http://www.cfengine.com/pages/benefits

Few good points on what enterprise owners may want from policy compliance on desktops... cfengine is a very good option.

Firstly, please note we need co-existence. I apologize if the original post was misleading... this is not about throwing out Windows, its about moving 300 desktops to Linux while retaining others with Windows & MAC.

Some of the lockdown features:

- Authenticate desktop against AD. Yes I know its LDAP, but guys we already have one and eventually I'd like to move to OpenLDAP, but in a heterogeneous environment we use AD - web apps login, network proxy login, VPN login, everything is tied to the AD identity. Likewise Open, Samba and others do this nicely - so this is the easiest bit.

- restrictions on what can be installed locally. Again SSH and configuring controlled environments is not a problem. Having a nice GUI tool to do it with would be ideal. Resident Linux genius won't always be around... In any event, making technology easier to use is one of the goals here.

- desktop preferences including personalizing network settings, display settings, file system folders (or redirection to network drives), backups, company screen saver, wallpaper, etc, etc. Stuff that management dreams up as well as routine admin requirements. And since the hardware belongs to the company, no one has the right to complain... don't like the policy get your own machine.

- application preferences like URL lists in firefox, proxy settings, email folder subscriptions, FTP server links, Intranet links, custom toolbar menus (in apps that allow this using windows registry), etc.

- pushing new applications and updates against to groups of users or users who belong to a certain role. Remotely deploying new executable with role specific configurations.

- Remotely managing firewall, security, etc. Less off a problem given netfilter, clam, etc.

- Inventory for everything - hardware, software, etc.

Guys, the problem isn't that this stuff doesn't wok with Linux... Likewise, Landscape, cfengine, puppet, OpenLDAP, all excellent tools. In fact, SuSe Enterprise does most of this out of the box and perhaps other commercial enterprise desktops too.

But have any of you put the pieces together and analyzed the costs? Put together, its expensive. Expensive enough to not be able to justify the move.

So question is, are there viable, lower cost alternatives (don't have to be free, in fact having paid support is a good thing) that can solve our problems and save the company money justifying the move? Recession is coming up...

I think you got the big picture very very well. Question is, do you have any solutions? Company assets have to be protected as per company terms... Can't understand why people question that? Check your personal email on your personal laptop!

Good suggestions. I need to keep the AD as there are a number of users who will stay on Windows e.g. Sales and CRM people who do not have equivalent windows binaries for their daily bread n butter applications. Most people are saying, "don't look at this from windows point of view..." - we're NOT! The reality is that we do need co-existence with Windows & Linux (and sometime MAC). Making it work together, managed centrally and complying with policy is the key. And by policy I mean everything that users are already accustomed to... employees who don't like our network policy (including admins) buy their own laptops and use the visitor networks. Like someone pointed out, corporate liability for management is such a huge concern...

Am aware of the Landscape tool and it does indeed accomplish a lot of the things we are looking for... the problem is the $150/seat.