Living Large
All desktop management suites must handle application deployment, desktop configuration and lockdown, remote control and information management. You'd think that because virus protection is an integral part of desktop security, it would be a mandatory feature, but it's not--yet. Two of the four suites we tested, Novell ZENworks and Intel LANDesk, include virus protection, and we predict the others will soon follow suit.

Application deployment is, naturally, the bread and butter of desktop management. It takes a technician more than two hours to install the software a workstation might need over its lifetime; a desktop management package can deploy it in minutes. But don't look for nirvana in these packages: All the products we tested can take a "snapshot" of an application and deploy it to workstations, but only LANDesk can do a true "lights out" installation. Fortunately, all four packages support conditional application deployment based on other applications, registry entries, environment variables, workstation muscle and so on--a must for truly useful application deployment.

Application packagers, notably Microsoft's SMS Installer, offer strong scripting functions, which can be powerful assistants for installs and perform workstation maintenance that can't be captured in snapshot-style deployments. Still, most times, it's better to use the built-in console features rather than venture into labor-intensive scripting.

As far as desktop configuration and lockdown go, Microsoft Windows' System Policy Editor (PolEdit) is about as fancy as most packages get. Only ZENworks integrates workstation policy management into its console. In addition, ZENworks is the only product that offers automated printer installation--a real time-saver.

Remote control is similar across three of the packages; we think centralized authentication is a must for dealing with large numbers of workstations. Veritas' offering, which uses per-workstation passwords, is just unacceptable--a nonscalable and insecure solution. With any kind of mass authentication, if it's a bother to change passwords, they don't get changed.

Microsoft and Veritas lead the pack in regard to information management; their products both include and integrate Crystal Reports into the consoles, and thus support user-built queries and reports. We were satisfied, however, with the prebuilt reports that shipped with all four packages we tested. All support data export, allowing you to use any system you want to create reports. Finally, having been forced to live with old data in previous management-suite incarnations, we are thrilled that all the packages support some level of database purging.

If you're looking for interoperability à la Web servers and clients, you might as well stop now--it doesn't exist. Forget about the instrumentation standards; you can't actually manage a workstation using any of these packages without installing the package's specific client. If your company acquires another that uses a different management suite, you have two options: Uninstall the old suite's clients and reinstall yours, or continue using the old management suite. Even the widely supported WOL (Wake On LAN) from Intel is only supported by Intel's suite; you'll have to purchase an add-on tool for the others. Intel told us it's planning to "open source" its client, which theoretically would open the door for standard clients--something we'd love to see--but given the political challenges, we're not holding our breath.

In the end, picking a desktop management suite is a feature-oriented and environment-based decision. Novell ZENworks and Intel LANDesk are our favorites, with ZENworks walking away with our Editor's Choice award. All these packages will do the job, but ZENworks stands out because of its solid feature set, easy-to-use interface and strong directory functions.

Pricing models differ, but they come pretty close to one another in the midrange. You can get about 100 seats, a good starter pack if you're just beginning, for about the price of two souped-up PCs. (And we strongly recommend that you do your own pilot testing for whatever suite you pick, particularly if there's a WAN link in the picture.) As far as good values go, however, notice that ZENworks and LANDesk come with virus protection, and that Veritas DMS comes with its BackupExec backup software.

How We Tested
With the exception of ZENworks, all packages were installed to a server running NT Server 4 with Service Pack 5. SMS required a domain controller; the other servers were member servers of an NT domain. ZENworks was installed to a NetWare 5 server with Service Pack 2a applied. (All packages will work with NetWare in the picture, but ZENworks requires at least one NetWare server.)

We used Dell and Gateway workstations and laptops; to diversify our desktops, we used Windows 95 OSR2, Windows 98, Windows 98 SE and NT 4 Service Pack 5 as client operating systems. We tested both on clean, freshly installed machines, and obtained images from machines that had been in the field. All workstations were connected to an Ethernet network with several VLANs.

On each console, we created applications to deploy, ranging from a snapshot installation of WordPerfect 9 to a simple executable of NetTerm, a terminal emulator. We tested each item that's listed in our features chart (see pages 64 and 66); between iterations of tests with each management system, we ensured "known good" workstations by resetting each client system to its original image and then deploying the management agents via login scripts--a reasonably plug-and-play procedure.