TS: Windows Server 2008 R2, Desktop Virtualization

Transcription

1 TS: Windows Server 2008 R2, Desktop Virtualization Number: Passing Score: 700 Time Limit: 120 min File Version: Microsoft EXAM TS:Windows Server 2008 R2,Desktop Virtualzation Total Questions: 123 -I have added another dump (Microsoft_Prepking_70-669_v _54q_By-Moe) Still need to verify the answers By SharmaAshle (Junjunwala) Updated by JunJunwala ( )

2 Exam A QUESTION 1 Your company uses Microsoft Application Virtualization (App-V). You maintain the sequencing for applications. You need to add a template to an existing sequenced application. What should you do? A. Edit the application, add the template, and then save the application with a new name. B. Sequence the template as a new application to the original application installation folder. C. Restore the sequencing computer and add the template to the original application installation folder. D. Upgrade the existing sequencing package, add the template to the package, and then save the application. Correct Answer: D /Reference: QUESTION 2 Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs Windows Server 2008 R2. All client computers run Windows 7. You need to ensure that the current Libraries from users' computers are available when they log on to the RD Session Host server. What Should you do? A. Use Group Policy Preferences to copy.library-ms files from the client computers to the RD Session Host server. B. Redirect each user's Documents folder to a network share. C. Redirect each user's Links folder to the RD Session Host server. D. Use a startup script to copy.library-ms files from the client computers to the RD Session Host server. Correct Answer: A /Reference: QUESTION 3 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You provide access to some applications through a virtual desktop infrastructure (VDI) environment. All Remote Desktop Session Host (RD Session Host) server objects are located in an organizational unit (OU) named RDServers. All virtual desktop computers are located in an organizational unit (OU) named VirtualDesktops. All other client computer objects are located in an OU named Desktops. The system drive in each RD Session Host server is running out of free disk space. You need to restrict the amount of disk space used by the roaming user profile cache. What should you do? A. Create a Group Policy object (GPO) that enables folder redirection for all users. Link the GPO to the RDServers OU. B. Create a Group Policy object (GPO) that enables folder redirection for all users. Link the GPO to the VirtualDesktops OU. C. Create a Group Policy object (GPO) that configures the Limit the size of the entire roaming user profile cache setting. Link the GPO to the RDServers OU. D. Create a Group Policy object (GPO) that configures the Limit the size of the entire roaming user profile

3 cache setting. Link the GPO to the VirtualDesktops OU. Correct Answer: C /Reference: QUESTION 4 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional, Windows Vista Business and Windows 7 Enterprise. The network includes 10 servers that run the Remote Desktop Session Host (RD Session Host) role. The computer accounts for the RD Session Host servers are located in an organizational unit (OU) named ABC- RDSHservers. The computer accounts for the client computers are located in an organizational unit (OU) named ABC-Clients. The roaming user profile cache is using a large amount of disk space on the system drive of the RD Session Host servers. How can you limit the amount of disk space used by the roaming user profile cache? A. By configuring a Group Policy Object linked to the ABC-RDShservers OU that configures the Limit the size of the entire roaming user profile cache setting. B. By configuring a Group Policy Object linked to the ABC-Clients OU that configures the Limit the size of the entire roaming user profile cache setting. C. By configuring a Group Policy Object linked to the ABC-RDShservers OU that configures disk quotas for the system drive. D. By configuring a Group Policy Object linked to the ABC-Clients OU that configures disk quotas for the system drive. Correct Answer: A /Reference: : QUESTION 5 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server You install Remote Desktop role services on servers as shown in the following table. You need to present a RemoteApp program by using Remote Desktop Web Access (RD Web Access). What should you do? A. Add Server2 to the TS Web Access security group on Server1.

4 B. Add Server2 to the Session Broker security group on Server3. C. Add Server1 to the Session Broker security group on Server3. D. Add Server1 to the TS Web Access Administrators security group on Server2. Correct Answer: A /Reference: QUESTION 6 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Remote client computers are not members of the domain. Your environment includes a Remote Desktop Gateway (RD Gateway) server. You install an application on a Remote Desktop Session Host (RD Session Host) server. You need to ensure that remote users can run the application. What should you do? A. On each remote client computer, configure the Remote Desktop Connection client to connect to the RD Gateway server. B. On each remote client computer, configure the Remote Desktop Connection client to connect without warning if server authentication fails. C. On the RD Gateway server, add the Guests local group to the Remote Desktop Users local group. D. On the RD Session Host server, configure the Remote Desktop Connection client to connect to the RD Gateway server. Correct Answer: B /Reference: QUESTION 7 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You run Remote Desktop Services and Microsoft Virtual Desktop Infrastructure (VDI). You have the servers shown in the following table.

5 You are configuring Remote Desktop Web Access (RD Web Access) to publish VDI desktops and remote applications on the RD Web Access server. You need to ensure that when remote users log on to the RD Web Access server they are presented with all remote applications and only their assigned VDI desktop. Which two actions should you perform on Server4? (Each correct answer presents part of the solution. Choose two.) A. Set the source name to Server1;Server2. B. Select the option to use to one or more RemoteApp sources. C. Set the source name to Server3. D. Select the option to use a Remote Desktop Connection Broker server as the source. Correct Answer: CD /Reference: QUESTION 8 You use Microsoft Application Virtualization for Desktops to virtualize applications for client computers. A virtual application that was installed by using a Windows Installer Package (.msi) file has become corrupted. You need to restore access to the virtual application. Which two actions should you perform? (Each correct answer presents a complete solution. Choose two.) A. Reload the virtual application package. B. Use the Microsoft Application Virtualization (App-V) Sequencer to edit the virtual application package. C. Use the Repair function in the Windows Installer Package. D. Use the Microsoft Application Virtualization (App-V) to re-sequence the application. E. Reinstall the virtual application package. Correct Answer: CD /Reference: QUESTION 9 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You use a virtual desktop infrastructure (VDI) environment to provide access to applications. All virtual desktop computer objects are located in an organizational unit (OU) named VirtualDesktops. All client computer objects are located in an OU named Desktops. You need to ensure that all users receive the same desktop shortcuts, and that they are not able to modify the shortcuts from virtual desktops. Which two actions

6 should you perform? (Each correct answer presents part of the solution. Choose two.) A. Create a mandatory user profile. B. Create a new default user profile. C. Create a Group Policy object (GPO) that configures the user profile. Link the GPO to the Desktops OU. D. Create a Group Policy object (GPO) that configures the user profile. Link the GPO to the VirtualDesktops OU. Correct Answer: AD /Reference: QUESTION 10 You work as a desktop technician at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server The client computers run a mix of Windows XP Professional and Windows 7 Enterprise. The company is planning to roll out Windows 7 Enterprise throughout the network. Users that require legacy applications will be able to run them in Windows XP Mode virtual machines on their computers. You are conducting some testing with Windows XP Mode virtual machines (VMs). You have two Windows XP Mode VMs on your Windows 7 client computer. You want to configure the networking options for the two VMs so that they have network connectivity to each other but not to your host computer or the rest of the ABC.com network. How should you configure the VMs? A. You should navigate to the Networking node in the VM Settings and configure the network adapter to use the Internal Network option. B. You should navigate to the Networking node in the VM Settings and configure the network adapter to use the Shared Networking (NAT) option. C. You should navigate to the Networking node in the VM Settings and configure the network adapter to use the Bridge Mode option. D. You should configure the Bridge Connections option in the Network Adapter properties in Windows XP on each VM. Correct Answer: A /Reference: : QUESTION 11 You work as a desktop technician at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. The network includes a Windows Server 2008 R2 server named ABC-Deploy1. ABC-Deploy1 runs the IIS Server role and is part of the company's Microsoft Enterprise Desktop Virtualization (MED- V) environment. Your Windows 7 client computer is named ABC-Tech1. The MED-V Management console is installed on ABC-Tech1.

7 You are configuring the Microsoft Enterprise Desktop Virtualization (MED-V) environment to deploy MED-V virtual machines to several client computers. You have configured a MED-V image with the required applications. You run Sysprep on the image and upload it to ABC-Deploy1. Which two of the following steps will ensure that computer names following a specified naming convention are generated when the VMs are first run after the deployment? Choose two. A. In the Workspace settings, navigate to the VM Setup tab and configure the computer name pattern. B. In the Workspace settings, navigate to the Deployment tab and configure the computer name pattern. C. Add a Script Action to rename the computer. D. Run the Setup Manager Wizard and configure the computer name pattern. E. Add the computer names to Sysprep.inf. Correct Answer: AC /Reference: : QUESTION 12 You work as a desktop technician at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. You are in the process of configuring a Microsoft Enterprise Desktop Virtualization (MED-V) environment. You need to configure a central image repository for client computers to download images from. You install a Windows Server 2008 R2 member server named ABC-Deploy1. You create a folder named MEDVImages on ABC-Deploy1. What should you do next on ABC-Deploy1? A. You should share the MEDVImages folder. B. You should install the IIS Server role and configure a virtual directory to point to the MEDVImages folder. C. You should install the FTP Server component of IIS and configure an FTP site to point to the MEDVImages folder. D. You should install an SSL Certificate. Correct Answer: B /Reference: : QUESTION 13 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. ABC.com runs a Microsoft Enterprise Desktop Virtualization (MED-V) environment. A Windows Server 2008 R2 member server named ABC-Deploy1 is configured to run Microsoft Enterprise Desktop Virtualization (MED-V) Server and hosts the central MED-V image repository.

8 You notice that the disk space on ABC-Deploy1 is running low due to the MEDVImages folder taking up a large amount of disk space. You open the MED-V Management Console and note that there are several versions of the MED- V Workspace virtual machines (VMs). How can you minimize the disk space used by the MEDVImages folder? A. By deselecting the "Workspace is persistent" option. B. By configuring the image update settings to keep a limited number of images. C. By configuring the image update settings to select the "Clients should use the Download manager when downloading the images" option. D. By manually deleting old image files. Correct Answer: B /Reference: : QUESTION 14 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server The client computers run a mix of Windows XP Professional and Windows 7 Enterprise. You are in the process of migrating the Windows XP Professional client computers to Windows 7 Enterprise. You need to design a solution to resolve application compatibility issues. You are planning a desktop virtualization solution that will run legacy applications on virtual machines (VMs) running Windows XP Professional. You want to deploy Windows Virtual PC 2007 and a virtual machine image to the client computers when they are migrated to Windows 7 Enterprise. How can you create a single installation package that includes both Windows Virtual PC 2007 and a virtual machine image? A. By using the Packaging Wizard from Microsoft Enterprise Desktop Virtualization (MED-V). B. By using Package Manager (pkrmgr.exe) from the Windows Automated Installation Kit (WAIK) tools. C. By using a template created using Microsoft System Center Virtual Machine Manager (VMM) 2008 R2. D. By using Windows System Image Manager from the Windows Automated Installation Kit (WAIK) tools. Correct Answer: A /Reference: : QUESTION 15 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. You have recently migrated 2000 client computers from Windows XP Professional to Windows 7 Enterprise and deployed Microsoft Enterprise Desktop Virtualization (MED-V) to resolve application compatibility issues.

9 All client computers use a single MED-V Workspace. For performance reasons, company policy states that the hard drives of the client computers should not be indexed. You are planning to update the Workspace image. How can you minimize the network impact of the client computers downloading the updated image? A. By configuring the image update settings to select the "Clients should use the Trim Transfer when downloading the images" option. B. By compressing the folder on the deployment server that contains the images. C. By using the Pack option in MED-V to compress the images. D. By compressing the folder on the client computers that contains the virtual machine. Correct Answer: C /Reference: : QUESTION 16 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. You have been asked to deploy a custom sales application named SalesApp to the client computers in the Sales department. However the custom application will only run on Windows XP Professional. You install Windows XP Mode on your Windows 7 computer. You plan to test the application in Windows XP Mode and deploy Windows XP Mode to the Sales department computers if your tests are successful. You install the application in the Windows XP Mode virtual machine. You click the start menu in the VM and successfully launch SalesApp. You attempt to start the application from your Windows 7 start menu but there is no shortcut to SalesApp. How can you ensure that Sales users will be able to start SalesApp from their Window 7 start menus? A. By copying the SalesApp application shortcut to the All Users profile in Windows 7. B. By copying the SalesApp application shortcut to the All Users profile in the Windows XP Mode virtual machine. C. By installing the Virtual PC Integration Components in the Windows XP Mode virtual machine. D. By installing the Virtual PC Integration Components in Windows 7. Correct Answer: B /Reference: : QUESTION 17 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. You are in the process of configuring a Microsoft Enterprise Desktop Virtualization (MED-V) environment.

10 All client computers will use a single MED-V Workspace. The virtual machine (VM) image will be downloaded from a central image repository on a Windows Server 2008 R2 computer. How can you ensure that any changes made by users to the VM are maintained between sessions? A. By configuring the Allow Write permission on the server folder containing the VM image. B. By configuring the Allow Write permission on the VM image files on the client computers. C. By selecting the Workspace is revertible option in the MED-V Management Console. D. By selecting the Workspace is persistent option in the MED-V Management Console. Correct Answer: D /Reference: : QUESTION 18 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. You are in the process of configuring a Microsoft Enterprise Desktop Virtualization (MED-V) environment. You want to install MED-V in a server cluster. You install MED-V on one server in the cluster. What should you do next? A. You should install Network Load Balancing (NLB) on all servers in the cluster. B. You should install the MED-V client on all servers in the cluster. C. You should install Cluster Administrator on all servers in the cluster. D. You copy the <InstallDir>/Servers/ConfigurationServer folder from the installed node to a shared network folder. Correct Answer: D /Reference: QUESTION 19 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. ABC.com includes a Development department. Users in the Development department develop software applications for use by ABC.com customers. You have configured a Microsoft Enterprise Desktop Virtualization (MED-V) environment to provide the Developers with temporary test environments. The temporary MED-V Workspaces have expiry dates configured on them. How can you minimize the disk space used by obsolete MED-V Workspaces? A. By configuring the option to keep a limited number of old image versions on the Virtual Machine tab in the

11 MED-V Management console. B. By configuring the Workspace Deletion options on the Deployment tab in the MED-V Management console. C. By selecting the Workspace is revertible option on the Virtual Machine tab in the MED-V Management console. D. By clearing the Enable Workspace option on the Deployment tab in the MED-V Management console. Correct Answer: B /Reference: : QUESTION 20 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. A server named ABC-Deploy1 runs Microsoft System Center Configuration Manager 2007 R2 and is used to manage client computers. ABC-Deploy1 also runs Microsoft Enterprise Desktop Virtualization (MED-V) Server. A server named ABC-Deploy2 runs IIS and is configured as a central repository to store MED-V Workspace images. A server named ABC-SQL1 runs Microsoft SQL server You want to configure the deployment infrastructure to store MED-V logging information in a central location and provide the ability to generate reports from the logs. Where should you store the logs? A. You should store the logs in a Public folder on a member server. B. You should store the logs in an SQL database on ABC-SQL1. C. You should store the logs in virtual directory on ABC-Deploy2. D. You should store the logs in a folder on ABC-Deploy1. Correct Answer: B /Reference: : QUESTION 21 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. A desktop administrator named Clive Allen is using a Windows 7 client computer to learn about PC virtualization. He has downloaded and installed Windows Virtual PC on his computer. Clive wants to create multiple virtual machines (VMs) all running Windows XP Professional. Clive creates a VM named XP1. Clive asks you how he can easily create additional VMs and minimize the hard disk space used by the VMs. What advice should you provide to Clive?

12 A. You should advise Clive to create dynamically expanding virtual hard disks (VHDs) for the additional VMs. B. You should advise Clive to create fixed size virtual hard disks (VHDs) for the additional VMs. C. You should advise Clive to use Windows Explorer to make multiple copies of the virtual hard disks (VHD) file used by XP1. D. You should advise Clive to create differencing virtual hard disks (VHDs) for the additional VMs and configure them to use XP1's VHD as the parent VHD. Correct Answer: D /Reference: QUESTION 22 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. The client computers in the domain run Windows XP Professional or Windows 7 Professional. The functional level of the domain is Windows Server 2008 R2. You use Microsoft Volume Licensing for the Windows 7 client computers and Windows Server 2008 R2 servers. A server named ABC-KMS1 runs the Key Management Service (KMS) to activate the volume licenses. The company purchases 10 new client computers for users in the Sales department. You install Windows 7 Professional on the client computers. You discover that the operating systems haven't automatically activated. Which two of the following options could you take to manually activate the operating systems using the KMS server? (Choose two. Each answer represents a complete solution.) A. You could activate the operating systems using the Control Panel System applet. B. You could activate the operating systems using the slmgr.vbs script with the -rearm parameter. C. You could activate the operating systems using the slmgr.vbs script with the -ato parameter. D. You could activate the operating systems using the Volume Activation Management Tool (VAMT). E. You could activate the operating systems using the Computer Management tool. Correct Answer: AC /Reference: : QUESTION 23 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. The company has decided to deploy Remote Desktop Services for application consolidation purposes. Users will use Remote Desktop Connections to connect to servers to run applications in Remote Desktop sessions. You install Windows Server 2008 R2 on a server and name it ABC-RDS1. You configure ABC- RDS1 to run the Remote Desktop Session Host role. You need to migrate user profile settings from client computers to ABC-RDS1.

13 How can you automate the migration of user profile settings from their client computers to ABC- RDS1? A. By running the Scanstate and Loadstate commands from the User State Migration Tool (USMT) 4.0. B. By running the Windows Easy Migration tool. C. By using the ImageX tool from the Windows Automated Installation Kit (WAIK). D. By using the Windows Optimized Desktop Toolkit. Correct Answer: A /Reference: : QUESTION 24 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional, Windows Vista Business and Windows 7 Enterprise. You are planning to deploy a virtual desktop infrastructure (VDI). The virtual machine computer accounts are located in an organizational unit (OU) named VirtualPCs. To provide a standard desktop environment to all users and to ensure that users cannot change the desktop environment, you configure a mandatory user profile. How can you ensure that all virtual desktop users use the mandatory profile? A. By configuring a Group Policy object (GPO) linked to the Default Domain Controllers OU to apply the mandatory user profile. B. By configuring a Group Policy object (GPO) linked to the VirtualPCs OU to apply the mandatory user profile. C. By copying the mandatory user profile to the All Users profile on each virtual machine. D. By copying the mandatory user profile to the Default User profile on each domain controller. Correct Answer: B /Reference: QUESTION 25 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run a mix of Windows Vista Business and Windows 7 Enterprise. The network includes a Remote Desktop Services environment for application consolidation. A Windows Server 2008 R2 server named ABC-RDS1 runs the Remote Desktop Session Host role. Users use Remote Desktop Connections to connect to ABC-RDS1 to run applications in Remote Desktop sessions. You deploy another Windows Server 2008 R2 server named ABC-RDGW1 and install the Remote Desktop Gateway (RD Gateway) role on it. ABC-RDGW1 will be used to provide external users access to virtual desktops on ABC-RDS1. You need to configure the corporate firewall to allow access to ABC-RDGW1. How should you configure the firewall?

14 A. You should enable inbound port B. You should enable inbound port 443. C. You should enable outbound port D. You should enable outbound port 443. Correct Answer: B /Reference: : QUESTION 26 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run Windows 7 Enterprise. The network includes 10 servers that run the Remote Desktop Session Host (RD Session Host) role. Company users can connect to any of the RD Session Host servers. The computer accounts for the RD Session Host servers are located in an organizational unit (OU) named ABC-RDSHservers. The computer accounts for the client computers are located in an organizational unit (OU) named ABC-Clients. The user accounts for all users are located in an organizational unit (OU) named ABC-Users. The domain controller computer accounts are located in the Default Domain Controllers container. You create a Group Policy object (GPO). The GPO is configured to redirect the Documents folder so that users can access their own Documents folder from any of the RD Session Host servers. Where should you link the GPO? A. You should link the GPO to the ABC-RDSHservers OU. B. You should link the GPO to the ABC-Clients OU. C. You should link the GPO to the ABC-Users OU. D. You should link the GPO to the Default Domain Controllers container. Correct Answer: A /Reference: : QUESTION 27 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory

15 Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. The company has decided to deploy Remote Desktop Services for application consolidation purposes. Users will use Remote Desktop Connections to connect to servers to run applications in Remote Desktop sessions. You install Windows Server 2008 R2 on a server and name it ABC-RDS1. You configure ABC- RDS1 to run the Remote Desktop Session Host role. You have purchased Remote Desktop Services client access licenses (RDS CALs). What should you do before installing the CALs? A. You should install the Active Directory Certificate Services role on a server. B. You should install Remote Desktop Licensing role. C. You should install the Remote Desktop Services Manager role. D. You should run the Manage RDS CALs application. Correct Answer: B /Reference: : QUESTION 28 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run Windows 7 Enterprise. The network includes 10 servers that run the Remote Desktop Session Host (RD Session Host) role. A server named ABC-RDLicensing runs the Remote Desktop Licensing role and has 200 Remote Desktop Services client access licenses (RDS CALs) installed. You are planning to deploy 20 new Windows 7 client computers to the network. You notice that the pool of RDS CALs is getting low. You want to return 20 RDS CALs to the license pool to accommodate the new client computers. How can you return 20 RDS CALs to the license pool? A. By rebooting 20 client computers that have Per Device RDS CALs. B. By logging off 20 users that have Per User RDS CALs. C. By reinstalling 20 RDS CALs. D. By revoking 20 Per User RDS CALs. E. By revoking 20 Per Device RDS CALs. Correct Answer: E /Reference: : QUESTION 29 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory

16 Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The network includes a virtual desktop infrastructure (VDI) environment that is used to provide a virtual Windows 7 desktop environment to company users. The virtual desktop image is stored on a server named ABC-VDI1. You have created an updated virtual desktop image and uploaded it to ABC-VDI1. You plan to use User State Migration Tool (USMT) 4.0 to migrate application settings from the original virtual desktop image to the new virtual desktop image. Which two of the following options describe how you should run the USMT commands? Choose two. A. On the original virtual desktop image, run Scanstate.exe with the /offlinewinold option. B. On the original virtual desktop image, run Scanstate.exe with the /hardlink option. C. On the original virtual desktop image, run Loadstate.exe with the /offlinewinold option. D. On the original virtual desktop image, run Loadstate.exe with the /hardlink option. E. On the new virtual desktop image, run Scanstate.exe with the /offlinewinold option. F. On the new virtual desktop image, run Scanstate.exe with the /hardlink option. G. On the new virtual desktop image, run Loadstate.exe with the /offlinewinold option. H. On the new virtual desktop image, run Loadstate.exe with the /hardlink option. Correct Answer: AH /Reference: : QUESTION 30 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers in the domain run Windows 7 Professional. You use Microsoft Volume Licensing for the Windows 7 client computers and Windows Server 2008 R2 servers. A newly installed server named ABC-KMS1 runs the Key Management Service (KMS) to activate the volume licenses. You discover that the client computers are not being activated. You suspect a DNS issue. You check the DNS zone for ABC.com and verify that there is a Host (A) record for ABC-KMS1. Which other type of DNS record should you check for? A. You should check that a PTR record exists for ABC-KMS1. B. You should check that an SOA record exists for ABC-KMS1. C. You should check that an SRV record exists for ABC-KMS1. D. You should check that a CNAME record exists for ABC-KMS1. Correct Answer: C /Reference: :

17 QUESTION 31 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional, Windows Vista Business and Windows 7 Enterprise. A server named ABC-CA1 is configured as a Certificate Authority for the ABC.com domain. You have installed a server named ABC-RDHost1 that runs the Remote Desktop Session Host (RD Session Host) role. Users will use RemoteApp connections to connect to ABC-RDHost1. You are creating Remote Desktop Protocol (.rdp) files to issue to users for the RemoteApp connections. You want to use certificates from ABC-CA1 to sign the.rdp files. Which three types of certificate could you use to sign the.rdp files? (Choose three.) A. You could use a Workstation Authentication certificate. B. You could use a Code Signing certificate. C. You could use a Server Authentication (SSL) certificate. D. You could use a User Authentication certificate. E. You could use a Remote Desktop Protocol (RDP) Signing certificate. Correct Answer: BCE /Reference: : QUESTION 32 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run Windows 7 Enterprise. The network includes two servers that run the Remote Desktop Session Host (RD Session Host) role. The computer accounts for the RD Session Host servers are located in an organizational unit (OU) named ABC-RDSHservers. The computer accounts for the client computers are located in an organizational unit (OU) named ABC-Clients. A new company security policy states that before users are authenticated for Remote Desktop Connections, the computer identities should you validated. You need to configure a Group Policy Object (GPO) to comply with the company security policy. Which three of the following steps describe how you should configure the GPO? Choose three. A. Enable the "Configure server authentication for client" setting. B. Disable the "Configure server authentication for client" setting. C. Select the "Do not connect if authentication fails" option. D. Select the "Always connect, even if authentication fails" option. E. Link the GPO to the ABC-RDSHservers OU. F. Link the GPO to the ABC-Clients OU. Correct Answer: ACE

18 /Reference: : QUESTION 33 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional and Windows 7 Enterprise. A Windows Server 2008 R2 server named ABC-RDS1 runs the Remote Desktop Session Host role. You install a custom graphics application named ABCApp1 as a RemoteApp application on ABC- RDS1. You need to ensure that ABCApp1 opens when a user double-clicks on a bitmap (.bmp) picture file. You plan to use TS RemoteApp Manager on ABC-RDS1 to create a Windows Installer file to distribute the RemoteApp package to users. How should you configure the RemoteApp package? A. You should enable the Allow any arguments setting when creating the package. B. You should remove the.bmp file extension association on the client computers. C. You should enable the client extensions for this program option when creating the package. D. You should deploy a Remote Desktop Protocol (.rdp) file to the client computers before installing the package. Correct Answer: D /Reference: : QUESTION 34 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. A Windows Server 2008 R2 server named ABC-RDS1 runs the Remote Desktop Session Host role. ABC- RDS1 hosts several RemoteApp applications. The RemoteApp applications are available to users in all ABC.com company departments. A Windows Server 2008 R2 server named ABC-RDSW runs the Remote Desktop Web Access (RD Web Access) role. ABC-RDSW provides Remote Desktop Web Access to the RemoteApp applications on ABC- RDS1. You install a custom sales application named ABCSalesApp as a RemoteApp application on ABC- RDS1. You need to configure RD Web Access so that only users in the Sales department can see ABCSalesApp as an available RemoteApp. Which two of the following steps would achieve this goal? (Choose two.) A. Move all user accounts for the Sales users to an Organization Unit (OU) named SalesUsers. B. Add all user accounts for the Sales users to a global security group named SalesUsers. C. Allow only the SalesUsers group NTFS permission to the folder containing ABCSalesApp.

19 D. Assign only the SalesUsers OU to the ABCSalesApp RemoteApp when enabling RD Web Access. E. Assign only the SalesUsers group to the ABCSalesApp RemoteApp when enabling RD Web Access. Correct Answer: BE /Reference: : QUESTION 35 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. The corporate firewall divides the network into an internal Local Area Network (LAN) and an external perimeter network. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. The perimeter network hosts servers that are accessible from the public internet. A Windows Server 2008 R2 server named ABC-RDS1 is located in the LAN and runs the Remote Desktop Session Host role. A Windows Server 2008 R2 server named ABC-RDSW is located in the LAN and runs the Remote Desktop Web Access (RD Web Access) role. ABC-RDSW provides Remote Desktop Web Access to the RemoteApp applications on ABC-RDS1. A Windows Server 2008 R2 server named ABC-RDGW is located in the perimeter network and runs the Remote Desktop Gateway (RD Gateway) role. To improve security, you move ABC-RDSW to the perimeter network. Users now report that they are unable to see the RemoteApp applications when the log on to RD Web Access. How can you ensure that RemoteApp applications on ABC-RDS1 are available through RD Web Access? A. By configuring the firewall to allow port 3389 between ABC-RDSW and ABC-RDS1. B. By configuring the firewall to allow Windows Management Instrumentation (WMI) communication between ABC-RDSW and ABC-RDS1. C. By restarting the World Wide Web Publishing Service on ABC-RDSW. D. By configuring the firewall to allow port 443 between ABC-RDSW and ABC-RDGW. Correct Answer: B /Reference: : QUESTION 36 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional and Windows 7 Enterprise. A Windows Server 2008 R2 server named ABC-RDS1 runs the Remote Desktop Session Host role. You install a custom graphics application named ABCApp1 as a RemoteApp application on ABC- RDS1. You need to deploy ABCApp1 so that users can access the application from a Start menu shortcut.

20 How should you create a package to deploy to the client computers? A. You should use TS RemoteApp Manager to create a Remote Desktop Protocol (.rdp) file. B. You should use TS RemoteApp Manager to.msi C. You should use Package Manager to create a Windows Image (.wim) file. D. You should use Windows Explorer to create a Shortcut (.lnk) file. Correct Answer: B /Reference: : QUESTION 37 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional and Windows 7 Enterprise. A Windows Server 2008 R2 server named ABC-RDS1 runs the Remote Desktop Session Host role and the Microsoft Application Virtualization (App-V) 4.6 client. You use App-V to publish a custom Sales application named ABC-SalesApp on ABC-RDS1. You want to provide external Sales users access to ABC-SalesApp. You provide the external Sales users a Remote Desktop Protocol file that enables them to use the Connect From Anywhere feature to access ABC- SalesApp on ABC-RDS1. You now need to configure the corporate firewall to allow the external connections to ABC-RDS1. Which port should you open on the firewall? A. You should open HTTP port 80. B. You should open RTSP port 554. C. You should open HTTPS port 443. D. You should open RDP port Correct Answer: D /Reference: RDP runs on 3389 QUESTION 38 You work as a network administrator at ABC.com. The company consists of a main office and a branch office. Both offices are part of a single Active Directory Domain Services domain named ABC.com. The two offices are connected by a slow WAN link. All servers are located in the main office and run Windows Server 2008 R2. All client computers in both offices run Windows 7 Enterprise. You are configuring a Microsoft Application Virtualization (App-V) 4.5 environment. You use App-V to virtualize an application. The virtual application will be used by users in both offices. When you test the virtual application from the branch office, you discover that the bandwidth of the WAN link is not sufficient to run the application.

21 Which two of the following options would enable the virtual applications to work in the branch office? (Choose two. Each answer represents part of the solution). A. Use App-V Desktop Client version 4.6 instead of version 4.5 on the branch office client computers. B. Install a Windows Server 2008 R2 server in the branch office. C. Install Microsoft System Center Application Virtualization Management Server in the branch office. D. Configure servercache in Host Cache mode in the branch office. E. Configure an Application Virtualization File Server in the branch office. Correct Answer: CE /Reference: : QUESTION 39 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. The client computers run a mix of Windows XP Professional, Windows Vista Business and Windows 7 Enterprise. The network includes a Microsoft Application Virtualization (App-V) environment. All Windows XP Professional client computers are 32-bit operating systems and run App-V Desktop Client 4.5. The Windows Vista client computers run either the 32-bit or 64-bit operating systems and run App- V Desktop Client 4.5. The Windows 7 client computers run either the 32-bit or 64-bit operating systems and run App-V Desktop Client 4.6. You plan to install a reference computer which will be used to virtualize a custom application. The virtualized application will be used by all company users. Which software configuration should you use on the reference computer? (Choose two. Each answer represents part of the solution). A. You should install Windows 7 64-bit. B. You should install Windows 7 32-bit. C. You should install Windows Vista 64-bit. D. You should install Windows Vista 32-bit. E. You should install Windows XP Professional 32-bit. F. You should install App-V Sequencer 4.5. G. You should install App-V Sequencer 4.6. Correct Answer: EF /Reference: : QUESTION 40

22 You work as a network administrator at ABC.com. The company consists of a main office and two branch offices. All three offices are part of a single Active Directory Domain Services domain named ABC.com. The two branch offices are connected by slow WAN links to the main office. All servers are located in the main office and run Windows Server 2008 R2. All client computers run Windows 7 Enterprise. Users with portable Windows 7 computers often travel between offices. A server named ABC-DC1 in the main office is configured as a domain controller and primary DNS server for the domain. You are configuring a Microsoft Application Virtualization (App-V) 4.6 environment. You deploy Windows Server 2008 R2 servers in the main office and both branch offices. The three servers run the IIS Server role. App-V users in each office will stream virtual applications from the local IIS server. How would you configure DNS to ensure that users in each office connect to their local IIS server to stream virtual applications? (Choose three. Each answer represents part of the solution). (Need to have confirmation on this answer) Create a single DNS A record and configure a HTTP host header for each IIS server. A. By creating a Host (A) record with the same name for each server. B. By creating an Alias (CNAME) record with the same name for each server. C. By creating a Service Locator (SRV) record with the same name for each server. D. By disabling Round Robin. E. By disabling Netmask Ordering. F. By enabling Round Robin. G. By enabling Netmask Ordering. Correct Answer: ABG /Reference: : QUESTION 41 You work as a network administrator at ABC.com. The company consists of a main office and a branch office. Both offices are part of a single Active Directory Domain Services domain named ABC.com. The two offices are connected by a slow WAN link. All servers are located in the main office and run Windows Server 2008 R2. All client computers in both offices run Windows 7 Enterprise. You are configuring a Microsoft Application Virtualization (App-V) 4.5 environment. You use App-V to virtualize an application. The virtual application will be used by users in both offices. When you test the virtual application from the branch office, you discover that the bandwidth of the WAN link is not sufficient to run the application. How can you enable the branch office users to run the virtual application? A. Use App-V Desktop Client version 4.6 instead of version 4.5 on the branch office client computers. B. Create a Windows Installer (.msi) package for the virtual application and deploy that to the branch office client computers. C. Install Microsoft System Center Application Virtualization Management Server in the branch office.

23 D. Configure BranchCache in Distributed Cache mode in the branch office. Correct Answer: B /Reference: : QUESTION 42 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. All client computers run Windows 7 Enterprise. The network includes a Microsoft Application Virtualization (App-V) environment. To troubleshoot an issue with App-V, you configure the registry by setting the following registry key to 0: HKLM \SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\State. What effect will this have on the client computer? A. It will disable FileSystem caching. B. It will reset the FileSystem cache. C. It will disable the cache space management feature. D. It will allow an unlimited FileSystem cache size. Correct Answer: B /Reference: : QUESTION 43 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. All client computers run Windows 7 Enterprise. The network includes a Microsoft Application Virtualization (App-V) 4.6 environment. You have multiple virtualized applications. One of the virtualized applications is named ABC- App1. You need to add some files to ABC-App1. Which two of the following steps describe how to add files to ABC-App1? (Choose two. Each answer represents part of the solution). A. Use the App-V Sequencer to open ABC-App1 with the Edit option. B. Use the App-V Sequencer to open ABC-App1 with the UABCrade option. C. Use the App-V Sequencer to sequence the additional files as a new application. D. Add the files and save the application with a new name. E. Add the files and save the application. Correct Answer: BE

24 /Reference: : QUESTION 44 Your company uses Microsoft Application Virtualization (App-V) 4.5 and 4.6. You maintain the sequencing for applications. All existing sequenced applications were sequenced by using App-V 4.5. You need to modify an existing sequenced application for deployment to a computer that runs Windows 7 Enterprise x64. What should you do? A. Edit the Sequencer Project (.sprj) file for the application and add <OS VALUE="X64"/>. B. Install the App-V bit sequencer. Edit the application by using the App-V bit sequencer. Add Windows 7 64-bit to the Selected Operating Systems list. C. Install the App-V bit sequencer. Open and save the application package by using the App-V bit sequencer. D. Edit the Sequencer Project (.sprj) file for the application and add <OS VALUE="Win7"/>. Correct Answer: A /Reference:

25 Exam B QUESTION 1 Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server. You need to select a digital certificate for signing Remote Desktop Protocol (.rdp) files. Which two certificate types can you use to achieve this goal? (Each correct answer presents a complete solution. Choose two.) A. Remote Desktop Protocol (RDP) Signing B. Workstation Authentication C. Authenticated Session D. Trusted third party SSL certificate Correct Answer: AD /Reference: You can sign.rdp files that are used for RemoteApp connections by using a Server Authentication certificate [Secure Sockets Layer (SSL) certificate], a Code Signing certificate, or a specially defined Remote Desktop Protocol (RDP) Signing certificate. QUESTION 2 Your company has a main office and four branch offices. You have an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You virtualize applications by using Microsoft Application Virtualization (App-V). You need to ensure that all users access virtualized applications from their local branch office, and allow for active upgrades. Which should you install in each branch office? A. a server with the File Services role installed B. a server with the Web Server (IIS) role installed C. Microsoft System Center Configuration Manager 2007 R2 D. Microsoft System Center Application Virtualization Streaming Server Correct Answer: D /Reference: The App-V Management Server streams the package content and publishes the shortcuts and file-type associations to the App-V Client. The App-V Management Server also supports active upgrade, license management, and a database that can be used for reporting. Application Virtualization (App-V) Streaming Server The App-V Streaming Server hosts the packages for streaming to App-V Clients in environments such as branch offices, where the bandwidth of the connection to the App-V Management Server is insufficient for streaming package content to clients. The Streaming Server contains only streaming functionality and does not provide you with the App-V Management Console or the App-V Management Web Service. Application Virtualization (App-V) Data Store The App-V data store, in the SQL database, retains information related to the App-V infrastructure. The

26 information in the App-V data store includes all application records, application assignments, and which groups manage the Application Virtualization environment. Application Virtualization (App-V) Management Service The App-V Management Service communicates read/write requests to the Application Virtualization data store. This component can be installed on the same computer as the App-V Management Server or on a separate computer with IIS installed. Application Virtualization (App-V) Management Console The App-V Management Console is a snap-in management utility for App-V Server administration. This component can be installed on the same computer as the App-V Server or on a separate workstation that has MMC 3.0 and.net 2.0 installed. Application Virtualization (App-V) Sequencer The App-V Sequencer monitors and captures the installation of applications and creates virtual application packages. The output of the Sequencer consists of the application icon, the OSD file containing application definition information, a package manifest file, and an SFT file containing the application s content files. Optionally, a Windows Installer file can be created for installing the package without using the App-V infrastructure. Application Virtualization (App-V) Client The App-V Client is installed on the App-V Desktop Client computer or on the App-V Terminal Services Client computer. It provides the virtual environment for the virtual application packages. The App-V Client manages the package streaming to the cache, virtual application publishing refresh, and interaction with the Application Virtualization Servers.

27 Application Virtualization (App-V) Management Server QUESTION 3 Your organization has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You need to deploy Microsoft Application Virtualization (App-V) 4.6 in a stand-alone configuration. Which should you install? A. Microsoft Application Virtualization Database

28 B. Microsoft Application Virtualization Desktop Client C. Microsoft System Center Application Virtualization Streaming Server D. Microsoft System Center Application Virtualization Management Server Correct Answer: B /Reference: QUESTION 4

29 Your company uses Microsoft Application Virtualization (App-V). When sequencing applications, you receive an error indicating that the App-V Sequencer is unable to save temporary files. You need to ensure that you can sequence applications. What should you do on the App-V Sequencer computer? A. Increase the amount of memory. B. Increase the size of the page file. C. Increase the priority of the App-V Sequencer process. D. Increase the storage space available to the scratch directory. Correct Answer: D /Reference: Configure the temp directory with enough free disk space. The Sequencer uses the %TMP% or %TEMP% directory and the Scratch directory to store temporary files during sequencing. You should configure these directories on the computer running the Sequencer with free disk space equivalent to the estimated application installation requirements. You can verify the location of the Scratch directory by opening the Sequencer console and selecting Tools, Options, and then selecting the Paths tab. Configuring the temp directories and the Scratch directory on different hard drive partitions can improve performance during sequencing. When you sequence large applications, use two hard drives. App-V (SoftGrid) Sequencer uses %TMP%, % TEMP%, and its own scratch directory for large temporary files. If you redirect these directories to a directory on a separate hard disk drive, you can shorten the sequence time. The %TMP% environment and the %TEMP% environment should be changed in the System control panel for the specific user account that will be used for sequencing. To change the App-V (SoftGrid) Sequencer scratch directory, click Options on the Tools menu, click the Path tab, and then change the directory that appears in Scratch Root. For example, on your primary hard disk drive, you have a "C" partition and a "Q" partition. And, on your secondary drive, you have an "E" partition. On the "E" partition, you can redirect the specified directories to E:\SEQTMP. Frequently asked questions What do I do if an application must install to drive C? To simplify the Sequencing process, we recommend that you use the same drive for the Installation directory, for the Asset directory, and for the App-V (SoftGrid) client mount. By default, App-V (SoftGrid) labels the drive "Drive Q." Because certain applications must be installed on drive C or because some application must be run from drive C, App-V (SoftGrid) Sequencer accommodates this requirement. In this case, do not give the Asset directory the same name as the Installation directory. We do not recommend that you sequence to drive C for the following reasons: Depending on how the sequencing is performed, the process may introduce small App-V (SoftGrid) overhead or a significant App-V (SoftGrid) overhead. The specific drive letter, "C", must be present on the App-V (SoftGrid) client. To accommodate this situation, specify a directory on drive C for the Installation directory during the sequencing process. Then, specify a directory on drive Q to use as the Asset directory. This causes the whole application to be run on the App-V (SoftGrid) Virtual File System. Do not modify the FILENAME attribute to point to drive C. The executable file that is specified in this attribute must point to drive Q. What do I do if I have to sequence an MMC snap-in or an Internet Explorer plug-in? Note Examples of Internet Explorer plug-ins include different versions of Java runtimes, different versions of ActiveX components, different versions of Flash runtimes, and different versions of Shockwave runtimes. Even though you cannot sequence core operating system components such as Windows Internet Explorer, you can create multiple virtual environments for each of these applications. Make sure that you do not install these

30 applications during the sequencing process. Instead, refer to the local copy of the application. This causes the local application to be pulled into a virtual environment that includes the desired version of the plug-in that was sequenced. The correct versions of the core operating system components on the App-V (SoftGrid) clients must match the versions on App-V (SoftGrid) Sequencer. To create the sequence, follow these steps: Create an empty folder on drive Q. Point to this folder when App-V (SoftGrid) Sequencer asks where the application was installed during the installation phase. Install the plug-in to this location on drive Q during the installation phase. During the execution phase, test the application by using local shortcuts. Then, save the sequence. Modify the.osd file to point to the local core operating system executable file by using appropriate parameters. For example, if you are sequencing an Internet Explorer plug-in, use the following parameters: FILENAME="%CSIDL_PROGRAM_FILES%\Internet Explorer\IExplore.exe" If you are sequencing an MMC snap in, use the following parameters: FILENAME="%CSIDL_SYSTEM%\MMC.EXE" PARAMETERS="%SFT_MNT%\Asset directory name\path to an.msc file" Why should I sequence an application to a root folder that has a unique name of eight characters or less? You must use a globally unique name because each application is mounted on drive Q as "Q:\Asset folder name." We recommend that you use eight characters or less to make sure that the short path names of the files are correctly preserved on the client. Certain operating system components require short names. For example, when Microsoft Office XP is installed on the App-V (SoftGrid) Sequencer computer, it is assigned the short path name of "Micros~1". When Microsoft Office 2000 is installed on the App-V (SoftGrid) Sequencer computer, after the computer has been hosted to the original state, it is assigned the short path name of "Micros~1". If Microsoft Office XP is streamed to a fresh client, it is given the short path name of "Micros~1". If Microsoft Office 2000 is then streamed to the same client, it is given the short path name of "Micros~2". This causes the application to fail because non-parsed registry keys point to "Micros~1". If you hardcode two applications to Q:\Office, and then you try to stream the second version of Office when the first version of Office is already streamed, the App-V (SoftGrid) client will be unable to correctly mount the second version of Office on the drive Q. Can I sequence an application on one operating system and then stream it to another operating system? Yes, App-V (SoftGrid) lets you sequence on one operating system and then stream it to another operating system. However, the application may not work correctly if it detects the operating system version when the application is installed. The application may select different components depending on that detection. This may cause problems depending on the component compatibility with other operating systems. Before you try to stream an application to another operating system, determine whether additional sequencings are required for each operating system. You may have to contact the application vendor. What are the current limitations of the Save-As feature? The current version of the App-V (SoftGrid) Sequencer Save-As feature requires that the package root directory, the asset directory, be changed as part of the process. This can cause applications that have hardcoded paths or that have some forms of copy protection to fail after a Save-As operation. To work around this problem, resequence the application without using the Save-As feature. The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. QUESTION 5 Your company has an Active Directory Domain Services (AD DS) domain. You virtualize applications by using Microsoft Application Virtualization (App-V). You are creating an application virtualization package. You need to allow Microsoft Update to run during monitoring. Which should you use? A. Microsoft Application Virtualization Sequencer B. Microsoft Application Virtualization Desktop Client

31 C. Microsoft System Center Application Virtualization Streaming Server D. Microsoft System Center Application Virtualization Management Server Correct Answer: A /Reference:

32 QUESTION 6 All client computers in your environment run Windows 7, You virtualize applications by using Microsoft Application Virtualization (App-V). You need to reset the FileSystem cache on a client computer. What should you do? A. Use the AppVCacheSize tool to set the maximum cache size to 0. B. Use the AppVCacheSize tool to set the minimum free disk space threshold to 0. C. Set the HKLM\SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\State registry key to 0. D. Set the HKLM\SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\FileSize registry key to 0. Correct Answer: C /Reference: How to Reset the Application Virtualization File System Cache File? When you remove an application from SoftGrid Client Management, the application is removed from the SoftGrid Client cache. However, the size of the cache file does not decrease. You may have to recover disk space by manually reducing the size of the cache file. You can do this by using the following method. This method removes all the application data from the SoftGrid Client cache. Therefore, the size of the cache is reduced to zero. However, the applications remain listed in

33 SoftGrid Client Management. Additionally, the user settings remain intact. Therefore, the applications are loaded the next time that the application starts. Remove application data from the SoftGrid Client cache To manually reduce the size of the cache file, follow these steps: Start Registry Editor. Expand HKEY_LOCAL_MACHINE, and then expand SOFTWARE. Expand Softricity, and then expand SoftGrid Client. Expand CurrentVersion, and then click AppFS. Right-clickState, and then clickmodify. Type0in thevalue databox, and then clickok. Exit Registry Editor. Restart the SoftGrid Client computer. For Application Virtualization versions 4.5 and later: Start Registry Editor. Locate the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Softgrid\4.5\Client\AppFS. Right-click State, and then click Modify. Type 0 in the Value data box, and then click OK. Exit Registry Editor. Restart the App-V Client computer. QUESTION 7 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You virtualize applications by using Microsoft Application Virtualization (App-V). You are deploying servers to five new branch offices. Each branch office will stream virtual applications from a local file server and perform application sequencing locally. You need to replicate application packages to all file servers and minimize bandwidth usage. What should you do? A. Create a Distributed File System (DFS) root on each file server. B. On each file server, add the BranchCache for network files role service. C. Create an Active Directory Distributed File System (DFS) root target folder. D. Create a Distributed File System Replication (DFSR) full mesh replication group. Correct Answer: D /Reference:

34

35 The Full Mesh Topology Another commonly used replication topology is the full mesh topology.

36 This topology, shown in Figure B, allows every replica to replicate with every other replica. The advantage of using this topology is that replication will still continue to function even if a server drops off-line. Of course the disadvantage to using this method is that it can result in an excessive amount of replication traffic. QUESTION 8 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You provide access to some applications that run on Windows 7 through a virtual desktop infrastructure (VDI) environment. You add a new Windows 7 virtual desktop image to the same server as an existing Windows 7 virtual desktop image. You need to ensure that all application settings are copied from the original virtual desktop image to the new virtual desktop image. What should you do? (Need to verify) A. From the new virtual desktop, run Windows Easy Transfer and use the network option. B. From the original virtual desktop, run Windows Easy Transfer and use the Easy Transfer cable option. C. On the new virtual desktop, run the ScanState tool with the /hardlink option, and then run the LoadState tool

37 with the /offlinewinold option. D. On the original virtual desktop, run the ScanState tool with the /offlinewinold option. From a command prompt on the new virtual desktop, run the LoadState tool with the /hardlink option. Correct Answer: D /Reference:

38 QUESTION 9 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You have a Remote Desktop Session Host (RD Session Host) server and a Remote Desktop Gateway (RD Gateway) server. You change the configuration of Windows Firewall by using Group Policy. Users on the corporate network are then unable to connect to their virtual desktops. You need to ensure that users can connect to their virtual desktops. What should you do? (Each correct answer presents part of the solution. Choose two.) A. Create a Windows Firewall inbound rule for port 443 on the RD Gateway server. B. Create a Windows Firewall inbound rule for port 443 on the RD Session Host server. C. Create a Windows Firewall inbound rule for port 3389 on the RD Gateway server. D. Create a Windows Firewall inbound rule for port 3389 on the RD Session Host server. Correct Answer: AD

39 /Reference: Connection type VMM server to VMM agent on Windows Server based host (control) VMM server to VMM agent on Windows Server based host (file transfers) VMM Self-Service Portal to VMM self-service Web server VMM library server to hosts VMM host-to-host file transfer VMConnect (RDP) to Hyper-V hosts Remote Desktop to virtual machines VMware Web Services communication SFTP file transfer from VMM server to VMWare ESXServer3i hosts Protocol WS-Management HTTPS (using BITS HTTPS BITS BITS RDP RDP HTTPS HTTPS What does TS Gateway do? TS Gateway provides many benefits, including: TS Gateway enables remote users to connect to internal network resources over the Internet, by using an encrypted connection, without needing to configure virtual private network (VPN) connections. TS Gateway provides a comprehensive security configuration model that enables you to control access to specific internal network resources. TS Gateway provides a point-to-point RDP connection, rather than allowing remote users access to all internal network resources. TS Gateway enables most remote users to connect to internal network resources that are hosted behind firewalls in private networks and across network address translators (NATs). With TS Gateway, you do not need to perform additional configuration for the TS Gateway server or clients for this scenario. Prior to this release of Windows Server, security measures prevented remote users from connecting to internal network resources across firewalls and NATs. This is because port 3389, the port used for RDP connections, is typically blocked for network security purposes at the firewalls. TS Gateway transmits RDP traffic to port 443 instead, by using an HTTP Secure Sockets Layer/Transport Layer Security (SSL/ TLS) tunnel. Because most corporations open port 443 to enable Internet connectivity, TS Gateway takes advantage of this network design to provide remote access connectivity across multiple firewalls. The TS Gateway Manager snap-in console enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources. For example, you can specify: Who can connect to network resources (in other words, the user groups who can connect). What network resources (computer groups) users can connect to. Whether client computers must be members of Active Directory security groups. Whether device and disk redirection is allowed. Whether clients need to use smart card authentication or password authentication, or whether they can use either method. You can configure TS Gateway servers and Terminal Services clients to use Network Access Protection (NAP) to further enhance security. NAP is a health policy creation, enforcement, and remediation technology that is included in Windows XP Service Pack 3 (SP3), Windows Vista, and Windows Server With NAP, system administrators can enforce health requirements, which can include software requirements, security update requirements, required computer configurations, and other settings. Note Computers running Windows Server 2008 cannot be used as NAP clients when TS Gateway enforces NAP. Only computers running Windows XP with SP3 and Windows Vista can be used as NAP clients when TS Gateway enforces NAP. QUESTION 10 You use Microsoft Application Virtualization (App-V).

40 You need to automate the process of sequencing applications. Which command should you run? A. SFTSequencer / UPGRADE:" P ath ToS ourcesprj " / INSTALLPACKAGE:" PathToUpgradeInstalIer " / DECODEPATH:" P ath T o D ecode F older " / OUTPUTFILE:" P ath T o D estinationsprj " B. SFTMIME configure package: "PackageName " / OverrideURL FILE: "PathTOSFT " C. SFTSequencer / I:"PathToMSI " / P:"PathToPackageRoot " / 0:"PathToDestinationSPRJ " D. SFTMIME ADD APP:"AppIicationName " /OSD " PathToOSD " /CONSOLE Correct Answer: C /Reference: How to Upgrade a Virtual Application by Using the Command Line Use the following procedure to upgrade a virtual application by using a command line. To upgrade a virtual application On the computer that is running the Application Virtualization (App-V) Sequencer, to open the command prompt, select Start,Run, and type cmd. Click OK. At the command prompt, specify the location where the App-V Sequencer is installed. For example, at the command prompt, you could type the following:cd C:\Program Files\Microsoft Application Virtualization Sequencer. At the command prompt, type the following command, replacing the text in quotation marks with your values: SFTSequencer /UPGRADE: pathtosourcesprj /INSTALLPACKAGE: pathtoupgradeinstaller /DECODEPATH: pathtodecodefolder /OUTPUTFILE: pathtodestinationsprj You can specify additional parameters by using the command line, depending on the complexity of the application you are upg that are available for use with the App-V Sequencer, seesequencer Command-Line Parameters. Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. Value pathtosourcesprj pathtoupgradeinstaller pathtodecodefolder pathtodestinationsprj Press Enter. Description Specifies the directory location of the virtual application to be upgraded. Specifies the Windows Installer or a batch file that will be used to install an u Specify the directory in which to unpack the SFT file. Specifies the path and file name of the SPRJ file that will be created. Sequencer Command-Line Parameters You can use the following Application Virtualization (App-V) Sequencer parameters to sequence an application and to upgrade an existing virtual application by using a command line. For more information about sequencing an application by using a command line, Sequencer Command-Line Parameters /HELP or /? Displays information about parameters that are available for using a command line to sequence applications. /INSTALLPACKAGE or /I : Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced. /INSTALLPATH or /P : Specifies the package root directory for an application. /OUTPUTFILE or /O : Specifies the path and file name of the SPRJ file that will be generated. /FULLLOAD or /F : Specifies whether all files will be contained in the primary feature block. If the/

41 FULLLOADparameter is specified on the command line, all of the associated application data is added to primary feature block. If the/fullloadparameter is not specified on the command line, then none of the associated application data is added to the primary feature block. /PACKAGENAME or /K :Specifies the package name that will be assigned to the sequenced application. /BLOCKSIZE Specifies the SFT file block size that will be used to stream the package to client computers. You can select one of the following values: 4 KB 16 KB 32 KB 64 KB You should consider the size of the SFT file when you specify the block size. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes use more network bandwidth. /COMPRESSION Specifies the method for compressing the SFT file that will be streamed to the client. /MSI or /M Specifies whether a Windows Installer for the sequenced application should be created. /DEFAULT Specifies the default SPRJ file that will be used when creating a virtual application package. This file is used as the.sprj template when the application is sequenced for the first time. /UPGRADE Specifies the path and file name of the SPRJ file that will be upgraded. /DECODEPATH Specifies the directory on the sequencing computer where the files associated with the sequenced application package are installed. Use one of the following formats when specifying the directory: /decodepath:q: /decodepath:q:. /decodepath: Q:. /decodepath: Q: QUESTION 11 All client computers in your company run Windows 7 Enterprise. Each client computer runs one guest virtual machine (VM) in Windows Virtual PC. A user reports that a supported USB device connected to his client computer does not appear in the guest VM. The USB device functions correctly on the client computer. You need to ensure that the USB device can be installed in the guest VM. What should you do? A. Use Virtual PC Manager to attach the USB device on the host. B. Use the Computer Management console to scan for hardware changes in the guest. C. Run the Add Hardware Wizard in the guest. D. Use the Computer Management console to update the USB Virtualization Bus driver on the host. Correct Answer: A /Reference: USB Architecture in Windows Virtual PC Some old legacy devices may not have driver support for newer operating systems (Windows Vista and beyond). Windows Virtual PC (WVPC) makes it possible to use these devices in Windows 7, using Windows XP Mode. Users can, at the same time, utilize the benefits of newer and secure features of Windows 7. In this article, we will describe the USB architecture in WVPC. Typical USB devices used in a Virtual Machine (VM) are: Printers Flash memory sticks

42 External hard disks Webcams and Digital cameras Smartcards Figure 1a: USB Menu on a Virtual Machine s Tool Bar Figure 1b: Manage USB Devices for Virtual Applications Details on using these devices with the VM can be found in anearlier post. WVPC uses theredirection Policy Manager(RPM) of the Windows to provide the USB redirection in a Virtual Machine. It loads an alternate driver in the lieu of the original driver to redirect the device to a Virtual machine. WVPC creates a virtualized host controller in the Virtual Machine that is being offered using a VPCBus Channel. For more details, please refer toearlier post. USB Architecture The overall USB architecture is shown in Figure 2.

43 Figure 2: USB Architecture showing a USB Device in VM USB architecture consists of a server side component running in Host OS and a client side component running in Virtual Machine. The server side involves a Connector driver to manage USB devices and a Stub instance for every USB Device. The client side implements a VPCBus enumerated virtual host controller that supports the subset of the USB driver interfaces that are necessary for compatibility with the supported devices. The redirection process also triggers the connector driver to send commands to the guest to create the PDO for the redirected device. After this the Stub driver, Connector driver and the Virtual bus/hub driver work in unison to enable communication of commands, responses and data between physical USB device and the redirected USB device. Component details are described below: Server Side (Host OS) A channel is created by Virtual PC host process (VPC.exe) through the Connector Driver using VPCBus whenever a VM boots up. Also, a server side hub instance is created internally by the Connector with this channel for every VM. There are two drivers on the server side as below: The Connector driver provides services regardless of the devices that are currently connected. The USB Stub driver is the alternate driver loaded by the USB stack instead of the vendor supplied or system supplied driver for the device using RPM. Please refer Figure 2. The Stub driver just forwards requests from the Connector driver to the PDO created by the hub driver. A total of up to 8 USB devices can be assigned to a VM at a time. HID and Hub Class Devices cannot be assigned to the VM. The USB devices in VM can be safely removed just like in Host OS whenever the USB device driver supports. QUESTION 12 Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You create a Windows XP image. You need to deploy the image as a virtual machine (VM) to the client computers so that the image can run in

44 Windows Virtual PC. Which should you use? A. Microsoft System Center Configuration Manager 2007 R2 B. Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 with a template C. Microsoft System Center Virtual Machine Manager (VMM) 2008 with a template D. Microsoft Virtual Desktop Infrastructure (VDI) Correct Answer: A /Reference: VMM - is for virtual machines VDI - is complete set of desktop virtualization not the image management.

45 QUESTION 13 Your company has an Active Directory Domain Services (AD DS) domain. You plan to virtualize an applications by using Microsoft Application Virtualization (App-V). You are creating an application virtualization package.

46 What should you use? A. Microsoft Application Virtualization Sequencer B. Microsoft Application Virtualization Desktop Client C. Microsoft System Center Application Virtualization Streaming Server D. Microsoft System Center Application Virtualization Management Server Correct Answer: A /Reference: QUESTION 14 Your company runs Remote Desktop Services. All client computers run Windows Vista SP2. You have a Remote Desktop Session Host (RD Session Host) server. You need to deploy a RemoteApp application to client computers and ensure that the application appears on the Start menu. Which file type should you distribute to the client computers? A. Windows Installer (.msi) B. Client Configuration File (.wcx) C. Remote Desktop Protocol (.rdp) D. RemoteApp Programs list and settings (.tspub) Correct Answer: A

47 /Reference: QUESTION 15 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You activate the Key Management Service (KMS) on a server to handle volume activation for your Windows 7 client computers. Windows 7 client computers are not being activated. The KMS licensing status is shown as Licensed. The Windows Event Log does not contain any corresponding activation-related events. You need to ensure that the KMS server can activate Windows 7 client computers. What should you do? A. Run the slmgr.vbs /dlv command. B. Run the slmgr.vbs /ato command.

48 C. Add a DNS SOA record pointing to the KMS server. D. Add a DNS SRV record pointing to the KMS server. Correct Answer: D /Reference: QUESTION 16 Your company has an Active Directory Domain Services (AD DS) domain that runs at the Windows Server 2008 functional level. All servers run Windows Server 2008 R2. All client computers run Windows XP Professional. You use the Key Management Service (KMS) to manage your volume license activations. All servers have been activated by using KMS. You deploy 20 Windows 7 virtual desktops. The virtual desktop operating systems do not activate. You need to ensure that the virtual desktops activate by using KMS. What should you do? A. Deploy five more virtual desktops. B. Run slmgr.vbs with the -ato parameter. C. Use the Volume Activation Management Tool (VAMT). D. Raise the domain functional level to Windows Server 2008 R2. Correct Answer: B

49 /Reference: With KMS you can complete activations on your local network, eliminating the need for individual computers to connect to Microsoft for product activation. KMS is a lightweight service that does not require a dedicated system and can easily be co-hosted on a system that provides other services. By default, volume editions of Windows 7 and Windows Server 2008 R2 connect to a system that hosts the KMS service to request activation. No action is required from the user. KMS requires a minimum number of computers (physical or virtual machines) in a network environment. The institutions must have at least five computers to activate Windows Server 2008 R2 and at least 25 computers to activate clients that are running Windows 7. These minimums are referred to as activation thresholds. QUESTION 17 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. The company has decided to deploy Remote Desktop Services for application consolidation purposes. You install Windows Server 2008 R2 on a server and name it ABC-RDS1. You configure ABC- RDS1 to run the Remote Desktop Session Host role. You need to ensure the Remote Desktop connections are as secure as possible by ensuring that the session is not created until the user is authenticated. How should you configure ABC-RDS1? A. You should set the security layer option to the RDP Security Layer. B. You should configure the firewall to block port C. You should configure the server to allow connections only to Remote Desktop client computers that use Network Level Authentication. D. You should set the encryption level option to FIPS Compliant.

50 Correct Answer: C /Reference: : 1) All connections from computers running any version of Remote Desktop or 2) Allow connections only from computers running Remote Destop with Network Level Authentication QUESTION 18 You work as a network administrator at ABC.com. The company consists of a main office and a branch office. Both offices are part of a single Active Directory Domain Services domain named ABC.com. The two offices are connected by a slow WAN link. All servers are located in the main office and run Windows Server 2008 R2. All client computers in both offices run Windows 7 Enterprise. The company has decided to deploy Remote Desktop Services for application consolidation purposes. You install Windows Server 2008 R2 on a server in the main office and name it ABC-RDS1. You configure ABC-RDS1 to run the Remote Desktop Session Host role. Users in the branch office report slow performance when accessing applications on ABC-RDS1.

51 You want to minimize the bandwidth used by branch office user's connections to ABC-RDS1. How can you minimize the bandwidth used? A. By installing a Global Catalog server in the branch office. B. By configuring ABC-RDS1 to allow computers from clients running any version of Remote Desktop. C. By selecting a lower connection speed in the Remote Desktop Connection options on each client computer in the branch office. D. By selecting High Color (16 bit) in the Remote Desktop Connection options on each client computer in the branch office. Correct Answer: D /Reference: : QUESTION 19 You work as a network administrator at ABC.com. The company consists of a main office and two branch offices. All three offices are part of a single Active Directory Domain Services domain named ABC.com. The

52 two branch offices are connected by slow WAN links to the main office. All servers run Windows Server 2008 R2 and all client computers run Windows 7 Enterprise. A server named ABC-DC1 in the main office is configured as a domain controller and primary DNS server for the domain. You are configuring a Microsoft Application Virtualization (App-V) 4.6 environment. You deploy Windows Server 2008 R2 servers in the main office and both branch offices. You want users in each office to stream virtual applications from their local server. You also want the clients to automatically receive any uabcrades to the virtual applications. How should you configure the new servers? A. You should install the Web Server (IIS) role on all three servers. B. You should install Microsoft System Center Application Virtualization Streaming Server on all three servers. C. You should install Microsoft System Center Configuration Manager on the main office server and install the File Services role on the branch office servers. D. You should install Microsoft System Center Configuration Manager on the main office server and install the Web Server (IIS) role on the branch office servers. Correct Answer: B /Reference: Application Virtualization (App-V) Management Server The App-V Management Server streams the package content and publishes the shortcuts and file-type associations to the App-V Client. The App-V Management Server also supports active upgrade, license management, and a database that can be used for reporting. Application Virtualization (App-V) Streaming Server The App-V Streaming Server hosts the packages for streaming to App-V Clients in environments such as branch offices, where the bandwidth of the connection to the App-V Management Server is insufficient for streaming package content to clients. The Streaming Server contains only streaming functionality and does not provide you with the App-V Management Console or the App-V Management Web Service. Application Virtualization (App-V) Data Store The App-V data store, in the SQL database, retains information related to the App-V infrastructure. The information in the App-V data store includes all application records, application assignments, and which groups manage the Application Virtualization environment. Application Virtualization (App-V) Management Service The App-V Management Service communicates read/write requests to the Application Virtualization data store. This component can be installed on the same computer as the App-V Management Server or on a separate computer with IIS installed. Application Virtualization (App-V) Management Console The App-V Management Console is a snap-in management utility for App-V Server administration. This component can be installed on the same computer as the App-V Server or on a separate workstation that has MMC 3.0 and.net 2.0 installed. Application Virtualization (App-V) Sequencer The App-V Sequencer monitors and captures the installation of applications and creates virtual application packages. The output of the Sequencer consists of the application icon, the OSD file containing application definition information, a package manifest file, and an SFT file containing the application s content files. Optionally, a Windows Installer file can be created for installing the package without using the App-V infrastructure. Application Virtualization (App-V) Client The App-V Client is installed on the App-V Desktop Client computer or on the App-V Terminal Services Client computer. It provides the virtual environment for the virtual application packages. The App-V Client manages

53 the package streaming to the cache, virtual application publishing refresh, and interaction with the Application Virtualization Servers. QUESTION 20 You work as a network administrator at ABC.com. The ABC.com network consists of an Active Directory Domain Services domain named ABC.com. All servers on the network run Windows Server 2008 R2. All client computers run Windows 7 Enterprise. The ABC.com virtualization environment includes Remote Desktop Services, Microsoft Application Virtualization (App-V) 4.6 and Microsoft Enterprise Desktop Virtualization (MED-V). Members of the ABC.com Sales team use portable computers and often work away from the office. You want to create a virtualized application package that contains two Sales applications. The Sales applications require authorization to run and will need to be available for offline use for the roaming Sales users. Which three of the following steps describe how you should create the virtualized Sales application package? (Choose three. Each answer represents part of the solution). A. You should use MED-V to create the package. B. You should use App-V to create the package. C. You should install the applications on a Remote Desktop Session Host server. D. You should configure the ApplicationSourceRoot registry key on each client computer. E. You should configure the AutoLoadTriggers, AutoLoadTarget and RequireAuthorizationCached registry keys on each client computer. F. Log in to each client computer as administrator and launch one of the Sales applications. G. Log in to each client computer as the Sales user and launch one of the Sales applications. Correct Answer: BEG /Reference: : QUESTION 21 Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that remote desktop users can print only to the printers that are installed on the RD Session Host server. What should you do? A. Enable the Do not allow client printer redirection Group Policy setting. B. Disable the Do not allow client printer redirection Group Policy setting. C. Enable the Do not set default client printer to be default printer in a session Group Policy setting. D. Disable the Do not set default client printer to be default printer in a session Group Policy setting. Correct Answer: C /Reference:

54 QUESTION 22 All Client computers in your company run Windows 7 Enterprise. Users run Windows XP Mode guest virtual machines (VMs) on their computers. Each client computer runs two guest VMs. Each guest VM requires network connectivity to the other guest VM on the host computer, but most not have network connecticity to the host computer operating system or to the internet You need to configure each guest VM to meet the requirements. What should you do? A. Set each VM network adapter to Not connected. B. Configure each VM to use one Internal Network network adapter. C. Configure each VM to use one Shared Networking (NAT) network adapter. D. Disable Integration Features for each VM. Configure Windows Firewall to allow incoming ICMP traffic, and remove all other Windows Firewall exceptions Correct Answer: B /Reference: - Shared Networking (NAT) refers to a virtual NAT (Network Address Translation) which allows the VM to leverage the external TCP/IP network connected to the host. This is very useful if you regularly move the host computer between different network configurations. NAT is the preferred networking option when there is a shortage of IP addresses, a need to ensure the VM s IP address is not targetable from an external network, or a need for connecting using WWAN.

55 - In contrast, Bridge mode uses the network adapter on the host. This option appears in the drop down menu as the name of the adapter. The VM is connected directly to the selected network connection of the Windows 7 host, and will behave like a separate physical computer on the same network. If the host has a wireless adapter, its name will appear in the dropdown list. In Bridge mode, Virtual Machine Network Services driver helps redirect the incoming network traffic to the correct VM and associate the correct MAC address in all outbound network traffic. In scenarios using VPN, Bridge mode is the preferred option. - Choosing the option Not connected disables the VM s networking ability and completely isolates it from the network. - Internal Network option enables networking among only the VMs on the single Windows 7 host.

56 Windows Server-based hosts on a perimeter network Aperimeter networkis separate from an organization's internal network and the Internet and has the following characteristics: Allows external users to access specific computers located on the perimeter network. Prevents access to computers on the organization's internal network. Can be set up to allow limited access from users on the internal network to computers located on the perimeter network. For example, a perimeter network can include the company's Web server so that it can deliver Web content to the Internet. However, the perimeter network does not allow external users to access any private company data on computers on the internal network. Even if an external user penetrates the perimeter network security, only the perimeter network servers might be compromised. You can deploy virtual machines on a host on a perimeter network from within the internal network. However, after you deploy virtual machines on a host on a perimeter network, you cannot migrate those virtual machines back to a host on the internal network or to another host on the perimeter network. Because a perimeter network is separate from the internal network, security for a host on a perimeter network must be provided by a local service account. QUESTION 23 Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You are deploying Microsoft Enterprise Desktop Virtualization (MED-V) virtual machines (VMs) on several client computers. You need to ensure that names of the new VMs follow a naming convention. What should you do? A. In the MED-V Management console, configure the Image Update Settings. B. In the MED-V Management console, add a script action and set the VM computer name pattern. C. In the VM, configure the Identification String option by using the Setup Manager Wizard. D. In the VM, run the System Preparation Tool (Sysprep) and choose to start the factory session after rebooting. Correct Answer: B /Reference: Using Variables to Manage the Naming of your Persistent MED-V Workspaces Many organizations want to use variables to simplify the naming and manageability of MED-V workspaces. While regular operating system environment variables cannot be used inside the workspace policy, MED-V has variables that can be used for persistent workspaces. The workspace policy must use the VM Setup script to implement these variables. These variables can be selected when configuring the MED-V workspace policy inside the MED-V management console (run from the client.) To view and select these variables, do the following: 1.) Log into the MED-V Management Server (policy server) using the MED-V Management utility. 2.) When the policy loads, navigate to the Policy node. 3.) Select your desired workspace, then click on the VM Setup Tab. (Be advised that this option is only available for persistent workspaces which is defined in the Virtual Machine tab.) 4.) In the VM Setup tab you will see an option for "VM Computer Name Pattern" near the bottom of the page.

57 The default pattern for the machine image name is: MED-V%workspace########## where %workspace represents the name of the workspace used by this image on the client computer. The remaining # characters denote a random generated character. It is here where you have the option to insert different variables and where you can define your own computer name pattern. The variables that can be used are: %Workspace: The name of the MED-V workspace being used by this image during the VM setup. %User: The name of the user logged on to MED-V during the VM setup. %Domain: The domain name (short name) of the authenticating MED-V Active Directory domain. %Hostname: The hostname of the physical machine running the MED-V Client using this workspace. %VMName: The name of the Virtual Machine name (Name of the virtual machine image file used by the workspace.) Examples: If a user named Ernie from the domain CORPORATE logged on to a machine named CLIENT234 using the workspace called IE_7 leveraging the image XP01 will have the following name translations after generation: VM Computer Name Pattern Actual Name MED-V%Domain##### MED-VCORPORATE5 %Workspace-%User IE_7-ERNIE %UserMED-V ERNIEMED-V %Hostname-MEDV CLIENT234-MEDV %VMNameMEDV##### XP01MEDV64345 NOTE: The maximum limit for a name is 15 characters. Any pattern that generates a result that exceeds this limit will be truncated to the first 15 characters.

58 5.) Once this is determined, you will need to include the action within the VM setup script. This will require you to click the "Script Editor" option under Persistent VM Setup. Click on this button. The "Rename Computer" Action is required to generate the computer name. Also note, this will need to be followed by a "Restart Computer" action. QUESTION 24 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You use Microsoft Enterprise Desktop Virtualization (MED-V) to support client virtualization requirements. You need to ensure that all MED-V virtual machine (VM) images can be centrally stored and are available to all client computers. What should you do? A. Install and configure IIS on a member server. B. Configure a shared folder on a member server. C. Create a visible workspace for client computers. D. Install and configure Microsoft SQL Server on a member server. Correct Answer: A /Reference: An image repository is an optional server that is used for image distribution (where administrators upload new images and client computers check the server every 15 minutes and update their image if a new one is available). An image distribution server requires the following: Internet Information Services (IIS) During the IIS installation, when adding role services, select the following supported authentication methods: Basic Authentication Windows Authentication Client Certificate Mapping Authentication

59 When configuring IIS, include the following: Add a virtual directory, with the alias named MEDVImages. The physical path should point to the location of the images. Enable BITS. Add the following MIME types: -.ckm (application/octet-stream) -.index (application/octet-stream) On the MED-V site, add read permissions to Everyone. Restart IIS. QUESTION 25 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You update the MED-V Workspace virtual machines (VMs) several times and notice that the server is running out of disk space. You need to configure the Workspace to minimize the disk space requirements. What should you do? ( Need to validate the answer) A. Configure the Workspace as revertible. B. Set an expiration date for the Workspace. C. Specify the number of image versions to keep. D. Specify that clients should use the Trim Transfer when downloading the images.

60 Correct Answer: D /Reference: Base VHD + (User per computer x (Difference Disk + Saved State)) If you are updating the image several times then you will have multiple workspace and the image will grow and consume more space on the server. Calculate the Disk Space Requirements for Shared MED-V Workspaces If you are calculating for a shared MED-V workspace deployment on a single computer, then the number of users per computer in your calculation is always 1 because MED-V only configures a single differencing disk for all users. You can find the differencing disk and the saved state file for shared MED-V workspaces in %ProgramData% \Microsoft\Medv\AllUsers. the default Image Update Settings of not enabling the Keep Only (#) Old Image Versions and Suggest Update When A New Version Is Available. Also accept the default setting of enabling Clients Should Use Trim Transfer When Downloading Images For This Workspace. Trim Transfer is a MED-V technology that optimizes the process of deploying or updating a Workspace image

61 to a client. Prior to MED-V deploying an image to a client, Trim Transfer indexes the client hard drive and compares this data to the Workspace image, looking for duplicated operating system and application data. Once this process is complete, Trim Transfer will transfer only image data from the Repository Server that doesn t already reside on the client hard disk, minimizing the amount of data transferred, optimizing network bandwidth, and reducing deployment and update time. Adding and Removing Applications on the Core Image Although not considered a MED-V best practice, you can add and remove applications directly on the core image. After you have added or removed an application, you can redeploy the MED-V workspace back out to your enterprise just as you deployed it originally. For more information about how to add or remove applications on the core image, see Installing Applications on a Windows Virtual PC Image. Important We do not recommend this method of managing applications. If you add or remove applications on the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved on the virtual machine is lost. Note Even though an application is installed into a MED-V workspace, you might also have to publish the application before it becomes available to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the Start menu. Likewise, to unpublish an application, you might have to manually remove a shortcut from the Start menu. By default, most applications are published at the time that they are installed, when shortcuts are automatically created and enabled. QUESTION 26 Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You need to create a single distribution file containing Windows Virtual PC and a virtual machine image that will be deployed to all the client computers. What should you use? A. Microsoft Deployment Toolkit (MDT) 2010 B. Deployment Images Servicing and Management (DISM) C. Microsoft Enterprise Desktop Virtualization (MED-V) Packaging Wizard D. Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 with a template Correct Answer: C /Reference:

62 Removable Media Deployment Removable media such as a DVD or USB storage device can also be used to initially deploy a MED-V Workspace. The process for deploying a MED-V Workspace using removable media is provided in the following steps: 1. Create the MED-V Workspace, and upload the packed image to the repository using the MED-V Management Console. You can skip this step if you have already created the MED-V Workspace and image. 2. Download the image to the desired Management Console workstation using the MED-V Management Console. The image files will be downloaded to C:\MED-V_Images\ PackedImages\imagename directory on the local hard disk of the Management Console. You can skip this step if you have already downloaded the MED-V Workspace and image. 3. To prepare for the Packaging Wizard deployment package process, create a local or network directory with separate subdirectories for the MED-V client, Virtual PC, and.net Framework installation files, and copy the associated setup files into these directories. The Packaging Wizard will ask for the location of these installation files during this process. 4. On the MED-V Management Console top menu bar, select Tools Packaging Wizard. 5. On the Packaging Wizard Deployment Package screen, click Next. 6. On the Workspace Image screen, mark the check box to include the image in the package. Select the image we just downloaded and click Next. 7. On the MED-V Installation Settings screen, select the path where we located the MED-V installation files, enter the MED-V server address and port, select Install MED-V Using Default Installation Settings if appropriate, and click Next. 8. On the Additional Installations screen, select the appropriate check boxes and installation path for Virtual PC 2007 SP1, Virtual PC QFE, and.net Framework 2.0, and click Next. 9. On the Finalize screen, enter the path for the package destination and package name, and click Finish. 10. Copy the contents of the MED-V deployment package to the removable media (DVD or USB storage device). a. On the personal computer targeted for the Workspace deployment, insert the DVD or USB storage device that has the deployment package files that we previously copied. b. Open the removable media device, and launch the MedvAutorun.exe application. The MED-V screen will appear, asking if you would like to install the MED-V package now. The Installer screen will be also be displayed and will provide progress information for the installation of Virtual PC 2007 SP1, Virtual PC 2007 SP1 Update, MED-V Client, and the importing of the Workspace image. At the end of the process, the MED-V Installer window will display a message saying that MED-V was successfully installed. c. The MED-VWorkspace is now ready to use.

63 QUESTION 27 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run WIndows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You are preparing to update a MED-V Workspace that is used by 1000 client computers. You need to minimize the network impact of updating the workspace. What are the two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.) A. Pack the Workspace images. B. Enable Trim Transfer on the Workspace. C. Send each virtual machine file storage folder to a compressed (zipped) folder. D. On each virtual machine file in the Workspace, enable file system compression. Correct Answer: AB /Reference: the default Image Update Settings of not enabling the Keep Only (#) Old Image Versions and Suggest Update When A New Version Is Available. Also accept the default setting of enabling Clients Should Use Trim Transfer When Downloading Images For This Workspace. Trim Transfer is a MED-V technology that optimizes the process of deploying or updating a Workspace image to a client. Prior to MED-V deploying an image to a client, Trim Transfer indexes the client hard drive and compares this data to the Workspace image, looking for duplicated operating system and application data. Once this process is complete, Trim Transfer will transfer only image data from the Repository Server that doesn t already reside on the client hard disk, minimizing the amount of data transferred, optimizing network bandwidth, and reducing deployment and update time. MED-V Trim Transfer Technology The MED-V advanced Trim Transfer de-duplication technology accelerates the download of initial and updated virtual machine images over the LAN or WAN, thereby reducing the network bandwidth needed to transport a MED-V workspace virtual machine to multiple end users. This technology uses existing local data to build the virtual machine image, leveraging the fact that in many cases, much of the virtual machine (for example, system and application files) already exists on the end user's disk. For example, if a virtual machine containing Windows XP is delivered to a client running a local copy of Windows XP, MED-V will automatically remove the redundant Windows XP elements from the transfer. To ensure a valid and functional workspace, the MED-V client cryptographically verifies the integrity of local data before it is utilized, guaranteeing that the local blocks of data are absolutely bit-by-bit identical to those in the desired virtual machine image. Blocks that do not match are not used. The process is bandwidth-efficient and transparent, and transfers run in the background, utilizing unused network and CPU resources.

64 When updating to a new image version (for example, when administrators want to distribute a new application or patch), only the elements that have changed ("deltas") are downloaded, and not the entire virtual machine, significantly reducing the required network bandwidth and delivery time QUESTION 28 All client computers in your company run Windows 7 Enterprise. You are planning to deploy a custom application that runs only on Windows XP to all users. You install Windows XP Mode on each host computers and install the application in the Windows XP guest virtual machines (VMs). You verify that the application runs in the guest VMs. An application shortcut does not appear on the Windows 7 host computers. You need to ensure that the applications can be launched directly from Windows 7 host computers. What should you do in the guest VMs? A. Repair the application. B. Upgrade the Virtual PC Integration Components. C. Copy the application shortcut to the Start menu to All Users.

65 D. Assign the Full Control permission to the application shortcut to the everyone group. Correct Answer: C /Reference: QUESTION 29 Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You use Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 to manage your Hyper-V hosts. Your environment includes Microsoft Enterprise Desktop Virtualizaetion (MED-V). You plan to deploy a virtual machine (VM) image to all client computers. You need to ensure that user state information is maintained between sessions in the VM. What should you do? A. Use VMM to configure placement settings. B. Configure MED-V revertible workspace policy. C. Configure MED-V persistent workspace policy. D. Use Hyper-V Manager to create a revert snapshot. Correct Answer: C /Reference: The following MED-V workspace types are available: Persistent In a persistent MED-V workspace, all changes and additions the user makes to the MED-V workspace are saved in the MED-V workspace between sessions. Additionally, a persistent MED-V workspace is generally used in a domain environment. Revertible In a revertible MED-V workspace, at the completion of each session (that is, when the MED-V workspace is stopped), the MED-V workspace reverts to its original state during deployment. No changes or additions that the user made are saved on the MED-V workspace between sessions. A revertible MED-V workspace cannot be used in a domain environment. QUESTION 30 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You use Microsoft Enterprise Desktop Virtualization (MED-V). You need to prepare the MED-V server for cluster mode. What should you do? A. Copy the ConfigurationServer folder to a network share. B. Add the Failover Clustering feature to the MED-V server. C. Add the Network Load Balancing (NLB) feature to the MED-V server.

66 D. Migrate the MED-V server to a highly available virtual machine (HAVM). Correct Answer: A /Reference: To configure the MED-V server in cluster mode 1. Install and configure MED-V on one of the servers. 2. Create a shared network in a central location where all of the servers can access it. 3. Copy the contents of the <InstallDir>/Servers/ConfigurationServer folder to the shared network. 4. Install MED-V server on all designated servers. 5. On the shared network, assign full access to all MED-V server system accounts. 6. On each server, do the following: a. In the <InstallDir>/Servers/ServerConfiguration.xml file, set the value of <StorePath> to the shared network path. b. Copy the <InstsallDir>/Servers/KeyPair.xml file from the original server to all MED-V servers. c. Restart the MED-V service. The Global Data Location is a single location where all virtual applications on a computer are stored in an immutable state. This folder must be on a local drive and accessible to all users who will log in to this machine. The preferred drive letter is a logical mount point on the client and is a pointer to a local cache in the Global Data Location. The User-Specific Data Location is where the user s application state is located. This can be a network share to allow the user state to roam with the user. You should test to determine the size because the size of user states can vary widely across applications, and it could become too large to roam and lead to decreased user satisfaction. How to Share Folders Between the Host and the MED-V Workspace

67 This topic has not yet been rated Rate this topic Updated: April 1, 2010 Applies To: Microsoft Enterprise Desktop Virtualization You can share folders between the host and the MED-V workspace. The shared folders can be stored on the following: An external computer on the network The host computer The following procedures demonstrate how to share folders between the host and the MED-V workspace. To share folders located on the network Configure MED-V in full desktop mode. In MED-V management, on the Network tab, click Use different IP address than host (Bridge). Do the following on the host computer: In Control Panel, click View network status and tasks, and set Network discovery to On. On the Start menu, right-click Computer, and click Map network drive. In the Map Network Drive dialog box, in the Drive field, select a drive. Note Ensure that the same drive letter is not in use on both computers. Click Browse. In the Browse For Folder dialog box, browse to the shared drive, and click OK. Click Finish. Repeat step 3 in the MED-V workspace. Point to the same drive as on the host computer. To share folders located on the host Configure the folder to be shared with the appropriate permissions. From the MED-V workspace, go to My network places and locate the shared folder. From the MED-V workspace, locate the shared folder. Note Ensure that both the host and MED-V workspace computers are in the same domain or workgroup. QUESTION 31 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You use MED-V to support temporary test environments. You need to ensure that the disk space used by obsolete Workspaces is automatically minimized. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two)

68 A. Configure the Workspace as revertible. B. Set an expiration date for the Workspace. C. Specify the number of image versions to keep. D. Configure automatic deletion at the Workspace. Correct Answer: BC /Reference: Workspace Deletion Options The administrator can set the MED-V workspace deletion options for each user or group so that the MED-V workspace is automatically deleted under certain conditions. To set MED-V workspace deletion options 1. In the Deployment pane, click Workspace deletion options. 2. In the Workspace Deletion Options dialog box, select from the following options: The Workspace has been disabled If the administrator disables the MED-V workspace, the MED-V workspace is deleted from the user or group computer. The Workspace has expired If the MED-V workspace expires according to the date specified, the MED-V workspace is deleted from the user or group computer. User is offline for more than the allowed period If the policy is not refreshed in the time period specified since the user was offline, the MED-V workspace is deleted from the user or group computer. 3. Click OK. QUESTION 32 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You manage client computers by using Microsoft System Center Configuraion Manager 2007 R2. You are deploying Microsoft Enterprise Desktop Virtualization (MED-V) to support client virtualization requirements. You need to ensure that administrators can centrally store MED-V logging information and generate reports. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. Install and configure IIS on a member server. B. Configure a shared folder on a member server. C. Install and configure Microsoft SQL server 2008 on a member server. D. Configure Microsoft Asset Inventory Service on the Configuration Manager server. Correct Answer: AC /Reference: Recommended System Configuration Memory Processor Operating system Database 2 GB RAM or greater Recommended: 2 GHz or faster Windows Server 2008 Standard/ Enterprise Edition MS SQL Server Enterprise/Express

69 Edition QUESTION 33 All client computers in your company run Windows 7. Windows Virtual PC is installed on all client computers. You create and configure a virtual machine (VM) named Guest1. You need to use the Guest1 virtual hard disk (VHD) as a base for additional VMs that will run on the same host computer, and minimize the disk space required for each new VM. Which type of VHD should you create for the new VMs? A. fixed size B. differencing C. dynamically expanding D. linked to a physical hard disk Correct Answer: B /Reference: QUESTION 34 Your company has an Active Directory Domain Services (AD DS) domain that runs at the Windows Server 2008 R2 functional level. All servers run Windows Server 2008 R2. All client computers run Windows XP Professional. You use the Key Management Service (KMS) to manage your volume license activations. All servers have been activated by using KMS.

70 You deploy 20 Windows 7 virtual desktops. The virtual desktop operating systems do not activate. You need to ensure that the virtual desktops activate by using KMS. What should you do? A. Deploy five more virtual desktops. B. Run slmgr.vbs with the -ato parameter. C. Use the Volume Activation Management Tool (VAMT). D. Raise the domain functions level to Windows Server 2008 R2. Correct Answer: B /Reference: To manually activate KMS clients (for example, disconnected clients) before distributing them to users, use the Control Panel System item, or run slmgr.vbs /ato at an elevated command prompt. The Slmgr.vbs script reports activation success or failure and provides a result code. To perform activation, the KMS client must have access to a KMS host on the organization s network. QUESTION 35 Your company has Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs Windows Server 2008 R2. Client computers run Windows Vista and Windows 7. You need to automate the migration of user settings from client computers to the RD Session Host Server. Which tool should you use? A. Windows Easy Transfer B. User State Migration Tool (USMT) C. Windows System Image Manager (Windows SIM) D. Deployment Image Servicing and Mangaement (DISM) Correct Answer: B /Reference: - Microsoft Windows User State Migration Tool (USMT) migrates user files and settings during deployments of Microsoft Windows XP and Windows Vista. You can use USMT to perform unattended migrations and to migrate files and settings for computers with multiple users. Also, with USMT you have the ability to encrypt and compress the store. USMT is intended for administrators who are performing automated deployments. - The Deployment Image Servicing and Management (DISM) tool replaces the pkgmgr, PEImg, and IntlConfg tools that are being retired in Windows 7. DISM provides a single centralized tool for performing all of the functions of these three tools in a more efficient and standardized way, eliminating the source of many of the frustrations experienced by current users of these tools. - Windows System Image Manager (Windows SIM) is the tool used to create unattended Windows Setup answer files. You can create an answer file by using information from a Windows image (.wim) file and a catalog (.clg) file. Component settings are added to an appropriate configuration pass in the answer file. You can also add packages to be installed during Windows Setup. The following topics describe conceptual

71 information about Windows SIM. QUESTION 36 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You use a virtual desktop infrastructure (VDI) environment to provide access to applications. All virtual desktop computer objects are located in an organizational unit (OU) named VirtualDesktops. All client computer objects are located in an OU named Desktops. You need to ensure that all users receive the same desktop shortcuts, and that they are not able to modify the shortcuts from virtual desktops. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. Create a mandatory user profile. B. Create a new default user profile. C. Create a Group Policy object (GPO) that configures the user profile. Link the GPO to the Desktops OU. D. Create a Group Policy object (GPO) that configures the user profile. Link the GPO to the VirtualDesktops OU. Correct Answer: AD /Reference: A mandatory user profile is a type of profile that administrators can use to specify settings for users. Only system administrators can make changes to mandatory user profiles. Changes made by users to desktop settings are lost when the user logs off. QUESTION 37 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You have a Remote Desktop Session Host (RD Session Host) server and a Remote Desktop Gateway (RD Gateway) server. You change the configuration of Windows Firewall by using Group Policy. Users on the corporate network are then unable to connect to their virtual desktops. You need to ensure that users can connect to their virtual desktops. What should you do? (Each correct answer presents part of the solutions. Choose two.) A. Create a Windows Firewall inbound rule for port 443 on the RD Gateway server. B. Create a Windows Firewall inbound rule for port 443 on the RD Session Host server. C. Create a Windows Firewall inbound rule for port 3389 on the RD Gateway server. D. Create a Windows Firewall inbound rule for port 3389 on the RD Session Host server. Correct Answer: AD /Reference: An RD Gateway server uses port 443, which transmits data through a Secure Sockets Layer (SSL) tunnel.

72 QUESTION 38 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You provide access to some applications through a virtual desktop infrastructure (VDI) environment. All Remote Desktop Session Host (RD Session Host) server objects are located in an organizational unit (OU) named RDServers. All virtual desktop computers are located in an organizational unit (OU) named VirtualDesktops. All other client computer objects are located in an OU named Desktops. The system drive in each RD Session Host server is running out of free disk space. You need to restrict the amount of disk space used by the roaming user profile cache. What should you do? A. Create a Group Policy object (GPO) that enables folder redirection for all users. Link the GPO to the RDServers OU. B. Create a Group Policy object (GPO) that enables folder redirection for all users. Link the GPO to the VirtualDesktops OU. C. Create a Group Policy object (GPO) that configures the Limit the size of the entire roaming user profile cache setting. Link the GPO to the RDServers OU. D. Create a Group Policy object (GPO) that configures the Limit the size of the entire roaming user profile cache setting. Link the GPO to the VirtualDesktops OU Correct Answer: C /Reference: Roaming user profile cache management A new Group Policy setting is available for Remote Desktop Services in Windows Server 2008 R2 that limits the size of the overall profile cache. If the size of the profile cache exceeds the configured size, Remote Desktop Services deletes the least recently used profiles until the overall cache goes below the quota. You can configure the maximum size of the roaming user profile cache on an RD Session Host server by applying the Limit the size of the entire roaming user profile cache Group Policy setting. The Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components \Remote Desktop Services\Remote Desktop Session Host\Profiles. If you enable this policy setting, you must specify a monitoring interval (in minutes) and a maximum size (in gigabytes) for the entire roaming user profile cache. The monitoring interval determines how often the size of the roaming user profile cache is checked. QUESTION 39 Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs Windows Server 2008 R2. All RD Session Host servers are located in an Organizational Unit (OU) named RDSessionHosts. All user accounts are located in an OU named Employees. Users connect to multiple RD Session Host servers by using the Remote Desktop Connection client on their Windows 7 client computers.

73 You need to ensure that users can access the files stored in their own Documents folders regardless of the RD Session Host server to which they are connected What should you do? A. Create a mandatory profile on each client computer. B. Create a mandatory profile on each RD Session Host server. C. Create a Group Policy object (GPO) that redirects the Documents folder, and link the GPO to the employees OU. D. Create a Group Policy object (GPO) that redirects the Documents folder, and link the GPO to the RDSessionHosts OU Correct Answer: C /Reference: Folder Redirection User settings and user files are typically stored in the local user profile, under the Users folder. The files in local user profiles can be accessed only from the current computer, which makes it difficult for users who use more than one computer to work with their data and synchronize settings between multiple computers. Two technologies exist to address this problem: Roaming Profiles and Folder Redirection. Both technologies have their advantages, and they can be used separately or together to create a seamless user experience from one computer to another. They also provide additional options for administrators managing user data. Folder Redirection lets administrators redirect the path of a folder to a new location. The location can be a folder on the local computer or a directory on a network file share. Users can work with documents on a server as if the documents were based on a local drive. The documents in the folder are available to the user from any computer on the network. Folder Redirection is located under Windows Settings in the console tree when you edit domain-based Group Policy by using the Group Policy Management Console (GPMC). The path is [Group Policy Object Name]\User Configuration\Policies\Windows Settings\Folder Redirection. How to configure Folder Redirection as an alternative to Roaming Profiles Create and configure a location for the folder redirection 1. Create a folder called Fldredir 2. Turn off inheritance on the folder and copy the permissions. a. Click the Advanced button found on the Security tab. b. Clear Allow inheritable permissions to propagate to this object check box in the Advanced Security Settings dialog box. c. Click Copy when prompted by the Security dialog box. 3. Click OK to return to the Security tab. Ensure we have the following permissions set: Administrators: Full Control System: Full Control Creator Owner: Full Control Authenticated Users: Modify 5. Change permissions for Authenticated Users so they cannot access other users folders. You do this by: a. Click Advanced on the Security tab. b. Click Authenticated Users, and then click Edit. c. On the Permissions Entry for Fldrredir dialog box, drop down the Apply onto and select This folder only. d. Click OK twice.

74 Create a Group Policy Object to redirect selected profile components 1. Create a GPO and link to the OU. It needs to be linked to an Users OU

75 2. Configure the GPO as follows (click on the image to zoom):

76

77 3. Clear the old Roaming Profile path from user account properties Verify the operation of Folder redirection The user redirected folders should start appearing inside the Fdlredir

78 *****EDIT***** For Documents folder: you need to choose redirect instead of create Otherwise the policy will create Documents folder for each user. QUESTION 40 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2.

79 You are deploying Remote Desktop Services (RDS). You install a Remote Desktop Session Host (RD Session Host) server in the environment. You need to install Remote Desktop Services client access licenses (RDS CALs). What should you do first? A. Run the Install Licenses Wizard. B. Run the Manage RDS CALs Wizard. C. Add the Remote Desktop Licensing role service. D. Add the RD Session Host server to a new group in the Remote Desktop Connection Manager console. Correct Answer: C /Reference: To use Remote Desktop Services, you must also have at least one license server deployed in your environment. For small deployments, you can install both the RD Session Host role service and the RD Licensing role service on the same computer. For larger deployments, it is recommended that the RD Licensing role service be installed on a separate computer from the RD Session Host role service. QUESTION 41 Your company has an Active Directory Domain Services (AD DS) domain. You have multiple Remote Desktop Session Host (RD Session Host) servers. You have 100 Windows Server 2008 R2 Remote Desktop Services client access licenses (RDS CALs) installed on your license server. You need to return 10 RDS CALs to the pool on the license server. What should you do? A. Remove the Per User RDS CALs. B. Revoke the Per Device RDS CALs. C. Remove the Per Device RDS CALs. D. Repeat the installation of the RDS CALs. Correct Answer: B /Reference: QUESTION 42 Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that computer identities are validated before user authentication is performed. What should you do? A. Configure the Set TS Gateway authentication method Group Policy setting to Use smart card. B. Configure the Set TS Gateway authentication method Group Policy setting to Use locally logged-on credentials.

80 C. Enable the Configure server authentication for client Group Policy setting and then select Do not connect if authentication fails. D. Enable the Configure server authentication for client Group Policy setting and then select Always connect, even if authentication fails. Correct Answer: C /Reference:

81 QUESTION 43 Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server. You enable Microsoft Word as a RemoteApp application on the RD Session Host server.

82 You need to ensure that the RemoteApp application opens when a user double-clicks a Word (.docx) file on a client computer. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. Create a Windows Installer (.wmi) file. B. Create a Remote Desktop Protocol (.rdp) file. C. In the properties of the RemoteApp application, enable the Allow any command-line arguments setting. D. Enable the Associate client extensions for this program with the RemoteApp program setting for the file. Correct Answer: AB /Reference: RemoteApp Considerations By using RemoteApp with App V it is possible to deploy virtual applications to users. However, configuring a virtual application for RemoteApp will require additional administrative steps and is not recommended. Using RemoteApp with computer-based targeting, administrators can control which applications are available to individual users by only deploying the RDP or MSI files to the appropriate users. This will achieve a similar functionality as a session-based desktop with user-based targeting, but will have the added benefit of integrating the virtual application into the user s local desktop. Distribute RemoteApp Programs to Users Applies To: Windows Server 2008 R2 You can distribute RemoteApp programs to users several ways. Depending on the method that you choose, users can: Access a link to the program through RemoteApp and Desktop Connection by using RD Web Access. RD Web Access is a Remote Desktop Services role service that lets you make RemoteApp programs available to users through RemoteApp and Desktop Connection. For more information, see Remote Desktop Web Access (RD Web Access). Double-click an.rdp file that has been created and distributed by their administrator. You can create a Remote Desktop Protocol (.rdp) file to distribute RemoteApp programs to users. For more information, see Create an.rdp File. You can distribute an.rdp file to client computers by using your existing software distribution process, such as Microsoft System Center Configuration Manager, or through a file share. Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer package. You can create a Windows Installer (.msi) package to distribute RemoteApp programs to users. For more information, see Create a Windows Installer Package. To distribute a Windows Installer package to client computers, you can use your existing software distribution process, such as Microsoft System Center Configuration Manager or Active Directory Group Policy. You can also make the Windows Installer package available through a file share. The Generate Microsoft Windows Installer (MSI) Package option creates an MSI file, which can be used to distribute this virtual application to a stand-alone machine with no need for a streaming server. This is helpful for contract or home workers who need access to an application but don t have Active Directory domain access.

83 Understanding Supported Deployment Scenarios A very common misconception is to think that App-V is an all-or-nothing proposition requiring much complexity and architectural considerations. With the latest technologies built into the App-V client, it is possible to get your feet wet with App-V with no additional backend infrastructure whatsoever and achieve a very quick return on investment (ROI). In this scenario App-V is reduced in complexity to that of a packaging technology. Chances are your organization is already packaging or repackaging MSI files, so packaging to an App-V standard requires little extra training because it is a very similar skill set. Be sure that the business justification for an App-V project plays a central role in determining which deployment scenario you choose. shows high-level descriptions of the relative complexity of three deployment models. Stand-alone MSI Deployment When the App-V client is put into stand-alone mode, it does not change the nature of the virtual application. The application still exists virtually, and all of the benefits of isolation between applications, packaging with dependencies, and others are still there. What is different, however, is that a sequencer-generated MSI file performs many of the functions of the management server, because in this model there is no management server or any other backend requirements. The MSI will copy the SFT file into cache, register file-type associations, and publish the shortcuts to their locations specified during sequencing. A stand-alone MSI app is managed in a fashion similar to a locally installed application. It will register itself with Programs and Features (appwiz.cpl) and will be available to all users of that PC. Since there is no streaming server to update the virtual app, it is also updated as a physical MSI using your existing processes. Nearly any form of distribution can deploy an App-V MSI such as USB flash drive, DVD, UNC path, or Group Policy. A shrink-wrapped application installer to a deployed virtual application is essentially a three-step process, as shown in Figure To configure an App-V client for stand-alone operation, first delete all applications listed in the Application Virtualization Client console and make the following dword value changes in the Registry: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Configuration] "RequireAuthorizationIfCached"=dword: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Network] "AllowDisconnectedOperation"=dword:

84 "Online"=dword: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Permissions] "ToggleOfflineMode"=dword: The last step is to reboot the machine. The machine is now configured as a stand-alone client. Remember that this can also be configured centrally via Group Policy with the Microsoft Application Virtualization Administrative Template. To install an MSI-wrapped virtual application, launch the MSI file located in the same folder as the virtual application s SFT file MSI Install of a virtual application The stand-alone MSI deployment model is usually the best choice for the following scenarios: In rarely connected or severely bandwidth-limited situations Remote users or contractors who do not have access to Active Directory or to your App-V infrastructure In mature environments where existing application deployment processes are extremely efficient The stand-alone MSI deployment model considerations are No centralized reporting No package upgrade Double-click a file where the file name extension is associated with a RemoteApp program. If you distribute RemoteApp programs through Windows Installer packages, you can configure whether the RD Session Host server will take over client file name extensions for the RemoteApp program. For more information, see Create a Windows Installer Package. QUESTION 44 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You have a Remote Desktop Session Host (RD Session Host) server and a Remote Desktop Web Access (RD Web Access) server.

85 You enable several RemoteApp applications in the RD Session Host server. You need to configure access to RemoteApp applications so that RD Web Access users see only applications to which they have been granted access. What should you do? A. Set NTFS permissions on the installation folder for each RremoteApp application. B. Assign domain users and domain security groups to each RemoteApp application. C. Add domain users and domain security groups to the TS Web Access Computers security group on the RD Session Host Server. D. Specify custom menu locations on the RD Session Host server for each domain security group by using a Group Policy object (GPO). Correct Answer: B /Reference: You can specify which domain users and domain groups can see the icon for a RemoteApp program when the RemoteApp program is made available through RD Web Access. By default, all authenticated domain users will be able to see the icon for a RemoteApp program on the Web site provided by RD Web Access. QUESTION 45 Your company runs Remote Desktop Services. All client computers run Windows Vista SP2. You have a Remote Desktop Session Host (RD Session Host) server. You need to deploy a RemoteApp application to client computers and ensure that the application appears on the Start menu. Which file type should you distribute to the client computers? A. Windows Installer (.msi) B. Client Configuration File (.wcx) C. Remote Desktop Protocol (.rdp) D. RemoteApp Programs list and settings (.tspub) Correct Answer: A /Reference: Users can run RemoteApp programs in a number of ways. They can: - Double-click a Remote Desktop Protocol (.rdp) file that has been created and distributed by their administrator. - Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer (.msi) package. - Double-click a file whose extension is associated with a RemoteApp program. (This can be configured by their administrator with a Windows Installer package.) - Access a link to the RemoteApp program on a Web site by using TS Web Access.

86 QUESTION 46 Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service and the Microsoft Application Virtualization (App-V) 4.6 client on a server that runs Windows Server 2008 You publish applicaions to the RD Session Host server by using App-V. Partner companies require access to an internal application. You provide each partner company with a preconfigured Remote Desktop Protocol (.rdp) file that enables the company to access the application by using the Connect From Anywhere feature. You need to specify the protocol that each partner company must allow through its firewall to establish the connection. Which protocol should you specify? A. RDP B. HTTPS C. RTSP D. RTSPS Correct Answer: A /Reference: Microsoft Windows Server Remote Desktop Services Microsoft s solution for presentation virtualization has traditionally been called Terminal Services. In Windows Server 2008 R2, Terminal Services has been renamed to Remote Desktop Services (RDS) to better reflect the solution s abilities to deliver both presentation virtualization and VDI services. Microsoft Windows Server 2008 R2 RDS can be used to deliver a desktop environment to an endpoint device via RDP. This can be accomplished via the Microsoft Remote Desktop Connection, with a web browser via (RD) Web Access and via the Windows 7 Start menu. In addition, the RD gateway can also be used to provide remote access to an organization s RDS applications and remote desktops via RDP over HTTPS. QUESTION 47 Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You have a Remote Desktop Session Host (RD Session Host) server. You have the following requirements: Local devices from remote desktop clients must be redirected to the RD Session Host server. USB devices from remote desktop clients must not be redirected to the RD Session Host server. What should you do? A. Disable drive redirection on the remote desktop clients. B. Disable drive redirection on the RD Session Host server. C. Enable the Prevent installation of removable devices Group Policy Setting on the remote desktop clients. D. Enable the Prevent installation of removable devices Group Policy setting on the RD Session Host server. Correct Answer: A

87 /Reference: Do not allow drive redirection Specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection). By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in Windows Explorer or Computer in the format <driveletter> on <computername>. You can use this setting to override this behavior. If the status is set to Enabled, client drive redirection is not allowed in Remote Desktop Services sessions. If the status is set to Disabled, client drive redirection is always allowed. If the status is set to Not Configured, client drive redirection is not specified at the Group Policy level. However, an administrator can still disable client drive redirection by using the Remote Desktop Session Host Configuration tool. Prevent Installation of Removable Devices You can use this procedure to prevent installation of any removable device. A device is considered removable when its device driver, or the device driver for the bus to which the device is attached, reports that it is a removable device. If this policy is enabled, in addition to preventing installation of the affected devices, it also prevents users from updating the device drivers for already installed devices that match the policy. Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. QUESTION 48 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You need to deploy Microsoft Application Virtualization (App-V) 4.6 in a stand-alone configuration. Which should you install? A. Microsoft Application Virtualization Database B. Microsoft Application Virtualization Desktop Client C. Microsoft System Center Application Virtualization Streaming Server D. Microsoft System Center Application Virtualization Management Server Correct Answer: B /Reference: QUESTION 49 Your company uses Microsoft Application Virtualizaetion (App-V). Your environment includes multiple client computer configurations, as shown in the following table.

88 You need to deploy a 32-bit application to all client computers. Which reference computer configuration should you use? A. Config1 with App-V Sequencer bit B. Config2 with App-V Sequencer bit C. Config3 with App-V Sequencer bit D. Config4 with App-V Sequencer bit Correct Answer: A /Reference: Sequence to the lowest operating system version used in the target environment. If your client computers run multiple operating systems at various service pack levels, and it is not practical to sequence the applications multiple times, sequence to the lowest common denominator. However, there is no guarantee that an application sequenced on one operating system functions as expected on a different operating system. For example, if an application is known not to function on Windows 7, sequencing it on Windows XP and deploying it to Windows 7 will not work. MOC 10324A Student Handbook We need to deploy a 32-bit application to all clients. (B and D are eliminated) Considering Vista and Windows 7, we have to take the older version to support the old version of OS. QUESTION 50 Your computer has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All portable computers run Windows 7. You virtualize applications by using Microsoft Application Virtualization (App-V). You are deploying servers to five new branch offices. Each branch office has its own subnet, and will stream virtual applications from a local IIS server. Users frequently move between branch offices with their portable computers. You need to ensure that branch office users access virtualized application only from the local IIS server. What should you do? (Need to have confirmation on this answer) A. Create a single DNS SRV record that contains all servers. B. Create a single DNS A record and configure a HTTP host header for each IIS server. C. Create five DNS A records with the same name. Point each A record to a different IIS server and disable the round robin options. D. Create five DNS CNAME records wih the same name. Point each CNAME record to a single IIS server. Disable the netmask ordering option. Correct Answer: B

89 /Reference: QUESTION 51 All client computers in your environment run Windows 7. You virtualize applications by using Microsoft Application Virtualization (App-V). You need to reset the FileSystem cache on a client computer. What should you do? A. Use the AppVCacheSize to set the maximum cache size to 0. B. Use the AppVCacheSize tool to set the minimum free disk space threshold to 0. C. Set the HKLM\SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\State registry key to 0. D. Set the HKLM\SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\FileSize registry key to 0. Correct Answer: C /Reference: How to Reset the FileSystem Cache Resetting the FileSystem cache is not something that should usually be necessary. However if you need to completely reset the FileSystem cache, perhaps for troubleshooting purposes, you can use the following procedure. Administrative rights are required to perform this action. To reset the FileSystem cache Set the following registry value to 0 (zero): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\AppFS\State Restart the computer. QUESTION 52

90 Your company uses Microsoft Application Virtualization (App-V). You maintain the sequencing for applications. You need to add a template to an exisiting sequenced application. What should you do? A. Edit the application, add the template, and then save the application with a new name. B. Sequence the template as a new application to the original application installation folder. C. Restore the sequencing computer and add the template to the original application installation folder. D. Upgrade the existing sequencing package, add the template to the package, and then save the application. Correct Answer: D /Reference: QUESTION 53 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. You virtualize applications by using Microsoft Application Virtualization (App-V). You are deploying servers to five new branch offices. Each branch office will stream virtual applications from a local file server and perform application sequencing locally. You need to replicate application packages to all file servers and minimize bandwidth usage. What should you do? A. Create a Distributed File System (DFS) root on each file server. B. On each file server, add the BranchCache for network files role service. C. Creates an Active Directory Distributed File System (DFS) root target folder. D. Create a Distributed File System Replication (DFSR) full mesh replication group. Correct Answer: D /Reference: Distributed File System Distributed File System (DFS) Namespaces and DFS Replication offer simplified, highly-available access to files, load sharing, and WAN-friendly replication. In the Windows Server 2003 R2 operating system, Microsoft revised and renamed DFS Namespaces (formerly called DFS), replaced the Distributed File System snap-in with the DFS Management snap-in, and introduced the new DFS Replication feature. In the Windows Server 2008 operating system, Microsoft added the Windows Server 2008 mode of domain-based namespaces and added a number of usability and performance improvements. What does Distributed File System (DFS) do? The Distributed File System (DFS) technologies offer wide area network (WAN)-friendly replication as well as simplified, highly-available access to geographically dispersed files. The two technologies in DFS are the following: DFS Namespaces. Enables you to group shared folders that are located on different servers into one or more

91 logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. This structure increases availability and automatically connects users to shared folders in the same Active Directory Domain Services site, when available, instead of routing them over WAN connections. DFS Replication. DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections. It replaces the File Replication Service (FRS) as the replication engine for DFS Namespaces, as well as for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level. BranchCache Key BranchCache design points While you design your BranchCache solution, it is useful to remember the following key points: BranchCache can decrease wide area network traffic between computers that are running Windows Server 2008 R2 and computers that are running Windows 7. BranchCache has two modes of operation, distributed cache mode and hosted cache mode. When the content cache at a branch office is distributed among client computers, BranchCache is running in distributed cache mode. When the content cache at a branch office is hosted on a server computer, BranchCache is running in hosted cache mode. BranchCache is installed by default on client computers running Windows 7 Enterprise and Windows 7 Ultimate, however you must enable BranchCache and create firewall exceptions to allow BranchCache traffic between client computers. BranchCache supports the optimization of downloads over end-to-end secure transports such as Hypertext Transfer Protocol Secure (HTTPS) and Internet Protocol security (IPsec). To cache application and Web server content that is sent to branch offices over Hypertext Transfer Protocol (HTTP), you must install the BranchCache feature on the application server or Web server whose content you wish to cache in branch offices. To cache File Server content that is sent to branch offices using the Server Message Block (SMB) protocol, the BranchCache for network files role service of the File Server role in Windows Server 2008 R2 must be installed and enabled. BranchCache might not function correctly when used in combination with a hardware-based WAN accelerator, because WAN accelerators might alter the fields and messages that are necessary for BranchCache operation. When you deploy a WAN accelerator with BranchCache, BranchCache might work for some protocols, but not for other protocols. For example, some WAN accelerators cannot process server message block (SMB) 2.1, but can process HTTP and HTTPs. Review your WAN accelerator documentation for more information. BranchCache is designed to prevent unauthorized access to content. Before transfer between peers or between clients and the hosted cache server, content is encrypted by BranchCache. Content can only be decrypted using the identifiers provided by the content server in the main office. The content server provides identifiers only to authenticated clients that are members of the same domain as the content server. Distributed cache mode is best suited for small branch offices that do not contain a local server for use as a hosted cache server. Distributed cache mode allows you to deploy BranchCache with minimal hardware deployments in branch offices. However, if the branch office contains additional infrastructure, such as one or more servers that are running other workloads, deploying BranchCache in hosted cache mode might be beneficial for the following reasons: Increased cache availability. Hosted Cache mode increases the cache efficiency because content is available even if the client that originally requested and cached the data is offline. Because the hosted cache server is always available, more content is cached, providing greater WAN bandwidth savings, and BranchCache efficiency is improved.

92 Centralized caching for multiple-subnet branch offices. Distributed cache mode operates on a single subnet. At a multiple-subnet branch office that is configured for distributed cache mode, a file downloaded to one subnet cannot be shared with client computers on other subnets. Because of this, clients on other subnets, unable to discover that the file has already been downloaded, get the file from the main office content server, using WAN bandwidth in the process. When you deploy hosted cache mode, however, this is not the case - all clients in a multiple-subnet branch office can access a single cache, which is stored on the hosted cache server, even if the clients are on different subnets. If you have a multiple-subnet branch office with less than 100 users, therefore, using hosted cache mode is recommended. You can use the following guidelines to determine the mode in which you want to deploy BranchCache: For a branch office that contains less than 100 users and does not have any local servers, use distributed cache mode. For a branch office (either single subnet or multiple-subnet) that contains less than 100 users and also contains a local server that you can use as a hosted cache server, use hosted cache mode. For a multiple-subnet branch office that contains more than 100 users, but less than 100 users per subnet, use distributed cache mode. QUESTION 54 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. The Remote Desktop Services (RDS) environment includes a Remote Dekstop Session Host (RD Session Host) server in the LAN environment, and a Remote Desktop Gateway (RD Gateway) server in the perimeter network (also known as DMZ). You deploy a Remote Desktop Web Access (RD Web Access) server in the perimeter network. You publish a RemoteApp application. The RemoteApp application is not visible to users when they log in to AD Web Access. You need to ensure that authorized users can run RemoteApp applications from RD Web Access. What would you do? A. Restart the World Wide Web Publishing Service on the RD Web Access server. B. Disable Forms Authentication on the Default Web Site on the RD Web Access server. C. Allow Windows Management Instrumentation (WMI) communication between the RD Gateway server and the RD Session Host server. D. Allow Windows Management Instrumentation (WMI) communication between the RD Web Access server and the RD Session Host server. Correct Answer: D /Reference: Configure the TS Web Access server to allow access from the Internet To allow users to access the TS Web Access server from the Internet, the recommended configuration is to place both the TS Gateway server and the TS Web Access server in the perimeter network, with the terminal servers that host RemoteApp programs behind the internal firewall. Alternatively, you can deploy TS Web Access on the internal network, and then make the Web site available through Microsoft Internet Security and Acceleration (ISA) Server. If you deploy TS Web Access in the perimeter network, you must configure your firewall to allow Windows Management Instrumentation (WMI) traffic from the TS Web Access server to the terminal server.

93 QUESTION 55 Your computer has an Active Directory Domain Services (AD DS) domain. You have a main office and a branch office that are connected by a slow WAN link. All servers are located in the main office. You virtualize an application by using Microsoft Application Virtualizaetion (App-V) 4.5. The available bandwidth is not sufficient for branch office users to run the virtualized application. You need to ensure that branch office users can run the virtualized application by using the Microsoft Application Virtualization Desktop Client. What should you do? A. Configure BranchCache in Distributed Cache mode. B. On each client computer in the branch office, upgrade the App-V desltop client to 4.6. C. On each client computer in the branch office, install the application by using Windows Installer (.msi) files created by the App-V Sequencer. D. In the Microsoft System Center Application Virtualization Management Server, configure an Application Virtualization file server for the main office. Correct Answer: C /Reference: App-V Standalone mode enables you to deploy MSI wrapped virtual applications seamlessly via CD, USB, or by integrating with your existing software delivery system.

94 QUESTION 56

95 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You use MED-V to support temporary test environments. You need to ensure that the disk space used by obsolete Workspaces is automatically minimized. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two) A. Configure the Workspace as revertible. B. Set an expiration date for the Workspace. C. Specify the number of image versions to keep. D. Configure automatic deletion at the Workspace. Correct Answer: BC /Reference: Workspace Deletion Options The administrator can set the MED-V workspace deletion options for each user or group so that the MED-V workspace is automatically deleted under certain conditions. To set MED-V workspace deletion options 1. In the Deployment pane, click Workspace deletion options. 2. In the Workspace Deletion Options dialog box, select from the following options: The Workspace has been disabled If the administrator disables the MED-V workspace, the MED-V workspace is deleted from the user or group computer. The Workspace has expired If the MED-V workspace expires according to the date specified, the MED-V workspace is deleted from the user or group computer. User is offline for more than the allowed period If the policy is not refreshed in the time period specified since the user was offline, the MED-V workspace is deleted from the user or group computer. 3. Click OK. QUESTION 57 Your company uses Microsoft Application Virtualization (App-V). You maintain the sequencing for applications. You need to add a template to an exisiting sequenced application. What should you do? A. Edit the application, add the template, and then save the application with a new name. B. Sequence the template as a new application to the original application installation folder. C. Restore the sequencing computer and add the template to the original application installation folder. D. Upgrade the existing sequencing package, add the template to the package, and then save the application. Correct Answer: D

96 /Reference: QUESTION 58 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You use MED-V to support temporary test environments. You need to ensure that the disk space used by obsolete Workspaces is automatically minimized. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two) (not sure about the below choice) A. Configure the Workspace as revertible. B. Set an expiration date for the Workspace. C. Specify the number of image versions to keep. D. Configure automatic deletion at the Workspace. Correct Answer: BC /Reference: Workspace Deletion Options The administrator can set the MED-V workspace deletion options for each user or group so that the MED-V workspace is automatically deleted under certain conditions. To set MED-V workspace deletion options 1. In the Deployment pane, click Workspace deletion options. 2. In the Workspace Deletion Options dialog box, select from the following options: The Workspace has been disabled If the administrator disables the MED-V workspace, the MED-V workspace is deleted from the user or group computer. The Workspace has expired If the MED-V workspace expires according to the date specified, the MED-V workspace is deleted from the user or group computer. User is offline for more than the allowed period If the policy is not refreshed in the time period specified since the user was offline, the MED-V workspace is deleted from the user or group computer. 3. Click OK.

97 The first option controls how many versions will be maintained on the MED-V client before the images will be deleted (oldest first.) The second option will determine if the user will be prompted when a new version is made available. The third option will determine if TrimTransfer is going to be used when downloaded updated image versions. Please note that this option also turns on local image indexing which will always run the first time a workspace is started prior to initial image download. QUESTION 59 Your companys main office and a branch office are connected by a slow WAN link. All servers run Windows Server 2008 R2. All client computers run Windows 7. You install an application on a Remote Desktop Session Host (RD Session Host) server. Users in the branch office experience slow performance when accessing the application through Remote Desktop. You need to minimize the bandwidth utilization to the RD Session Host server. What should you do? A. Configure BranchCache in Hosted Cache mode. B. On the RD Session Host server, configure the RDP-TCP properties to allow only Network Level Authentication. C. On each client computer, set the display colors in the Remote Desktop Connection client to High Color (15 bit). D. On each client computer, configure the Connect From Anywhere settings in the Remote Desktop Connection client.

98 Correct Answer: C /Reference: Choosing 15 bit color will diminish the graphic quality you see on the child computer, but unless you re using Photoshop or other graphic intensive programs on the child computer, the difference won t matter. And, the less visual data that has to be streamed back to the parent computer means a snappier remoting experience!

99 QUESTION 60 Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that each user is authenticated to the RD Session Host server before a session is created. What should you do? A. Set the security layer option to SSL (TLS 1.0). B. Set the encryption level option to FIPS Compliant. C. Set the log on option to Always prompt for password. D. Set the security option to Allow connections only from computers running Remote Desktop with Network Level Authentication. Correct Answer: D /Reference:

100 QUESTION 61 Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7. You use Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 to manage your Hyper-V hosts. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You plan to deploy a virtual machine (VM) image to all client computers. You need to ensure that user state information is maintained between sessions in the VM. What should you do? A. Use VMM to configure placement settings. B. Configure a MED-V revertible workspace policy. C. Configure a MED-V persistent workspace policy. D. Use Hyper-V Manager to create a revert snapshot. Correct Answer: C /Reference:

101 A revertible VM is a MED-V Workspace image that returns to its original state after each session. Leave the Synchronize Workspace Time Zone With Host option at its default setting of being selected. A Workspace can also be configured to be persistent. A persistent VM is a MED-V Workspace image that saves its state after each session. Other options for a persistent Workspace include shutting down the VM when stopping the Workspace, logging into Windows, running in the VM, and using MED-V credentials to support Single Sign-on (SSO). Client virtualization is the decoupling of computer resources on the client endpoint device, such as hardware, operating system, applications, and user settings and data. Virtualization solutions including desktop virtualization, application virtualization, and user-state virtualization enable the decoupling or separation of client computing resources. This separation provides a more flexible or agile environment, reducing complexity and costs and improving deployment, security, and manageability. All of these benefits have the potential to improve the overall desktop environment. A model of the traditional client endpoint device and virtualized client architecture is illustrated in Figure

102 QUESTION 62 All client computers in your company run Windows 7. Windows Virtual PC is installed on all client computers. You create and configure a virtual machine (VM) named Guest1. You need to use the Guest1 virtual hard disk (VHD) as a base for additional VMs that will run on the same host computer, and minimize the disk space required for each new VM. Which type of VHD should you create for the new VMs? A. fixed size B. differencing C. dynamically expanding D. linked to a physical hard disk Correct Answer: B /Reference: Differencing. A differencing virtual hard disk stores the differences from the virtual hard disk on the management operating system. This allows you to isolate changes to a virtual machine and keep a virtual hard disk in an unchanged state. The differencing disk on the management operating system can be shared with virtual machines and, as a best practice, must remain read-only. If it is not read-only, the virtual machine s virtual hard disk will be invalidated. Base VHD + (User per computer x (Difference Disk + Saved State)) To calculate the required disk space, determine the following:

103 Size of the base VHD the virtual hard disk that was used to create the MED-V workspace. Do not use the.medv file size for your calculation because the.medv file is compressed. Users per computer MED-V creates a MED-V workspace for each user on a computer; the MED-V workspace consumes disk space as each user logs on and the MED-V workspace is created. Size of the differencing disk used to track the difference from the base VHD. This size varies as you add applications and software updates to the virtual hard disk. A differencing disk is created for each MED-V user when they start MED-V for the first time. Size of the Saved State file used to maintain state in the virtual machine. Typically, this is just a bit larger than the allocated RAM for the virtual machine. For example, 1 GB of RAM allocated creates a file about 1,081,000 KB. The following example shows a calculation based on three users of a MED-V workspace that has a 2.6 GB virtual hard disk: 2.6gb + (3 x (1.5gb + 1gb)) = 10.1gb A MED-V best practice is to calculate the required space by using a lab deployment to validate the requirements. Locate the Files to Determine File Size The following locations contain the files for the computer and user settings: Type Location Files that you selected in the MED-V Work Base VHD %ProgramData%\Microsoft\Medv\Workspace InternalName.vhd - WhereInternalN Differencing %LocalAppData%\Microsoft\MEDV\v2\Virtual WorkspaceName.vhd Disk Machines Saved State File %LocalAppData%\Microsoft\MEDV\v2\Virtual Machines WorkspaceName.vsv Calculate the Disk Space Requirements for Shared MED-V Workspaces If you are calculating for a shared MED-V workspace deployment on a single computer, then the number of users per computer in your calculation is always 1 because MED-V only configures a single differencing disk for all users. You can find the differencing disk and the saved state file for shared MED-V workspaces in %ProgramData% \Microsoft\Medv\AllUsers. Bump

104 QUESTION 63 All client computers in your company run Windows 7 Enterprise. You are planning to deploy a custom application that runs only on Windows XP to all users. You install Windows XP Mode on each host computer and install the application in the Windows XP guest virtual machines (VMs). You verify that the application runs in the guest VMs. An application shortcut does not appear on the Windows 7 host computers. You need to ensure that the application can be launched directly from the Windows 7 host computers. What should you do in the guest VMs? A. Repair the application. B. Upgrade the Virtual PC Integration Components. C. Copy the application shortcut to the Start menu for All Users. D. Assign the Full Control permission to the application shortcut to the Everyone group. Correct Answer: C /Reference:

105 QUESTION 64 Your company has an Active Directory Domain Services (AD DS) domain that runs at die Windows Server 2008 functional level. All domain controllers run Windows Server 2008 R2 (Core Installation). You have a Remote Desktop Services infrastructure that Includes a Remote Desktop Connection Broker (RD Connection Broker) server and a Remote Desktop Session Host (RD Session Host) server in redirection mode. You configure a virtual machine (VM) as a personal virtual desktop for an employee. The Personal Virtual Desktop tab is not visible when you display the properties or the employee's user account. You need to assign a personal virtual desktop to the user account. What should you do? A. Use the Active Directory Users and Computers console on a server that runs Windows Server 2008 R2. B. Raise the domain functional level to Windows Server 2008 R2. C. Configure a virtual desktop pool on the RD Connection Broker server. Add the VM to the pool. D. Run the Configure Virtual Desktops Wizard. Correct Answer: A /Reference:

106 QUESTION 65 Your organization has an Active Directory Domain Services (AD DS) domain, You use Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 to manage your Hyper-V hosts. Your environment includes Windows Server Update Services (WSUS). You create a new Windows 7 virtual machine (VM) image and run the sysprep /oobe /generalize /shutdown command. You store the image in the VMM library. You need to apply operating system updates to the image without affecting licensing or activation status of the image. What should you do? A. Use the Deployment Image Servicing and Management (DISM) tool to service an offline image. B. Use VMM to deploy the image, and then apply the operating system updates. C. Use the Windows Optional Component Setup (OCSetup.exe) tool with an online image. D. Use the Sysprep Tool to service the image. Correct Answer: A /Reference:

107

108 QUESTION 66 Your companys main office and a branch office are connected by a slow WAN link. All servers run Windows Server 2008 R2. All client computers run Windows 7. You install an application on a Remote Desktop Session Host (RD Session Host) server. Users in the branch office experience slow performance when accessing the application through Remote Desktop. You need to minimize the bandwidth utilization to the RD Session Host server. What should you do? A. Configure BranchCache in Hosted Cache mode. B. On the RD Session Host server, configure the RDP-TCP properties to allow only Network Level Authentication. C. On each client computer, configure the Remote Desktop Connection Client Experience. D. On each client computer, configure the Connect From Anywhere settings. Correct Answer: C /Reference:

109 QUESTION 67 Your company runs Remote Desktop Services on Windows Server You have a Remote Desktop Session Host (RD Session Host) server. You plan to install an application on the RD Session Host server by running a setup.exe file. You need to ensure that the application will install properly and be useable by all users on the RD Session Host server. What should you do first on the RD Session Host server? A. Run the Change user /install command. B. Set the Remote Desktop licensing mode to RDS Per User CAL. C. Run the Change user /execute command. D. Set the Remote Desktop licensing mode to RDS Per Device CAL. Correct Answer: A /Reference: You must put a Terminal Services server in Install mode to install or remove programs on the server. You can put a Terminal Services server in Install mode either by using the Add/Remove Programs tool in Control Panel to add or remove a program, or by using the change user command at a command prompt. This article describes how to use the change user command.

110 To Switch Terminal Services to Install Mode When you want to add or remove programs, put the Terminal Services server in Install mode. To do this: Click Start, and then click Run. In the Open box, type cmd, and then click OK. At the command prompt, type change user /install, and then press ENTER. The following message appears: User session is ready to install applications. Type exit, and then press ENTER. Add or remove the programs that you want. Back to the top To Switch Terminal Services to Execute Mode When you are finished adding or removing programs, return the Terminal Services server to Execute mode. To do this: Click Start, and then click Run. In the Open box, type cmd, and then click OK. At the command prompt, type change user /execute, and then press ENTER. The following message appears: User session is ready to execute applications. Type exit, and then press ENTER. QUESTION 68 You have an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. All client computers are configured to extend the desktop display across two monitors. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that users can extend the Remote Desktop Connection window across both monitors. What should you do? A. Configure the screen resolution of the RD Session Host server. B. Configure the Ease of Access options on the RD Session Host server. C. Configure the display configuration settings of the Remote Desktop Connection client to use all monitors. D. Configure the display configuration settings of the Remote Desktop Connection client to set the size of the remote desktop to Full Screen. Correct Answer: C /Reference:

111 If you have dual or multiple monitors setup on your desktop and often use remote desktop client log into remote terminal server, you may want to have the same screen setup over on remote desktop session as well to have more screen real state. And here is how.

112 The version of remote desktop client that comes with Windows 7 supports multiple monitors natively, so you don t need 3rd party tools to help make that happen. If you are remote desktop to a windows prior to Windows 7 or Windows server 2008 R2 Launch the remote desktop client from the command line by using the following command: mstsc.exe /span What it does is to match the remote desktop width and height with the local virtual desktop, spanning across multiple monitors if necessary. It works pretty smooth but with some of the limitations: The set of monitors must form a rectangle. In other words, the set of monitors have to use the exact same screen resolution. If one monitor sets to and the second one to , span option will be ignored, and you are still stuck in one monitor. The total of the resolutions must be below The multiple monitors are in span mode. Maximizing one application window will maximize the window across all monitors, instead of one. QUESTION 69 Your company runs Remote Desktop Services. All client computers run Windows XP SP3. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that users can print by using Easy Print while connected to the RD Session Host server. What should you do on the client computers? A. Enable a Windows Firewall Inbound Rule for File and Printer Sharing. B. Enable a Windows Firewall Outbound Rule for File and Printer Shanng. C. Enable Network Level Authentication (NLA) D. Install.NET Framework 3.5. Correct Answer: D /Reference: To use the Terminal Services Easy Print driver, clients must be running both of the following: Remote Desktop Connection (RDC) 6.1 Note The RDC 6.1 ( ) client supports Remote Desktop Protocol 6.1. At least Microsoft.NET Framework 3.0 Service Pack 1 (SP1) Using Remote Desktop Easy Print in Windows 7 and Windows Server 2008 R2 Remote Desktop Easy Print configuration properties: The following table displays the Client/Server combinations that support Easy Print. Windows 7 Client / Server -> v Windows Server 2008 Windows XP Client : (1), (2) Client : (1), (2) Server : (3) Windows Server 2008 R2 Client : (1), (2) Server : (4)

113 Windows Vista Client : (1), (2) Client : (1), (2) Server : (3) Client : (1), (2) Server : (4) Windows 7 Server : (3) Server : (4) Windows Server Client : (2) Client : (2) Client : (2) 2008 Server : (3) Server : (4) Windows Server 2008 R2 Server : (3) Server : (4) (1) RDC 6.1 or above (Windows XP with Service Pack 3 and above includes this). (2) Even if RDC 6.1 or above is used,the user must install a supported version of.net Framework separately. Microsoft.NET Framework 3.5 (which includes.net Framework 3.0 SP1) can be downloaded from the Microsoft Download Center ( go.microsoft.com/fwlink/?linkid=109422). *In Windows Vista SP2 with RDC 7.0 andkb971644installed,.net Framework is not required (3) Terminal Services role. (4) Remote Desktop Session Host Role. If all the requirements are met, the Easy Print driver is listed in the Model field of the redirected printer s Properties dialog. Troubleshooting: If you experience formatting problems using Easy Print. Refer to the KB article athttp://support.microsoft.com/kb/954744(related: KB954743).

114 Refer to the KB article athttp://support.microsoft.com/kb/ Refer to the KB article athttp://support.microsoft.com/kb/ If the client printers are not redirected as Easy Print: First check the RDP version on the RDP client computer as well as the.net framework version with respect to the operating system used (as explained above). Also verify that the RD Session Host / Terminal Server role is installed if the host computer is running Windows Server 2008 R2 or Windows Server Group Policy must be correctly set to enable Easy Print on the Server. The policy location is Computer Configuration -> Administrative templates -Windows Components -> Remote Desktop Services > Remote Desktop Session Host -> Printer Redirection. The setting Use Remote Desktop Easy Print printer driver first must be set to Enabled for Easy Print redirection, and it has to be Disabled for Legacy Print. For Not configured, Easy Print is chosen by default. Check The Remote Desktop Configuration Tool (tsconfig.msc) settings to ensure that the Windows Printer option is not disabled (it is not disabled by default). Make sure that the Printers check box in the client (mstsc.exe) window on the Local Resources tab is checked. The corresponding setting in the associated RDP file is redirectprinters:i:1. Ensure that the spooler service is running on both the RDP Client & Server. Windows Server 2008 added the ability for an Admin to configure spooler security and Windows 7/Windows Server 2008 R2 adds the UI for this. Therefore, it would be possible to alter the RDP server s spooler security descriptor which might prevent RDP client printers from being redirected on the session. The spooler security descriptor must contain the AU (Authenticated User) ACL (Access Control List) which allows any authenticated user to open the spooler service for reading operations. Therefore,if that ACL is missing from the spooler security descriptor, it must beaddedlike the example below using the command prompt (elevated). > sc sdshow spooler D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY) > sc sdset spooler D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSD RCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY) [SC] SetServiceObjectSecurity SUCCESS If you connect over RD Gateway, ensure that the policy that disables printer redirection is turned off. If everything listed so far is correct and you still have a redirection problem, check the event logs. Some of the events to look for are: Event ID Message 1105 Printer security information for the printer could not be set.

115 1109 The printer could not be set as the default printer The driver required for the printer is unknown. Contact the administrator to install the driver before you log in again The printer cannot be redirected by using Remote Desktop Easy Print.The client computer may not have a version of the Remote Desktop Connection client or Microsoft.NET Framework installed that supports this driver An internal communication error occurred. Redirected printing will no longer function for a single user session. Check the status of the Remote Desktop Device Redirector in the System folder of Device Manager The number of printers per session limit was reached. The default client printer and the default printer in the RDP session must be the same. If the Easy Print driver is missing in the host, this event will be logged. Make sure you ve met all the requirements in the table above. If the number of redirected printers is less than the number of the RDP client printers. The maximum number of printers that can be redirected is controlled by the registry key MaxPrintersPerSession REG_DWORD which is under the node HKLM\\Software\\Policies\\Microsoft\ \Windows NT\\Terminal Services. The default value for this is 20 printers per session. If Easy Print is unable to print on a domain controller. Refer to the Knowledge Base Article athttp://support.microsoft.com/kb/968605/en-us If the client printer is redirected as Easy Print and the user is unable to stop a print job on the redirected printer. Take ownership of the printer and allow the Print & Manage printers permissions. But note that when logged off from the RD Session, the remote printer settings are not retained. QUESTION 70 Your company has an Active Directory Domain Services (AD DS) domain. You are installing the RD Session Host (RD Session Host) role service in Server Manager on a server that runs Windows Server 2008 R2. The Audlo and video playback check box on the Configure Client Experience page is not available. You need to ensure that you can enable audio and video playback for users connecting to the RD Session Host server. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.) A. Start the Windows Audio EndPoint Builder service. B. Install the Desktop Experience feature. C. Start the Windows Audio service.

116 D. Install Connection Manager Administration Kit feature. Correct Answer: BC /Reference:

117

118 QUESTION 71 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You have a Remote Desktop Services infrastructure that hosts remote desktop sessions for users. You need to be able to revoke 240 Remote Desktop Services client access licenses (RDS CALS). What should you do? A. Configure the Remote Desktop Session Host (RD Session Host) server to use Per Device licensing mode. Install 20 RDS CALs. B. Configure the Remote Desktop Session Host (RD Session Host) server to use Per User licensing mode. Install 100 RDS CALs. C. Conngure the Remote Desktop Session Host (RD Session Host) server to use Per User licensing mode. Install 20 RDS CALs. D. Configure the Remote Desktop Session Host (RD Session Host) server to use Per Device licensing mode. Install 100 RDS CALs. Correct Answer: D /Reference:

119 We talked about licensing Windows Server on a VMware environment but that s only one part of the licensingnightmare. You will also need client access licenses also called CALs. Client Access Licensing In addition of the Windows Server 2008 License you also need a Windows Server 2008 Client Access License also called CAL. This is required for each user or device (or combination of both) that accesses or uses the Windows 2008 software. Requirements Every user or device accessing the Windows Server 2008 needs a CAL. Youdon tneed a CAL when: You access the instance of server software only through the internet without being authenticated or individually identified by the server software; You access Windows Web Server 2008; If external users are accessing the instances of server software and you have acquired a Windows Server 2008 External Connector License for each server being accessed; You only administer the server software with two devices or users; You use the Windows Server 2008 solely as a virtualization host. The last point doesn t impact us much because we use VMware ESXi solely as our virtualization platform. How to choose the correct CAL licensing? Step 1 Choose your CAL type: Device CAL or User CAL You can choose between two types of Windows CALs: device-based (Device CALs) or user-based (Windows User CALs). With a device-cal you access the network and the Windows Server 2008 resources from a device which might be used by multiple users. For every device which accesses the network you need a device CAL.

120 With a user-cal one user uses multiple devices to access the resources on the network for every user in the organization that accesses the network you will need a user-cal license. Step 2 Choose your Client Access Licensing Mode: Per User/Per Device Mode or Per Server mode After choosing a user-based or device-based license you have the option to use the server software in two different modes: Per User/Per Device mode or Per Server mode. Both modes are available for either type of license. Per User/Per Device mode This mode is the mode where 1 user may access several servers, it replaces the Per Seat mode found in older versions of Windows. (99.9% of the customers run the software in this mode) Per Server mode In this mode you need a CAL for every user/device who accesses a server. So if you have multiple servers you need per user/device a CAL for every server accessed. Now that we have the Server licenses and the different forms let s try an example. Example: An organization uses 3 VMware vsphere 4 ESXi servers, with 2 Six Core CPUs per server to host 60 Windows 2008 and 5 Windows 2003 virtual machines. These machines are accessed by 2500 Internet users without being authenticated, 1200 employees who work in 3 8 hour shifts on about 2000 different devices. What licensing do we need here? 6 Windows Server 2008 Datacenter licenses and 1200 Windows User CALs (user based licenses) and the servers in per user/per device mode. If you deploy Windows Server 2003 virtual machines onto VMware ESXi, you do not require Windows Server 2008 CALs for your virtual machine users. (You will still require CALs for your appropriate Windows Server edition, in this case, for Windows Server 2003), because of the server mode and the CALs best be user-based you already have the appropriate licenses for the Windows 2003 servers if you bought new ones for the Windows 2008 servers. Do we need a CAL or an External Connector License? QUESTION 72 Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that remote desktop users can print only to the printers that are installed on the RD Session Host server. What should you do? A. Enable the Do not allow client printer redirection Group Policy setting. B. Disable the Do not allow client printer redirection Group Policy setting. C. Enable the Do not set default client printer to be default printer in a session Group Policy setting. D. Disable the Do not set default client printer to be default printer in a session Group Policy setting. Correct Answer: C /Reference:

121 QUESTION 73 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Application Virtualization (App-V), Microsoft Enterprise Desktop Virtualization (MED-V), and Remote Desktop Services.

122 You have three applications that are in one package and require authorization to run. You need to deploy the applications for offline use. What should you do? A. Configure a MED-V revertible workspace policy. B. Configure the Remote Desktop Connection Broker (RD Connection Broker). Create a Group Policy object (GPO) to configure the Configure server authentication for client setting. C. Use Microsoft Application Virtualization for Desktops. On each client computer, set the client cache configuration settings to Use free disk space threshold and configure the ApplicationSourceRoot registry key. D. Use Microsoft Application Virtualization for Desktops. On each client computer, configure the AutoLoadTriggers, AutoLoadTarget and RequireAuthorizationIfCached registry parameters. Then launch any one of the applications while logged in with the computer users credentials. Correct Answer: D /Reference: A. MED-V revertible workspace policy Self-cleaning (revertible) virtual machine MED-V offers a unique method for managing an easy to support virtual desktop environment. It takes advantage of hardware independence enabled by virtualization, and maintains the exact same image across multiple endpoints. All user changes to applications or the OS are discarded once the virtual PC session ends, and the virtual machine reverts to the original image, as packaged and delivered by the administrator. This can significantly simplify management, support, and troubleshooting for virtual machines. Updates, patches, new applications, and settings changes are applied to the master virtual image, tested by the administrator, and uploaded as a new version of the virtual image to the MED-V image repository. The new version is delivered to all endpoints using Trim Transfer technology, removing the need to update each endpoint separately. This method is applicable only where no user data or settings need to be kept in the virtual image (for instance, when all user data and settings are stored on a network location). Also when using the revertible method, the virtual machine should not be part of an Active Directory domain. B. Remote Desktop Connection Broker Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker (TS Session Broker), is used to provide users with access to RemoteApp and Desktop Connection. RemoteApp and Desktop Connection provides users a single, personalized, and aggregated view of RemoteApp programs, session-based desktops, and virtual desktops to users. RDConnection Broker supports load balancing and reconnection to existing sessions on virtual desktops, Remote Desktop sessions, and RemoteApp programs accessed by using RemoteApp and Desktop Connection. RDConnection Broker also aggregates RemoteApp sources from multiple Remote Desktop Session Host (RDSession Host) servers that may host different RemoteApp programs. To configure which RemoteApp programs and virtual desktops are available through RemoteApp and Desktop Connection, you must add the RDConnection Broker role service on a computer running Windows Server2008R2, and then use Remote Desktop Connection Manager (RDConnection Manager). For more information, seeremoteapp and Desktop Connection. Who will be interested in this feature? The improvements to the RDConnection Broker role service will be of interest to organizations that are implementing either a Virtual Desktop Infrastructure (VDI) or are deploying session-based desktops or RemoteApp programs. Additionally, these improvements will be of interest to organizations that currently use or are interested in Remote Desktop Services. What does RD Connection Broker do? RDConnection Broker extends the TS Session Broker capabilities included in Windows Server2008 by creating a unified administrative experience for traditional session-based remote desktops and virtual machine-based

123 remote desktops. A virtual machine-based remote desktop can be either a personal virtual desktop or part of a virtual desktop pool. In the case of a personal virtual desktop, there is a one-to-one mapping of virtual machines to users. Each user is assigned a personal virtual desktop that can be personalized and customized. These changes are available to users each time that they log on to their personal virtual desktop. For a virtual desktop pool, a single image is replicated across many virtual machines. As users connect to the shared virtual desktop pool, they are dynamically assigned a virtual desktop. Because users may not be assigned the same virtual desktop when they connect, any personalization and customization made by a user are not saved. If you choose to use a virtual desktop pool and users need their personalization and customizations saved, you can use roaming profiles and folder redirection. Which editions include this feature? RDConnection Broker is available in the following editions of Windows Server2008R2: Windows Server2008R2 Standard Windows Server2008R2 Enterprise Windows Server2008R2 Datacenter RDConnection Broker is not available in the following editions of Windows Server2008R2: Windows Web Server 2008 R2 Windows Server2008R2 for Itanium-Based Systems Additional references For information about other new features in Remote Desktop Services, seewhat's New in Remote Desktop Services. Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker (TSSession Broker), is a role service that provides the following functionality: Allows users to reconnect to their existing sessions in a load-balanced RDSession Host server farm. This prevents a user with a disconnected session from being connected to a different RDSession Host server in the farm and starting a new session. Enables you to evenly distribute the session load among RDSession Host servers in a load-balanced RDSession Host server farm. Provides users access to virtual desktops hosted on RDVirtualization Host servers and to RemoteApp programs hosted on RDSession Host servers through RemoteApp and Desktop Connection. Overview of Remote Desktop Connection Broker (RD Connection Broker) Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker (TSSession Broker), is a role service that provides the following functionality: Allows users to reconnect to their existing sessions in a load-balanced RDSession Host server farm. This prevents a user with a disconnected session from being connected to a different RDSession Host server in the farm and starting a new session. Enables you to evenly distribute the session load among RDSession Host servers in a load-balanced RDSession Host server farm. Provides users access to virtual desktops hosted on RDVirtualization Host servers and to RemoteApp programs hosted on RDSession Host servers through RemoteApp and Desktop Connection. RDConnection Broker keeps track of user sessions in a load-balanced RDSession Host server farm. The RDConnection Broker database stores session information, including the name of the RDSession Host server where each session resides, the session state for each session, the session ID for each session, and the user name associated with each session. RDConnection Broker uses this information to redirect a user who has an existing session to the RDSession Host server where the user s session resides. If a user disconnects from a session (whether intentionally or because of a network failure), the applications that the user is running will continue to run. When the user reconnects, RDConnection Broker is queried to determine whether the user has an existing session, and if so, on which RDSession Host server in the farm. If there is an existing session, RDConnection Broker redirects the client to the RDSession Host server where the

124 session exists. With RDConnection Broker Load Balancing, when a user without an existing session connects to an RDSession Host server in the load-balanced RDSession Host server farm, the user will be redirected to the RDSession Host server with the fewest sessions. If a user with an existing session reconnects, the user is redirected to the RDSession Host server where the user s existing session resides. To distribute the session load between more powerful and less powerful servers in the farm, you can assign a relative server weight value to a server. RDConnection Broker is also used to provide users with access to RemoteApp and Desktop Connection. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users. RDConnection Broker supports load balancing and reconnection to existing sessions on virtual desktops accessed by using RemoteApp and Desktop Connection. To configure the RDConnection Broker server to support RemoteApp and Desktop Connection, use the Remote Desktop Connection Manager tool. For more information, see the Remote Desktop Connection Manager Help in Windows Server2008R2. RD Connection Broker components There are two RDConnection Broker components to consider in a load-balanced RDSession Host server farm. RD Connection Broker server.this is the server that runs the Remote Desktop Connection Broker service and tracks user sessions for one or more load-balanced RDSession Host server farms. RDConnection Broker uses a farm name to determine which servers are in the same RDSession Host server farm. RDSession Host servers that use RD Connection Broker.These are RDSession Host servers that are members of a farm in RDConnection Broker. To participate in RDConnection Broker, a server must meet the following criteria: The server must have the RDSession Host role service installed. The server must be a member of an ActiveDirectory domain. The server must be a member of the Session Broker Computers local group on the RDConnection Broker server. The server must be a member of a load-balanced RDSession Host server farm. C. Use Microsoft Application Virtualization for Desktops. On each client computer, set the client cache configuration settings to Use free disk space threshold and configure the ApplicationSourceRoot registry key. The FileSystem cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the Application Virtualization (App-V) Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Use of the FileSystem cache space management feature can also help to avoid low cache space problems. More than one package is deleted if necessary. Packages that are locked are not deleted. To ensure that the cache has sufficient space allocated for all packages that might be deployed, use theuse free disk space that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V ca accordingly. QUESTION 74 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You are deploying Remote Desktop Services (RDS). You install a Remote Desktop Session Host (RD Session Host) server in the environment. You need to install Remote Desktop Services client access licenses (RDS CALs). What should you do first? A. Run the Install Licenses Wizard. B. Run the Manage RDS CALs Wizard. C. Add the Remote Desktop Licensing role service.

125 D. Add the RD Session Host server to a new group in the Remote Desktop Connection Manager console. Correct Answer: C /Reference: QUESTION 75 Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server. You need to select a digital certificate for signing Remote Desktop Protocol (.rdp) files. Which two certificate types can you use to achieve this goal? (Each correct answer presents a complete solution. Choose two.) A. Code Signing B. Authenticated Session C. Workstation Authentication D. Remote Desktop Protocol (RDP) Signing Correct Answer: AD /Reference: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed by use of a cryptographic hash. Code signing can provide several valuable features. The most common use of code signing is to provide security when deploying; in some programming languages, it can also be used to help prevent namespace

126 conflicts. Almost every code signing implementation will provide some sort of digital signature mechanism to verify the identity of the author or build system, and a checksum to verify that the object has not been modified. It can also be used to provide versioning information about an object or to store other meta data about an object. About Digitally Signing RemoteApp Programs You can use a digital signature to sign.rdp files that are used for RemoteApp connections to the Remote Desktop Session Host (RDSession Host) server. This includes the.rdp files that are used for connections through RDWeb Access to RemoteApp programs and to the desktop of an RDSession Host server. To connect to a RemoteApp program by using a digitally signed.rdp file, the client must be running at least Remote Desktop C Remote Desktop Protocol6.1.) If you use a digital certificate, the cryptographic signature on the connection file provides verifiable information about your identity as its publisher. This enables clients to recognize your organization as the source of the RemoteApp program or the remote desktop connection, and allows them to make more informed trust decisions about whether to start the connection. This helps protect against the use of.rdp files that were altered by a malicious user. You can sign.rdp files that are used for RemoteApp connections by using a Server Authentication certificate [Secure Sockets Layer (SSL) certificate], a Code Signing certificate, or a specially defined Remote Desktop Protocol (RDP) Signing certificate. You can obtain SSL and Code Signing certificates from public certification authorities (CAs), or from an enterprise CA in your public key infrastructure hierarchy. Before you can use an RDP Signing certificate, you must configure a CA in your enterprise to issue RDP Signing certificates. If you are already using an SSL certificate for RDSession Host server or RDGateway connections, you can use the same certificate to sign.rdp files. However, if users will connect to RemoteApp programs from public or home computers, you must use either of the following: A certificate from a public CA that participates in the Microsoft Root Certificate Program Members program ( If you are using an enterprise CA, your enterprise CA-issued certificate must be co-signed by a public CA that participates in the Microsoft Root Certification Program Members program. Membership in the localadministratorsgroup, or equivalent, on the RDSession Host server that you plan to configure, is the minimum required to complete this procedure.review details about using the appropriate accounts and group memberships athttp://go.microsoft.com/fwlink/?linkid= To configure the digital certificate to use On the RDSession Host server, open RemoteApp Manager. To open RemoteApp Manager, clickstart, point toadministrative Tools, point toremote Desktop Services, and then clickremoteapp Manager. In theactionspane of RemoteApp Manager, clickdigital Signature Settings. (Or, in theoverviewpane, next todigital Signature Settings, clickchange.) Select thesign with a digital certificatecheck box. In thedigital certificate detailsbox, clickchange. In theselect Certificatedialog box, select the certificate that you want to use, and then click OK. The Select Certificate dialog box is populated by certificates that are located in the local computer's certificates store or i certificate that you want to use must be located in one of these stores. Using Group Policy settings to control client behavior when opening a digitally signed.rdp file You can use Group Policy to configure clients to always recognize RemoteApp programs from a particular publisher as trusted. You can also configure whether clients will block RemoteApp programs and remote desktop connections from external or unknown sources. By using these policy settings, you can reduce the number and complexity of security decisions that users face. This reduces the chances of inadvertent user actions that may lead to security vulnerabilities. The relevant Group Policy settings are: Specify SHA1 thumbprints of certificates representing trusted.rdp publishers Allow.rdp files from valid publishers and user s default.rdp settings Allow.rdp files from unknown publishers These Group Policy settings are located incomputer Configuration\Policies\Administrative Templates \Windows Components\Remote Desktop Services\Remote Desktop Connection ClientandUser Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services \Remote Desktop Connection Client.

127 These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference ( QUESTION 76 Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs Windows Server 2008 R2. Client computers run Windows Vista and Windows 7. You need to automate the migration of user settings from client computers to the RD Session Host server. Which tool should you use? A. Windows Easy Transfer B. User State Migration Tool (USMT) C. Windows System Image Manager (Windows SIM) D. Deployment Image Servicing and Management (DISM) Correct Answer: B /Reference: The User State Migration Tool (USMT) is a Microsoft command line utility program intended to allow advanced users, comfortable with Scripting language, to transfer files and settings between PCs. This task is also performed by Windows Easy Transfer, recommended for general users. USMT supports the high-volume, automated deployment of files and settings from Microsoft Windows versions 2000, XP, Vista and Windows 7 and is useful in migrating user settings and files during OS upgrades. 32-bit to 64-bit migrations are supported, but 64-bit to 32-bit are not. Because USMT has high complexity and a command line interface, there have been several attempts to provide access to its useful functionality by creating GUI wrappers for it. Windows User State Migration Tool (USMT) 4.0 is a scriptable command-line tool that provides a highlycustomizable user-profile migration experience for IT professionals. USMT includes two components, ScanState and LoadState, and a set of modifiable.xml files: MigApp.xml, MigUser.xml, and MigDocs.xml. In addition, you can create custom.xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. For the latest updates to this documentation, as well as USMT 4.0 white papers, go to thismicrosoft Web site. Benefits USMT 4.0 provides the following benefits to businesses that are deploying Windows operating systems: Safely migrates user accounts, operating system and application settings. Lowers the cost of deploying Windows by preserving user state Reduces end-user downtime required to customize desktops and find missing files Reduces help-desk calls Reduces the time needed for the user to become familiar with the new operating system Increases employee satisfaction with the migration experience. Limitations USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can usewindows Easy Transferfor computers running WindowsVista or Windows 7. There are some scenarios in which the use of USMT 4.0 is not recommended. These include: Migrations that require end-user interaction. Migrations that require customization on a machine-by-machine basis.

128

129 QUESTION 77 Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You provide access to some applications through a virtual desktop infrastructure (VDI) environment. All virtual desktop computers are located in an organizational unit (OU) named VirtuaIDesktops. All other client computer objects are located in an OU named Desktops. Many users experience long logon times when logging into virtual desktop computers due to large roaming profiles. You need to reduce the user logon times for virtual desktop computers. What should you do? A. On each virtual desktop computer, set a disk quota on the system drive. B. On each client computer, set the temporary folders option to not use session-specific temporary folders. C. Create a Group Policy object (GPO) that enables folder redirection for all users. Enable slow link detection, and link the GPO to the VirtuaIDesktops OU. D. Create a Group Policy object (GPO) that enables folder redirection for all users. Enable loopback processing, and link the GPO to the VirtualDesktops OU. Correct Answer: D /Reference:

130 An Overview on Folder Redirection

131 Folder Redirection is a Group Policy feature that enables users to redirect the system folders containing the profile of a user on the network, through the use of the Folder Redirection node in the Group Policy Object Editor console. This basically makes folder redirection a user configuration option. Through the use of the Folder Redirection feature, users can configure that the system folders contents on the user remains the same, irrespective of the particular computer used to log onto the system. The system folders that users can configure for folder redirection are listed below: Application Data: This folder contains user configuration files, user specific data that applications utilize, and Public Key Infrastructure files. Desktop: This folder holds the shortcuts and files that appear on the user s desktop. My Documents: This folder holds the user s files and pictures. Start Menu: This folder holds the shortcuts and files that appear on the Start menu. Folder redirection settings are stored in the User Configuration node of the Group Policy Object Editor. The Offline Files feature can be configured to enable users to access redirected folders when no network connection exists. Users can use the Offline Folder node in Group Policy to configure this feature. Folder redirection provides the benefits listed below: Redirecting the My Documents folder ensures that users can access their data from any computer. This applies to all other redirected folders as well. Because redirected folder data is stored on a network server, the user can back up the data to an offline

132 storage media. The disk quotas feature specifies the amount of space that each user s redirected folders are allowed to use. By configuring the Offline files feature, users can ensure that they have access to the My Documents folder when the network connection is lost. This capability is useful to individuals that use laptop computers. When roaming profiles are utilized for users, the network path to My Documents is included in the roaming user profile. The folder is not included in the profile. The situations in which users should enable folder redirection for the different types of system folders are summarized below: Redirect the My Documents folder to allow access to the same documents from any computer on the network. Redirect the Application Data folder when applications should operate in the same manner for a user whenever the user utilizes a new system. When the Application Data folder is redirected, the user does not need to be configured again when he/she changes systems. Redirect the Desktop folder when users save files that contain data to the desktop. Redirect the Start Menu folder in the following situations: When a user saves files containing data to icons located on the Start menu. When there are consistent software installations through the network. When a user needs to access the Favorites and Printers and Faxes folders If an organization already has home folders, Windows Server 2003 includes an option that allows users to redirect My Documents to the user s home folder. One requirement though is that the user s home folder needs a Windows XP Professional client. Windows XP Home Edition, Microsoft Windows 2000, and Windows NT client cannot be utilized. The manners in which users can configure folder redirection are listed below: Users can redirect folders to a location based on the security group s membership. Users can redirect folders to a single location for all users in a site, domain, or OU. When specifying the location for the redirected folders, the following options exist: Create a folder for the user beneath the root path Redirect the folders to a specified location. Redirect the folders to the user s local profile Redirect the folders to the user s home folder How to Redirect Folders to a Location Based on Security Group Membership Windows Server 2003 includes additional options for redirecting folders that the Windows 2000 Server does not offer. With Windows 2000 Server, users could only specify the location for the target folder location in the one provided text box. Windows Server 2003 offers more options in the Target Folder Location list. Use the steps below to redirect folders to a location based on security group membership: Open the GPO linked to the site, domain, or OU that holds the users for which folder redirection should be enabled. Expand the User Configuration node, expand the Windows Settings node, and then expand the Folder Redirection node. Right-click the folder that should be redirected and then select Properties from the shortcut menu. When the Properties dialog box for the folder selected for redirection opens, in the Setting list of the Target tab, choose the Advanced-Specify Locations For Various User Groups option. When the Specify Group And Location dialog box opens, click the Browse button in the Security Group Membership area. When the Select Group dialog box opens, specify the name of the security group for whom the folder should be redirected. Click OK. In the Specify Group And Location dialog box, choose the location for the redirected folder. Choose one of the options listed below: Create A Folder For Each User Under The Root Path a folder with the user s name is created under the root path. The option is not available if the user selected to redirect the Start Menu folder. Redirect To The Following Location the folder is redirected to a location specified. Redirect To The Local Userprofile Location the folder is redirected to the default folder location. Redirect To The User s Home Folder the folder is redirected to the user s home directory. The option is available when the My Documents folder is redirected.

133 Enter the path to which the folder should be redirected if the Create A Folder For Each User Under The Root Path option was selected or the Redirect To The Following Location option in Step 7. Enter the UNC path or a path on the user s local computer. Click OK. Click the Settings tab. The Grant The User Exclusive Rights To Redirected Folder checkbox is enabled by default. It is recommended to leave this option unchanged. The Move The Contents Of User s Current Folder To The New Location checkbox is enabled by default. It is recommended to also leave this option unchanged. In the Policy Removal box of the Settings tab, it is recommended to leave the Leave The Folder In The New Location When Policy Is Removed option selected. In the My Pictures Preferences box of the Settings tab, it is recommended to leave the Make My Pictures A Subfolder Of My Documents option enabled. This is the default configuration setting. Click OK. How to Redirect Folders to a Single Location for All Users in a Site, Domain, or OU Open the GPO linked to the site, domain, or OU that holds the users for whom the folder redirection should be enabled. Expand the User Configuration node, expand the Windows Settings node, and then expand the Folder Redirection node. Right-click the folder that should be redirected and then select Properties from the shortcut menu. When the Properties dialog box for the folder selected for redirection opens, in the Setting list of the Target tab, choose the Basic-Redirect Everyone s Folder To The Same Location option. Select one of the following options from the Target Folder Location list: Create A Folder For Each User Under The Root Path a folder with the user s name is created in the root path. Redirect To The Following Location the folder is redirected to a specified location. Redirect To The Local Userprofile Location the folder is redirected to the default folder location. Redirect To The User s Home Folder the folder is redirected to the user s home directory. Enter the path to which the folder should be redirected if the Create A Folder For Each User Under The Root Path option was selected or the Redirect To The Following Location option in the previous step. Click the Settings tab. It is recommended to leave The Grant The User Exclusive Rights To Redirected Folder checkbox and Move The Contents Of User s Current Folder To The New Location checkbox enabled or selected. This is the default setting for those two checkboxes. In the Policy Removal box of the Settings tab, it is recommended to leave the Leave The Folder In The New Location When Policy Is Removed option enabled. In the My Pictures Preferences box of the Settings tab, leave the Make My Pictures A Subfolder Of My Documents option enabled. This is the default configuration setting. Click OK. How to set up the network share for offline files and folders As mentioned earlier, the user can configure the Offline Files feature so that others can still access redirected folders when the network connection is lost. When configured, the Offline Files feature stores any files that are accessed via folder redirection on the local computer s hard drive. The file is updated locally when the user accesses a file of a redirected folder. When the user logs off the computer, the file is moved to the server and stored. Configuring the network share for offline files and folders is the initial step in the configuration of the Offline Files feature. Navigate to and right-click the shared folder that includes the offline files, then select Sharing And Security on the shortcut menu. Click Offline Settings on the Sharing tab. When the Offline Settings dialog box opens, select one of the options listed below: Only The Files And Programs That Users Specify Will Be Available Offline allows users to specify files for offline availability. All Files And Programs That Users Open From The Share Will Be Automatically Available Offline all files that users access are available offline. Files Or Programs From The Share Will Not Be Available Offline no files will be available offline. Click OK.

134 How to Set Up the Offline Files Feature for Computers and Servers Open My Computer. Click Folder Options on the Tools menu. When the Folder Options dialog box opens, select the Offline Files tab Check the Enable Offline Files checkbox. The options that can be selected for a full synchronization of Offline Files are listed below: Synchronize All Offline Files When Logging On checkbox for a full synchronization of Offline Files when the user logs on Synchronize All Offline Files Before Logging Off checkbox for a full synchronization of Offline Files when the user logs off. Users can enable the Display A Reminder Every checkbox so that reminder balloons are displayed when the computer goes offline. The reminder balloons are displayed on the desktop s notification area. Specify how frequently the reminders should be displayed. To display a shortcut to the Offline Files folder on the desktop, select the Create An Offline Files Shortcut On The Desktop checkbox. To encrypt offline files, select the Encrypt Offline Files To Secure Data checkbox. Set the amount of disk space to use for temporary offline files by using the slider. Click the Advanced Button. When the Offline Files-Advanced Settings dialog box opens, choose one of the options listed below: Notify Me And Begin Working Offline enables the user to continue to access files when the network connection is unavailable. Never Allow My Computer To Go Offline prevents the user from accessing files when the network connection is unavailable. Click Add to access the Offline Files-Add Custom Action dialog box. This is where users can configure a specific action for a computer so that it is treated differently when another computer loses a network connection. Enter the name of the computer in the Computer text box. Specify how the computer should be treated by selecting an option in the When A Network Connection Is Lost area of the dialog box. Click OK. Click OK in the Offline Files-Advanced Settings dialog box. Click OK in the Folder Options dialog box. How to Configure Synchronization of Offline Files and Folders Click Start, All Programs, Accessories, and click Synchronize. Click Setup on the Items To Synchronize dialog box. The Synchronization Settings dialog box opens. On the Logon/Logoff tab of the dialog box, in the When I Am Using This Network Connection list, select the connection to be utilized. In the Synchronize The Following Checked Items list, choose the items that should be synchronized. Enable the When I Log On To My Computer checkbox to allow synchronization to occur when the user logs on to the computer. Enable the When I Log Off My Computer checkbox to allow synchronization to occur when the user logs off the computer. In order to display a message, asking for permission to perform synchronization, enable the Ask Me Before Synchronizing The Items checkbox. Click OK. Best Practices for Implementing Folder Redirection A few best practices for implementing folder redirection using Group Policy are summarized below: It is recommended to accept the default folder redirection settings on the Settings tab when configuring folder redirection. It is always best to allow the system to create the folders. Because users typically need to access the contents of redirected folders when the network connection is lost, enable the Offline Files feature for redirected folders. The My Pictures folder should exist within the My Documents folder. When specifying the location for redirected folders, use fully qualified UNC paths. Only redirect the My Documents folder to the user s home folder if there is an existing home folder

135 environment. The Application Data folder should not be redirected if using the Encrypting File System (EFS). Situation: An organization has users that log into workstations interactively and also log into a Terminal Server with the same user account, but stricter policies are desired for the Terminal Server session than for the users interactive session with their own computer. Also, certain users (such as Administrators) should be exempt from these policies. ex: When a domain user logs on to Terminal Server, they do not have access to the Control Panel and cannot change the Desktop wallpaper; on their own machine these actions are allowed. Administrators that log on to the Terminal Server still must have access to the Control Panel and all other areas of the system. Problem: Since users can only be contained in a single OU, and user policies assigned to OUs that contain only computers are not processed, it may seem that this is not possible without creating separate user accounts just for accessing the Terminal Server. Strict local policies could be used on the Terminal Server itself, but these would also apply to Administrators making the server difficult to manage. Solution: Use loopback processing of group policy in conjunction with security filtering of certain GPOs to allow different user policies to be applied depending on what computer the user logs on to. In Active Directory Users and Computers, make sure that the Terminal Server is in its own OU just for Terminal Servers. If the Terminal Server is also a Domain Controller, a new OU can be created inside of the Domain Controllers OU so that domain controller policies are still applied as well. In the Group Policy Management MMC, create a new GPO called Loopback and link it to the Terminal Servers OU created in step 1. Edit the new Loopback policy to enable Loopback processing. The setting is under Computer Configuration -> Policies -> Administrative Templates -> Group Policy -> User Group Policy loopback processing mode. See example below: Now create another GPO linked to the same Terminal Servers OU. This one will contain the user policies that will be in effect when users from another OU log on to a computer in this OU. Name it something like Terminal Server Lockdown, or whatever suits the situation. Before editing this policy, it is important to set up some security filters first. Assuming you do not want this policy applied to Domain Administrators, perform the following steps: Select the GPO and go to the Delegation tab. Click Advanced to view the ACL. Add the Domain Admins group (or whichever group is appropriate) and grant the group all permissions except DENY the Apply group policy permission as shown below: Click OK to save the ACL. Edit this Lockdown policy just as you would any other user policy, making sure that you edit items in the User section, not the Computer section. Remove the Control Panel, lock the taskbar, customize Internet Explorer, etc. If everything went properly, this policy will be applied to any user that logs on to the Terminal Server (or any computer in the Terminal Servers OU) except those that are members of the Domain Admins group. If the policies do not immediately work, try running gpupdate /force when logged on to the server as a Domain User. -n Related content: Group Policy Not Applied To Remote VPN Users How To: Time Sync Across Windows Network Adding Sites to Internet Security Zones Using Group Policy Terminal Server Does Not Accept Enough Client Connections Redirected Printer: Access Denied in Remote Desktop Session QUESTION 78 Your company has an Active Directory Domain Services (AD DS) domain. You have multiple Remote Desktop Session Host (RD Session Host) servers. You have 100 Windows Server 2008 R2 Remote Desktop Services client access licenses (RDS CALs) installed on your license server. You need to return 10 RDS CALs to the pool on the license server. What should you do?

136 A. Remove the Per User RDS CALs. B. Revoke the Per Device RDS CALs. C. Remove the Per Device RDS CALs. D. Repeat the installation of the RDS CALs. Correct Answer: B /Reference: Licensing Corner CALs We are often asked by clients What are these CAL things and why do I need to buy them I m already buying (or I ve already bought) a server license? Well, this goes back to the way that Microsoft sells and licenses most of their server products. If you remember the inaugural License Corner back in October 2010, we said that when you pay Microsoft for software you are not acquiring a physical object that has intrinsic value in the object itself but, rather, are acquiring a limited right to use the software. A software license provides the legal right to install, use, access, display, run, or otherwise interact with a software program. For most server products Microsoft uses a Server + Client Access License (CAL) model as the primary method for licensing the use of the software. This means that first you must purchase a license to install and operate the server software on the physical server. Then for every user or device that accesses the server to use services on that server, such as file storage or printing or to utilize an application running on that server, a Client Access License (CAL) must be purchased. So the CAL simply permits access to the server. (Note: if you have multiple Windows Servers in your network one CAL permits access to all the servers. You don t have to buy a CAL for every unique server.) There are two types of CALs and the decision on which to purchase is based on how users (employees, typically) will access the server. There are User CALs and Device CALs. User CALs With the User CAL, you purchase a CAL for every user who accesses the server to use services such as file storage or printing, regardless of the number of devices they use for that access. Purchasing a User CAL might make more sense if your company employees need to have roaming access to the corporate network using multiple devices, or from unknown devices, or simply have more devices than users in your organization.

137 Device CALs With a Device CAL, you purchase a CAL for every device that accesses your server, regardless of the number of users who use that device to access the server. Device CALs may make more economic and administrative sense if your company has workers who share devices, for example, on different work shifts. The Microsoft products that utilize the User/Device CAL model are: Windows Server Remote Desktop Services Server (formerly Terminal Server) SQL Server Exchange Server Lync Server (Formerly Office Communications Sever) SharePoint Server Since every Microsoft server needs the Windows operating system running on it to function just about every Windows server requires CALs to be accessed. Then if any of the Microsoft server systems listed above are installed on the Windows server, those CALs are also needed. So, for example, an Exchange server requires Windows CALs and Exchange CALs. Pricing is typically the same for User and Device CALs. In addition, both types of CALs can be reassigned from one device to another or from one user to another provided the reassignment is made either (a) permanently away from the one device or user or (b) temporarily to accommodate the use of the Windows CAL either by a loaner device, while a permanent device is out of service, or by a temporary worker, while a regular employee is absent. You can also have both User and Device CALs accessing the same server. You can only switch between User and Device CALs if the CALs have Software Assurance (see License Corner November 2010) and only upon renewal of the Software Assurance. Per Device License (Device CAL) The licenses for device (Device CAL) grant the right to use the features provided by one or more servers for all the devices are fully licensed CAL. Per User License (User CAL) Licenses Per User (User CAL) grant the right to use the features provided by one or more servers to a named user.the user can use the functions made available by one or more servers also using more than one device. For server licenses This licensing model to a particular server is assigned a set number of CALs and the number of devices allowed to concurrently access the server can not exceed the number of CALs purchased for the server.cals are not permanently associated to a given device, if the organization decides to add another server Windows Server 2003 R2, always in a per server, to access the second server will need to purchase additional CALs for Windows Server.For deployment in the server is the system administrator when configuring the server determines the number of CALs to associate, based on the number of licenses purchased for the server.for server licenses are available for Windows Server 2003 R2. Processor licenses For some server products are also available for per-processor licensing model, which includes the purchase of a license for each processor installed on the server where the software must be run.the license allows the processor to access by an unlimited number of users that can connect from the LAN (Local Area Network) or WAN (Wide Area Network) or outside the firewall.therefore, it is not necessary to purchase additional server licenses, CALs, or Internet Connector. Example Scenarios

138 Dismissal "To Device" or "Per User" In this scenario, the organization has chosen to deploy Windows Server 2003 R2 in mixed mode "To Device" and "Per User" by buying a mix of Device CALs and User. Dismissal "Per Server" In this scenario, the organization has chosen to deploy Windows Server 2003 R2 on a per server, the purchase of five CALs allow a maximum of five devices to connect simultaneously to the server.to provide an opportunity to connect to the server, by excluding devices, will be necessary to increase the amount of CALs, or wait for one of five devices that occupies a CAL terms the connection to the server and, therefore, makes it free. Client Access Licensing In addition of the Windows Server 2008 License you also need a Windows Server 2008 Client Access License also called CAL. This is required for each user or device (or combination of both) that accesses or uses the Windows 2008 software. Requirements Every user or device accessing the Windows Server 2008 needs a CAL. Youdon tneed a CAL when: You access the instance of server software only through the internet without being authenticated or individually identified by the server software; You access Windows Web Server 2008; If external users are accessing the instances of server software and you have acquired a Windows Server 2008 External Connector License for each server being accessed; You only administer the server software with two devices or users; You use the Windows Server 2008 solely as a virtualization host. The last point doesn t impact us much because we use VMware ESXi solely as our virtualization platform. How to choose the correct CAL licensing? Step 1 Choose your CAL type: Device CAL or User CAL You can choose between two types of Windows CALs: device-based (Device CALs) or user-based (Windows User CALs).

139 With a device-cal you access the network and the Windows Server 2008 resources from a device which might be used by multiple users. For every device which accesses the network you need a device CAL. With a user-cal one user uses multiple devices to access the resources on the network for every user in the organization that accesses the network you will need a user-cal license. Step 2 Choose your Client Access Licensing Mode: Per User/Per Device Mode or Per Server mode After choosing a user-based or device-based license you have the option to use the server software in two different modes: Per User/Per Device mode or Per Server mode. Both modes are available for either type of license. What types of CALs are out there? As you can see there are a lot of flavors and different CALs out there, some we mentioned are: Windows User CAL Device CAL TS CAL (Terminal Services) RDS CAL (Remote Desktop Services) Per Processor CAL Management Server CAL Core CAL (Suite) Enterprise CAL (Suite) RMS CAL VECD CAL Suites Core CAL Suite Enterprise CAL Suite Because CAL Suites contain licenses to products that are released independently, CAL Suites are version-less. CAL Suites are only offered with Software Assurance coverage, and accordingly give customers the right to use the most recent version of every product in the suite. All Enterprise CAL Suite components are available for individual purchase also. For more information around licensing the core CAL and Enterprise Suite follow thislink. VECD Either VECD or VECD for SA is required for any VDI environment running Windows as the guest operating system, regardless of the choice of infrastructure or hypervisor vendor that the customer chooses. More information about the VECD license can be found at the followinglink. CAL Tracking Because of all the different CALs and software licenses it becomes hard too find out which software you use and which license you will need, Microsoft made a tool called the MAP Toolkit to help us track which software is used in the environment so we get a picture of what licenses we should get to get compliant with the terms and conditions. The Microsoft Assessment and Planning (MAP) Toolkit is an agentless tool designed to simplify and streamline the IT infrastructure planning process across multiple scenarios through network-wide automated discovery and assessments. MAP performs an inventory of heterogeneous IT environments and provides you with usage

140 information for SQL Server and servers in the Core CAL Suite. The Microsoft Assessment and Planning (MAP) Toolkit 5.0 includes the following new features for simplified IT infrastructure planning: Heterogeneous IT environment inventory Software usage tracking for Windows Server, SharePoint Server, System Center Configuration Manager, Exchange Server, and SQL Server Microsoft Office 2010 readiness assessment SQL Server discovery and assessment for consolidation Windows 2000 migration assessment You can use this toolkit to track the use of Windows Server and several Microsoft applications like Sharepoint, SCCM, Exchange Server and SQL Server. QUESTION 79 Your company runs Remote Desktop Services. You have a Remote Desktop Web Access (RD Web Access) server. You publish several applications on the internal network by using RD Web Access. You need to ensure that the published applications are accessible from the internet via an HTTPS connection over port 443. What should you do first? A. Install and configure the Remote Desktop Connection Broker (RD Connection Broker) role service on me RD Web Access server. B. Use Intemet Information Services (IIS) Manager to enable Windows Authentication. C. Use Intemet Information Services (IIS) Manager to disable Forms Authentication. D. Install and configure the Remote Desktop Gateway (RD Gateway) role service on the RD Web Access server. Correct Answer: D /Reference: Creating a Remote Desktop Gateway (RD Gateway) is straight forward and can be used to securely access your Windows servers over port 443 using the Remote Desktop Connection Client. I use this to access my home lab when I m on the road or at work, and it saves exposing your machines to the internet directly over RDP (TCP 3389). The RD Gateway isn t new, in fact it was available on Windows Server 2008 as TS Gateway, and the installation is the same. For this article, I will be using Windows Server 2008 R2. Step 1: Build a new virtual machine and install Windows Server 2008 R2. Step 2: Click on Add Roles (in Server Manager). You will then be presented with the following wizard dialog boxes. Click on each image for full screen.

141

142

143

144

145

146

147

148

149

150

151

152

153 Step 3: Configuring the RD Gateway Now the RD Gateway is installed, go to Start > Administrative Tools > Remote Desktop Services > Remote Desktop Gateway Manager. Right click on the RD Gateway server within the RD Gateway Manager console and select Properties. Select Create a self-signed certificate then click Create and Import Certificate. You will then be presented with the following: