Springboard Series Blog

Great Ways To Share Your Ideas and Score Some Cool Prizes

Stephen L Rose — Fri, 13 Apr 2012 16:54:34 GMT

The UE-V and App-V teams both have ways for you to get a chance to win some cool prizes like a unlocked Nokia phone or a Microsoft Xbox 360, by sharing your UE-V or App-V templates. Check out both pieces below to learn how to participate in these contests.

Creating and Sharing Your Own Microsoft User Experience Virtualization Settings Location Templates

We recently shared this via the Springboard Newsletter, but wanted to make sure that if you were not yet a subscriber you saw this article about creating and sharing settings location templates with Microsoft User Experience Virtualization written by Senior Product Marketing Manager A.J. Smith.

With the recent beta announcement of Microsoft User Experience Virtualization (UE-V) on the Windows for your Business and Springboard Series blogs, many of you are already seeing how it can easily roam the experience for Windows 7, Windows 8 Consumer Preview, and the Microsoft Office 2010 suite regardless how they are deployed. Now you want to move on to the next step of creating a settings location template for your line of business or 3^rd party applications. For those of you not familiar with settings location templates, they are XML files that tell the UE-V agent:

What applications to roam the experience for
Where in the file system and registry that the application writes the experience information to.

Creating these templates is easy using is the UE-V Generator. This wizard based tool that you can get from the Connect site is will help automate the creation of your templates. To make it even easier I am going to walk you through using the tool step by step using Microsoft Expression Design 4.

1. After launching the UE-V Generator from the start menu and choosing the option to create a settings location template, you provide the tool with the path to the executable that you want to create the template for.

2. The application will launch and the Generator will look and see where in the file system and the registry the application stores its settings.

3. Close out of the application and review the locations the Generator discovered.

Note: The Generator will show you the locations split up into two groups, standard and nonstandard locations. Standard locations are areas on the machine where you would typically find settings written to, like C:\users\AJ\appdata\roaming or HKey_Current_User\Software\Microsoft. Nonstandard locations are places where an application might write if it assumes the user has administrative rights, like C:\Windows or the HKey_Local_Machine location in the registry. By default, the UE-V Generator will assume that you want to roam all the standard locations but none of the nonstandard locations. You should review both sets of locations and decide which ones you do or don’t want to roam.

4. Review the properties of the template to complete the creation of the template.

Now that you have created a template, why not share it with the community? To make this easy we have created a Settings Location Template Gallery so you can share and find templates.

Some of you might be thinking, “What’s in it for me to upload settings location templates to the gallery?” Well beside the thanks and adoration from your fellow IT pros, we thought we would make it even more worth your while to share. From now until May 3, 2012 we will be running a contest and invite you to create your best settings location templates, share them with the community, and possibly win an unlocked Nokia Windows Phone or an Xbox 360! We’ll pick the best two contributions and announce the winners in May*.

*No Purchase Necessary. Open only to IT Professionals 18+. Game ends 5/3/12. For details, see Official Rules.

Create and Share Your App-V Package Accelerators

This was also shared this via the Springboard Series Insider Newsletter, but I wanted to make sure that you saw this information about the App-V Package Accelerators contest as well- Senior Product Marketing Manager David Trupkin

Where do you start when you need to create a package for a new application in Microsoft Application Virtualization (App-V)? If you’re an App-V expert, maybe you dive right in and create the package yourself. If you’re just getting started, or trying to save time, maybe you’ll search the Internet to see if one of your peers has already packaged the same application. If they have, they may have shared the step-by-step process, the recipe, for creating the package. In App-V, this is a process known as Sequencing.

Where can you find App-V recipes? A good place to start is the App-V Sequencing Recipe Forum. We’ve even provided a link to the Recipe Forum right inside the Sequencer! Here you’ll find recipes for applications like Microsoft Visual Studio 2010 and AutoCAD 2010 LT. Other popular packaging-oriented websites and our own App-V MVP community also frequently post App-V recipes.

Starting with App-V 4.6 Service Pack 1, we’ve made it even easier for the App-V community to share packaging knowledge with the introduction of App-V Package Accelerators. Package Accelerators help make App-V packaging easier, faster and more predictable, taking most of the manual steps out of Sequencing. One of the best explanations I’ve heard of Package Accelerators came from the App-V development team. They think of Package Accelerators as “dehydrated” App-V packages. When you use the App-V Sequencer to combine them with the application’s original installation files, you’re “rehydrating” the App-V package.

Where can you find App-V Package Accelerators? You’ll find them in the App-V Package Accelerator Gallery. And, just like the Sequencing Recipe Forum, we’ve included a link to the Package Accelerator Gallery right inside the App-V Sequencer.

One of the best things about the App-V Package Accelerator Gallery is that it’s easy for you to share
Package Accelerators that you create by uploading them to the Gallery!

Between April 5, 2012 and May 3, 2012, we invite you to create your best Package Accelerators, share them with the community, and possibly win an unlocked Nokia Windows Phone or an Xbox 360! We’ll pick the best two contributions and announce the winners in May*.

To help you get started, check out these videos on how to create an App-V package from an App-V Package Accelerator, and how to create your own App-V Package Accelerator. You can also find more information in the App-V 4.6 SP1 Sequencing Guide and the Online Technical Library for App-V. You can get App-V 4.6 SP1 by downloading the Microsoft Desktop Optimization Pack 2011 R2 Language Update on MSDN or TechNet, or check out the App-V 4.6 SP2 Beta on Microsoft Connect. Happy Sequencing!

*No Purchase Necessary. Open only to IT Professionals 18+. Game ends 5/3/12. For details, see Official Rules.

Data, Data Everywhere. Not a Control to Waste!

Stephen L Rose — Wed, 11 Apr 2012 17:25:51 GMT

Todays blog is from Chase Carpenter who is a Principal Product Unit Manager with the Microsoft Security & Compliance team and builds upon our SCM 2.5 post from April 3rd.

This week, I was reading through Verizon’s 2012 Data Breach Investigations Report. Last year, they recorded a dramatic increase in the number of security incidents that exposed more than 174 million user records. What I found most disappointing was the fact that 97 percent of these breaches could have been prevented by using rather basic security controls. Malware played a role in 95% of the stolen data last year and hacking (obtaining access illegally) was an issue with 81% of all breaches and 99% of the records. There is also direct evidence that, while important, anti-malware alone isn’t as effective as it once was. Obviously, addressing these attack vectors with a defense in depth approach reduces an enormous amount of risk to your organization.

If we look at the data from the most recent Microsoft Security Intelligence Report, we see that more than 93 percent of malware required user interaction, the ability to abuse AutoRun, or leveraged known, but patched vulnerabilities. These are items that can be mitigated solely by configuring your systems correctly. Additionally, the Australian Government’s Defence Signals Directorate released it’s top 35 mitigation strategies, the top 4 of which are configuration items that would have prevented more than 85 percent of the intrusions they observed, and the Center for Internet Security has shared it’s top 10 tips to help secure your information.

There is a ton of great information in these three resources, but it can seem overwhelming. To help, we’ve boiled the information down and combined it with our own experience, as well as what we’ve heard from many of you. To address these and other security concerns, we have come up with four controls that you can use to significantly reduce your risk. It’s important to note that configuring these controls is a great first step, but on-going assurance is critical to keeping the computers in your organization protected. The great news is that now you can deploy these controls and monitor them for on-going compliance using System Center 2012 Configuration Manager and our free Security Compliance Manager Solution Accelerator.

Patch your OS

The computers in your organization are only as secure as your least-patched system. I am sure that you are tired of hearing how important patching is. I remember how painful it was when I managed thousands of desktops and servers. That doesn’t eliminate the fact that it’s one of the most significant things that you can do to successfully reduce attacks on your clients and servers.

Luckily, Configuration Manager makes this easier than ever before, taking advantage of features like Automatic Deployment Rules to automate the monthly process as well as the new Software Center interface that lets users better control their update experience. For a detailed walkthrough of these features, check out Jason Githens blog on managing updates with Configuration Manager 2012.

Update your applications & 3^rd party add-ons

Secunia reports that in 2011 79 percent of all vulnerabilities reported were identified in non-Microsoft products. Amazingly patches were available for 72 percent of these vulnerabilities at the time they were disclosed. The 50 most common applications deployed are from 12 different vendors. To effectively patch them, you need to learn a variety of additional technologies.

System Center 2012 Configuration Manager provides several mechanisms to help here. The free System Center Updates Publisher tool provides a streamlined way to inject patch catalogs from other vendors (such as Adobe) into Configuration Manager and it also allows for you to create your own. There are also a variety of other add-on tools which provide even deeper application patching for other applications. One example is System Center Alliance partner- Eminentware, which delivers a terrific set of capabilities on top of Configuration Manager.

When we talk about patching and updating, don’t forget to update your anti-malware signatures. System Center 2012 Endpoint Protection is now deeply integrated into Configuration Manager as part of our evolving management and security strategy. Endpoint Protection in Configuration Manager provides deep protection through signature-based scans, behavior monitoring, vulnerability shielding, Windows Firewall management, and event-driven malware analysis and signature delivery through the Microsoft Active Protection Service.

Restrict the use of administrator accounts

According to BeyondTrust, running without admin rights would have eliminated 81 percent of critical vulnerabilities in 2010. I don’t want to oversimplify this challenge, but we’ve worked hard to eliminate some of the more common issues blocking the use of least privileged user accounts. There are still some edge cases that require administrative rights like installing some local devices or installing new software. However, Windows 7 and Windows Server 2008 R2 provide many new features that make this a much more appetizing option.

Installation challenges can be mitigated by deploying your applications using Configuration Manager, but there are some legacy applications that may have run-time issues. In those cases, the use of Microsoft Application Virtualization (App-V) is a great solution that is designed to help. Check out Aaron Margosis’ blog for some great tips on running applications without admin privileges, and a fantastic tool called LUA Buglight that you can use to help identify admin-permissions issues in desktop applications.

Remember the following key issues. The best security solution is to run as a standard user. The next best scenario is to run as a standard user but with access to a local administrator account on the computer when you need to escalate privilege. It is significantly less secure to perform routine tasks with administrator privileges and you should always avoid using a domain administrator account for any day-to day operational tasks.

Harden your OS

Microsoft leads the industry in working with government agencies, customers, and partners to produce security hardening standards and security guides for many of our products. These can be found in our Security Compliance Manager (SCM) tool. You can use SCM to create Group Policy Objects (GPOs) to quickly configure your systems or Configuration Manager DCM configuration packs to monitor your clients for compliance with these standards.

The configuration baselines available in SCM include pre-configured recommendations for both workstations and servers. They address hundreds of the most significant controls such as passwords, firewall and network configuration, encryption, and logging. The configuration baselines are designed to meet the requirements of hundreds of regulations and standards worldwide.

In addition, system hardening includes the use of whitelists and exclusion lists. AppLocker is an evolution of the Software Restriction Policies functionality in Windows Server 2008 R2 and Windows 7 that uses the concept of signed applications to greatly simplify this process. Microsoft and many other vendors sign our applications so that they can be allowed to run based on a simple ruleset. We encourage all organizations to self-sign their own internally developed applications to take advantage of this functionality.

We do recognize that organizations can have thousands of applications so AppLocker includes an audit-only mode that you can deploy on a cross-section of your systems to monitor how the rules might have impacted production systems. It’s no small challenge, but AppLocker can provide an important piece of your overall security management solution.

Call to action:

The Microsoft Solution Accelerator team has released a set of additional baselines for our free Security Compliance Manager (SCM) tool that adds new checks to quickly monitor patch status, identify changes to the administrators group, and report on the use of whitelists using the desired configuration management feature in Configuration Manager. Here’s a quick screenshot of these checks in SCM:

Using these capabilities in conjunction with the traditional baselines provides a robust solution to monitor these key security controls. Here’s what we recommend for next steps:

Download the evaluation version of System Center 2012 Configuration Manager if you don’t already have it installed. Evaluate the patch deployment, software deployment, endpoint protection, and compliance monitoring features that it provides.

Try running as non-admin again. Evaluate Microsoft Application Virtualization (App-V) for the older applications that may still not work under least privilege.

Download Security Compliance Manager (SCM) and customize a configuration baseline. Then export a DCM pack and use Configuration Manager to start monitoring your systems for compliance.

A well-managed environment pays dividends, and not only in increased security. Even mitigating one attack can save your organization hundreds of thousands of dollars and keep you out of next year’s Data Breach report!

Change the Device, Keep Your Experience

Stephen L Rose — Wed, 04 Apr 2012 17:04:52 GMT

This morning on the Windows for your Business blog, we announced a new Desktop Virtualization product called Microsoft User Experience Virtualization (UE-V), which will be available via the Microsoft Desktop Optimization Pack (MDOP) once it’s complete. The central idea of UE-V is to enable users to keep their Windows and application experience regardless of what device they use to access Windows and their apps. We have heard from many of you that your users have multiple devices to access their corporate applications and content. To support this, we are seeing organizations adopting desktop virtualization technologies, including Microsoft Application Virtualization (App-V), RDS session-based desktops, and Virtual Desktop Infrastructure (VDI).

So what do we mean by “experience”? Think about how you use Windows and productivity applications. If you’re like most users, you have configured specific options just the way you like them – from toolbars that are turned on or off, to font size preferences, or how often autosave kicks in. This is your personalized experience. In the many conversations I’ve had with organizations addressing consumerization, IT Professionals have expressed the challenge of delivering a consistent look and feel to desktops and applications when their users access their experience from more than one delivery method or device.

Let’s consider a scenario to illustrate this problem. You have a user named Jill in the finance department of your organization. She does not travel much and works from the same desk every day using a desktop computer where all of her applications are installed locally. Like most users she rarely logs off her machine and locks it every night when she leaves. She has spent some time configuring Windows 7 and her applications just the way she likes them to help her be productive.

Every few months, Jill travels to another office to participate in budget planning meetings. For these trips, IT temporally grants her access to a RDS session based desktop. In this delivery model, IT takes advantage of App-V to get better scale per RDS server. Jill doesn’t realize this because her applications just work. Each time Jill uses the RDS desktop, she has to reconfigure her applications and desktop experience. This is because the experience does not roam between Windows 7 and Windows Server 2008 R2, and the different application delivery methods used.

With UE-V deployed in the company, Jill would not have to do this. She would no longer need to reconfigure the OS and applications when she went to the other office. UE-V can automatically keep her Windows 7 experience from her desktop – even the background picture of her family – and roam them to her virtual RDS desktop. UE-V also does this for her applications by including items she has configured in Word 2010, like the quick access toolbar, or the database server her line of business application needs to connect to in order to work properly. The other great benefit is that although IT chose to use virtual apps in the RDS session, it doesn’t impact Jill’s experience. UE-V seamlessly moves the personalized settings between traditional and virtual applications.

Another great feature of UE-V is when we capture and load the experience information. Compared to traditional roaming solutions that only capture the experience at login and logoff, UE-V uses additional triggers to capture and load the experience, reducing delays. For applications, we use the trigger of opening the application to apply the experience and then closing the same program to gather it. This way, if you make any changes to the look and feel of the app, we quickly roam this to another instance of the application. This also means that we can decrease the Windows login time compared to other roaming settings solutions since all we need to load at login is just the Windows experience. For the operating system triggers, we use login and log off, screen lock and unlock and RDS session connect and disconnect.

Jill gets her great experience, but what does IT have to do to roam the experience for the application and OS? At a high level, IT needs to deploy the UE-V agent to all the machines (physical or virtual) that they want to enable roaming on. UE-V also needs a settings location template for each roaming application. These XML-based templates are used to tell the agent what applications should have their experience roamed, and where in the file system and registry the settings are stored. In the beta release of UE-V, we provide settings location templates for Windows 7, Windows 8 Consumer Preview, and the Microsoft Office 2010 suite. If IT needs to support more applications, they can create their own templates using the UE-V Generator. The UE-V Generator is a wizard-based tool that automates the creation of the settings location template. All the IT Pro has to do is point the tool to the executable for the application, watch the application open (so that it can read and write settings to file system and registry), close out of the application, and choose the locations they want to add to the template.

This last step where the UE-V Generator shows you where an application writes and reads from in the file system and registry is crucial. These locations are split up into two groups: standard and nonstandard locations. Standard locations are areas on the machine where you would typically find settings written to, like C:\users\jill\appdata\roaming or HKCU\Software\Microsoft. Nonstandard locations are places where an application might write if it assumes you have administrative rights, like C:\Windows or HKLM location in the registry. By default, the UE-V Generator will assume that you want to roam all the standard locations but none of the nonstandard locations. You should review both sets of locations and decide which locations you do or don’t want to roam.

Here is a quick screenshot of what the review process looks like in the UE-V Generator:

Another important task is helping users rollback settings to a known “good” point, an issue we hear about often from IT Pros. Sometimes users change settings that they don’t mean to. For example, they accidently drag and drop a toolbar to a new location and don’t know how they did it. The user typically calls the help desk to get it fixed. Sometimes the help desk does not know the application well enough to fix this and the only solution is to delete the user’s profile and have them reconfigure every application, instead of just the one they need help with. With UE-V, the help desk does not need to do this. Now they can roll back the application’s experience to when UE-V first saw that application launch and get the user back up and running. All other application and OS experience information is not touched.

Beyond the agent, the settings location template, and the UE-V Generator, there is one other piece needed to roam Jill’s experience: a remote location to sync the experience information. This information is stored in a settings package that is synced from the machine to a file share on the corporate network. The file share can be the users’ home drive mapped in Active Directory or another location that is configured on agent install or through group policy. If disconnected from the corporate network, the settings packages are cached on the local machine and any changes will be synced when connectivity to the share is restored.

The last thing I want to discuss is how UE-V integrates and scales, leveraging your investments in existing tools. A software distribution system like System Center Configuration Manager or group policy can be used to deploy the UE-V agent and settings location templates. If you plan on using System Center Configuration Manager 2012, we will release a desired configuration management (DCM) pack to help you keep the agent configuration consistent across the organization. UE-V also heavily leverages Windows PowerShell, so all the knowledge you have in creating PowerShell scripts to automate tasks can be utilized. As I mentioned earlier, UE-V also works with the Microsoft Desktop Virtualization products like RDS, VDI and App-V, so that there is nothing to configure in these products to make them work seamlessly with UE-V. All the logic happens inside the UE-V agent.

UE-V will be available in a future version of MDOP, but the beta is available for you to download and evaluate how it can help you deliver a consistent experience for your users. The UE-V Beta can be downloaded here (Windows Live ID required). You can also watch a short overview video about UE-V on the MDOP Video Zone on the Springboard Series on TechNet.

Security Compliance Manager 2.5 Now Available

Stephen L Rose — Tue, 03 Apr 2012 22:41:43 GMT

Ready to automate the compliance management of your desktop, virtualized, and private cloud environments? Then check out Security Compliance Manager 2.5 (SCM 2.5) which is now available for download. SCM 2.5 is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage both desktops and servers using Group Policy and Microsoft System Center Configuration Manager.

Key Features Include:

SCM 2.5 includes Windows and Office client product baselines that deliver on Computer, Domain, and User scenarios.
SCM 2.5 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft security guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.
Additional SCM 2.5 client product baselines are included in the download, including Windows 7 SP1, Windows Vista SP2, Windows XP SP3, Office 2010 SP1, Exchange Server 2010 and Internet Explorer 8.
Gold master support which enables you to be able to create a snapshot of a reference machine or import an existing Group Policy to quickly build Configuration Manager DCM packs.
The ability to Configure stand-alone machines and deploy your configurations to non-domain joined computers using the new GPO Pack feature.
Customize and deploy one of the 64 pre-built DCM packs or group policies that cover multiple operating systems, server workloads and client applications.
Take advantage of the deep security expertise and best practices in the updated security guides, and the attack surface reference workbooks to help reduce the security risks that you consider to be the most important.
SCM configuration baselines are integrated into the System Center 2012 Service Manager Process Pack for IT GRC to provide oversight and auditor-ready reporting of your compliance activities.

Next steps:

Download SCM 2.5 from the Microsoft Download Center
Help spread the word: tell your friends about Security Compliance Manager 2.5.
Thoughts? Favorite features? Feedback? Tell it to the dev team.
Want more information on a specific feature? Feel free to contact Venkat Ganti on the Solutions Accelerators team.
Learn more about all the Solutions Accelerator tools on the Springboard Series on TechNet.

Microsoft DaRT 8 Beta Q&A

Stephen L Rose — Wed, 28 Mar 2012 17:02:49 GMT

This week I had a chance to sit down with Craig Ashley, product manager for Microsoft’s Diagnostics and Recovery Toolset (DaRT), to discuss the next release of the toolset and the public beta that is now available.

DaRT has been a favorite tool for many IT pros, dating back to its days as part of Winternals Admin Pack. As a quick review, the taoolset can help IT professionals reduce the challenges associated with troubleshooting and repairing system failures on Windows-based desktops, saving time for both them and users. Administrators can easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all without leaving the office, making it much faster than the average time it takes to reimage a machine. When necessary, it can also quickly restore critical lost files. This helps make PCs safer to use, makes them easier and less expensive to manage, and keeps employees productive,.

For additional details on DaRT or other products within the Microsoft Desktop Optimization Pack, visit the MDOP Resource Zone on TechNet.

Stephen: Craig, thanks for taking time to chat with me. Let’s jump right in. Many IT Pros have been using DaRT for many years now. What’s new in DaRT 8 for them?

Craig: Absolutely Stephen. I am very excited to start talking about DaRT 8 and get users involved in our beta that is now available.

With regard to what will be new in DaRT 8, we chose to focus on two key investment areas: support for new software and hardware platforms, and improving the image creation process.

First, let’s start with the new software and hardware platforms supported by DaRT 8. If you have not heard the buzz around the technology world, there is a new version of Windows and Windows Server that will be available later this year. One key focus with DaRT 8 is compatibility with these two new versions, Windows 8 and Windows Server 8.

Additionally, we needed to look at supporting some new hardware requirements arriving in the upcoming months as well. The first is support for GUID Partition Tables, which allows tools like Disk Wipe, Disk Commander, File Restore, and Computer Management to work with GPT disks. The second is supporting the UEFI boot process, allowing users with UEFI machines to boot into DaRT.

Stephen: It is certainly important to be sure that we continue to make DaRT compatible with upcoming Windows platforms. The other investment area you mentioned was the image creation process. What is new there?

Craig: Right on Stephen. This may be one of the most exciting updates for DaRT 8 and incorporates a few new areas of functionality. The first is that the image creation wizard is now built on top of Windows PowerShell cmdlets. We have heard many times that the ability to use scripting for each of the image creation steps would provide additional extensibility and support for deployments of DaRT. While the previous versions of DaRT leveraged Deployment Image Servicing and Management (DISM) cmdlets for much of the image creation process, not all steps were covered. Therefore, to complete the process we rounded out the image creation process by creating four new DaRT cmdlets, providing end-to-end image creation via scripting. For beginning or novice scripters, the end result of utilizing the wizard the first time is the output of a script which can be repurposed for later use.

Cmdlet	Description
Mount-WindowsImage	Mount image from Windows 8 media
New-DartConfiguration	Create DaRT configuration object
Set-DartImage	Apply DaRT configuration to mounted image
Add-WindowsDriver	Add additional drivers to image
Copy-Item	Add additional files to image
Dismount-WindowsImage	Dismount image and save changes
Export-DartImage	Creates ISO file from WIM image file
Copy-DartImage	Burns ISO to CD/DVD or USB

Stephen: In addition to the use of PowerShell, what else is new with the Image Wizard?

Craig: Good question. While PowerShell provided the base for the new wizard, there is a bit of additional functionality we included on top of scripting. We have heard from users that at times DaRT requires additional steps or multiple machines for creating images or media types. DaRT 8 focuses on simplifying some of the areas.

For example, in DaRT 7, we supported the creation of DaRT images for USB media, but it required an additional tool that was not included in the box with DaRT. With the next version, we are including native support for USB media deployments.

Additionally, it will now be possible to create both 32- and 64-bit images from a single machine. In previous versions, users would be required to create 32-bit images from 32-bit machines, and the same was required for 64-bit images. With DaRT 8, users can select which one should be created during deployment, from a single machine.

Finally, through the DaRT image creation process, users will now be able to create both WIM and ISO output formats, depending on which is required for their image deployment plan.

Stephen: I believe a beta for the next version of DaRT is available. Two questions: Is this a public beta? And how can users get the beta bits?

Craig: You are absolutely correct, there is a beta version of DaRT currently available. It is a public beta available to everyone that completes the short beta questionnaire. We are very excited about this release and encourage everyone to download it and try it out by signing up and downloading the beta installer files from the DaRT 8 Connect site.

We are looking forward to hearing about beta experiences using the software in various environments. Please note, we are collecting feedback using surveys and the feedback form on these sites:

800 Days Until Windows XP End of Support

Stephen L Rose — Sat, 28 Jan 2012 15:42:57 GMT

It takes 18-24 months to plan for and deploy a new operating system. If you haven’t started planning to migrate your Windows XP PCs to a modern OS, or if your migration plan have stalled here are some great tools to help you.

First of all, start by downloading the Microsoft Deployment Toolkit (MDT). It removes the need for disc imaging, migrates your data in place during deployment, and (best of all) it’s free.

Some other tools to help make your move from Windows XP to Windows 7 easier include:

Automating the Migration from Windows XP to Windows 7 End-to-End
Migrating User Files and Settings from Windows XP to Windows 7
Windows XP to Windows 7 Migration Guide
Windows 7 Application Compatibility List for IT Professionals (check the Windows compatibility status of more than 27,000 applications)
Video: Windows XP to Windows 7 Migration Using Microsoft Deployment Toolkit 2010
Video: Migrating from Windows XP to Windows 7 Using the User State Migration Tool (USMT)
Need some help? Find support in the Windows 7 Installation, Setup, and Deployment forum.

Questions about Windows XP EOS and what it means to you and your company? Make sure to check out the End of Support website for Windows XP and Office 2003 and as always, visit the Deploy Zone on the Springboard Series on TechNet for all your Pilot, Deploy and Manage needs!

Security Compliance Manager 2.5 now available for beta download

Stephen L Rose — Wed, 25 Jan 2012 00:49:11 GMT

Back in October I did a blog post on Security Compliance Manager 2. We are now excited to share that the latest version 2.5 is now available for beta download!

For those not familiar with the Security Compliance Manager, SCM is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage your computers, traditional data center, and private cloud using Group Policy and Microsoft System Center Configuration Manager. In addition to Windows 7 SP1, Windows Vista SP2, Windows XP SP3, Office 2010 SP1, and Internet Explorer 8, SCM 2.5 now offer additional baselines for Exchange Server 2007 and Exchange Server 2010. Updated configuration baselines now include Windows 7 SP1, Windows Vista SP2, , Windows XP SP3, Microsoft Office 2010 SP1, and Internet Explorer 8.

SCM 2 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft security guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

Key Features Include:

Integration with the System Center 2012 IT GRC Process Pack for Service Manager—Beta: Product configurations are integrated into the IT GRC Process Management Packs to provide oversight and reporting of your compliance activities.
Gold master support: Import and take advantage of your existing Group Policy or create a snapshot of a reference machine to kick-start your project.
Configure stand-alone machines: Deploy your configurations to non-domain joined computers using the new GPO Pack feature.
Updated security guides: Take advantage of the deep security expertise and best practices in the updated security guides, and the attack surface reference workbooks to help reduce the security risks that you consider to be the most important.
Compare against industry best practices: Analyze your configurations against prebuilt baselines for the latest versions of Windows client and server operating systems, Microsoft Office applications, and Internet Explorer.

Next Steps:

Learn about SCM here.
Ready to download the Beta?

Existing Connect participants go here,
New Beta participants go here.

Have any thoughts? Want to discuss your favorite features? Have feedback to help us improve the product? Want more information on a specific feature? Interested in speaking with the development team? Please contact Venkat Ganti.

IE Auto Updates: Good News for Businesses Too

Stephen L Rose — Thu, 15 Dec 2011 13:06:00 GMT

As you may have seen on the Internet Explorer blog today, we have announced plans to begin automatic upgrade for the IE browser. This change will be rolled out initially to a limited audience, beginning in January for customers in Australia and Brazil, and then expanding gradually. We’re re-issuing the IE9 or IE8 Windows Update and removing the additional UI prompt so that it is installed without additional user interaction for a more seamless experience for the end user. The update will ship as a high-priority update for XP and Important class update for Vista and Windows 7. Once issued, this update will install Internet Explorer 8 for users on XP SP3 that are still using IE7 and IE6; users on Vista SP2 and Windows 7 RTM and SP1 will be moved to Internet Explorer 9.

Since, Internet Explorer is a browser for all Windows customers; the auto-upgrade mechanism is designed with Enterprise customers in mind as well. We understand that companies have business reasons to rely on a one specific version of the browser and they need support. The auto-upgrade mechanism doesn’t change the support lifecycle of the browser – an Internet Explorer version will continue to be supported until the underlying OS it ships on expires. This means that if you’ve taken a dependency on a particular version of Internet Explorer, the support for that version doesn’t end simply because of the introduction of the auto-upgrade mechanism.

The important point is that with Internet Explorer you still have the option of using a particular version. For most customers, no extra effort is needed to exercise this option. There are several reasons why, one is that this package will not be shipped via the WSUS and Microsoft update site catalog channel. If you’re using WSUS to manage windows update, you will not need to worry.

As I posted last Feb, Enterprises can still use the IE Blocker Tool and that fact has not changed. In fact, as you’ll see from the IE team’s blog, a big consideration for our auto upgrade is how we are balancing the needs of all our customers, including our business users. The IE9 Blocker Toolkit helps ensure that IE9 is introduced to PCs at the right time. This way you can still test any updates before they are pushed out to your users. For non-managed environments, this will improve safety and security of the browser experience as well as performance and standards compliance. Lastly, if some users are accidentally upgraded, it’s possible to roll back to previous version of Internet Explorer as well.

As I meet many IT pros during my Springboard Series Tours, I am amazed to hear how many of you still get complaints from end users that their machine is “slow.” We joke about users installing 5 different tools bars and the advantages of a standardized Windows environment but when we get into the details of it, many of you are surprised when we discuss the 1,400 security policies that you can use to standardize and lock down IE in your environments. No more multi-tools bars, no more extraneous or unsafe browser plugins, no more hijacked home pages or browsers adjusted to unsafe settings. IE is built for the Enterprise. From the Internet Explorer Administration Kit 9 (IEAK 9) to help you install IE easily into your environment to the ability to easily deliver Internet Explorer 9 through Automatic Updates

Need more information? Check out the Internet Explorer blog to learn more why you should consider Internet Explorer as your standard corporate browser. Want to learn more about the IEAK and IE Blocker tool? Check out the links below.

And of course check out the Springboard Series for Internet Explorer for more information, tips and tricks to help you manage Internet Explorer in your environment.

Microsoft Assessment and Planning Toolkit 6.5 – Now available for download!

Stephen L Rose — Tue, 06 Dec 2011 16:16:00 GMT

We are pleased to announce that the next version of the Microsoft Assessment and Planning (MAP) Toolkit—version 6.5—is now available for download.

The journey to the cloud is now smoother than ever with the Microsoft Assessment and Planning (MAP) Toolkit 6.5 Beta. The MAP Toolkit’s new capabilities help users to securely assess heterogeneous IT environments while enabling the evaluation of workloads for migration to Microsoft’s private and public cloud platforms. Consolidate existing server workloads using the updated Microsoft Private Cloud Fast Track capacity planning feature. The revamped Azure Migration capability in MAP 6.5 provides more in-depth analysis for migrating on-premises applications to the Windows Azure™ platform. Other significant new features in MAP 6.5 include the discovery of active Windows® devices, Software Usage Tracking for Forefront® Endpoint Protection (FEP), and the discovery of Oracle instances on Itanium-based servers with HP-UX to assist in the planning of migration to SQL Server®.

Key features and benefits of MAP 6.5 help you:

Plan your migration to new Microsoft technologies -Use the Microsoft Assessment and Planning Toolkit to inventory your IT environment and assess your hardware readiness for migration to Windows 7, Windows Server 2008 R2, Hyper-V, Microsoft Private Cloud Fast Track, Windows Azure and Microsoft Office 2010 and 365—in just a few hours. MAP automatically generates detailed reports on hardware, device, and application compatibility—information you can immediately put to work in your migration plans.
Determine readiness for migration to Windows 7 and Windows Internet Explorer 9 - Simplify your organization's migration to Windows 7 and Windows Internet Explorer 9 with MAP 6.5. The MAP Internet Explorer migration assessment—now updated for Internet Explorer 9 migration—inventories your environment and reports on deployed web browsers, Microsoft ActiveX controls, and add-ons, and then generates a migration assessment report and proposal for easier migration to Windows 7 and Internet Explorer 9.
Assess your client environment for Office 365 readiness -MAP 6.5 helps make your planning process easier and faster for business productivity solutions. MAP 6.5 includes an Office 365 client assessment that evaluates the compatibility of the Office suite software deployed in your environment. This assessment helps you quickly pinpoint the clients ready for upgrade to Office 365. The tool obtains machine-level details to determine the upgrade readiness and quickly identifies the compatibility of current Office suite software installed with Office 365
Accelerate planning for the private cloud with Microsoft Private Cloud Fast Track Onboarding- Planning your private cloud just got easier. Microsoft Private Cloud Fast Track Onboarding, an updated assessment available with MAP 6.5, provides consolidation guidance and validated configurations with preconfigured Microsoft Private Cloud Fast Track Infrastructures including computing power, network, and storage architectures. The updated feature provides more flexibility in planning private cloud migration by allowing users to customize computer powers and shared resources to accommodate workloads. Get a quick analysis of server consolidation on Microsoft Private Cloud Fast Track Infrastructures to help accelerate your planning of P2V migration to Microsoft Private Cloud Fast Track.
Identify migration opportunities with enhanced heterogeneous server environment inventory - MAP has expanded its heterogeneous server environment inventory to include VMware Server, VMware vSphere and VMware vCenter. Inventory and reporting on the number of servers and guests deployed and managed by VMware infrastructure helps you identify migration opportunities and accelerates the migration planning process. SQL Server, SharePoint Server and Exchange Server run better on Hyper-V, and MAP 6.5 has the capability of identifying Microsoft workloads deployed on VMware guests.
Assess your software usage and evaluate your licensing needs with the enhanced Software Usage Tracking feature, now updated with the Forefront Endpoint Protection (FEP) scenario - The enhanced Software Usage Tracking feature in MAP 6.5 simplifies your software license management and compliance process in terms of product coverage and the ability to track devices. The Forefront Endpoint Protection (FEP) scenario measures server and client usage for the FEP product, a recent addition to the Microsoft Core Client Access License (CAL) Suite. Active Devices is a new inventory scenario that allows organizations to report Windows devices that are active on the network. This information is useful in Enterprise Agreement scenarios as well as for maintaining Active Directory information for the environment. This strengthened tracking feature provides consistent software usage reports for key Microsoft server products: Forefront Endpoint Protection, Windows Server, SharePoint Server, System Center Configuration Manager, Exchange Server, and SQL Server. Run updated reports whenever you need to accurately assess current software usage and client access history in your environment. This reduces time and administrative costs for managing your server and CALs and helps you to streamline the management of your software assets.
Discover Oracle instances on Itanium-based servers for migration to SQL Server - MAP 6.5 adds to the heterogeneous database inventory and reporting capability with the discovery of Oracle instances on Itanium-based servers with HP-UX. The MAP Toolkit can help determine total cost of ownership for maintaining Oracle and the potential return on investment (ROI) from switching to SQL Server. MAP also allows users to discover, plan, and migrate to SQL Server. Along with reporting of the size and use of each schema, MAP provides an estimate of the complexity of migration and suggests candidates for migration to SQL Server. This heterogeneous database inventory and reporting capability will help you accelerate migration to SQL Server from MySQL, Oracle, and Sybase databases.
Accelerate planning and migration with new UI and usability updates in MAP 6.5 - MAP 6.5 offers an improved user interface (UI) and usability updates to accelerate your planning needs. The improved MAP scenario interface simplifies the assessment and planning process as users can clearly identify the sequence of next steps they must perform.
Simplify heterogeneous database management through the Database Consolidation Appliance - MAP 6.5 simplifies heterogeneous database consolidation planning and provides detailed analysis of SQL Server workloads and consolidation recommendations for migration to Database Consolidation Appliance. Using MAP, you can measure the current database workloads, estimate the capacity required for migrating to Database Consolidation Appliance, and take the next steps in the process. The Database Consolidation Appliance provides better agility through a fully elastic database infrastructure and allows you to consolidate thousands of SQL Server instances into a single appliance, saving operational and management costs.

MAP works with the Microsoft Deployment Toolkit and Security Compliance Manager to help you plan, securely deploy, and manage new Microsoft technologies—easier, faster, and at less cost. Learn more.

Next steps:

Download MAP 6.5!
Learn more about the MAP Toolkit.
Check out all the content to help you Pilot and Deploy Windows 7 on the Springboard Series on TechNet.
Send your questions or comments to the MAP Team.

The Springboard Series Final Stop… TechDays Chile

Stephen L Rose — Sat, 26 Nov 2011 23:23:25 GMT

Our final city stop was Santiago, Chile for TechDays. For those of you not familiar with TechDays, they are locally run events showcasing the best and brightest MVPs. Microsoft Employee and Evangelists and Developers sharing the knowledge and skill sets with local IT pros and developers.

We had a amazing time presenting to the packed house and seeing the amazing city of Santiago. Unfortunately, all good things must come to and end and does this Springboard Series tour. For those who attended, make sure to check out all the resources we discussed on the Springboard Series on TechNet! We had an amazing time and want to thank all the great IT pros who came out to meet us and we look forward to seeing all of you again in the future.

Watch as WMV

The Springboard Series Visits Argentina

Stephen L Rose — Tue, 22 Nov 2011 16:40:00 GMT

Our third stop on the tour takes us to Buenos Aires, Argentina. Here we presented Windows deployment techniques to over 100 decision makers, drove on the widest street in the world and of course, sampled the local delicacies. Our next and final stop is TechDays in Chile.

The Springboard Series Visits Lima, Peru

Stephen L Rose — Fri, 18 Nov 2011 13:27:37 GMT

Our second stop in South America was Lima, Peru. Day one we discussed the Proof Of Concept Jumpstart Kit with local companies currently testing their application compatibility and deployment strategies. Day two was a full day of presentations on embracing consumerization, leveraging free deployment tools like MDT, MAP and ACT and ended the day showing off the great features and functionality of Windows Intune. The day concluded with the Microsoft Peru office turning the event room into a gigantic viewing party for the big soccer match between Peru and Ecuador. We had a great time but we need to get to Argentina for our next event. Check out the video and see you in Buenos Aires!

Watch as WMV

The Springboard Series Tour Arrives in Brazil

Stephen L Rose — Mon, 14 Nov 2011 19:18:11 GMT

The first stop on the Springboard Series Tour was the city of Sao Paulo, Brazil. Sao Paulo is the 7th largest city in the world and filled with many IT pros. Myself and Elias Mereb, a MVP from Venezuela who is joining me for the tour, presented Windows Deployment, Windows Intune and Flexible Workstyle to over 150 local IT pros and decision makers. To see more on the event and this amazing city, check out the video below. Next stop, Lima, Peru!

Watch as WMV

Simplify Client Infrastructure Configuration Management With SCM 2

Stephen L Rose — Mon, 31 Oct 2011 14:42:13 GMT

We recently released Version 2 of the Microsoft Security Compliance Manager (SCM 2). Security Compliance Manager 2 is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage your desktops, traditional datacenter, and private cloud using Group Policy and Microsoft^® System Center Configuration Manager.

SCM 2 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

You can easily configure Windows operating systems, Microsoft Office applications, including Internet Explorer 9 with industry leading knowledge and fully supported tools.

Now with SCM2, you can import the configuration of a “golden master” reference machine or existing Group Policy. Compare your standards to industry best practices, customize them using rich knowledge, and seamlessly create new policies and DCM configuration packs in the user-friendly UI designed to work with System Center Configuration Manager 2007 R2.

Key Features of SCM 2 Include:

Gold master support: Import and take advantage of your existing Group Policy or create a snapshot of a reference machine to kick-start your project.
Configure stand-alone machines: Deploy your configurations to non-domain joined computers using the new GPO Pack feature.
Updated security guides: Take advantage of the deep security expertise and best practices in the updated security guides, and the attack surface reference workbooks to help reduce the security risks that you consider to be the most important.
Compare against industry best practices: Analyze your configurations against prebuilt baselines for the latest Windows client and server operating systems.

Next steps:

Download SCM 2
Learn more about Security Compliance Manager 2
Thoughts? Favorite features? Feedback? Contact the SCM team.

Solving Business Problems with App-V and MED-V

Stephen L Rose — Fri, 28 Oct 2011 14:21:18 GMT

Today’s post comes to us from David Trupkin, Sr Product Manager for App-V and MED-V

One of the ways I can tell it’s going to be a good day at work is when I look at my calendar in the morning and see that I’ve got some sort of IT Pro related activity on my schedule. As the product manager for Microsoft Application Virtualization (App-V) and Microsoft Enterprise Desktop Virtualization (MED-V), I find your feedback particularly valuable. Considering my own background as an IT Pro, I enjoy helping you solve business problems.

A recurring message I hear from the community is that you want choice. If you’re responsible for desktop or application deployment in your organization, it’s likely that you have some sort of infrastructure in place dedicated to this task. It may be Microsoft infrastructure such as the Microsoft Deployment Toolkit (MDT) 2010 or System Center Configuration Manager 2007, or it may be a third party tool. Many of you have told me you want to use these systems to deploy and manage App-V and MED-V, but didn’t think it was possible. I’ve even seen third party information that implies that you absolutely must use a dedicated App-V Management Server before you can use App-V in your environment. The truth is that App-V and MED-V work with your existing management systems – no dedicated infrastructure required!

Today we’ve posted a new video series for App-V and MED-V that will help you get started. The first videos are about App-V. If you’re using MDT 2010, have a look at Deploying App-V with the Microsoft Deployment Toolkit. If you’re using System Center Configuration Manager, you’ll want to review Deploying App-V with System Center Configuration Manager. If you want deeper, hands-on experience with App-V and System Center Configuration Manager, you can review the TechNet Hands-on Lab.

Of course, if you’d like to use the App-V Management Server, we have you covered. This new video will step you through the process of Setting up the App-V Management Server on Windows Server 2008 R2.

The next set of videos covers MED-V. MED-V 2.0 eschews dedicated server infrastructure, allowing you to manage its application compatibility workspaces just as you would any other Windows endpoint in your environment. You can Deploy MED-V Workspace Packages with the Microsoft Deployment Toolkit, or Deploy MED-V Workspace Packages with System Center Configuration Manager. For deeper technical information on deploying MED-V 2.0 the new whitepaper, Deployment Guidance for Microsoft Enterprise Desktop Virtualization 2.0 (I know, who thinks up the titles for these things?), is just what you’re looking for.

Thank you for all of your valuable feedback, and please keep it coming! I look forward to meeting you at events in the coming year. Please visit the Desktop Virtualization zone on Springboard, and the App-V TechCenter for more information on App-V and MED-V.