Deployment Windows clients from a Linux server with Opsi
Windows with a View
Opsi extends Linux's convenient software distribution methods to Windows PCs on heterogeneous networks.
Corporate networks with a large number of client workstations often rely on some form of network service for installing operating systems upgrades and software updates. Installing updates on a Linux system is very easy because almost every Linux distribution comes with some form of package manager. However, the concept of package management is not as familiar to the Windows world.
Many Windows programs support automatic online updates, but everyday users often do not have sufficient privileges to complete the installation. On top of this, online updates consume a huge amount of bandwidth if, for instance, all of your clients attempt to download the latest Office update at the same time.
Several proprietary solutions offer deployment and software management services for Windows clients. Windows Active Directory has a rudimentary software deployment solution, but only for Microsoft's MSI package system. Microsoft Systems Management Server (SMS, now replaced by System Center Configuration Manager), Materna DX-Union, Novell Zen for Desktops, some HP OpenView components, and IBM Tivoli offer similar features. Community projects such as WPKG , Unattended , and Unattended GUI  have also gotten in the game.
In theory, it is possible to build a homegrown software deployment server without resorting to any third-party tools. Many Internet sites provide ready-to-run installation scripts . Given time and sufficient experience, any administrator can handle the packetizing themselves (see also the "Do-it-Yourself Software Deployment" box). However, most administrators don't have the time to build such a system from scratch. A solution that offers the freedom for custom configuration while providing commercial support and packetizing services for common applications would seem to be ideal.
Opsi ("Open PC Server Integration")  is a tool that offers remote OS installation and software deployment for Windows clients from a Linux server. Opsi – which is produced by a company called UIB in Mainz, Germany – can handle the installation of Windows 2000, XP, Vista, and Windows Server 2003/2008 systems, as well as deployment and upgrade of applications that run on these Windows platforms. Additionally, Opsi includes a hardware and software inventorying feature (Figures 1 and 2), Windows Registry support, and a history function. An intuitive license management feature automatically assigns and releases keys. Opsi can handle multiple license pools and can even support downgrade licenses (Figure 3).
Opsi – The Linux Solution
Opsi relies on free software components such as Debian GNU/Linux, Samba, TFTP, DHCP, and MySQL. Support for Windows Vista and Server 2008 (and according to the manufacturer for Windows 7, which is due for release in October), license management, VPN support, and a number of other features are available to paying customers only (see the "Commercial Opsi Support" box). The company promises to open up commercial modules as soon as they have recouped their development costs.
Commercial Opsi Support
UIB, Opsi's manufacturer, provides commercial support, workshops, and training, as well as software packetizing subscriptions (a variety of models are available ). Options such as support for a complete file server and remote administration in a complete package are available on request.
The homepage points to sponsoring the development of future features. The projects on the roadmap are Linux installation, multiple role support, schedule installation via wake-on-LAN, and templates for individual clients.
At the heart of the Opsi environment is the opsi-wInst utility, which the developers call "the central tool for installing and configuring Opsi software packages." The accompanying wInst scripting language lets you create custom installation scripts for unattended upgrades, and Opsi provides its own packaging system for enclosing a script, dependency data, and a Windows-style installer .exe file into a single easy-to-manage package.
Opsi is officially available for Debian, Ubuntu, SUSE, and the Univention Corporate Server, and it is integrated with an installable Debian DVD. The downloadable VMware server and client images are definitely useful for initial testing, giving you the option of trying Opsi without modifying your existing system.
After launching the server and entering the network configuration, users, and access passwords, just update the system via apt-get and decide whether Opsi will run as your DHCP server or whether you will rely on an existing service. After completing the setup, you can access the system with SSH and https.
Packages from Various Sources
Opsi is useful both for existing clients and for new systems. To launch a fresh Windows installation, you simply need to copy the contents of the Windows CD to your server. Once the PC has the network booted with PXE or a custom CD, Opsi loads a modified Linux environment, analyzes your hardware, and copies the setup files. The installation process runs without user interaction; when done, the Windows login screen appears. Alternatively, Opsi also supports disk image installations.
Once the basic operating system is installed, the software deployment service steps in to add client applications Opsi gives you several do-it-yourself installation methods: snapshot, silent installation, script-based, or simulated keyboard input. Alternatively, you can use the (non-free) packages available from UIB, or you can exchange goodies in the free community. An Opsi forum  and wiki  provide ready-to-run installation scripts.
According to the manufacturer, critical updates, such as monthly Microsoft Security Fixes, are available on a commercial basis within three days of their release, unless you packetize them yourself; this saves the cost of running a Windows update server. Other packages and Service Packs are provided to commercial customers in one or two weeks.
Do-It-Yourself Software Deployment
If you prefer to avoid an off-the-shelf solution, you can build your own. Besides the typical Windows XP licenses used in enterprise environments, you will need a custom DHCP, TFTP, and Samba server configuration; the free BINL server  with prepared network drivers; and a WINNT.SIF or UNATTEND.TXT file for each PC to control the setup process .
The setup starts with a PXE boot from the TFTP server, uses BINL to install the network drivers, then downloads the control file and the image from the Samba share. The image needs to include a full set of drivers for, say, graphics, sound, or controllers . The whole process is fairly complex, but luckily you can find various How-tos on the web   .
If you have a Windows server, you can use the integrated RIS or WDS service to install the clients and then choose a software deployment approach. Incidentally, Microsoft completely reworked the installation process for Windows Vista; both the protocols and the configuration are totally different from their predecessors, and free deployment solutions are correspondingly rare. To sum things up, a 100% do-it-yourself system is only recommend for administrators with very special requirements.
Feature-Rich Java Interface
To manage clients, you can use either the extensive Java web interface, which is capable of grouping and filtering machines along with their hardware information and software status (Figure 4); the command line; or the graphical server console. Opsi tools support management from a client. For individual PCs, you can assign the operating system and individual software packages, thus creating different profiles for different departments.
Clients push detailed information to the server defining the local environment. The web interface also supports polling of information from the clients to discover, for example, which Vista PCs have at least 4GB of RAM and which graphics cards are suitable for video editing. During the installation, Opsi supports package dependencies and client-specific settings, which allows users to prioritize the installation process. Details such as Windows keys can be defined globally.
Kernel king admits his tone has alienated volunteers, but says the demands of the process require directness.
New flaw in an old encryption scheme leaves the experts scrambling to disable SSL 3
Lennart Poettering wants to change the way Linux developers talk to each other.
Enterprise giant frees itself from ink and home PCs (and visa versa).
Mozilla’s product think tank sinks silently into history.
TODO group will focus on open source tools in large-scale environments.
New tool will look like GParted but support a wider range of storage technologies.
New public key pinning feature will help prevent man-in-the-middle attacks.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.