Would your security team ever allow scheduled compute on idle user workstations?

Why would there ever be a need for this

To use corporate resources to mine crypto for free. Duh.

But I'm asking why in a corporate environment? You have servers for this stuff.

Not least because any security suite worth half what's paid for it is going to have a field day of false positives trying to identify anomalous behavior, depending on how arbitrary those workloads are.

F@h is still cooking. I think cryptocurrencies, and now AI, has taken much of the spare compute, but they're still running strong. The project typically has less FLOPS during the summer during peak heat, but in the winter it's really going.

Distributed compute. It’s a thing. Look up incredibuild for example https://www.incredibuild.com/

Sounds like you're too young to remember folding@home. You'd install an agent called BOINC and run folding or seti. Distributed computing like 20+ years ago. My IT director at the time was number 1 on seti@home until the school district he ran busted him and charged him with computer tampering and a number of other felonies including theft of district resources. They tried to get him on stealing like a million dollars worth of electricity for the few years the agent was running on thousands of classroom computers.

27 or so years ago when I was an intern I was hired basically to be a social security number so a company could get a government contract. I did no work at all there but I sat all summer and worked on a wen hosting company that I sold. Long story short I was wondering why my linux desktop was lagging so much so I noticed there was a program running using all the CPU. It was either protein folding or SETI or something We didn't get root on the desktop so I just booted into single user mode and the IT staff didn't password it so I disabled it and rebooted. The next day i go into "work" and my desktop was gone with a note saying see IT. I showed it to my manager and explained what I did and she started to ask everyone in the company to check processes and it was running on all desktops. His excuse was I hacked the desktop and it was removed due to that. Then his excuse was it was running at a low nice level so shouldn't steal CPU. He was fired that day and I got my desktop back to do get paid to build my web hosting company

The price of servers went up like 600% and every crappy desktop app needs 16GB of ram so there is a buttload of capacity sitting around. Honestly not the worst idea I've heard lately.

engineering workstations and desktops running Linux often allowed preempt-able jobs managed by Slurm to consume idle capacity. Seen that in a few market niches The issue is scheduling and executing remote compute is “easy” but it’s hard to handle identity, storage and data movement. This is why Folding@Home was a thing because molecular dynamics is data light and cpu heavy sp it’s easy to farm out to distributed systems I don’t see it much these days mostly because the type of compute in my market requires terabytes to petabytes of data and storage

Render farms for 3D/VFX/CAD software like Autodesk's 3ds Max and Maya, to pick 2 examples I used to do this with. Back in the day (I'm talking up until the 2010s), this was fairly popular in the AEC (Architecture/Engineering/Construction) and 3D/visual effects industries. Instead of one PC taking several days to render a very high-res, detailed scene or animation like an architectural visualization of a new building concept or something, you could do it overnight by queueing a render job to run on something like Autodesk Backburner after-hours and your rendering job would be completed by the next morning, utilizing all of the spare CPU and GPU compute on the entire network. It was really easy to setup a render farm and you could run multiple jobs on a schedule within certain hours, so the moment everyone clocks off for the day, the rendering farm starts churning away on the queued up jobs. All it required was installing Backburner on the rendering PCs and leaving them powered on after-hours. I knew larger companies that actually sold this as a service back in the day too, distributed rendering of very large/complex jobs that would take smaller orgs or individuals days or even weeks to complete by themselves. Nowadays with real-time rendering engines being so good, it's probably less commonplace but I'd imagine there's still a place in these industries for distributed rendering internally.

We had a client ask about this but it a like $8 to use 4x 32 vcpu servers for an hour. Either azure or aws . And that fits right in with the dev workflow, with deployment. If you needed 10x as much, you could get that. If this is an irregular thing it doesn’t make financial sense to pursue because of the engineering time also the power use, support when something goes wrong. And if it’s a regular thing it’s better to get dedicated hardware

Say there was a tool that ran batch jobs on engineering workstations after hours, inside your own network So an RMM

My security team would allow it but the company I work in is running on solar and they would not be happy about the electricity bill (welcome to Germany where electricity is luxury)

Not policy but i don't think it would get past security review. Vetting the process would be monumental, what it can do on the machine (not what they vendor says it can do), how is activates and deactivates, and how it actually works. NDAs, watching for exfiltration, watching for contamination and leaks. Add in department heads and researchers shying away from it. NO, a vibe-coded AI will never run unattended on corporate hardware. At least not in the environment i work at

It probably would depend upon what the schedule computing task was doing and what it was for. We have a variety of scheduled tasks running on edge machines, servers, and workstations. Use cases range from sending batches of process data to a corp historian database to diagnostics collection for root cause analysis to OT controls & alarming to network status detections to the usual software update maintenance activities...

As long as it’s company code for company reasons then it’s a good use of compute power , pre virtualisation layers and gpu’s we did it

I used to work at a VFX studio where this was just super normal. I don't currently work at a studio so I can't speak to exactly what they are doing these days, but I can't imagine it's much different. Especially these days when GPU compute servers for a renderfarm are almost impossible to buy, you wouldn't just leave a bunch of compute capacity sitting idle for no reason. Artist workstations where were everything got made, so the workstations had all the ACL's and permissions to get access to the storage they'd need for rendering. This was normal going back to the 90's when it was done on SGI Irix workstations using Alfred as the work queue.

One place where I worked (not as a sysadmin though) years ago, that was done. It was a research centre though, and there was a compute cluster that ran on SGE (Sun Grid Engine) back then. Some labs in the centre had their analysis workstations hooked up as cluster nodes as well so that they can accept jobs when not in use. This was not done with general purpose PCs like office admin staff. It was only research workstations that had configurations which were aligned with the cluster. Similarly, I've heard of certain industries (VFX or Animation shops in particular) where it's common that artist workstations would extend the render farm for overnight renders, etc.

This is something that PBS has supported for decades at this point and wasn't unheard of. And AFAIK this is still supported. Cycle scavenging was definitely a thing. I mean, that is fundamentally what a batch scheduler does. Just need something to watch for interactive use and kill. Of course I wouldn't want to do anything with a lot of I/O or communication, but for single node compute throughput cases it's not completely unreasonable.

You'll save more trading the workstations for laptops and the building for a well designed cloud setup, properly sizing that type of low priority, highly parallelizable, compute work onto spot instances during off-peak times. And your staff will be happier.

Security aside, the average office doesn't have the power or cooling infrastructure to support every machine running at full capacity at all times. I suppose that it could be designed that way, but then you would have a data center and not an office.

Not sure this is any different then using shared compute, extrapolate on that and you get VDI. It gets a pass for several reasons. The compute is sitting there idle Nothing is entering or leaving the agency, its internal work. No noticeable impacts to users. What is the security threat - that entirety depends on the 'batch job' and what that runs under on the pc. Every computer left idle has something running in the background anyway, even if thats a screen saver. Cluster compute projects have been an idle curiosity. I deployed MOSIX back in the day. These days render farms and other thing use software like HTCondor, BOINC, OpenCue Flamenco etc. The agency I work for went a different route, we invested in VDI with large central servers and lightweight thin clients at the edge. This gives us lots of spare capacity when not serving up desktops to users. Costly but the servers have multiple GPU's, terabytes of ram and 64+core CPU's each, more then 80% of of each box can be allocated to after hours projects with no impacts. With the workload set to the lowest priority, it gets stunned as soon as the cluster needs that power back. Fewer endpoints to have to roll into a cluster.

As long as source of the code Iis from inside the comlany I see no problem. We did it a lot.