Next we take a look at the main approaches to automated software deployment and software management. Some are appropriate for large organizations, others for smaller outfits. The key is to understand the software deployment
marketplace
, the tools available, and the enterprise's needs and current infrastructure; at that point, the choice of approach will become obvious.
Microsoft Tools and Software Deployment
For Windows networks, an alternative approach is to use Microsoft's Systems Management Server (SMS) 2.0, which has both inventory and deployment functions. SMS normally requires a dedicated server and is less expensive and quicker to install than a management framework. SMS was the route taken by Los Alamos National Laboratory (www.lanl.gov). In addition to having two of the world's eight
fastest
supercomputers for modeling
nuclear
reactions
, the laboratory also has 11,000 desktops. Although it needed to ensure its security functions were top
notch
, labor requirements made this prohibitive. The laboratory's Information Architecture (IA) team for desktop systems calculated that, even if only one updated virus definition, a single operating system patch, and one browser patch were installed each month, it would take 87 staff working full time (at an average of 19 updates per person per day) to manually keep up with the changes. The IA team simply did not have the personnel to do this, so they decided to investigate enterprisewide desktop management (DM) systems. After evaluating several DM products, they piloted Microsoft's SMS and then rolled it out to five sites serving more than 1500 desktops. In a nine-month period, the SMS team produced and distributed over 70 software packages with a total technical resource investment of 210 person-days. To do the same job manually would have required 5530 person-days.
Implementing a DM system, however, involved significant startup costs including buying a server and paying for all the software licenses, as well as hiring the tech personnel. For a 150-
user
group
, these costs came to $272,541, or $1,817 per client. The IA team
discovered
, however, that as they rolled out SMS across a larger and larger portion of its overall organization, more attractive economies of scale come into play that eventually brought the cost per client down to less than $200. SMS goes way beyond software deployment, into the areas of remote desktop support and network management. This added functionality, however, also means added complexity for deployment and administration. SMS is not something one can take out of the box, load, and put to use. So, before deploying it, an enterprise must make sure it has available IT resources with the experience to cope with it.
Site Licensing/Tracking Software
The above approaches are comprehensive solutions, but can be overkill — too complex or expensive for someone who wants to deal with the immediate problem of managing licenses and updates. A full framework, for example, typically comes with a price tag of hundreds of thousands or millions of dollars and can take over a year to put in place — not the
sort
of pace required when the BSA might come knocking at any moment. Luckily, several easier and quicker approach to software deployment and licensing are available. Dedicated deployment tools take care of the software deployment and distribution task without burdening users with all the
bells
and whistles of a framework or SMS. One of the better ones is Executive Software's Sitekeeper. This is a tightly focused tool dealing with automated software distribution, inventory, updating, and license tracking that costs about $15 per machine for large enterprises (Exhibit 1).
Exhibit 1:
Sitekeeper High-Level Data/Control Flow Diagram
After installing Sitekeeper, the first step is to launch Inventory Tracker, which contains a setup wizard to guide the administrator through the process of designating which domains or machines to inventory and how often. It does not install any
agents
on the workstations but
scans
the Windows Registry to gather software
names
, versions (major and minor), build number or patch level, and
name
of publisher. It typically inventories five to ten machines per second, so a thousand-user network would be done in two to three minutes. Data is stored in a database, and a browser-based inventory report is generated. This shows both the inventory on each machine, as well as which machines have a particular product installed.
Another module, License Tracker, generates a license report based on the completed inventory. The administrator enters the number of licenses purchased, and the report informs the administrator if the organization has excess licenses, if it needs to purchase some more, and if users are installing software locally without permission. From there on out, the module will continue to notify the administrator as licenses expire or new inventories show changes in license status.
Sitekeeper's PushInstall is of most relevance to software deployment. This feature remotely installs and uninstalls software, updates, upgrades, and patches. It works with any Windows 2000, XP, or Microsoft installer-compliant program, as well as most software designed for NT. Software, updates, and patches can be scheduled to use minimum resources, which takes a little longer but has less impact on users. When speed is more important, such as when installing a new virus definition, the administrators can run the program at a higher priority. Once the administrator selects the target machines or domains and the installation speed, the program automatically
installs
the software and
reports
the results of each installation back to the administrator.
Sitekeeper is a quick-to-implement, simple-to-run, and inexpensive software management application. For those looking for a "set it and forget it" method of staying on top of licensing and software management
headaches
, it does the job well.
Software Deployment Case Study
-
Organization
— Unisea, Inc. (Redmond, Washington, and Dutch Harbor, Alaska; www.unisea.com).
-
Business/mission
— Unisea is one of the world's leading fish product companies, with peak production of over 60 metric tons of fish per
hour
.
-
Goal
— The primary goal was to create accurate hardware and software inventories and ensure license compliance; the secondary goal was to be able to run routine checks for users installing unauthorized software.
-
Scope
— Software is installed at two locations, the headquarters in Washington and the processing facility in Alaska; the company has about 1200
employees
.
-
Solution
— Executive Software's Sitekeeper was installed to automate
inventorying
, deployment, and license compliance.
-
Results
— Inventories are now taken and
maintained
automatically. Routine deployment of software updates has been reduced to one hour per site during normal business hours (no more coming in early or working late).
-
Cost savings
— Personnel time required for software updates was reduced 85 percent; process revealed that the company had more software licenses than it needed.
For many
years
, Unisea systems staff performed updates and inventories manually. Administrators tracked licenses using paper and pen, consolidating various notes into an Excel spreadsheet. Similarly, deploying software updates required
visits
to every desktop every time a new patch came in, and IT staff worked nights going from box to box to install the latest patch. As a result, their workload became backlogged and critical updates were delayed. Unisea purchased Sitekeeper by Executive Software to automate these processes and to add the capability of checking company machines periodically for unauthorized software (Exhibit 2).
Exhibit 2:
Unisea's Sitekeeper Architecture
{% if main.adsdop %}{% include 'adsenceinline.tpl' %}{% endif %}
|
Unisea uses a mix of Windows NT 4.0 and Windows 2000 servers running in a NT 4.0 domain. This
meant
that Unisea did not have to install any agents on these boxes, as Sitekeeper works without agents on Windows NT, 2000, and XP boxes, which greatly speeded up installation because the software had to be loaded only on the host machine in order to automatically inventory all client boxes at a rate of about ten per second.
While many firms are concerned about license compliance because of the huge penalties that could be incurred following surprise
audits
from policing bodies such as the BSA or SIIA, this was not a concern for Unisea. The company had purchased enough licensing; in fact, initial inventories revealed that the company had actually paid for more licenses on some software than it needed.
The benefits
experienced
from automated inventorying, though, were overshadowed by the amount of time saved in software deployment
utilizing
Sitekeeper's PushInstall feature. In one sixty-day period, for example, two critical Internet Explorer (IE) security patches came out. Unfortunately, Microsoft decided to release these IE patches individually by version, rather than one release covering a range of versions. Earlier, an update like this would have meant that Unisea IT staff would have had to go around to each box to apply the appropriate patches. Manually installing patches could require the IT staff to come in at 4:00 in the morning or work late into the evening so they would not have to kick users off their machines. Depending on existing priorities, it could take days or even weeks for every machine receive the update. Using Sitekeeper, however, the system administrator identified the various IE versions on each box and remotely applied the appropriate patch to every workstation and server. This reduced the workload from two days to a few minutes. Today, Unisea updates software as soon as a patch comes in, even during business hours; thus, system security is enhanced as known vulnerabilities are immediately remedied. Further, it means that all needed updates do get done, as opposed to being lost in the line behind scores of other updates.