The Customer
Thanks to the people and systems of Essex Police, the county of Essex is one of the safest areas in the UK. Their community-based approach to policing demands a high degree of cooperation with other bodies. National pressures on increasing front line staffing “on the beat” mean that Essex Police are continuously looking at how to maximise the performance of their systems and software assets to save time and money.

Reducing the costs of deploying software and maintaining it across their large and geographically spread IT infrastructure is one such example. Essex Police has around 7000 users, across 4000 PCs.

The Situation
The cost-efficiencies inherent in Essex Police’s investment in the Microsoft® “stack” meant that it was most cost-effective for them to replace their existing enterprise monitoring and management solution with Microsoft System Center Configuration Manager and System Center Operations Manager. A migration programme was therefore initiated with the help of IT partner EACS Limited.
Essex Police is a 24x7 operation, spread across a number of locations from 2 main HQ campus buildings to a range of sizes and locations of Police stations and offices across the county. Network bandwidth also varied depending on office, giving a number of different deployment and maintenance challenges.

Tight timescales for implementation meant that a phased approach would be needed, with the replacement of existing functionality prioritised over new features. At the same time, there was a need to quickly implement advanced patch management capabilities, and replace the incumbent anti-virus solution with Microsoft ForeFront.

It would be impractical to visit the large number of users to work on their machines, so all auditing, removal of existing tools, and installation of System Center clients would need to be done remotely, whilst not interfering with 24x7 operations.

Whilst the project was under way, the project team also faced an unexpected demand when Essex Police’s strategic desktop supplier had to change the motherboard specification on the “standard” PC, which meant a demand of several person-months worth of effort from the same team that had already committed their effort over the remaining weeks to deliver SCCM Phase One.

The Solution
For the solution, Microsoft System Center Configuration Manager was used, in phase one, for software deployment and reporting, hardware reporting, and remote control. Essex Police’s own IT department resources created tools to enhance the operation of the remote control and support capabilities to meet police-specific needs.

The architecture was designed to use a resilient primary SCCM server (on Windows Server 2008), with a second tier of stateless distribution servers (Windows Server 2008), and Windows 7 based branch servers, also stateless, dealt with 45 or so of the larger remote offices. After an audit of the space, power and cooling available at remote sites, these machines were specified, sourced, built and deployed around the county in the preparation phase, over a period of 6 weeks.

This design spread the distribution and network load; around 2000 clients were “directly” deployed in the HQ campus, and after initial monitoring and adjustments, 2000 remote clients were “bootstrapped” and discovered in 5 hours with no noticeable impact on the network. Full deployment of the client reached the target 80% (3600 PCs) in 4 days, with SCCM and its distribution infrastructure automatically managing the “trickle-feed” of clients to discovered PCs, preserving network integrity.

The flexibility of SCCM was put to good use during the first phase deployment. Supply problems meant that three of the secondary servers were delayed, but simply by changing site boundaries within SCCM, the PCs from the affected offices were logically attached to other secondary servers, and the deployment continued unabated.

Potentially more serious was the unexpected need to rebuild, test and regression test two entirely new standard builds (AMD and Intel) for the standard desktops after the manufacturer changed the motherboard, necessitating several driver changes. After some lateral thinking from the team, and consultation with Microsoft, the existing images were reused with SCCM taking care of injecting the correct drivers into the images as alternative drivers, then deploying the images. This preserved the integrity of the bulk of the image, and so vastly reduced the testing overhead. This alone saved an estimated 3-4 person-months of effort through SCCM’s advanced capabilities.

The project was under the time pressure of immovable deadlines, in order to take advantage of license expiry dates. The widespread and 24x7 nature of Essex Police also added risk to the picture, as did the fact that there was not a dedicated project team – team members were also engaged in their “day jobs”. To help manage this, as well as the project plan and requirements, the project was driven by a risk, issues and assumptions log that was updated weekly with the team and key stakeholders. This allowed the SCCM client deployment to conclude two weeks ahead of schedule, and within the budgeted time – even allowing for the unexpected standard PC image update requirement.

Conclusion
By planning the project and managing risks closely, Essex Police and EACS were able to design, build and implement the infrastructure and enough SCCM functionality to replace their previous monitoring and management infrastructure in only 18 weeks. After the initial learning phase, the clients were deployed very rapidly without impacting on day-to-day operations.

SCCM has already saved a large amount of time through the image updating that was possible following the standard PC motherboard change. The reports which are now being generated on client software and hardware are giving Essex Police new confidence in the facts they need to know to make decisions for the future.

Work is currently under way to implement patch management with SCCM, and in parallel, the infrastructure is also being set up to deploy ForeFront anti-virus.

“We knew that we had tight deadlines for what was a major infrastructure project, so to help us through the learning curve, we involved our long-term IT partner EACS to help us deliver the project. We regularly shared information on risks, issues and assumptions as the project went on. By pulling together a team from Essex, EACS and Microsoft, we also made use of bright ideas and lateral thinking to get even more benefit than we expected out of our SCCM deployment.”
Sagar Roy, Assistant Head of IT – Operations, Essex Police.

“Implementing SCCM has given us more confidence in the reporting and management of our IT estate. It also saves us time in managing our standard images. It has given us a robust, flexible and powerful platform on which to build, and we are already implementing further new capabilities compared to what we could do before. As well as saving time, the information we are collecting is helping us make better, more informed decisions.”
Anthony Leadbetter, IT Senior Operations Manager, Essex Police