Altiris shakes up Windows configuration management

Every once in a while a product comes along that fundamentally alters your perception of what is possible with IT. For me, it was the first time I saw Microsoft’s IntelliMirror technology. The combination of Group Policies and client-side persistent caching of applications and data represented a huge leap forward in traditional “fat” client desktop manageability.

However, while I sat basking in the glow of management Nirvana, people far smarter than I were already hard at work on the next big evolutionary leap. The folks at Altiris weren’t satisfied with self-healing install programs or policy-based feature control (both cornerstones of the Microsoft IntelliMirror model). They envisioned a software deployment model that worked much like a light switch: Turn it on and the application is there; turn it off and it disappears without a trace.

The advantages of such an approach over IntelliMirror are clear: No messy installation scripts that break under tightened security; no troublesome “artifacts” in the Windows Registry; no leftover files lurking in obscure folders on the local hard disk, waiting to trip up the next deployment. In the software deployment world according to Altiris, applications would materialize and/or dematerialize with the flick of a switch.

Impossible, you say? I certainly thought so. But then I installed the company’s SVS (Software Virtualization Solution) on a few PCs, and found that I was wrong -- virtual configuration management was possible, and Altiris does a bang-up job of streamlining the process.

Peeking Behind the Virtual Curtain

As I dug into the underpinnings of the SVS magic, I found a clever combination of file system filtering and multi-layered, local caching of code and data. Working together, they allow SVS to intercept application calls made to the Windows file system (including those calls to the Registry hive files) and redirect them to a private, hidden cache file.

This redirection allows you to install an application without modifying the PC’s configuration, and it's the key to the SVS system's power. You're now effectively capturing all changes that the installation program would normally make (new files copied to the hard disk, Registry keys added/updated), while isolating them from the actual runtime environment.

The act of “turning on” the application then becomes a simple matter of layering these changes over the existing Windows runtime, using the filter driver to redirect file system calls as necessary to the cached code and configuration data. Turning off an application with SVS is equally simple -- disable its profile with the filter driver and the application “disappears” from the PC.

It’s a potent formula: Filter driver plus Profiles (Altiris calls them “layers”) equals seamless application virtualization. Throw in an easy-to-use recording tool to document changes made by each application installer and a flexible, policy-based management component to isolate and organize the various layers within the cache, and suddenly the SVS “magic” looks a lot more like an innovative way to overcome some of the nasty limitations in the current Windows Installer model.

Harnessing the Magic

I began my Altiris SVS test drive by installing the company’s Notification Server software, which is a core component of its larger Client Management Suite framework. After “pushing” the basic Altiris client agent out to several systems using the Notification Server’s Console and its auto-discovery capabilities, I was able to schedule deployment of the SVS client.