eWEEK - April 18 2011

In Tune subscription price.

Windows InTune manages Microsoft Update requests and endpoint protection from malware, and reports on the software that is installed on managed systems. It is hosted by Microsoft and accessed via the Internet as a cloud service.

The product depends on a client agent that must be installed on each user system. InTune can be used on Windows XP with Service Pack 2 and newer Windows PC systems.

In addition to providing Microsoft Updates and malware protection, Windows In Tune gathers information to provide software-license usage, along with the software installed on managed systems. All this information is sent with alerts and reports that are available to desktop administrators via a Web logon to the service.

How Windows In Tune
works

When I tested Windows In Tune, I started with a late beta version and converted to the shipping version. I used a variety of desktop, laptop and virtual systems running in eWEEK Labs' VMware vSphere test environment. ( Windows In Tune does not support Mac or Linux systems or mobile devices.)

PC management platforms usually start with mapping out where the supporting server infrastructure will be installed. Traditional PC management tools are generally built with a central command center that is connected to remote office depot and distribution points to keep repetitive traffic off the WAN. All of that is gone with Windows In Tune.

Although the traditional hassle
of setting up the supporting server
infrastructure is thankfully missing
from this product, there is the matter
of installing the client and enroll-
ing the managed PCs. Because the
Windows In Tune client depends on
an account-specific certificate file,
care must be taken that the two files
are deployed together and present
when installed on the user system.

During my tests, I installed the Windows In Tune client on systems that already had an endpoint protection system in place. As would be standard practice when replacing existing antivirus systems, I followed the installation directions and removed the other antivirus system before

installing this product. This is no small task, and IT managers should factor the time and trouble involved into the overall cost of deploying the service into an existing fleet.

The Windows In Tune agents are downloaded from the subscription Web page. Once installed, the service worked well on my systems. My physical and virtual client systems reported in to the Windows In Tune service without a hitch.

Because the Windows InTune client comes with the account information, there is no user configuration required as there usually is with traditional management systems. The client comes with a certificate file that ensures that the PC agent can connect and report only to the authorized Windows In Tune account.

There are two types of administrators that can be associated with a Windows In Tune account: tenant and service. The tenant is the overall manager, and the service account is used for day-to-day operations. This is the area where I would like to see Microsoft make significant enhancements in future versions.

As it stood, I was able to create ser-
vice accounts, but I was unable to limit
those accounts to groups of users or to
specific actions. Thus, administrators
in this first version of Windows In Tune
have too-broad powers.
On the upside, the sys-
tem has rudimentary noti-
fication rules that can send
service alerts to the right
person. Windows In Tune
comes with 380 preconfig-
ured alert types that cover a
broad range of malware and
endpoint system problems.
I associated alerts with
various system administra-
tors so that security admins
were alerted when security
problems were reported by the man-
aged system. Likewise, I configured
system alerts about failed software
installations or high disk utilization
to be routed to the help desk.
A number of basic reports are also
provided with the Windows In Tune ser-
vice. Updates, software and licensing
data can be used to show basic system
configuration on managed systems.

I expect that as the service matures, more reports and more control over custom reporting will become available so that system managers can get detailed information on their fleets. «