Chasing the Mobile Desktop: How to Tame your Distributed Desktop Environment

Transcription

1 1 Table of Contents Executive Summary... 1 Desktop Management Checklist... 2 Traditional Desktop Systems Management... 3 PCLM Challenges... 4 PC Backup and Restore Challenges... 6 Desktop Virtualization... 7 Desktop Virtualization Challenges... 7 Extending Desktop Management to a Remote and Mobile Workforce... 9 Distributed Desktop Virtualization Chasing the Mobile Desktop: How to Tame your Distributed Desktop Environment Executive Summary Distributed organizations have unique desktop management challenges. End users span the globe, are often offline or connected via higher latency links, and typically have administrative privileges that can lead to a more unstable PC environment. Emerging technologies show promise for reducing desktop TCO, but assessing how they will work in a distributed environment is critical. This white paper surveys existing and emerging approaches to desktop management in the enterprise, covering both traditional systems management methods, as well as newer desktop virtualization technologies. We will discuss their advantages and shortcomings of each approach, and propose an alternative paradigm to desktop management that attempts to reconcile the conflicting needs of user experience and mobility vs. centralized management and control. Page 1

2 2 The Scope of Desktop and Laptop Management Tasks The management of desktops in the distributed enterprise encompasses all tasks related to keeping the desktops functional and their users productive. In this white paper, we focus on the tasks that can be automated with a desktop management system. When considering a desktop management solution, one should consider whether it addresses the following checklist of capabilities: Deployment, Migration and Retirement OS deployment and provisioning What are the tools and process for deploying the OS to newly provisioned machines, including delivery, boot and system configuration? Single image management Can you configure, update and patch a base image, consisting of the OS and a core set of applications that are common to some or all users? Hardware and OS migration/refresh Can you refresh the hardware while retaining user data, user-installed applications, and environment?; What is the process for migrating existing desktops to a new operating system (e.g., XP to Win7)? Archival of the desktop environment When de-provisioning hardware or when users leave the company, can you retain a copy of the user environment? Management and Operations Asset management What tools are available to track and manage software licenses, devices and inventory? Software distribution What process, tools and infrastructure are required to deliver application packages to all users, both LAN connected and distributed? Update and patch management How are endpoints updated with applications, drivers and OS patches? Compliance management Can you ensure that endpoints comply with corporate policies, including applications (black lists and white lists), versions, patches, and malware? Support Helpdesk operations What tools are available to helpdesk staff identify end user issues quickly? Break/fix, troubleshooting What methods and tools are available to help troubleshoot and quickly fix problems reported by end users? Remote control Can helpdesk staff remotely access an endpoint to troubleshoot a device? Restore from a snapshot Can a desktop be restored to a last known working configuration, in case of malware or software problems that reduce user productivity? Page 2

3 Backup and Continuous Data Protection Disaster recovery (system level ) Can a user be restored to a fully operational state after a laptop is lost, stolen or broken including user-installed applications, user data, and personal settings? What level of downtime is acceptable? Backup/restore (file level) Can end users restore individual files/directories that were deleted by accident, or retrieve older versions of files? Does this require helpdesk intervention? Restore persona (different desktops) Can a user s full environment be restored onto a different desktop environment (different hardware, virtual hardware, etc.?) Once core capabilities are defined, a desktop management system can then be evaluated against the following characteristics: 1. Coverage How comprehensively does a solution address the above functions? 2. Support for distributed users How effective are these solutions for users who are connected to the enterprise through VPN and/or WAN connections, and what is their user-experience, both during regular end user operation as well as during the management system s operation? For example, how quickly can IT get an end user back to full productivity after restoring a desktop over a WAN? Another consideration would be to determine how effectively a distributed user s desktop could be repaired or updated with latest patches? 3. TCO How much IT labor is necessary to perform management tasks (Opex), and what infrastructure (storage, servers, network, etc.,) is required to make the system optimally functional (Capex)? 3 Traditional Desktop Systems Management Managing desktops in the enterprise has traditionally been addressed by two types of disparate and non-integrated systems: PC Lifecycle Management (or PCLM 1 ) PC backup and business continuity systems PCLM systems are used to manage the desktops in a centralized and automated fashion. They are typically comprised of a suite of loosely-coupled tools with some common management that facilitates integration of the individual tasks into a controlled and monitored workflow. A typical PCLM system is comprised of the following components: Desktop agent(s) One or more thick services that execute at the endpoint and carry out various tasks related to the management/operations category. For example, the agent performs inventory 1 Gartner has recently termed this category PC Configuration and Lifecycle Management (PCCLM) Page 3

4 tracking and periodic scanning of the desktop to check for compliance with corporate policies. The agent is also responsible for receiving application packages (new or updates) from the server, installing them locally on the desktop, and reporting on the outcome of the installations. Management server The systems back-end that controls the management of the endpoints, including the distribution of software, collecting and controlling the asset management data, and providing the tools to construct and manage the images for deployment purposes. Note that the server does not contain any instance of the data or the meta-data of the endpoint, only a template to be distributed to a group of endpoints. OS deployment tool Typically provided as a separate tool intended to manage the first time provisioning of images to endpoints, or migrating users to new endpoints during a hardware refresh. This subsystem includes tools to construct the common image, a pre-installation environment, as well as definition of sequencing events that tailor the image to the specific hardware by executing scripts at the endpoint during different phases of the installation. Once an image has been deployed, all consequent updates to that endpoint are incremental and may vary from endpoint to endpoint, as users install their own applications and settings. Branch Proxy Infrastructure nodes that are used to push large data files to branches so that endpoints can read these large files from their local proxy instead of across a WAN. A typical PC backup/restore systems is comprised of the following components: Backup/restore desktop agent An agent that executes on the desktop and is responsible for tracking changes made by the user or the system, and uploading the changes efficiently to a backup server. Upon restore, the agent restores individual files (typically in a self-service mode) or an entire system (typically with the assistance of IT) back to operation. Backup/restore server The counterpart to the backup/restore agent, responsible for storing the desktop files efficiently and for restoring data to the endpoints, either in a file-level fashion, or for the entire system. 3.1 PCLM Challenges While PCLM systems have been in use for many years, they have several major architectural drawbacks, especially when managing mobile laptops and knowledge workers in distributed enterprises Challenge: Image Sprawl As mentioned above, a controlled image is deployed once to an endpoint, and from then on each endpoint evolves in its own way as different users (or IT administrators) install a variety of applications on the endpoints. Over time, the individual image contents diverge, leading to what is known as an image sprawl with the following downsides: PC instability: As users install applications and patches, the system has a higher likelihood of becoming unstable over time. Less stability means less user productivity, and more calls to the helpdesk. Troubleshooting complexity: Since PCs deviate from the originally deployed image, it is harder to troubleshoot a problem when a desktop is not functioning properly, since any of Page 4

5 the added applications could have contributed to the problem, and because there is no comparable system in the data center with which to experiment and understand the issue. Support escalations: Slow resolution of a user s problem can result in escalations to more expensive support resources Challenge: Delivering Software and Updates to Remote Users PCLM systems often rely on endpoints being connected to the corporate Intranet, and are not suitable for operation over a VPN connection or directly over the Internet. However, many remote users such as road warriors or outsourced employees that work at another company do not bother to connect to their corporate Intranet, and even if they do, the VPN connections are often limited in duration and in bandwidth. As a result, those desktops are often poorly managed. Another issue with managing distributed users is related to software and patch distribution. Typically, PCLM systems rely on proxy servers in order to perform the updates within a reasonable time and without requiring undue bandwidth. Since remote users often do not have access to branch proxy servers, the software updates or patches never make it to the end user, or take a very long time to occur, often resulting in calls to the helpdesk related to timeouts and connection failures in the midst of a PCLM operation. Recently, some PCLM systems started to introduce Internet-based client management systems. However, they offer very limited functionality (e.g., no support for client/os deployment, software distribution) and no support for network optimizations to enable effective management for remote users Challenge: Limited Break-Fix and Support Tools PCLM systems do not provide effective tools for IT to improve helpdesk operations and reduce user downtime. For example, there are no good tools to clean up a faulty machine and get it back into a working state by restoring it from snapshot, or by enforcing a good corporate image on the endpoint, without wiping out user personalization. Lack of support tools is even more painful when supporting remote users. As an example, consider the following scenario: In many organizations there is a threshold, typically minutes, after which a helpdesk employee stops trying to fix a PC problem and resorts to re-imaging the desktop with a fresh base image. This procedure is a painful process from an end-user perspective, because it means that all applications that were installed on that desktop on top of the base image are removed and must be reinstalled by the user. Furthermore, any user data on the desktop would need to be restored from the PC backup system (assuming it was backed up in the first place, including all environment and settings). Last but not least, re-imaging is both problematic and impractical for distributed WAN users, since sending a multi-gb image over the WAN is both time and bandwidth intensive. Alternatively, image servers must be deployed at the edges of the network, but this is a costly infrastructure and adds complexity to the PCLM system. In lieu of image servers at the branches, IT can ship DVDs or portable hard drives with the restore material, but this process is slow, vulnerable from data protection perspective, and usually leaves the user without PC access for days Challenge: Complexity of PCLM Agents and Contention with User Applications Page 5

6 A typical PCLM solution employs multiple agents on the desktop including agents for asset management, system recovery, remote access, and for patch, update and software delivery management. Furthermore, most of these agents perform heavy computation on the endpoints. For example, a typical PCLM agent performs scanning for asset management and confirms installation of all software packages, which might contend for machine resources with user applications. More generally, the proliferation of uncoordinated heavy desktop agents impacts both the performance and stability of the desktop operation. In a sense, the complexity and execution overhead of these management tools defeats the purpose for which these tools were constructed to improve the quality of the user experience with respect to desktop usage. 3.2 PC Backup/Restore Challenges for Distributed Desktops Challenge: Full Desktop Restore Most PC backup systems focus on file level restores. Some provide system-wide restore on a separate hidden drive on the desktop, and a few can offer a whole system backup that is stored on the backup server. However, all systems are challenged when restoring a whole desktop environment to WANconnected users, due to the sheer amount of data that needs to be transferred, and the impact on user downtime. Further, most systems lack automation for full desktop restore, often requiring user access to boot-media and additional IT-support. Finally, none of these systems offer an automated full desktop restore (including user-installed applications, user data and settings, and corporate image) onto a different hardware platform, or into a virtual machine, (e.g., to enable temporary access to his/her desktop via a virtual machine until a physical device becomes available and is shipped to the user. ) Challenge: Snapshot Restore PC backup systems typically maintain multiple versions of specific files in the backup server, but they do not maintain complete snapshots of the entire desktop, including user-installed applications and system configuration. Hence, if the desktop gets corrupted (e.g., due to malware, or due to an application that was installed and is incompatible with the rest of the system) there is no good way to revert the desktop to last known working state from, say, a week ago Challenge: Backup Performance PC backup agents perform scanning of the desktop to check for updates, which impacts system resources on the desktop and often prompt end users to disable the service. To reduce this intrusion the frequency of the backup interval is typically limited to once a day at most. 4 Desktop Virtualization Desktop Virtualization (DV) is a new approach to desktop management that has gained traction in recent years. In this approach, IT can centrally manage and deploy desktops on virtual machines, which abstract the hardware and lead to a common machine image that is stored in a file (e.g., VMDK or VHD virtual disk format). This image can then be delivered to (virtual) endpoints. For a DV product to be considered Page 6

7 a desktop management solution, it must also address the functional requirements listed in Section 2. For example, a DV solution should have an image management sub-system for constructing, configuring and delivering desktop images to virtual endpoints. In addition, on-going incremental updates to the images in the form of software and patch updates and application delivery should be supported. Finally, a comprehensive solution should include an integrated method for data protection and business continuity. There are two main types of desktop virtualization: Server-based DV Whereby the desktops execute in the data center on a pool of virtual machines, and are accessed by users via a thin-client protocol such as RDP or ICA. Such systems use a connection broker, which is an intermediary system component that accepts user requests, authenticates them, and provisions a virtual machine (possibly on-demand) loaded with the user s virtual desktop. In addition, a system for managing a pool of VMs to match the needs of end users and overall system load must be in place. Server-based DV is particularly relevant in LAN environments with fixed connectivity and can be effective for task workers, who often access limited application sets and have minimal requirements to keep data on the desktop. Client-based DV In this model, the desktop image (also referred to as a guest OS) executes on a virtual machine that is hosted on the client endpoint, as opposed to running in the data-center. One relevant use case for client-based DV is when the physical desktops are owned and managed by the end-user (also known as Bring Your Own PC, or BYOPC). Another use case is for third party contractors that need temporary access to a corporate PC to conduct their work. They are, however, less relevant for enterprise-owned PCs, where IT needs to manage both the PC and the native operating system. Client-based DV can be further classified into two types: o Type-2 Hypervisor The virtual machine runs as a process on top of a standard host operating system such as Windows or Mac-OS. The underlying host OS is completely unmanaged and not part of the DV solution. Because the OS is completely abstracted from the hardware, type-2 hypervisors offer more portability. o Type-1 (bare metal) Hypervisor The virtual machine runs on a specialized OS (e.g., Xen) that executes on bare-metal hardware and is dedicated and optimized to execute VMs. Type-1 hypervisors allow for faster access to the hardware and they can offer better security. 4.1 Desktop Virtualization Challenges While Desktop Virtualization is effective for certain use cases as described above, it introduces many challenges, especially when applied to distributed laptop users Server-Based DV Challenges User-experience for distributed and mobile knowledge workers While today s server-based DV systems can offer adequate user experience for task workers that are connected over LAN and use simple applications, they do not provide reasonable user experience for distributed and mobile knowledge workers, who are often connected over WAN and VPN connections, use sophisticated applications (e.g., enhanced graphics) and consume rich media. Page 7

8 o Predictable performance Users don t want to depend on the network for every keyboard stroke or mouse movement they make, especially when they are mobile or connect from different networks to the data center. o Offline Many laptop users must be able to operate offline when not connected or when connectivity is intermittent or slow. Workflow consistency Server-based DV is a different paradigm for end users that can require a complete shift in how they work. Further, the transition from thick to thin clients requires many significant changes in IT process. Compute and storage infrastructure build out - Server based DV requires significant infrastructure build-out in both compute and storage resources, since all desktops now need to execute in real time, as well as be stored in the data center Client-based DV challenges Image Size: A major challenge in client-based DV is how to maintain and deliver a large multi-gb virtual machine image to remote endpoints over the WAN. Backup over WAN: A similar challenge exists for data protection how to continuously and efficiently protect remote/mobile laptops over WAN, especially for knowledge workers who generate large files in their desktops and install their own applications. Type-2 Hypervisor-specific issues: There are a number of challenges that are specific to a Type- 2 hypervisor, including: o Unmanaged Host OS This model leaves the underlying host OS unmanaged, yet the operation of the guest-managed OS depends on the health of the host OS. Furthermore, IT still needs to manage the host OS in many cases (e.g., using traditional systems management software), so the fundamental desktop management problem remains unresolved. o Security A compromised host OS can make the guest OS vulnerable to security attacks. o Performance Since the guest VM/OS runs as a process, its performance is degraded every access to devices needs to be translated via the host OS. Furthermore, each OS needs to run anti-virus and other infrastructure software, further taxing the shared CPU. Type-1 hypervisor-specific issues: Additional challenges that are associated with Type-1 hypervisors include: o General availability One of the main challenges in type-1 HV is lack of wide support for drivers (especially paravirtualized drivers, which are optimized for a type-1 environment), particularly in the mobile laptop world with many unique devices such as power status, GPU access, multi-touch pointers, and fingerprint readers. In addition, most type-1 hypervisors require hardware assisted virtualization, which is not available on all hardware platforms. o Deployment Deployment is generally harder than with type-2 hypervisors because the type-1 needs to be installed on the bare-metal, wiping out the previous image, and then the managed OS must be re-deployed on top of the type-1 HV. o Managing the hypervisor The Hypervisor OS still needs to be managed and maintained in addition to the managed host OS. Page 8

9 4.1.3 Common DV Challenge: Supporting Single Image Management with User Personalization A basic premise behind DV-based management is the provisioning and management of virtual PCs, which are essentially virtual disk images encapsulated in a VMDK (or VHD) file. This approach allows IT to create a common image for all endpoints (unlike physical devices in which images differ based on the hardware configuration of the target device). However, the delivery of whole VMs implies that these systems cannot cope with any persistent changes made by the user. For example, if a user installs an application on top of the provisioned VM, the application would be kept on a delta disk, which together provides a uniform view of the modified virtual disk. However, if the IT administrator changes the common VM image and distributes it to the endpoints, any changes made by the user will be removed. In other words, there is typically no support for merging persistently user-installed changes that must exist in the system virtual machine disk. This challenge exists in both server-based and clientbased DV. 5 Addressing the Desktop Management Challenges As we observed, traditional systems management solutions, which can be effective in LAN-based settings, are complex to manage, interfere with end-user operations, lack integrated support for backup, continuity and support, and are particularly challenging when supporting distributed users. DV solutions improve on some of the issues by keeping and managing the desktop instances in the datacenter, enhancing protection, support, security and continuity. However, they introduce a new set of challenges, particularly for endpoints that are mobile and distributed, including offline support, performance, user-experience over WAN, personalization preservation, disruption to existing models, and high cost of the overall solution. A key question is whether a third solution category can be found. This paper claims there is such model, as highlighted below. 5.1 Cloud Desktop Management This new approach reconciles the seemingly conflicting requirements of centralization and userexperience. Instead of moving the entire desktop to the data center, including the physical compute resources and desktop image, as is the case with server-based DV solutions; or alternatively keeping the entire desktop at the end-point desktop, as is the case with systems management and client-based DV solutions the cloud-based desktop management model offers a third alternative. Specifically designed to address the needs of distributed organizations, cloud desktop management can uniquely: Migrate the complete image of each desktop instance (including OS, applications, and all user data), into the data center so that they can be managed and protected centrally. Use the physical compute resources at the endpoint to execute the desktop workloads on a secondary (or cached) copy of the desktop image giving the end user local execution, including performance, the ability to personalize, and operate offline. Page 9

10 Modularize the desktop image into three logical layers an IT-managed base image (OS and core IT applications), user-installed applications and settings, and user-data. Provide for efficient and consistent bi-directional synchronization between the centrally-stored and distributed desktop copies, in which the managed base-image propagates down to endpoints, while personally-generated data and user-installed applications continuously propagate up for backup and continuity purposes. Provide the capability to quickly reassign and stream the logical desktop onto different execution containers across geographical distances and over WAN, using optimizations and inplace image swapping technologies. Provide the capability to reassign logical desktops to different hardware platforms, as well as transition between physical and virtual machines. Leverage the endpoints already deployed, and ensure optimal efficiency across the network, server and storage infrastructure. The key advantage of this approach is in aligning the roles and responsibilities of the different types of users with their location and environment. That is, IT administrators can consolidate the management, protection and control of all desktop images in one location at the data center (in a similar fashion to what VDI systems offer), while end users execute the applications and access their personal data locally at the distributed endpoints (in a similar fashion to thick client environments managed by systems management tools), hence with good performance, offline capability, and native user-experience. While most organizations will harness a range of solutions to meet their varying needs, new solutions are available that are specifically designed to unify desktop management and data protection across distributed organizations. For more details on this architecture, visit Wanova.com. Page 10