Software Deployment

My personal opinion look at Novell's ZenWorks Config Manager (ZCM)... Especially if you are a mid-sized business with up to 5k nodes.

It is awesomely easy to create deployments. Those deployments are TONS more flexible then SCCM and can either be self contained or reference other deployments (for say dependencies).

Deployment packages have a couple of stages (distribute, install, launch, reinstall, uninstall). Each stage can have an unlimited amount of steps or actions like install msi, install another ZCM package, edit ini, edit reg, run script, run exe etc. These steps can be put in any order needed to deploy software....

ZCM also has something that is drastically different but very nice, an App shortcut window (they call it the Novell Application Laucher or NAL). Its a huge change for the users, since it essentially is a window with all their app icons in it, but VERY nice since these icons will check for updates/new versions everytime they are launched. Think of the NAL window as an advertised entry point if you will but for the deployment system. You could even have a script that runs before the customer launches each app...

Downside... last time I used ZCM (10.3), it has pretty horrible network management... They had a good/smart satellite server system, where a PC/Server on the LAN can provide download files without crossing WANs but there really wasn't bandwidth controls. Caused some issues especially with vpn/wireless users... Not nearly as robust as MS Bits system.


I went from a ZCM system to SCCM (working with SCCM the last year). While SCCM does get the job done... ZCM was infinitely easier to use, especially difficult multi installer apps. Also packaging knowledge expertise was not needed as much because of all the cool "steps" zcm had. Many times we would use simple scripts/reg entries via SCCM instead of building way more complex mst/msi's to do the same thing with SCCM.

MS SCCM is the best tool in the market and a leader.

Hi, I hope I am not too late to reply to your question.  I wanted to give you my take on deployment tools because we have used several and recently (about a year and a half ago) discovered the tool that worked with us best.

What's best for one company may not be the best for another, or even any other. The approach should be to list your requirements and then seek out a product which matches as many of those as possible with as few disadvantages/down-sides as possible.

For me, there doesn't seem to be too much wrong with SCCM, other than the monumental hoop-jumping required if you want to force an application to deploy right now!.

[sorry for the delayed response...I was on leave]

Thanks for the response, Ian.

I have a few questions....(Please don't mind...the list of questions is big...if you think it's waste of your time answering these questions pls ignore them...I can understand)

1. What is the average success rate when you deploy a default package/application on all your computers with SCCM?
2. How much time you spend on fixing the broken installations OR installation failures...etc?
3. Do you have a proper reporting mechanism in SCCM? Can we completely rely on this reporting?
4. How do you handle package upgrades on remote machines (i.e user laptops which will be connected to office network via a software VPN)?
5. How do you handle package upgrades with application in-use case? (i.e, How do you upgrade Adobe Reader/Acrobat when the user is using any of these apps)
6. How do you assign packages to the computers? is it by adding computers to AD groups? if yes, what's the minimum time it takes to sync the AD changes and assign the package? In short, can I deploy a package to a user's computer *now*?
7. Can we deploy packages under current user context?
8. Can we give a pop-up to the user informing about the application upgrade and request the user to close in use applications (e.g. browsers, applications...etc)?
9. Do we have software/hardware inventory in SCCM?
10. Can we deploy security patches (both Microsoft's and third party like adobe, apple...etc) via SCCM?

Thanks,
Chetan

With the massive proviso that I'm deploying into a test environment...
1. What is the average success rate when you deploy a default package/application on all your computers with SCCM?
I'd say around 96%

2. How much time you spend on fixing the broken installations OR installation failures...etc?
It depends on what caused the failure but, since we moved to using VMs, it's much, much quicker to restore to a known state and re-deploy.

3. Do you have a proper reporting mechanism in SCCM? Can we completely rely on this reporting?
The reporting is extensive but not something I spend a great deal of time playing with but, given that the database is SQL-based, you could create pretty much any report you might want.

4. How do you handle package upgrades on remote machines (i.e user laptops which will be connected to office network via a software VPN)?
What do you mean "How do you handle"? Are you thinking about sizeable packages/bandwidth considerations?

5. How do you handle package upgrades with application in-use case? (i.e, How do you upgrade Adobe Reader/Acrobat when the user is using any of these apps)
In general, these should be handled by the package.

6. How do you assign packages to the computers? is it by adding computers to AD groups? if yes, what's the minimum time it takes to sync the AD changes and assign the package? In short, can I deploy a package to a user's computer *now*?
I *always* use AD groups but the bods in the client's Production environment add them explicitly. To my mind, the latter means you end up with cluttered collections, where machines are removed from the domain. There is a default setting for refreshing collections from AD but you can force it to happen on demand. Once the machine is in the collection, deployment normally happens within the hour which, for us, is good enough.

7. Can we deploy packages under current user context?
Why would you want to, when almost every piece of software is licensed per-machine? User-level data (file or registry) is obviously handled by the package.

8. Can we give a pop-up to the user informing about the application upgrade and request the user to close in use applications (e.g. browsers, applications...etc)?
The SCCM client does that already but there's no reason why you couldn't roll your own. The SCCM object model is pretty rich and fairly well documented.

9. Do we have software/hardware inventory in SCCM?
Yes.

10. Can we deploy security patches (both Microsoft's and third party like adobe, apple...etc) via SCCM?
Yes but we leave MS patching/KBs to WSUS (long story...)

Thanks a ton for your time and reply, Ian. I am really happy to see your responses to all my questions.

I'll provide more details on our environment and our expectations tomorrow.(My cab is waiting outside; it's 8:00 PM in India).

Thank you once again for your time and reply, Ian.

Regards,
Chetan

By "best", you'll need to define what you mean by best. Lowest cost? Most reliable? Most configurable? Least maintenance? Simplest to use? Each of these has trade-offs and you'll need to define your target before you aim at it. You'll get a lot of MS folks saying "use SCCM" if for no other reason than that's what they know, and it for the most part it works pretty well. Folks who are sold on Radia, etc. will say the same thing. Any delivery system has its disadvantages and you'll need to decide which of those you can live with, and which of those you can't live with.

Folks who are sold on Radia, etc. will say the same thing.
I can't believe you used the "R" word... LOL

I agree that SCCM is the best that I've used, having worked with Altiris, CA Desktop and Server Management (now CA IT Client Manager) and SMS (now SCCM). If you have the option I would go with the later SCCM 2012 over SCCM 2007.

To expand on a few of the answers that Ian gave:

1. What is the average success rate when you deploy a default package/application on all your computers with SCCM?
Around 95% or higher. (not counting offline machines)

3. Do you have a proper reporting mechanism in SCCM? Can we completely rely on this reporting?
The deployment reporting provides specific status updates, whether it is Accepted, Running, Waiting (for content), Retrying, Succeeded, Failed, No Status (usually offline or otherwise not communicating) and others.
There are also many pre-configured reports (hardware and software) and you can create your own custom reports to report on anything that is inventoried.

6. How do you assign packages to the computers? AD, etc?
We generally create collection of systems based on dynamic queries. If we are performing a software upgrade we do a query that consists of "Add/Remove Programs > Display Name" = "ProgramToBeUpgraded" and then deploy to the resulting list of machines. The collection can be updated manually and is very quick. Other times we will add a specific list of computers directly to a query and that is fast as well. Since the AD is managed by another group and the organization does not always line up perfectly with our deployment targets, it wasn't practical for us to use it in that manner.

7. Can we deploy packages under current user context?
Yes, you can deploy packages under the current user context and you can also set up an ongoing deployment that will deploy once to each user that individually logs onto the machine.
Some of the deployment options are:
Program can run:
"Only when a user is logged on" (Select - Run with user's rights OR Run with administrative rights)
"Whether or not a user is logged on" (Elevated)
"Only when no user is logged on" (Elevated)

9. Do we have software/hardware inventory in SCCM?
Yes, and it is configurable to include what is not collected by default or exclude things you are not interested in inventorying. For example, it inventories several keys of the "Add/Remove Programs" "HKLM\Software\Windows\CurrentVersion\Uninstall" registry path, but not UninstallString by default. I found that when tasked with uninstalling a program the UninstallString was useful so I modified the default inventory configuration to include the UninstallString. This is especially helpful if you have multiple versions of the same program which sometimes have different uninstall strings. And that's just one example.

10. Can we deploy security patches (both Microsoft's and third party like adobe, apple...etc) via SCCM?
Yes, I think the Microsoft patching with SCCM (using WSUS integration) is fantastic compared to other systems. You can also deploy 3rd party security updates as standard software deployments after creating the silent install package.

It is also capable of doing OS deployments, but we haven't taken advantage of that feature yet.
It has Wake on LAN capabilities also.

There is also a lot of information available for troubleshooting online and in forums.

The downside in my opinion is that the console can be a bit complicated at times, but once you learn where everything is and what it does it's really not so bad.

Thanks for sharing and letting us aware about this information. This is a great thread, so much info.it ls a good article and love your words , so charming and make people learn a lot , thanks !

hi i am having lot of dought on cab files while we creating the msi what is the main purpose of creatig that cab files is there any other uses for that

what are the main critical errors in our packaging and repackaging and what r the best solutions for those

what are the main critical errors in our packaging and repackaging and what r the best solutions for those Employing people who have no idea how to do the job?

The best solution is to either out-source to a reputable firm or lay out some money to send new packagers on training courses.

Before that, though, it might be an idea to teach them forum etiquette, like posting one question at a time and not hijacking totally unrelated threads..

Oink...flap...

ORIGINAL: DeQuosaek

I agree that SCCM is the best that I've used, having worked with Altiris, CA Desktop and Server Management (now CA IT Client Manager) and SMS (now SCCM). If you have the option I would go with the later SCCM 2012 over SCCM 2007.

To expand on a few of the answers that Ian gave:

1. What is the average success rate when you deploy a default package/application on all your computers with SCCM?
Around 95% or higher. (not counting offline machines)


With us it's about 80%, lot's of agents just not working. With the updates it's even worse, estimated: 60%, 40% of the machines now not updating anymore.


3. Do you have a proper reporting mechanism in SCCM? Can we completely rely on this reporting?
The deployment reporting provides specific status updates, whether it is Accepted, Running, Waiting (for content), Retrying, Succeeded, Failed, No Status (usually offline or otherwise not communicating) and others.
There are also many pre-configured reports (hardware and software) and you can create your own custom reports to report on anything that is inventoried.


The reporting is there, however: it is a b*tch to configure for anything exotic and has a non intuitive interface.


6. How do you assign packages to the computers? AD, etc?
We generally create collection of systems based on dynamic queries. If we are performing a software upgrade we do a query that consists of "Add/Remove Programs > Display Name" = "ProgramToBeUpgraded" and then deploy to the resulting list of machines. The collection can be updated manually and is very quick. Other times we will add a specific list of computers directly to a query and that is fast as well. Since the AD is managed by another group and the organization does not always line up perfectly with our deployment targets, it wasn't practical for us to use it in that manner.


The "dynamic queries" can also be seen as a drawback. If you make a dynamic query based on an AD group it can take from 15 minutes to never for the changes to show in SCCM. Also creating these queries is no simple task indeed. I can do some copy pasting, but creating a query based on "what program is installed on the machine" is beyond me...


7. Can we deploy packages under current user context?
Yes, you can deploy packages under the current user context and you can also set up an ongoing deployment that will deploy once to each user that individually logs onto the machine.
Some of the deployment options are:
Program can run:
"Only when a user is logged on" (Select - Run with user's rights OR Run with administrative rights)
"Whether or not a user is logged on" (Elevated)
"Only when no user is logged on" (Elevated)


You can? I would love to learn how to assign packages to a user and have them run in a timely fashion. The SCCM client only knows which user is logging on after the logon process, so the "Whether or not... and "Only when..." options are never going to work correct? I would not know where to start assigning a package to a user and, more importantly, have SCCM roll it out before the user calls it a day and goes home :P


9. Do we have software/hardware inventory in SCCM?
Yes, and it is configurable to include what is not collected by default or exclude things you are not interested in inventorying. For example, it inventories several keys of the "Add/Remove Programs" "HKLM\Software\Windows\CurrentVersion\Uninstall" registry path, but not UninstallString by default. I found that when tasked with uninstalling a program the UninstallString was useful so I modified the default inventory configuration to include the UninstallString. This is especially helpful if you have multiple versions of the same program which sometimes have different uninstall strings. And that's just one example.


Man, I need a crash course in SCCM. I have not a clue as to how I could make such a query and then actually use it...


10. Can we deploy security patches (both Microsoft's and third party like adobe, apple...etc) via SCCM?
Yes, I think the Microsoft patching with SCCM (using WSUS integration) is fantastic compared to other systems. You can also deploy 3rd party security updates as standard software deployments after creating the silent install package.


We used to use WSUS for our update deployment: great, never any problems (now and then you had to reset the updates on a machine, but that was it). Now we are using SCCM 2007 and have nothing but problems. Updates that are failing, not downloading or get stuck half way. Then we have machines that simply do not download updates anymore. Maybe we can share some info, we must be doing something wrong at this end :P


It is also capable of doing OS deployments, but we haven't taken advantage of that feature yet.
It has Wake on LAN capabilities also.


Hehe weird, this is the only thing that is just about perfect in SCCM and you don't use it :P
We use SCCM to deploy Win7 and I have to say: GREAT! Really configurable, easy to understand and even the interface it nice. It seems like a non-sccm product actually...


There is also a lot of information available for troubleshooting online and in forums.

The downside in my opinion is that the console can be a bit complicated at times, but once you learn where everything is and what it does it's really not so bad.


Maybe SCCM is just for very large orginizations with 5000+ users and 3 or 4 dedicated SCCM admins. We are a medium company with one SCCM admin that has to do SCCM on the side besides other tasks and project. For that it is simply a to complex option with a very steep learning curve and a lot of drawbacks for a "simple" enviroment...

you'll need to define what you mean by best. Lowest cost? Most reliable? Most configurable? Least maintenance? Simplest to use?
Well said. At the risk of being a shill, I wrote my own deployment tool to deploy software via WSUS and released it via an open source license. More info here: http://localupdatepublisher.com

I would recommend to check out the new Total Software Deployment tool:
http://www.softinventive.com/total-software-deployment/

It has a user-friendly interface. It’s quite cheap. There are three different methods to create deployment packages. I was able to deploy around 90% of installers with this tool so far, it’s much more flexible than other solutions these days.

No-one mentioned BigFix yet so I thought I would...

The best software deployment tool in the market, hands down is Leroy. http://www.leroydeploy.com

Why ?

• It's free
• It's agent based
• It's threaded
• It's easy to use and xml driven
• It works on all platforms and technologies.

Another solution out there is one called Heat LANrev.  It is dual platform Win/OSX solution with all three tiers.... server/admin/client supporting both Win and Mac.  I have used its Mac management extensively and can attest to how efficiently it can push out software packages and updates.  It is good solution for managers who operate primarily in a Windows-centric environment, as well.