Altiris' suite was the only product in this roundup to let us create collections, or groupings of computers, for each of its components. We could create one collection specifically for metering, another for remote control and a third for software deployment. We also could set up additional groupings of collections within each component. This let us create a large number of collections and still keep them manageable. Each component collection may be used across the entire suite, so your remote-control collections can be referenced in software distribution, for example.
For patch management, we had to install the free Microsoft Baseline Security Analyzer (MBSA) on our clients. The clients run MBSA periodically and send the reports back to the Altiris server. This lets you see which patches are needed and by how many clients. However, we had to download and package the patches manually. A minor inconvenience, granted, but an automated approach would be welcome. Each patch can be rolled out to a collection of test-bed computers, and then to your entire organization. Marimba and Microsoft use a similar approach, though their automated packaging features earned them a slightly higher score.
Altiris does go the extra mile with its vulnerability reports. These reports blow the whistle on SQL and IIS vulnerabilities, such as exposed passwords, blank SQL passwords, or if the IIS lockdown tool has not been run; blank system passwords; bad file permissions; improper IE settings; and nonexpiring passwords.
We give Altiris props for having the best user interface of the products we tested. The UI is Web-based, and we liked how individual components, such as inventory and software distribution, have separate collections, policies and alerts. The drill-down capabilities were especially good. For example, instead of being presented with a static list of clients that had 256 MB of RAM, we could see details for each machine. This additional information beats the more limited approach taken by many other products, which present lists of data and no way to gather details. However, we do have a few quibbles: The process to define collections and queries was not totally intuitive. Many of the table- and field-selection names were cryptic, like "AeX EU Contact Detail," which contains information about Exchange accounts in one long drop-down menu.
Also, we were disappointed in the lack of access controls for limiting the rights of other administrators. Altiris says that this feature will be in the next release. There is, however, a separate Web report section. We could create individual Web sites containing a selected subset of the available reports. For instance, you could have reports only on hardware made available to a person or group responsible for physical assets, as they wouldn't need to know about software configurations. Access to these individual sites is controlled by IIS permissions.