Why is Quest doing free PowerShell stuff?

I love conspiracy theories and here’s the one from me. In his Registration-Free AD Cmdlets post Jeffrey raises questions on why Quest is providing AD cmdlets for free, and what is the commercial thinking behind this. He makes a great point that a commercial vendor like Quest needs to make money and whatever is not making money for a vendor might not be viewed as a long-term investment on which you can rely. So here’s the truth: Quest is making money on the free PowerShell cmdlets. And here’s how:

  1. Indirectly as a marketing tool: Quest gets a lot of money selling Active Directory migration and management tools and AD cmdlets are getting us even better brand-recognition in this target market. I think Tyler got it.
  2. Directly to upsell: Letting us sell our flagship AD management product – Quest ActiveRoles Server.

I think everything is more or less clear with the former, so let me explain more about the latter.

<commercial product pitch section>

We’ve been very successful selling ActiveRoles Server for normal UI-based operations. Basically, it substitutes Active Directory Users and Computers and makes all AD management go through its proxy. The proxy brings a lot of additional value:

  • Role-based delegation: you don’t have to give your helpdesk staff – you don’t have to give them native AD permissions, instead you can do that through proxy and in a very efficient fashion (e.g. “allow to reset passwords for locked-out accounts if the user office is ‘New York'”).
  • Full auditing: any changes made to AD are audited providing full change history for any object.
  • Automated policy enforcement: specify policies on what your AD objects need to be and have them applied to any change (e.g. when a user gets deprovisioned the account is actually not deleted but disabled, moved to a special OU, membership gets cleared, email forwarding gets set to the manager, etc.)
  • (My favorite feature) Approval workflows: if certain changes need to be approved (e.g. group membership in some privileged groups) the change won’t get into effect until the person in charge reviews and approves.

Now here comes the conspiracy part: if you have the (free) AD cmdlets and the (commercial) ActiveRoles Server – you can make the cmdlets use all these benefits for your cmdline and PowerShell scripts. All you need to do is initialize your session with Connect-QADService -proxy and all your PowerShell code will go through this policy/approval/etc. engine.

  AD cmdlets AD cmdlets with Quest ActiveRoles Server
PowerShell command-line for Active Directory
+ +
Auditing for all changes - +
Role-based delegation (e.g. for helpdesk scenarios) - +
Automated policy enforcement - +
Approval workflows - +

Here’s a slide that illustrates the architecture:

AD cmdlets and Quest ActiveRoles Server

We believe that this commercial functionality brings tremendous value. I know that PowerShell is magnitudes more readable than VBScript with ADSI. However, wouldn’t you want to have a safety net around your AD automatically applied to all your scripts? Wouldn’t you want to get “flight recorder” automatically working for all your scripts so you know what they are actually doing? Wouldn’t you want to have all your corporate policies, standards, and approvals applied to scripts and command-line? We are seeing that enterprises answer yes to all of the above and here’s why for them we find our product a great fit.

This has been that way for UI administration and VBScripts for quite some time. Now it’s time to move to PowerShell!

</commercial product pitch section>

Tags:

About these ads

7 Responses to “Why is Quest doing free PowerShell stuff?”


  1. 1 Rod Trent June 13, 2007 at 3:10 pm

    So, does this mean you are an actual employee of Quest?

  2. 2 dmitrysotnikov June 13, 2007 at 3:48 pm

    Yes I work for Quest. See the about page of this blog or the Legal section in the right-hand column. I am in charge of new product research for Quest’s Windows Management products. PowerShell was one of our research projects which grew into a bit of hobby for me as well.

  3. 3 Rod Trent June 13, 2007 at 7:13 pm

    Cool. I remember Aelita. I did some things with them a few years back.


  1. 1 Webcast: Active Directory Management Made Easy with PowerShell « Dmitry’s PowerBlog: PowerShell and beyond Trackback on June 26, 2007 at 3:19 pm
  2. 2 PowerShell makes Quest Microsoft’s Global ISV Partner of the Year « Dmitry’s PowerBlog: PowerShell and beyond Trackback on July 13, 2007 at 7:10 am
  3. 3 PowerShell Security « Dmitry’s PowerBlog: PowerShell and beyond Trackback on July 27, 2007 at 7:59 am
  4. 4 Quest, NetPro, PowerShell « Dmitry’s PowerBlog: PowerShell and beyond Trackback on September 15, 2008 at 7:01 am

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




My Recent Tweets

Legal

The posts on this blog are provided “as is” with no warranties and confer no rights. The opinions expressed on this site are mine and mine alone, and do not necessarily represent those of my employer - WSO2 or anyone else for that matter. All trademarks acknowledged.

© 2007-2014 Dmitry Sotnikov

June 2007
M T W T F S S
« May   Jul »
 123
45678910
11121314151617
18192021222324
252627282930  

Follow

Get every new post delivered to your Inbox.

Join 2,326 other followers

%d bloggers like this: