Vista: CIOs' First Impressions

The enterprise version of Windows Vista is now available, but many companies will not immediately discard XP and upgrade to Microsoft's latest operating system.

That's the consensus of chief information officers and consultants who have been evaluating Vista in recent months. Most big companies will wait at least a year before deploying Vista to make sure the operating system is stable and that third-party applications work well with it, the beta testers say.

Five years in the making, Vista is, among other things, Microsoft's attempt to address the security holes in its previous operating systems. By adding features for blocking unauthorized Internet downloads and automating encryption of hard drives, Microsoft hopes to curtail the viruses plaguing corporate XP users and mitigate the impact of laptop theft.

"It's certainly the most secure operating system they've released to date," says Erik Schmidt, a technical manager at the University of Florida, which has been evaluating Vista on more than 50 PCs as part of Microsoft's Technology Adoption Program.

Robert Taylor, chief information officer of Fulton County, Ga., says Vista's user account control feature, which administrators can use to prevent the installation of unauthorized applications, will allow the county to cut back on the 24,000 hours it spends each year cleaning up infected machines. That will translate into about $750,000 in cost savings, he says.

Of course, with the final version of Vista Enterprise Edition just now out the door, relatively few users have had a chance to test Vista's security features in the environments where its flaws would be most costly. "I have a trust-but-verify posture," says Matt Miszewski, chief information officer for the state of Wisconsin, who oversees 64,000 desktop systems. He says it would be a mistake to believe Microsoft has solved all of its security problems.

One security enhancement in Vista that may be complicated to use is BitLocker, which encrypts the contents of a hard drive so that a stolen laptop can't become a source of pilfered intellectual property. BitLocker's policy of looking for changes in a PC's Basic Input/Output System—the code run by a computer every time it's booted up—may occasionally activate the shutdown mechanism when it isn't needed; for instance, after a systems administrator has upgraded the hard drive. BitLocker "is a very good idea," says the University of Florida's Schmidt. "But it can be dangerous if you don't know what you're doing."

Microsoft declined to make an executive available to answer specific questions about Vista.

Next page: Changing the Rules of the Game