. Oracle maintains a knowledge base of reported problems and possible resolutions. It's difficult to explain it except to note that I typically didn't have access to this knowledge base (Oracle would claim I did--maybe when I used to work for Oracle). So what would happen is the junior analyst might draw a list of say 15 possible solutions--and inevitably decide to make me jump through hoops in their process of elimination; I could usually tell from context almost immediately that the proposed solution wasn't relevant and want him or her to skip down to the next scenario. The analyst would be inflexible and argue that if I didn't comply to his satisfaction with his prescribed sequence, he would close the TAR (problem ticket). I would then escalate the TAR to a senior analyst, which of course duty managers hated but I didn't care. Maintenance costs are nontrivial, and I was a customer: time is money, and my time was important to my employer or client. I didn't exist for convenience of Oracle's training purposes. It was the responsibility of the senior analysts to mentor junior colleagues.

So one of my pet peeves is dealing with what I call scripts or protocols, and Indian help desk personnel are heavily scripted. They don't respond well from deviations from their script. (I'm not going to transcribe the script, but first they will take down parameters for filling out their ticket--your phone number, etc., ask you to remember their ticket number, and so forth. There's typically a gratuitous "I'm sorry you're experiencing this problem", "I can surely fix your problem", etc.) More or less, I discussed the Window update issue, the frozen Defender switches, the user thread solution I summarized above. At no time did he even acknowledge any Defender issues with Norton. He seemed to pick up on my reported issue with the removal tool download. He sends me a URL link. There's a DNS issue (no such webpage). I report back to him. He says try another browser; I'm saying, "Dude, do you understand what I mean by a DNS issue?" (I did pull up Firefox just to humor him.)  He eventually sent me a couple of other links, one of which seemed to connect, but no download. I'm asking "Are you sure that FTP services are up on the server?" Again, no response. He's trying to get me to allow access to my machine; that's not going to happen.  I'm irritated that his scripts include invalid URLs and such; he's not even trying to explain why the download isn't happening. At that point, I was done with the call.

I knew that I could uninstall Norton from Control Panel/Programs. As I hypothesized, the Defender toggle switches were released. I toggled them off and then reinstalled Norton. At that point, I went to Windows Update and manually checked for updates. This time there were no hanging Defender downloads, and Update reported no new patches to download. [Of course, if and when Norton isn't available, I'll need to update Defender or install other security software.] At some point in the future, I'll try testing again whether I can download the Norton removal tool.

[* updated 5/18/16]

A similar problem occurred today on my backup notebook PC. It had a different nuance, because in fact Defender settings were off. In this case, a Defender patch seemed to lead a handful of other, major updates, like a cumulative Windows 10 patch, and the update process seems to stall with Defender. Whatever Norton is doing to micromanage Defender does not seem to be controllable (earlier I had tried turning off the firewall and/or antivirus, but that didn't restore Defender functionality). So I uninstalled Norton and was able to update Defender and complete the other updates. I rebooted and reinstalled Norton.

I tried to do a trouble ticket with Norton, because this is getting to be ridiculous. I shouldn't have to uninstall and reinstall Norton every time I have a queue of Window Updates. Once again, I had to deal with one of their Indian helpdesk analysts, and two times during a chat session where I told him I had resolved my issue, he wanted to remote session my PC. Idiot! He told me Defender was a Windows 10 default security application. DUH! Just do a Google search, and you'll find posts of Norton users reporting Defender issues. As I recall, one post was from 2013, where Norton and/or Microsoft were expected to have a solution "any day now".  Now you don't get nice functionality of the type as MS saying "we're having problems with Defender, so let's put it aside for the time being, and work on your other patches." I know it started with Defender and 2-3 hours later it was still apparently at ground zero. I thought perhaps the software distribution folder was corrupted; but that didn't fix the issue. Finally, I uninstalled Norton, manually updated Defender, finished my patching, and then reinstalled Norton after the patch reboot and checking Windows Update to ensure it was current. The Indian helpdesk guy had zero to say about known Defender issues and/or workarounds; he was totally useless.