Microsoft Licensing: A Cautionary Tale
Organizationsdread tax audits and safety audits. Inspections cost an organization precious timeand money. IT managers have an added source of audit anxiety -- the softwarelicense audit.
Microsoftrecently surprised the municipal government of Virginia Beach, Va., with arandom audit, which resulted in the municipality sending Redmond a $129,000check.
LastAugust, Virginia Beach received a letter from Microsoft requesting a routineinventory of licenses and installed software at city offices. Virginia Beach’scity government employs 5,900 people and uses 3,900 Windows computers. The 60days Redmond gave the city presented both an organizational and technicalchallenge for the city’s IT unit.
“Thehardest part for us was coming up with proof-of-ownership documentation,” saysDavid Sullivan, chief information officer for Virginia Beach. Sullivan saysuntil recently, software and other equipment was acquired on a departmentallevel, with little centralized management. In some cases, point solutions werepurchased with petty cash at retail outlets, although Dell is the city’sapproved supplier.
Before theaudit, Sullivan had begun the task of centralizing the purchase and managementof the city’s computers, and ensuring that software licenses were accessibleand accounted for. The audit reinforced the need for standard policiesregarding licenses. “We needed better management and knowledge of what softwarewas installed,” he says.
RobEnderle, vice president and research leader at Giga Information Group, saysSullivan’s experience is not uncommon. “It’s kind of like the IRS, you can justhave your number come up,” he says.
The bulk ofVirginia Beach’s 3,900 PCs run Windows 95, with a few Windows 98 and Windows NTworkstations. The workstations use the WordPerfect suite for productivityapplications. Although the city uses Novell’s NetWare for most of its file andprint services, it also uses Windows 2000 servers, particularly for SQL Serverapplications.
SQL ServerClient Access Licenses (CAL) presented a significant problem. Sullivanestimates that about a third of the payment made to Microsoft is for SQL ServerCALs. “The CALs are very difficult to administer,” he says, noting it wasdifficult to determine exactly how many users accessed the city’s three SQLServer databases.
“SQL is oneof those products that is pretty unique [in its licensing],” Enderle says.“It’s difficult to keep track of who is a user and who is a guest, sometimesthat can be pretty aggravating.”
Sullivanand his team were also required to audit the operating systems on desktopmachines. For this task, the city repurposed Check2000, a Year 2000 assessmentprogram from Greenwich Mean Time Ltd. and User Technology Associates. Theproduct crawled the network and determined the installed software. Sullivansays he will use Asset Insight from Tangram Enterprise Solutions for future centralizedsoftware assessments.
Sullivansays machines like laptops that are not consistently attached to the networkhad to be inventoried by hand, making the task a little more tedious. After theinventory was done, Sullivan and his team found several machines that hadWindows installed but did not have licenses to account for the installation.Sullivan says he is sure that a fair number of machines were already paid for,but the city paid Redmond to avoid problems.
Enderlesays Virginia Beach got off relatively easy. “If [Microsoft] believes a site isout of compliance, they will send in [an auditing] team,” he says.
Sullivansays, however, that a license audit is something difficult for administratorsto plan for. “Microsoft frequently changes its licensing agreements, and is notrequired to notify us,” he says. After consulting with colleagues at otherorganizations, Sullivan believes his experience is not unusual. “ClearlyMicrosoft is stepping it up,” he says. “You need to read your Microsoft licensingagreements.”
Enderle isnot sure that Redmond is increasing its audit efforts, but notes that newversions of Microsoft products include features for automating audits to helpensure all users are paid users. He believes these features will make audits easier.
News of theVirginia Beach audit reached the Linux-friendly slashdot.org message board, andSullivan became intrigued by the suggestions some of the posters made,including using free-license, open-source software.
Sullivansays Virginia Beach uses commercial software written for purposes beyond thereach of amateur programmers, such as a SQL front-end for policeadministration. If the city decided to go open-source, it would have to hire aprogrammer to accomplish what packaged software does cheaply -- a practice thecity ended when it closed the doors on its mainframe era. ‘When you have a buystrategy, the market pretty much dictates what you want to do,” he says.
Index:
Microsoft Corp., Redmond, Wash., www.microsoft.com
GigaInformation Group, Framingham,Mass., www.gigaweb.com