Year: 2022

Apple will discontinue the Fleetsmith Mobile Device Management (MDM) service in October and is warning businesses using the service to find another MDM provider.

Apple and Fleetsmith, a short history

Apple acquired Fleetsmith in June 2020. At the time, it was understood the company wanted to improve what it offered to small business users. “The weakest spot for Apple in business has always been for the small businesses who just want to get started,” Jamf CEO Dean Hager told me soon after Apple Business Essentials was revealed.

When I spoke with Fleetsmith co-founder Zack Blum in 2018, he said:

“Apple’s biggest accomplishment and contribution to enterprise technology has been bringing mobile to the enterprise. Apple has raised the bar in delivering well-designed product experiences, as well as hardware and OS security.”

Replacing Fleetsmith

Many small and mid-sized business (SMB) users might be served by Apple Business Essentials, which leverages some of the technologies Apple took from Fleetsmith. However, for more complex deployments, there’s a rich industry of sophisticated MDM systems.

Thankfully, following more than a decade of steady growth in Apple deployments in the enterprise, Fleetsmith customers seeking an alternative MDM vendor are increasingly spoiled for choice.

Founded in 2002 and used at SAP, IBM and perhaps even at Apple, Jamf was early to identify the emerging Apple in business opportunity and remains the clear market leader with a range of services, including powerful Zero Trust solutions.

But Jamf isn’t the only game in town. Reflecting Apple’s growth in the sector, the stable of Apple-focused MDM providers is expanding quite rapidly.

That’s great, as many businesses have quite unique needs, so the plethora of choices means even the most unique business has an opportunity to identify a vendor suitable for the business they run. Companies including Jumpcloud, Addigy, Hexnode, Kandji, Citrix, MobileIron and many others are all competing with Jamf to support the enterprise.

What is driving Apple in the enterprise?

This growing network of players has emerged in response to the consumerization of IT, which continues to transform business technology. A new 451 Research study I’ve seen claims that about 25% of SMBs plan to invest in their digital transformation strategy moving forward, following substantial hardware investments across the last two years.

MDM is a critical element to any such strategy.

Of course, when it comes to the proliferation of Apple kit in enterprise IT, you can justifiably argue this first began to accelerate following introduction of the iPhone in 2007, which soon spawned the BYOD (Bring Your Own Device) trend. As the Apple smartphone became more widely used in the enterprise, iPad and Mac deployment soon followed.

This desire for a consumer-simple experience in enterprise IT has also nurtured the emergence of employee-choice schemes, as discussed here, here, and here.

One recent survey (commissioned by Jamf) claimed Apple users had a better experience with their chosen platform, reporting improvements in productivity (87%), self-sufficiency (87%), and creativity (86%).

Ways of seeing

The way business leaders see Apple kit has changed dramatically in the last decade or so. The days when tech leaders could mock the company’s offerings really came to an end when Microsoft’s then-CEO, Steve Ballmer faced a room full of Mac-using journalists at a press event.

Today, while business leaders continue to see Apple hardware as a more expensive initial investment, it has become crystal clear that the cost of ownership over the usable lifecycle more than makes up for that.

In other words, this side of the market has grown and will continue to grow, and with almost every Fortune 500 firm now supporting Apple devices, it’s unlikely to decline any time soon.

Farewell Fleetsmith, hello new world of enterprise IT

Apple knows this, of course, and while the shuttering of Fleetsmith suggests the company will continue to nurture the third-party MDM services market, it still means existing Fleetsmith customers must now prioritize finding an alternative MDM provider.

As explained in this Apple tech support note, Fleetsmith will cease on Oct. 21, after which devices will no longer receive configuration profiles. The service no longer accepts new customers.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

The California State Assembly is considering new rules that would offer workers greater protection from the use of digital monitoring tools by employers.

The “Workplace Technology Accountability Act” (AB 1651), introduced by Assemblymember Ash Kalra, would create a way to protect workers against the use of technologies that can negatively affect privacy and wellbeing.

The bill would “establish much needed, yet reasonable, limitations on how employers use data-driven technology at work,” Kalra told the Assembly Labor and Employment Committee on Wednesday. “The time is now to address the increasing use of unregulated data-driven technologies in the workplace and give workers — and the state — the necessary tools to mitigate any insidious impacts caused by them.”

The use of digital surveillance software grew during the pandemic as employers sought to track employees’ productivity and activity when working from home, installing software that uses techniques such as keystroke logging and webcam monitoring.

Digital monitoring and management is being used across a variety sectors, with warehouse staff, truck drivers and ride-hailing drivers subject to movement and location tracking for example, with decisions around promotions, hiring and even firing made by algorithms in some cases.

The bill, which was approved by the committee on a 5-2 vote and now moves to the Appropriations Committee for more debate, makes three core proposals:

• To ensure employees are notified prior to the collection of data and use of monitoring tools and deployment of algorithms, with the right to review and correct collected data.
• To limit the use of monitoring technologies to job-related use cases and valid business practices.
• To require employers to conduct impact assessments, with worker input, on the use of algorithms and data collection to identify potential harms and discriminatory impacts.

Kalra said the bill would not result in a widespread ban of technologies, only “dangerous” tools such as facial and emotion recognition. His concerns echo those of a UK union group, The Trades Union Congress, which surveyed workers about the prospect of monitoring and raised reg flags about the tactic.

“Worker surveillance tech has taken off during this pandemic – and now risks spiralling out of control,” Frances O’Grady, TUC general secretary, said in a statement last month.

Among those opposing the measure is the California Chamber of Commerce.

“Based on our initial review…, quite frankly the bill is unworkable,” said Ashley Hoffman, policy advocate at the California Chamber of Commerce. The business group argues it would place unnecessary demands on employers to store and review collected data and ensure technologies are compliant, while potentially hitting small business employers with penalties up to $20,000 for violations.

Regulating workplace management and monitoring technologies is an growing priority for lawmakers in the US and in Europe. Although though the General Data Protection Regulation put in place some rules against the misuse of worker data by employers, the European Commission recently drafted proposals that would offer greater protection to gig workers that are supervised by algorithms.

The bill’s prospects for passage by the full Assembly were not immediately clear. If passed and signed into law, it would apply to all businesses that use monitoring tools and could have ripple effects beyond just California. The state is home to many big tech firms and often adopts worker protection measures that could similar legislation in other states.

We often think vendors are perfect. They have backups. They have redundancy. They have experts who know exactly how to deploy solutions without fail. And then we see they aren’t any better than we are.

Let’s look at a few recent examples.

In the small to mid-sized business (SMB) space, StorageCraft has long been a trusted backup software vendor. One of the first to make image backups easy to do, it was used and recommended by many managed service providers. After StorageCraft was acquired by Arcserve in March 2021, there were no immediate major changes in how the company ran.

Then, last month, a lot of backups in the cloud were permanently lost. As was reported by Blocks and Files, “During a recent planned maintenance window, a redundant array of servers containing critical metadata was decommissioned prematurely. As a result, some metadata was compromised, and critical links between the storage environment and our DRaaS cloud (Cloud Services) were disconnected. Engineers could not re-establish the required links between the metadata and the storage system, rendering the data unusable. This means partners cannot replicate or failover machines in our datacenter.”

As of April 16, the status report said: “All affected machines are now enabled with a buildup of recovery points occurring. All throttling has been turned off and uploads are working as normal. The time to replicate data will depend on each customer’s upload bandwidth and data volume.”

That doesn’t help if there was an older backup you wanted to keep in your cloud repository.

Next up, Atlassian, which indicated on April 4 that approximately 400 Atlassian Cloud customers experienced a full outage across their Atlassian products. As the company noted on its site:

“One of our standalone apps for Jira Service Management and Jira Software, called “Insight – Asset Management,” was fully integrated into our products as native functionality. Because of this, we needed to deactivate the standalone legacy app on customer sites that had it installed. Our engineering teams planned to use an existing script to deactivate instances of this standalone application. However, two critical problems ensued:

“Communication gap. First, there was a communication gap between the team that requested the deactivation and the team that ran the deactivation. Instead of providing the IDs of the intended app being marked for deactivation, the team provided the IDs of the entire cloud site where the apps were to be deactivated.

“Faulty script. Second, the script we used provided both the ‘mark for deletion’ capability used in normal day-to-day operations (where recoverability is desirable), and the ‘permanently delete’ capability that is required to permanently remove data when required for compliance reasons. The script was executed with the wrong execution mode and the wrong list of IDs. The result was that sites for approximately 400 customers were improperly deleted.”

While these incidents may not have directly affected you, it’s wise to use them as lessons to learn from.

First and foremost, always review (in either your contract with a vendor or the terms of licensing) what their responsibilities are and what remedies you may have should a problem occur. In both cases, StorageCraft and Atlassian will be abiding by the terms they agreed to. If you are a larger client, you can control the contract terms and the remedy at hand. If you’re a smaller client, the end user license agreement and the terms included in it control what the vendor will do. If you rely on a vendor and its services, plan on something going wrong at some point. The key is to review how vendors handle their mistakes rather than their successes.

Will they reimburse you for the value of your loss? Will they perform extraordinary actions to restore you to whole or near whole? Often, how quickly they fess up to what’s happened can be more important than how they handle your data.

In both cases, human error was to blame. I can still remember the time I was working on a DOS computer and accidentally typed in del *.* at the root of the C drive rather than under the subdirectory that I intended. Clearly, it’s a lesson that stays with me to this day. Whenever I am doing anything related to deletion, I always pause and ask whether I have a backup in case I make a mistake. I pause and check where I am performing the action. I ask myself if I am deleting the right item.

No matter whether you are a single user or handle a network of computers (either on-premises or in the cloud), always have a full backup. Consider having multiple ways you can recover data after a problem. From full backups to simple copies of directories, be flexible in having ways to recover data.

Next, if you are an MSP, urge your staff to double-check your scripts. Often, we re-use scripts and don’t audit them to ensure they still do what we intend. Reading about the details of the Atlassian failureis painful. Clearly, the teams didn’t communicate well and ended up accidentally deleting information they weren’t planning to delete. Communication when you are planning a major change to your infrastructure is key to success.

That goes for communications from vendors, too. I’m a Microsoft 365 user and I often rely on two different platforms to keep track of issues. The Microsoft 365 Twitter account allows me to get alerts when there are issues. (You can download the Twitter app and set it up to receive a push notification when there’s a status change.) Alternately, you can set up notifications from the message center to ensure you’re kept up to date. For any vendors you use regularly, check on whether they have any communication channels that will keep you up to date.

Remember that technology is driven by human decisions and humans make mistakes. Don’t assume mistakes won’t occur. Plan on what you’ll do when vendors make mistakes. After all, they’re only human.

Microsoft is planning to release a new tool that will automate the patch management process, all but eliminating Patch Tuesdays for many organizations.

The company’s new Windows Autopatch service will keep business computers continuously updated as part of a new feature included with the Windows Enterprise E3 subscription service.

Organizations running systems with a Windows 10 or Windows 11 Enterprise E3 license will be eligible for the new patch service, which is expected to be generally available in July.

“This service will keep Windows and Office software on enrolled endpoints up-to-date automatically, at no additional cost,” Lior Bela, senior product marketing manager at Microsoft, wrote in a blog post. “IT admins can gain time and resources to drive value. The second Tuesday of every month will be ‘just another Tuesday.’”

Microsoft

Patch Tuesday (more recently called Update Tuesday) is a colloquial term used in the IT industry to refer to when Microsoft and others typically release spot repairs to their operating system and other software. Patch Tuesday is always the second Tuesday of each month.

Microsoft said it’s automating software updates in response to the “evolving nature of technology.” For example, the pandemic increased demand for more remote or hybrid work, making performance and security updates even more crucial, as systems are more often outside an organization’s firewall.

“The value should be felt immediately by IT admins who won’t have to plan update rollout and sequencing, and over the long term as increased bandwidth allows them more time to focus on driving value,” Bela said. “Quality updates should enhance device performance and reduce help-desk tickets — feature updates should give users an optimal experience, with increased uptime and new tools to create and collaborate.”

Dan Wilson, a senior research director at Gartner, said there is unmet demand for endpoint patching services as traditional outsourcers tend to favor more full-service offerings.

“Autopatch can address the common challenge of keeping pace with Windows and Office updates. The $0 price tag should make it attractive to at least test. Third-party application patching is the other challenge, but that is not currently in scope for Autopatch,” Wilson said in an email reply to Computerworld.

Windows Autopatch will be able to detect differences among endpoints, and place them into four “test rings” or groups, and then dynamically check them for necessary updates.

First there will be a “test ring” containing a minimum number of devices that are representative of all the types of devices and configurations under management. The next ring is slightly larger, containing about 1% of all devices under management. A third “fast” ring contains about 9% of endpoints, and the remaining 90% of devices will be assigned to a “broad” ring. The percentages don’t change as devices are added or removed from the service network.

The point of the four rings is to ensure there are no software issues associated with firmware or software updates. As each group passes the tests, the updates are installed until all of an organization’s devices are patched.

Wilson noted that Autopatch follows ring-based deployment best practices with the ability to halt and roll-back should issues arise, and minimum license requirements (Windows E3 or up) shouldn’t be an issue “as most have or are upgrading to Microsoft 365 bundles that include this.”

“And the requirement to be enrolled in or co-managed by Intune and in Azure shouldn’t be a major concern at this point,” Wilson said. “Whether or not Autopatch is better than leveraging automated update capabilities already within Microsoft Endpoint Manager, Windows Update for Business and the Office 365 admin console is unclear, Wilson said. “They try to address that on their Windows Autopatch FAQ page, he said.

Windows Autopatch will manage all aspects of device group deployments for Windows 10 and Windows 11 quality and feature updates, drivers, firmware, and Microsoft 365 Apps for enterprise updates, Bela said.

From an endpoint management standpoint, the main prerequisite for Autopatch is Intune or co-management. The service has a built-in readiness assessment tool that will check relevant settings in Intune, Azure Active Directory, and Microsoft 365 Apps for Enterprise to see that they are configured to work with Autopatch.

The online tool checks all of an organization’s settings in Microsoft Endpoint Manager — specifically, Microsoft Intune, Azure Active Director and Microsoft 365 — to ensure they’ll work with the Autopatch service. If any settings turn up as “not ready” the service has click-through instructions on how to resolve issues, Microsoft said.

“After providing consent, Microsoft completes all the other steps for you automatically, and will manage creating the right policies and groups so that updates are ready to be deployed,” Mark Florida, principal engineering product manager at Microsoft said in a video presentation. “Talk about saving time. Imagine doing all the policy configuration and group definitions yourself.”

Data released today by IT asset management platform provider Lansweeper indicates that upgrades to Windows 11 have almost tripled over the past three months, but the overall adoption rate remains miniscule.

The survey of more than 10 million Microsoft devices by Lansweeper’s PC management software showed 1.44% now run Windows 11, an increase from the 0.52% of PCs that ran the OS in January.

“Overall adoption remains slow, almost six months since the initial launch of Windows 11 to the general public, as previous Lansweeper research revealed that 55% of devices scanned are not capable of being upgraded to Windows 11,” Lansweeper said.

While the majority of Microsoft devices scanned by Lansweeper’s software passed the RAM test (91%), only about half of the workstation TPMs (Trusted Platform Modules) tested met the requirements — 19% failed and 28% were not TPM compatible or did not have it enabled, Lansweeper’s monitoring showed.

“For virtual machine workstations, the forecast is less optimistic,” Lansweeper said. “While the CPU compatibility is slightly higher at 44.9%, our research shows that only 66.4% has enough RAM. For TPM the news is grim, only 0.23% of all virtual workstations have TPM 2.0 enabled. This isn’t completely a surprise, TPM has never been required for Windows and while TPM passthrough (vTPM) exists in order to give virtual machines a TPM, it is rarely used. …Most VM workstations will need to be modified to get a vTPM before they can upgrade to Windows 11.

“TPMs on physical servers only passed the test 1.49% of the time, which means about 98% would fail to upgrade if Microsoft creates a server operating system with similar requirements in the future. For virtual servers, again there are almost no TPM-enabled servers.”

Lansweeper’s data contrasts sharply with that of computer-monitoring software provider AdDuplex, whose latest data shows an adoption rate of 19.4%. AdDuplex’s research did, however, show Windows 11 growth had stagnated in last month; it only saw a 0.1% market share increase over other Windows editions.

Jack Gold, principal analyst at J. Gold Associates, said AdDuplex’s Windows 11 adoption numbers are too high, and Lansweeper’s assertion that 55% of machines can’t run Windows 11 is likely too low.

“I honestly doubt that Windows 11 is running on 19% of all machines in use today, since Windows 10 is only running on about 75% or so of machines in use, depending on whose numbers you believe,” Gold said. “That means that at 19%, about 25% of Windows 10 machines could be updated to Win11. I find it hard to believe that 25% of all Win10 machines out there are even compatible with Win11, given that many PCs in use are three-to-five years old or even older (probably at least 40%).”

In evaluating the data from both AdDuplex and Lansweeper, it’s important to understand how the companies came up with their respective numbers, whether through a web browser interacting with certain web sites (a self-selected group of users) or through a voluntary user running the company’s software (again, a self-selecting subgroup), Gold said. 

“Without knowing exactly how they are obtaining their numbers, it’s pretty hard to evaluate how accurate they may be. But I’d certainly lean towards a lower number than a higher one,” he said.

It’s likely that any machine more than a couple of years old will not be compatible with (and therefore not upgradable to) Windows 11. And PCs are even more unlikely to be compliant if they’re older, lower-end machines, Gold said.

Lansweeper

In December, AdDuplex’s data showed Windows 11 uptake had reached nearly 9%; that number, again, contrasted sharply with figures released by Lansweeper; at that time, it showed the new platform with a less than 1% adoption rate.

Microsoft has pushed to get users to upgrade to Windows 11, but the overwhelming majority have chosen to remain on Windows 10.

Roel Decneut, chief strategy officer at Lansweeper, said unlike previous Windows releases, Windows 11 is simply an adjusted Windows 10 version, and the core differences between the two is minimal. “This is likely the main reason why businesses are against upgrading to a new, and almost unproven, version rather than staying with what they know with Windows 10,” Decneut said.

Steve Kleynhans, a vice president of research at Gartner, agreed commercial customers are not really diving into the new OS. And they’re not expected to do so until 2023.

Still, Kleynhans said it’s “a bit” early to draw any conclusions about Windows 11’s success. “While technically the OS update is six months old, a very large percentage of machines weren’t being offered the update until just a couple of months ago,” he said in an earlier interview. “The current [install rate] is likely just normal market evolution during the early stages of any new OS version and not a sign of anything really problematic.”

AdDuplex

Lansweeper’s updated survey results did show that the number of machines running “end of life” OSes (i.e., platforms no longer supported by Microsoft) has fallen to 6.6%, compared to 9.75% in January. A significant portion of those systems are running Windows XP and Windows 7 — software Microsoft stopped supporting back in 2014 and 2020, respectively.

“Although the rate of adoption is increasing bit by bit, it’s obvious that Windows 11 upgrades aren’t going as fast as Microsoft had hoped, especially within the business environment. Many organizations have been put off from having to buy new machines that meet these [hardware] conditions, while others are simply happy with the current existence of Windows 10, which continues to be supported until 2025,” Decneut said.

Because of the minimal differences between Windows 10 and 11, the slow uptake of the latter is likely to continue unless businesses GET a compelling reason to upgrade, Decnuet explained.

“For those looking to adopt Windows 11, the first step is to assess which of their existing devices are capable of upgrading,” he said. “It’s the reason why IT asset management is so important for organizations, capable of running in-depth device audits that can tell IT teams the hardware specs of machines so they can weigh up how many devices are capable of upgrading and the potential cost of such a move.”