Motivations for, and barriers to, using Cornell's MS Configuration Manager (CM) more powerful tools and capabilities, such as application updating. Especially within Research. |
Interesting CM/Casper/Encryption stats CIT website
CM book. Considering ordering "Mastering System Center Configuration Manager 1st Edition" to save CM training costs.
The decision to have CM installed "on all Windows which are in CU AD" is fine within Research as long as the following condition holds true:
We can roll out CM within Research ONLY IF we have the option, per computer, to pick and choose CM capabilities to best meet that research computer's business need.
KEY: No software is forced installed on Windows except the following under specific circumstances:
| Software forced-installed | Circumstance | Notes |
|---|---|---|
| CM Client | Added when system added to CU AD | Non-issue, right? |
| Flexera CSI (Secunia) | Added when system added to (CIT?) Central Patching | If only installed if system added to CIT Central Patching, non-issue, right? |
| No other software is forced-installed! | (Not to be confused with action taken on pre-installed software) |
| (1A) CU AD | (1B) CM client | CIT Central Patching | A&S Central Patching | Chemistry Central Patching | A la carte patching (CM) | A la carte patching: (GP) | A la carte installs (CM) | A la carte installs (GP) | |
|---|---|---|---|---|---|---|---|---|---|
| What service gets you or does: | Gets you CM client automatically (forced install) | Enables all other CM services. | Patching ONLY if application already on system. | Patching ONLY if application already on system. | |||||
| Pros of service: | None: passive. | ||||||||
| Cons of service: | (none) | (none?) Can it report out, even in "passive" mode? OK anyway, right? | |||||||
| How used in Chemistry Research: | All supported Windows able to get on AD get this. | Thus, supported Windows able to get on AD get this. | Java patching | Java intalls. |
Snap-shot of a la carte patching targets:
| Application | Owner | Notes |
|---|---|---|
Snap-shot of a la carte installable applications"
| Application | Owner | Notes |
|---|---|---|
| SCEP | Chemistry IT | If SEP or other anti-virus software already installed, uninstalls that software first. Created by Michael Hint, and shared with the AS IT Science cluster.
|
| Others? |
| Function | Gap, as understood by Chemistry IT | Notes |
|---|---|---|
| Create and maintain easy-to-access page with current list of apps managed by 3rd party updater. | Unknown products been installed or updated by 3rd party updater. | All or nothing, right? |
| Enable stand-alone CM SCEP install | ||
| Enable stand-alone CM MS updates with forced reboots | Do not automatically link this capability with any other enrollments. | Forced reboots moving from ~2pm to ~4pm, once moved to CIT's schedule. |
| Ideal: Enable stand-along CM MS updates with non-forced reboots (and/ or other algorithms) | The more choice, the more likely to find a good fit to ensure patching. | |
| Enable stand-alone A&S CM Java install | In progress. A&S testing. | |
| Enable stand-alone A&S CM Firefox install | Easy? | Easy since CIT has package already? |
| Enable stand-alone A&S CM Flexera install | DONE! | |
| Enable stand-alone A&S CM FileZilla install | DONE! | |