The Total Economic Impact Of Dell Active Directory Modernization Solution

Transcription

1 A Forrester Total Economic Impact Study Commissioned By Dell Project Director: Michael Speyer March 2015 The Total Economic Impact Of Dell Active Directory Modernization Solution

2 Table Of Contents Executive Summary... 3 Disclosures... 4 TEI Framework And Methodology... 5 Analysis... 6 Financial Summary Dell Active Directory Modernization Solution: Overview Appendix A: Composite Organization Description Appendix B: Total Economic Impact Overview Appendix C: Glossary Appendix D: Endnotes ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2015, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to

3 3 Executive Summary Dell commissioned Forrester Consulting to conduct a Total Economic Impact (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying Active Directory Modernization Solution (ADMS). The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of ADMS on their organizations. ADMS is a suite of software tools that help with Active Directory (AD) domain migration projects and day-to-day AD management. To better understand the benefits, costs, and risks associated with using ADMS, Forrester interviewed four customers that have experience using ADMS. Based on our interviews with Dell customers, Active Directory Modernization Solution allowed them to: Enable centralized management of their AD estates. Shorten the time and lower the risk of migrating users to new domains. Enable single sign-on for users who work at multiple locations. Improve insight into AD group usage. Prior to modernizing their AD estates, the four customers had complex AD domain architectures consisting of hundreds of domains and, in some instances, over 100,000 groups. Loose AD governance enabled multiple users to have administration rights, and their AD backup and recovery processes were not well established. The state of their AD domains posed security and compliance risks, along with the potential for downtime should an AD server fail. Identity attestation and audit review processes were inefficient and cumbersome, and distributed, disconnected domains made providing users access to new technologies on a companywide basis difficult. The overall risk and potential cost to their businesses of not addressing these issues drove the interviewees to simplify and modernize their AD estates. After the organizations went through extensive AD domain re-architecture processes, ADMS enabled centralized management of their AD estates; streamlined report generation needed for identity attestations, which ultimately reduced the overall effort needed for identity attestations; reduced the effort needed to prepare reports for audit reviews; and shortened the time and lowered the risk of migrating users to the new domains. Overall, these efforts deliver ongoing mitigation against security and compliance risk. DELL ACTIVE DIRECTORY MODERNIZATION SOLUTION STREAMLINES USER MIGRATION AND REDUCES IDENTITY ATTESTATION EFFORT Our interviews with four existing customers and subsequent financial analysis found that a composite organization based on these interviewed organizations experienced the risk-adjusted ROI, benefits, and costs shown in Figure 1. 1 See Appendix A for a description of the composite organization. FIGURE 1 Financial Summary Showing Three-Year Risk-Adjusted Results ROI: 124% Payback: 23 months Benefits: $14.5 million Costs: $6.5 million

4 4 Benefits. The composite organization experienced the following three-year risk-adjusted, present value benefits that represent those experienced by the interviewed companies: Reduction in labor needed for user migrations of $44,957. This represents the reduction in labor effort needed to migrate users from old domains to new domains using ADMS. Cumulative reduction in labor needed for AD administration of $5.4 million. Migrating to a new domain architecture resulted in fewer domains, which requires less labor to administer in comparison with the prior domain architecture. Cumulative reduction in labor needed for identity attestation reviews of $8.9 million. Migrating to a new domain architecture resulted in improved data quality and a centralized AD repository. This resulted in improved attestation report quality, which reduced the time needed for managers to perform attestation reviews. Reduction in effort needed for preparing audit reports of $144,216. Improved data quality and the use of ADMS report generation tools reduced the effort needed to prepare audit reports. There was also an improvement in report quality, reducing the effort needed to resolve audit inquiries. Costs. The composite organization experienced the following three-year risk-adjusted, present value, costs: Software licensing and maintenance fees of $3.5 million. This includes license fees and three years of maintenance. Professional services fees of $1.32 million. This is for professional services to assist with AD modernization architecture, planning, engineering, and process development. It does not include any work done to perform the actual migrations. Internal labor for AD migration planning and execution $1.6 million. This represents the internal labor effort needed during the initial AD modernization planning phases, as well as AD user and domain migration. Training tools development expense of $22,313. Training materials were developed on how to execute the processes that were most frequently used for user and machine migration. Learning to use the ADMS software was a self-taught process. Disclosures The reader should be aware of the following: The study is commissioned by Dell and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis. Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the report to determine the appropriateness of an investment in Dell ADMS. Dell reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester's findings or obscure the meaning of the study. Dell provided the customer names for the interviews but did not participate in the interviews.

5 5 TEI Framework And Methodology INTRODUCTION From the information provided in the interviews, Forrester has constructed a Total Economic Impact (TEI) framework for those organizations considering implementing Dell Active Directory Modernization Solution. The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. APPROACH AND METHODOLOGY Forrester took a multistep approach to evaluate the impact that Dell ADMS can have on an organization (see Figure 2). Specifically, we: Interviewed Dell marketing and sales personnel, along with Forrester analysts, to gather data relative to ADMS and the marketplace for ADMS. Interviewed four organizations currently using Dell ADMS to obtain data with respect to costs, benefits, and risks. Designed a composite organization based on characteristics of the interviewed organizations (see Appendix A). Constructed a financial model representative of the interviews using the TEI methodology. The financial model is populated with the cost and benefit data obtained from the interviews as applied to the composite organization. Risk-adjusted the financial model based on issues and concerns highlighted in the interviews. Risk adjustment is a key part of the TEI methodology. While interviewed organizations provided cost and benefit estimates, some categories included a broad range of responses or had a number of outside forces that might have affected the results. For that reason, some cost and benefit totals have been risk-adjusted and are detailed in each relevant section. Forrester employed four fundamental elements of TEI in modeling Dell ADMS service: benefits, costs, flexibility, and risks. Given the increasing sophistication that enterprises have regarding ROI analyses related to IT investments, Forrester s TEI methodology serves to provide a complete picture of the total economic impact of purchase decisions. Please see Appendix B for additional information on the TEI methodology. FIGURE 2 TEI Approach Perform due diligence Conduct customer interviews Design composite organization Construct financial model using TEI framework Write case study

6 6 Analysis COMPOSITE ORGANIZATION For this study, Forrester conducted a total of four interviews with representatives from the following companies, which are Dell customers: A global multiproduct insurance company with 95,000 employees. This company has gross annual insurance premiums of over $4.5 billion. A US regional hospital and healthcare organization with 18,000 employees. An insurance company with 23,000 employees and operations in the US, Europe, and Asia. This company has revenues of approximately $4 billion. A global auto manufacturer with 180,000 employees and operations in over 100 countries. This company has revenues of over $8 billion. Based on the interviews, Forrester constructed a TEI framework, a composite company, and an associated ROI analysis that illustrates the areas financially affected. The composite organization that Forrester synthesized from these results represents a global services firm. It has operations in over 100 countries and has 60,000 employees. Prior to modernizing its AD estate, the composite organization had 120 domains, 80 forests, and 200,000 groups. Domain management was done by multiple administrators spread all over the globe. The company s goal was to reduce the number of domains and forests to 12 and centralize domain management. See Appendix A for a complete description of the composite organization. INTERVIEW HIGHLIGHTS From the interviews, we learned that the interviewed companies had large numbers of AD forests, domains, and groups, with plans to reduce the number of forests and domains. The number of users would remain constant, and group count would vary depending on each company s planned AD architecture and management strategy (see Figure 3). FIGURE 3 Interviewed Companies Active Directory Vital Statistics Company No. 1 Company No. 2 Forests Domains Groups Before ,000 After ,000 Before ,000 After ,000,000+ Company No. 3 Company No. 4 Before ,000 After ,000 Before After 1 1 Not yet determined Not yet determined

7 7 Challenges Prior to migrating their AD infrastructures, the interviewed companies had experienced domain and group proliferation and administration costs, with little planning or oversight. Because each company was geographically dispersed, domain, group, and user administration were decentralized. Multiple users had administrator privileges and were able to perform domain and group administration, with few controls over their privileges and access rights. AD management was most often done using native Windows tools with occasional use of scripts to automate tasks. Few attempts at domain migration had been made, which were largely unsuccessful. The companies lacked the infrastructure to easily manage their AD estates or migrate to a simplified, more centralized AD architecture. The decentralized nature of the interviewed companies domain architecture and lack of controls over administrator access resulted in the following challenges: Security risks posed by uncontrolled access to domain and group management. Companies did not have visibility into administrator activity and were not able to control which administrators could make changes to domains and group policies. This posed a constant security risk, especially in those companies that employed many temporary workers. There was no governance and process around the management of identities, computers, groups, or users. It was like the Wild West. ~Director, identity and access management Difficulty in easily providing users access to new technologies on a companywide basis. Siloed domain architectures made it extremely difficult and time-consuming to provide user access to new technologies, especially if these users could not access the domain in which the new application resided. In one instance, a company had legacy Windows NT4 in its domain estate and needed to migrate off this platform before it could enable companywide user access to new applications. High burden for creating reports needed for identity attestations and audit reviews. Preparing for attestations and audits were error-prone and time-consuming tasks, which needed to be streamlined and with done with improved report quality. Inability to automate identity life-cycle management. Enabling rapid birthright provisioning and getting employees the rights they needed to do their jobs in the quickest manner were especially important to those companies that had a high employee turnover. While these tasks were largely done by the companies identity management systems, these systems relied on sound AD infrastructure to perform efficiently. Inadequate AD backup and recovery solution. When AD disasters like losing a domain server struck, the companies had no easy way to recover lost domains. They realized that if they were to consolidate the number of domains in their AD estates, they would need a solid backup and recovery solution. Inability to create a federated identity system. In some instances, the companies wished to create a federated identity management system, especially when working with external business partners. They found that their current domain architectures made creating federated identity management systems extremely difficult. Solution To overcome these challenges, the companies realized that they would need to re-architect their AD infrastructures. The central theme was to build a greenfield AD architecture with fewer, larger domains that could be centrally managed and controlled. To achieve this, the companies realized that they would need tools that would help automate the migration process from the old domains to the new ones and assist with day-to-day AD management.

8 8 The companies planned their AD migrations over a three- to five-year time span, depending on the size and complexity of their AD estates. Prior to performing the actual migrations, significant effort was spent on planning and process development. All of the interviewed companies used a combination of internal resources and professional services to plan and execute their AD migrations. Professional services included a mix of engineering, architecture, deployment, documentation, and testing and were obtained from Dell or other providers. At the time of the interviews, the companies had completed 20% to 40% of their migrations. Results Although the interviewed companies had only partially completed the modernization of their AD estates, they had already experienced numerous qualitative and quantitative benefits. The qualitative benefits included: Lay the foundation for a global, centralized AD management model. For those companies where AD management was uncontrolled and decentralized, a global centralized management model resulted in overall risk reduction because fewer people had administrator access, and management had the tools to monitor administrator activity and know whether administrators were following governance mandates. They also believed that a global support model would reduce the number of people needed for AD management. Increased user and computer migration speeds. All the interviewed companies reported this benefit, in comparison with what they believed it would have taken without Dell ADMS. In one instance, an organization reported that the AD tools allowed it to perform migrations with fewer boots on the ground because the migrations could be managed remotely. Another company was able to migrate 7,000 users in 38 hours using three administrators. Reporter allows you to format data in a variety of interesting ways. And the formatting makes it more consumable and more palatable to the auditors, which makes them happy. Single sign-on for users who work at multiple locations. This benefit was experienced to the extent that the interviewed ~ Active Directory program lead companies had consolidated their AD domains. It was especially beneficial for the healthcare company where healthcare providers (i.e., doctors or nurses) often worked at multiple locations. This avoided the need to memorize multiple user ID/password combinations, and the organization experienced decreased calls to the help desk for password resets. Improved insight into group usage. ADMS allowed AD administrators to understand which groups were active and who was using them. This, in turn, allowed administrators to identify groups that were no longer in use or seldom used, so that they could be earmarked for consolidation or elimination. Easy delegation of permissions. For those companies that were decentralized, it was necessary to delegate permissions out to their business units. They found that ActiveRoles Server made this process very easy, transparent, and auditable. Similarly, one company found that using ActiveRoles Server to delegate rights enabled it to create a self-service process that allowed business users to manage group rights themselves. Reduction in footprint needed for AD backup and recovery. As a result of using Recovery Manager, one company was able to substantially reduce its footprint required for backup and recovery. We note that centralizing domain management and using well-defined processes along with automation to facilitate such activities as user provisioning and deprovisioning, user and group management, auditing, reporting, and AD backup and recovery can result in improved governance and compliance, a stronger security profile, and lowered risk of business

9 9 downtime. These intangible benefits are of value, and Forrester urges readers to assess the value of these benefits for their own businesses. Best Practices Used To Ensure Modernization Success To ensure AD domain migration success, the interviewed companies made significant investments in upfront planning, engineering, and process development. The costs associated with this effort are detailed in the Costs section. During the planning phase and initial migrations, the companies developed best practices. These included: Ensuring that must have requirements for the migration and management tools are well defined, and that the functionality expected from the ADMS software modules is well understood. Investing significantly in upfront planning. According to one company, you spend 80% of time on planning, 20% on migrating... the tools work, as long as you plan well. This company did not skimp on planning time and had its processes in place before it attempted migrations. Developing templates and training material for repeatable processes. This removes a degree of risk from the processes.

10 10 BENEFITS The composite organization experienced the following quantifiable benefits, based on what we learned from the interviewed companies: Reduction in labor needed for user migrations. Reduction in labor needed for AD administration. Reduction in effort for identity attestation reviews, thus reducing the cost of compliance. Reduction in effort for audit preparation. We also learned of other benefits that have economic value but were not possible to quantify at the time of writing. These benefits include: Cost savings associated with decommissioning legacy platforms and eliminating redundant domains and unneeded software licenses. Reduced help desk labor effort, particularly associated with password resets. Risk reduction associated with eliminating unused user accounts and associated privileges. In one instance, a company reported that it narrowly avoided a security breach after deploying ADMS tools. The company believed that the breach would have cost $750,000 to report, audit, and remediate. Savings on software maintenance and labor associated with Lightweight Directory Access Protocol (LDAP) management, after using Privileged Access Suite for Unix to eliminate LDAP and move authentication services to AD. We note that by using ADMS, the companies avoided having to develop in-house tools for doing the migrations and centralization of AD. Forrester estimates that these costs are as much as two times more than commercial off-the-shelf products. Reduction In Labor Needed For User Migrations We learned that using ADMS sped up the time needed to migrate user accounts and/or computers. In one instance, a company migrated 300 to 400 users and workstations in 15 minutes. In another, a company migrated 7,000 users in 38 hours. We note that for all the interviewed companies, significant resources were spent upfront planning the migrations, including establishing new target accounts and groups and synchronizing data. This allowed for rapid migrations on the actual migration day. The expense associated with these activities is detailed in the Costs section. For the composite organization, we assume the user/computer migrations are spread out over a three-year period (row A1). We also assume that an administrator can migrate 200 users/computers per day using native Windows and an ad hoc tool, and 500 users/computers per day using Dell ADMS, for a net gain of 300 users or computers per administrator each day. This yields a total three-year labor savings of $65,385. There are many factors that change the number of users who can be migrated each day, especially the amount of setup work that is done before the migration and the complexity of the migration. To account for these factors, we risk-adjusted the benefit down by 15%, for a three-year risk-adjusted benefit of $55,557 (see Table 1).

11 11 TABLE 1 Reduction In Labor Needed For User Migrations Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total A1 A2 A3 Number of users/devices migrated Number of user accounts migrated/day/administrator using manual tools Number of user accounts migrated/day/administrator using Dell Active Directory Modernization Solution 60,000 10,000 25,000 25, A4 Number of labor days saved A1/(A3-A2) A5 At IT administrator fully loaded hourly rate Reduction in labor needed for user migrations $85,000/2,080 $40.87 $40.87 $40.87 A4*A5*8 $0 $10,897 $27,244 $27,244 $65,385 Risk adjustment 15% Atr Reduction in labor needed for user migrations (riskadjusted) $0 $9,263 $23,157 $23,157 $55,577 Cumulative Reduction In Labor Needed For AD Administration We learned from the interviewed companies that the overall number of administrators needed to manage their AD estates decreased after the original domains were consolidated into the new domains. We learned that these labor savings did not result in a workforce reduction, but rather re-assignment to different tasks. Pre-migration, the number of domains managed by an administrator varied depending on the size of the domain and the amount of management that each domain required. Forrester estimates that an administrator can manage 1.5 to 2.5 of these domains. The new domains require more administrators per domain because they are significantly larger than the existing domains. For the composite organization, we assume that its 120 existing domains are migrated to 12 new domains over three years (see rows B1 and B6). We assume that for the 120 existing domains, an administrator can manage two existing domains (row B3), requiring a total of 60 administrators. We also assume that each new domain will require two administrators (B7), requiring a total of 24 administrators. As the domains are migrated, an increasing amount of administrators are freed up to do other tasks (row B9). The cumulative savings associated with domain administration are $8.1 million over three years. We learned from the interviews that time and effort needed to manage a domain can vary widely, depending on the size and complexity of each domain. Because of the variability in the number of administrators required per domain, the net savings will vary. Therefore, we risk-adjusted the savings down by 15%, for a three-year risk-adjusted benefit of $6.9 million (see Table 2).

12 12 TABLE 2 Reduction In Labor Needed For AD Administration Ref. Metric Calculation Year 1 Year 2 Year 3 Total B1 Number of domains to be migrated B2 Number of domains not yet migrated 120-B1 (previous years) B3 Number of unmigrated domains managed per administrator B4 B5 B6 B7 B8 B9 B10 Number of administrators needed to manage domains not yet migrated Number of administrators freed up Number of new postmigration domains Number of administrators needed to manage a single new domain Number of administrators needed to manage new domains Net number of administrators freed up AD administrator fully loaded annual salary B2/B B B6*B B5-B ,000 85,000 85,000 Bt Cumulative reduction in labor needed for AD administration B9*B10+Bt (previous year) $510,000 $2,295,000 $5,355,000 $8,160,000 Risk adjustment 15% Btr Cumulative reduction in labor needed for AD administration (riskadjusted) $433,500 $1,950,750 $4,551,750 $6,936,000

13 13 Cumulative Reduction In Effort For Identity Attestation Reviews All companies that fall under regulatory requirements need to perform attestation reviews, so minimizing the costs of performing these reviews is important. The interviewed companies reported decreased time for the business units to perform identity attestation reviews after migrating users to new domains. This resulted from improvements in data quality and report formatting. Improved data quality resulted in fewer queries or reviews, which made the attestation process more timely and run more smoothly. The length of the attestation process was decreased from weeks to days. We note that the value of this benefit increases over time, as more users are migrated over to the new domains. For the composite organization, which has 60,000 employees, the employees are migrated to the new domains at a rate shown in row C1. We assume that the employee to manager ratio is 15 to 1, and the number of managers enjoying the benefit increases from 1,000 in Year 1 to 6,000 in Year 3 (row C3). We assume the company does two attestations per year, and the amount of time needed to perform attestations decreased from 13 hours to 3 hours. Of this time savings, we assume that only 75% is utilized effectively. This yields a cumulative three-year savings of $12.7 million (see Table 3). We risk-adjusted this benefit downward by 10% to reflect variations in the time need to perform attestation reviews and the manager to employee ratio. This yields a risk-adjusted savings of $11.4 million. We note the value of this benefit will increase with the number of reviews conducted annually. TABLE 3 Reduction In Effort For Identity Attestation Reviews Ref. Metric Calculation Year 1 Year 2 Year 3 Total C1 Number of employees migrated to new 10,000 35,000 60,000 domains C2 Average manager/employee ratio C3 Number of managers C1/C2 1,000 3,500 6,000 C4 C5 C6 C7 Number of identity attestation reviews per year Number of hours needed to perform attestations before modernization Number of hours needed to perform attestations after modernization Manager average fully loaded hourly rate $110,000/2,080 $52.88 $52.88 $52.88 C8 Ct Percentage time savings utilized Cumulative reduction in effort for identity attestation reviews C3*C4*(C5- C6)*C7*C8+previous year Risk adjustment 10% 75% 75% 75% $793,269 $3,569,712 $8,329,327 $12,692,308

14 14 Ctr Cumulative reduction in effort for identity attestation reviews (riskadjusted) $713,942 $3,212,740 $7,496,394 $11,423,077 Reduction In Effort Preparing Audit Reports The interviewed companies reported that the effort needed to prepare the reports needed for audit reviews decreased significantly. According to one company, it had approximately 10 employees who worked full time, manually preparing reports for audits. After modernization, this decreased to three people who just oversaw the process with the tool that does all the heavy lifting for us. Similarly, another company reported a significant improvement in report quality, with a five-time decrease in labor effort needed to prepare the reports. For the composite organization, we assume five administrators work for two weeks (40 hours) to prepare audit reports prior to migration. After migration, the number of administrators decreases annually as more users are migrated to new domains, with only two administrators needed by Year 3. Also, the amount of time needed to prepare the reports for the new domains decreases to three hours. This yields a three-year saving of $193,212. To account for the variation in the number of people preparing audit reports and time savings, we risk-adjusted the value of this benefit downward by 10%. The three-year risk-adjusted savings are $173,890 (see Table 4). TABLE 4 Reduction In Effort Preparing Audit Reports Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total D1 Number of audits performed annually D2 Number of administrators involved in report preparation before modernization D3 D4 D5 Time needed to prepare audit reports before modernization (hours) Number of administrators saved for report preparation after modernization Time needed to prepare audit reports before modernization (hours) D6 IT administrator hourly rate $85,000/2,080 $40.87 $40.87 $40.87

15 15 Dt Reduction in effort preparing audit reports D1*((D2*D3)- (D4*D5))*D6 $64,894 $64,404 $63,913 $193,212 Risk adjustment 10% Dtr Reduction in effort preparing audit reports (risk-adjusted) $58,405 $57,963 $57,522 $173,890 Total Benefits Table 5 shows the total of all benefits across the four areas listed above, as well as present values (PVs) discounted at 10%. Over three years, the composite organization expects risk-adjusted total benefits to be a PV of more than $14.5 million. TABLE 5 Total Benefits (Risk-Adjusted) Present Ref. Benefit Category Year 1 Year 2 Year 3 Total Value Atr Reduction in labor needed for user migrations $9,263 $23,157 $23,157 $55,577 $44,957 Btr Cumulative reduction in labor needed for AD administration $433,500 $1,950,750 $4,551,750 $6,936,000 $5,426,078 Ctr Dtr Cumulative reduction in effort for identity attestation reviews Reduction in effort preparing audit reports $713,942 $3,212,740 $7,496,394 $11,423,077 $8,936,348 $58,405 $57,963 $57,522 $173,890 $144,216 Total benefits (risk-adjusted) $1,215,110 $5,244,611 $12,128,823 $18,588,544 $14,551,599

16 16 COSTS The composite organization experienced a number of costs associated with ADMS: Software licenses and maintenance. Professional services fees. Internal labor for AD migration planning and execution. Training tools development. These represent the mix of internal and external costs experienced by the composite organization for initial planning, implementation, and ongoing maintenance associated with the solution. Software Licenses And Maintenance ADMS software is priced on a per-user basis and varies with the number and type of modules purchased. For the composite organization, we assume that the software modules purchased are those that were used in common by the interviewed organizations. These modules are shown in the composite organization description that can be found in Appendix A. For the composite organization, the software license and first-year maintenance expense is $2.7 million. Maintenance is 20% of license cost, or $540,000 for years 2 and 3 (see Table 6). This yields a total license and maintenance cost of $3.78 million All software pricing was supplied to Forrester by Dell. Forrester encourages users to contact Dell to obtain pricing for their own specific situation. TABLE 6 Software Licenses And Maintenance Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total E1 E2 Software license and firstyear maintenance Annual software maintenance (20% if license cost) $2,700,000 $540,000 $540,000 Et Software licenses and maintenance E1+E2 $2,700,000 $0 $540,000 $540,000 $3,780,000 Risk adjustment 100% Etr Software licenses and maintenance (riskadjusted) $2,700,000 $0 $540,000 $540,000 $3,780,000 Professional Services Fees All of the interviewed companies used professional services to assist with their AD modernization architecture, planning, engineering, and process development. In no cases were services used for migration execution. Professional services fees paid by the interviewed organizations ranged from less than $1 million to over $2 million. Professional services included

17 17 knowledge transfer, which allowed the interviewed companies to create their own training tools. These training tools were focused on migration process execution and AD management, as opposed to using the Dell software. For the composite organization, we assume professional services fees of $1.2 million. We risk-adjusted this upward by 10% to account for variations in the actual work done, the project complexity, and the amount of internal resources devoted to initial phases of the modernization project. This yields a risk-adjusted total of $1.32 million (see Table 7). TABLE 7 Professional Services Fees Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total F1 Professional services fees $1,200,000 Ft Professional services fees F1 $1,200,000 $0 $0 $0 $1,200,000 Risk adjustment 10% Ftr Professional services fees (risk-adjusted) $1,320,000 $0 $0 $0 $1,320,000 Internal Labor For AD Migration Planning And Execution According to one interviewee, the time spend on AD modernization is 80% planning and 20% migrating. Another interviewee said that migrating is 90% logistics and 10% technology. To this end, all the interviewed companies invested considerable resources in the initial planning phases, ranging from four to 20 full-time equivalents (FTEs). The number of FTEs varied with the size and complexity of the project and the relative use of professional services to perform the planning work. After the initial planning phases were complete, the companies assigned engineers to migration execution. The number of engineers ranged from four to 16 FTEs. These engineers were separate from administrators who performed daily AD administration tasks. We note that additional administrators at local sites may be needed in supporting roles during the actual migrations. For the composite organization, we assume that eight engineers are assigned to initial migration planning and four are assigned to migration execution. This yields a total internal labor expense of $1.7 million. We risk-adjusted this upward by 5% to reflect variations in the amount of internal resources that each company devotes to AD planning and migration. This results in a total risk-adjusted labor expense of $1.78 million (see Table 8).

18 18 TABLE 8 Internal Labor For AD Migration Planning And Execution Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total Number of IT G1 administrators needed for planning 8 G2 G3 G4 Gt Gtr AD architect full loaded annual salary Number of IT administrators needed for migration execution IT administrator fully loaded annual salary Internal labor for AD migration planning and execution 85, ,000 85,000 85,000 (G1+G2)+(G3+G4) $680,000 $340,000 $340,000 $340,000 $1,700,000 Risk Adjustment 105% Internal labor for AD migration planning and execution (riskadjusted) $714,000 $357,000 $357,000 $357,000 $1,785,000 Training Tools Development All the interviewed companies adopted a train the trainer approach in learning how to execute the migration processes. Training tools were developed for the most-used processes, especially those used in large migrations. Learning to use the Dell software was generally a self-teaching process, requiring relatively little effort. For the composite organization, we conservatively assume that 25% of an FTE is used during the initial phases to develop training materials. This yields a training tool development expense of $21,250. We risk-adjusted this upward by 5% to account for the variations in the amount of time needed to develop the tools, which results in a risk-adjusted training expense of $22,313 (see Table 9). TABLE 9 Training Tools Development Ref. Metric Calculation Initial Year 1 Year 2 Year 3 Total

19 19 H1 H2 H3 Number of FTEs needed to develop training tools Time needed to develop tools Training developer fully loaded annual salary 1 25% $85,000 Ht Training tools development H1*H2*H3 $21,250 $0 $0 $0 $21,250 Htr Risk adjustment 5% Training tools development (riskadjusted) $22,313 $0 $0 $0 $22,313 Total Costs Table 10 shows the total of all costs as well as associated present values, discounted at 10%. Over three years, the composite organization expects total costs to total a net present value of a little more than $6.5 million. TABLE 10 Total Costs (Risk-Adjusted) Ref. Cost Category Initial Year 1 Year 2 Year 3 Total Present Value Etr Software licenses and maintenance ($2,700,000) $0 ($540,000) ($540,000) ($3,780,000) ($3,551,991) Ftr Professional services ($1,320,000) $0 $0 $0 ($1,320,000) ($1,320,000) Gtr Internal labor for AD migration planning and execution ($714,000) ($357,000) ($357,000) ($357,000) ($1,785,000) ($1,601,806) Htr Training tools development ($22,313) $0 $0 $0 ($22,313) ($22,313) Total costs (risk-adjusted) ($4,756,313) ($357,000) ($897,000) ($897,000) ($6,907,313) ($6,496,110) FLEXIBILITY Flexibility, as defined by TEI, represents an investment in additional capacity or capability that could be turned into business benefit for some future additional investment. This provides an organization with the right or the ability to engage in future initiatives but not the obligation to do so. There are multiple scenarios in which a customer might choose to implement ADMS and later realize additional uses and business opportunities. Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix B). At the time of writing, the interviewed organizations were still executing their migrations and were not planning further investments in ADMS.

20 20 RISKS Forrester defines two types of risk associated with this analysis: implementation risk and impact risk. Implementation risk is the risk that a proposed investment in ADMS may deviate from the original or expected requirements, resulting in higher costs than anticipated. Impact risk refers to the risk that the business or technology needs of the organization may not be met by the investment in ADMS, resulting in lower overall total benefits. The greater the uncertainty, the wider the potential range of outcomes for cost and benefit estimates. TABLE 11 Benefit And Cost Risk Adjustments Benefits Adjustment Reduction in labor needed for user migrations 15% Cumulative reduction in labor needed for AD administration 15% Cumulative reduction in effort for identity attestation reviews 10% Reduction in effort preparing audit reports 10% Costs Adjustment Professional services 10% Internal labor for AD migration planning and execution 5% Training tools development 5% Quantitatively capturing implementation risk and impact risk by directly adjusting the financial estimates results provides more meaningful and accurate estimates and a more accurate projection of the ROI. In general, risks affect costs by raising the original estimates, and they affect benefits by reducing the original estimates. The risk-adjusted numbers should be taken as realistic expectations since they represent the expected values considering risk. The following impact risks that affect benefits are identified as part of the analysis: Reduction in labor needed for user migrations will depend on the effectiveness of the migration planning and migration complexity. Cumulative reduction in labor needed for AD administration will depend on the rate at which users and domains are migrated and the number of domains that an administrator can effectively manage. This will depend on the size of the domains. Cumulative reduction in effort for identity attestation reviews will vary with the time needed to perform attestation reviews, the manager to employee ratio, and the number of attestations conducted annually. Reduction in effort preparing audit reports will vary with the number of domains, the number of audits performed annually, and the amount of automation used for report preparation prior to domain migration. The following implementation risks that affect costs are identified as part of this analysis:

21 21 Professional services will vary with the size and complexity of the AD modernization project. Internal labor for AD migration planning and execution will depend on how many of these tasks are outsourced to thirdparty providers, the number of users who are migrated, and the rate at which migrations will happen. Training tools development will vary with the amount of training tools that are developed. Table 11 shows the values used to adjust for risk and uncertainty in the cost and benefit estimates for the composite organization. Readers are urged to apply their own risk ranges based on their own degree of confidence in the cost and benefit estimates.

22 22 Financial Summary The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the composite organization s investment in ADMS. Table 12 below shows the risk-adjusted ROI, NPV, and payback period values. These values are determined by applying the risk-adjustment values from Table 11 in the Risks section to the unadjusted results in each relevant cost and benefit section. FIGURE 4 Cash Flow Chart (Risk-Adjusted) $14,000,000 $12,000,000 $10,000,000 $8,000,000 Financial Analysis (risk-adjusted) Cash Flows $6,000,000 $4,000,000 $2,000,000 $0 ($2,000,000) ($4,000,000) ($6,000,000) Initial Year 1 Year 2 Year 3 Total Costs Total Benefits Cumulative Total TABLE 12 Cash Flow (Risk-Adjusted) Initial Year 1 Year 2 Year 3 Total Present Value Costs ($4,756,313) ($357,000) ($897,000) ($897,000) ($6,907,313) ($6,496,110) Benefits $0 $1,215,110 $5,244,611 $12,128,823 $18,588,544 $14,551,599 Net benefits ($4,756,313) $858,110 $4,347,611 $11,231,823 $11,681,232 $8,055,489 ROI 124% Payback period 22.8

23 23 Dell Active Directory Modernization Solution: Overview The following information is provided by Dell. Forrester has not validated any claims and does not endorse Dell or its offerings. Dell Active Directory Modernization Solution helps organization streamline active directory to more easily manager and better secure their infrastructure. With their solution, Dell helps users meet the challenges of the daily management of Active Directory, challenges of business-impacting downtime, security breaches, audits, limited agility, lack of resources and rising costs. This solution helps customers meet their challenges by: Enabling the efficient daily management of their AD environment. Providing a secure infrastructure by ensuring users can access only the resources they need to do their job. Handling control of Unix, Linux and Mac systems through AD. Reducing security breaches by automating, tracking, alerting and reporting on the who-what-where of changes across the network. Ensuring business as usual with automated and granular data backup and recovery Empowering the organization to be nimble, reactive and ready to stay ahead of business changes and evolving technology that impacts infrastructure, applications and data. Dell Active Directory Modernization Solution consists of 6 key areas: Restructure, Manage, Secure, Comply, Extend, Recover. While the goal of each organization may be the same, the journey can be very different for each organization and Dell offers a complete end to end AD Modernization solution.

24 24 Appendix A: Composite Organization Description The composite organization is a global financial services firm. It has operations in over 100 countries. The company has 60,000 employees. Prior to using Dell AD modernization tools, the organization had 120 domains, 200,000 groups, and 80 forests. Domain and user administration were decentralized. Multiple users performed domain administration, with little oversight into or controls over their privileges and access rights. The decentralized nature of the domain architecture and lack of controls over user access resulted in the following overarching challenges: Difficulty in providing access to new technologies throughout the company. A high burden for creating the reports needed for identity attestation and audit reviews. Security risks posed by uncontrolled access to domain management. No infrastructure to easily manage the AD estate or migrate to a more centralized AD architecture. To meet these challenges, the organization decided to centralize AD management and shrink its AD architecture. In doing so, it would collapse 120 domains to 12, and 80 Forests to 12. To achieve these goals, the organization realized that it would need to automate the migration process and invest significant time to create a new domain architecture and the processes for performing the migrations. The company decided to use Dell Active Directory Modernization Solution. It planned to perform the migrations over a three-year period. The Active Directory Modernization Solution components that the organization purchased are: ActiveRoles Server. Authentication services (Privileged Access Suite for Unix). Change Auditor. Enterprise Reporter. GPOAdmin. Migration Manager for Active Directory. Recovery Manager for Active Directory Forest Edition. Spotlight on Active Directory.

25 25 Appendix B: Total Economic Impact Overview Total Economic Impact is a methodology developed by Forrester Research that enhances a company s technology decisionmaking processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders. The TEI methodology consists of four components to evaluate investment value: benefits, costs, flexibility, and risks. BENEFITS Benefits represent the value delivered to the user organization IT and/or business units by the proposed product or project. Often, product or project justification exercises focus just on IT cost and cost reduction, leaving little room to analyze the effect of the technology on the entire organization. The TEI methodology and the resulting financial model place equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization. Calculation of benefit estimates involves a clear dialogue with the user organization to understand the specific value that is created. In addition, Forrester also requires that there be a clear line of accountability established between the measurement and justification of benefit estimates after the project has been completed. This ensures that benefit estimates tie back directly to the bottom line. COSTS Costs represent the investment necessary to capture the value, or benefits, of the proposed project. IT or the business units may incur costs in the form of fully burdened labor, subcontractors, or materials. Costs consider all the investments and expenses necessary to deliver the proposed value. In addition, the cost category within TEI captures any incremental costs over the existing environment for ongoing costs associated with the solution. All costs must be tied to the benefits that are created. FLEXIBILITY Within the TEI methodology, direct benefits represent one part of the investment value. While direct benefits can typically be the primary way to justify a project, Forrester believes that organizations should be able to measure the strategic value of an investment. Flexibility represents the value that can be obtained for some future additional investment building on top of the initial investment already made. For instance, an investment in an enterprisewide upgrade of an office productivity suite can potentially increase standardization (to increase efficiency) and reduce licensing costs. However, an embedded collaboration feature may translate to greater worker productivity if activated. The collaboration can only be used with additional investment in training at some future point. However, having the ability to capture that benefit has a PV that can be estimated. The flexibility component of TEI captures that value. RISKS Risks measure the uncertainty of benefit and cost estimates contained within the investment. Uncertainty is measured in two ways: 1) the likelihood that the cost and benefit estimates will meet the original projections and 2) the likelihood that the estimates will be measured and tracked over time. TEI risk factors are based on a probability density function known as triangular distribution to the values entered. At a minimum, three values are calculated to estimate the risk factor around each cost and benefit.