Much has changed in the two years since we last compared desktop management tools. Network executives are as focused as ever on reducing costs, but there’s been a resurgent interest in security, particularly keeping up with the latest security patches for applications and hot fixes for the operating system.
Much has changed in the two years since we last compared desktop management tools. Network executives are as focused as ever on reducing costs, but there’s been a resurgent interest in security, particularly keeping up with the latest security patches for applications and hot fixes for the operating system.
And while keeping alert for attacks takes precedence over the more mundane tasks of tracking how many people used a particular application in the last month, it doesn’t make software-tracking any less important – especially with new licensing models and higher per-user fees looming.
The decision-making process works best when all the necessary information is available and accurate. For example, a complete and accurate hardware inventory is essential before making an operating system upgrade decision. Vulnerability assessments won’t protect you if you can’t tell which machines have the latest Internet Explorer service pack installed.
The proliferation of mobile users with laptops and PDAs is another relatively new variable. IT managers have to establish new policies for the use and management of intermittently connected devices, and they need to keep mobile workers connected and productive.
Add these issues up, and you need a complex set of tools to cover the bases. While many point products focus exclusively on one or two of these areas, there are vendors that offer management suites that take a shot at covering them all.
We recently tested nine desktop management products to see which provide the best set of tools for managing desktop computers. The suites we tested were Altiris’ Express Client Management Suite; CA’s Unicenter Asset Management, Software Delivery and Remote Control; LANDesk’s Management Suite; Mobile Automation’s Mobile Lifecycle Management Suite; NetSupport’s TCO; PC-Duo Enterprise from Vector Networks; PowerQuest’s PowerDeploy Suite with Cognet Manager and Cognet Observer; Novell’s ZENworks for Desktops; and ZENworks for Handhelds, and XcelleNet’s Afaria.
Overall, Novell’s ZENworks offers the most complete solution based on the scoring criteria we established for this review. That doesn’t necessarily mean it’s the best product for every situation. If you’re just looking for a software distribution tool, then take a look at the Prism product from Lanovation (sold separately or as part of the XcelleNet Afaria product). If your focus is strictly on mobile devices, consider either the Mobile Lifecycle Management Suite or Afaria. If you only need to create and distribute system images, turn to the PowerDeploy Suite from PowerQuest. A pure inventory or asset management problem might best be solved with the CA Asset Management tool. A defined set of requirements focused on solving specific problems will help you choose the best tool for the job.
Desktop configuration
Having a consistent desktop configuration across the company goes a long way in reducing the number of tech support calls. Maintaining a consistent configuration is virtually impossible without some form of an automated process. All the products we tested provide different tools to accomplish the desktop-configuration task.
Several vendors use a system of policies to define rules that dictate how a particular application will behave. For example, Novell’s ZENworks policies dictate everything from when an inventory scan is performed, to what systems get the latest version of a specific application. Policies can be enhanced further with the use of groups, such as giving everyone in accounting a specific policy that dictates when each system receives software updates.
Tracking and maintaining configuration files has diminished as companies move away from the Windows 9x vintage operating systems. This is mainly because Microsoft is doing away with configuration files such as WINDOWS.INI and SYSTEM.INI found in the older operating systems. Several products, including LANDesk, NetSupport TCO and PC-Duo, continue to support this feature for older workstations. It’s more important today to track desktop settings and browser favorites, both for migration purposes, and to restore user settings in case of hardware failure.
Another feature in this category is the concept of hard disk imaging. While this could be considered a poor man’s back-up procedure, it does provide a significant capability for restoring corrupted operating systems or rolling out a complete operating system upgrade. Altiris and PowerQuest have long been known for their disk imaging products, while Novell’s ZENworks has included similar functionality for several product releases. PowerQuest’s PowerDeploy Suite provides a comprehensive set of tools to streamline the entire process.
ZENworks has the most complete set of tools to manage desktop configurations of the products we tested. Using the policy-based approach lets an administrator configure every aspect of a user’s desktop. For applications managed through the Novell Application Launcher, you can even control how that application runs – either locally or using a terminal services session. ZENworks includes a complete workstation imaging capability that takes a snapshot of a user’s hard drive at a specific time, so you can completely restore that image over the network.
The latest version of LANDesk includes an operating system deployment feature specifically designed to roll out new operating system versions. A neat feature of this tool is the ability to use a hard disk image from other vendors, including Symantec’s Ghost and PowerQuest’s DeployCenter. The only downside is that it only images partitions, and will resize the image to fit the entire drive of the target computer. LANDesk also uses a targeted multicasting feature to minimize the effect on the bandwidth of the network when distributing large packages. CA Unicenter Software Delivery also can be used to deploy operating system images.
Mobile Automation’s Mobile Lifecycle Management Suite includes a “task package” that lets you distribute a series of commands in a package to individual workstations. We liked that the product ships with several sample tasks, including one that backs up the configuration files from a workstation along with the registry to a named file on the server. It uses variables to build a name for the back-up file based on the workstation name and current date. Tasks can be scheduled to happen at any time for the configuration back-up task.
The other three products, NetSupport TCO, PC-Duo Enterprise from Vector Networks and XcelleNet’s Afaria all had similar features to each other for desktop configuration management.
Track those PDAs!
Two products we tested are designed with mobile devices in mind. XcelleNet’s Afaria supported the most devices, including Symbian devices, Pocket PCs, Windows CE devices, Palm handhelds, Research in Motion BlackBerry devices and a number of smart phones. Afaria also includes a back-up manager designed for mobile devices. The document manager handles the translation of files such as Microsoft Word documents between the native format and one suitable for the target device.
Mobile Automation’s Mobile Lifecycle Management Suite supports Windows CE devices, Palm OS PDAs, BlackBerry devices and some of the smart phones. One twist on its product comes from the help desk support angle. The strategy is to make the majority of these functions client-initiated. This helps get around a variety of issues such as dial-up links, firewalls, network address translation and the like. At the device level the software can even do an inventory of BlackBerry devices to record model and serial number. The database also tracks ownership of devices to help you keep track of who has what.
We liked Afaria’s attention to the little things. Those include options to configure its bandwidth-throttling feature, and the ability to automatically control how you handle different devices and connections. The software also lets you synchronize with multiple databases and groupware products such as Lotus Domino. A “roll-back” feature lets you return a device to the last known state should a synchronization process not finish.
Novell’s ZENworks for Handhelds adds a number of features to the ZENworks product specifically for managing handhelds. The current release supports Palm, Windows CE and Pocket PC devices. Features include hardware/software inventory, software and content distribution, configuration and security management, and file retrieval. Specific disconnected functionality consists of checkpoint restart and delta capabilities to minimize the amount of time needed to distribute updates and make backups of handheld files.
These three vendors were the only ones with products focused on PDAs. The Altiris product also supports remote control to mobile devices; also, the LANDesk mobile product is a version of Afaria, so it receives the same score in this category.
Gathering inventory
Gathering hardware and software inventory information is not rocket science. Most computers manufactured in the past three or four years have built-in Desktop Management Interface (DMI) support for reporting hardware information. Many also support the System Management BIOS (SMBIOS) that works in conjunction with DMI at the hardware BIOS level.
There are several basic approaches to identifying software inventory. The simplest technique is to match an easily determined characteristic of a program to a database of known applications. Data such as file name, size and date typically don’t change once a program has been installed. For example, a file named IEXPLORE.EXE with a specific size and date would identify a particular version of Internet Explorer. It is pretty easy to extract the version number of a program from information inside an executable file.
The next level of complexity is to detect data such as software patches or hot fixes to the operating system. These don’t always change in size or date, but typically change items such as the signature of the file. Several products, including CA Unicenter Asset Management, Mobile’s Lifecycle Management Suite and PowerQuest’s Cognet Observer, were great at detecting the various combinations we had installed. All the products let you edit the database of applications and either change information for specific entries or add new entries.
CA’s Unicenter Asset Management did a good job of detecting all versions of Microsoft Office and Internet Explorer. We liked the user interface of the management console and the way it makes it easy to see what’s installed on each machine. Gathering summary information for groups of machines or all managed machines utilizes the reporting tool. You also can export report information for use by an external program such as Microsoft Excel or Word.
Mobile Automation’s Mobile Lifecycle Management Suite was perfect in detecting Internet Explorer versions and service packs. It also knew how to check for OS Hot Fixes and specific patches (Microsoft KB numbers). On hardware inventory, the software had a few minor discrepancies, such as listing the actual processor speed being off by a few MHz and disk/memory storage numbers not exactly displaying what was expected. A nice touch was the software’s use of log files for each client that describe exactly what took place and when. The management interface lets you drill down on any item to get more information.
PowerQuest’s Cognet Observer did a good job of identifying all the software versions we had installed. It also keeps a list of unidentified software that it couldn’t find in its database. A software manager tool lets you look at these entries and make changes to identify applications for future inventory scans. It also lets you view the database by software vendor, category, unidentified or ignored files, or by computer. The computer explorer shows a directory tree similar to Windows Explorer’s with every executable file discovered on that computer. On the hardware side it did an excellent job of showing memory size (consistent across all machines), processor speed, and other details such as serial numbers and product names.
Novell’s ZENworks for Desktops client requires at least Internet Explorer Version 5.5 or higher, so we couldn’t do exactly the same software testing that we did with the other products. It correctly recognized the various versions and service packs of Microsoft Office as well as the different operating system configurations.
On the hardware side it was comparable to the other products in terms of detail and accuracy.
We liked the fact that Altiris Express provided several predefined reports that specifically look for a particular Microsoft security update to Internet Explorer. These typically are numbered by the particular Microsoft Knowledge Base article that describes the problem and fix. On the downside, the Altiris software inventory portion incorrectly identified two versions of Internet Explorer.
LANDesk’s basic functionality hasn’t changed in quite a while. Overall its software inventory feature does very well, although it did not report the right version for several Internet Explorer versions. It got the service packs right for all the Windows 2000 client machines. It also included things such as multiple copies of Microsoft system library (DLL) files that could be just a nuisance to many.
NetSupport TCO did a good job on the hardware inventory but didn’t appear to recognize some versions of Internet Explorer 5.0. It also couldn’t tell the difference between 56- and 128-bit encryption installations of Internet Explorer. The inventory software has the ability to grab files for archiving purposes.
PC-Duo also had issues of discrepancies in numbers for memory and processor speed on the hardware side. On one of our laptops (a PC Laptops model), it didn’t even come close on the correct processor speed. The software inventory identified Internet Explorer 5.5 as Internet Explorer 6.0. It also couldn’t discriminate between different encryption levels.
XcelleNet’s Afaria was the most tedious of the group to configure for hardware and software inventory. This is partly because of the nature of the product. All actions in Afaria are client-generated and require multiple steps to initiate. Gathering inventory for clients requires you to create a channel and then publish it to the clients. There also were a few discrepancies in the software identification process.
Software distribution and application healing
All the products we tested offer some form of software distribution. Support for fixing broken applications depends on your definition of “application healing.”
The concept of application healing is not new, and has been essentially present in Microsoft Office for some time. With the latest release of the Windows Installer, Microsoft now directly supports install on demand and application self-healing. The problem is that many older applications don’t use the Windows Installer or Microsoft Installer (MSI) format. In that case, the application must be restored in another manner.
The biggest challenge in software distribution is installing a new application. Creating a software distribution package typically includes several steps. First, you run a “before” snapshot of a target workstation before installing the software. Next, you install the application. Finally, you take an “after” snapshot to record all the changes since the installation and gather all the new files, along with configuration changes, together into a single package for distribution.
The most comprehensive software deployment of the products we tested is Lanovation’s Prism Deploy. XcelleNet uses Prism Deploy as its software distribution component. Prism Deploy has many features that cross some of our categories. For example, you can use the tool to return a desktop to a known state by taking a “picture” of the original configuration to include system files, registry settings, the Windows desktop and other pertinent information. You can then later restore that workstation to the original state by deploying a package with those settings. It also supports the MSI format for distributing application packages and delivery of applications over the Internet through a Web page.
Novell’s ZENworks supports the standard software distribution methods and adds another dimension with its Novell Application Launcher technology. This feature makes it possible to have dynamically delivered applications that run locally or on a server using terminal services, depending on a number of predetermined criteria. We love this feature because it gives administrators a wealth of flexibility in deciding how they will distribute and deliver their applications.
The LANDesk Application Healing client agent watches for EXE and DLL load failures, then looks to see if any of the offending program files match a list of programs that have been configured for healing. If a match is found, the agent reinstalls the application using a LANDesk Enhanced Software Distribution (ESD) package previously associated with those files. An ESD must have been previously created using the same snapshot technique. LANDesk also distributes MSI packages created with other installer programs.
Mobile Lifecycle Management Suite uses a similar snapshot technique to create distribution packages. To accomplish application healing, the software periodically checks the client to see if any files in a managed application are missing or settings changed, and then fixes the problem.
Altiris delivers its product in several configurations. As part of the product we tested, Altiris includes a migration tool along with the standard software distribution capability. This tool also is sold as a stand-alone product. The software distribution tool uses the before-and-after snapshot approach to building a distribution package. This product can be purchased as a stand-alone application.
We didn’t like the fact that PC-Duo does not directly support the creation of installation packages but relies on third-party packagers, such as Installshield, or the network installation features of many Microsoft packages.
CA Unicenter uses a similar before-and-after snapshot packaging approach for building an application. It also supports the Microsoft Installer files and uses that approach for application healing. NetSupport TCO and Cognet Manager also use the before-and-after snapshot approach to build a distribution package.
Remote control
The ability to take control of a remote workstation over the network can save you on trips to distant offices. It becomes even more necessary at geographically dispersed companies with centrally located IT services. Determining the usefulness of a remote-control program boils down to speed and ease of use.
Several products we tested required a separate client agent to perform remote control. These included Altiris Express Client Management Suite, CA Remote Control and NetSupport Manager. The PowerQuest/
Cognet products do not offer remote-control features.
Altiris uses Carbon Copy (acquired from Compaq in April 2001) as its remote-control function. A nice feature of the current version is that it works down to the handheld. We could view the screen of an iPAQ device from a workstation on our network. The server portion works from within a Web browser, giving added flexibility.
We like the fact that CA’s Remote Control product and NetSupport Manager have the ability to record and play back a remote session. The NetSupport product can replay a recorded session to multiple clients at the same time. This could really come in handy for help desk personnel in training sessions.
Mobile Automation calls its remote control application Live Support. This application operates in attended or unattended mode. The attended mode is meant to be used in conjunction with a user at his computer, requiring the user to grant permission for a Live Support session. Unattended mode is aimed more for remote access to troubleshoot or perform system maintenance. The Mobile Automation 2000 Web console supports only attended mode at this time.
Novell’s ZENworks remote control feature includes all the functionality found in the other products, but seemed somewhat sluggish on our test systems. While the feature worked as advertised, it was noticeably slower than the other products in bringing up new windows and in tracking mouse movement.
Software metering
Even though the emphasis on license compliance has increased recently, we felt the other categories were more important. A number of the products, including Altiris Express Client Management Suite, LANDesk’s Management Suite, NetSupport TCO, and Novell’s ZENworks, offer software metering and application monitoring, which lets you control and monitor the usage of specific software applications.
PowerQuest’s Cognet Observer did a really good job tracking software usage by username. A usage summary screen shows the application name, number of executions and how long the application was open and active. It also keeps track of unused software – applications loaded on a particular workstation that never gets used. Another feature we liked was Web usage. The Observer client keeps track of all Web sites accessed from individual workstations and logs them by user. Several predefined reports let you quickly see a summary of all Web usage or by specific user.
Installation and documentation
Installation and configuration spanned the range of blessedly simple (NetSupport TCO, CA Unicenter Asset Management) to cursedly frustrating (Novell’s ZENworks). For most installations it means installing the latest service packs, both for the operating system and database. Some products, such as ZENworks, depend on a functioning DNS to provide access to the different services.
One way to judge ease of use is how many steps it takes to actually install and use the product. For some products, such as NetSupport’s TCO, the amount of effort was minimal. It took a few steps to load the server portion, a few more on the client and we were done. Rebooting the client gave us the hardware and software inventory on the management console.
For others, such as Novell’s ZENworks, you have to go through multiple steps to install the software, configure the database, enable the right policies and finally install client software before you see any results.
Loading the client software on a host of workstations could be a tall order if it required a visit to every workstation. All the products we tested support some sort of installation over a network, typically through a shared directory on a server. Some products, such as the Altiris client, use a Web page link to initiate the install.
Novell’s ZENworks has a minimum requirement for the client. For Windows 2000 clients you must have Service Pack 2 installed, along with Internet Explorer 5.5 or higher. ZENworks 4.0 is the first version of the product that does not require a NetWare server to function properly. Installing the product in a Windows-only environment is possible, but takes some work. ZENworks 4.0 requires that you have Novell eDirectory for Windows installed and running at least on the server that will host the ZENworks components.
NetSupport TCO has a nice remote setup utility that scans many IP addresses, looking for machines running Windows NT 4.0, 2000 or XP. It then pushes the client software over the network to workstations using an account with administrator privileges.
Altiris Express required multiple steps to get the software installed and licensed. Installing Carbon Copy for remote control required an additional step and a separate client program for each workstation. The multiple-step process could be seen as a benefit or a detractor. Only installing the modules of interest keeps the management console uncluttered, while the extra step takes an additional amount of time and effort. The extra steps were an annoyance.
CA’s Asset Management was one of the easiest products to install. One click and the product did the rest. The first time you run the program it checks the Web for inventory database updates. Unfortunately, it then makes you individually check each update you want to add. For us the list had 1,107 unique applications. It’s a nice feature, but tedious to use. A “check all” function would have been more helpful.
Novell had the most documentation pages. The ZENworks for Desktops Administrators Guide comes in at 1,028 pages. Fortunately, everything is in a searchable Adobe Acrobat format with a nice table of contents. Other products with electronic-only documentation came from Altiris, LANDesk, Mobile Automation and Vector Networks. The rest provided some combination of printed and electronic manuals.
Bottom line
In the final analysis it’s all about features and requirements. Novell ZENworks offers the most features of all the products we tested. It also was the most difficult product to get up and running, but the current version will run in a Windows-only environment as long as you have Novell’s eDirectory installed on one server.
The question becomes whether you need all those features bad enough to justify the effort to get the product working. Knowing your requirements and “pain points” will help you make a more informed decision and choose the tool or tools that best fit.
