Continuing from part one, Jerry Honeycutt offers more advice on deploying user and computer settings.
Logon scripts
Logon scripts are a longtime method for configuring settings, such as mapping network drives and connecting to network printers. The method is effective for user settings, particularly if you're handy with batch scripts or Windows Script Host. For example, you can configure registry settings by importing .reg files or running Reg.exe from a batch script.
Logon scripts fail my top criteria, though. They're not so effective for deploying computer settings in locked-down environments, since logon scripts run in the user's security context. They do well in the remaining criteria, however. They're automated by their very nature. And you can easily use them to update settings post deployment. And since you're deploying individual registry settings, they're also very precise. They are scripts, after all.
Logon scripts suffer from complexity, though. It's not uncommon for a logon script to be a few hundred lines to a few thousand lines in length. Over time, maintaining what turns into batch spaghetti becomes tiresome.
Disk imaging
Disk images are a natural place to customize computer settings. The process typically goes something like this: install Windows XP on a computer; log on to the computer as Administrator; configure computer settings; and then run Sysprep to prepare the computer for cloning. This is a manual process that's error prone, however. If during testing you find a problem and have to recreate the disk image, you can't be sure that you're not creating new problems when you rebuild it.
The better solution is to create a script that configures the settings and then call that script from the unattended-setup answer file. The only catch is that it requires you to know where each setting is in the registry. Of course, the very last thing the script does after configuring the computer is run Sysprep. The benefit is that you can rebuild the disk image time and time again and get the same result.
At first glance, deploying settings in disk images looks like a good deal. Locked-down environments aren't even an issue, since you configure settings after logging on to the computer as Administrator, and then you deploy the disk image. You can automate the configuration, too. Where this technique falls apart is management. After you deploy a disk image, you must use a different technique to update settings. And you must still use a separate technique in order to configure user settings.
This technique also aggravates image count. It's common for department requirements to vary only by the settings they require. By including settings in your disk images, you could find yourself in a scenario where you increase your image count for something as silly as a few settings. If you need to change a setting, you have to rebuild the disk image.
Third-party tools
The techniques for deploying settings that I've described so far don't require third-party tools, with the exception of the product you use to clone disk images. There are third-party tools available that meet all of my requirements, though. For example, Microsoft Systems Management Server fills the bill. But that's out of reach of most small to medium sized businesses, and even many enterprises skip SMS because it requires a rather big commitment.
A tool that I've used with great success and have touted here at SearchWin2000.com is AutoProf ProfileMaker. This tool is designed to deploy user settings, and you can deploy computer settings with elevated privileges. It's completely automated and you can even extend it with your own scripts. (It supports batch scripts, Windows Script Host and so on.) It also provides a central, graphical user interface, which is based on Microsoft Management Console, for managing settings. It also allows you to configure settings with a high degree of precision, which keeps my OCD under control. One thing that ProfileMaker has over many other techniques for deploying settings is that it provides a user interface for configuring a variety of applications.
Comparison
The following table compares the settings deployment methods I've described in this article, and notes whether they fully or partially meet the criteria. By no means have I covered all of the methods available, and there are some pretty clever and inventive ones out there. In the long run, though, you're better off with some sort of centralized settings management tool.
| |
Default User
|
Logon Scripts
|
Disk Imaging
|
Third Party
|
| Elevated privileges |
|
|
Partial
|
Full
|
| Automation |
|
Full
|
Full
|
Full
|
| Settings management |
|
Full
|
|
Full
|
| Centralized management |
|
Partial
|
|
Full
|
| Precise configuration |
|
Full
|
Full
|
Full
|
About the author: Jerry Honeycutt is a well-known author, speaker and columnist who specializes in desktop deployment and management. He has toured cities throughout the world teaching IT professionals how to deploy the business desktop and is the author of "Microsoft Windows Desktop Deployment Resource Kit" to be published by Microsoft Press in 2003. He is also SearchWin2000.com's resident expert for its Desktop Administration Ask the Experts category.
