How do you manage software licenses?

FINE! If no one wants to play I will take my ball and go home! :p

Thanks to edwinr for peer mailing me some ideas!

So much for serious topics, huh? Guess I will go back to the TROLLS discussion "WHO TO HIRE?" and hijack it again! :D

http://tinyurl.com/qa62h

It really amazes me that people even rise to a discussion like that anymore. How many times do the certified and the uncertified and the certifiable all have to go on and on about the way they did it so it must be the best?

If you see this and decide to post in that "discussion", please please please just post something off-topic! B-) The boobie prize to the most off-topic thread started! :D

I wasn't here over the weekend, I was working.

hmm, lets see.. yup, GNU-GPL is the license for 99.95% of the software used here.

but the policy is:
if the company didn't purchase the software, it better not be installed on company systems, unless you have given the company every disk, manual and copies thereof you got from it.

always working an angle to "save the day". Cool. :)

Sorry dear, I was busy with other things when you started this. It must have fallen off my Contacts board before I got back to it.

I use an Access database to manage both software licenses and assets when the location is small. Where I have had a tool like Tivoli available, I use it.

Educating your staff is the thornier side of the problem. What is the knowledge level of the staff you are educating? Is this audit being driven by SOX? Are you validating back to a vendor? Does this staff have technical knowledge or are thy more business end users? Those things will impact how you want to educate.

I can give you an example of the database structure I have used in the past. I will warn you- I am a "third normal form" kind of girl.

The software comes in.

The software gets copied and logged. Original requestor, how many licenses, serial numbers, etc.

After that, I just hope it doesn't get installed in more locations than were originally purchased.

We do have policies stating nothing can be installed without prior approval and proper licensing, etc, but we don't have in place any type of monitoring to see how many copies of a particular software are actually running/installed.

A good tool to use is MS SMS (system management service I think), or the commercial version of belarc advisor. I haven?t actually used either of these tools but I've seen the commercial version of belarc (I've forgotten it's name) in action and it looks good and gives a pretty good list of what?s installed on the machine, what?s in it and all MS license keys. I've been told SMS it similar (and cheaper with an MSDN or similar agreement)

The client can be silently installed without the users even needing to know about it, say using the login script.

As for telling the users, reinforce the impression that the IT dept is god :) . More seriously it depends on the user?s level of understanding. If they know a lot about business or IT then all you need to tell them is you need to keep track of what software is installed they will understand the business motivations of an audit. If they are not then I find scare tactics work well (I'm sure you're creative enough to fill the rest in), if you talk to idiots you better speak idiotese.

BTW JD, terribly sorry to drag this discussion [b]on topic[/b] :) but in my defence I'll happily waffle on about atheism, Islam, Israel, gun laws and oil prices.

I am in the beginning phase of an assessment of the hardware and software for my company and have done a lot of looking. Money is a issue, so i have probably focused on the cheaper end of the market.

http://www.itsolutions.intuit.com/default.asp
Looks very good but a little too expensive for me. However, it uses WMI which i have had no end of trouble with.

http://www.auditwizard.com/pages/auditwizard.asp
I used this with my previous employer. It was quite good. Installs a small client on workstations to do the scan.

http://www.lansweeper.com/ls/default.aspx
I use a logon script to run a small exe that scans workstation and reports results to a management station running a service and MS SQL Express. There is a basic web-based front end for browsing the results. If you want to run queries you will need to design yourself. I think there is also a commercial version with more bells and whistles. You will need to add your own stuff to track licenses and compare to installed software.

http://manageengine.adventnet.com/products/service-desk/index.html
Free for max 25 workstations. Annual subscription for more than this. Uses WMI to scan workstations. I had all sorts of problems with this until i gave up.

http://www.ilient.com/
There is a free version for 100 workstations, i think. Interface needs a lot of improvement. I am still considering this but am really finding it hard to get past the interface. Commercial version offers more features. But would you pay for the interface!

http://winventory.sourceforge.net/ will soon be replaced by ...
http://www.open-audit.org/

If you search sourceforge.net for 'inventory' you will find a number of tools.

There are also numerous commercial applications out there. Some will even report how often an application is used etc. It just depends on how much money you are willing to spend.

I will probably settle with lansweeper for the moment and roll my own queries to compare licenses to installed software.

Hope that helps.

PCProfile at pcprofile@internode.on.net offers the following free whitepapers that might be helpful as a 1.4MB zipped file of the feature articles as listed below, free of charge!

- Who is liable for software piracy?
- DRAFT Software Compliance Policy
- Governance Issues
- We Dont_Care_How_Much_They_Lose_Due_to_Piracy!
- Licensing FAQ
- Software Compliance Audit Task Template
- Copyright Code of Practice
- What is an Anton Pillar order?
- Why Do Staff Install Software To Your Systems Without Authorization?
- A simple model for an anti-piracy action at 80percent compliance level
- Management Dilemma of Software Compliance Auditing
- HOW STUPID IS THIS?
- Risks of being caught with illegal software
- What steps are necessary when looking at the big picture?
- Stolen_is_a_strong_word_for_piracy
- 1st Principles
- Audit tools viewpoint
- Court orders and injunctions

Given that the fines being announced $US2M so far in USA and GBP 1.4M) are increasing in line with the reward schemes it might be very useful for organizations that have no idea what is going on, then this is a very timely reminder worthy of announcement to your managemnt to wake them up to their complacency!

find out how other people are doing this, and take the best for yourself.

As for software, we currently use TrackIT, but it is horrible for doing any sorting on the data, and it is currently unusable because my co-worker followed tech supports advice and ended up corrputing the whole database. Oh yeah, it takes them about two days to get back to us for support, so a week later, we still can not get into the database. Not sure exactly what it is we are paying them for afterall......

I am recommending to the PTB that we move to something different. Don't know WHAT yet.

I haven't used it in some time so don't know all of the bells and whistles it currently has.

The best system I have seen was using Tivoli and a barcode. The new asset was read into the system, the serial associated with a location/user, load defined- could be one of three. Box locked down and all approved requests for software were entered into the system to reflect the change and then implemented.

A report from the system told you what was out there. Random audits were done periodically. If your system wasn't what we thought it should be, it was investigated. Didn't happen often.

Maintaining a good system is better than having to start from scratch. Unfortunately, there is a cost asosciated to it and many companies don't want to pay it.

is to have to remain on whatever the current version of OS is until the systems no longer run, regardless of if you can get support (updates/drivers) or not.

Our big move right now is to get rid of the last of the Win98 systems, and anything that is under a pII400. (about 20 systems)

I have tested so many trying to find one I liked and they all have
some but not other features. I have tried Centennial Discovery
and Alloy Asset Navigator and enjoyed them in their demo
mode, but has anyone used them for real? Altiris is so much
more then I wanted and the alloy has integrated Help Desk.

http://www.alloy-software.com/a5/index.html

Is anyone using a full Asset and License Complience Package?

Didn't the BSA (Business Software Alliance, not the Boy Scouts or the motorcycle company) have a free inventory tool? I thought it was basically the same as what they would use during one of their audits.

If I were tasked with the software inventory, I would run that in addition to any other tool(s) I would prefer to use. My reasoning is that I would not want to be thinking everything is in order, but have a report from the BSA tool say otherwise during a BSA audit. I know some of the alternatives are recognized by the BSA and they will use reports from those if you have one.

Two other related items I would like to mention. First, how are all the valid/invalid uses from the licenses reconciled with the inventory? Some licenses permit one install per machine and no transfer to another. There are many variations on licensing even for the same piece of software. What about offline machines? I have seen some reports claim a piece of software was still installed after it had been uninstalled.

Second. Another good reason to know what you have installed is managing vulnerability patching. It doesn't matter if the software is free or not, vulerabilities come with no extra charge except managing the patching.

When I started a new position as a Network Admin, one of the fist things I did was to look at the software licenses. When I asked the guy who I was replacing, he got a little vague, saying "Well, you know, you have to fudge a little." Upon investigation, I learned that the reason I couldn't find the licenses was because there were none. They had four copies of Windows 2000, a couple of copies of office, (Not '03). I did an immediate audit of all software installed on the 50 pc's, figured up what we needed to purchase and presented these findings to management. When they realized how far hung out we were, they were shocked and appaled. To management's credit, the planned network upgrade was put on hold until software licenses were acquired.

I use a program at work called SiteKeeper (the same company
that makes DiskKeeper [automatic scheduled defrags]) to track
all workstations, software, and versions installed. It's also a
good tool to use for patch management when you want to make
sure everybody is using the same version and don't want to use
a patch management Group Policy. Sitekeeper is run from a
server that connect to a SQL database, but I'm sure it can be
configured to use MSDE if you do not have a SQL server.

They have a trial version available, and licensing isn't TERRIBLY
expensive. We started out with 54 client licenses, added 17 last
year, and now I need to purchase about another 30 licenses
because of growth this year due to expansion in our HQ and the
addition of a new office.

Note for XP SP2: There are some special considerations to make
for computers that are using XP Pro SP2, due to the "advanced"
firewall differences compare to SP1, but that can be fixed using
Group Policy to make sure everyone's SP2 firewall allows the
correct ports to be open for Sitekeeper to recognize the
computer.

Reporting in SiteKeeper is pretty straightforward; you can print
out reports by machine, by software on each machine, and
named software vendors or products which will list all the
machines a specific software title is installed on.

All in all, it is worth the money, especially if you use a lot of
high-risk license software packages (like Office and AutoCAD,
for example - where you know you could get busted if you are
not in relative compliance). It's also a good tool to use to make
sure "unauthorized" software (like the many versions if IM
programs and file-sharing programs out there) gets noticed,
allowing help desk/support people to UNINSTALL the software
from those specific machines. I've done this countless times,
and employees are normally willing to let it be removed, or
claim ignorance saying they didn't know it was against company
policy {yeah right!}.

I know it sounds anal, but I send out our Internet / Email /
Acceptable Use policy about 2-3 times per year, reminding
everybody that they agreed to comply when they signed the
paperwork during their entrance interview, by NOT installing
unauthorized software. This is a good way to let management
know that I really am "just doing my job," and they enjoy the
reduced exposure and financial risk by my doing this.

I normally do my Audits 2-4 times per year, just to make sure
that I am up-to-date on software installed relative to the
number of active machines on our network. However, I normally
bring the company licensing in to compliance once or twice per
year, mostly during renewals, to make up the difference in
licensing shortfalls.

Hope this helps!
Gordon

MvPCinfo will inventory everything on the computer including internet sites visited, serial numbers for all software. I bought the personal edition for $49 and it can be installed on a server and runs silently in the background when users log on. It runs on Windows 95 and newer, also can be run from a floppy, memory stick, thumb drive, floppy disk and accross the network.

MvPCbase is the data base management for MvPCinfo. It imports the saved text files and allows you to manage all of the data to include exporting to Excel or a txt file. I have been using it for years and it is excellent. I paid $129 for the personal version.

An added benefit is you have two years of free updates when purchased.

http://www.mvpcinfo.com/

Hi JD!

At my company we took some action that i'll like tio share with you

- When the users logon, we put a text box (via Active Directory policy) the text of our policy;
_ When he open his browser, again we show our software licensing e internet access policy;

HTH

Diego Dias, Brazil

Hi JD. I am the "Software Licensing Analyst" in my organization. We have close to 6000 computers that we have to ensure are compliant. The firs thing we did was lock all the networked computers down so that only administrators could install software.

Next, I created a policy that only "authorized" software would be installed on a computer. Requests go to me and I create a task for the "Field Techs" to install the software once a license is purchased.

Luckily, we were just about to convert all of our PC's over to WinXP, so each one of them were going to be reimaged. The Field Techs only install the software that has a corresponding task.

If an end user wanted some other software installed, the Field Tech told them to fill in a software request form. I would then ask if the user had a license. If they couldn't supply one, they would have to purchase an "upgraded" version of the software to run on XP.

I create each task in a program called Task+ (for use in a medical environment - not the best program, but it does what I need it to). It is a database of sorts used by our Help Desk to track problems. The title of task includes the PC name and the software title. The task title can be searched.

In each task, I include the PO number of the software and any serial numbers. As only a limited number of people have access to this database, serial numbers are fairly secure.

If the software is no longer required on a user's PC, the title changes from the original PC name to "Spare" and then I can re-issue it.

We are about 98% compliant, I would guess, but we need something to replace the Task+ system. Help Desk is moving to a different system.

By the way, it has taken me about 5 years to get the Field Techs and other people with administrator access to get on board with this process. Now that all most all the PC's have converted, I am confident that we have a handle on all the software.

The added benifit to this "Nazi" control of software is that I control what is purchased and can often get much better deals through bulk purchasing than the individuals can get by all buying the software themselves. Site licenses are the way to go with our organization.

We install most of the common software using Altiris.

As for Documentation on company policy, we pirated information from www.caast.com. It is the Canadian Alliance Against Software Theft. It's a great source of information and even has sample letters.

We keep a database of licenses and have a notebook with license certificates.

I also put out a bulletin to remind our users what is allowed. In short --
? No software brought from home or downloaded without IT authorization
? Don?t copy software from the network to your hard drive
? IT must participate in the installation of ANY software
? IT Manager must approve all software purchases
? IT is the custodian of all software media

Each bullet point is explained further in the bulletin and it is re-issued each year with minor tweaking.

We also randomly run audits, but it?s manual. If we find something that shouldn?t be there I let the department head know what it is and who had it. I also try to point out the fines that could be levied, and the possibility of jail time. We then keep an ?eye? on the user to see that it doesn?t happen again.

We have an MDB file with several tables; one for computers (with serial numbers), another for installed hardware, another for installed software (with license numbers), another with network switch assignments, and still another with the physical wiring. It all is related via a form and a bunch of queries and reports.

It's a thing of beauty.

Thanks!

We are looking into possibly something like this and your DB gave us some great ideas.

I'm sorry about that,i've been laid up for a couple of weeks and didn't know about your post.
I'll come back, promise.
Regards and apologies :(
Aaron

Thanks. I'll let you know how it works for us (once I get it open; couldn't open it from home, so I emailed to my work).

Ouch! Too bad! I guess I am lucky that I deal primarily with software resellers. They track all of our licenses for us (I still track them myself, but I can go back to them for reporting).

Once you are all complient, it might be worth a look into. It doesn't cost any more - we actually get a much better deal than we would purchasing it directly from the vendor, for the most part.

I deal with Softchoice, but there are other software resellers out there as well. The important thing to do is stick with one vendor so that the tracking is consistant.

Good luck!