Why Buy? The Case For Building vs. Buying Windows Mass Management Solutions

Transcription

1 Why Buy? The Case For Building vs. Buying Windows Mass Management Solutions

2 The Case For Building vs. Buying Contents Executive Summary....3 Introduction...3 Are Group Policies and Scripts the Way to Go?...3 What Is the Right Mass Management Solution For Me?....5 Third Party Products for Different Needs....6 Freeware and Shareware Applications...6 Low-End Mass Management Tools....7 High-Performance Mass Management Applications....7 Next Steps....8 Summary....9 About Lieberman Software

3 Windows Mass Management Solutions Executive Summary When it comes to mass management of the Windows computers on your network, there are two alternatives: purchase third party products or create your own solution using scripts, the Active Directory Group Policy feature, and similar means. This paper examines the tradeoffs of different approaches and provides recommendations to improve system reliability and reduce the time spent by IT administrators on tedious, error-prone system management tasks. Introduction I only need to change a few settings on all of my Windows workstations should I handle it by developing a script or should I purchase a third party product? This question faces almost every IT administrator responsible for managing both large and small groups of Windows computers. The need for Windows mass management tools can be prompted by a requirement to more efficiently perform mundane administrative tasks such as ad-hoc patch management and local account provisioning. Or, it can stem from a desire to reliably perform time-sensitive operations that can impact thousands of systems including emergency malware remediation and reporting of wide-scale configuration settings to prove regulatory compliance. Consider the choices faced by senior IT staff at a large North American bank who discovered the organization s Windows computers were infected by a zero-day virus attack. The virus had circumvented the bank s antivirus software after an enterprise systems management agent failed to work as intended. The bank was fortunate to have a high-end mass management solution in place (in this case, User Manager Pro Suite from Lieberman Software) with the flexibility to perform a complex repair scenario they had never envisioned: wide-scale, near-simultaneous malware remediation, Registry repair, operating system patches and reboots on thousands of computers all without the benefit of a functioning antivirus and system management infrastructure. Are Group Policies and Scripts the Way To Go? There are many different ways to create scripts that make changes to Windows computers. For example, the Microsoft Resource Kit for Windows provides a wealth of pre-written scripts that address many issues, ranging from Active Directory user account management to group management. Visit the technical section of most bookstores and you can find a wide range of books on writing computer management scripts. Many of these books contain a large number of pre-written scripts that you can easily implement in your network. There are also numerous books about using the Windows Management Interface (WMI). And, you can also utilize Group Policy to implement changes using the Active Directory feature of Windows

4 The Case For Building vs. Buying Group Policies provide a limited range of changeable options; they offer no conditional logic (that is, you can t change a policy depending on the conditions of each computer) and propagation delays can be significant. There can also be a complex problem of determining the effective setting of a policy if more than one policy is in effect. Because of these Group Policy limitations many IT administrators turn to scripts. However, before opting for scripts it might be wise to consider if IT staff can: Constantly maintain an accurate list of machines to process. Deal with off-line systems (auto-retry list management). Schedule operations on a one-time/periodic basis. Handle multiple domains/workgroups and credentials. Log successes/failures in a human readable/event Log format. Fully document the code and operating procedures of each script to prevent disruptions whenever there are changes to the IT environment or turnover in personnel who maintain and execute the script. Find the time to update the scripts as the environment changes. Find the time to learn all of the scriptable interfaces. Prepare a wide range of reports of system settings. Handle the programming of situations where there are no scriptable interfaces. Handle the gotcha cases where the scriptable interface behaves differently depending on the target system (i.e. XP, 2003, Vista, Server 2008 all with varying levels of hot fixes/service packs). Force the change in managed systems immediately (when there s no time for coding, debugging, or propagation delay). Handle scalability to manage all the organization s systems at a time. Deal with a topology of LAN/WANs with varying speed connections, in which scripts may completely stop and wait for the slowest system in the list. Handle both ASCII and UNICODE data as well multiple languages on different systems. Handle the storage/retrieval/editing of cryptographically sensitive credentials needed for script execution

5 Windows Mass Management Solutions While writing, debugging and executing a successful script might be satisfying work for some administrators, in today s cost-conscious business environment few may have time to design scripts that take into account all of the security, error handling, reporting and other features needed to safeguard target computers when executed in a larger enterprise. It might be practical to ask whether the time taken to write, test and debug scripts could be better spent developing applications that are unique to the business needs of the organization; leaving general-purpose, mass management tasks to a third party product designed for that purpose. The purchase of a third-party mass management solution might seem unnecessary to an IT administrator who writes and maintains a small number of scripts that is, until the administrator is tasked with writing, deploying, debugging, and supporting a significant number of the organization s management scripts over a longer period of time. Need Proof? If you d like to test-drive a high-performance, mass management solution for Windows you can download a free, 30-day evaluation of User Manager Pro Suite from Lieberman Software at User Manager Pro Suite helps you maintain system uptime by quickly performing precision repairs and configuration changes to any number of Windows computers; it gives you control over critical security settings and local administrator account passwords; and, it provides the comprehensive reports you need to better manage your Windows environment. The question to ask is: What added functionality or convenience do I get with a third party solution that I would be missing if I did it myself? The general rule of thumb is to purchase a third-party mass management solution if it provides functionality needed to manage an area that s critical to the organization s business and is impractical to manage with scripts and Group Policy. The question to ask is: What added functionality or convenience do I get with a third party solution that I would be missing if I did it myself? What Is the Right Mass Management Solution For Me? When evaluating third-party mass management solutions, it can be helpful to ask these questions: Whenever I need to get a security configuration report or make a change to all of my systems immediately, does the solution offer me the assurance that I can do so without delay and so that I can avoid the potential for serious damage? Does the product provide me the flexibility to work on just a few computers at a time, or must I apply any changes to large groups of systems? Can the solution support precision, per-computer logic such as move all users except the following to a specific group? Can the solution support per-computer wildcard operators such as change the name/password of the built-in administrator account, no matter what the current name might be? Are the product workflows designed a Help Desk technician, a domain-wide administrator, or both? Can the product manage systems in multiple domains and different workgroups? Can the solution manage computers by NETBIOS, DNS, and IP identities? - 5 -

6 The Case For Building vs. Buying If any of the computers contain sensitive data, does the solution give me the capability to report on and configure their security configurations? Does the product provide auditing and logging capabilities that satisfy my organization s current and likely future needs? Can the solution auto-retry any off-line systems as well as scheduled operations? Does the list of computers that I manage change often enough that I need the product to automatically adapt to the current list? If errors and exceptions have the potential to cause serious issues in my environment, does the solution provide sufficient feedback as to why the error occurred? If it s important for me to see the internal technical details of all operations that are performed on my systems, does the solution provide this information? Does the solution record all operations, as well as who performed them, when, and from where, in both the local and remote systems event logs? Can the software vendor offer proof that the solution is being used successfully to manage other IT environments that are about the same size as mine? Third Party Products for Different Needs Third-party Windows mass management products can be categorized in three groups, as detailed below. Freeware and Shareware Applications Freeware and shareware mass management tools are typically written as scripts (PERL, VB- Script) and offer a simple user interface. Pros: Cons: The tools are either free or inexpensive. The tools offer limited or no support. They typically offer limited functionality compared to commercial alternatives. They can be slow when handling more than a handful of machines. They may offer no or very limited logging features. They typically provide less robust error recovery capabilities. Compared to commercial alternatives, they typically provide far less capability to manage changing groups of computers

7 Windows Mass Management Solutions Low-End Mass Management Tools Many low-end commercial mass management tools are written as Visual Basic applications with a tree-view interface. They typically offer a wide scope of functionality with very limited depth of capabilities in each area. Designed to provide a broad view of a network and to allow drill-down to perform administrative tasks on a specific machine, these products can offer significant improvements over built-in tools provided by Microsoft. The tools in this category represent a very good value for IT staff that do not manage large numbers of systems and do not require more sophisticated features such as encryption, wildcard operations, logging, auditing, recovery, scheduling, and per-system operation logic. Pros: Cons: Low-end commercial tools typically offer wide functional capabilities from a single, consistent interface. They can offer very good value considering the scope of functionality provided. They may offer a suitable solution for Help Desk staff who need to diagnose and repair one workstation at a time. They typically offer low-cost, per-administrator or per-node pricing. In general, low-end tools are not designed for concurrent mass management (though some can generate one-time mass management scripts using resource kit tools). They offer only the most basic options for error recovery and logging, if any. Because many low-end tools are designed in Visual Basic, they offer very limited throughput when performing complex tasks or accessing large numbers of systems. Low-end tools typically support only basic add/delete operations of single objects. Suppliers of low-end tools typically offer only limited support, documentation and training. High-Performance Mass Management Applications High-performance mass management solutions are often written in C/C++ and are designed to handle more complex management scenarios that involve large groups of systems. While the breadth of features offered by these products may not match the smorgasbord of features provided in some low-end commercial toolsets, each supported feature is typically executed in a more comprehensive and robust way. For this reason, high-performance mass management applications are specifically designed for experienced administrators rather than for typical Help Desk staff. The typical purchaser of a dedicated mass management application handles large groups of Windows systems that need similar changes applied nearly simultaneously. The high-end products appeal to IT administrators who are seeking auditing, recovery, scheduling, cryptography, and support for varied and sometimes complex use cases. The best products in this category can also handle multiple languages and varying Windows operating system versions, patch levels, and network speeds smoothly while maintaining a high throughput rate

8 The Case For Building vs. Buying Pros: Cons: High-end mass management applications appeal to those administrators who need thoughtfully-designed feature sets to support a range of potentially complex usage scenarios. The best products in this category easily handle large Windows enterprises and stricter, more complex security standards. Products in this category may offer a utilitarian user interface that is optimized for experienced administrative staff who want to perform more complex tasks with the minimum of mouse clicks. Well-designed high-performance mass management applications offer stable, consistent performance regardless of the number of target computers involved in an operation; they also provide robust error handling and event logging. Because enterprise customers can demand high levels of support, developers of high-performance mass management applications typically offer more comprehensive documentation, a greater number of training options, and responsive technical support after the sale. High-performance mass management products are typically priced per managed node, making them more expensive than shareware and low-end tools. Designed for efficient use by senior administrators, high-end products user interfaces and logging features can be less intuitive for first-time and infrequent users. Next Steps If you d like to evaluate a high-performance, mass management application for Windows in your environment you can download a free, 30-day evaluation of User Manager Pro Suite from Lieberman Software at User Manager Pro Suite helps you maintain system uptime by quickly performing precision repairs and configuration changes to any number of Windows computers; it gives you control over critical security settings and local administrator account passwords; and, it provides the comprehensive reports you need to better manage your Windows environment. For more information, info@liebsoft.com

9 Windows Mass Management Solutions Summary The decision whether to develop Windows management tools in-house or purchase a packaged solution should depend on the complexity of the IT environment and the skill, persistence, and interest level of the administrators involved. For IT staff who don t relish potentially tedious tasks including physically accessing large numbers of individual computers and using built-in Windows tools to make changes high-end mass management products offer the potential for significant time savings and fewer operational errors. Those administrators who manage smaller, less dynamic IT environments may find scripting to be an attractive alternative to manual processes. Yet as organizations grow, their networks become larger, and administrators management tasks become more varied and complex, third-party mass management software can offer greater time savings, a higher degree of control, and greater flexibility to handle unforeseen events compared to scripts that are written and maintained by the organization s IT staff members. In deciding which third party product is right for you, examine the complexity of your requirements, the importance of the feature sets of each product, and of course your budget. Installing and evaluating each product being considered for purchase, examining the technical documentation, and interacting with each vendor s support staff before you buy can provide assurance that the quality of the product matches the value of the systems and data that you re protecting. About Lieberman Software Lieberman Software Corporation, established in 1978 as a software consultancy, has been a profitable, management-owned organization since its inception. The company provides privileged identity management and security management solutions that secure the multi-platform enterprise. By automating time-intensive IT administration tasks, Lieberman Software increases control over the computing infrastructure, reduces security vulnerabilities, improves productivity, and helps ensure regulatory compliance. Lieberman Software is a Microsoft Gold Certified Partner and has technical partnerships with other industry leaders such as Cisco, Novell, Red Hat, Hewlett-Packard, IBM, RSA, Oracle and Intel. The company is headquartered in Los Angeles, CA, and maintains a regional office in Austin, TX. All product development, testing, and support operations are based in the United States. For more information, visit or call (USA and Canada) or (International). P (USA/Canada) P (01) (Worldwide) F (01) Avenue of the Stars, Suite 425, Los Angeles, CA Lieberman Software Corporation. Trademarks are the property of their respective owners