Desktop Management Suites: How Suite it Is

The Big Picture

None of the suites we tested is what we'd call spot-on. For example, we saw some really good user interfaces, and some not so good. On our wish list: More control over deploying software to the entire organization; better security and role-based access controls; patch management from every player; and improved alerting and scripting capabilities. We expect to see a lot of innovation, enhancements and development over the next few years--each suite had its own stand-out features that we'd like to see added to all the products.

All the DM suites we tested were current shipping versions, except for Microsoft's. In a departure from our usual rules of engagement, we tested a beta copy of SMS 2003 Release Candidate 2. Microsoft says the product will be shipping when this issue goes to print, and we couldn't pass up the opportunity. Normally, we bar beta versions from comparative reviews, but when we make an exception our policy is to treat the beta software no differently than the shipping products. Microsoft was informed of this policy and chose to participate.

All the DM suites we tested have a similar pyramid architecture. At the top is a central database server and a central management server. Inventory, client and policy information is stored here. Distribution servers (aka staging, local, relay, deployment, fan out or transmitter servers, depending on the vendor) can be installed in remote offices or on multiple subnets. These servers cache data from clients and store local copies of policies and software. Client machines can pull software from the closest distribution server to help distribute network load and increase performance. At the very bottom of the pyramid are end-user machines, which must have client agents loaded. These agents periodically upload inventory data and check for new policies or enforce current ones. Agent software can be distributed via disk, CD, e-mail, network share or login script, or it can be downloaded from one of your Web servers or pushed out via an AD domain. None of the products tested had agents that struck us as gluttonous RAM suckers.

As for feature sets, here's what we consider important:

• Patch management: All products we tested could distribute patches. However, without patch management you can't see which nodes on your network are vulnerable. You could run a custom report identifying software versions with known vulnerabilities, but that tack has some limitations: You would need to keep the list up-to-date, it wouldn't be as elegant, and the technique would fail if a patch didn't increment the version number. Thus we consider full patch management a key selling point for DM suites, and we gave it a heavy weighting. Altiris, Marimba and Microsoft are the only vendors tested that supported Windows patch management. Novell supports only Linux patches via Ximian's Red Carpet.