Software Asset Management Professionals

It’s almost over, this terrible, awful, no-good year is almost over. Let’s have a recap:

Plague
Famine
Economic collapse
Pestilence
Violence
Murder Hornets

Did I get everything? Probably not but that’s all behind us now. It’s a new year and hopefully, hopefully, it will be better than the last. Last year around January, I wrote a piece about where MetrixData thought 2020 was going and a few predictions we had about trends we were noticing in the tech industry. At the time, COVID was just an outbreak in China that was steadily inching closer to my hometown. Then March struck and that piece got sidelined real quick because the future was suddenly very dark and unpredictable. Now, we’re still stuck in that turbulent time, and rolling with the punches is our only strategy because who knows what’s next? At MetrixData 360, we thought this year we’d give our tentative outlook for 2021, with a lot of wriggle room in case 2021 is as full of surprises as last year. So, what does 2021 have to throw at us after the chaotic dumpster fire that was 2020?

2021 Risks to Think About

There are a few worse case scenarios that must be taken into consideration when forecasting 2021. While 2020 has proven that it’s always best to keep an open mind about what will happen next, a few of the worst-case scenarios that could possibly play out include:

The virus may not be under control by the end of 2020:

- COVID mentality will not be shaken off so easily: There will likely be a transition period, while people shake off that 2020 storm-weathering mentality. Many people may choose to remain remote for fear of contracting the virus. While local tourism might increase out of a desperate desire to get out of lockdown, far-flung holidays to remote locations may be postponed until 2022 for fear of being stranded overseas. Many people and businesses will find themselves staying afloat financially only by the skin of their teeth, and for some people, their jobs will not be coming back after COVID, and so will be either unwilling or unable to flaunt any spending money.

2021 recession or rebound: It might be important to keep that storm-weathering mentality and hunker down for a 2021 recession, which some economists are predicting. The US dollar has a 50% chance of doing a double-dip recession by the end of 2021. Although other economists are predicting the economy will ramp back up as businesses open again, deals that were postponed are picked up again and employees who were laid off during the pandemic are sent back to work.

Related: Want to learn how to save money on software during COVID? You can watch our video on how to save money during a pandemic.

As you can see, a lot can happen in the upcoming year, we may not be out of these treacherous waters just yet, but what kinds of things can we expect without any unexpected turns?

Tentative Return to Work

Many companies are expected to be heading back to work either on a partial basis or in a manner that allows employees to effectively social distance. If companies were not already on the Cloud when the pandemic struck, there was a hasty adjustment period, where companies scrambled to assemble some kind of Cloud infrastructure that would allow them to keep their business running, forcing companies to technologically jump several years ahead. Since a Cloud migration is typically seen as an expensive endeavor, it’s unlikely that going back to the office will result in a complete dismantling of their efforts. So, the Cloud platforms will likely stay, which could easily lead to a more flexible work environment for employees. Many analysts predict that our working situation in 2021 will look more like 2020 than 2019, as those who enjoyed working online will most likely push to remain so. What this means is that companies will now have a global pool of candidates to pick from while also have to compete for good candidates on a global scale with other companies.

Aggressive Audits

The software industry took a definite plunge over the past year, with sales reaching a vicious low when it came to licenses. The exception to this rule of course, was telecom software, with both Zoom and Microsoft’s Teams taking off in popularity. Despite this growth, many software companies experienced significant losses in 2020. This means we will most likely be seeing an aggressive wave of software audits soon. The software vendors also demonstrated significant generosity towards their customers during the pandemic, with free offers, customer packaging, and a hold on true-ups and negotiations. However, their generosity will be coming to a close soon, so it is important you clean your profiles of any programs whose free trials have expired and get started in preparing to meet a far less generous software vendor during your next true-up.

Related: Don’t let the software auditors catch you off guard with our Software Audit Checklist

IT Security Threats on the Rise

The swift migration to the Cloud during the beginning of the pandemic resulted in a lot of hasty constructions of the cloud infrastructure, basically, they just needed the bare minimum to get going. What this has left us with are platforms that may not be the most secure. Think of all the businesses that couldn’t provide their workers with their own unique devices and those employees were forced to use their own laptops, which may easily be dated or perhaps already burdened with barely contained malware. It is suspected that 2021 will see cybersecurity being one of the many daunting challenges companies will have to face, such as an increase in Ransomware attempts, phishing, and IoT attacks will all increase as businesses struggle to protect their new cloud environments.

Related: Protect your Software Environment with our article, How SAM Can Improve Your Cyber Security

Get Ready for 2021 with MetrixData 360

2021 is upon us and as we leave this awful year behind it is important to keep looking ahead and prepare for the worst but hope for the best. Nothing prepares you better than having a software environment that is organized and under control. At MetrixData 360, we provide our customers with the ability to sleep easy at night, knowing their software environment is compliant and cost-effective.

IT Security Threats on the Rise

How To Prepare for a BSA Software Audit

Posted on November 6, 2020June 5, 2024 by Mike Austin

Receiving a BSA software audit can be just the thing to ruin your day or your month. The Business Software Alliance (BSA) is an industry trade group that acts to defend its members, including large software corporations like Microsoft, from copyright infringement. They are also the top advocate for technological innovation.

The BSA’s software audits are a special kind of painful, and MetrixData 360 has just the remedy for that type of pain. Having spent many years in the software asset management industry, we’ve been able to get our clients out of the stickiest situations. So, let’s talk about BSA audits and how you can prepare for one.

What Is a BSA Software Audit

Software audits are the review or analysis of a piece of software to ensure several different regulations are being properly adhered to. The reasons for instigating an audit vary, but include:

- Checking Compliance
- Ensuring that the piece of software is working properly
- Investigating the proper configuration of a piece of software within an environment

Generally, software audits form an excellent stream of revenue for software vendors, since compliance gaps are often resolved with the purchase of more licenses to drive up the vendor’s sales and market value.

Having a strong defense for software audits is critical to ensure that you are not left paying out millions of dollars in unneeded fines.

What Causes a BSA Software Audit?

Regular software audits from a software vendor occurs for a variety of reasons.

Their revenue has taken a sudden dip and they are trying to make up for the losses
Your company has gone through a merger and acquisition, and it’s likely that your software licensing environment is messy after the move
Random selection, some software vendors issue routine software audits on a regular basis regardless of whether their clients have shown any red flags for compliance issues. There’s little you can do about it just being your turn.
You have rolled back on purchased licenses suddenly and without explanation
You have gone through a software audit before and the results revealed a huge compliance gap. The software vendor will assume you’ve fallen back into old habits.

Related: Avoid inciting an audit. Check out our article:
How to Avoid Software Audits

However, the thing that incites a BSA audit is a little different.

The BSA has telephone hotlines and radio stations where they encourage disgruntled employees and vendors to make anonymous reports and complaints about companies in violation, regardless of size.

These informants are further incentives by the potential of a reward for any leads into instances of the unlawful installation of software.

Of course, the BSA will consider any installation without a proper receipt or proof of purchase as an unlawful download. For each report, the BSA will decide if they will request a self-audit or if they will go straight to a lawsuit but usually, they will ask you to conduct a self-audit first.

A self-audit will give you the chance to run your own internal resources and use your own software audit team to compile your defense.

The Tools and Process of a BSA Audit

Since the BSA audit will be a self-audit, you will be allowed to use an internal staff or a third-party firm to gather your relevant information, which will include proof of purchases or receipts for all the versions of software and all the computers that you have in your software infrastructure. Make sure you pay close attention to this collection phase, since the BSA may mark free versions or old versions of the software as unlicensed.

The BSA may offer you software tools in order to collect the relevant data, but these free discovery tools may easily miss critical information. They may mark free or test/dev software as fully licensable or they may fail to accurately capture the intricacies and uniqueness of your software environment.

When in doubt it’s always best to use your own software inventory tools.

Related: Want to learn more about SAM tools? Get started with the basics:
What are Software Asset Management (SAM) Tools: Functions, Advantages, and Disadvantages

What Are the Fees Associated with a BSA Software Audit

The most worrisome difference, and the one that is on everyone’s mind, is the price tag associated with the BSA audit.

A regular software audit is sent out by the software vendor on a systematic basis to their customers to ensure the proper use of their software. They usually send you one of two types of software audits: a review or an audit.

Reviews are voluntary and the only payment you have to make is the purchase of the licenses you are found to be owing.

Official Software Audits are distinctly not voluntary, and if you are found out of compliance to a significant degree (every software vendor is different but for Microsoft, you only need to be out of compliance by 5%) you will be asked to pay for the missing licenses, along with additional fees, and you will be burdened with covering the expense of the software audit.

Those are the two types of fees you can expect when the software vendor audits you. When the BSA audits you, it’s a whole different story.

When the BSA audits you, they will expect you to perform your own internal audit and provide them with the results. After receiving your findings, the BSA will fine you based on any illegal duplications or unauthorized use. This may be difficult to prove and, in some cases, even something like a proof of purchase will not be enough to satisfy the BSA standards. If that is the case, the fee can be staggeringly high — up to $150,000 USD per infringement, which is a reeling sum, especially for smaller businesses.

What Should You Do When You Receive a BSA Audit Request?

Respond

While one must be always worried about legitimate claims from untrustworthy sources, if you can affirm that the letter does in fact come from the BSA (and feel free to verify it with a lawyer), then it is always best to respond.

Even if the only thing they are asking for is a self-audit, refusing to comply will result in the BSA escalating things straight to litigation. If you were to refuse the demands of the BSA, it will make it look as though you have something to hide and will send a red flag to your software vendors.

Ensure Confidentiality

Set up a confidentiality agreement between yourself and the BSA, this will determine the scope of BSA’s investigations and will limit the BSA’s ability to use the data you provide to them in court. If they provide you with a NDA to sign, make sure to read it carefully to ensure it protects your own rights as well as that of the software vendor.

Start to Gather all the Relevant Material

You’ll need to compile all the data that will be required for this self-audit. This will probably take about 3 to 4 months to gather completely, depending on the size of your software licensing environment, so it’s best to get started early.

The types of things you’ll be gathering are:

List of software products that are part of the BSA membership that have been installed as of the date the BSA letter was issued.
Proof of purchases — usually an invoice will be fine when it comes to the BSA.
A list of your software inventory

How to Handle Software Audits with Confidence

Software Audits are no one’s cup of tea, and when it comes to the software audits that the BSA dishes out, they tend to come with an extra dose of difficulty that can leave many companies stupefied.

Being stuck paying out millions of dollars in fines that you don’t owe is hardly an ideal scenario and, what’s worse, is that it is completely avoidable. There’s a way to get around this.

At MetrixData 360, we know how to deal with these types of audits and we have defended our clients in the most challenging times. If you’d like to learn more about MetrixData 360’s approach to audits, you can download our Audit Defense Procedure for an in-depth step-by-step look into handling an audit.

Windows Server Licensing Explained

Posted on November 2, 2020June 5, 2024 by Mike Austin

Windows Servers licensing is not an easy concept to wrap your head around. Next to SQL Servers, it is one of the most complicated licensing models Microsoft has to offer, perhaps one of the most complicated licensing models period. It might be as entertaining as watching mud dry and as complicated as today’s political climate, it can be mastered with the right tools at your disposal.

At MetrixData 360, we specialize in the toughest licensing that software vendors can offer, even software as complicated as Windows Server. So, we thought we would go over some of the basics you will need to know when ensuring compliance with your Windows Server licensing.

What is Microsoft Windows Server?

Windows Server is an enterprise-class server operating system, with the purpose of sharing services with multiple users and providing administrative control over storage, applications, and corporate networks. Since its release in the early 2000s, Windows Server has served as a critical element in the software infrastructure of many organizations to this day. Among the current Windows Server editions, each has its own slightly different licensing metric. Due to the nature of these servers, it can often be quite difficult to license them and to ensure one is properly licensed.

Types of Windows Servers

Windows Server Essential

Ideal for anyone anticipating eventual mobility into the cloud, this server has built-in integration with Office 365 hosted services.

Windows Server Essential follows a Speciality Server licensing model, meaning it is licensed per server. The upfront cost for Windows Server Essential, which is significantly lower than the other models, is the majority of what you will have to pay for the server. It’s priced as such because Windows Server Essential is unique in that there is no need to buy additional users or device Client Access Licenses (CALs) after the initial purchase. Instead, the server has a cap limit on the number of users and devices that can access it.

Customers can choose between using up to 25 named user accounts or installing Windows Server Essential on no more than 50 devices. For this reason, it is best suited for smaller companies that have minimal anticipated growth over the next two to five years.

Windows Server Standard Edition

Proving the happy medium between Essential and Datacenter, Standard Edition offers a solution that is similar in function to Datacenter but is closer to the cost of Essential, making it suitable for a medium-sized company.

It offers the ability to run two virtual machines, along with fully integrated services and direct access for users. It follows a core-based licensing model and requires CALs. Due to this fact, purchasing a Standard edition is a little tricky, since you must purchase 16 cores per server and you will also require additional purchases if the number of cores per server is greater than 16. If a business requires more virtual machines than the two offered by the Standard edition, then the Datacenter edition should be considered.

Windows Server Datacenter Edition

The most advanced and expensive of the Windows Servers, the Datacenter Edition offers the ability to run an unlimited number of virtual machines and can effectively meet the demands of large enterprises with larger IT infrastructures. Just like the Standard Edition, the Datacenter Edition follows a core-based licensing model. The greatest drawback of the Datacenter Edition is its cost, which is roughly eight times the original price of the Standard Server.

What is a Core-Based Licensing Model?

If you have Windows Server Standard or Windows Server Datacenter editions, then you will have a core-based licensing model. A core-based licensing model means that the number of licenses that you need is determined by the number of server cores inside the number of processors.

This type of model was introduced in 2016 with Windows Servers, and this was done in order to provide a more consistent licensing metric across Cloud platforms and to allow for easier cloud mobility.

The three basic rules that you must adhere to with the core-based licensing model are as follows:

Every processor must be licensed to cover a minimum of 8 cores
Every server must be licensed to cover a minimum of 16 cores
All physical cores in a server must be licensed

When adhering to the core-base licensing model, you will need to first have a base license that covers 16 cores. if your server has more than 16 cores, any additional cores will require additional licenses. All additional licenses come in increments of 2, 4, and 16 cores. Additional licenses are also required when using more than two virtual machines (VMs) on a Windows Server Standard edition.

No additional licenses are required for VM’s that are run on Windows Servers 2019 Datacenter. Should you be running an application on the Windows Server such as a SQL Server or an Exchange Server, then the general licensing rules for the server application must be applied.

Related: Trying to get a handle on your SQL Server licensing as well? Check out our article: SQL Server Licensing Explained for a deep dive into Microsoft’s most complicated licensed product.

Client Access Licenses (CAL) and Remote Desktop Service (RDS)

After you have your cores figured out, you will need additional Client Access Licenses (CALs) to cover every user or device which connects to the server. CALs are distributed based on unique persons, described as users, or devices. It should be noted that depending on whether you choose to license per user or per device can greatly influence the overall cost of your licenses.

CALs can be considered keys, in that every person or device will need their own separate key to access the server, which will require its own license in the same way that a door requires a key for its lock.

CALs come in packs of 1, 5, 10, or 50. Once a user or device is given a CAL, they will have access to any Windows Server of the same edition or lower, so long as the server software is running on Customer’s Licensed Servers.
For example, a user with a Windows Server CAL 2012 may access a Windows Server 2008 edition or a 2012 edition, however, they could not access a Windows Server 2016 edition. Mixing and matching Window Servers and CALs can become quite confusing and you should consult a licensing expert before configuring your licenses in such a manner.

Remote Desktop Service (RDS) CALs, previously known as Terminal Services, will also be needed for users or devices who wish to access programs or full desktops remotely. Both a CAL and an RDS will be required for remote desktops, with the only exception to this rule being if two users or devices are accessing a server software but only for administrative purposes in which case there is no need for either a CAL or RDS. An RDS will allow the remote access of applications for a wide range of devices and network connections.

Windows Servers in Azure

Microsoft’s cloud platform, Azure, has adopted the ability to license Windows Servers in its own complicated manner. There are many different ways to license your Windows Servers in Azure including but not limited to:

Building Windows Servers directly into Azure through the use of Azure virtual machines: this can often be an easy solution to implement, but an expensive one, as the cost of Azure virtual machines will simply be added to your overall cloud spending, which can certainly accumulate without proper regulation to limit rampant spending.
Hybrid Benefits: considered the new way to license, although, you will need to use your own activation method such as a KMS Server or a MAK key.
A License in Windows Server Cannot Move within a 90-day Period: it is important to note that license mobility and SA benefits do not apply to Windows Servers.

Virtual Machines and Windows Server

Simply because a server is only virtual, it does not remove the need for a license, as virtual instances of Windows Server must be licensed under its host, and the host license must account for virtual machines.

In the scenario where clusters of virtual machines are free to move between hosts, all potential hosts must be licensed as if they were the current host. There is no need to count the host operating system or provide it with a license as long as the operating system is used only as the hypervisor to run the virtual instances.

The exception for this scenario, of course, is Windows Server Datacenter editions, where each host only needs to be covered with 16 licenses, this will give them the right to unlimited virtualization.

Stacking licenses is the practice of using multiple Windows Server Licenses, either Standard or Enterprise, in order to properly license multiple virtual machines over multiple hosts.

It can be quite difficult to figure out the correct number of licenses to fully cover a virtual server, however, when this limit is reached the licensed host is considered licensed for capacity; the same is applied to a host or cluster which is described as licensed for capacity when it has a finite number of virtual servers allotted to it.

Related: Want to Learn More about Virtual Machines? Check out our article: All About Virtual Machine

Need Help With Your Windows Server Licensing?

Windows Servers are critical elements to your software environment; however, their usefulness shouldn’t be tempered by the difficulty surrounding their licensing. Having a strong understanding of what you need to buy and how best to buy it will give you the confidence you need when confronted by Microsoft’s sales reps.

At MetrixData 360, we specialize in difficult licensing structures, the likes of which would leave most people’s head spinning. Our licensing experts thrive in the most challenging of scenarios, and our SAM Tool is equipped to quickly handle the most complicated of Windows Server licensing scenarios.

If you would like to learn more about our services and how well we can help you license your servers in a way that can save you money while keeping you in compliance, you can check out our tool page using the link below.

What is Active Directory (and how to use it to save on Software Licensing)

Posted on October 27, 2020June 5, 2024 by Mike Austin

What is Active Directory? The Active Directory is an extremely popular directory service used by the vast majority of Fortune 1000 companies in the market today. It is also perhaps one of the most critical elements within your software environment, so knowing what it does and how it can benefit your efforts in taming this unruly technological beast that is your software environment is essential.

The Active Directory can be a confusing place. However, at MetrixData 360, we often find ourselves working with our customers’ ADs and we know how overwhelming an experience it can be without the proper assistance or knowledge.

We know how an Active Directory works, and we know how to make it so that it can assist you in your software asset management efforts.

So, in this article we will examine the Active Directory tool: what it’s used for, how it works, and how it can be used in software asset management.

What is the Active Directory?

Active Directory is a feature of the Windows Server Operating System and acts as a critical element in many companies’ software infrastructure. For a Windows-based environment, almost all applications and tools are put through the Active Directory to allow for authentication and directory browsing. The Active Directory is broken down into two parts:

The Database:

The database is also known as the directory, which is comprised of the most critical info about your environments such as users, groups, their passwords, their computers and their licensing restrictions and their permissions (e.g. You can allow all employees to see your company benefits but only permit the financial team to modify the document).

The Services:

This controls all the activity within your IT environment. This is meant to ensure that everyone is who they say they are, ensuring passwords and ID are correct and limits user access to certain information (authorization).

You can see how critical an active directory is to a software environment and you can also imagine that stability, availability, and security must be a top priority for Admin staff regarding the Active Directory.

How Does Active Directory Work?

While you could write a small book about the inner workings of the Active Directory, to put it briefly, it does not benefit a company to have their computers operating independently from one another: there needs to be an element of connection, with the ability to share information while simultaneously controlling access to sensitive information that should only be viewed by authorized employees.

If all this information is stored in a central location, it can greatly improve productivity. Picture the AD like a phone book, matching names to numbers and locations (although that is only one of the things AD organizes). This pool of data is arranged hierarchically. AD has a few main structures it relies on:

Domain: Any related group of users, computers or other objects, there are also sub domains or Children of top domains, which may act as smaller groupings within the Domain.
Trees: Multiple Domains grouped together
Forests: Multiple Trees grouped together
Schemas: Definitions of all the objects which are used to make sense of the storage systems of every forest.

Active Directory in the Cloud

With the vast majority of modern businesses existing now in the Cloud to some extent, IT professionals may be wondering about how their Active Directory will be able to effectively translate to this new environment or if it will even survive the move.

Sadly, the Active Directory cannot easily be transferred to the Cloud despite the growing popularity of Cloud solutions among the IT department. This is mainly due to the fact that the Active Directory was first published in the late 90s, where the main goal was simply to get every office worker a computer.

The Active Directory helped to ensure that these computers were controlled and monitored under one system. While it may be difficult to move your Active Directory from on-prem to the Cloud, there is also the available counterpart of Azure Active Directory, which allows users that same level of control over external resources (Microsoft 365, Azure portal and similar SaaS applications) and internal resources (applications on your organization’s intranet and cloud apps developed by your own organization).

A basic version of Azure AD is available as a free feature to those who are subscribed to any Microsoft Online business service, with more premium versions requiring licenses.

Related: Moving to the cloud can be a costly occasion.
Here are a few hidden costs you should be aware of!

Active Directory and Software Asset Management

Because so much is stored in the Active Directory, many companies let their Active Directory become disorganized, and some companies do not allow easy access to their Active Directory.

The Active Directory, as a result of this lack of upkeep, could have large amounts of data that is dated and a record of assets that have long since been retired while still seeming as though they are in use. Despite this disorganization, the Active Directory is one of the first places that the software auditors look to when conducting an audit.

They will take the information stored in the Active Directory and build a compliance gap based on that information. This is why having a clean Active Directory that is up to date and comprised of only assets that are currently in your infrastructure is important if you want to avoid unwarranted auditing fines.

Your Active Directory also allows you to have a clear picture of all your assets in one place and as such can prove a valuable tool in your software asset management efforts.

At MetrixData 360 we often consult our clients’ Active Directory when we first begin cleaning up their assets. This gives us a starting point for what assets need to be hunted down, and what assets can be cleaned up.

Related: Ready to Get Started on Software Asset Management?
Check out our Beginners’ Guide to Get Started!

MetrixData 360 Active Directory Reporting Tool

Having a clean Active Directory is imperative in your efforts to keep your software environment organized and ready for whatever this tumultuous year can throw at your business.

At MetrixData 360, we have created our own tool to help with the difficult task of cleaning up your Active Directory. Our Active Directory Reporting Tool is specifically designed to be adjustable, scalable, quick, easy, and safe to use. Our clients have found our tool valuable in its ability to complete months of work in seconds.

An accurate depiction of what you have, what you need and what you don’t is at your fingertips with our Active Directory Reporting Tool.

For more information about what our Active Directory tool does, and to see it in action you can check out our Active Directory reporting tool page.