How Windows 10 marks the end of Roaming Profiles

Transcription

1

2 How Windows 10 marks the end of Roaming Profiles

3 About me Microsoft Community Star (HK and TW) Microsoft Most Valued Professional (MVP) MCT, MCP, MCP+I, MCITP, MCTS, MCDST, MCSA, MCSE, MCSE+I, MCDBA, MCAD, MCSD, MCPD DataAccess Insider, Azure Insider, DotNet Insider, SourceCode K2 Insider Guest Speaker on Regular MSDN Seminars ( ) Guest Speaker on Microsoft ImagineCup ( ) Guest Speaker on Microsoft TechEd 2008 Guest Speaker on Microsoft TechDays 2009 Guest Speaker on Microsoft TechDays 2015 Guest Speaker on Microsoft Tech Summit 2017

4 Agenda Identifying the Problem Enterprise State Roaming: The Cloud Solution UE-V: The On-Prem Solution Hybrid Environments Q&A

5 Identifying the Problem

6 Problem 1 I want settings and app data accessible from any device. The Windows experience should follow me as a user so I can stay productive wherever I go.

7 Problem 2 Device replacement is painful. I want to feel protected from data loss if my device fails. Configuring my device again is time consuming.

8 Microsoft s Customer Promises

9 Roaming Profiles

10 When are the Roaming Profiles from? 1994!

11 Roaming Profile Versioning Client OS Server OS Extension Profile Location Win NT4 Win Server NT 4 None \\<servername>\<fileshare>\<username> Win 2000 Win Server 2000 None \\<servername>\<fileshare>\<username> Win XP Win Server 2003 Win Server 2003 R2 None \\<servername>\<fileshare>\<username> Win Vista Win Server 2008 V2 \\<servername>\<fileshare>\<username>.v2 Win 7 Win Server 2008 R2 V2 \\<servername>\<fileshare>\<username>.v2 Win 8 Win Server 2012 V3 \\<servername>\<fileshare>\<username>.v3 * \\<servername>\<fileshare>\<username>.v2 ** Win 8.1 Win Server 2012 R2 V4 \\<servername>\<fileshare>\<username>.v4 * \\<servername>\<fileshare>\<username>.v2 ** Win 10 V5 \\<servername>\<fileshare>\<username>.v5 Win 10 Anniversary (1607) V6 \\<servername>\<fileshare>\<username>.v6 * After the software update and registry key are applied (KB ) ** Before the software update and registry key are applied *** After the software update and registry key are applied (KB ) **** Before the software update and registry key are applied

12 Roaming with 1+ Versions of Windows If support 2 OS versions, 2 x Roaming Profile Size If support 3 OS versions, 3 x Roaming Profile Size Documents and Pictures (Computer Configuration) Contacts, Desktop, Favorites, Music, Videos, Start Menu, AppData\Roaming (User Configuration) Between WinVista/Win Server 2008 and Win7/Win Server 2008 R2 Between Win8/Win Server 2012 and Win8.1/Win Server 2012 R2 Between WinVista, Win7, Win8 and Win8.1 Changes made on one OS version won t roam to another OS version Moving your environment to new version of OS, new and empty profile created No supported method of migrating User Profiles

13 Roaming Start Menu on Win 10 Using more than one PC Remote Desktop Session Host Server Virtualized Desktop Infrastructure (VDI) Server Will fixing it in future release Configurate User Profile Disks with Remote Desktop Session Host Server or VDI Server More info:

14 Roaming Advantages & Disadvantages Enforcement of Admin control by using Mandatory User Profile Users can access data anywehre Easier backup Very large size, but smaller with Folder Redirection since Win Server 2008 Only registry is roaming but not Local Settings It can corrupt with Diff set of applications installed on machines Some applications does not support profile in UNC, i.e., Batch file under Command Prompt Adobe Reader v9.0 and v10.0 OpenOffice.org 3.3 AutoCAD 2013

15 Settings roaming is what we still want!

16 Settings Roaming in Win10 Sync your settings Enterprise State Roaming (ESR): The Cloud Solution User Experience Virtualization (UE-V): The On-Prem Solution

17 Settings Sync

18 Settings Sync Allows consumers to sync their OS Settings and Modern Applicatio data across all their personal Windows Devices Theme, IE Settings, Edge Browser Settings, Passwords, Language Preferences, Ease of Access Features, Other Windows Settings UWP Data

19 What Account? Only Microsoft Accounts Enterprise Users needs to connect a Microsoft Account to AD domain account Replaced with a Primary/Secondary Account Framework Primary can be Microsoft Account, Azure AD Account, On-Prem AD Account, Local Account Secondary can be Microsoft Account, Azure AD Account, some other account such as Gmail or Facebook Only Primary Account for the device can be used for Settings Sync

20

21 Enterprise State Roaming (ESR)

22 Settings Sync

23 Goal: Provide Enterprise State Roaming using Azure Active Directory (AAD) authentication for AAD Premium users. Corporate-owned device support Separation of corporate and consumer data Enhanced security (Azure RMS) Management and monitoring services

24 Protection Scope Cloud Devices App Data* OS Settings Data resides in the Azure Cloud PC Laptops Tablets VDI (client SKU VM) UWP app roaming data Personalization Accessibility Language settings Windows settings Browser settings Credentials *ESR does not currently support the roaming of Win32 app settings

25 Identity and Roaming Data Separation scenarios Always based on the identity used to sign into Windows ( primary account ) Consumer Employee Always based on the identity of app acquisition User s relevant app data roams across their devices if the acquisition ID is the same as the primary account Enterprise and personal data stay separate in their respective storage locations Personal Consumer Use OneDrive OneDrive Consumer Personal (BYOD) OneDrive OneDrive BYOD Company Owned Business Open Company Owned Business Use Business Only

26 App State Roaming Example AAD Primary Identity Work-owned Device Business only Apps AAD Primary, added MSA Identity Work-owned Device Business & Consumer Apps Azure Cloud Azure Only the business app syncs to cloud

27 Enhanced Security Data that syncs is encrypted Encrypted using Azure Rights Management (Azure RMS) before leaving the device All content stays encrypted at rest in the cloud Enterprises with Azure RMS subscription can Bring Your Own Key

28 Sync data storage Storage location Enterprise State Roaming data is hosted in the Azure region that best aligns with the tenant s country Data is locally located with the geographical region, and is not replicated across regions

29 Why Join Azure AD?

30 Five Easy Steps

31 Step 1: Create an Azure Directory Azure AD Premium, OR EMS

32 Step 2: Enable Device Registration

33 Step 2a: Enable MDM Enrollment

34 Step 3: Configure DNS Entry Type Target Enterpriseregistration CNAME enterpriseregistration.windows.net

35 Step 4: Create Cloud IDs

36 Step 5: Join the Azure Domain Requires Windows 10 * With Enterprise or Education SKU Becomes the primary account Enables logon with other tenant IDs Linked secondary logon

37 AAD Join in OOBE

38 AAD Join after OOBE

39 Questions on Azure AD

40 Enterprise State Roaming (ESR) Windows Settings UWP App Settings

41 How do I try out ESR? 1. Azure Active Directory (AAD) Premium subscription. 2. Windows 10 (Version 1511, OS Build or later). 3. Devices are Azure AD joined (or traditional on-prem AD domain-joined devices with automatic registration to Azure AD). 1. IT Admin goes to the AAD online management portal to configure users for Enterprise State Roaming. 2. Additional policies may be applied.

42

43 User Experience Virtualization (UE-V)

44 What is User Experience Virtualization (UE-V)? VDI environment where multiple accounts are stored Call centers where thin clients are used Enterprise user with multiple devices (dekstop, laptop,...etc)

45 User Experience Virtualization (UE-V) Microsoft Office 2016, 2013, and 2010 Internet Explorer 11 and 10 Many Windows applications, such as Xbox Many Windows desktop applications, such as Notepad Many Windows settings, such as desktop background or wallpaper

46 UE-V Customer Value On-Premise UE-V relies on local network share No server component needed Customer can completely manage and own their data Works for customers in strict data enforced countries such as those in EU Win32 App settings roaming Over 80%+ applications in use by Enterprise customers are Win32 desktop applications Custom and LOB apps can be roamed using templates Granular control over which app can roam

47 UE-V Settings Storage Path

48 What s New for Windows 10 Anniversary Update Easier to deploy Easier to manage Simple to Acquire Simple to Migrate Built in components of Windows New PowerShell and GP commands Moving from MDOP attachment licensing Ensuring settings and configurations are retained

49 MDOP Previously, UE-V shipped with the Microsoft Desktop Optimization Pack (MDOP) as an external set of installers Agent UI and Service Setup Template Generator Setup Needed MDOP attachment to Software Assurance License to get the installers

50 What s New For Window 10 Anniversary Update and beyond, UE-V is shipped as a Windows component in Windows Enterprise SKU and can be enabled inbox PowerShell & Group policy deployment Agent UI has been removed UE-V Template Generator ships as a part of the Windows Assessment and Deployment Kit (ADK) Available for download from the Hardware Download Center Software Assurance License now includes MDOP without additional add-on license after August 1 st, 2015

51 Pro SKU to Enterprise SKU For customers who are paying for Windows Pro SKU but would like to use UE-V and other enterprise features, they can upgrade to Windows Enterprise SKU Allows Pro SKUs to turn on Enterprise features including UE-V Using SLMGR.VBS, just change the product key No reboot needed

52 Migration For customers who were using a previous version of Windows and UE-V Upgrade to Windows 10 Anniversary Update will automatically migrate UE-V setting, configurations and enable the UE-V service Removed inbox templates Win32 calculator template IE 8/9 Added inbox template Office 2016

53 UE-V Changes in Windows 10 Does not roam printer settings or preferences

54 Key PowerShell commands for UE-V Enable-UEV Turns on the UE-V service, requires reboot Disable-UEV Turns off the UE-V Service, requires reboot Get-UevStatus Displays whether UE-V service is enabled or disabled in Boolean value Set-UevConfiguration Configures the UE-V service Needs to be set before enable Get-UevConfiguration Displays the configurations set by the IT admin

55 Deploy UE-V Allow UE-V Users List Folder/read data and Create Folders/Append data in root Allow Creator Owner Full Control on Subfolders and files Use Group Policy or PowerShell Get-childItem c:\programdata\microsoft\uev\inboxtemplates\*.xml % {register- UevTemplate $_.Fullname} Set-UevConfiguration -EnableWaitForSyncOnApplicationStart

56

57 UEV & ESR Together?? What if my customer uses a hybrid on-premise and cloud environment? What if my customer wants to roam Win32 apps settings right now? Can UE-V and ESR currently coexist?

58 UE-V & ESR Together UE-V can roam Win32 applications on-premises while Enterprise State Roaming (ESR) can roam the rest Admins can configure UE-V to roam just Win32 app settings by disabling roaming of Windows OS settings and Universal app data through Enable Do Not Synchronize Windows Apps Disable Synchronize Windows Settings Disable IE Roaming in the applications section In Windows 10 Anniversary Update, UE-V will automatically detect if ESR is enabled and apply the above policies directly

59 Summary on UE-V & ESR Together UE-V is a completely on-premise solution, requires management of templates, provides granular control and can roam Win32 app settings. ESR is a cloud-based solution connected to AAD, which provides an enterprise compliant service that syncs OS settings and modern app data. UE-V and ESR can co-exist for a complete settings roaming solution in hybrid environments.

60 Summary

61 Summary Unfortunately lacks support for Win32 applications

62 Thank You

63 Share us your feedback of this session! Download the Tech Summit Event App! Log in with your Tech Summit Account Add your attended session to My Agenda Click into the agenda details for the session s evaluation

64 Is time Allowed? More...

65 Customizing the Start Menu in Windows 10

66 Windows 10 Start Menu

67 Group Policy for Start Menu Options

68 Create Start Layout XML

69 Export the Start Layout export-startlayout path <path><file name>.xml Add LayoutCustomizationRestrictionType="OnlySpecifiedGroups to DefaultLayoutOverride element Specified Tile Groups can never be changed

70 Applying the Start Layout Group Policy Windows Imaging and Configuration Designer provisioning package Mobile Device Management (MDM) Group Policy Preference Import in Windows Image

71 Sample Start layout XML start:tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App"

72

73 Taskbar Options Default Windows Apps Apps pinned by the user Apps pinned during deploy

74 Configuring the Taskbar <taskbar:uwa> and AUMID to pin Universal Windows Platform apps. <taskbar:desktopapp> and Desktop Application Link Path to pin desktop applications. Add PinListPlacement="Replace" to <CustomTaskbarLayoutCollection>

75 Sample Taskbar Start layout XML taskbar:uwa AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" taskbar:desktopapp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"

76 Deploy the Start Layout

77 Combine Start & Taskbar Layout

78 Deploying the Start Menu

79 Use Group Policy to deploy Start layout

80 Use MDM to deploy Start Layout./User/Vendor/MSFT/Policy/Config/Start/StartLayout

81 Other ways to deploy Start layout Use Windows Imaging and Configuration Designer (ICD) to include XML in the PPKG Import-StartLayout

82 Summary

83 Summary Manage Windows 10 Start and taskbar layout