"I believe that if you show people the problems and you show them the solutions they will be moved to act" — Bill Gates
Log in

User Installed Applications – Fact or Fiction?


Posted June 30, 2010 by

Its been a while now since the initial flurry of activity around the beginnings of the Desktop Virtualization space and today, many organizations are starting to piece together the puzzle in search of that alluring reduction in TCO.  What we are beginning to experience is the realization that additional software is needed to fill the gaps in technology not current catered for by the VDI vendors whether this be security, personalization, management or application provisioning which is further leading to confusion.  We are entering a space where there is no reference architecture, no early groups who walked the walk and know the mistakes and no firm recommendations as to exactly what is needed – this is new territory for many.

While the concept of a controlled, secured and centrally managed systems sounds like utopia the reality is that the Microsoft world is just not ready for this and many organizations are not considering the actual user when looking at VDI.  While VDI may bring financial benefit and sound good when being presented to a CFO, the reality is that the user will ultimately decide if it will be adopted.  Although we may not like to admit it, in the IT world, the user is the boss and we simply work for them.  You can propose the most perfect solution available but if doesn’t work for the user, it will not be adopted.

The PC user has a certain way of working today in many environments and I use the term PC user to describe those who don’t use centralized resources such as Terminal Services.  I remember once hearing my mothering-law complain about her computer at work because she couldn’t use a certain website and how her and a group of others had IT over-ruled because of it.  Now while you might say that is rare I can assure you that the organization she worked for was amongst the bigger organizations in the world.

Today’s PC environment is very different to how IT would like to imagine it to be with a multitude of technology in play.  Even if the IT infrastructure available to the user is limited; by simply connecting a machine to the Internet, the user will more than likely touch more pieces of independent (not corporate known or managed) software than ever existed in the early days of Terminal Services.  With Flash, Silverlight, Air, RealPlayer, the Google toolbar and the various document viewers to name a few, the PC is a constantly evolving device that grows to accommodate the user.

I believe that last statement I made was quite important – the device grows to accommodate the user and not the other way around.  IT likes to believe that the build they put out is exactly what the user needs and will often struggle to realize that each user is different.  This is the main reason that IT and the user typically clash, both have different expectations about the same thing – how computing resources will be used.

So where does User Installed Applications play in all of this?

I think that almost all of the organizations involved with VDI have established that a one user to one virtual machine model just isn’t financially beneficial and as such have to seriously consider stateless machines.  While the organization could allow the user to install applications knowing that they would be destroyed at logoff, this would bring substantial problems with the user experience and would probably be rejected in the long term.

With the above in mind, we find ourselves in the situation of having to allow users to install applications in a non-persistent environment, which is destroyed at logoff.  WOW – can you imagine saying that just 5 years ago let alone 10.  The user session consists of more than just the data, personality and corporate delivered applications; it consists of every little thing that makes that user work.  That user must be able to use a virtual machine in exactly the same way as they used their physical machine otherwise they will object, complain, moan and ultimately cause the failure of the project.

So there lies my view with User Installed Applications.  It may not be the right view and I may look back on this post in 12-18 months and think wow, how wrong was I but I highly doubt it.

I am however interested in what other people think in this area.

This post was filed in Citrix, Desktop Virtualization, User Installed Applications, VMware

About Jon Wallace:
Jon is a senior executive and technology veteran having worked with some of the largest and most complex technology environments in the world. As director of emerging technologies for a leading multinational software organization Jon focuses on creating disruptive strategy and maintains an in-depth view of the industry at large. With the experience of working from the field level to the boardroom Jon brings a unique viewpoint catering for many factors and one which is based on real world experience.

 Reader Comments...

@rimmergram on June 20, 2010 at 12:00 am

UIA will continue to be a necessary evil for IT admins, the case cited above about Adobe Air and TweetDeck sums it up very concisely :-) However, IT admins needs to have the visibility to see what is installed and what is being consumed and how it is being used. Free tools such as WorkSpace Discovery from @centrixsoftware can provide this IT intelligence.

Reply
Guest on June 30, 2010 at 12:00 am

Guest Above:

Where John is most mistaken is with his take that the user can control what sys-admins can or decide to do. Users will work with whatever is given to them and a controlled environment is just as good as a flexible one.

With strong control like which is provided by RES and other vendors you can still give the user a personal environment without having to give them the keys to the castle.

My initial comment may have been posted quickly but I stand by what I say in that it is just a matter of controlling the user and settings the right expectations.

Reply
@tyrone_thomas on June 30, 2010 at 12:00 am

@Eric s. Perkins – No User installed anything/user personalised anything can work -

But only if IT can meet user exceptions and keep pace with ever evolving work-styles – however if that link breaks – dissatisfied users WILL look for a way to circumvent IT’s carefully curated environment – I’m sure you have have done it yourself! – it’s been this way for ever and will continue unless IT changes attitudes and trusts some users a little more.

e.g Look @ Apple which been trying to control users and apps on their devices for ever and for most this is ok – but there is a large ‘black market’ for jailbreaking for those people who require more than the vendor can offer.

It is one of the age old challenges of desktop management and IT unless it can offer some more flexibility or innovate more quickly, be more dynamic and be responsive to business and user requirements – nothing will change.

Reply
Simon Rust (AppSense) on June 30, 2010 at 12:00 am

Thanks for raising this conversation topic Jon – this has quickly become a really interesting thread.

What is really clear to me is that we are all on a journey and some folks have unsurprisingly taken slightly different paths along the way and hence have what appears to be very differing opinions

However, all do seem to generally agree that control is important (I take particular note of @gilwood_cs here – “needs to be done in a framework that helps prevent them from breaching licensing & security rules and stops them from hosing their device”- particularly like the hosing of the device comment :-) )

There also appears to be agreement on this is actually something that is dangerous and risky – BUT that we must seriously consider the implications of not doing something.

So far all I have said is what you read above :-) – so I add that it is really now about how we as IT admins can deliver the user experience that is required by the end users in a controlled manner. We all agree the demands of the user population is growing…

If you have a use case that depicts a need (I fully accept that not all will have need – as above, the call center use case for User Installed Apps does not exist most likely as just one example) to enable users to install business tools that are not pre-packaged, then I believe that we are to give the illusion to the user population that we are releasing the reins somewhat, but that full control is maintained (by IT) under the hood. This will grant you the very best of both words where possible.

@djfeller does indeed hit the nail on the head with the comment above regarding the dangers for the data center etc. If we can allow selective groups / users this illusion that they are the owners of their own productivity destiny, then we somewhat allow ourselves to be in a position to deliver an acceptable user experience via the virtual desktop to them, BUT that we do in fact retain the control that so many of us are talking of here.

As Jeff O’Connor states, it is indeed down to the professionals to be able to bring solutions to the table that provide smarter ways to deploy out to end user requirements.

Great thread that will not end here I am sure :-)

Looking forward to being able to share a solution that AppSense will very soon have to help fill this void.

@SimonARust
(AppSense)

Reply
@djfeller on June 30, 2010 at 12:00 am

@amichael
Good point regarding it isn’t all or nothing. I totally agree. With regards to the call center use case, I am not convinced I would use a virtual desktop (VDI model for them). In fact, I would probably go down the path of the XenApp published desktop. They only need 1-2 apps and running call center apps on XenApp gives us the more controlled, fast and scalable environment we need for those users. Your point is accurate, it is not all or nothing. Align user requirements with technical functionality.

Reply
Gareth Kitson (AppSense) on June 30, 2010 at 12:00 am

@ Jeff O’Connor – I have a proposal.

IT can not put all apps in base build, nor can package and manage every app to be virtualized, Dazzle/Immidio may help here, and be further enhanced with AppSense UIA?.

What if, through the use of UIA technology – when AppSense captures the install and redirects to create the self service application provisioning system for the select users we are addressing, we also have the option to then publish the application back through a Dazzle/Immidio interface to then share the UIA application back across the user base – once of course IT has permitted it acceptable and approved it.

The user, when installing, could be presented with an option to assign info to the install such as:

Application Name: Example.exe
Type of Application: Mindmap software, freeware
Use Case: To help learn presentations
Suitable for: Marketing, Sales and Presenters

This can then go into the Dazzle portal as a user install application and users can then search for apps which they will then receive through Dazzle, but were introduced by the user, not IT workload, IT merely permit the usage..

Thoughts?

@GarethKitson

Reply
Gareth Kitson (AppSense) on June 30, 2010 at 12:00 am

@rimmergram

Yup – agree! IT need to be able to see what users are installing, how it is being used and how often.

To save on multiple point solutions – we already provide this functionality in our Application Manager product today, we can see what has been installed, how often it is executed, by who, on which machine etc.. of course, the new UIA technology must also benefit from and use our auditing and reporting capabilities to provide the visibility you quite rightly mentioned :)

We’ve been working on the UIA stuff for a long time now, fingers crossed, hopefully we’ve covered all the essentials in this first release.. but as always, keen to hear more thoughts and feedback..

Thanks
Gaz

Reply
Guest on June 30, 2010 at 12:00 am

Isn’t this just a problem for Microsoft to fix. The whole debate and growing industry is due to failings & shortcomings of MS OSs. Legacy profile & rights issues will surely be addressed in Windows 8 and then all this will be a commodity. Applying technology to sandbox & virtualize user installed apps is an expensive way of ignoring the reasons why users were revoked admin privileges.

AppSense et al are a cost of failure to Microsoft – fact. Can MS afford that cost or lost revenue share – probably? Is this a real problem or have a group of ISVs & industry commentators stumbled upon a set of technologies that need a home. If it is (a problem) then MS will fix it, and either way the ISVs & commentators are about to realize their peak.

Reply
Guest on June 30, 2010 at 12:00 am

Disagree! This is just a matter of controlling the user and setting the right expectation.

RES Powerfuse has been doing this for years
http://www.ressoftware.com/

Reply
@amichaell on June 30, 2010 at 12:00 am

User installed applications isn’t something that should be approached with an all or nothing perspective. As with everything, there is a time and place for various delivery models.

The model of task workers and power workers applies to VDI environments just as it has always applied to more traditional fat client environments. Workers in call center environments simply do not and should not have the ability to install applications. Whether your IT department officially supports whatever application they choose to install, the point is that you WILL end up supporting it when that application causes a conflict or exposes a vulnerability. It’s not as if you have the ability to simply tell the user to fix it themselves.

On the other hand nearly every environment has your power users or simply those who “need” the ability to install applications (e.g. iTunes, Pandora, etc). For that class of worker you’ll need to allow this functionality somehow.

Reply
Steve Atkinson (RES Software) on June 30, 2010 at 12:00 am

This is a topic that I am sure will run and run but on a personal note UIA (Especially in a VDI scenario) holds all sorts of concerns for me.

It is obvious that UIA will clearly win lots of brownie points for Admins from their users but will no doubt be also be responsible for plenty of downtime whilst also posing many other vulnerabilities to the data centre and its resources. We should remember that Admins are not in a popularity contest, they have an ultimate responsibility to provide a working enviroment that allows users be be as productive as possible whilst upholding compliancy set at corporate level.

RES PowerFuse 2010 has provided the ability for users to install their own applications for some time however it is seldom as simple as simply allowing turning on this functionality as there are so many other considerations that can have major effects on the infrastructure. It has to be said that smart Admins do not seem to go down that route.

All vendors in this space should exist to create products with great functionality but they should never tell their customers how to use their products but rather advise as to how the features may help them and then let them decide for themselves. If you want UIA for any reason then RES PowerFuse provides this. Is it a good idea to use it in a VDI environment? Probably not in my opinion.

Anyone considering UIA in a VDI environment should serriously question their motives for using it. Is it simply to give the users what they want? If it is think again as this time it could really hurt further down the line.

Steve Atkinson
RES Software.

Reply
@gilwood_cs on June 30, 2010 at 12:00 am

I think “User Installed Applications” needs to be more than ‘allowing users to install applications’ – you can do that now in all honesty. What’s to say a user installing their own app won’t cause a conflict with another application; that that application is properly licensed, that that application doesn’t expose your environment to some risk? though malware or trojans; that the application installed relies on other software (say an updated .net install, or java update) that in turn begs the same questions?

Stand back – does IT need to find a way to be more flexible. A user isn’t a “consumer”; they’re an employee they should be focused on doing their tasks, which is unlikely to be “installing applications”.

Flip side is – having a very locked down environment can (and does) prevent users from working effectively. Not only in VDI; but laptop/mobile/remote devices.

I think giving users the ability to directly control their desktop is a great feature – but it needs to be done in a framework that helps prevents them from breaching licensing & security rules and stops them from hosing their device.

Reply
Jon Wallace on June 30, 2010 at 12:00 am

Hi Jeff,

Fair point but surely you can’t pre-package every application?

For example – the other day I installed TweetDeck on a machine. To do that I needed to upgrade Adobe Flash, install Adobe Air and then TweetDeck. That’s 3 separate applications and so 3 separate pre-packaged entities…

Then, what about when those components are updated? What when TweetDeck won’t work because it needs the updated Adobe Air, will IT rush to pre-package?

The thought of pre-packaged apps is great and all but not practical in a Windows world. In that world, there are too many ‘different’ ways of doing things, too many add-on’s, too many active-x components not to allow users to be able to install their own applications.

I do however agree 100% with your view of now granting admin rights and the key is that technology needs to exist that will allow a user to install an application virtually without admin rights…

Reply
@chrisdemichael on June 30, 2010 at 12:00 am

I don’t think the question of whether or not it is a good thing to allow user installed apps is solely a technical one. Sure, any IT administrator or desktop architect will tell you that the ideal situation that they can create is one of prison-like structure, for all of the “right” reasons (all of those listed above in fact). However, the overall success of any VDI project, or any other IT project for that matter, is not measured by how much of a textbook situation you can create, it’s measured by user acceptance!

If you already have a locked down environment and you deploy a virtual environment that is equally locked down, it will most likely succeed. The user experience is not changing. On the other hand though, if your existing environment allows user installed apps and you implement a locked down virtual environment, you are almost certainly doomed to failure. Why? Because you just turned a few hundred or a few thousand user’s lives upside down! Did you do the “right” thing from a textbook IT standpoint? Of course. But the cold, hard truth is that we all have jobs because of those end users and any major change to their environments must be handled with caution.

Reply
Guest on June 30, 2010 at 12:00 am

@ Gareth Kitson

Spot on Gareth! this is one of those typical examples. Appsense has lockdown functionality for ages: RES renames there policy bit to lockdown. Appsense starts blogging about user installed apps, RES renames their partly managed worstations to user installed apps.

@all

if you give rights or the ability to install apps in a VDI environment there is a direct 1 to 1 relationship with that VD (=persistent =management =costs).

Reply
@tyrone_thomas on June 30, 2010 at 12:00 am

User driven personalisation including user installed applications needs to be careful considered – implemented initially on a user group by user group basis – as alluded to by @djfeller.

I agree with the OP that IT does need to let go of the chains/reins a little and trust competent user groups, but at the same time IT must have a fall-back capability to restore a users desktop or session to a previously last know good state or configuration – IT will also need a robust data management strategy and appropriate usage guideline and protections in place, in order to keep corporate data safe.

Some products and solutions have just started to emerge which promise dynamic composition of a desktop through layering – e.g. Unidesk. Hopefully there will be many more entrants, and maybe some existing user personalisation vendors can push their boundaries to start to make this all possible and more mainstream.

As I’ve said the critical thing is – that if IT is to let go of the reins it must have a fall-back plan to help users that break their desktop/sessions/personalities, and a proper data management strategy.

Reply
Jon Wallace on June 30, 2010 at 12:00 am

Gaz,

I’ve just tweeted your comment and that is a VERY interesting idea… This kind-of evolves Dazzle into a self-populating database of applications without IT having to pre-package each one of them.

VERY VERY interesting…

Reply
@chrisdemichael on June 30, 2010 at 12:00 am

I don’t see this topic as being as simple as whether or not to”give users what they want”. The whole subject of user installed apps is really one about “giving users what they HAVE”.

I don’t think anyone commenting above would suggest that we use a VDI deployment to move from a locked down physical environment to a wide open virtual one, that would be insane. However, are we actually suggesting the opposite? Would we move a wide open physical enviornment to a totally locked down virtual one? In my opinion, that would be equally insane. Take for instance a University. I was recently in a pre-sales discussion with the VP of Information Systems of a small, private university when the question of user installed applications was brought up. He flat out told me “We are a University, we don’t lock down ANYTHING for our users” (he was of course referring to faculty, not students). In that situation, it’s not even a question of what is good practice or not, we just HAVE to deliver user installed apps. Period.

In this field, almost every organization will have a different set of requirements that we must strive to fill. Filling those requires options, the more the better to add to our arsenals. User Installed Applications are a reality and something that we need to have in our arsenals. The argument as to whether or not to use it is still an important one, but one we need to be ABLE to have.

Reply
Jon Wallace on June 30, 2010 at 12:00 am

Hey Eric,

Are you not in the business you are because users DO utilize a PC in the way they want to use it? Assuming that is the case and that people like you and companies like yours will always be needed, logically that says that PCs will always be used the way users want to use them.

Don’t get me wrong, I’m not saying User Install Applications are a good thing, I’m saying they are a necessary thing and whether I, you or anyone else likes it, they are real.

To steal the comment from @djfella:

“think we can all agree that user installed applications is dangerous not only for the desktop itself but also for the entire data center. Unfortunately, if your virtual desktop deployment is going to succeed in large scale, you must have some way of supporting users in this model.”

He’s right on the money here, they are dangerous but hey, users rule when it comes to the PC and IT.

Can you imagine how quick IT policy will be reversed when a trader for XYZ goes to his boss and tells him that he can’t make his usual $20m for the bank because he can’t run that secret little tool that he uses…

IT may like to BELIEVE they set policy but they don’t, they provide services to the users.

Reply
@djfeller on June 30, 2010 at 12:00 am

I think we can all agree that user installed applications is dangerous not only for the desktop itself but also for the entire data center. Unfortunately, if your virtual desktop deployment is going to succeed in large scale, you must have some way of supporting users in this model. Don’t believe me? Look at yourselves then. What have you done to your corporate image? Did you install your own apps? Did you personalize the OS? The apps? Did you add your own files all over the desktop?

I bet most of you are saying yes, yes, yes. It is a fact that users must have ability to install apps, but it is only a portion of what personalization means. We have a fine line to walk. We must allow users functionality to customize their environments but we also must help protect the data center and the user from themselves.

Reply
Guest on June 30, 2010 at 12:00 am

Does any IT department run without some of their staff having the rights on install applications on their local PC?

I’ve never seen it in any of the places I’ve worked or visited.

The fact is that we in IT will happily tell a business user to “Shut up and use what you’re given”, but will insist at the same time without any hint of irony that we need special rights is a symptom of the fundamental reason why enterprise IT is failing – IT departments think they’re the reason why the company succeeds, when more often they’re the roadblock to success.

Reply
@FrustratedITDirector on June 30, 2010 at 12:00 am

Allow me to throw out there three hypothesis and would welcome any feedback.

1. The root-cause of most IT Support incidents, in an environment where users have admin rights, is the end user.

2. The laws of diminishing returns apply very quickly when writing a business case to productize an application delivered via a gold build or streaming technology. Say 10/15 apps within the gold build and 20/30 more can be streamed, thereafter we are in the long-tail where the costs are not justified.

3. Within a heterogeneous business environment the majority of users will use the top 30/45 applications but will not be satisified as they will have requirements for additional applications unique to their function, role, demographic, customer, supplier, competitor, previous employer, etc.

So, if the above hypothesis are true then we need to find an answer that:
1. Protects the desktop from the user with admin rights, whilst provisioning a safe environment for UIA. Perhaps also allowing a differentiated service level for the Gold Build/Streamed Apps vs the user’s (dirty) sandboxed environment.

2. Identify a technology that delivers a gold build desktop with streamed applications and safe sandboxed environment for users to install applications.

3. Recognise that diversity is a strength and necessity to remain competitive within the 21st Century. IT is an enabler and we must find innovative solutions such that we do not force conformity onto the desktop. Our budgets and demands are accelerating in opposite directions, it is about time we found the ‘holy grail’ that delivers the win/win. Reading the postings above I believe that there are ISVs getting close and we have our cheque books ready.

P.S. If the same technology allows me to rationalise my desktops onto a non-persistent VDI environment then I want to hear about ASAP!

@FrustratedITDirector

Reply
Eric Perkins on June 30, 2010 at 12:00 am

User Installed anything=bad idea

I’m “old skool” on this IT should control the apps, licenses and help improve user productivity while keeping IT costs down.

Reply
Jeff O'Connor on June 30, 2010 at 12:00 am

@Gareth

Interesting idea indeed, I think for some organisations it could work well, for others maybe not. There are generally strict controls over apps that are to be installed & supported in the enterprise, most enterprises are still stuck with some very old-school type thinking around their packaging and deployment, QA, etc. But thats for us professionals to have better solutions to bring them to new methods and better deployments for their customers/users.

I like the flexibility of the model though, which potentially offers more choice for applications, faster delivery and the control is still in the right hands.

I guess theres work to be done for the Immidio Appscriber team, Dazzle team, etc :)

Cheers,
Jeff O’Connor

Reply
Guest on June 30, 2010 at 12:00 am

Dear Guest, when you get your head out of the sand, please come back and make a sensible comment. RES gives IT the ability to deliver a more flexible user environment, fitting more into what Jon discusses in his article above. It helps control the management of the data, NOT the user.

Corporste IT has for many years put a choke chain around users’ necks and been able to get away with it due to a generic lack of awareness and comfort for IT, but those days are finished. There needs to be a shift in how we (IT) manage data alng with users’ expectations and requirements. No more wagging fingers (“you will not…”, “you cannot…”, “you are not allowed ot…”, “you must use…”), or we risk being sidelined for service providers that will cater to the user experience whilst providing an efficient IT service for the organisation.

I think Jon makes some pretty good points that need to be considered, and it adds to the complexity of the stack that IT has to juggle these days.

Reply
@dimitri_t on June 30, 2010 at 12:00 am

We all seem to be struggling to define what is meant by data, user data and data security. I think this is an area where the industry is still not sure where it’s going or how to get there, let alone how to manage it.

@djfeller makes some excellent points, and the earlier posts also demostrate how we in IT view our users – and it’s not positive. The new generation of people entering the workforce are not prepared to submit to a controlled environment they will probably see as outdated and authoritarian. IT needs to work smarter, more quickly and have a much better understanding of the type of users in their business, how they operate and how to manage their expectations.

I agree wih Jon’s point about how the device evolves to accommodate the user is important. How we cut through all te marketing and new technologies coming at us so thick and fast, in order to best guide that evolution is our challenge for the next few years.

Reply
Jeff O'Connor on June 30, 2010 at 12:00 am

Gotta disagree with most people here. If you plan your environment well User Installed Apps can be the most empowering thing you can do for your users. However, my definition of User Installed apps, is Self-Service Apps (think Dazzle & Immidio). The Apps users can install, are pre-defined / packaged / virtualised / or streamed, etc.

Users get a bare bones desktop with Tier 1 applications, or core applications. Above and beyond that are Tier 2 & 3 applications which are delivered through a self-service mechanism. To me these are user installed applications, as they have picked the ones they wanted (IT approved and tested) for their requirements.

This is one mere example, and maybe my definition is different than you all, but I think this one area where user installed apps has been more successful in VDI deployments I have completed over the last 4 yrs. My customers users are happy, IT are happy, and its still User Installed Apps….

Users having local admin permissions to install what they want is obviously a no-no. But packaged apps delivered through an IT mechanism is powerful.

dont confuse user installed apps with local admin priveleges, or perhaps this is just my interpretation of what it means for the enterprise.

Reply
Gareth Kitson (AppSense) on June 30, 2010 at 12:00 am

I think some of the differences here (looking at between the views of Jon Wallace, UIA use cases and RES & other opposing arguments) may come in because of a missunderstanding in the UIA the target audience and cases.

User Installed Applications (UIA) technology focuses on providing (selected power/admin/advanced knowledge) users with the ability to install ‘work related’/'business’/'personal productivity’ applications into a non-persistent stateless virtual desktop environment and ensure those applications, plug-in, add-ons are persisted in the next available session – so:
1. They can do their job as they need applications IT have not delivered,
and
2. They do not have to re-install every single time they log on.

UIA is by no means allowing any user, to install any application, and give the entire user population control of the virtual environment / “keys to the castle”- taking power over and above that of the system admin. It is meeting the needs of the users, and enabling IT in ENTERPRISE environments to adopt stateless virtualization technology.

If by the RES supporting comment of “stand by what you say in that it is just a matter of controlling the user and settings the right expectations” – then possibly you have not had to provide a fully functional, personal, non persisted virtual desktop for large organizations with complex environment supporting many power users? With today’s technology – it is simple: IT CAN NOT deliver EVERY application to EVERY user in a virtual world for tens of thousands of users:

1. Not every application can go in the base gold image (not everyone needs every application in the organization, and also licensing issues).
2. Not every application can be virtualized, packed and streamed to the virtual desktop as there are too many apps out there, some are only used by very small number of users, but are critical none the less, but these applications would be stuck at the back of a 1 year packing queue.
3. Some applications cannot be virtualized either.
All of three of these points validate the need for UIA technology. “Stand by what you say” in any of these situations will lead to project failure as you do not meet the needs of either the user, it department or the enterprise as a whole. This is why I believe AppSense have created the technology – not for the fun of it, but because our large enterprise accounts are demanding this capability (again, for their select, key, important power users – not all users).

Perhaps the difference in views of is based on each person’s / vendors respective experience in different accounts to that of where AppSense (amongst other supporting comment providers on this post) has proven success and where the UIA technology is targeted?… (guest/RES) I presume by the comments of simply locking down every user, you mean smaller businesses may wish to lock every user down and give them only what IT chose to as they have a small, static, simple environment? <- and yes, that approach can work there, I’ve seen it. However, based on my 6 year experience at AppSense and user virtualization solutions, in a larger, more complex and demanding enterprise environment consisting of tens of thousands of users – certain users need more – this is where AppSense comes into play, pushes the boundaries and innovates with new technology such as UIA, and, the soon to be released User Rights Management technology…

As for pure lockdown, well then yes, RES and also AppSense can of course lockdown a desktop, very very much so, while also giving the user the correct data, settings, applications and mapped drives and printers etc as chosen and stipulated by the It dept. In fact AppSense do this at a very granular level and are the clear leaders in this space (1 million license sales in 2009).. and with our new 2010 UIA technology from AppSense soon to be released, this will further propel their user virtualization solution as the leading technology to enable the adoption of desktop virtualization in the enterprise world…

Don’t be afraid of the new technology – it is here to drive the adoption of stateless desktop virtualization, not give every user on the system the opportunity to install whatever they chose to; just select, trusted users…. And i agree with many of the other comments supporting the use of UIA, IF, it also comes with means of fallback, protection, auditing, licensing control, and of course controlling which users can install what applications etc.. which is why as leaders, we have thought about these things and have been working hard to develop an enterprise ready and suitable UIA solution.. Come release – I trust you won’t be disappointed :)

Thanks
@GarethKitson – AppSense.

Reply
Gareth Kitson (AppSense) on June 30, 2010 at 12:00 am

@ Steve Atkinson

Hi Steve.. Hope all is well..

I’m by no means wanting to sound rude here, but I think you are missunderstanding the functionality of AppSnese UIA and subsequent value it provides…

The new AppSense UIA technology being discussed in this article and comments section differs to that of the existing RES PowerFuse and AppSense Application Manager functionality. What you are currently referring to in your post with respect to RES being able to provide UIA is actually something I wrote about a short while ago – User Installed Applications (UIA) by any other name? – http://appsense.wordpress.com/2010/02/22/user-installed-applications-uia-by-any-other-name/

The RES PowerFuse (and AppSense Application Manager) software can be used to block access to unauthorized applications – however, IT cannot block ALL users from installing their own applications. So, quite rightly both AppSense and RES provide the option for the user to self authorize the installation or execution of an application which would typically have been blocked by the respective products. Enabling the user to install the application, but still protect the machine from malicious unknown code executing in the background, as when it attempts to execute, the user is prompted that an application that is typically blocked is attempting to run and do they chose to run it, if the user thinks it is malware, then of course they block it.

In AppSense Application Manager this feature is called ‘Self Authorizing Users’ – in previous versions of RES PowerFuse it was called ‘Partially Managed Workstation’ within the RES AppGuard feature. Today, in RES PowerFuse 2010 (perhaps on account of the interest in the new AppSense UIA technology, which is different from Self Authorizing Users and Partially Managed Workstations) ‘Partially Managed Workstation’ has been changed to RES ‘User Installed Applications’ <- which now proves the points I made in my ‘User Installed Applications by any other name?’ article as we can see has already caused confusion as RES PowerFuse, like AppSense Self Authorizing Users (not the soon to be released AppSense UIA) only enables the user to perform a local install of the application. It does not atomically capture, virtualize, redirect the application outside of the desktop session, and the re-deliver the said application back into any non-persistent or alternatively delivered desktop for that user. This is what AppSense UIA will provide.

I disagree that UIA should not be used in VDI – this is where it has most use. In non-persistent VDI, a percentage of the power users in an organization MUST BE ABLE to install and PERSIST applications, plug-ins/add-ons, drivers etc, between non-persistent VDI sessions. RES PowerFuse and AppSense Self Authorizing Users would enable the user to bypass the policy that typically block unauthorized applications, but neither feature can virtualize, separate and persist the application between non-persistent desktop sessions.

I agree with you on that we should create products but not tell how they should be used all of the time. the AppSense UIA technology for example is something that many of our larger customers (talking over 50k users) have been asking for – they have users that need to persists their own applications. Not every user and not every application – IT control who can do it and to what extent.. we are not telling how to use UIA, as leaders AppSense are providing a much awaited feature and key enabler of stateless desktop virtualization adoption.

Thanks
Gareth Kitson – AppSense.

Reply
@jimmoyle on June 30, 2010 at 12:00 am

In the traditional desktop space user installed applications on an enterprise supported computer are a nightmare. This doesn’t have to be the case now and allowing user installed applications can give the user a much more powerful set of tools to do their job.

The job of IT in this case is to provide an environment where allowing user installed applications does not affect the integrity of enterprise data, or impact adversely the cost of support.

The tools to do this are just becoming available to us and our attitudes should be changing from ‘we can’t do it’ to ‘how do we achieve it’.

Reply
Guest on June 30, 2010 at 12:00 am

Dear all,

I work for RingCube (www.ringcube.com), a technology company based in silicon valley.

As part of our daily conversations with various IT admins in the US and Europe, we hear quite often that today’s VDI serves the task worker well, but has limitations with respect to full user personalization. As you guys are well aware, there are several approaches to address this limitation. User profiles solves a part of the problem, but doesn’t really address “full” user personalization. Application virtualization addresses the need to deliver pre-sequenced corporate provided apps well, but again, doesn’t fully and seamlessly address the user installed application aspect.

We build a product called ‘vDesk’ that relies on a workspace virtualization approach. We virtualize everything above the OS (apps, data and settings) and place them in one file, encoded in the VHD format. When the user logs in to a VDI pool, his/her vDesk VHD file is mounted and auto-launched. For the user, the environment looks and feels like standard windows. Everything the user does, namely changing settings, installing applications, even installing applications that install software printers or creates users or loads some kernel mode drivers, works seamlessly. When the user logs off, the VHD is unmounted automatically and the pool VM is available for the next user. To summarize, you get the resiliency and cost effectiveness of the pool model, with the full personalization that an assigned desktop model can provide.

Our large enterprise customers have been extremely pleased with their selection of RingCube.

In their own words…

“Our users want everything. We want VDI. We have the best of both with vDesk”.

Reply

Leave a comment

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>