Here's how three IT organizations are locking down desktops while providing some flexibility for employees.
St. Luke's Health System: Standards Plus Flexibility
Consistency across a large organization can be difficult. With 10 locations throughout Idaho, St. Luke's Health System has been extremely careful about its standard desktop. For infrastructure manager Eric Johnson, one important goal was to give doctors and other staffers flexibility around which hardware they can use -- allowing them to choose from a list of approved devices -- and where they may work within the hospital.
"In moving from Novell to Microsoft for our back end, we had a blank slate," says Johnson. The organization decided to move from systems-based downloads for applications to user-based downloads. In other words, end users can choose from a library of pre-approved software that they download themselves.
This has led to significant time savings, he says, because IT staffers have been freed up to focus on managing the library rather than about doing "one-off" application installs. He says the most significant challenge has to do with apps that are not yet in the repository, but that a department might need; the IT staff has to deal with this challenge on a case-by-case basis.
St. Luke's uses application virtualization software from Beyond Trust called PowerBroker Desktops . The rules-based engine can remove administrative rights from the user's desktop so that the person cannot install applications, and it watches for errant installs that did not complete correctly. A dashboard matches the look and feel of other Microsoft data center tools.
Johnson says his team uses PowerBroker to manage about 8,000 desktops in 90 buildings. He says St. Luke's has settled on Windows XP SP3, Office 2007, Adobe Flash, Microsoft Silverlight, the Citrix client and Microsoft Live Meeting as the core of its standard desktop.
A new employee is added to multiple groups as appropriate -- say, advertising, marketing and general business. For each group, the employee can then download multiple applications from the approved list, obtain file permissions to gain access to network servers for those applications and configure some options locally, such as IE toolbars and Outlook menus.
One other challenge at St. Luke's, and for most companies dealing with a standard desktop, has to do with versioning. The facilities use a core image for their base OS and apps, and tend to stick with one version for long periods of time. Yet, Johnson says the organization manages about 22 different versions of Java through application virtualization -- and this argues against including Java in a standard desktop.
By virtualizing, St. Luke's IT staffers can root out incompatibilities between applications that use Java. For example, they can determine that the standard desktop for accounting always needs a specific Java plug-in. Yet, they keep the core the same and deliver Java versions as needed, outside of the standard desktop.
Sign up for Computerworld eNewsletters.