Desktop Profile Management

Most IT teams work hard to make sure that client disk images include user profile settings (e.g., default screen resolution, desktop shortcuts, drive and printer mappings) appropriate to each group of employees. But deploying disk images with the appropriate user profiles isn't the end of the job. You might need to change these profiles later because of employee turnover or simply to satisfy evolving management preferences. For example, if management wants users to save documents by default to network home directories rather than to local hard disks, you must modify the registry on each user's desktop. And you can't define Microsoft Outlook messaging profile settings in disk images because you need to populate those profiles individually. Managing desktop settings can be tedious and time-consuming.

If you've migrated to Windows 2000 and Active Directory (AD), you can use Group Policy Objects (GPOs) to manage some desktop settings. But administrators in Windows NT shops or mixed environments typically manage desktop settings through batch files and logon scripts written in VBScript, Perl, or KiXtart. To manage users' Outlook messaging profiles, some IT departments use the Automatic Profile Generator (i.e., newprof.exe). This tool uses the Messaging API (MAPI) to populate the messaging profile. But the Automatic Profile Generator supports only the most basic configuration settings, and using one tool to manage messaging profiles and another for user profile settings can be a hassle.

If you use scripts and batch files to manage desktop settings, changing settings requires modifying the script, which can take quite a bit of time if you don't do much scripting. And because end users lack administrative privileges, you can't use scripts to perform tasks that require administrative permissions, such as setting the system clock. To manage user profiles efficiently, administrators need other alternatives. I look at three products that can help you manage desktop settings. Two of these products also manage Outlook messaging profiles.

Visual KIX 2.0
Simplified Networking's Visual KIX 2.0 makes scripting easy. This graphical KiXtart scripting tool lets you create scripts in a fraction of the time that you'd need to create them manually. Visual KIX also lets you quickly and easily modify a script's application rules, as Figure 1, page 44, shows. However, Visual KIX doesn't help you manage messaging profiles and supports only a limited set of desktop profile changes, such as changing icon sizes and wallpaper, bringing up a licensing screen, and mapping drives and printers.

You use Win2K Server Terminal Services to access the product, which runs on a domain controller (DC). At $495 for companies with as many as 450 clients per domain and $995 for companies with more than 450 clients per domain, Visual KIX is inexpensive and might be a good value for organizations that use many logon scripts for basic tasks. You'll need a separate product to manage messaging profiles, however, and Visual KIX can't perform tasks that require administrative privileges.

Full-Featured Offerings
AutoProf and ScriptLogic offer full-featured products that help you efficiently manage user profiles and messaging profiles. AutoProf initially designed Profile Maker as a messaging profile management tool; in Profile Maker 7.0, AutoProf has enhanced those capabilities and added desktop management features. In contrast, ScriptLogic Enterprise Edition 4.12 is based on KiXtart scripting technology, so this product's strength is in managing desktop settings. But ScriptLogic also includes messaging profile management capabilities that should satisfy most users. Although both products provide a GUI, Profile Maker uses a Microsoft Management Console (MMC) snap-in whereas ScriptLogic uses a proprietary management interface. Both products are priced per user, depending on the number of users. Profile Maker ranges from $5.85 (for 2500 or more users) to $7.90 (for fewer than 1000 users); ScriptLogic costs from $5 (for 10,000 or more users) to $9 (for as many as 500 users).

Profile Maker 7.0
Although Profile Maker's strength is in messaging profile management, it also provides a full-featured desktop-settings management capability. Profile Maker 7.0 uses MAPI and, according to the vendor, provides a broader range of functionality than Automatic Profile Generator. For example, AutoProf says that Profile Maker can add new mailboxes to the Microsoft Exchange service and can set the addressing search order. By running the client as a local system process, Profile Maker can even make user profile changes that typically require Administrator privileges.

You use Profile Maker's MMC snap-in, which Figure 2 shows, to define the settings, rules, and users that a user profile change affects. Profile Maker adds those settings to an .xml file that contains similar settings for other user groups. When users log on each day, the logon script launches a client that resides in the DC's Netlogon share. The client makes a remote procedure call (RPC) to the .xml file from the Profile Maker Master Control Service Console and executes the relevant profile changes in the file. Very large organizations can deploy Profile Maker Secondary Service Servers to distribute the .xml files to large numbers of users and to collect licensing and logging information from users' desktops. Profile Maker centralizes all this information in its Master Control Service Console.

ScriptLogic Enterprise Edition 4.12
ScriptLogic's flagship product began life as a graphical KiXtart scripting tool, and the company has added features with each new version. Like Visual KIX, ScriptLogic can dramatically shorten the time necessary to create a script. In addition to using the product to develop custom scripts, you can download canned scripts from ScriptLogic's Web site and import existing KiXtart scripts, then easily modify them.

ScriptLogic says that its product uses the Automatic Profile Generator to manage mail profiles, but ScriptLogic's strength is in its ability to manage a user's desktop settings. One interesting ScriptLogic feature is the Logoff and Shutdown agent, which lets you install drivers or service packs at logoff rather than at logon. Notebook users who need to turn off a proxy server when they shut down their systems before leaving the office might find this feature useful. You can also use this feature for application deployment, a task that you would probably want to perform as employees are logging off for the day rather than when they're trying to start the workday.

After installing ScriptLogic on your DC, you use its GUI to configure the logon script for each group of users, as Figure 3 shows. The logon script downloads the ScriptLogic client to each user's computer the first time the user logs on. At subsequent logons, the client polls the manager component for user configuration scripts that might be destined for that user, then interprets and implements the configuration script. Unlike Profile Maker, which packages changes for all user groups in one file, ScriptLogic uses a separate file, which typically ranges from 20KB to 100KB, for each user.

As I've said, some registry modifications require administrative privileges. Because end users typically don't have these privileges, organizations that rely on scripts to manage user profiles are often limited in what they can do. But when ScriptLogic's client executes a script that requires administrative privileges to perform a task, the client passes that task request to another ScriptLogic service that runs on the DC. That service remotely logs on to the workstation with administrative privileges, performs the requested task, then returns control to the script that's running on the user's computer.

Making Your Choice
Organizations that have migrated their entire network to Win2K and AD will probably want to use ScriptLogic or Profile Maker in conjunction with Group Policy. These products provide more granularity in settings management than Group Policy does, and Group Policy can't manage Outlook messaging profiles. However, Group Policy can do some things, such as manage security settings, that the third-party products can't. Because ScriptLogic and Profile Maker support all versions of Windows, they're well suited to companies that have mixed environments.

The decision you make between these three products will likely depend on what you're trying to accomplish. Visual KIX is an inexpensive logon-script management solution that can also handle some user profile management tasks. Profile Maker and ScriptLogic both seem to have full feature sets, so choosing between them will depend on your priorities. If efficiently managing Outlook mail profiles is your top priority, Profile Maker might be the better choice. If managing desktop settings is more important, ScriptLogic might be the best tool for you.

To determine which tool best meets your needs, test the leading candidates in your environment—you can download a time-limited trial version of each product from its vendor's Web site. Only you can determine which features and capabilities matter most in your situation. You might also discover performance or ease-of-use concerns that will be important considerations in making a selection.