Going to work with Windows 8 Enterprise

Windows 8 Enterprise is the reverse-mullet of operating systems: all party in front and business in the back. Up front, the new Start screen and touch-focused interface are more focused on users having a good time—one can not imagine many productivity applications for having access to content based on a gamertag, for example. Behind the tiles, the Desktop is where all the real work will happen.

And even at the Desktop level, Windows 8 Enterprise does not wear its business credibility on its sleeves. The exclusive features in the volume-licensed version of Windows 8 packaged specifically for business users are for the most part under the covers and barely visible. But they make it possible for users to work more securely, and take their work with them when they untether from the LAN—or, with one new feature, when they unplug their boot thumbdrive from the PC.

There are six features exclusive to Windows 8 Enterprise that aim to make it friendlier for business use:

• Windows to Go capability, which allows users to boot a secured image of Windows from a USB drive
• BranchCache content staging and network storage caching feature
• AppLocker application access control
• DirectAccess remote access technology
• Enhanced VDI support for touch-based Windows devices
• “Side-loading” of internal applications developed using the “Metro” interface

Not all of these features are new in Windows 8. DirectAccess, AppLocker, and BranchCache were available in Windows 7 Enterprise and Ultimate, as was VDI support. The improvements in BranchCache, VDI support, and DirectAccess are also dependent on changes in Windows Server 2012. And other than Windows to Go and VDI, the features are largely hidden from the end-user and depend on Active Directory and Windows group policy settings—and in some cases Windows’ PowerShell—to be configured.

But are these features in and of themselves enough for businesses to justify upgrading—and dealing with the user retraining, software testing, and other hassles that come with a major operating system upgrade? For companies that have volume licensing already in place, for whom a “step-up” fee may not be that major a financial consideration, the other hard and soft costs of upgrading may outweigh any benefits from the internal improvements of Windows 8 itself. Much of the decision will rest on whether or not to embrace the new Windows 8 application development model, the adoption of x86-based tablets, and considerations beyond the technical soundness of the platform itself.

The good news is that Windows 8 Enterprise is ready to go when businesses decide to be assimilated—and IT pros won’t have to change much about how they currently support Windows desktops and notebooks to accommodate the change. Some of the new features of Windows 8 Enterprise may not be easy to deploy immediately because of a lack of supporting devices and applications, however. So it might be a while before many businesses feel ready to stop fearing the Start screen and love Windows 8 Enterprise.

Windows to Go and VDI

For organizations that have users without a fixed PC to go to, Windows 8 Enterprise offers two ways to connect to their own personal desktop: Windows to Go, which puts the whole Windows 8 environment onto a portable USB-based storage device, and through a virtual desktop infrastructure with Remote Desktop Connection.

Windows to Go is a great idea: a secure, corporate-approved image of Windows 8 that can be booted from a USB-connected device on practically any recent PC without touching the local operating system. Combined with DirectAccess or a VPN, it gives people a safe way to reach back to the home office, check mail, and access documents from an untrusted PC. Users can do this at home, a client’s office, or a public computer—all without fear of leaving a trail or exposing corporate systems to malware lurking on an under-protected system.

I did a somewhat involved test of Windows to Go’s concept after the Consumer Preview was released, using Windows 7 administrative tools to build out my bootable image on a 32-gigabyte USB stick. It worked well for beta, but it was too labor-intensive for your average user to self-configure. Now, Microsoft has completely automated the creation of Windows to Go volumes with a click-and-go utility on a desktop for self-provisioning. There are also tools in System Center 2012 for provisioning Windows to Go images.

To self-provision a Windows to Go “workspace,” the first step is to find the Windows to Go wizard in Windows 8’s Settings (Window key + W brings you to the settings search in the Start window).

Windows to Go requires Windows 8 Enterprise to work because of its volume licensing—other versions of Windows get married by their installation keys to specific hardware. And that’s fine, because it’s a feature that is best when married with the other features enabled by Windows 8 Enterprise.

Step 2: Insert your USB, and select it in the provisioning wizard as a target.

There’s really just one fly in the ointment—the self-provisioning tool only works with USB drives that are “Windows to Go Certified.” That’s a short list at the moment. As of launch, there are only three devices certified for Windows to Go, and one of them—Western Digital’s My Passport Enterprise—is a 500-gibabyte portable hard drive. This is not the sort of thing you carry around hanging from a lanyard (unless you’re Flava Flav, and you glue a clock to it).

The key attributes of being a certified Windows to Go device are USB 3.0 support and firmware to support two partitions: a 350-megabyte FAT32 system partition and another larger NTFS partition for Windows 8 itself.

If you’re an administrator building a custom Windows to Go “workspace,” as Microsoft refers to it, the process can be automated to some degree. You’ll need to use PowerShell scripts, the Deployment Image Servicing, and Management command-line toolkit or the Windows 7 Automated Installation Kit (see the TechNet walkthrough for those details).

One other limitation of Windows to Go that most companies won’t care too much about is that the Windows Store is disabled and apps purchased from it won’t run. That’s because Windows Store licenses are linked to a specific computer.

Remote Desktop connection, on the other hand, follows a more traditional route to desktop and app access for users not bound to a single PC. Microsoft put a lot of work into its support for virtual desktop infrastructure in Windows Server 2012, and that’s reflected in Windows 8 Enterprise. It now offers better support for all sorts of users—including those with touch-based tablets.

The biggest changes to VDI in Windows 8 Enterprise are related to how it connects to the remote session. Windows 8 and Windows Server 2012 use RemoteFX to support virtual desktop sessions, instead of the vanilla Remote Desktop Protocol. RemoteFX can harness a graphics processor on the server to power multiple remote desktop sessions. Users can then access apps with 3D graphics and handle all the heavy lifting on the back-end, either through a full remote desktop experience or through a RemoteApp virtualized application session.

A Remote Desktop Connection session with Windows 8. The client’s own menu provides quick access to Metro apps’ interfaces without having to deal with mouse-hover to be recognized over a WAN connection.

The Remote Desktop Connection client in Windows 8 Enterprise also supports connecting local USB devices. Another addition is support for touch-based interaction with remote sessions of Windows 8—not just over a local network connection, but over a WAN connection as well. That may make Windows 8 Enterprise more attractive to organizations that want to put tighter security control on tablets, such as hospitals.

BranchCache

Introduced in Windows 7 and Windows Server 2008 R2, BranchCache is a technology designed for optimizing the use of bandwidth over a wide-area network. It does so by caching files and webpages from the corporate network locally. Instead of reaching out across the network to hit a remote Web or file server, BranchCache-enabled Windows clients retrieve metadata about the content from the original host, then check local caches. Those caches can reside either on a local Windows Server acting as cache server (in a “hosted cache” configuration) or from other PCs on the local subnet (using “distributed cache” mode).

On the client side, BranchCache gets switched on through a Windows Group Policy Object when a user logs in through Active Directory. Through the Group Policy Editor, you can designate the maximum amount of disk space that can be used for BranchCache’s hash store.

Creating a BranchCache group policy object in Group Policy Management (using Windows 8’s remote administration tools for Windows Server 2012).

Unlike Windows’ client-side caching of network shares—a feature that’s been in Windows since Windows XP—BranchCache isn’t intended to provide offline use of files. While it can work alongside offline file caching, BranchCache can also be used with other sorts of network content, such as company-private webpages and Windows updates distributed internally through Windows Server Update Services. In essence, it’s your organization’s very own internal content delivery network.

Rather than storing data in a file structure, BranchCache stores it as a series of hashes based on the location the data came from. Windows 8 Enterprise PCs in a distributed caching environment share that data over the same protocols it came in on (HTTP, HTTPS, or SMB) as BranchCache services running on PCs exchange messages within the subnet.

Distributed cache mode works well for small offices where deploying a local server would be too expensive or difficult to support. It is also a good solution for organizations that use a hosting company or cloud provider for their Windows server infrastructure.

There’s no user control surface to enable BranchCache, though you can turn the service on and off as administrator through Windows 8’s services management console.

All an end-user will ever see of BranchCache (other than faster intranet response) if they dig down into Windows 8’s Services.

While the general functionality of BranchCache hasn’t changed much from Windows 7 to Windows 8, there have been a lot of tweaks to how it performs them. Configuration of BranchCache in Windows 8 Enterprise is automatic, and Microsoft has added data deduplication features to the client-based BranchCache to prevent multiple PCs from downloading the same content. Changes are also made in smaller chunks now, so that small changes to files don’t require another full download across the WAN.

Remote Access Services and DirectAccess

Windows 8 supports two remote access features: the more traditional VPN-based remote access of Routing and Remote Access Server, and DirectAccess—a network tunneling technology based on IPv6 and “transitional” technologies that encapsulate IPv6 over IPv4. DirectAccess immediately joins a PC to a remote domain securely at startup, blocking out the local network environment and preventing local network attacks on the PC or the remote server.

Both of these services were supported in Windows 7 Enterprise and Windows Server 2008 R2, but they couldn’t co-exist on the same server. In Windows Server 2012, a single Remote Access Service server can host both RRAS and DirectAccess. Because it works right from boot-up, DirectAccess is invisible to the user—it’s configured through a group policy and activated when a computer is first bound to a domain. DirectAccess deployment has been greatly simplified in Windows Server 2012. For example, you no longer have to have a PKI infrastructure deployed before you can install DirectAccess.

The Remote Access Management console, part of Windows 8’s remote administration tools, provides a quick way to set up policies for DirectAccess and audit its usage.

Since it’s driven through Group Policy, DirectAccess can be turned on for just mobile computers or for all PCs. If you want to ensure the security of your network while allowing guests to still be able to access the Internet, you can force all domain-bound computers to tunnel through the DirectAccess server to route to internal and external resources.

AppLocker and “Sideloading”

Part of Windows 8’s DNA is the adoption of the “app store” model for installation of packaged Metro-based applications. Enterprises may or may not want users to run the Bing apps (or games, or Netflix) on their work PCs. But they may want to turn to Metro for line-of-business applications because of Metro’s HTML5 and JavaScript development model. Windows 8 Enterprise provides a way for businesses to have their Metro and block it, too.

Microsoft’s AppLocker, a feature introduced in Windows 7 and Server 2008, gives IT administrators a way to exercise total control over applications, allowing them to create policies on which applications can be run on an enterprise PC, blocking even executable files that don’t usually require elevated privileges to run (including JavaScript and VBScript). AppLocker is largely hidden from the user—at least until he or she tries to install their favorite, non-corporate piece of software.

That sort of capability makes AppLocker a must-have for companies and other organizations looking to totally lock down their desktops and notebooks to limit the avenues of attack for malware. Once a policy is built out, it can be applied through group policies to sets of PCs. You don’t need an Active Directory environment to deploy it—you could, in smaller environments, install local security policies on every system.

The only really significant change made to AppLocker in Windows 8 and Windows Server 2012 is the addition of rules for handling “packaged” apps and their installers—which are specific to Windows 8 in any case. Two more types of files were added to Windows 8’s AppLocker control: .mst files used in Windows application installer packages and .appx files used to package Windows 8 Store apps for the Metro environment.

Perhaps the easiest way to get started with AppLocker is to use a reference machine with approved applications installed to automatically create a rules set.

To generate AppLocker default rules from the configuration of a PC, you’ll need to run PowerShell and launch the Local Security Policy management console.

After creating the default rules, you can run a wizard from a right-click on “Executable Rules” that automatically generates a set of policies based on the applications already installed on the PC.

You can add additional policies to explicitly allow or block the installation or execution of packaged apps or installers. Here, I’ve used the Bing News app as a template to get Microsoft’s publisher data to create a rule that allows PCs to only install Metro apps from Microsoft.

Windows 8 Enterprise informs the user that AppLocker has app blocked them.

After setting the polices to be enforced, and attempting with another user to install and run the Metro Netflix app, the installation failure shows up in Windows 8’s system logs.

Microsoft is forcing developers of Windows 8 applications for consumers to distribute them through the Windows 8 cloud-based application store, but that’s not an acceptable option for organizations creating their own line-of-business apps in Metro. The answer to that problem is Windows 8’s support for “application sideloading.” This allows approved in-house applications to be installed by users or administrators from an application installation package, while still enforcing security against potentially malicious apps imported from elsewhere.

Sideloading is available in all versions of Windows 8 in one form or another, but it is turned on as a feature by default in Windows 8 Enterprise. Apps need to be signed by a trusted certificate authority, and administrators need to set group policy to allow all trusted applications. Windows 8 and Windows 8 Pro require an activation key be created for each app, which has to be added to the system via Slmgr.vbs (a special sideloading script) via command-line.

One of the benefits of Windows 8 Enterprise’s sideloading feature is it allows companies to essentially build their own internal app stores. Organizations can do this through an internal intranet site, or by using the capabilities of System Center 2012 Configuration Manager SP1—which supports distribution of Windows 8 applications through its Application Catalog and Software Center. Used in combination with AppLocker, administrators can avoid mass deployments of apps to users and have them pull just the applications they need down to their system, while enforcing rules about which version they run.

Enough to upgrade for?

On the plus side, Windows 8 Enterprise is at least an incremental step forward in terms of its advanced features. But on their own, these changes just aren’t enough to be a deciding factor when choosing whether to upgrade from Windows 7 or not. The organizations most likely to benefit from a Windows 8 upgrade are those still using Windows XP (and there are plenty of them)—but they’re more likely to move to Windows 7 Enterprise first.