Pica Communications Licensing NoteVirtualizing IE6 |
Other Licensing Notes in this series:Software Assurance and Virtualization Basics Upgrade Paths for Virtualization
Nov. 22, 2010 By Paul DeGroot This note represents the opinion of the author, who is not a lawyer and does not offer legal advice, and it is not endorsed by Microsoft. Many people appear to be quite confused about using Internet Explorer 6 (IE6) on Windows 7, and I'm a bit confused by the confusion. I agree that Microsoft hasn't been crystal clear about this, but there are ways to legally run IE6 on a Windows 7 machine, and a lot of enterprise customers are already licensed for them. Overall, Microsoft has done a reasonably good, if not always speedy, job in responding to market demands for more desktop virtualization rights, and the main confusion in my mind about the IE6 virtualization issue is why Microsoft isn't tooting its horn about how responsive it is. There are many reasons for Microsoft to try to accommodate IE6 virtualization, since the inability to migrate IE6 applications to Windows 7 is a major obstacle to Windows 7 migration for many customers, and speedy Windows migrations are very important to Microsoft's goal of putting the Windows XP and Vista eras behind it. lnstead of saying that some logical migration and virtualization solutions are unsupportable and illegal, Microsoft would be better served by useful solutions and migration paths, for its own good if for no one else's. The company should not let licensing rules--rules that Microsoft itself writes and can change at any time--stand in the way. Furthermore, a close look at the existing rules and customer use rights appear to support a broader range of licensing options than the company describes, and this note may prove useful in negotiating reasonable understandings with Microsoft that can help both customers and Microsoft move forward with migrations to Windows 7. (Related Pica Communications Licensing Notes, "Upgrade Paths for Virtualization" and "Software Assurance and Virtualization Basics "can be useful for customers who want to act on the advice in this note.) Microsoft's ReasoningFirst, we need to disentangle some of the advice Microsoft is giving customers. A note from Microsoft to customers that Gartner's Neil MacDonald excerpts (at http://blogs.gartner.com/neil_macdonald/2010/09/22/virtualizing-ie6-using-application-virtualization-violates-microsofts-eula/) says the following (I've italicized the critical points): Microsoft does not support the use of Microsoft Application Virtualization (App-V) or similar third-party application virtualization products to virtualize IE6 as an “application” enabling multiple versions of Internet Explorer on a single operating system. These unsupported approaches may potentially stop working when customers patch or update the underlying operating system, introducing technical incompatibilities and business continuity issues. In addition, the terms under which Windows and IE6 are licensed do not permit IE6 “application” virtualization. Microsoft supports and licenses IE6 only for use as part of the Windows operating system, not as a standalone application. Microsoft separates “supporting” a solution vs. “licensing” a solution in this note, and customers should know the difference. The Support ArgumentWhen Microsoft says it doesn't support using App-V, it means that it won't help customers when they have problems such as those listed (it stops working, technical incompatibilities, business discontinuity). A Premier Support contract may not cover this, for example, or TechNet may not offer bulletins or guidance for this solution. And of course, when it comes to third-party (non-Microsoft) applications, Microsoft has no obligation to provide technical support no matter how well they might work. It doesn't mean that it's technically impossible or illegal, but if it blows up, Microsoft is not committed to help. This non-support falls reasonably well into Microsoft's published support guidelines because it involves supporting an OS and browser version that are past the Mainstream support phase. It's possible that customers with an Extended Hotfix Support agreement could get help if they're willing to pay for it, but the cost would probably be prohibitive and Microsoft may lack the engineering manpower (e.g., people who can dive into XP and IE6 source code) to do this in any reasonable time frame or cost envelope. It's worth noting, as well, that the technical design of Microsoft's App-V virtualization product makes it a poor candidate for virtualization of IE6 on Windows 7. To use App-V, customers perform an operation known as "sequencing," in which they install and run the application while App-V logs system activity to determine which libraries and services the application requires. It then creates an image containing all the necessary code, and this image can be sent over the network to run in isolation from other software on a workstation, permitting the workstation to run, for example, incompatible browser versions side by side. To minimize the impact of the extra network traffic, it streams the most critical bits over the network first and can access other required bits on demand. However, App-V applications are not completely isolated from the workstation's operating system--to further reduce streaming demand, it may access some OS code that is already resident on the host workstation. There's the gotcha: Sequencing IE6 running on Windows XP and then streaming it via App-V to a workstation running Windows 7 invites numerous problems, since the application may try to access XP code on a Windows 7 workstation. Some non-Microsoft application virtualization technologies may be technically superior in this respect, which might fix the application compatibility problem, but as you'll see, the licensing rules can still break the deal. In discussions I've had with Microsoft, the problems with App-V keep coming up, but from a licensing perspective, the technical issues are irrelevant. An alternative that Microsoft recommends, Microsoft Enterprise Desktop Virtualization (MED-V, a "classic" VM technology that runs an instance of the full Windows OS in complete isolation from the workstation host, which can be running a different OS) is licensed exactly the same way that App-V is. So although MED-V may be technically superior, any licensing problems App-V raises also arise with MED-V, and any time that MED-V is OK, App-V should also be OK. The Licensing ArgumentMany readers may find this complex and picky, but welcome to the world of Microsoft licensing. I hope I can demonstrate the value here of being picky and making the effort to wade through complex language. I highlighted the words “In addition...” in the note from Microsoft above, because it indicates that the licensing point is different from the support point. Microsoft clouds this in the next sentence, where it mentions support again—“Microsoft supports and licenses IE6 only for use as part of the Windows operating system...”—but if we ignore the repetition of “support” you can see that they're saying that they don't license IE6 separately from Windows. The targets of this argument are some enterprising souls who have taken components of IE6 from Windows XP and created IE6-compatible browsers that can run on Windows 7. Microsoft says that since IE6 is a "component" of Windows XP, and not an "application"--notwithstanding the fact that you could download it separately and, indeed, Europeans must download IE separately these days--you can't pull out just one component without violating Microsoft's licensing terms. Let's have a look at these terms and see if Microsoft's argument holds up. The language that Microsoft says restricts virtualization of IE6 can be found in Microsoft's Product Use Rights (PUR) which governs software purchased through volume licensing. It's not the current PUR that counts, the company says, but the rules that govern Windows XP. To find those rules, we have to go way back, to July 2006, the last time that Windows XP appears in the PUR. The "Universal License Terms" section of the PUR has a section that the company says forbids using a component of Windows XP, that is, extracting IE6 from XP and using just that in App-V or a similar technology to virtualize IE6 on Windows 7. That section says: F. No Separation of Software. You may not separate the software for use in more than one operating system environment under a single license, unless expressly permitted. This applies even if the operating system environments are on the same physical hardware system. Microsoft's assertion that this forbids virtualization of IE6 faces two obstacles. First, this language does not appear to apply to Windows XP at all. It is a subsection of a paragraph that says The following license terms apply to your use of products in the Microsoft Servers licensing models. They also apply to your use of products in the Desktop Applications licensing model when used with Microsoft Virtual PC or similar technologies. The operating system is not the target of these rules, although it does get mentioned in another subsection of this paragraph, most likely because Microsoft needs to explain virtual operating sytems for the sake of Virtual PC, which is mentioned in the paragraph above. That subsection says C. An “operating system environment” is one instance of an operating system and instances of applications, if any, configured to run on that operating system instance. There are two types of operating system environments, physical and virtual.... This paragraph says nothing about whether customers can use just part of the full OS or must use every component. Interestingly, in a list of changes at the top of the next edition of the PUR, dated Oct. 2006, Microsoft says the Oct. 2006 PUR "clarifies" the meaning of an operating system environment (OSE). Notice that it is not marked as a "change" but as a clarification. That clarification says an OSE is ...all or part of an operating system instance, or all or part of a virtual (or otherwise emulated) operating system instance... Thus it seems obvious that the Separation of Software clause, which also appears in the Oct. 2006 PUR, does not apply to the operating system, since this adjoining clause says an OSE can be "part of an operating system instance." The second problem with Microsoft's assertion that the PUR language forbids virtualizing IE6 from Windows XP is the clause that says "You may not separate the software for use in more than one operating system environment under a single license." Note the qualification here. The argument does not stop at saying you may not separate the software. It says you may not separate the software "under a single license." While the company wants to ensure that people don't get two-for-one operating systems, what's illegal here is not so much separation of the software, but "separation" of one license to cover two OSEs. There's a solution to that: two licenses. That's a solution that one would think Microsoft should welcome, since it could mean more revenue. Some readers may be lost at this point, so here is a quick summary of the arguments: Microsoft: Customers can't separate a fundamental component, like IE, from the OS. Therefore, it is not a licensable scenario. DeGroot: If an operating system environment (OSE) can include "part of an operating system instance," that part can be IE. Because it's an OSE, it must be, and can be, licensed. Getting a Second LicenseHow do a customer acquire a second OS license? At least four ways.
The first two options have been covered elsewhere and are quite expensive. The next two options apply to much larger sets of customers and haven't received nearly as much attention as they deserve. Option 3 is free if you have one of the qualifying OSs and Option 4 takes advantage of licensing rights that many customers already own. The XP Mode OptionXP Mode was a remarkable generous concession from Microsoft, the first time the company has offered customers a second OS license at no additional charge. The need was clear—with so many customers standardized on Windows XP, with applications (such as IE6) that had not been migrated to Vista or XP, the company would encounter resistance to upgrading to Windows 7 unless customers had a simple, inexpensive way to keep using old Windows XP applications. XP Mode is a free, Windows XP Professional VM that customers can download and run on Windows Virtual PC on Windows 7 Professional, Enterprise, or Ultimate editions. It is intended to resolve situations exactly like the IE6 migration problem: customers can replace Windows XP computers with new ones running Windows 7, but still run the old, Windows 7-incompatible application in XP Mode. In effect, they are migrating their IE6 users from a physical device running XP Professional and IE6 on a to a virtual device running XP Professional and IE6. In this case, IE6 is properly licensed because it is running in an OSE for which Microsoft has given the customer a free OS license. Microsoft tends to dismisses XP mode as suitable only for smaller customers because it does not include any sophisticated tools for centrally managing the VM (hence the recommendation to go with MED-V, which does offer centralized management features), but that is not an insurmountable problem. Customers who have purchased a suite of Client Access Licenses (CALs), such as the Core CAL Suite or the Enterprise CAL Suite, also get a Client Management License for System Center Configuration Manager (SCCM), which aids in patching, upgrading, and otherwise maintaining the configuration and performance on a desktop computer. Customers who have purchased a CAL Suite can use their SCCM Management License to centrally manage the XP Mode VM. Absent a CAL suite, they can purchase a SCCM Client Management License (plus at least one license for the SCCM server) for just the computers they want to cover. Third-party virtualization management tools are also available and may have technical or financial advantages over SCCM and its management licenses. The Software Assurance OptionAs it happens, every customer who can use App-V or MED-V already has a second license that they can assign not only to virtual instances using those technologies, but also to instances running atop non-Microsoft virtualization technology, from Citrix, Symantec, VMware, and other vendors. They even have a second license for an OSE running directly on the physical machine. The reason: to use App-V or MED-V, which are both included in a bundle called the Desktop Optimization Pack (DOP), customers must first purchase SA. (For the basics of SA and its virtualization entitlements, see Software Assurance and Virtualization Basics.) SA has offers numerous benefits, many of them trivial, but in virtualization scenarios, it offers two particularly useful benefits: the right to run up to four VMs on a desktop computer and the right to apply two OS licenses to one physical machine. Between them, these entitlements would appear to cover any scenario in which IE6 is virtualized: running IE6 in an isolated or semi-isolated VM, or running it inside or on top of the OS on the physical device. About half of all customers who have an Enterprise Agreement have an Windows OS SA subscription for all of their workstations, so they are fully licensed to run IE6 in a virtual Windows XP instance. The illustration below describes three scenarios.
Workstation 1The workstation has been assigned an SA subscription, and the customer has also purchased the DOP. SA includes the OS licenses that the customer needs to license additional OS instances running on the workstation, and the DOP gives them the right to use products such as App-V or MED-V as part of those virtual instances. Workstation 2This customer does not have an SA subscription for the workstation. As a result, they cannot use any of the DOP's virtualization tools, and they do not have extra OS instances that they can use in VMs running on non-Microsoft virtualization tools. They need to purchase at least one additional OS license for each virtual instance that they run. Workstation 3Like Workstation 1, this workstation has been assigned an SA subscription, but in this scenario the customer wants to use non-Microsoft virtualization tools. No problem: they can assign up to four OS licenses to which they are entitled via their SA subscription to virtual OSEs running on their chosen virtualization platform. Does Microsoft Agree?Microsoft does not endorse the analysis in this note, but readers might want to decide for themselves how valid or applicable it is. They may also be able to get concessions from their Microsoft representative, such as permission to use a robust IE6 emulator or virtual OSE that successfully runs IE6 on Windows 7 in order to facilitate their migration off of Windows XP. Windows 7 deployment is one of the major performance metrics on many Microsoft representatives' annual scorecards, while preventing customers from using IE6 clones or utilities is not something for which they have incentives. As long as customers are aware of the risks, some Microsoft field representatives may be prepared to ignore any migration activity that, while not officially blessed by the company, eases customers' pain and helps them modernize their desktop infrastructure. In particular, customers who have SA coverage on their Windows OS should insist that Microsoft explain to them why they cannot apply the many additional licenses to which they are entitled to any workable application virtualization solution that they need to make a smooth transition to Windows 7. Microsoft may also want to consider whether its response--warning people away from all application virtualization solutions, include its own, that might help customers migrate to Windows 7-- is proportionate to the danger (that customers might upgrade to Windows 7 too rapidly?). Some companies would even treat this as a business opportunity and steal the hacker's thunder, producing a utility that would do the same thing but would be authorized by the vendor and perhaps generate incremental revenue. For further information on how to purchase SA, see "Upgrade Paths for Virtualization." This article represents the opinion of the author and is not endorsed by Microsoft. Paul DeGroot is principal consultant at Pica Communications, which provides training and consulting services related to Microsoft licensing. Last updated November 24, 2010 |
