GOTB Europe - Windows 7 Deck

Welcome to Windows 7
Stephen L Rose
Worldwide Community Manager – Windows Client
stros@microsoft.com
http://microsoft.com/springboard
Blog- http://windowsteamblog.comTwitter- @stephenlrose / @MSspringboard

Agenda
Who Am I?
Resources, Resources, Resources
Windows 7 Overview
Windows 7 Anywhere
Security and Control in Windows 7
Windows 7 Deployment
Wrap-up

What is the Springboard Series?
The Springboard Series is the resource for desktop IT pros www.microsoft.com/springboard
Springboard is localized in 10 languages
Over 50 video walkthroughs on Windows 7 features, tools and tasks
Dedicated zones for Application Compatibility, Migration, Deployment and more
Straight-talk Monthly Feature Articles & Overview Guides
Springboard Insider Monthly Newsletter and Windows Team Blog
Virtual Roundtable Events
The Springboard Series IT pro experience offers IT Pros dynamic content and structured guidance across the adoption lifecycle
Follow us on Twitter @ MSSpringboard

www.TalkingAboutWindows.com – The people , the backstories, and the events behind Windows 7.
Join The Conversation!

Let’s Begin

Windows 7 Versions
Windows 7 Starter
NoAero
No 64 Bit
Windows 7 Home Basic
Emerging Markets only
Windows 7 Home Premium
Includes Aero, Media Center and Touch
Windows 7 Professional
Does not support Direct Access, BitLocker, BitLocker To Go, BranchCache. Does have XP Mode
Windows 7 Enterprise
Supports all features. Only available via Volume License to Software Assurance customers.
Windows 7 Ultimate
Supports all features.

Understanding VL and SA
What is Volume Licensing?
Volume Licensing is the most affordable way to upgrade your existing PCs to Windows 7Enterprise.
Windows licenses available through Volume Licensing are upgrade-only licenses. They do not replace purchasing the initial Windows licenses for software that comes pre-installed on new PCs.
Each desktop that runs the Windows 7 upgrade must first be licensed to run one of the qualifying operating systems (Windows Vista (Enterprise/Business/Ultimate) or Windows XP (Professional)—otherwise the PC will not have a valid, legal Windows license.
What is Software Assurance?
When you acquire Windows 7 Professional licenses, either through Volume Licensing upgrades or through an OEM, you can cover those licenses with Software Assurance to get rights to Windows 7 Enterprise.
SA also applies to Office and other Microsoft products.

What Else Do I Get With SA?
Microsoft Desktop Optimization Pack (MDOP) - MDOP is an add-on subscription license that provides innovative technologies to help better control the desktop PC, accelerate and simplify desktop PC deployments and management, and create a dynamic infrastructure by turning software into centrally-managed services.
Windows Virtual Enterprise Centralized Desktop (VECD) for Software Assurance - Windows VECD is an annual device-based subscription that enables organizations to license virtual copies of Windows 7 (or prior OS versions) in a variety of user scenarios.
Windows Fundamentals for Legacy PCs - Available exclusively to Microsoft Software Assurance customers, this small-footprint, Windows-based operating system solution is for customers with legacy computers running early operating systems who are not in a position to purchase new hardware.
Virtual OS Rights - Use up to four instances of Windows in virtual OS environments for each license that has active Software Assurance coverage.
New Version Rights - Receive new versions of licensed software released during the term of your coverage. If you have Software Assurance coverage for your PCs when Windows 7 is released, you will automatically receive rights to use Windows 7 Enterprise on those PCs.

MDOP Technologies
App-V turns applications into centrally managed services that are never installed, never conflict, and are streamed on demand to end users
AIS is a hosted service that collects software inventory data and translates it into actionable business intelligence
DART reduces downtime by accelerating desktop repair, recovery, and troubleshooting unbootable Windows-based desktops
DEM enables proactive helpdesk problem management by analyzing and reporting on application and system crashes
AGPM enhances governance and control over Group Policy through robust change management and role-based administration
MED-V enables deployment and management of Microsoft Virtual PC to address key enterprise scenarios, primarily resolving application compatibility with a new version of Windows

What’s The Killer Feature In Windows 7?

What’s The Killer Feature In Windows 7?
“I Don’t Care How It Works. I Just Want It To Work.”
Mobility
Direct Access / VPN Reconnect/Mobile Broadband / BranchCache
Security and Control
BitLocker/BitLocker To Go / Improved UAC
Desktop Auditing / NAP / AppLocker / IE8
GUI
New Aero Features / Search / Wireless support / Device Stage / Location Aware Printing / Home Groups / Libraries
General
Speed / Efficiency / Capabilities / Flexibility / Reliability

Windows 7 and Access Anywhere

Information Worker’s World Has Been Changing
CENTRAL OFFICE
BRANCH OFFICES
REMOTE WORK
MOBILE & DISTRIBUTED WORKFORCE

The Evolving Needs
IT Professional needs:

Secure and flexible infrastructure for“work anywhere”
Reduce costs

Mobile & Remote Work-Force needs:

Work anywhere
Fast access

Remote Access for Mobile Workers
Windows 7 Solution
Situation Today
DirectAccess
Home
Office
Home
Office

Corporate network boundary includes managed assets no matter where they are on the Internet
Easy to service mobile PCs and distribute updates and polices
New network paradigm increases mobile user productivity by providing same experience inside & outsidethe office
Challenging for IT to manage, update, patch mobile PCs while disconnected from company network
Difficult for users to access corporate resources from outside the office

DirectAccess Components
Server
Client

Runs on Windows 7
Domain-joined
Initial configuration done on Corpnet or over VPN
Runs on Windows Server 2008 R2
Sits on network edge
Single box by default
Services can be split up for scalability

DirectAccess
Technical Details
IPsec/IPv6
Internet
Compliant Client
Compliant Client
NAP / NPS Servers
IPsec/IPv6
IPsec/IPv6
Tunnel over IPv4 UDP, HTTPS, etc.
DirectAccess Server
Intranet User
Assume the underlying network is always insecure
Data Center and Business Critical Resources
Intranet User
Redefine enterprise network edge to insulate the datacenter and business critical resources
Enterprise Network
Security policies based on identity, not location

DirectAccess & IPv6
Internet
DirectAccessServer
DirectAccessClient
Tunnel over IPv4 UDP, HTTPS, etc.
Encrypted IPsec+ESP
Native IPv6
6to4
Teredo
IP-HTTPS

DirectAccess & IPsec
EnterpriseNetwork
Line of Business Applications
DirectAccess Server
No IPsec
IPsec Integrity Only (Auth)
IPsec Integrity + Encryption

DirectAccess Deployment
Get ready step by step
Determine your strategy
Be ready to monitor IPv6 traffic
Choose an Access Model: Full Intranet Access vs. Selected Server Access?
Assess deployment scale
Get your infrastructure ready
Windows 7 clients
Windows Server 2008 R2 DirectAccess Server
DC, DNS Server, Active Directory, PKI, Application Servers, etc.
During deployment
Use DirectAccess configuration wizard to setup DirectAccess Server and generate policies for clients, application servers, and DC/DNS
Customize policies as needed

IT Pro Benefits
Improved manageability of remote users
IT simplification and cost reduction
Consistent security for all access scenarios
Seamless & secure access to corporate resources
Consistent connectivity experience in / out office
Combined with other Windows 7 features enhances the end to end IW experience
DirectAccess Benefits
End User Benefits

DirectAccess? Show Me!

VPN Reconnect
Windows 7 Solution
Situation Today
VPN Server

The client maintains persistent VPN connection across network outages
VPN Client can connect to any VPN Server of choice

VPN Server

VPN used frequently for remote access to corporate resources
Mobile workers reconnect to VPN on every network outage

Benefits

Better end user experience: seamless and consistent VPN connectivity
Reduced support costs

Mobile Broadband
Windows 7 Solution
Situation Today
Integrated solution that is consistent and easy to discover

Plug & play experience for 3G cards (built-in or external)

Benefits
Internet connectivity via mobile broadband cards is expanding:

Inconsistent user experience
Additional software required
IHVs can integrate devices using Windows 7 platform
No need for users to install3rd party software
End users have same connectivity experience across WiFi and WWAN

Branch Office Enhancements
Windows 7 Solution
Situation Today
BranchCache™
Caches content downloaded from file and Web servers
Users in the branch can quickly open files stored in the cache
Frees up network bandwidth for other uses
Application and data access over WAN is slow in branch offices
Slow connections hurt user productivity
Improving network performance is expensive and difficult to implement

BranchCache
Technical Details

Authenticates current state of data and access rights of the user against the server
Supports commonly used protocols: HTTP(S), SMB
Support network security protocols (SSL, IPsec)
Requires Windows Server 2008 R2 in the data center and Hosted Cache

BranchCache Distributed Cache
Main Office
Data
Get
Get
ID
ID
Data
Data
Get
Get
Branch Office

BranchCache Hosted Cache
Main Office
Get
Get
ID
ID
ID
ID
ID
Data
ID
Data
Data
Data
Search
Search
Get
Put
Advertize
Get
Request
Branch Office

BranchCache
Hosted CacheData cached at the host server
Distributed Cache
Data cached in cache pool

Cache stored centrally: existing Windows Server 2008 R2 in the branch
Cache availability is high
Enables branch-wide caching
Increased reliability
Recommended for branches without a branch server
Easy to deploy: Enabled on clients through Group Policy
Cache availability decreases with laptops that go offline

Enterprise

BranchCache Benefits
IT Pro Benefits

Optimize network utilization:
HTTP and HTTPS-based intranet traffic
SMB (and signed SMB) shares on the read path
Support network security protocols (SSL, IPsec)
Reduce the cost of managing WAN
Improve application responsiveness and reduce file transferwait time
Combined with other SMB offerings enhance the userexperience on remote shares

End User Benefits

Enhance Security & Control in Windows 7

Windows 7 Enterprise Security
Building upon the security foundations of Windows Vista, Windows 7 provides IT Professionals security features that are simple to use, manageable, and valuable.
Fundamentally Secure Platform
Helping Protect Users & Infrastructure
Helping Secure Anywhere Access
Helping
Protect
Data
Windows Vista Foundation
Streamlined User Account Control
Enhanced Auditing
Network Security
Network Access Protection
DirectAccessTM
AppLockerTM
Internet Explorer 8
Data Recovery
RMS
EFS
BitLocker & BitLocker To GoTM

Fundamentally Secure Platform
Windows Vista Foundation
Enhanced Auditing
Streamlined User Account Control
Make the system work well for standard users
Administrators use full privilege only for administrative tasks
File and registry virtualization helps applications that are not UAC compliant
Group Policy Configurable
XML based
Granular audit categories
Detailed collection of audit results
Simplified compliance management
Security Development Lifecycle process
Kernel Patch Protection
Windows Service Hardening
DEP & ASLR
IE 8 inclusive
Mandatory Integrity Controls

User Account Control
Windows Vista
System Works for Standard User
All users, including administrators, run as Standard User by default
Administrators use full privilege only for administrative tasks or applications
Influence the ecosystem to write software that does not need administrative rights
Streamlined UAC
Reduce the number of OS applications and tasks that require elevation
Refactor applications into elevated/non-elevated pieces
Flexible prompt behavior for administrators
Continued ecosystem influence for standard user applications
Challenges
Customer Value
User provides explicit consent before using elevated privilege
Disabling UAC removes protections, not just consent prompt
Users can do even more as a standard user
Administrators will see fewer UAC Elevation Prompts
Windows 7

Desktop Auditing
Windows Vista
Enhanced Auditing
New XML based events
Fine grained support for audit of administrative privilege
Simplified filtering of “noise” to find the event you’re looking for
Tasks tied to events
Simplified configuration results in lower TCO
Demonstrate why a person has access to specific information
Understand why a person has been denied access to specific information
Track all changes made by specific people or groups
Challenges
Granular auditing complex to configure
Auditing access and privilege use for a group of users
Windows 7

UAC & Auditing

Securing Anywhere Access
Network Security
DirectAccess
Ensure that only “healthy” machines can access corporate data
Enable “unhealthy” machines to get clean before they gain access
Security protected, seamless, always on connection to corporate network
Improved management of remote users
Consistent security for all access scenarios
Policy based network segmentation for more secure and isolated logical networks
Multi-Home Firewall Profiles
DNSSec Support

Remediation
Servers
Example: Patch
Restricted
Network
Corporate Network
Policy Servers
such as: Patch, AV
Health policy validation and remediation
Helps keep mobile, desktop and server devices in compliance
Reduces risk from unauthorized systems on the network
Not policy compliant
Policy compliant
DHCP, VPN
Switch/Router
Windows
Client
NPS
Windows 7

Protect Users & Infrastructure
AppLockerTM
Data Recovery
Internet Explorer 8
Protect users against social engineering and privacy exploits
Protect users against browser based exploits
Protect users against web server exploits
File back up and restore
CompletePC™ image-based backup
System Restore
Volume Shadow Copies
Volume Revert
Enables application standardization without increasing TCO
Increase security to safeguard against data and privacy loss
Support compliance enforcement

Help Desk Made Easier
Problem Steps Recorder
Windows Troubleshooting Platform

Application Control
Situation Today
AppLocker
Eliminate unwanted/unknown applications in your network
Enforce application standardization within your organization
Easily create and manage flexible rules using Group Policy
Users can install and run non-standard applications
Even standard users can install some types of software
Unauthorized applications may:
Introduce malware
Increase helpdesk calls
Reduce user productivity
Undermine compliance efforts
Windows 7 Solution

AppLocker Demo

AppLocker
Technical Details
Simple Rule Structure: Allow, Exception & Deny
Publisher Rules
Product Publisher, Name, Filename & Version
Multiple Policies
Executables, installers, scripts & DLLs
Rule creation tools & wizard
Audit only mode
SKU Availability
AppLocker – Enterprise / Ultimate

BitLocker / BitLocker To Go
Situation Today
BitLocker To Go
+
Worldwide Shipments (000s)
Extend BitLocker drive encryption to removable devices
Create group policies to mandate the use of encryption and block unencrypted drives
Simplify BitLocker setup and configuration of primary hard drive

Gartner “Forecast: USB Flash Drives, Worldwide, 2001-2011” 24 September 2007, Joseph Unsworth
Gartner “Dataquest Insight: PC Forecast Analysis, Worldwide, 1H08” 18 April 2008, Mikako Kitagawa, George Shiffler III

Windows 7 Solution

BitLocker /BitLocker To Go
Technical Details
BitLocker Enhancements
Automatic 200 Mb hidden boot partition
New Key Protectors
Domain Recovery Agent (DRA)
Smart card – data volumes only
BitLocker To Go
Support for FAT*
Protectors: DRA, passphrase, smart card and/or auto-unlock
Management: protector configuration, encryption enforcement
Read-only access on Vista & XP
SKU Availability
Encrypting – Enterprise, Ultimate
Unlocking – All

Microsoft Learningwww.microsoft.com/learning
Springboard Serieswww.microsoft.com/springboard

© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.