Mac Management Group

This thread is to see what thoughts are from customers side within ITMS

• Share your thoughts here about required area of ITMS for improvements

Get driver management working well in DS.  We love your patch product, but DS has been a pain to deal with.  Every upgrade, it feels like we're trading a promised new feature where something else breaks.  When I upgraded to 7.5, we gained the managed computer deployment window, but we lost ability to deploy USB3 drivers.  7 months later, we still can't deploy USB3 drivers with no updates from support.  I'm afraid to touch SP1 and risk what else will be broken.

See my thread here - https://www-secure.symantec.com/connect/forums/75-deployanywhere-issues-ds-upgrade-mess-me

Agent Stability

This has improved since the days of 7.0, but we almost constantly battle with agent stability issues. It comes in waves. The HTTPS bug in 7.5 absolutely destroyed us. At any given time a quarter of our machines were unmanagable. We were beat up daily by our help desk and it took weeks to figure out what was going on. I know this was fixed in SP1, but we haven't been able to move to that yet. We had to revert to HTTP to stabilize our environment.

But it's not just this one bug. For years this has been an issue, and it seems like it's almost always caused by problems with plug-ins. We've had the App Metering, OOB, Inventory, Monitor, and Deployment plugins, all at different times in the past, crashing the SMA. Some were due to bugs, some were due to plugins being upgraded before the SMA, and some are still ongoing. The Deployment plugin still crashes the SMA on some of our physical Cisco servers. I haven't opened a case for this. I removed the plug-in and I'm waiting to upgrade. We're currently on ITMS 7.5 HF5.

Obviously when the agent is not functioning everything goes to hell. Computers don't get patched, software doesn't get delivered, monitor data stops coming in, etc. I could set up an agentless policy to monitor the SMA  service on every single device and restart them when they stop, or alert us, but I shouldn't have to do that. Thankfully RAAD exists, as we uses that regularly to hunt down and remediate misbehaving agents. The fault reports help, too.

Everything is relatively stable now - I'm just waiting for that next inevitable round of agent issues. At a previous TAB meeting we talked about a future version of ITMS doing away with the plug-in model. I seriously hope that's still in the works.

Remote Control

We gave up on pcAnywhere, and I know other customers that have as well. If you're wondering, we went to ScreenConnect. pcAnywhere is a product of the 90s that has pretty much only seen added support for newer operating systems. One of the better features, the pcAnywhere Access Server, got killed off after the source code was stolen. pcAnywhere is not a CEM-enabled solution and Symantec has acknowledged that this should be rectified. And now the retail pcA product is EOL. pcA Solution is a dead man walking.

If Symantec wants to include a remote control tool in their management suite, like other vendors do, it'll probably have to be an acquisition. I once heard through the grapevine that Symantec had written a new remote control tool from the ground up that was fully Internet-enabled, and that they decided to kill it. I don't know if that's true or not, but it's a little sad if true.

Beef up Monitor Solution

While it's super simple to set up Monitor Solution there are some glaring omissions and odd issues.

We still can't monitor multiple instances of SQL Server without setting up metrics per instance. There's no way I'm taking the time to do that. We started monitoring SQL Server with another tool.

Uptime reports have been useless to us. ICMP availablity shows Up, Down, and a chunk shows up as Unknown. I placed a support call for this. I was given some reason as to why the data may show up as Unknown and was advised to post an Idea on Connect for changing this behavior. Really? I want it to show a system as Up or as Down. That should be the goal. Why should I post that as an idea?

Since upgrading to 7.5 I very frequently get bogus alarms. For example, CPU usage alarms will come in showing that a system is over 1000% utilized. Again, I opened a case and we worked this for a while. I was told I need to schedule a Reset Monitored Resources task to run on a regular basis. I was told this was a best practice. I'd never had to do this before going to 7.5, and I've never run into an issue anything like this with any other monitoring tool that we use. I ended up turning off email alerts to my team because they were too often being triggered for no reason.

I just want the product to work well. I want to be able to rely on it.

I could rattle off more, but these are some areas where we'd like to see improvement.

Deep breath.....

For a start I suggest actually responding to (and maybe even implementing some of) the ideas in the Ideas section of this site.  If there were responses from product managers then people might vote more regularly and post more ideas as they see things being implemented.

Other areas:

Deployment Server 7.5

1. Significant improvements to DeployAnywhere is needed. Sally5432 is right about USB3 but we also need to be able to accurately deploy drivers that come bundled in an exe.  Often these include applications so relying on basic driver detection is simply not enough.  Yes there are work-around scripts out there but it should do this out of the box.  Waiting for a software managment policy to do this after inventory is not fast enough.
2. Direct support for wim images
3. Add a simple gui to the pectagent in WinPE - waiting and hoping is not good in WinPE!  Show us something is happening
4. Include the abiity to add all the WinPE package options (.Net, HTA, Powershell etc) to WinPE without customization
5. Add the ability to add 3rd party winpe wims

Symantec Management Agent

1. Give the gui an over-haul.  It looks almost the same as it did in 6.x.  Gui design as moved on.
2. Stability hasn't been a problem for me

pcAnywhere, Realtime Control and RAAD

1. I second jessek's comments
2. The RAAD is great but the other two are awful
3. Possibly merge the three together into a "go to" tool for help desk teams?

Reporting

1. The report builder is absolute rubbish.   Every time I try to use it I find it locks up or I can't even do the simplest of things.  I usually just write reports directly in SQL Management Studio
2. The 6.x simple report builder was far better.
3. Many of the out of box reports need to be re-written for current versions
4. There are not enough reports for managed software delivery policies

SMP Console

1. Please stop using Java applets
2. Please.

Take everything that was good, even great about 6.9, and put it back in the next release.

As previously stated, please go through the 'ideas' area. There are some very simple suggestions that are much needed that have been out there for over three years. Changing the "from address" for the software portal, deleting tokens, deleting drivers, etc.

Integration of Bootwiz to the Web interface. This includes progress bars, a little more ability to troubleshoot installs (like checking the status of the pre-boot install itself). Fix the speed issues introduced by the web interface. Using the standalone executable to perform the same driver additions is much faster. It would be nice if there was a way to "apply settings immediately" for the driver additions so the package.refresh would run and distribute the package to NBS servers more real-time/automatic.

The ability to check machine status from the computers enhanced view. Navigating through the site servers to see if a computer is online is a waste of time and a function that previously existed.

Implementing some of the recommendations of SWAT team into the core install. It seems strange we perform an install then have to tune some of the core settings after running SMPDiag.

The ability to clone jobs without cloning every task.

Restore the right click 'Retry' and 'Continue' functionality at the task level. In most cases I don't want to retry a whole job when a simple task fails.

We need a way to use DA through a task or similar. This is evident with the USB3 issues where we need to run DA again once the OS has booted.

Something else that came up when I realized I was having driver issues post 7.5 upgrade was that the advanced support engineers I was talking to were totally blindsided by what the 7.5 update actually changed.  I literally spent hours on the phone while they pieced together exactly how the 'new' DA was running.... and I upgraded months after the update came out.  It made me think I am the only customer out there who even tries to rely on DA.  Given the lack of response on the USB3 issue, maybe I still am.

Very odd that this question is getting asked here in the forum when lots of ideas are posted. Plus I gave every product manager a piece of my mind during Vision. Very frustrating to feel that I, we -user groups, us forums are suppling feedback and not getting responses. I know Damon Covey said they are switching product managers so they could not track ideas page at times. 

quick hits 

1. PCAnywhere was working great in 7.1 sp1  then it was changed in 7.5 hf5 to spilt the agents out. however, the upgrade policies were not upgraded to reflect the difference in structure. 

a. Support from PCanywhere tech back line was horrible - if I say it is broken its broken. give me better tools to troubleshoot this. I have been beat to death on the PCAnywhere agent uninstalling by itself and then reinstalling. 

2. Deployanywhere drivers not a issue for me as we wrote our own driver libary and scan for it. 

3. Barcode - yes it still exists and it could be a great product if it was supported. Just pay Basis their money and get over it . 

4. Report writer sucks! I have written my own stuff for years because of how bad it is. It got a little better in 7.5 but not much 

4a new issue is that sometimes 7.5 hf5 will not take my sql queries- it works on sql server but not in the console 

4b. tell me again why i cant past in a sql query and have security applied to it? the built in report writer does it so why cant i just replace the sql ? 

thats all for now more later 

1. Software license tracking needs to be resolved for the Partial Upgrade of a license. A renewal or upgrade of a license right now has to be for the same quantity.

2. License types needs an overhaul. Right now you have 2 options, Concurrent or per node. There are far too many other licensing models that are not accounted for.

3. Fix the areas that require a Point Fix. Each HF install requires the reapplying of the Point Fixes.  One in particular is the Stored Procedure for Inventory to Asset Sync. This has been a problem for several years, why can't this PF make it into a release?

4. CMDB Resource Assoc. Diagram is difficult to use. By default the Free Form has not helped me. It shows associations for items the are not directly related to the item I started with. By the time it settles down and stops moving I am ready to change it to a Tree Hierarchy. I really thought the 6.x version was much more intuitive and easy to read. Would like to be able to Copy and Paste or Print the results.

5. The CMDB types need to be refreshed. Some of these have not changed in years. Data Center types, Services, Systems.  I have had to create lots of Custom Data classes to resolve the shortcomings.

6. SLA's need a refresh. No relationships to OLAs. These areas of the CMDB for SLA,OLA, Services and Systems need to be much more aligned to ITIL practices.

oh yeah - why cant i have topology manager back after network discovery? It was one of the best products that Altiris every put out? The CMDB Resource Assoc diagram is a joke and has been for quite a while.

Even when i get the diagram to display something correct i cant print it big enough or save it correctly as the size is restricted to 11x18 

I'll echo the frustration that you are asking a question like this here when there is an entire Ideas section setup for the community to post individual ideas and vote on them as a basis for product development.   Many of us have been providing feedback for years and it is very frustrating to provide the same feedback over and over and have it go nowhere.  Expand the use of the Ideas forum and start indicating directly in the forum which Ideas are slated for implementation.   If some will not or can not be implemented, let us know why. 

That said, I hear a lot of good recommendations in this thread so far.

The biggest recommendations I have on the product are:

• The console requires Silverlight, Java, ActiveX, and Flash.  Pick a platform and get on it! (please not Java!)
• Include Extensive testing of major releases and service packs before release including load testing.  The big problems we had with SP1 processor utilization and config generation should have been detected with a load test.  Most customers can setup a small DEV instance but don't have the ability to load test.
• Browser independence!
• RAAD ability from the console
• No CEM for Mac agent?  With all the effort to "catch up" the Mac agent, why was this not a priority to include with CEM out the gate?

Here are some other minor annoyances I have that have not been worth the trouble of opening tickets on but you asked for it!

• Silverlight Search UI flakey (sometimes doesn't take keyboard input depending on mouse cursor placement)
• 7.5 SP1 computer views are prompting users to save changes when being used as an ad-hoc filter
• WINS info is being reported incorrectly on inventory screen (primary / secondary are reversed)
• Direct URLs to reports only show two records until refresh button is used
• Inability to copy data from datatables within the silverlight views (we've been complaining about this since the feature was lost from 6.x NS)
• "Desktop Monitor" inventory is inaccurate for secondary monitors on Windows machines
• 7.5 SP1 Agent icon shows disconnected (red circle) even though the agent is communicating fine and shows connected in the config page.
• On Win 7 machines with UAC enabled, bandwidth control box doesn't work

Well, I'll start by saying that I was/am a customer too.

Rather than reiterating some of the sentiments listed above. The Symantec Management Console needs a major overhaul. I will not discount many of the new features that provide some ease of use, but the focus here is improvements.

For example, how many DIFFERENT ways are presented to the console user to edit? There's the pencil; in certain areas you can double-click; There's the finger pointing downward (properties); in certain areas there are right-click functions for Edit; in the row views, there may be a function in the Actions pull down menu; there's the rectangular button marked "Edit".

Point being, UI unification. The user experience is not unified and thus instructions on how to use the SUITE will always need to be writen in the context of where a user may be within the console. This costs everyone; from Symantec with the need to write specialized instructions, to our support staff; to the customer who requires specialized training and instruction.

Terminology - Agents/Plug-ins: A normalization of the usage of these terms from the console to the client should be employed. The agent is the Symantec Management Agent. Plug-ins provide solution functionality.

Wizards - for both Policies and Jobs/Tasks: Any wizard that guides a user on the creation of these items should allow the user to direct where they would want to save the item. Saving to the System Jobs and Tasks or to the particular default policy folder doesn't foster security roles employed by most customers and requires the user to then take the time to move the created items to a folder after-the-fact.

Deployment Solution - I would like to see a bulk import tool for the Driver Management.

Deployment Solution - Plugin rollout should be possible with a single policy. If Inventory Solution and Software Management Solution, etc. are able to roll out their respective plugins as a single policy, so should Deployment Solution.

 pcAnywhere Solution - Plugin rollout should be possible with a single policy. If Inventory Solution and Software Management Solution, etc. are able to roll out their respective plugins as a single policy, so should pcAnywhere Solution.

pcAnywhere Solution - Active Directory should be supported for all supported platforms and not just Windows.

Software Management Solution - Software Delivery Policies should be renamed to Managed Policies or Managed Software Policies. Many of us use these to REMOVE software or to deliver tasks unrelated to DELIVERING software.

More to come...

I'll echo Jesse's comments on the UI. I suggested a long time ago that the agent UI also be changed to show "Policies" instead of "Software Delivery". It just makes more sense - one tab for policies, one for tasks, and software delivery could occur in either. I also wanted to see Client Task Schedules show up in that Policies tab of the Agent UI.

An oldie but a goodie - update that grid UI so that I can just scroll from top to bottom. People have complained about this since 7.0 was released. Scrolling via the top and bottom arrows is useless as you have to wait for the list to refresh after each click. I love the scrolling in Activity Center. When I saw that the Event Console was going Silverlight I thought, awesome, no more of that lame scrolling. But, no, it ended up exactly the same. I'm not even sure what the point of using Silverlight in the Event Console was. The only thing that looks different is the behavior when "Loading data from the server..."

I'm liking this thread, but it does make me feel like the Ideas we've posted have been ignored.

Sally5432, I soooo second everything you said and I also "I upgraded months after the update came out".  I was told Deployment was totally fixed in 7.5 and I should upgrade.  I have not used Deployment since I moved from 7.1 or whatever version it was.  It is totally embarrising that I can't take a WIM with all the drivers loaded into it and it installs perfectly with a usb fully loaded but I can't use the same WIM to even try to deploy with deployment solution.  I have support tickets that have been ignored since Thomas left and they have even tried closing them I guess because I do SOI and they say no one else in the world does this.

Thing is for me sccm2012 is like less than a month around the corner for me and I can only say good riddens Deployment Solution.

The thing is this should of all worked out of the box but it did not and never will when Support does not respond and try to see what is going on.

I also second the comments on the console with all the requirements.  Write it in html5 (Javascript) and stop using all these third party plugins!

I feel like this ended up as a RANT and I'm sorry if it comes across like that but I think there are some very upset customers with this product.

I agree with everything so far so I'll just add what I see missing:

• Fix policy remediation causing tasks to fail. At the bare minimum until this is fixed provide an automated way to prevent policies from running during deployment. The "answer" to just use policies for post-image-deploy tasks is not good enough. 
• Dump the web UI and return to x86/x64. The web UI only works on IE in Windows anyway, so cross-platform support (the only reason for a web UI in the first place) is not a valid argument. The web UI is a complete mess utilizing half a dozen different platforms, none of which work as well as simple Windows application programming.

I actually like the web interface.  We use another product for Mac Management for 7000 Macs that's 100% web based - that doesn't require any plugins.  It works great on a Mac or PC... but would require a full overhaul of everything by Symantec.

I do miss the nice green/red light to see if a computer is on from the 6.x days, but last checkin time is usually good enough for us to guess if a machine is on or not.  I don't need or want drop and drag in the GUI.  I don't even need right click options.

I'd much rather have an interface that uses no plugins, is lightening quick and works in a modern browser.  You want to add a computer to a filter? Open the filter and have computers (or existing computer groups/filters) listed and select the computers to add via checkboxes.  Don't require silverlight or Java to add some fancy pick window, etc.

It's hard to imagine the console ever being rebuilt again, though.  

I hear "bring back the hardened console" all of the time from many people.

Guy/Gals - To accommodate the number of clients that the Notification Server can, I don't see this ever coming back. The suite's functionality supports many platforms, but currently requires a Windows computer to manage the clients. I don't think the client support ever came into play, but I could be completely speculating.  

I DO agree with sfaucher about being tied to Internet Explorer is a huge turn-off - on many levels. I can also tell you that there are many companies that use our software from a Mac and have to either log into a terminal session or have a Windows VM just to do their job. This increases the cost of the technician's workstation and in some cases rules Symantec out over purchasing the suite.

I would like to see the console to be browser aware with mobile support that can distinguish between a full featured tablet to a smaller device - limiting the functionality as necessary to make the features work.

I'll just add as I go...

Documentation Library found within the SMC's Help tab should present the installed/referenced documentation in alphabetical order.

I would concur with everyone else. Read the ideas section! Ive also just realised pcA doesn't work with CEM so that right there kills us renewing this product. Its been way too painful the last couple of years with this product. I dont really see the point of this thread, does no one read the ideas forum. I did post a comment in ideas asking if anyone reads them. I didn't get a response. sums it up really! stop posting after that.

All - Thanks for the feedback, this is much appreciated. There is always a balancing act of spending our development time on the areas of most impact so feedback always helps while we execute on this. 

While this has been a helpful post, please continue to post these requests in the Ideas section - they are read and this is the appropriate forum for this information. In addition please feel free to reach out directly if there any specific questions or issues. 

Best Regards,

Damon