Project Brief

ENT040 – Remote Windows Server Management

Approvals

Background

This project brief describes the objectives, scope, timeline, deliverables and acceptance criteria for the replacement of the current remote Windows server management process, which uses the University’s VPN service to access and manage Windows servers and VMs remotely. The goal of the project is to replace the current process with a service based on Microsoft’s Remote Desktop Gateway for Windows servers. The service will enable members of ITI Enterprise Services, and IS Apps Development Technology and Technology Management teams to remotely access Windows servers for troubleshooting and management purposes. A level of granular security will be delivered with administration groups authorised to only access specific groups of servers for which they have responsibility.

Project Scope

The project will implement secure and robust gateway processes to provide remote access to development, test and live Windows servers managed by the ITI Enterprise Services (ENT) Windows team and IS Apps teams. The implementation will cover the installation and configuration of the gateway, integration with Active Directory, registration of administrators, and definition of server groups and assignment of administrator access to specific server groups. In addition, the configuration of Windows and network firewalls is required to enable access from outside the University to specific VLANs and server groups.

All Windows servers managed by ITI ENT will be add to the gateway. This means servers running Windows Server 2008, 2012 or 2016. All gateway account administration will be managed by the ENT team.

Out of Scope

The work will only provide a new method to enable administrators to remotely connect to Windows servers managed by the ENT Windows team. Access will not be provided to Windows servers managed by other teams e.g. Schools administration team nor will access be provide to non-Windows servers such as Linux (CentOS) servers managed by the ENT Unix teams.

Objectives

The key requirements and the associated priorities are outlined below.

The key objectives on this project are to –

• Install and configure Microsoft’s Remote Desktop Gateway on load balanced servers at JCMB at Appleton Tower to provide access to Windows servers managed by the ENT Windows team at both data centres
• Authorise administrator groups in Active Directory as gateway users
• Define ENT Windows server groups, VLANs, etc. and add servers to the gateway
• Assign access to administrators to specific server groups
• Configure Windows firewalls to provide administrator access to VLANS and servers
• Configure external facing network firewalls to enable remote access to the gateway
• Configure and run Windows Remote Desktop tests to ensure remote end-to-end access via both sites to all defined VLANs and servers
• Test gateway server failover at both sites to ensure all servers can still be accessed
• Define the procedure for using the remote desktop client and updating server and administrator data on the gateway
• Configure the ELK central logging system to retrieve and store gateway logs for review and audit

Deliverables

The following deliverables and acceptance criteria meet the objectives of the project.

Benefits

The successful delivery of this project is expected to provide the following benefits -

• A more secure, robust and appropriate access management to enable administrators to connect to servers remotely thus reducing the need to come on site outside office hours
• A level of granularity that can restrict server access to specific administration groups so that erroneous changes are reduced
• Formal process and procedures are presented to ENT and IS Apps staff to ensure a standard access method is available to administrators
• Gateway logs are transferred to the central logging system to facilitate reviews and to provide the facility to cross reference against other logs

Success Criteria

The following are the criteria to be met to ensure a successful completion of the project –

• An operational gateway service enabling ENT and IS Apps staff access to servers on a remote basis
• A secure service that ensures only access to assigned servers by authorised adminstrators is possible
• An operational process that adds, updates and deletes authorised users in an efficient and timely manner
• Operational and user documentation available and maintained on the process

Project Milestones

The following table outlines the key milestones in the project.

Impact

Priority and Funding

This work has been identified as a Priority 2 project within the ITI Enterprise Services portfolio. No capital investment is required as the Gateway is licenced through existing Windows Server licencing. Resourcing is as outlined in the section below.

Service Excellence

The gateway project aims to meet service excellence goals for information security and process improvement by delivering  new remote Windows server management service that is secure in terms of both user and server access, and is an improvement on the currently provisioned service.

Digital Transformation

The project will deliver a gateway service that uses one of the latest products providing remote access for Windows server management.

The following work breakdown structure summarise the key tasks required to deliver the gateway service.

Dependencies

Clearly a prerequisite to successfully implementing a new remote Windows server management process is the adoption of the process by the ITI Enterprise Services and IS Apps teams by ensuring adequate documentation and training is delivered as part of this project.

Currently no dependencies have been identified with other ongoing ITI projects.

Risks

The risk log will be maintained, on the Projects website, to record and track all risks to resolution. Risk severity and impact, risk owner and planned mitigation date will be assigned by the project team. Major risks with close proximity need to be escalated to the project board via the project sponsor.

Initial risks that have been identified for this project include –

• The project milestones may not be met due to the volume of work in other areas and/or the lack of skilled or available resources
• The scope of the work included in the project must be approved by the project sponsor and senior suppliers; any significant change of scope during the project must be presented and approved by the project sponsor
• Additional costs could be incurred for item such as software licences, additional compute and storage capacity, or network equipment; currently this is categorised as very low risk

Organisation

Work Breakdown

The following work breakdown structure summarises the key tasks required to deliver the gateway service.

Resources, Skills and Costs

No investment costs have been identified for this project gateway software is available under existing licences. It is assumed that the server and storage capacity required is available to build and extend the VMs required to run the service in the current VMware host environment.

The project will run from February 2019 to July 2019 and require limited ITI Enterprise Systems (ENT), Communications Infrastructure Services (CIS), ISG Technology Management and ISG Development Technology resourcing during that period. Estimated resource requirements totals are itemised in the table below

Project Governance

Overall project governance will be provide by the project board whose members are listed below. Day to day project management and delivery is the responsibility of the project team – see section Project Team. As this is a small project, project board meetings will be minimal.

Project Stakeholders

Project Board

The project sponsor is Graeme Wood, Head of ITI Enterprise Services. The following senior stakeholder will be invited to participate in project board meetings.

Project Team

The following diagram shows the key members of the Remote Windows Server Management project team.

Project Estimations

The table below show the estimated times for the main tasks in the project.

Assumptions

The following assumptions have been identified at the start of the project and may be expanded during the project.

• The resources estimated for the project will be available as scheduled to ensure the work assigned in the project plan is completed
• No additional investment costs will be needed for additional licences or equipment
• The remote access process will be thoroughly tested to ensure that is fit for purpose and all administrators have access to the relevant servers
• The remote Windows server management process will be adequately documented and adequate training given to administrators
• A BAU process will be in place to manage, inter alia, administrators, new and decommissioned servers, access rights, network changes and software upgrades

Constraints  

The main constraint for the project is that team members are not fully assigned to the project and are working on other projects and supporting BAU activities. This can be translated into a key risk were precedence for resources may go the BAU work or work on a higher priority project. Management commitment needs to be made to days allocated in the ITI resource plan and to the overall commitment defined in the section Resources, Skills and Costs.

Additionally, it is a management goal to complete the project before the end of FY2018-19. The current plan reflects this. However, the tasks have been stretched across the February to July timeframe to ensure the project does not put excess demand on ITI resources during this period.

Issues

If and when they arise, issues will be recorded, on the Projects website, and tracked throughout the project. Issues that are not outside agreed tolerances will be resolved within the project team. Major issues need to be escalated to the project board for review and advice on resolution. Issue resolution that requires a major change to the project in terms of time, quality or cost needs to be approved under formal change management by the project board.

All project changes outside tolerances must be reviewed and approved by the project board. Project changes within tolerances can be managed with the project team.

Project work that impacts production systems or networks must be communicated with the requisite lead time to the ISG CAB for review and approval.

Tolerances

The following standard ITI project tolerances will be applied and these are outline below. Any deviation outside these tolerances must be reported for review and resolution to the Project Board, if constituted, or the Project Sponsor and Portfolio Manager otherwise.

• Cost – over +/- 10% of original budget
• Plan – slippage of over 4 weeks to current plan
• Scope – extensive addition or reduction from current scope
• Quality – refusal to approve a key project deliverable

Lessons Learned

A log will be maintained on the Projects website to record lessons learned throughout the project. This will be reviewed at the project closure meeting and will be available for review by future projects.

Communication

The following meetings and communication channels will be put in place to support the effective communication of project progress, risk management and escalation.

Attachment	Size
ent040_wbs.jpg	60.79 KB
ent040_organisation.jpg	44.99 KB