Workstation handbook
Revision 24.3 · reviewed 2026-07-18 by Platform OperationsOperating documentation for managed workstations and portal access. Sections are maintained by the owning team; raise corrections through the Servicedesk.
Getting started
Every new workstation is delivered pre-imaged and joined to the domain. Your first sign-in provisions the profile, maps departmental resources and enrolls the machine as a trusted device.
First sign-in
- Connect the workstation to the corporate network by cable for the first sign-in. Wireless enrollment is not supported.
- Sign in with your domain account and the initial password from your welcome letter. You will be required to change it immediately.
- Enroll a second factor when prompted. Store the ten backup codes somewhere outside the workstation.
- Wait for the first policy cycle to complete — roughly six minutes. Do not restart during this step.
What is provisioned automatically
| Home share | Mapped to H:, 50 GB quota, backed up nightly |
| Department volume | Mapped to S: based on your primary group |
| Printers | Follow-me queue for your floor; release at any device with your badge |
| Baseline software | Office suite, browser, VPN client, endpoint agent |
Roles & permissions
Access is granted through roles, never to individual accounts. Roles are reviewed quarterly by the system owner; anything unused for 90 days is withdrawn automatically.
| Role | Grants | Approval |
|---|---|---|
| Workstation User | Portal sign-in, own device management, tool catalogue | Automatic on hire |
| Team Lead | Team audit records, access request approval | Line manager |
| Workstation Administrator | User management, announcements, audit export | Head of IT + security review |
| Auditor | Read-only access to all audit records | Compliance |
Requesting a change
Submit an access request in the Servicedesk. Requests need a business justification and your line manager's approval; privileged roles additionally require security review. Expect two working days end to end.
Common operations
Change your password
Passwords expire after 180 days. Change yours from Account → Password, or press Ctrl + Alt + Del on the workstation. Minimum 14 characters; the last ten passwords cannot be reused.
Enroll or revoke a device
Trusted devices skip the second factor for 30 days. Manage them under Account → Trusted devices. Revoke any device you no longer control — revocation takes effect at the next request, within about 60 seconds.
Map an additional share
Shares follow group membership, so mapping one manually will not grant access. Request the group first, then map:
net use P: \\fs-sin-02\projects /persistent:yesInstall catalogued software
Open Software Centre from the taskbar and install from the catalogue — no administrator rights are needed. Installations outside the catalogue are blocked by policy.
Remote access & VPN
The VPN client is pre-installed and configured for the gateway closest to your registered office. Certificate-based authentication is used; you will still be prompted for a second factor once every 12 hours.
| Gateway | Region | Use for |
|---|---|---|
| gw-sin-01 | AP-East | Singapore, Hong Kong, Sydney staff |
| gw-fra-01 | EU-West | Frankfurt, London staff |
| gw-iad-01 | US-East | North America staff |
Split tunnelling is disabled. All traffic is routed through the gateway while connected, including personal browsing — see Acceptable use.
Browsers & clients
The portal targets the two most recent versions of the browsers below. Older versions may load but are not tested and will not receive fixes.
| Client | Baseline | Notes |
|---|---|---|
| Chrome / Edge | 132+ | Recommended on managed workstations |
| Firefox | 135+ | Supported; ESR channel tested quarterly |
| Safari | 18+ | Disable strict tracking prevention for SSO |
| Mobile browsers | iOS 17+ / Android 14+ | Read-only pages only; admin actions are blocked |
Cookies and JavaScript are required. Extensions that block first-party storage will break sign-in.
Content delivery
The portal is split into two planes. The control plane serves pages, the session and the APIs; it is small, personalised and must stay responsive. The content plane serves images, video, audio and packages; it is large, impersonal and highly cacheable. They run on different hostnames so that a company-wide image rollout cannot slow down the login page.
Planes and hostnames
| Hostname | Plane | Serves | Cookies |
|---|---|---|---|
| portal.northbay.example | Control | HTML, session, APIs, signed-URL issuance | Session cookie |
| id.northbay.example | Control | Sign-in, SSO, MFA | Identity cookie |
| static.nbcdn.example | Content | Hashed CSS, JS, fonts, icon sprites | None |
| media.nbcdn.example | Content | Image renditions, thumbnails, posters, index documents | None |
| stream.nbcdn.example | Content | HLS manifests and media segments | None |
| dl.nbcdn.example | Content | Packages, archives, datasets | None |
| origin-media.nb.internal | Origin | Object store, reachable only from the shield PoP | None |
Content hostnames are cookieless by construction: they are not subdomains of the portal, so no session cookie is ever attached to a media request. That removes a class of leak, keeps requests small, and lets the CDN cache a single copy of an object for everyone.
What may be cached, and for how long
| Content | Endpoint | Cache-Control | Why |
|---|---|---|---|
| Hashed build assets | static | public, max-age=31536000, immutable |
The filename changes when the bytes change |
| Image renditions | media | public, max-age=604800, stale-while-revalidate=86400 |
Derived and versioned; a stale thumbnail is harmless |
| Media segments | stream | public, max-age=31536000, immutable |
Content-addressed; re-encoding produces new paths |
| VOD manifest | stream | public, max-age=60 |
Short TTL makes a ladder change visible without a purge |
| Packages and datasets | dl | public, max-age=31536000, immutable |
Versioned path plus published digest |
| Library index document | media | public, s-maxage=60, stale-while-revalidate=300 |
Shared per role group, rebuilt on publish |
| Public status JSON | media | public, s-maxage=15, stale-while-revalidate=30 |
Survives the incident that makes people load it |
| Portal HTML and APIs | portal | no-store |
Personalised; must never enter a shared cache |
| Signed-URL issuance | portal | no-store |
Entitlement is decided per request |
| Audit, account, admin | portal | no-store, private |
Contains personal and security-relevant data |
Rules that keep the split honest
- Version in the path, never overwrite. New bytes get a new URL. Purging is then an exception — for mistakes and takedowns — rather than part of normal publishing.
- Never cache a decision, only an object. Entitlement is enforced when the signed URL is issued. Nothing that varies per user is allowed into a shared cache.
- Application servers do not stream bytes. The portal issues a signed URL and redirects; the edge does the transfer. A 6 GB image download occupies no portal worker.
- Confidential material is signed and short-lived. 15-minute URLs, no shared caching, every issuance recorded in the audit log.
- Shield the origin. Only one PoP may reach the object store, so a cold cache in seven locations costs one origin fetch, not seven.
- Shape bytes at the edge, count requests at the portal. The two planes need different limits; sharing one rate limiter would let a download storm starve sign-in.
- Report them separately. The content delivery status page exists so that "video is slow" and "I cannot sign in" are never the same conversation.
Client behaviour
Range requests are enabled on dl, so transfers resume after a disconnect; the download manager uses this for anything above 20 GB. HTTP/3 is enabled on all content endpoints. Player traffic never touches the portal during playback — if the control plane is degraded, playback that has already started continues to completion.
Security baseline
- Disk encryption — enforced on every workstation; recovery keys are escrowed centrally.
- Screen lock — automatic after 10 minutes idle, 5 minutes in shared areas.
- Local administrator — not granted to standard accounts. Temporary elevation is time-boxed to four hours and fully logged.
- Patch rings — pilot on Tuesdays, broad rollout on Thursdays, mandatory within 72 hours.
- Endpoint agent — must be running; a workstation reporting an unhealthy agent loses network access after 24 hours.
Data handling
Classify before you store. The classification determines where a file may live and how long it is retained.
| Class | Where it may be stored | Retention |
|---|---|---|
| Public | Any corporate system | — |
| Internal | Home share, department volume | 3 years |
| Confidential | Department volume with restricted group | 7 years |
| Restricted | Approved secure enclave only | Per contract |
Removable media is blocked by default. Export to external storage requires a data transfer approval recorded against your account.
Acceptable use
Workstations, the portal and the corporate network are provided for business purposes. Limited personal use is tolerated where it does not interfere with work, consume significant resources or breach policy.
Access to this system is logged, including sign-in attempts, administrative actions and file access on department volumes. Logs are retained for 400 days and may be reviewed during a security investigation.
Sharing credentials, disabling security controls or connecting unmanaged equipment to the corporate network are disciplinary matters. If you believe an account or device is compromised, call the P1 hotline on ext. 4100 immediately.