I have nothing to show after spending $7M and they’ve asked for $20M more…

Let that sink in for a second. This is what a customer said to me regarding their failed IDM initiative. You can imagine the look on my face when he said that. No, it’s not the first time I’ve heard an IDM horror story of that magnitude. I’ve heard of a few bigger ones. But just the same, it’s incredible. The customer didn’t want to go into a lot of details about what happened but here are a few things he shared with me. He reports to the CIO so while quite senior he’s not real technical:

• I fired all of their consultants when I realized I knew more about Active Directory than they did. I asked him if that was because the consultants were 3rd party partner consultants or if they were from the IDM company. He said “from the IDM company”. To me, this was incredible. These guys still do not know that Active Directory isn’t just an LDAP directory? That it’s more than data – it’s Exchange, it’s SharePoint, it’s OCS, etc?
• When they acquired a company they migrated the people and data from the merged company’s Active Directory forest into their Active Directory forest. When they did that they restructured Active Directory and the IDM product stopped working. Everything was hard-coded to the previous structure of Active Directory. That was a several million dollar “re-do” right there.
• The product was “free”. So it was attractive to management. It was also picked by looking at the Gartner magic quadrant. If it is in the top-right hand quadrant it had to be good, right? I guess it wasn’t the “magic” he was expecting.

We could all arm-chair quarterback this deal. Why doesn’t he kick them all out now and start over? Why did he let it go on this long? Who knows?

All I can say is it has always been my goal to get to a point where customers do not have to spend millions upon millions of dollars to implement an identity and access management solution. This is something many of us at Quest Software have been working on for a long time now. The acquisition of ActiveEntry from Voelcker is one of the steps forward in that strategy. I want customers to remember Quest as that company that helped them realize their identity and access management vision without costing them their careers.

Technorati Tags:
Active Directory, identity management, Quest Software, QSFT, Voelcker, ActiveEntry, Jackson Shaw

Quest Software acquires Voelcker Informatik AG a leading identity management company based in Germany

I’m really pleased to pass on this news to everyone! We’ve been working very closely with Eckhard Völcker and his team in Germany for quite some time now and I’m really proud to announce that he and his team have agreed to join up with Quest and to help further our foray into the identity and access management market.

Voelcker’s ActiveEntry product simplifies identity management and compliance for large organizations through its comprehensive, solutions that include:

• Identity Management
• IT Compliance Automation
• IT Service Delivery

The fact that ActiveEntry is more than a provisioning or identity management product is one of the key attractions to this solution from my perspective. Another key attribute to ActiveEntry that I like is the fact that it is such a dynamic and easy-to-use product compared to many of the other frameworks that are available today. It has been German-engineered to be easy to integrate with and already supports integrated modules like its "IT Shopping Cart". This is extremely important to Quest. We already have a robust identity and access management portfolio of products and being able to integrate those products into the ActiveEntry platform will be very important and a key work item for us moving forward.

This is an exciting time! We'll be disclosing our road map plans and more details on product integration and direction later next month. As things progress I'll continue to blog what I can so stay tuned.

Once again, I'd like to welcome all the people at Voelcker Informatik to the Quest family!

Technorati Tags: Voelcker,Völcker,QSFT,Quest Software,identity management

Quest Authentication Services 4.0 – Auditing, Alerting and Change Tracking

I mentioned in my previous post that one of the new capabilities in QAS 4.0 is auditing, alerting and change tracking. I thought I would give you some further information on this benefit. The best benefit being that auditing, alerting and change tracking is included with QAS 4.0 at no additional charge.


Q) Why would someone care about auditing, alerting, and change tracking in an AD bridge solution?
A) When organizations make the key decision to integrate Unix with Active Directory they expand the scope and strategic importance of Active Directory. As a result it is critical to provide visibility into the Unix-centric data, which is now managed by AD. Authentication Services 4.0 addresses this challenge by delivering the ability to audit, alert, and show detailed change history of this Unix-centric information being managed by Active Directory.
Without these capabilities AD bridge administrators are either blind to any changes made to Unix-centric information managed by Active Directory or are forced to implement/purchase a 3^rd party solution, if one even exists.

Q) How does Authentication Services’ audit capabilities compare to other solutions?
A) This is a unique and critical differentiator for Quest. There are several competitive vendors in the AD bridge space but no vendor except Quest can offer these benefits as an integrated and included component of its AD bridge solution.

Q) How much does the audit capabilities of Authentication Services 4.0 cost?
A) There is no additional cost for audit, alerting, and change tracking, it is considered a new feature of Authentication Services 4.0 and is available to new customers and to existing customers that upgrade to the 4.0 product as part of their existing relationship with Quest.

Q) How does Authentication Services 4.0 handle the licensing for alerting, audit, and change tracking?
A) Quest Authentication Services 4.0 includes a special license key for Quest ChangeAuditor 5.0. When this license key is added to ChangeAuditor it unlocks a number of unique, Authentication Services-specific events.

Q) How does integration with ChangeAuditor work – technically?
A) Change Auditor 5.0 has been enhanced to support dozens of new events related to Authentication Services and Unix-centric information stored in Active Directory. When the provided license key is added these Authentication Services-specific events are unlocked and made available in the Change Auditor console.

Q) What are some sample use-cases for the ChangeAuditor functionality?
A1) Imagine that an organization is using Active Directory Group Policy to manage Unix systems and specifically has a policy that permits a Unix system administrator to access to every Unix machine.   If someone edits this Group Policy and, for example, grants additional users this access, Authentication Services can now grant immediate visibility into these changes.  An alert can be generated; organizations can audit who made the change, when, and from where; and a detailed history on what the policy was before and after the change can be provided.
A2) For any number of compliance initiatives assume an organization needs to be able to prove it has control over its Unix-centric data in Active Directory. With this new functionality an organization can now alert, audit, and show change history for events such as Unix systems being joined to AD, AD users or groups being ‘Unix enabled’, or even changes to NIS data stored in Active Directory.

Technorati Tags: Quest Software,QSFT,Quest Authentication Services,Vintela,QAS,VAS,Active Directory,strong authentication,OTP,audit,compliance,privileged account management,identity management,Jackson Shaw

Quest Authentication Services 4.0 – The leading Active Directory bridge product

We just released Quest Authentication Services 4.0. We’ve been shipping QAS since 2003 and this major release is a significant milestone with respect to the new capabilities we’ve engineered into the product. What are some of these new capabilities?

• Detailed Auditing and Alerting: Consolidating Unix data into Active Directory is just part of the picture. Authentication Services 4.0 solves the challenge of how to audit, report and alert on who makes changes to critical Unix data that is now stored in Active Directory. Version 4.0 includes award winning functionality to deliver full visibility and change alerting into who made changes, to what, when, where, and even why.
• Web-based Administrative Console: Effective management is essential when integrating Unix with Active Directory. The new web-based administration console dramatically simplifies deployment, expands management to local Unix users and groups, provides granular reports on key data and attributes, and streamlines the overall management of the Active Directory Bridge product from any web browser.
• One-time Password Authentication: Easily add another layer of security in situations that require it. For example when deploying Unix systems to tightly controlled network environments (e.g., DMZ). With new functionality included in Authentication Services 4.0, Active Directory users can be required to authenticate with a One Time Password to Unix systems. Everything that is required for an out-of-the-box solution comes with 4.0 including hardware and software tokens, PAM modules, Group Policy management capabilities and end-user licenses.
• Freeware Administrative Console: The administrative console is available free-of-charge to any organization wishing to take advantage of its local Unix user and group management capabilities.
• Advanced Management: Support for the flexible scripting of PowerShell, additional ADUC integration, and automated configuration tools.
• Group Policy: Group Policy functionality expands to include macro support, which enables a single GPO to be re-used across multiple Unix systems. In addition Mac OS X Group Policy support keeps pace with the latest OS from Apple (OSX 10.6 Snow Leopard).
• Privileged Account Management: Authentication Services 4.0 includes optimized integration with Quest Privilege Manager for Unix. Solve Unix security initiatives that need to control which users can access which system and what elevated rights they have. For example use Active Directory group memberships and Group Policy for streamlined management tasks.

We’ve talked with hundreds of customers, partners and analysts over the last twelve months and much of their input is included in this release. We’ve got a lot more to come over the rest of 2010 – stay tuned!

Technorati Tags: Quest Software,QSFT,Quest Authentication Services,Vintela,QAS,VAS,Active Directory,strong authentication,OTP,audit,compliance,privileged account management,identity management,Jackson Shaw