Broadcom CMS versus WorkSpace One

[Tal Fisher]

Now that Broadcom has acquired Vmware (Workspace 1) what is the future for Broadcom CMS (aka Altiris)?
What are the pros and cons between both technologies? I have been using CMS and have been certified since version 7.1. The company wants to replace Altiris with Workspace 1. What are your thoughts? In advance, Thank you.

[Mike Grueber]

Hi Tal,

I will let others comment on the pros and cons of Altiris and Workspace 1. 

It's important to note, though, that Broadcom has not completed its acquisition of VMware yet.  Broadcom has entered into an agreement to purchase VMware, but that agreement is subject to regulatory approval.  Until that time, all interaction between the two organizations must be conducted at arms length.  That means that the two organizations cannot yet collaborate on a go-forward strategy with respect to products such as Altiris and Workspace 1.

In my experience, Symantec Client Management Suite's strength is in managing laptops and desktops, whereas Workspace 1's excels in managing mobile devices.  There are many customers who use Client Management Suite to manage desktops and laptops but rely on Workspace One to manage mobile devices. 

From my perspective, the agent-based capabilities in Client Management Suite provide a breadth and depth of functionality to manage laptops and desktops that cannot be duplicated by Modern Device Management, which is a form of simplified and light-weight management.

[Shawn Mayhew]

@Mike Grueber I have asked for this comparison paper before. Understanding it might not be the best time politically to produce it. Especially the ability of Altiris to manage patch rings in a much tighter manor.

The pull of one software library to manage multiple environments is very tough to resist. ​Also 

I am much more concerned what is going to happen to my support structure - will Broadcom gut the support teams at Workspace One like they did Symantec?  If so Intune looks very attractive

------------------------------
Altiris Admin since 2002
------------------------------

[Tal Fisher]

I was hoping to get more information from the community. We have a new director, and he wants to replace BroadomCMS (Altiris) with Vmware WS1. We are also getting a new CIO this Spring. So he wants to see some change as well. I am not convinced that Altiris should and can be replaced by WS1. We officially have a project manager assigned to us for piloting WS1.

[Mike Grueber]

The needs of each customer differ.

I recommend that you carefully review how you are using CMS today and determine if WS1 will meet all of your needs with respect to aspects such as content delivery (e.g., bandwidth throttling and peer-to-peer delivery), granular control over things such as end user deferral of software installations, the capabilities of Managed Software Delivery policies, etc.

Determine what functionality that you use today in CMS is critical and then ask the project manager piloting WS1 if it addresses those use cases..  You may find that WS1 does not address some of the use cases and will then need to decide how critical those use cases are to you.
  
I would also suggest that you compare the cost of WS1 and Altiris CMS, as well as the effort required to migrate from one product to another.

[John CrossSarvis]

We are currently in the process of migrating from Altiris to Workspace One. It has been a challenging journey but we are making progress and I believe that it will be a good shift for us going forward. I'll try to comment on a few of the biggest things we've noticed so far in our implementation. Note that we are running things in parallel during the conversion.

Device vs User basis
WS1 is user centric while Altiris is device based for management. This can be a big paradigm shift for managing systems so be sure you understand those implications. We have had issues with security due to device based filters being overwritten by user based policies in restricted subnets.

Asset Management
WS1 is not an asset management solution. Our Altiris instance includes Asset Management modules that help to monitor our endpoint lifecycles. WS1 is not built for that and will not give you what you need to properly track them. We are moving all Asset tracking into Service Now.

Software distribution
I personally feel that WS1 has the upper hand in this area, but I'm sure many long time Altiris admins will disagree. Proper ring management seems to be a constant promise from WS1 that has not made it live yet, so that is a disappointment. Freestyle Orchestrator gives you all the tools you could need and is being further integrated through the ecosystem.

Intelligence
Altiris reporting is powerful, but it follows older principles for distribution in our environment. Having fully interactive dashboards with drill down vs an emailed sql report is a big change. Having the automation capabilities of Intelligence is a huge advantage for WS1.

This is just my personal hot takes on the switch for us, so your mileage may vary.

Thanks,
John

John Cross-Sarvis [e-mail]

[Tal Fisher]

Thank you for the information John. We just started using ServiceNow's Asset module this year. The managers like it, which is one less thing I have to do in Altiris now. The WS1 salesman states that the reporting will be better/easier than Altiris, and he states that WS1 can deploy ZERO-Day exploit patches faster than Altiris. But keep in mind that we do not use CEM. Meaning we have to wait until the customer connects to the network before we can run reports and remediate any Zero-DAY exploits. BUT to get WS1 to operate faster, we have to lower some of our security requirements. These exact requirements are what decrease Altiris' functionality.
Example
Not allowing internet traffic to communicate with the agent.
Not allowing  Microsoft Delivery Optimization to run on computers.
Not allowing full Azure sync to on-prem AD.
Do not allow software packages to transverse on different subnets. So we built about 130 package servers, one for each subnet.

[Johannes Engstle]

Hi Tal

we use Altiris for more than 15 years and we think the product is often underestimated.
Especially the automation capabilities are really powerful.
From my point of view, you need an automation workflow engine (like Symantec Workflow Solution or any other NoCode-Product)
to realize the full potential.
We have a lot of projects running e.g. Zero-Touch-Deployment on computer manufacturers site,
Zero-Touch-Patch-Deployment, Zero-Touch-SoftwareResource Checkin etc.

The reporting engine is best in class, 3rd party patching is great, CEM,
Managing Linux, OSX, Windows in one console

The support of the product is really good, the technical level of the support engineers is very high.
If you compare that when you open a case at Microsoft ...

If someone from Symantec/Broadcom reads this, a modern REST API would look good on a modern product.
We have more and more problems with automation integrations with the old SOAP web services.

Best Regards

[Mike Grueber]

@ J E

Thank you for your feedback.  I believe we may have had a discussion on the past regarding your suggestion to develop a modern REST API.  The coverage provided by the existing SOAP API is quite extensive and it would be a major effort to fully convert all parts of the existing SOAP API to REST.  That means that things would need to be prioritized in terms of which parts of the existing SOAP API to convert to REST.

What specific portions of the existing SOAP API are most important to convert to REST?  I have the same question for any other customers or partners reading this thread.​