University of Edinburgh: Case Study

Environment

Over 10,000 Windows PCs
~1,000 Macs
~2,000 Linux
Very devolved environment
- Faculties and departments require ability to control settings as much as possible at their devolved level

Internet Explorer and Firefox supported on Windows
Both supported to accommodate users' preference
Aim is to support both browsers equally, except:
- Where a security incident causes us to block browser or browser feature
- Where site or plugin will only work with 1 of the two browsers
  - now rare on external sites

IE to Firefox percentages estimated to be similar to "real world"
- ~70% use IE, 30% Firefox
Similar demographics
- Engineering and science-based faculties tend to have very high levels of usage of Firefox
  - increasing in other faculties
- Usage in business oriented departments much less so
  - not helped by there being some plugins and business applications not compatible with Firefox

Internet Explorer
- in image in default configuration, use Group Policies and Internet Explorer Maintenance client side extension to configure
Firefox
- Installed via GPO
- Packaged as MSI
  - for flexibility and ability to upgrade individual components, Firefox application, dictionaries, etc are packaged as seperate MSIs
- Controlled using FirefoxADM
  - allows flexible control and ability to devolve and override settings
  - familiar interface for controllers of devolved areas

Similar as with many educational establishments, especially Universities
Only changed once per year, during "quieter" summer period (May-Sept) inbetween academic years
So, as of summer 2007, just moving to Firefox 2.X now
We require to support Firefox 2 until summer 2008
- Was a concern this past 2 years because Firefox 1.0 and 1.5 became unsupported in April/May
Major version change process
- Will release a "Test GPO" of the next managed version to devolved Computing Officer usually in May for pilot testing
- Will release connected new applications (eg. plugins) as soon as possible to test alongside
- Work with feedback and also engage with academics and our internal applications division to make sure all internet and intranet applications pass testing
- Maximum 3 months turnaround

When released gauage risk based on release notes, bugzilla entries
Keep an "ear to the ground" regarding the patch quality in first few days/week after patch release
- weary of regression issues
- recent multiple quick patches
Change process:
- Create a patch for Firefox (usually new MSI)
- Announce to managers of devolved areas for their testing and communicating change to their users
- Usual turnaround of about 2-3 weeks for patch from release to deployment

Issues with managing profile
- very difficult to control with any level of granularity the likes of certificates, password files, profiles.ini, etc
Controlled prefs "tattoo" user's preferences
Would prefer to have Mozilla authorised MSIs and group policy ADM (ADMX in Vista) templates
Would prefer to be able to have a high level of control over allowed add-ons and themes
- be able to set blacklists or whitelists
Would like to have a similar level of control over OS X and Linux setups
- on Windows, *MUST* be group policy based as well as this is familiar interface and also what many auditing tools are based on.