Other security features, such as the updated firewall and more esoteric, internal fixes like Address Space Layout Randomization, are interesting but by no means compelling. Most IT shops have implemented a proper hardware firewall solution or third-party software for mobile/remote users, and address-based code exploits usually require some degree of social engineering to get them to work – a phenomenon even Vista can't thwart.
Decision: From a security standpoint, there's just not a lot to compel XP shops to upgrade. Many of the issues addressed by Vista have already been resolved under Windows XP using in-house applications or third-party tools.
Round 2: Manageability
One of the key drivers for Windows 2000 adoption, and later Windows XP adoption, was the debut of Active Directory and its Group Policy framework. For the first time, IT shops could address the myriad configuration management issues that plagued traditional, fat client installations, using a standardized, centralized repository of rules and restrictions. Vista adds a few extensions to this mechanism. However, as with the aforementioned security improvements, many of these issues have already been resolved.
For example, Vista adds support for locking down block devices at the client level. This is a useful feature – you can restrict users from accessing certain external media devices, such as CD driver or USB keys – but it's another XP loophole that was closed long ago by third-party management agents. Likewise, the inability to install printer drivers using a non-administrator account – something Vista now allows via a Group Policy extension – was resolved directly by many large IT shops, in some cases through the creation of their own elevation utilities.
On the management tools front, there is a dearth of new Vista-specific features, either from Microsoft or from major third-party framework vendors. In fact, outside of support for Vista's new image-based installation and deployment mechanism, which is one of the product's few noteworthy manageability improvements, there's little incentive to move to Vista from a purely systems management perspective. The image-based installation model makes it easier for IT to capture a “golden” working image of their runtime configuration, and then spin this out to multiple systems regardless of the underlying hardware. This was a real challenge under XP, so definitely a point to Vista, but given the myriad third party installation and provisioning tools (one or more of which are probably in use at any given IT shop) it’s no TKO.
Decision: Moving to Vista provides little or no ROI from a systems management perspective. Yes, the new image-based installation model is a welcome addition. However, the lack of significant innovation in other areas makes Vista's management story less than compelling.
Round 3: Reliability
With so much attention being paid to the more visible changes in Vista – UAC, Aero, the revised Explorer GUI – the tweaks Microsoft made under the hood have gotten little press. To be sure, Microsoft did some retrofitting with Vista. Heap management has improved. The power management subsystems have been completely rewritten. I/O tasks can be configured to run at a low priority, and they can even be canceled in certain situations, improving the user experience during background service processing, network timeouts, and so on.
There's no question this is all good stuff. However, from a practical standpoint, the changes are far from earthshaking. In fact, you'd be hard-pressed to point out examples of their impact during day-to-day operation. The lone exception: low-priority I/O, which is helpful during initial OS startup because Vista loads so many more background services than Windows XP. In other words, Microsoft needed something to offset all of that additional startup processing. If Vista boots before you return with your cup of coffee, you have I/O prioritization to thank.