University of Edinburgh: Case Study

Environment

• Over 10,000 Windows PCs
• ~1,000 Macs
• ~2,000 Linux
• Very devolved environment
  • Faculties and departments require ability to control settings as much as possible at their devolved level

Browsers

• Internet Explorer and Firefox supported on Windows
• Both supported to accommodate users' preference
• Aim is to support both browsers equally, except:
  • Where a security incident causes us to block browser or browser feature
  • Where site or plugin will only work with 1 of the two browsers
    • now rare on external sites

Browser Usage Statistics

• IE to Firefox percentages estimated to be similar to "real world"
  • ~70% use IE, 30% Firefox
• Similar demographics
  • Engineering and science-based faculties tend to have very high levels of usage of Firefox
    • increasing in other faculties
  • Usage in business oriented departments much less so
    • not helped by there being some plugins and business applications not compatible with Firefox

Settings

• Internet Explorer
  • in image in default configuration, use Group Policies and Internet Explorer Maintenance client side extension to configure
• Firefox
  • Installed via GPO
  • Packaged as MSI
    • for flexibility and ability to upgrade individual components, Firefox application, dictionaries, etc are packaged as seperate MSIs
  • Controlled using FirefoxADM
    • allows flexible control and ability to devolve and override settings
    • familiar interface for controllers of devolved areas

Major Upgrades of Firefox

• Similar as with many educational establishments, especially Universities
• Only changed once per year, during "quieter" summer period (May-Sept) inbetween academic years
• So, as of summer 2007, just moving to Firefox 2.X now
• We require to support Firefox 2 until summer 2008
  • Was a concern this past 2 years because Firefox 1.0 and 1.5 became unsupported in April/May
• Major version change process
  • Will release a "Test GPO" of the next managed version to devolved Computing Officer usually in May for pilot testing
  • Will release connected new applications (eg. plugins) as soon as possible to test alongside
  • Work with feedback and also engage with academics and our internal applications division to make sure all internet and intranet applications pass testing
  • Maximum 3 months turnaround

Minor Upgrades of Firefox

• When released gauage risk based on release notes, bugzilla entries
• Keep an "ear to the ground" regarding the patch quality in first few days/week after patch release
  • weary of regression issues
  • recent multiple quick patches
• Change process:
  • Create a patch for Firefox (usually new MSI)
  • Announce to managers of devolved areas for their testing and communicating change to their users
  • Usual turnaround of about 2-3 weeks for patch from release to deployment

Technical Issues We've Had/Wishlist

• Issues with managing profile
  • very difficult to control with any level of granularity the likes of certificates, password files, profiles.ini, etc
• Controlled prefs "tattoo" user's preferences
• Would prefer to have Mozilla authorised MSIs and group policy ADM (ADMX in Vista) templates
• Would prefer to be able to have a high level of control over allowed add-ons and themes
  • be able to set blacklists or whitelists
• Would like to have a similar level of control over OS X and Linux setups
  • on Windows, *MUST* be group policy based as well as this is familiar interface and also what many auditing tools are based on.