Doug Wilson Systems Consultant at Now

Transcription

1 Doug Wilson Systems Consultant at Now More information, contact your Account Executive: Brad Allgaier

2

3

4 Now Micro Device Lifecycle Company Hardware Reseller (Dell, HP, Lenovo, and more) OEM (Digital Signage, Kiosks, Appliances) Professional Services (Systems Management, Cloud) Recast Right Click Tools (ConfigMgr, Active Directory add-ons)

5 Recast Right Click Tools Recast RCTs (Free and Enterprise) It s crack for the ConfigMgr Console Everything that ConfigMgr should have done, Recast does Image Connect Premier Reseller of Dell, HP, Lenovo, and Microsoft Devices We run your live OSD task sequence on devices you purchase Delivered devices are domain joined, updated, ready for end user

6

7 ENTERPRISE FUNCTIONALIT Y AND EASE OF DEPLOYMENT

8 INTRODUCING WINDOWS 10 STUDENT USE BENEFIT

9 WINDOWS EDUCATION IN VOLUME LICENSING

10 WINDOWS 10 PRO EDUCATION 10

11

12 A brand new way of building, deploying, and servicing Windows

13 WHAT MICROSOFT HEARS FROM YOU 200+ Days Median # of days attackers are present before detection $3.5M Average cost of data breach (15% YoY increase) I m worried about security threats and managing the risk to my business. Decade-old PC tech, infrastructure, and processes drive up IT costs and slow business agility. $146-$188 per device Cost of keeping user devices up to date and secure $1,930 per PC Cost of upgrading Windows XP to Windows 7 My employees need to be productive on every device they use. 80% of workers spend a portion of their time working outside the office 38% of Millennials feel outdated collaboration tools hinder innovation 41% of CEOs Expect digital revenue to double over the next 5 years 47% of existing revenue considered to be under threat in the next 5 years We need to capitalize on new business opportunities quickly. Sources: Gartner, Ponemon Institute, IdeaPaint, MIT Center for IS Research

14 C A P A B I L I T Y Threat Game change protection with over Windows time and Software as a Services Attackers take advantage of periods Disrupt and between out innovate releases our adversaries by design 3,200 Protection Gap T I M E P R O D U C T R E L E A S E T H R E A T S O P H I S T I C A T I O N

15 DESIGNED FOR DIGITAL TRANSFORMATION Safer and more secure Designed for modern IT More Productive Powerful, modern devices

16 DESIGNED FOR DIGITAL TRANSFORMATION Safer and more secure Designed for modern IT More Productive Powerful, modern devices Protect, detect, respond to Ransomware Windows Defender Application Guard Windows Defender Advanced Threat Protection Let s go deeper

17 PROTECT, DETECT, and RESPOND Secure your identities Protect enterprise data Enhance threat resistance Secure your devices and connections Detect, investigate, and respond to breaches PRE-BREACH POST-BREACH

18 Windows 7 Security features Device protection Threat resistance Identity protection Information protection Breach detection investigation & response PRE-BREACH POST-BREACH

19 Windows 10 Security on Legacy or Modern Devices (Upgraded from Windows 7 or 32-bit Windows 8) Device protection Threat resistance Identity protection Information protection Breach detection investigation & response PRE-BREACH POST-BREACH

20 Windows 10 Security on Modern Devices (Fresh Install or upgraded from 64-bit Windows 8 ) Device protection Threat resistance Identity protection Information protection Breach detection investigation & response PRE-BREACH POST-BREACH

21 Hardware based isolation

22 Trustlet #1 Trustlet #2 Trustlet #3 Hardware based isolation in Windows 10 Apps Windows Platform Services Kernel Windows Operating System Kernel System Container Hyper-V Hyper-V Device Hardware Hypervisor

23 Device Guard Credential Guard Trustlet #3 Device Guard and Credential Guard Apps Windows Platform Services Kernel Windows Operating System Kernel System Container Hyper-V Hyper-V Device Hardware Hypervisor

24 Device Guard Credential Guard Trustlet #3 Microsoft Edge Protected by Windows Defender Application Guard Microsoft Edge Apps Windows Platform Services Windows Platform Services Kernel Windows Defender Application Guard Kernel Windows Operating System Kernel System Container Hyper-V Hyper-V Device Hardware Hypervisor

25 Protection against accidental data loss

26 Work File Personal File Work File Work Mail Personal Mail Windows Information Protection Separates work and personal data File System Kernel Windows Operating System

27

28 Is perfect protection possible?

29 Attackers hard to detect 140+ DAYS Median number of days attackers are present on a victims network before detection

30 Windows Defender Advanced Threat Protection Comprehensive security intelligence from Microsoft and our industry partners such as FireEye isight threat intelligence Integration with Office Advanced Threat Protection and Advanced Threat Analytics for better protection, from the client to cloud

31

32 Why Windows as a service? CxO Demonstrates organizational agility Needed to recruit the best and the brightest employees Security benefits to stay ahead of the bad guys No more huge deployment projects, predictable and steady investment Path towards the cloud Keep up with the competition Flexibility compared to other platforms. TDM Security and management features evolve quickly to protect devices, data, and infrastructure Smaller changes require little user training Simpler than traditional deployment Excellent app compatibility maintained through open preview process Less impact on the helpdesk IT Pro Simpler process using existing tools and products you already know Long-duration, high-stress project replaced by a series of easier deployments

33

34 Windows Predictable releases, twice per year Semi-Annual Channel Windows About six months between releases Windows Windows

35 18 months for each release Windows Each serviced for 18 months From the date of release Windows Windows Windows

36 Windows Aligned with Office For simpler deployment planning Office 365 ProPlus 1708 Windows Office 365 ProPlus 1802 Windows Office 365 ProPlus 1808

37 Windows ConfigMgr 1702 Windows Windows Windows ConfigMgr 1802 Supported by ConfigMgr Current Branch ConfigMgr 1706 ConfigMgr 1806 ConfigMgr 1710 ConfigMgr 1810 About four months between ConfigMgr releases

38 Windows Windows Start as early as possible Think of this as a process, not a project Windows Windows Plan & Prepare Pilot Broad Deployment

39 Continual improvements: New features twice per year, adding value and improving productivity Windows XP Windows 7 Windows 10 Disruption Improvements Minimized end-user disruption by having less change with each release

40 Traditional deployment (every 3-5 years) Apps Infra Imaging Deploy Windows as a service (twice per year) Apps Infra Imaging Deploy

41 Total costs over three years of WaaS needs to be the same or better than the traditional deployment project cost Application testing and validation Infrastructure remediation, upgrades Deployment itself All need to be reduced by nearly an order of magnitude Imaging costs can be eliminated Customers want proof Apps Infra Imaging Deploy

42 Hardware is changing rapidly Integration Performance Battery life Software is a key piece Power management Performance tweaks New hardware features to leverage Windows 10 is enhanced with each feature update release

43 F E A T U R E U P D A T E A G I L E U P D A T E C Y C L E Always up to date for latest productivity and security capabilities and hardware support From project to process F E A T U R E U P D A T E 2 F E AT U R E U P D AT E S P E R Y E A R

44

45 Semi-Annual Targeted vs. Semi-Annual Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> Defer Windows Updates If you are using WSUS or ConfigMgr, the setting doesn t matter as much

46

47 System Center Configuration Manager Servicing Plans Best support in System Center Configuration Manager Current Branch Requires WSUS 4.0 (Windows Server 2012 or above) with KB Existing versions (2012, 2012 R2), as well as SCCM Current Branch, can still use task sequences to perform Windows 10 upgrades (much easier in SCCM Current Branch)

48

49 Wireless Access Point Wireless Access Point Data Center Server Router Switches Data Center Server Router Switches Without peer-to-peer With peer-to-peer

50

51 Y YY With Windows 7 and 8, servicing choices added complexity and cost, increased fragmentation, and reduced quality What customers are running What we are testing Typical Windows 7 PC: Selectively Patched Windows 7 Test Lab PC: Fully Patched

52 A single cumulative update each month with no new features Twice per year with new capabilities Changes made for older Windows releases as well, to adopt learnings from Windows 10

53

54 Classic IT Modern IT Single Device Business Owned Corporate Network & Legacy Apps Manual Reactive High-touch & Multiple Devices User and Business Owned Cloud Managed & SaaS Apps Automated Proactive Self-Service

55 How to do Windows as a Service Three Main Ways Windows Update for Business/WU A collection of group policies that enable a device to get feature updates (fka upgrades) and quality updates (hotfixes and security updates) via Windows Update. Deploy to Deployment Rings Groups of computers in AD Windows Server Update Services Deploy Windows 10 updates to Computer Groups Leverages Express Updates (devices download only content they need) System Center Configuration Manager Current Branch Control WaaS using SCCM infrastructure Use same process as deploying updates with SCCM today New feature: Servicing plans allow to automatically setup plans on deferral basis (similar to automatic deployment rules for other updates)

56 1 Configure Insider PCs Lab or secondary PCs Enough to explore new features, measure compatibility 2 Identify special PCs Deploy Windows 10 Enterprise LTSB Limited numbers (we hope) 3 Recruit volunteers for pilots Willing participants who will provide feedback Cover the broadest set of apps and devices possible 4 Divide broad population of PCs Standard deployment best practice Focus on risk reduction, minimizing disruption

57 What are deployment rings Different names for the same thing: Rings Collections of devices Computer groups Basically, lists of PCs Manually or automatically populated, depending on the capabilities of the product being used Each targeted at different times Manually or automatically triggered or scheduled, depending on the capabilities of the product being used

58 Suggested deployment rings Pilot Ring #1: IT devices Validate infrastructure, core productivity apps, security software, common devices Experiment with new features Using Current Branch (CB), as soon as possible after release Pilot Ring #2: Early Adopters Aim to include as many apps and devices as possible, to build confidence Issues reported to the helpdesk Can be subdivided if needed Have a contingency plan if an issue occurs (e.g. VDI, fast rollback) Broad Deployment Rings #3 to??? As many as necessary to reduce risk and disruption

59 Deploy and Use Plan and Prepare Targeted Pilot Validation IT/Developer Canary Self Select Sample *Conceptual illustration only

60 Windows Insider Preview Branch New Windows 10 Release Specific feature and performance feedback Application compatibility validation Deploy to pilot audiences Validate and prepare for broad deployment Deploy to all audiences, in waves to reduce risk 6+ months of active development The process repeats Deploy / Use (Semi-Annual) ~4 months 12+ months 16+ months to validate, deploy, and use each release Evaluate Pilot Deploy / Use Grace 60 days

61 Microsoft 365 powered device The best way to experience Microsoft 365

62 Microsoft 365 powered device Intelligent security, built-in Easy to deploy and manage Always up to date Proactive insights

63 Microsoft 365 powered device Easy to deploy and manage Windows 10 & Office 365 ProPlus Windows AutoPilot Intelligent security, built-in Microsoft Store for Business Microsoft Intune Azure Active Directory Always up to date Proactive insights * In Preview

64 WINDOWS 10: DEPLOYMENT CHOICES Transform new devices so they are ready for productive use No imaging required: Lower effort and lower cost Existing Windows 7 and 8.1 devices migrated to Windows 10 Let Windows do all the work, automatically migrating apps, data, and settings Image-based wipe-and-reload approach for moving from Windows 7 and 8.1 to Windows 10 Higher effort and cost, but necessary in some scenarios

65 How to deploy Windows Upgrade from Windows 7 or 8.1 Stay current with Windows 10 Two distinct operations which can use different techniques Customers need to have a plan for #2 before they do #1 Fear of #2 is the biggest roadblock to #1

66

67 In-Place Upgrade: When not to use

68 In-Place Upgrade: Third-Party Disk Encryption

69 1 Down-level

70 1 Down-level 2 WinRE

71 Down-level WinRE 1 st boot to New OS 1 2 3

72 Down-level WinRE 1 st boot 2 nd boot to New OS

73

74 Upgrade process: Summary 1 Down-level 2 WinRE 3 1 st boot to new OS 4 2nd boot to new OS Running Win7, 8 or 8.1 Minimalist OS Binding the new yoke Finalize Upgrade Check the system Both new & old are offline Specialize to the machine Welcome the user back Inventory Applications Backup down-level OS Install drivers OOBE Inventory Drivers Lay down new OS Migrate Apps Assess compatibility Prepare new OS More Migration Prepare WinRE Inject drivers Some Migration Ready Set Go Welcome to Windows 10

75 Upgrade process: Troubleshooting

76 Upgrade process: Gotchas

77 Upgrade process: Gotchas

78 Upgrade process: Gotchas

79 Upgrade process: In-Box Apps

80 Upgrade process: Settings Migration

81 Upgrade process: Preflight windows-10-pre-upgrade-validation-using-setup-exe.aspx

82 Upgrade process: Other notes

83

84 User-driven, from the cloud IT-driven, using new tools Company-owned devices: Azure AD join, either during OOBE or after from Settings BYOD devices: Add a work account for device registration Automatic MDM enrollment as part of both MDM policies pushed down: Change the Windows SKU Apply settings Install apps Create provisioning package using Windows Imaging and Configuration Designer with needed settings: Change Windows SKU Apply settings Install apps and updates Enroll a device for ongoing management (just enough to bootstrap) Deploy manually, add to images

85

86 Provisioning: Bloatware

87 Windows Configuration Designer Demo Video

88

89 The golden path: No need for IT to touch the devices Simple process for users Integration in the supply chain Key technologies: Windows AutoPilot deployment service Azure Active Directory Microsoft Intune Office 365 ProPlus

90 Three simple steps: 1. Register devices 2. Assign a profile of settings 3. Ship the device to the user

91 Prerequisites: Windows 10 version 1703 (with July cumulative update) Azure Active Directory Premium Microsoft Intune (or other MDM service) Office 365 ProPlus Microsoft Store for Business account Windows 10 Subscription Activation (optional) Steps: 1. Boot an existing Windows device 2. Press Shift-F10 to open a command prompt on the first OOBE screen 3. Run script available from WindowsAutoPilotInfo/ to gather hardware details 4. Copy the CSV file to a safe location (USB key, network location, etc.) 5. Upload CSV file to Microsoft Store for Business 6. Continue the deployment

92

93

94 Core toolset for traditional Windows deployment Windows PE User State Migration Tool New version released with each feature update: Recommended to use the latest version New ADK is also supported with older Windows 10 releases Check with ConfigMgr team for ConfigMgr current branch requirements

95 Convert disk layout from MBR to GPT using MBR2GPT Change firmware settings using OEM tools Reboot Enable new UEFI-based security features on Windows 10 Simple two-step process using Windows and OEM command-line tools Built-in support in Windows , with supports for previous Windows 10 releases through Windows PE 1703 Quick and easy process, easy to automate See for more info

96

97 Tips when capturing image

98 Tips when capturing image he_layoutmodificationxml_file_to_the_device start-menu-and-add-ie-shortcut-during-osd/

99 Tips when capturing image

100 Configuration Manager Current Branch

101

102

103

104

105 Key trends 1. Profile build-up, slow logon and user switching issues have become a top blocker 2. Low spec devices amplify the problem with memory/disk space limitations 3. IT turns off everything in order to improve performance new Windows looks like old Windows

106 Sign in 1. Solve the slow logon problem for all users, especially in a shared environment 2. Ensure low spec devices benefit 3. Help IT with the configuration to achieve performance goals

107 Key trends Content Used for Educational Activities Websites 95% 91% of teachers use websites to find and share lesson plans or other classroom content Productivity software Non-digital textbooks 90% 85% 65% of teachers use websites for professional advice and support Collaboration platforms/lms Education apps Digital textbooks 48% 48% 65% Use Weekly 57% of teachers use websites to collaborate with teachers with whom they wouldn t otherwise have had the opportunity 1. The platform-agnostic cloud reduces sticky value prop of Win32 apps 2. Devices take on cloud-first characteristics such as cloud-based management and cloud identities 3. Low-spec devices are good enough for most school use

108 Azure Active Directory and Office Deliver a cloud-first solution that retains the Windows value prop 2. Simplify navigation to Microsoft EDU cloud services and apps 3. Focus on Lite IT that is migrating to the cloud

109 Key trends 1. Yearly digital standardized tests are driving PC purchases 2. Keyboards and environment lockdown required, headphones and mics sometimes required 3. Transition to digital testing includes growing pains with test deployment and administration

110

111 Different approaches for different audiences Set up School PCs app Audience: Lite IT / Teacher AAD Join Auto account management Lockdown policies Sign in w/o an account Curated Start menu Windows Configuration Designer Audience: IT Domain Join Auto account management Lockdown policies SKU upgrades Test Taker app configuration

112 No IT Teacher applies for a grant to pilot PC s in their classroom. No tech support. Recommendation: Setup School PC app Local Accounts likely used Set up School PC app will work without AAD or MDM Could be 1:1 or small cart for subset of students to use at a time School has a small IT Staff. E.g, part time tech assistant. Limited IT Recommendation: ICD if IT requires Active directory or for 1-1 devices Setup School PC app if AD not required AAD + School Data Sync Lightweight provisioning / management. Cart moves around school. Fast sign-in. No guarantee that students use same device each time. Cloud storage only, default is OneDrive. Office365 weblinks installed automatically on Start Primarily web apps (webpages in Edge browser). Full IT District has a large IT Staff. Full time tech support in each school. Recommendation: MDT/SCCM (shared PC CSP configured via MDM or WMI bridge more advanced configuration) Domain Join, or per device manual AADJ 1:1 or Cart Apps can be sideloaded or pushed via SCCM / MDM.

113 Web App Compatibility A dual-browser strategy Provides support for web apps designed for Internet Explorer Supported on Windows 7, Windows 8.1, Windows Use Switch Microsoft back automatically Edge Microsoft as a to safer, Edge Internet automatically faster, Explorer more 11 for for all productive other approved sites default sites on browser the Enterprise Mode Site List Upgrading web apps to modern standards is the best long-term solution, but you can use Internet Explorer 11 for backward compatibility and upgrade web apps on your own schedule

114 Significant change to traditional practices: PROACTIVE: Structured testing of only the most business-critical apps (automated if possible) REACTIVE: Validate all remaining apps via targeted pilot deployments Take advantage of observed 99% app compatibility rates Leverage available tools like Windows Analytics and Ready for Windows to identify issues up front

115 Outstanding compatibility means a smooth migration from Windows 7 or Windows 8.1, while also simplifying the process of staying current with Windows 10

116 Get links to Windows 10 ISV support statements Get usage information for every app version, and use that to target testing We are actively engaged with ISVs, to ensure full support for Windows as a service

117 Plan upgrades by identifying devices that are ready and identify and resolve top app/driver compat blockers. Ensure update and antimalware compliance with timely reports for all your devices (even those on the road). Reduce support costs by proactively identifying and remediating top end-user impacting issues.

118 Pull together key information Telemetry-based app and device inventory App and driver compatibility details App usage and support info from Ready For Windows Establish a process Prioritize apps Identify issues Remediate using provided information Drive deployment Identify machines that are ready to deploy Integrate with Configuration Manager and similar tools

119