KACE Systems Management Appliance (SMA) Reviews

We are a small university of 10,000 students with 1,000 faculty and staff. We have to manage about 3500 computers spread over 3 sites.

There are 2,000 computers available for students. The rest are for staff, including 700 laptops.

Student computers are completely redeployed during the summer break, unlike staff computers which are redeployed during their replacement (every 5 years).

We use KACE SMA mainly to deploy software and security updates. We also use KACE to manage our assets and create monitoring reports.

We were using an end-of-life solution with limited software deployment management capabilities, as well as WSUS to deploy security updates. The asset management was done in an in-house tool that was also end of life.

With KACE, we were able to have a simplification of the software deployment management with more granularity and flexibility.

The use of replicas allowed us to relieve inter-site links during massive computer deployments or security updates.

The ability to create reports is also a plus that allows us to track the life of our computers.

On a single page I can have access to the hardware information, the status of the warranty, the associated support tickets, the installed software, the software waiting to be installed, the last user connected, the accounting information, the date of purchase, et cetera. It gives us the ability to create our own indicators by using customized inventory rules.

We can also create our own indicators thanks to personalized inventory fields and thus bring up very targeted information, including the state of Windows activation, the number and model of connected screens, the power supply scheme used, the presence of a file, et cetera.

What could be improved is the possibility to use replicas in a secure way outside our network in order to maintain the machines that never connect to our corporate network.

The helpdesk could also improve, although it has evolved a lot on the last versions. It does not meet the moment for our needs.

What could be interesting when deploying larger software or software to many machines on a remote site would be to be able to do it P2P in order to accelerate the local deployment and not to load too much of the inter-site links.

I've used the solution for ten years.

When you have a large number of computers, the price starts to become apparent. 

The use case is for organization server patching, and we also use the asset management in a smaller capacity.

For what I use it for, the solution provides a single pane of glass with everything I need for endpoint management of all devices. For the most part, it lowers the amount of time required for manual intervention. It gives me more time to work on other projects instead of consistently worrying about patching. Per week or per month, it's saving me a good five hours.

One of the most valuable features is that it natively patches third-party applications and not just a core operating system.

It's relatively easy to use and most of it is pretty intuitive. They've made things a little more involved now with the agent token that needs to be used. That means installing it from a server, from the share, is not quite as simple as it used to be, but once you know how to do it, and that it's something that has to occur, it's really not a problem.

It enables IT asset management, compliance, software asset management, mobile device management, and patch management, although we don't utilize the MDM. That's mainly due to our security requirements. But the IT asset tracking is a big segment.

And the software asset management has been a big help, even when it comes to license true-ups. I can use it to find out how many Tivoli we have, and boom, there's the number. Even if it's reporting a number that might be a little higher than what it actually is, because it's looking for one component, it gives you a good first first-hand look. As a result, we know there's something out there and this confirms we've got five of them. And you can actually click on the information about the software and it shows, for example, that these five servers are where it's being reported. If you really want, you can log in to them and validate. We have used that quite a bit.

Another segment that has really helped out is where you go in and actually use the distributions. We might have a situation where we need something installed on all 237 servers by tomorrow. I'll just go in and do a managed installation and have KACE push it out. So far, that's been pretty successful. I wish it had a little bit more ability to allow me to put something in there without saying, "Okay, we're already aware of this software. What file do you want to use?" It would be nice if it let me type it in and prompted me, when needed, saying, "We've already found that. Do you want to use this one? Yes or no?" But it hasn't kept me from accomplishing what I intended. Overall, the distribution is a pretty nice feature.

My biggest complaint is that almost every time they send out a new version, it fixes something and breaks another. Something that wasn't working in the last version now works, but something else stops; or they'll remove some dashboard that I really found to be nice and replace it with something totally different that I could care less about.

Another example of this would be that there is a set of agents where the communication between the agents and KACE is very consistent, and the patch numbers are very good. And then there will be a new agent which they say fixes this, this, and this. But then, all of a sudden, my patch numbers go down and the communication isn't as good, or they're timing-out more.

An additional instance of this is that it used to be, when you were patching, you would see how many succeeded and how many failed. You would also see which patches had failed and had reached the maximum number of attempts. Connected with that, there used to be a "reset tries" feature and that was nice because you could actually reset the attempts and KACE would try those patches the next time. Now, although "reset tries," is still there, it's grayed out. It doesn't function.

It affects usability because every time you upgrade, you don't really know what you may be getting yourself into. I wish they'd be a little more consistent and make sure it's only getting better, rather than their saying, "We had 15 known issues in the last version. In this new version, we're offering these new things, but we've still got 15 known issues."

The installs are generally very easy. You just say, "Okay, go ahead, upgrade," and they seem to run fairly smoothly with no problems. It's just that after you've done them, you have to see what is working and what's not working.

I have been using Quest KACE Systems Management for five years.

On the whole, the stability is good. Once it's up and running, it just pretty much runs. There aren't really system crashes or anything of that nature. It's a solid system that really does not encounter failures of the system itself.

Scalability is available. I have not experimented much with some of the options. For example, you can have a system at this site and have another site that doesn't have an entire KACE, but just a file share where KACE can put patches as well. Instead of servers at that site going all the way to your primary site, they just pull the patches from that local repository. Theoretically, that helps. So it can be scalable if you so choose.

In our environment we manage 237 servers. 

Their technical support is good. They're very prompt. Quest has been very quick in responding to any support cases or questions. And most of the time, the answer is very straightforward and easily executed or easily understood.

Positive

We did use something that KACE replaced, but I don't even remember what it was.

SCCM is what we use for workstations, but not for server patching. We do have WSUS (Windows Server Update Services) running as a backup in case we want to use Windows Update. We do have other options available, but for servers, KACE is the primary patching system.

I was involved in the initial setup and I found it to be relatively easy. It was pretty intuitive and straightforward.

Bringing it online to the point that I could log in took 45 minutes to an hour, and that included making sure I had DNS records so that the URL was resolving, and putting in the IPS and gateways, et cetera. All of a sudden, boom, it was up and running. 

After that, it was a matter of making sure that patches are actually downloading properly, and that the agent installs are checking in and everything is working properly. So getting it all tuned and set the way we wanted took two or three months, but the initial "it's technically functioning" was just two or three days.

We have realized a return on our investment with the solution. We are more stringent than the NSA as far as security goes. We run weekly security scans on our systems and we're consistently bringing in third-party organizations to do red-team tests where they'll try to hack in and do a lot of things to test us. Since Quest KACE Systems Management patches not just the operating system, but can also patch third-party things like Java and Wireshark if an update is detected, overall it handles everything that's detected. If possible, it will attempt to patch it.

The cost of KACE has been relatively low compared to other systems. Even if those systems have the same cost, they do not do as much of the third-party patching that KACE natively does. With a cost of less than $4,500 a year, it's been very good.

The pricing model is fair and fine. I wouldn't change anything about that.

We looked at SCCM and Qualys.

One of the reasons we went with KACE was cost. 

Another was that it patches third-party applications natively. Certain systems tend to need native operating system patching only. You can download something like a Java update and then "package it" for installation. But with KACE you can say, "If you find it and it's critical, recommended, not superseded, and it's detected on our system, download it and patch it." It's nice that it's doing third-party apps and not just the operating system.

If you're considering KACE for a large environment, come up with smart labels and patching schedules that are going to fit the number of systems that you have. The scheduling really comes into play, especially now with Windows having bundled patches. As a result, you're downloading a 1 or 1.2-gigabyte file to update the server, versus between three and seven 2 or 3 or 5 megabyte files. When there were multiple files, even if two of them didn't get uploaded, the other three did. If this one large file times out, it just does not patch. So scheduling the time to stage those and deploy on a different day is really important.

I wish we had the ability to use the mobile asset tracking and bar coding. Those are things that have been a real void in our organization. At least we are utilizing KACE for the servers and we manually input barcodes or serial numbers. Having the option to use a KACE app to input that information is nice and would save a lot of time. 

We Primarily use KACE as a diverse deployment and management solution. 

Our environment includes multiple locations, so having a single point of deployment for automation/patches/software/scripts and response management is ideal. 

We work in the banking industry, so having this single point and not having to worry about security is enormous. We have to go through multiple government security audits a year and our auditors are always blown away with our KACE environment. We need KACE to keep our organization going.

Previously, we were working with upwards of 200 different applications and tools, the amount of compatibility issues and clutter was unbelievable. One update on one application could ruin a whole environment at times. Thank goodness we found KACE to consolidate our environment and really cut down on resources! 

They've saved us so much time and money it's unreal. They have so much flexibility in what you want to configure or script. In some of my deployments, I've built entire applications on KACE to work with, while in others I have small built-in batch files. The only thing that limits KACE is your imagination.

The ability to build scripts right on the deployment center itself, as well as building groups that take those scripts/task chains has been absolutely invaluable and one of the most important parts of my whole environment. Without it, we would need to hire at least six to seven more employees to do what I'm able to do myself with those tools. 

On top of this, they have multiple forums that are super active. I've gone to tech support, ITninja, and even Reddit. One time, I asked a question on the KACE subReddit on how to improve a function and a KACE team member responded in five minutes. That's honestly unheard of for a company like this.

The GUI needs some work. I love all that it can do, however, it can be just be so cluttered at times. I wish we could see them spend some time improving the interface.

Sometimes when I run certain functions or need to do a one-off massive deployment, it lacks in "mobility". It can be a pain, having to go back a page and re-type in all the same information in the "run now" tab when I have a whole bunch of one-off situations. It's not like I can't do what I need to do, however, I seem to just spend more time than I'd like having to type in the same information over and over.

I've used the solution for the past five years.

In all the years we've had this product we've never had a stability issue.

The solution can scale. The product can be a help desk ticket system, all the way up to the entirety of your virtual machine environment - making updates and changes at a click of a button.

They take their role in support extremely seriously. We don't have to reach out too often due to the lack of problems, however, when we do, they respond within an hour or two at the very longest.

Positive

We did not use another solution. Once we got KACE, I just don't understand how we held on for so long without it.

We had a vendor assist us so that we never had a single hiccup during the entire setup.

The vendor was, without a doubt, an expert. We assisted and learned everything they could teach us.

We had ROI about a year into this and have saved so much ever since.

If your team is small like ours, I highly recommend working with an install vendor. For us, it wasn't as much a technically challenging thing to implement as much as what the vendor showed us during setup and installation that was just so helpful. With their help, we were able to hit the ground running and had much less of a learning curve.

Other options were discussed however, it was so long ago I can't recall what they were.

I would say start by looking at all of the services/products that KACE offers - don't feel overwhelmed as they will integrate very well with each other.

The primary use of this product is for our user support (help desk).

Kace has helped us integrate all of our IT needs from inventory to imaging. Having this appliance to do everything automatically and push out software is a plus. Summer tasks are so much easier with imaging across the network that requires almost zero technicians intervention.

Managing 3,000+ computers across our campus from one single solution has made our life (and work) so easy. We are able to respond to the needs of our users always and can look into the history of the devices or the KB created to self-serve our users.

Our computer Inventory became more accurate, and computers were rolled out faster. Our techs adapted quickly to the new service desk, and the users can now check the status of their ticket by login into the user portal. 

As we plan computer rotations, having an accurate inventory is a key to identifying computers that are end-of-life or out of warranty. KACE can provide all of the necessary information by simply running customized reports that in turn can be provided to individuals or departments, either on-demand or on an automatic schedule.

Asset management, inventory, reporting, and service desk features work together and they are very valued in our daily operations.

When a user creates a ticket, users are in a continuous loop of communication via the service desk, user portal, or email. We are now able to set tier levels and involve other areas within IT, networking, sysadmin, VOIP, or managerial for approvals.

The service desk can be configured and customized to better serve our environment. If necessary, additional queues can be added.

There is always room for improvement. An example will be the implementation of granulated permission to run Scripts. We often find it unnecessary (and dangerous) that all technicians can see/run all the scripts created by our institution. Ideally, a Manager could assign some scripts to certain levels of support. 

However, the system does most of what we need at this moment.                                          

KACE has a website, "Use Your Voice," where users can make suggestions to improve the product or add new features. This offers a great way to improve the system.                      

KACE recently added Windows Feature Update patching to SMA. That was a considerable improvement to keep end-points secure, as many users were asking for it. 

SMA was implemented in our institution in late 2008.

The stability is great, initially was running on a physical server, and recently migrated to a VM, both environments are very well-built.

Support was always provided a fast and accurate response to our questions, issues, or even helping us implementing new system upgrades

Positive

n/a

The setup was straight foward, and a dedicated support team was on the line while we implemented and set up the system. KACE included a follow-up online training to guide us and have the appliance up and running within the first hour.

We've seen ROI in less than 6 months.

We also looked into TrackIT.

We use KACE for patching. 

I am impressed by the service desk ticketing and asset management.

I've had some issues with patch catalogue, which seems to have expired. Quite a few people have reported that they are struggling with it.

I have been using Quest KACE Systems Management for three months now.

The program is very stable.

We only have three people using this program in our company, but I believe it is scalable. I don't think we will increase our usage soon, though.

The technical support is good.

The initial setup was quite complex and I really struggled. It took me around 15 minutes to complete the setup, because it was a trail-based version.

I rate this program an eight out of ten. I will recommend it to others because it is simple and understandable.

My primary use case of this solution is to help us obtain accreditation in the UK of Cyber Essentials Plus. It is a program that is sponsored by the UK government which encourages UK companies to obtain a certain level of cyber-security within their cyber environment. The Quest KACE product helps us get an overview of all IoT(Internet of Things) devices that are accessing our environment.

The most valuable feature is the ability to have an overview of all devices that are accessing our environment.

I think it should have the ability to have the applications automatically update. It would be really helpful if this would override what the user might choose to do.

The initial setup was straightforward. There were some excellent step-by-step instructions sent to us. The instructions were also accompanied by videos, which were very informative.

It was a very attractive price. This is a huge feature of this product. If you would "credit score" this product versus others out there on the market, this one has a very attractive price.

We also looked out VMware Airwatch and MobileIron. But, we chose KACE. It just made more sense for us.

Our primary use case for using this product is as a ticketing solution. 

This product made the job easy to do without having to go put hands on the machines.

I love the integration with Bomgar. It really helped a lot.

The way we were set up, we had multiple campuses across multiple counties. And even with just our downtown campus, you're looking at fifteen different buildings, a hundred different classrooms, and offices everywhere. So for us, the ability to push an image to a machine, wake that image up, and just blast a new image to a computer without even having to touch it, and then push the software to that machine. This just made things so much more convenient for us and so much more efficient than having to go find that machine, pull that machine out, take it back to the shop, and repair it from there.

Just having those tools made the job so much easier and so much more efficient. But they really just don't need the people that they used to have ten years ago.

The biggest problem we had with Quest KACE, with the K2000, imaging becomes a problem when you start to try to go beyond doing more than thirty or forty machines at a time. We initially tried to do that virtually and it just, it wouldn't work.

But that one physical appliance was enough to get us through and once we got the one K2000 physical appliance that was plenty to handle imaging whatever we needed. As far as the K1000, our original purchase was underpowered. We really didn't have the box we should have had for over three thousand nodes, but when it came time to upgrade that box, we got a box that was much more in tune to having over three thousand nodes on that system and it's been doing fantastic for almost three years now. We haven't had any problems.

Overall, the stability has been pretty good. We we were using the Quest KACE on the front end, and then we had a Samba share on the back end that we were using for storage for all of our imaging and for all of our software. There were some issues with how we were doing things on the Samba side versus how they were connecting that to the K box, so there was some issues, but it wasn't anything that was Quest KACE's problem and Quest KACE has done everything that could possibly do to help us work the bugs out. But ultimately it was mismanagement on our end of people not knowing what they were doing and how they were supposed to be administrating the box.

It was really just as simple as buying the licenses as we needed it. As far as man power goes when I first started there, there was four technicians doing roughly 3,300 machines.

They were always fantastic. We dealt mainly with one tech support representative, and he was always spot on. We had some issues early on that I guess they didn't anticipate, and we worked closely with Dell, when Dell owned it, to work out some bugs that were huge for Dell. And because we were early adapters, we were kind of like Beta testers for some things that they eventually got a chance to role out to everybody else.  At first, USB imaging didn't work and then we worked with tech support for a while to get that ironed out and once we got that taken care of, it all got rolled into a new update and then it worked. The tech support staff was just phenomenal.

When I first started at my office, everything was done through Novell. At that time, we didn't have the ease of pushing software and remoting into the devices as we did with Quest KACE.

We also used another solution that wasn't exactly secure - it was touted as a secure solution but there had been some issues. It had been hacked before. And we were starting to get into an area where we were having outside vendors ask us for access into our network, so that started to become a concern for us.

It was easy. The team of the company came in, and helped us set it up.

The initial implementation was through Dell. They were excellent.

If the professionals make a recommendation, consider it. Really, seriously, consider it, because there were some things we didn't do with Quest KACE that we should have, and it  really hurt us in the long run. Even going back as far as active directory, there was some things that we didn't do with active directory that we were told by Microsoft engineers that this is what you need to do with active directory. Six, seven years later, we're looking at a network of two hundred almost VLANs. So, implementation of KACE was fairly smooth for us. If we would have done things exactly the way they would have told us to, which would have included flattening the network, like the Microsoft engineer told us to do when we went to active directory, things would have been even more smooth. We wouldn't have problems with wake-on-LAN, we wouldn't have problems with our scripting, we wouldn't have had problems with our SAMBA share. It would have been so much easier down the road to listen to the professionals and do exactly what they suggested we do, but because we had people who thought they were smarter than the professionals, we had some pains with implementation.

Nothing against Microsoft, but everybody I talk to, who has ever dealt with Microsoft SCCM, has ever dealt with Quest KACE. And, in comparison, it's just more user friendly, easier to integrate and it's just such a more elegant solution. It may be more expensive, but you get what you pay for, you know?

We also looked at Spiceworks. A lot of people on our team liked it because it is a free product. They were still working on their whole footing, trying to get everything worked out with that. But with Quest KACE, t had so many other things to offer. You know, with the ability to include the K2000 and K3000, which interested us.

The only hiccups we had were some power issues, where the box was a little under-powered early on. But, as far as having instances of bugs, or anything like that, the box ran great, as long as we left everything alone.