Windows Vista – (Too) Great Expectations?

Microsoft has done a good job promoting the consumer Vista launch. From a big launch event to promotions at retailers to guest appearances on TV by Bill Gates, the company has spared no expense. But, in some ways, is it may have done too well. By claiming that Vista is the biggest release since Windows 95, the company is inviting comparisons of the two launches. Few events have or could hope to match the excitement of Windows 95. And Vista (unlike XP and 95) is trying to replace a system that users are mostly happy with. This should not be underestimated. As much as there have been issues with XP, the installed base is generally happy.Also, by highlighting that Office 2007 and Vista are shipping at the same time, the company risks the perception that both need to be installed at the same time, and, although reviews of Office 2007 are overall positive, there is still apprehension, largely as a result of the new ribbon UI.One of the biggest areas that could be an issue is the crowds (or lack thereof) at the special retail events at 10 p.m. or midnight. Although retailers are leading this effort, the combination of the mostly happy XP users and the fact that this is the middle of winter, not the summertime launch of Win95, means we didn't see anywhere near the crowds that the introduction of Win95 brought. So, even if Vista ultimately is successful, which it eventually will be, it will have to overcome some expectations this week.

Why Isn't BitLocker Available to Everyone?
At the Vista kickoff, Steve Ballmer was asked, "How important is BitLocker?" In his typical booming response, Ballmer said, "hugely important." For those of you that don't know, BitLocker is Vista's tool for whole disk encryption. It was created as a direct response to the plethora of lost data resulting from lost or stolen laptops. BitLocker provides protection against data loss by encrypting the entire disk, thus protecting data from prying eyes.This is a particularly interesting response in light of the fact that BitLocker is only available via Microsoft's Software Assurance (SA) program aimed at large enterprises and the Ultimate version. Ultimate carries a pricing premium of 66% over the Home Premium version, includes every option of both home and business versions and is not targeted at typical home or SMB users. This means that small businesses and home users of Vista won't get the benefit of BitLocker's protection. If Steve Ballmer says it is hugely important, then why is Microsoft excluding so many of its clients from one of the major security functions on Vista?Are there pieces missing which would be required for the tool to work with home or small and midsize business users (such as Web-based key recovery), or is it part of Microsoft's attempt to sell up to SA across the board, locking more users in for the long term?

Stay on Top of Vista Updates
If you've been running Windows Vista before launch, you've no doubt struggled with the sometimes patchy quality of early device drivers. During the past few weeks, I've found myself frequently checking key vendors' Web sites looking for new updated drivers...but few have been coming. The vendors say that final, certified public drivers will be up on their Web sites on 30 January. This begs the question of what drivers are on all those brand-new Vista PCs that are on store shelves. After all, those machines were likely assembled and loaded up several weeks ago. Will a buyer of a new machine be forced to immediately connect to Windows Update or scour all the component suppliers' Web sites to download the "real" drivers for their brand-new system?Although this is standard practice for many enthusiasts, most consumers would find this unacceptable. The good news is that it shouldn't be necessary. In most cases, PC manufacturers get drivers that are different from the public ones posted online at a component supplier's site. Typically, these drivers are jointly developed and are pared down for specific requirements. They also don't need as much regression testing, because they are going into a well-known, tightly controlled package. The PC on the shelf should be a fully certified and functioning Vista machine out of the box. However, there are a couple of caveats.Once you get a new machine, you should connect to Windows Update to get security updates, even if no driver updates are required. You should also familiarize yourself with whatever facility the PC manufacturer provides for driver updates and see if they have any updates.At least initially, using drivers directly from a component supplier's Web site might actually downgrade capabilities from the pre-installed drivers. You should stick to the PC manufacturer's Web site for the first few months for any driver updates.The bottom line is that, with Vista, as with any new platform, early buyers of new Vista machines should expect that there will be a few rough spots to be worked through during the next few weeks, and they will need to stay connected to both Microsoft and their PC maker.

Will Vista Be Done by 30 January 2007?

I know. Vista was released to manufacturing on 8 November 2006. It was officially launched to businesses on 30 November. Why am I asking if it will be done? Isn’t it already done?Well, in a word, no. In past postings, we talked about the importance of Microsoft Update (MU) to Vista’s launch. The reality is that Microsoft could not have shipped Vista in November if real people were going to be using it en masse for real things right away. With consumers not getting Windows Vista until 30 January 2007, and most businesses just "kicking its tires' (if that) over the holidays, Microsoft and the Windows ecosystem have an 11-week extension between RTM and actual use. That Microsoft and the ecosystem are ready for the 30 January consumer availability is much more important than that they made their 2006 RTM goal.What kinds of things aren't ready? Mostly drivers. Microsoft is including more than 19,000 "in the box", but expects to have another 12,000 available via Microsoft Update. Some of the drivers available so far are still considered beta, are somewhat unstable or do not support the full feature set of the devices. And Microsoft's own Application Compatibility Toolkit (unimportant for consumers, but very important for enterprises) and Windows Mobile Device Center (important for enterprises and consumers) are also still in beta.Microsoft and the ecosystem need to be ready for the 30 January consumer launch. People want a stable system with devices they can use. Coupled with the security issues that have already surfaced, Microsoft and the ecosystem need to provide complete and stable driver support by launch, or Windows Vista will have a difficult time overcoming some troublesome first impressions.

Vista Looks Different, but Is It a Better View?

With Vista, Microsoft is boldly changing how users interface with their PCs. The new user interface (previously known as Aero Glass) is a combination of changes in style, color, windowing, interfaces and workflow. For the most part, the UI changes are cosmetic, and will have only minimal impact on user productivity - positive or negative. The biggest impact will be in user perceptions. The new look and feel is an improvement that freshens the Windows XP interface, which, after more than five years is showing its age.Although the look and feel will get a lot of attention, it is really the changes "under the covers" that are probably more important. The new UI is built on top of a completely new graphics engine that improves reliability and provides a more consistent level of performance than the older graphics subsystem. It also leverages newer graphics hardware to provide a more flashy look and feel, including brighter and better scaling, new animations and translucency on windows (the new UI elements). However, long term, it is the solid feel of the new user environment that most users will probably appreciate more than the flashy effects.Where the biggest impact of the new environment will be felt though are the changes that Microsoft has made to many of the workflow processes (such as how to navigate through network settings and some changes in control panel), dialog boxes, and applications as part of some of the underlying changes in how users interface with their PCs. Some of these changes are minor (Start menu changes), some are significant (new Network and Sharing Center). Many of the changes will have little effect on users, while others are dramatic ... and not always for the best.The bottom line is the UI in Vista is certainly different, but not necessarily better or worse than the Windows XP UI. The look and feel are a refreshing update, and will help more novice users navigate their digital world. Experienced users will find the UI equally interesting, but will grumble about having to re-learn some features and adjust how they work with their PCs today.

Windows Vista and MUI

With the launch of Windows Vista, there has been some confusion regarding license entitlements and the use of multilingual interfaces (MUIs). With Windows Vista, MUI, which is the ability to build and deploy an image that includes multiple languages that users can switch between, will be available exclusively by purchasing Software Assurance (SA) on the Windows client. Specifically, clients have been asking how their ability to use MUI would be affected if they decided to discontinue their Enterprise Agreement (EA) or not cover future desktop purchases with SA.For example, suppose that you have an EA for 1,000 desktops that expires in December 2006. Once it expires, you would get the rights to deploy Vista at a later date, which would allow you to use the MUI on those desktops. However, once an EA or SA expires, the Vista license (which includes rights to MUI) gets tied to the PCs that was covered at the time the EA or SA expired. So, as those original 1000 PCs are retired or removed from service, your rights to MUI will not extend to new purchases unless you buy SA.

Vista Benefits Technology Vendors. Or Does It?
With each iteration of an operating system from Microsoft there are great expectations from the supply chain to upsell technologies. By the end of an operating system cycle, prices have plummeted and margins have subsided to the point where vendors are pinched to support the next semiconductor-fueled technology round. As we look at the key components of PCs, the question is where Vista will drive benefits to the supply chain.The most obvious areas of benefit will be in RAM, video processors/cards and in flat-panel screens. Vista is expected to demand twice the RAM usually purchased for Windows XP machines. With today's RAM glut there is not expected to be a shortage. But price points could be maintained. The improved video capabilities of Vista will demand higher-end capabilities. While the native graphics of Intel platform offerings will suffice for Vista Aero, higher-end graphics will especially appeal to consumers, who are expected to precede the business market hardware purchases and deployment. The improved graphics capability of Vista will also demand widescreen high-resolution screens. On notebooks, a greater focus on networking will bring forth increased demand for wide-area wireless, despite Gartner's cautions against integrating such technologies on mainstream machines due to the expected rapid change of the technologies during the next several years (see Gartner Doc G00127982). Security processors could see an impact with an emphasis on the Trusted Computing Platform, but this may not be realized until business begins buying with Vista deployment in mind.Interestingly, we do not believe that processor requirements will be raised over the choices made today within today's generation. There is no question that next year's processors will support improved performance, but we believe that most users will buy at the same price points today. Vista does not seem to push buyers to higher limits. This will most certainly be a disappointment for Intel and AMD, especially when combined with the expected delay of mainstream enterprise migration to Vista until 2010. Consumers will drive the early Vista market through new PC purchases, and they will follow the component profile we have outlined here.On the software side, we must point out that Vista's Gadgets will likely drive a strong market for active controls on the desktop. We believe there will be many ideas driven by this concept. Vista attempts to simplify networking, but many of its components are spread out in multiple areas in a difficult-to-understand usage model. Microsoft could have done much better, although networking is improved to some degree. Third-party communications that overlay Vista's capability, combined with service offerings, could also be an active area especially as notebook sales continue to increase as a percentage of all personal computers sold. Tablet PC hardware and software manufacturers could see increases due to the inclusion of tablet capabilities as mainstream capabilities in Vista. Training could also be a ripe area, because Vista's user interface conventions are significantly different than XP's.Microsoft has not affected the supply chain with Vista as much as we would have expected. OEMs will hype Vista's demand for more capability, and such marketing efforts may still succeed in improving supply chain prospects. But as the technical evaluations come, inclusion of a stronger push toward video conferencing is one example of where Microsoft could have had more impact pushing bandwidth consumption and more endpoint technology. Had Vista been able to deliver a new file system, as originally promised, other supply chain benefits could have ensued. But as most know, Microsoft had to put the schedule before all other considerations.

Vista Enhances Mobile, but Not Enough to Rush Migration

Windows Vista promises a host of enhancements that will not only improve the computing experience, but also advance mobile communication. Indeed, such features as a mobility center that combines common notebook-focused features, a suite of enhanced security tools, and a Network and Sharing Center that brings together network-related information all promise to work together to bring about a polished, reliable and secure computing experience. Although these mobility features might tempt organizations to expedite the migration of their notebook computers ahead of their desktop PCs, this would be an ill-advised move. First, migration to Vista or any new platform promises to be a complex process. Planning and validation for a migration of this complexity should be done as a "top down" initiative across the whole enterprise, with a roll-out schedule based on business requirements, as opposed to individual ad hoc implementations. Second, even the best-planned Vista migration is likely to encounter unforeseen problems that are best worked out from a fixed location, that is, from the desktop. Third, Vista's security features, while attractive, offer nothing specific to notebooks and are nearly all available from third parties on XP. Organizations requiring near-term mobile security would be better advised to use the third-party tools than to rush, and possibly compromise, their Vista migrations. Microsoft promotes Vista as a remedy to a myriad of mobility challenges - power management, network awareness, offline access to important data, multiple displays, grab-and-go docking and readability - and the new features do make headway in these areas. Although Vista's mobility features are useful, they are not essential. None of them, nor the sum, constitute an immediate "must have" for any organization. As a result, organizations should resist the idea of early migration ahead of desktop computers, unless specific business issues are being addressed.

Here's Vista, So What's Next?
Talking with clients in recent months, it's clear that most understand the need to migrate to Vista - not immediately, but as soon as they're ready (most expect to start doing this in 2008). However, the motivation is invariably not to obtain the new features or capabilities offered by Vista, it's to ensure they keep their PC installed base within Microsoft's 10-year support cycle. Most regard their existing Windows operating system (OS) as "good enough" and will migrate because the old system is "wearing out," not because the new one is better.Although this may disappoint the technology enthusiasts, it is also refreshing: It demonstrates that most organizations understand the business value of ensuring that all their PCs run a supported OS and, therefore, get security patches. It shows that organizations recognize that the key question regarding Vista migration is "when," not "if." However, it also raises new questions for most users: Having pragmatically accepted that they must plan their PC deployments around Microsoft's OS road maps, they now want to know what comes next. What will the OS look like after Vista and when will it come? We, at Gartner, have ideas on this (see "Vista Will Be the Last Major Windows Release as We Know It"), but Microsoft is not yet disclosing any information. We hope that during the next few weeks and months, Microsoft will be able to address this lack of communication with its customers. Although Microsoft will be necessarily distracted by promoting and marketing Vista, it needs to start being more open with its future plans. This may be a challenge for its current way of working, but it would provide a better reflection of what Windows really represents to most organizations: a key building block of their IT plans. Most organizations have a long-term, evolutionary relationship with the Windows OS, and by sharing more of its long-term plans for Windows, Microsoft could better position Windows and itself for the future.

Put It on My Tab
I've been using Windows Vista as my production OS for a few weeks now. There are lots of things I like about it and a few things I don't. I'm still not sure that the benefits will make the migration costs worthwhile for the typical organization, but that's a factor of the high cost of migrating for most organizations and needs more room for discussion than a simple blog post. Look for some complete research on that in the near future.In this piece, I want to talk about tabs - a couple of types of tabs.First, ones I like - the tabs that are part of IE7. On Windows XP, I used both IE6 and Firefox. One of the main reasons I used Firefox was because it had tabs (the other reason was its lower susceptibility to malware, something we can't comment on for IE7 yet, though on paper IE7 looks good). IE7 has tabs, which helps me reduce my desktop clutter. Where I used to have 10-20 IE windows open at once, now I can have many fewer by using tabs. One thing I notice about the way the tabs work is that IE7 is relatively intelligent about how it uses them. I generally get two browser windows running pretty quickly - IE7 puts intranet sites in one IE7 window and other sites in another to maintain security. It's after that that I really notice the intelligence. Clicking on a link in an e-mail or document automatically opens a new tab in the appropriate browser window and opens the link I clicked in the tab. That's a lot better than before, where clicking on a link either opened a new browser window or used the last browser window I used, navigating me away from that site without asking me.Now the tabs I don't like. I keep a lot of windows open at once. Start with 20 or so Outlook windows, 5-10 IM windows, 2-4 IE sessions (reduced due to intelligent tabs), a few Excel, and PPT files and Lotus Notes and I get up to 30-50 windows pretty easily. I use the ALT-TAB key sequence to move between windows. I've been using it since Windows 95, so it's really deeply ingrained habit by now. In every previous version of Windows, pressing ALT-TAB rotated from the most recently used window to the least recently used window (or minimized windows). The order, starting with most recent and moving to less recently used windows is really important to me. Now the order seems to be the most recent few first, then windows seem to "age out" and be put in some odd order grouped by application.I sort of know how recently I used a pane and when I have to press TAB say, 15 times instead of four because the windows are no longer in the order of how recently I used them in Windows Vista, it's really annoying. Other people I've spoken with have not noticed this. Usually it's because they use the mouse to move between icons on the start bar or they've started using the Flip-3D feature of Vista (Windows-TAB), which seems to keep the panes in the correct order of recent use. I'm not used to Flip-3D yet because there was a performance hesitation under the betas before it presented the first one (that seems to be better on the RTM code - but Flip3D won't work with less-capable graphics adapters). Even Microsoft can't explain why the ALT-TAB order changed and what order it's in.To me, this is a real pain, very noticeable, and it reduces my productivity. What are your favorite and least favorite features of Vista so far?

Microsoft: Consumers Can’t Run Windows Vista in a Virtual Machine (Unless They Pay Enough)

Among Microsoft's new restrictions in the Windows Vista End User License Agreement (EULA) is that neither Windows Vista Home Basic nor Windows Vista Home Premium may be run in a Virtual Machine. Like Windows Rootkits (see Combat the Threat of Rootkits and Secure Hypervisor Hype: Myths, Realities and Recommendations), there is a risk that a VM Rootkits gets installed unbeknownst to the consumer. Microsoft says that consumers don’t understand the risks of running virtual machines, and they only want enterprises that understand the risks running Vista on a VM. So Microsoft removes user choice in the name of security.But this is a license restriction, not a technical one. So a consumer that wants to run Windows Vista under Parallels or VMWare on his or her Mac can purchase a Home SKU and install it on a VM in violation of the EULA (not that most of them will know it; who really reads the EULA?). The other option is to pay Microsoft $300 for Windows Vista Business or $399 for Windows Ultimate, instead of $200 for Home Basic or $239 for Home Premium. Does paying $60 or $100 more mean they understand the risks? We suppose that to Microsoft it does. Or maybe for the extra money, Microsoft just doesn't care as much. Is Microsoft using a EULA no one reads to educate? Should they be? We don’t think so. What do you think?

Microsoft Sets 30 November for Business Launch of Vista, Office 2007

There's lots of confusion around the various dates of Windows Vista and Office 2007. There are many dates to keep track of and they all mean different things. Here are the ones we're following:Select and Open price lists: 1 November 2006 for both products. Anyone with SA on either product in effect on 1 Nov 2006 gets the rights to both products. Release to manufacturing (RTM): Not yet announced for either product. Availability to volume license customers: At least a week, but perhaps longer, after RTM.Broad availability: Said to be 30 January 2007 for Windows Vista, this is when the product can be purchased by consumers and shipped preloaded by OEMs. Office likely similar. Business Launch Event: 30 November 2006 for both products.Consumer Launch Event: Will be another joint event, in 2007, but not yet scheduled.What does all this mean? Although it's possible that RTM will be in December, after the business launch event, that's not likely because both are on price lists as of yesterday. It's more likely that RTM will be some time this month. Could it still slip? Sure. But at this point, that's certainly less likely.What about Gartner's prediction that Vista would be late? In April, we published research saying that Windows Vista would not be broadly available until nine to 12 months after the release of Beta 2. Beta 2 was released in late May, a little earlier than we expected at that point, which means we would have expected broad availability in late February – late April. For all the press on the topic, it appears that Microsoft will beat our prediction by a month (if they meet their 30 Jan. target). We will congratulate Microsoft as they hit their dates.Microsoft shipping Vista and Office 2007 is great for the company and an important milestone for its customers. We have to be a little cautious in warning people that Microsoft Update helped Microsoft get the products out, probably several months earlier than they would have been able to without it (see Steve Kleynhans's post below). So organizations should continue working with applications, including the forthcoming ACT for Windows and OMPM for Office, although they should expect a stream of fixes for the first few months after availability. Microsoft beat the expectations of many in the industry, so the rest of the ecosystem is still catching up. Make sure your critical vendors will support their products on Vista in the timeframe you need.We continue to say that waiting for SP1 is a bogus milestone at this point – for two reasons: 1) Most large companies will not be ready to deploy by the time SP1 is available anyway (there is still too much complexity in testing and preparing), and 2) Because of Microsoft Update, you’ll have the fixes to most critical issues well before SP1 ships.

The Windows Update Effect

As Microsoft approaches the finish line with both Windows Vista and Office 2007, most testers continue to note that there are minor holes in the products. With previous releases, Microsoft may have been forced to hold back a release for these types of problems. However, the world is somewhat different this time around. Microsoft has a huge safety net it can fall back on: Windows Update.Windows Update (and now Microsoft Update) has proven to be a boon to both consumers and Microsoft. After some rough spots in the early days, Windows Update has become a pretty solid and reliable vehicle. Although it can still be somewhat intrusive, it has greatly simplified the process of getting patches and other fixes. With Vista and Office 2007, Microsoft can release the product to manufacturing in a complete form, but continue to embellish it with new device drivers, minor enhancements and fixes right through the actual consumer release. The good news is that this ensures that the product will continue to get more polished. The downside is that organizations must factor these changes into their testing processes.Looking ahead, Windows Update may also have a significant impact on another well-established tradition - waiting for Service Pack 1. With the ability to slip fixes into the product, the need for large, cumbersome, fear-inducing service packs have somewhat diminished. There is a significant likelihood that the first service pack for Vista may, in fact, be quite a ways off in future. Take this into account when developing your implementation plans.

Office 2007 Hits November Price Lists
There was no formal announcement, but Microsoft has added Office 2007 to the November Select and Open price lists. Although the software has not been released to manufacturing (RTM) yet, adding the product to price lists has a couple of implications. 1) Organizations with Software Assurance on Office (including most Enterprise Agreements) will have rights to the product, as long as their contract is in effect in November. Organizations whose contracts expire at the end of November can now breathe a sigh of relief knowing that they will have rights to the software whether they renew their SA or not. 2) Anyone that buys Office after 1 November should be ordering 2007. There is a 5% price increase they’ll have to absorb, but most would rather have the new version than save the 5%.However, the software is not actually available yet. Microsoft has not announced the RTM date, but, realistically, most organizations won’t do more than kick its tires during the remainder of 2006 anyway. To many, the date it shows up on price lists is actually more important than having the actual code.

Vista in January: It's Looking More Likely, But Is It Responsible?
Following last Friday's announcement that Vista is on schedule, it appears that Microsoft has made much faster progress than many (including Gartner) had expected in getting its next Windows OS ready for release. Given the patchy nature of the Beta releases we saw earlier this year, this is a noteworthy achievement, and it says much about the company's determination to meet the deadline it set for itself in March.However, we still question the wisdom of a general (consumer) release in January. The impact of staging such a significant product launch immediately after the holiday period can only be detrimental for the PC industry as a whole. Some PC buyers will inevitably delay buying new PCs to make sure they get the new OS preloaded, resulting in demand shifting from the months of November and December (the months of highest demand in the PC market calendar, when prices are generally higher) to January and February (when buyers expect prices to be discounted). The net effect for PC OEMs is likely to be a shortfall in revenue for the fourth quarter of this year that will not be entirely made up for by "Vista demand" in the first quarter of 2007. Even if Microsoft supports a coupon upgrade for holiday season buyers in an attempt to alleviate this, OEMs will bear much of the cost of distributing the new OS to consumers and handling the support calls that follow when they install Vista.So, although we salute Microsoft’s dogged determination, we believe it is demonstrating scant regard for the PC ecosystem on which it depends. With OEM sales of Windows accounting for the majority of its $13 billion Client BU revenue and PC OEMs enduring tough market conditions, this is a decision that Microsoft may come to regret in the years ahead. The average operating margin for PC OEMs continues to be less than 2%, and any revenue shortfall risks triggering further market consolidation. These considerations may yet persuade Microsoft to push back the Vista launch.

Windows Vista Upgrade Coupons Are Unlikely to Boost Holiday PC Sales
According to Information Week, Microsoft will roll out, later in October, an Express Upgrade program for Windows Vista, which is expected to be launched in 1Q07. With the program (note that this is based on rumor and not an official Microsoft announcement), PC buyers who purchase their machines with Windows XP stock-keeping units (SKUs) between 26 October 2006 and 15 March 2007 will receive a coupon for a free or discounted upgrade to Windows Vista, but will be responsible for upgrade costs. For a free upgrade, customers need to buy a PC with Windows XP Professional, XP Professional x64 Edition and Tablet PC Edition. Most consumers are buying PCs with Windows XP Home Edition now, and they will have to pay a fee for their Vista upgrade: a $49 fee for upgrade to Vista Home Basic and a $79 fee for upgrade to Vista Home Premium. It is still unclear if there will be an upgrade fee for PCs bought with Windows Media Center Edition or if those machines will be entitled to a free upgrade coupon. Microsoft is launching this coupon upgrade program to help boost PC sales to consumers and small businesses this Christmas holiday season. PC industry players are worried about a decline in consumer PC sales in the holiday period, as consumers might delay their PC purchases until the Vista release. Price to Move to Windows Vista for Consumers• PCs bought in 4Q06: $49/$79 plus upgrade cost (most consumers will not be able to upgrade their PCs themselves and will have to pay a retailer or a reseller to do that)• PCs bought in 1Q07: $0Based on the above costs, it is doubtful whether the Express Upgrade program will be able to drive consumer PC sales this holiday season. But if the PCs bought with Windows Media Center will be entitled to a free upgrade coupon, then Microsoft could persuade some of the consumers to purchase Media Center PCs in the fourth quarter.Most of the business buyers who will purchase their machines in the fourth quarter of 2006 will be entitled for a free Vista upgrade. That could persuade some small companies not to delay their purchases until the Vista launch date next year. However, it is doubtful that many of them will upgrade their new machines to Vista at a later time frame because of reasons similar to those of consumers. Companies that want the option to upgrade to Vista later on PCs they buy from the time the promotion starts should ensure that the PCs they purchase are eligible for the free/discounted upgrades to save the cost of buying an upgrade later.

Microsoft and the EU Spar Over Security Functionality in Windows Vista
It was widely reported last week that Microsoft and the EU are once again disagreeing on the extent to which Microsoft can bundle additional functionality into Windows — in this case, security functionality into Windows Vista. There is a chance that Windows Vista availability will be delayed in the EU (see "Events Aligning to Make Vista Delay More Likely").Let's set straight a couple of things up front. First, there is a difference between Microsoft's efforts to deliver more-secure code with Windows Vista and its efforts to deliver more security functionality in Windows Vista. The former reflects Microsoft's ongoing efforts to integrate security into its software development life cycle process to produce more-secure code. This is not at issue. The EU's issues are with the latter — specifically, where Microsoft is adding additional security functionality into Windows Vista, which may adversely affect competition in the market. The second thing to note is that, while the U.S. may accept monopolistic behavior that hurts competition if, ultimately, the consumer benefits, the EU does not. The EU has ruled that Microsoft's monopoly position in desktop operating systems should not be used to unfairly enter or adversely affect competition in other markers. I believe the EU has some valid concerns in some specific areas reported. Let's look at two: Windows Defender and PatchGuard.Windows Defender. This is Microsoft's integrated and on-by-default antispyware engine, complete with signature updates. To the extent that stand-alone antispyware vendors still offer products, this gives Microsoft an advantage. However, we believe there is no long-term sustainable market for stand-alone antispyware software (see "Stand-Alone Spyware Blockers Won't Become Separate Market" and "How to Get Free Anti-spyware (or Antivirus) Protection"), just like there is no long-term sustainable market for stand-alone personal firewalls (see "Desktop Personal Firewalls: When to Buy, When to Wait"). The firewall (present for many years in Windows) does not appear to be an issue, but the situation with the collapsing market for stand-alone firewalls and antispyware is almost exactly the same, regardless of Microsoft's bundling. The market trend is toward converged desktop security offerings that combine firewall, antivirus, antispyware and other forms of security protection. Symantec, Trend, Panda Software and others provide integrated antispyware and personal firewall capabilities for their users at no additional cost. Microsoft's antispyware and personal firewall offerings can be deactivated if another vendor's offering is used. The only purpose for the EU to take action here would be to nominally prolong a contracting market. In theory, Microsoft could offer a version with Defender disabled or, alternatively, removed altogether. In either case, Microsoft must ensure that while offering its add-on security products (OneCare for consumers and Forefront for enterprises), having Defender in place does not make it easier for Microsoft to offer its combined antivirus and antispyware product as compared with other independent software vendors (ISVs).PatchGuard. This is Microsoft's built-in protection to keep software from directly modifying the kernel with the 64-bit version of Windows. This capability is not new with Windows Vista — it was first introduced with Microsoft Windows Server 2003 SP1 and Microsoft Windows XP Professional x64 Edition. However, we believe this is an issue because the 32- and 64-bit versions are shipped as a single product with Windows Vista (with a decision made as to which version made at installation). There is a legitimate concern here. Many third-party security products (especially behavioral integrated plant system products) directly patch the kernel and its system tables to link in their functionality. Therefore, they will not work on Windows Vista in 64-bit mode. Although PatchGuard was not raised as a significant issue with Windows Server 2003 SP1 or XP Professional x64 edition, these were separately charged products and, more importantly, Microsoft hadn't yet made its intentions clear to enter the host security market. On the positive side, operating systems (Oss) need to be made more secure, and all OSs should evolve mechanisms, such as PatchGuard, to protect the kernel. However, as a monopoly desktop provider, Microsoft has a legal obligation to ensure that it doesn't disadvantage competitors — especially in security, where Microsoft now competes. Microsoft should have included ISVs in developing PatchGuard. It should also have developed mutually acceptable mechanisms for legitimate, trusted security software to use kernel hooks much in the same way as signed device drivers are used to control the introduction of third-party drivers. This would require significant rework and could delay the release of 64-bit Windows Vista in the EU. It also would likely delay the release of the 32-bit to remove the 64-bit option from the installation process and media. As a shorter-term alternative, Microsoft could modify Vista to enable administrators to disable PatchGuard and assume the risk, much like what Microsoft has done with Data Execution Prevention, which can be disabled.

Windows Vista Gets Little Attention at Intel Developer Forum

During Intel Developer Forum (IDF), held in San Francisco the week of 25 September, the new operating system (OS) for Windows Vista was rarely mentioned. IDF is a technical, hardware-specific event and Intel did not want Windows Vista to overshadow it. Intel was sure to mention that its new products would run with Windows Vista, but there was little discussion about the first new client Windows OS in the past five years and how it could boost PC sales or provide better/different end-user experience combined with new Intel processors and chipsets. This is contrary to Intel's aggressive messaging about six months ago, as the company tried to ensure that the industry knows that some of Intel's chipsets support full "Aero-glass" experience in Windows Vista. Gartner believes that, for the next six months, Intel will focus on improving its profitability and recovering market share from AMD. This is why Intel kept its story focused on PC technology, its latest Core 2 Duo processor and quad-core processors, which will be introduced toward the end of this year. Also, Intel wants to avoid stalling Christmas PC sales — Windows Vista will miss Christmas. Processor vendors and hardware OEMs are now left with the difficult task of creating exciting consumer offerings and convincing consumers to spend their money on PC hardware this Christmas instead of on other consumer electronic products or waiting for new PCs with Vista to arrive in early 2007.

Vista Alone Won't Significantly Chop TCO

Last week, Microsoft did a press tour to talk up Windows Vista for businesses. Microsoft must walk a fine line between making Vista appealing to consumers without having businesses wonder if it's mostly a consumer release. Windows XP suffered from that perception and some organizations delayed upgrades for that reason.One of the claims that Microsoft made to reporters was that Windows Vista will enable companies to manage their users better and reap the savings of better manageability in addition to any inherent savings Windows Vista provides. Although Microsoft's total cost of ownership (TCO) reduction claim (reducing IT operation costs from $542 to $202, or 63%) is probably aggressive to begin with (we estimate that moving from a typically managed to a locked and well-managed XP desktop can reduce IT operations costs from $576 to $377, or 34.5%; see "Use Best Practices to Reduce Desktop PC TCO, 2005-2006 Update), it's important to realize that well-managed environments don't just happen by themselves, and they don't just happen by throwing technology at them. Managers should also realize that migration costs — the cost to get Windows Vista and the cost to get better managed — are not included in most TCO calculations. Migration costs, especially if the process is done manually and includes other technologies (such as a move to Office 2007), must be considered to ensure that any savings outweigh the cost.Although many organizations use the deployment of a new operating system to reevaluate their management practices, and while Windows Vista and its user account control features may provide the technology needed to enable more companies to improve lockdown and remove administrator access from more users, lockdown is not done by technology alone. Companies that do not prepare their culture to enable lockdown will fail to realize the benefits they expect.

Changes to Microsoft's Support for Older Software
On 28 August 2006, Microsoft announced its new Custom Support Agreement (CSA) program, which brings some changes to the paid custom support. Instead of a high, flat annual fee - which did not vary based on the number of PCs, thus costing small organizations comparatively more than large organizations - customers will pay a fee only for PCs that are using the older software. Under the CSA, companies will get security fixes for critical and important vulnerabilities, but nonsecurity fixes will be provided at an additional fee. During the past 12 months, many organizations have been migrating users running PCs with Windows 98 or NT4 (which are out of extended support) to newer operating systems (Oss). For the worldwide professional market, only 3.4% of PCs will be running old OSs by YE06, compared with 11.4% by YE05. There are also big regional variations. NT4 is much more visible in Europe compared with the U.S. According to the results of a Symposium survey ("U.S. and European Companies Continue Move to Windows XP, Office 2003"), about 1% of PCs in large U.S. organizations were running unsupported OSs, compared with nearly 6% percent in Europe. The largest share from old OSs belongs to NT4, which is linked to old propriety applications. In many cases, the issue with old, unsupported OSs is vertically specific (for example, in finance/banking or manufacturing) when companies standardize on one OS and skip several further OS releases. Having a more clearly defined policy is good, but this announcement still falls short in that area. Microsoft is not committing to a specific or minimum number of years of custom support per product. The company will decide on a per-product basis toward the end of the product's support term. Microsoft should do more standardization for the Ts & Cs of customized support – that is, annual contracts that can be renegotiated - and guarantee to give at least a one-year notice of any intention to withdraw customized support entirely.Although small and midsize businesses will likely benefit from the change in pricing, it is difficult to determine whether most other clients will benefit from the change in the paid custom support program, because the pricing for older software support used to be negotiated on an individual client basis (there was no clear, fixed pricing list). Paid custom support, even after the announced changes, will remain expensive. Try to avoid running PCs with an OS that is out of mainstream and extended support, and aim to migrate users to the OSs before the end of the 10-year support life cycle.