View
3
Download
0
Category
Preview:
Citation preview
How Windows 10 marks the end of Roaming Profiles
About meMicrosoft Community Star (HK and TW)
Microsoft Most Valued Professional (MVP)
MCT, MCP, MCP+I, MCITP, MCTS, MCDST, MCSA,
MCSE, MCSE+I, MCDBA, MCAD, MCSD, MCPD
DataAccess Insider, Azure Insider,
DotNet Insider, SourceCode K2 Insider
Guest Speaker on Regular MSDN Seminars (2003-2007)
Guest Speaker on Microsoft ImagineCup (2005-2007)
Guest Speaker on Microsoft TechEd 2008
Guest Speaker on Microsoft TechDays 2009
Guest Speaker on Microsoft TechDays 2015
Guest Speaker on Microsoft Tech Summit 2017
Agenda
• Identifying the Problem
• Enterprise State Roaming: The Cloud Solution
• UE-V: The On-Prem Solution
• Hybrid Environments
• Q&A
Identifying the Problem
I want settings and app data accessible from any device.
The Windows experience should follow me as a user so I can stay productive wherever I go.
Problem 1
Device replacement is painful. I want to feel protected from data loss if my device fails.
Configuring my device again is time consuming.
Problem 2
Microsoft’s Customer Promises
Roaming Profiles
When are the Roaming Profiles from?
1994!
Roaming Profile VersioningClient OS Server OS Extension Profile Location
Win NT4 Win Server NT 4 None \\<servername>\<fileshare>\<username>
Win 2000 Win Server 2000 None \\<servername>\<fileshare>\<username>
Win XP Win Server 2003
Win Server 2003 R2
None \\<servername>\<fileshare>\<username>
Win Vista Win Server 2008 V2 \\<servername>\<fileshare>\<username>.V2
Win 7 Win Server 2008 R2 V2 \\<servername>\<fileshare>\<username>.V2
Win 8 Win Server 2012 V3 \\<servername>\<fileshare>\<username>.V3 *
\\<servername>\<fileshare>\<username>.V2 **
Win 8.1 Win Server 2012 R2 V4 \\<servername>\<fileshare>\<username>.V4 *
\\<servername>\<fileshare>\<username>.V2 **
Win 10 V5 \\<servername>\<fileshare>\<username>.V5
Win 10 Anniversary (1607) V6 \\<servername>\<fileshare>\<username>.V6
* After the software update and registry key are applied (KB 2887239)
** Before the software update and registry key are applied
*** After the software update and registry key are applied (KB 2887595)
**** Before the software update and registry key are applied
• If support 2 OS versions, 2 x Roaming Profile Size
• If support 3 OS versions, 3 x Roaming Profile Size
• Documents and Pictures (Computer Configuration)
• Contacts, Desktop, Favorites, Music, Videos, Start Menu, AppData\Roaming (User Configuration)
• Between WinVista/Win Server 2008 and Win7/Win Server 2008 R2
• Between Win8/Win Server 2012 and Win8.1/Win Server 2012 R2
• Between WinVista, Win7, Win8 and Win8.1
• Changes made on one OS version won’t roam to another OS version
• Moving your environment to new version of OS, new and empty profile created
• No supported method of migrating User Profiles
Roaming with 1+ Versions of Windows
• Using more than one PC
• Remote Desktop Session Host Server
• Virtualized Desktop Infrastructure (VDI) Server
• Will fixing it in future release
• Configurate User Profile Disks with Remote Desktop Session Host Server or VDI Server
• More info: https://blogs.technet.microsoft.com/enterprisemobility/2012/11/13/easier-user-data-management-with-user-profile-disks-in-windows-server-2012/
Roaming Start Menu on Win 10
• Enforcement of Admin control by using Mandatory User Profile
• Users can access data anywehre
• Easier backup
• Very large size, but smaller with Folder Redirection since Win Server 2008
• Only registry is roaming but not Local Settings• It can corrupt with Diff set of applications installed on machines
• Some applications does not support profile in UNC, i.e.,• Batch file under Command Prompt
• Adobe Reader v9.0 and v10.0
• OpenOffice.org 3.3
• AutoCAD 2013
Roaming Advantages & Disadvantages
Settings roaming is what we still want!
• Sync your settings
• Enterprise State Roaming (ESR): The Cloud Solution
• User Experience Virtualization (UE-V): The On-Prem Solution
Settings Roaming in Win10
Settings Sync
• Allows consumers to sync their OS Settings and Modern Applicatio data across all their personal Windows Devices
• Theme, IE Settings, Edge Browser Settings, Passwords, Language Preferences, Ease of Access Features, Other Windows Settings
• UWP Data
Settings Sync
• Only Microsoft Accounts
• Enterprise Users needs to connect a Microsoft Account to AD domain account
• Replaced with a Primary/Secondary Account Framework
• Primary can be Microsoft Account, Azure AD Account, On-Prem AD Account, Local Account
• Secondary can be Microsoft Account, Azure AD Account, some other account such as Gmail or Facebook
• Only Primary Account for the device can be used for Settings Sync
What Account?
Enterprise State Roaming (ESR)
Settings Sync
Goal:Provide Enterprise State Roaming using Azure Active Directory (AAD) authentication for AAD Premium users.
• Corporate-owned device support
• Separation of corporate and consumer data
• Enhanced security (Azure RMS)
• Management and monitoring services
Protection Scope
App Data*
• UWP app roaming
data
OS Settings
• Personalization
• Accessibility
• Language settings
• Windows settings
• Browser settings
• Credentials
Cloud
• Data resides in
the Azure Cloud
Devices
• PC
• Laptops
• Tablets
• VDI (client SKU VM)
*ESR does not currently support the roaming of Win32 app settings
• Always based on the identity used to sign into Windows (“primary account”)
• Always based on the identity of app acquisition
• User’s relevant app data roams across their devices if the acquisition ID is the same as the primary account
• Enterprise and personal data stay separate in their respective storage locations
Identity and Roaming Data Separation
EmployeeConsumer
Personal
Company
Owned
Personal
(BYOD)
Company
Owned
Consumer BYODBusiness
Only
Business
Open
scenarios
Consumer Use Business Use
OneDrive OneDrive
OneDrive OneDrive
App State Roaming Example
AzureCloud
Business onlyApps
AAD PrimaryIdentity
Work-ownedDevice
Business & ConsumerApps
AzureOnly the business app syncs to cloud
AAD Primary, added MSAIdentity
Work-ownedDevice
Data that syncs is encrypted• Encrypted using Azure Rights Management (Azure
RMS) before leaving the device
• All content stays encrypted at rest in the cloud
• Enterprises with Azure RMS subscription can Bring Your Own Key
Enhanced Security
Storage location• Enterprise State Roaming data is hosted in the
Azure region that best aligns with the tenant’s country
• Data is locally located with the geographical region, and is not replicated across regions
Sync data storage
Why Join Azure AD?
Five Easy Steps
Step 1: Create an Azure Directory
• Azure AD Premium, OR
• EMS
Step 2: Enable Device Registration
Step 2a: Enable MDM Enrollment
Step 3: Configure DNS
Entry Type Target
Enterpriseregistration CNAME enterpriseregistration.windows.net
Step 4: Create Cloud IDs
Step 5: Join the Azure DomainRequires Windows 10 *
• With Enterprise or Education SKU
• Becomes the primary account
• Enables logon with other tenant IDs
• Linked secondary logon
AAD Join in OOBE
AAD Join after OOBE
Questions on Azure AD
• Windows Settings
• UWP App Settings
Enterprise State Roaming (ESR)
1. Azure Active Directory (AAD) Premium subscription.
2. Windows 10 (Version 1511, OS Build 10586 or later).
3. Devices are Azure AD joined (or traditional on-prem AD domain-joined devices with automatic registration to Azure AD).
1. IT Admin goes to the AAD online management portal to configure users for Enterprise State Roaming.
2. Additional policies may be applied.
How do I try out ESR?
User Experience Virtualization(UE-V)
What is User Experience Virtualization (UE-V)?
• VDI environment where multiple accounts are stored
• Call centers where thin clients are used
• Enterprise user with multiple devices (dekstop, laptop, ...etc)
• Microsoft Office 2016, 2013, and 2010
• Internet Explorer 11 and 10
• Many Windows applications, such as Xbox
• Many Windows desktop applications, such as Notepad
• Many Windows settings, such as desktop background or wallpaper
User Experience Virtualization (UE-V)
UE-V Customer Value
On-Premise• UE-V relies on local network share
• No server component needed
• Customer can completely manage and own their data
• Works for customers in strict data enforced countries such as those in EU
Win32 App settings roaming• Over 80%+ applications in use by
Enterprise customers are Win32 desktop applications
• Custom and LOB apps can be roamed using templates
• Granular control over which app can roam
UE-V
Settings Storage Path
What’s New for Windows 10 Anniversary Update
Easier to deploy Easier to manage Simple to Acquire Simple to Migrate
Built in
components of
Windows
New PowerShell
and GP
commands
Moving from
MDOP attachment
licensing
Ensuring settings
and configurations
are retained
Previously, UE-V shipped with the Microsoft Desktop Optimization Pack (MDOP) as an external set of installers• Agent UI and Service Setup
• Template Generator Setup
Needed MDOP attachment to Software Assurance License to get the installers
MDOP
For Window 10 Anniversary Update and beyond, UE-V is shipped as a Windows component in Windows Enterprise SKU and can be enabled inbox• PowerShell & Group policy deployment
• Agent UI has been removed
UE-V Template Generator ships as a part of the Windows Assessment and Deployment Kit (ADK)• Available for download from the Hardware Download Center
Software Assurance License now includes MDOP without additional add-on license after August 1st, 2015
What’s New
For customers who are paying for Windows Pro SKU but would like to use UE-V and other enterprise features, they can upgrade to Windows Enterprise SKU• Allows Pro SKUs to turn on Enterprise features including UE-V
• Using SLMGR.VBS, just change the product key
• No reboot needed
Pro SKU to Enterprise SKU
For customers who were using a previous version of Windows and UE-V• Upgrade to Windows 10 Anniversary Update will automatically migrate UE-V setting,
configurations and enable the UE-V service
Removed inbox templates• Win32 calculator template
• IE 8/9
Added inbox template• Office 2016
Migration
• Does not roam printer settings or preferences
UE-V Changes in Windows 10
Enable-UEV• Turns on the UE-V service, requires reboot
Disable-UEV• Turns off the UE-V Service, requires reboot
Get-UevStatus• Displays whether UE-V service is enabled or disabled in Boolean value
Set-UevConfiguration• Configures the UE-V service
• Needs to be set before enable
Get-UevConfiguration• Displays the configurations set by the IT admin
Key PowerShell commands for UE-V
• Allow UE-V Users List Folder/read data and Create Folders/Append data in root
• Allow Creator Owner Full Control on Subfolders and files
• Use Group Policy or PowerShell
• Get-childItem c:\programdata\Microsoft\UEV\InboxTemplates\*.xml|% {register-UevTemplate $_.Fullname}
• Set-UevConfiguration -EnableWaitForSyncOnApplicationStart
Deploy UE-V
What if my customer uses a hybrid on-premise and cloud environment?
What if my customer wants to roam Win32 apps settings right now?
Can UE-V and ESR currently coexist?
UEV & ESR Together??
• UE-V can roam Win32 applications on-premises while Enterprise State Roaming (ESR) can roam the rest
Admins can configure UE-V to roam just Win32 app settings by disabling roaming of Windows OS settings and Universal app data through • Enable “Do Not Synchronize Windows Apps”
• Disable “Synchronize Windows Settings”
• Disable “IE” Roaming in the applications section
In Windows 10 Anniversary Update, UE-V will automatically detect if ESR is enabled and apply the above policies directly
UE-V & ESR Together
Summary on UE-V & ESR TogetherUE-V is a completely on-premise solution, requires management of templates, provides granular control and can roam Win32 app settings.
ESR is a cloud-based solution connected to AAD, which provides an enterprise compliant service that syncs OS settings and modern app data.
UE-V and ESR can co-exist for a complete settings roaming solution in hybrid environments.
Summary
• Unfortunately lacks support for Win32 applications
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview
https://technet.microsoft.com/en-us/itpro/windows/manage/uev-for-windows
mvpkenlin@live.com
Summary
Thank You
Share us your feedback of this session!
Download the Tech Summit Event App! https://aka.ms/tshkapp
Log in with your Tech Summit Account
Add your attended session to My Agenda
Click into the agenda details for the session’s evaluation
Is time Allowed?
More...
Customizing the Start Menu in Windows 10
Windows 10 Start Menu
Group Policy for Start Menu Options
Create Start Layout XML
Export the Start Layout•
•export-startlayout –path <path><file name>.xml
•Add LayoutCustomizationRestrictionType="OnlySpecifiedGroups“ to
DefaultLayoutOverride element
Specified Tile Groups can never be changed
Applying the Start Layout•
•
•Group Policy
Windows Imaging and Configuration Designer provisioning package
Mobile Device Management (MDM)
Group Policy Preference
Import in Windows Image
Sample Start layout XML
start:Tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App"
Taskbar Options•
Default Windows Apps
Apps pinned by the user
Apps pinned during deploy
•
Configuring the Taskbar•
•
•<taskbar:UWA> and AUMID to pin Universal
Windows Platform apps.
<taskbar:DesktopApp> and Desktop Application Link Path to pin desktop applications.
•Add PinListPlacement="Replace" to
<CustomTaskbarLayoutCollection>
Sample Taskbar Start layout XML
taskbar:UWA AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"
taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
Deploy the Start Layout
Combine Start & Taskbar Layout
Deploying the Start Menu•
•
•
Use Group Policy to deploy Start layout•
•
./User/Vendor/MSFT/Policy/Config/Start/StartLayout
Use MDM to deploy Start Layout
Use Windows Imaging and Configuration Designer (ICD) to include XML in the PPKG
Import-StartLayout
Other ways to deploy Start layout
Summary
Summary•
•
•
•Manage Windows 10 Start and taskbar layout
•mvpkenlin@live.com
Recommended