Company
Brose is an innovative automotive supplier with products installed in every second new car worldwide. Its 30,000 employees are spread across more than 70 locations around the globe. Modern information technology forms the backbone of the company. Around 580 IT experts ensure smooth processes.
Challenge
Central IT administration and local IT requirements
How does a global corporation manage to operate locally without incurring security risks? How can full administrative access to systems such as Active Directory, Azure AD, SQL Server, etc., be limited to a few administrators, but at the same time empower local IT to do everything they need to do on-site?
Networking and automation have long been a priority
Automation at Brose started even before ScriptRunner came into play. A job scheduling tool was used in the system management environment and for SAP background processes. There was a self-service interface, but it lacked certain features. The desire for an interface that would allow granular work grew louder.
Solution
Delete DNS records, but not entire DNS zones!
A classic example is tasks like 'Delete a DNS record' or 'Create a DNS record'. Some scripts already existed to perform these tasks. But how to ensure security? The Microsoft tools should allow users to act without being given the option of deleting arbitrary DNS records or even entire DNS zones or, for example, being able to create a DHCP range.
After the introduction of ScriptRunner, the existing scripts could be converted directly into actions, a combination of scripts, credentials, targets, and queries. Templates are dynamically filled from Active Directory; associated scripts are started in the background. This way, a user receives a drop-down menu containing only DNS records that the respective user is allowed to see and edit – no more, no less. This gives local IT administrators the room for maneuver they need. "With ScriptRunner, we have a proper, user-friendly interface. We can work granularly and provide self-services to colleagues," says Michael Köppl, Head of IT Automation & Integration.
No chance for tedious tasks
The people in charge were aware that automation can save time, especially time spent on boring things. Manual processing of certain tasks in IT operations can be quite dull and is often no longer appropriate. While IT operations ran on-premises when ScriptRunner was introduced, the corporation is now hybrid. Taking the example of 'Pushing group into Azure AD', Michael Köppl puts it in a nutshell: "That's boring and has no added value for the highly skilled people holding the required high privileges in the system – but it needs to be done." Early on, administrators had written scripts for such boring, repetitive tasks for example, around the topics of group maintenance and mailboxes.
He adds, "There are always small, manual tasks where sometimes the privileges, sometimes the know-how are not there. We now put that into scripts and automate those tasks. Through ScriptRunner, we then have the flexible interface so that other colleagues can delegate and securely trigger these actions."
The users in the company who can already help themselves in this way are the application owners. If a service fails, a script can be triggered to check whether only a server is being patched or whether the service is down actually – and the problem can now be handled more specifically. The concept of empowering users to safely execute scripts and initiate automated tasks themselves will be rolled out even further across the company in the future.
