• Sidebar: Terminal Services and Remote Administration
• Chart: Windows PC Management Features

The cost associated with managing Windows client machines has long been a source of concern for customers. The issue started to garner serious attention among Microsoft executives around 1996, when Oracle and others started to discuss the concept of a "network computer"—a simple terminal whose applications, data, and configuration settings would be provided over the network and managed centrally. The network computer (later to be called "thin client") approach promised to deliver a far lower total cost of ownership than Windows PCs and spurred Microsoft's Windows group to design PC management tools and services into Windows 2000.

Windows 2000 did in fact provide much of the architectural framework necessary to address several important client PC management issues, such as enforcing a common configuration across multiple machines and "locking down" users' PCs. However, in too many respects these capabilities were a "version 1.0" technology. The complex and unforgiving nature of some Windows 2000 technologies—especially Active Directory and Group Policy—along with significant gaps in the accompanying management tool set meant that the Windows 2000's PC client management features went largely unused by many customers.

With Windows Server 2003 and Windows XP, Microsoft strove to perfect rather than re-architect Windows 2000's PC management infrastructure and tools. Windows Server 2003 and Windows XP make it considerably more practical for administrators to manage client PCs throughout their life cycle. In particular, the processes for installing the client operating system (OS), deploying applications, centrally configuring and locking down the PC and its software, supporting users that roam between different PCs, restoring failed PCs, and migrating existing configurations to new PCs have all been improved.

Microsoft still lacks what could be called a unified management framework. PC management features are still spread across Windows and a somewhat confusing array of products such as Systems Management Server, Application Center, and Operations Manager. Furthermore, these technologies are only partially integrated with one another and overlap in functionality. However, the PC client management technologies in Windows Server 2003 and XP represent a major step forward compared to Windows 2000. Even using a subset of the capabilities of the new Windows versions could lower an organization's PC administrative costs, and are one reason to consider deploying Windows Server 2003.

The Promise of Windows PC Management

The major goals of the Window PC management technologies introduced with Windows 2000 are to centralize configuration and system lockdown, improve support for roaming users and desktop restoration, and improve application installation.

Centralize configuration and system lockdown. Group Policy allows administrators to organize users and computers into groups and to apply and enforce a common configuration for groups. It allows the administrator to centrally control most aspects of PC configuration, including individual computer and user Registry settings, which software is available, and which management scripts execute when the user logs on or off.

Support for roaming users. IntelliMirror is the blanket term for a combination of management technologies in Windows that enable administrators to centrally manage and replicate a user’s PC environment. In particular, user data, settings, and applications can "follow" the user to any PC on the corporate network. In addition to supporting users with laptops and "pools" of PCs shared by many users, this feature provides a mechanism to rebuild a user’s desktop in the event that the PC hardware has to be replaced.

Reliable application installation. The Windows Installer service improves application installation by reducing conflicts and instabilities between software components (such as DLLs), and supporting unattended application installation, clean removal (uninstall), and rollback in the event of an installation failure. IntelliMirror software deployment leverages this service to manage software on clients.

Windows 2000 also introduced the Remote Installation Service to simplify the initial installation of the OS and applications. It also substantially improved the Windows Terminal Services feature, which is primarily designed to enable remote execution of desktop applications, but also facilitates remote administration of PCs. (For more information on Terminal Services' role in administration, see the sidebar "Terminal Services and Remote Administration".) Finally, Windows XP and Server 2003 shipped with a new Windows Management Instrumentation (WMI) technology that enables management applications and scripts to examine and change PC configurations.

(For a summary of PC management activities and the technologies that support them, see the chart "Windows PC Management Features".)

The keystone to most of these technologies is Active Directory, a distributed database of objects, such as users, groups, computers, and policies. Active Directory is used primarily to control security (authentication and access to resources), but it is also essential to support centralized administration of computer settings through Group Policy, as well as to support IntelliMirror’s data, settings, and application replication capabilities.

Why Windows 2000 PC Management Fell Short

The PC management capabilities in Windows 2000 failed because of the large upfront investment, the complex and unforgiving nature of the components, and missing technology.

Large upfront investment. Many organizations found Active Directory too hard to implement because it required careful planning of the directory structure and defining business and control relationships for the entire organization. The technical complexity and political difficulty of this task kept many organizations from implementing Active Directory. But without Active Directory, Windows 2000’s PC management capabilities are minimal.

Complex and unforgiving technology. Even when an organization deployed Active Directory, the PC management tools in Windows 2000 were complex and unforgiving. Mistakes in Active Directory design could not be easily corrected and could require starting all over again. Furthermore, administrators struggled to understand Group Policy, how to use it to manage various configurations, and how to predict the effects of a specific policy change. A simple Group Policy mistake could stop a large number of users from performing their jobs.

Missing technology. Although Windows 2000 management technologies showed promise, they were a version 1.0 technology and were sometimes incomplete—for example, administrators had no tool to help manage patches to the OS, no tool to help predict the effects of Group Policy, and only a limited number of tools to create software packages that IntelliMirror could deploy.

What's Ahead

This report summarizes the most important PC management improvements in Windows Server 2003 and Windows XP. It explains how these operating systems make it easier and safer to deploy Active Directory and Group Policy, details enhancements made to the Windows client application installation infrastructure, and outlines the IntelliMirror capabilities the above technologies help make possible. The report also briefly reviews other Windows technologies useful for reducing PC management costs. Finally, it provides some guidelines for evaluating PC management capabilities when considering migration to Windows Server 2003 and Windows XP from Windows 9x, Windows NT 4.0, and Windows 2000.

The report is organized into the following chapters:

Active Directory Improvements Remove Many Migration Roadblocks explains how Microsoft has addressed many of the barriers to implementing Active Directory by providing better and more complete planning information and making it easier for administrators to adjust the directory to organizational changes, such as the acquisition of a new business or the accommodation of units that require their own directory.

Windows Server 2003 Reduces Fear of Group Policy summarizes how Microsoft has addressed a major barrier to deploying Group Policy by providing tools that help the administrator understand to whom a specific policy will apply, and what the policy will do to those users’ PCs.

Managing PCs with IntelliMirror reviews the IntelliMirror family of technologies for managing and replicating users' data, settings, and applications, and briefly summarizes incremental improvements made to these technologies in Windows Server 2003 and Windows XP.

Windows Application Installation Improves covers the set of improvements in the way applications are installed on Windows that were necessary for Windows Server 2003’s Group Policy and IntelliMirror capabilities to more effectively manage application software on PCs. This chapter includes discussions of a new version of the Windows Installer service that provides support for new installation tasks and the .NET Framework; and describes improvements to the way shared components are supported in Windows XP that ease "DLL Hell" problems created during application installation.

Benefits and Prospects provides an overview of the management benefits that accrue with Windows Server 2003 deployment under three of the most common scenarios: the organization’s current corporate network infrastructure is built on Windows 2000 Server with Active Directory, Windows 2000 Server without Active Directory, or Windows NT 4.0 Server. This chapter also points out the two major holes in Microsoft's overall systems management picture.

Appendix A: Management Features by Platform summarizes the set of PC management capabilities available to administrators when various versions of the Windows client are used in conjunction with either a Windows 2000 Server- or Windows Server 2003-based corporate network infrastructure.