Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Windows 7 And Windows Server 2008 R2 Combined Value
1. Windows 7 and Windows Server 2008 R2 Combined Value Amit Gatenyo Infrastructure & Security Manager, Dario Microsoft Regional Director – Windows Server & Security 054-2492499 Amit.g@dario.co.il Udi Leutashi Solutions Architect Dario IT Solutions 054-9700781 Udi.l@dario.co.il
2. Information Workers’ World Has Been Changing CENTRAL OFFICE BRANCH OFFICES REMOTE WORK MOBILE & DISTRIBUTED WORKFORCE
3. The Evolving Needs of Organizations IT Professional needs: Secure and flexible infrastructure for“work anywhere” Reduce costs Mobile & Remote Work-Force needs: Work anywhere Fast access
5. Remote Access for Mobile Workers Make Users Productive Anywhere Windows Server 2008 R2 and Windows 7 Solution Situation Today Direct Access ™ Home Office Home Office Difficult for users to access corporate resources from outside the office Challenging for IT to manage, update, patch mobile PCs while disconnected from company network New network paradigm enables same experience inside & outside the office Seamless access to network resources increases productivity of mobile users Infrastructure investments also make it easy to service mobile PCs anddistribute updates and polices
6. DirectAccess™ IPv4 Devices IPv6 Devices Support IPv4 via 6to4 transition services or NAT-PT IT desktop management DirectAccess provides transparent, secured access to intranet resources without a VPN Allows desktop management of DirectAccess clients Native IPv6 with IPSec AD Group Policy, NAP, software updates IPv6 Transition Services Supports direct connectivity to IPv6-based intranet resources DirectAccess Server Internet Supports variety of remote network protocols Allows IPSec encryption and authentication Windows 7 Client
7. IT Pro Benefits Improved manageability of remote users IT simplification and cost reduction Consistent security for all access scenarios Seamless & secure access to corporate resources Consistent connectivity experience in / out office Combined with other Windows 7 features enhances the end to end IW experience DirectAccess Benefits End User Benefits
8. BranchCache™ Windows 7 Solution Caches content downloaded from file and Web servers Users in the branch can quickly open files stored in the cache Frees up network bandwidth for other uses Technical Details Authenticates current state of data and access rights of the user against the server Supports commonly used protocols: HTTP(S), SMB Support network security protocols (SSL, IPsec) Requires Windows Server 2008 R2 in the data center and hosted cache
12. Network Access Protection Today’s Challenges Unprotected Network Taps Within An Organization’s Buildings Administrators Have Limited Control About Health Of Systems Joining Network Result: Hardware/Network Upgrades And Increased Operational Costs, Reduced Productivity Solution – End-to-End, Authenticated, Tamper-resistant Communication Improved Isolation Using IPsec Network Access Protection Across IPsec, 802.1X, DHCP, VPN Increased Manageability
13. Remediation Servers Example: Patch Corporate Network Network Access Protection Policy Servers such as: Patch, AV 3 1 2 Not policy compliant 4 DHCP, VPN Switch/Router Windows Client Restricted Network NPS Policy compliant 5 If not policy compliant, client is put in a restricted VLAN and given access to fix up resources to download patches, configurations, signatures (Repeat 1-4) DHCP, VPN or Switch/Router relays health status to Microsoft Network Policy Server (RADIUS) Network Policy Server (NPS) validates against IT-defined health policy If policy compliant, client is granted full access to corporate network Client requests access to network and presents current health state 2 3 4 5 1
14. Business and Technical Benefits Reduce the risk of network security threats An additional layer of defense-in-depth Reduced attack surface area Increased manageability and more healthy clients Safeguard sensitive data and intellectual property Authenticated, end-to-end network communications Scalable, tiered access to trusted networked resources Protect the confidentiality and integrity of data Extend the value of existing investments No additional hardware or software required Get more value from Active Directory and Group Policy Complements existing 3rd network security solutions
15. Software Control via AppLocker Windows Server 2008 R2 and Windows 7 Solution Situation Today AppLocker™ Eliminate unwanted/unknown applications in your network Enforce application standardization within your organization Easily create and manage flexible rules using Group Policy Users can install and run unapproved applications Even standard users can install some types of software Unauthorized applications may: Introduce malware Increase helpdesk calls Reduce user productivity Undermine compliance efforts
17. EncryptionEnhance Security & Control Windows Server 2008 R2 and Windows 7 Solution Situation Today BitLocker ToGo™ + Worldwide Shipments (000s) Protect data on internaland removable drives Mandate the use of encryption with Group Policies Store recovery information inActive Directory for manageability Simplify BitLocker setup and configuration of primary hard drive
20. Remote Desktop Services Architecture RD Web Access RD Session Host RD Client RD Virtualization Host RD Connection Broker RD Gateway Licensing Server Active Directory®
21. Remote Desktop Services Architecture User - Personal VM assignment RDVH (Hyper-V) AD VHD VHD Pooled VMs Assignment RDV Agent VHD VHD Retrieve List of Remote apps / sessions RemoteApp RD Connection Broker Session Desktop RDSH RD Web Access RD Gateway RDP over HTTPS HTTPS Win7: RemoteApp & Desktop Connections RD Client MSTSC XP / Vista: IE
22. RDP over HTTPS Udi Leutashi Solutions Architect Dario IT Solutions 054-9700781 Udi.l@dario.co.il
23. Make programs available via RD Web Access or RemoteApp & Desktop Connection (Windows 7) Create MSI or RDP files RemoteApp Overview Applications launched from Web Page, RDP files or MSI shortcuts Programs look like they are running locally NEW in R2: Per-user RemoteApp filtering RD Client RD Session Host / RD Virtualization Host
24. RDS User Experience Enhancements Multiple Monitor Support Enhanced Audio Support Windows Media Redirection Windows Aero Glass Support Enhanced Bitmap Acceleration
25. Published Applications Udi Leutashi Solutions Architect Dario IT Solutions 054-9700781 Udi.l@dario.co.il
27. Summary Remote connectivity via DirectAccess BranchCache Read-Only DFS More efficient client power management Desktop and applications virtualization feeds Agile VPN AppLocker BitLocker encryption on removable drives
28. Thanks for listening! Amit Gatenyo Infrastructure & Security Manager, Dario Microsoft Regional Director – Windows Server & Security 054-2492499 Amit.g@dario.co.il Udi Leutashi Solutions Architect Dario IT Solutions 054-9700781 Udi.l@dario.co.il
Editor's Notes
One of the goals of Windows 7 is to enable users to access the information that they need whether they are in or out of the office. In the past few years, Microsoft has made getting to email from outside the office easier. First we had Outlook Web Access, so we could access email through the web. Then we introduced RPC over HTTP, which just requires and internet connection to connect to the Exchange server.But users still have a challenge when accessing resources that are inside the corporate network. For example users cannot open the links to an internal Web site or share included in an email. The most common method to access these resources is VPN. VPN can be hard to use for users because it takes time and multiple steps to initiate the VPN connection and wait for the PC to be authenticated from the network. Hence, most remote users try to avoid VPN’ing as much as possible and stay disconnected from corporate network for as long as they can. At this point we run into a chicken-egg problem: Since remote users are disconnected, IT cannot manage them while away from work – remote users stay more out of date and it gets harder and harder to access corporate resources… With the capabilities Windows 7 enables, users who have internet access will be automatically connected to their corporate network. A user who is sitting on a coffee shop can open his laptop, connect to the internet using the wireless access of the coffee shop and start working as if he is in the office. The user in this case will be able to not only use outlook, but also work with intranet sites, open corporate shares, use LOB applications, and basically have full access to corporate resources. This solution is also very appealing to IT Professionals:Managing mobile PCs has always been an issue since they could be disconnected from the corporate network for a long time. With this work access solution, as long as they have internet connectivity, users will be on corporate network. Servicing mobile users (such as distributing updates and Group Policy) is easier since they can be accessed more frequently by IT systems.Deploying Windows 7 will not automatically enable this type of work access connection. You will have the choice to enable it or not and it will require some changes to your backend network infrastructure, including having at least one server running Windows Server 2008 R2 at the edge of your network. The solution takes advantage of Microsoft’s investments in IPSEC and IPv6 to provide secure connectivity even when not on the physical corporate network.
The first is a peer-to-peer model known as Distributed Mode. In this scenario, content is cached at the branch on client computers running Windows 7. To enable distributed mode, each Windows 7 client maintains a cache of the content it has retrieved, and then makes this content available to other clients when they send out requests. The content is only provided if the requestor was authorized by the server at the data center, so authentication and access right security is maintained. As a result, this feature reduces WAN traffic, since cached data gets served locally with the additional side benefit of improving application responsiveness.The disadvantage to this solution is that content is cached on client computers, so if the computer containing the cached content is unavailable, the content must be retrieved over the WAN connection again.
In the Server scenario also known as hosted caching, content is cached at the branch on a server running Windows Server 2008 R2. The advantage to this solution is that the server is always available, so the cached content is always available. The unavailability of any client computer running Windows 7 does not affect the availability of the content cache, or require content to be retrieved over the WAN link again.How it works:The client computer running Window 7 requests information that resides in another location across a WAN network segment.The client computer contacts the computer hosting the information in the other location.The computer hosting the information returns a set of hashes to the client computer.The client computer sends out a request on the local network for any local cached copies of the file by using the hashes retrieved from the computer hosting the information.If the content is on the Hosted Branch Cache server, the Hosted Branch Cache server responds and the client retrieves the content from the local cache.If the content is not on the Hosted Branch Cache server, the Hosted Branch Cache server retrieves the content, caches the content, and the client retrieves the content from the local cache.Subsequent requests for the same content are retrieved from the local cache.
Title: Network Access ProtectionTalking Points: Let’s discuss more in-depth in how Network Access Protection works.Enterprises are constantly being challenged by viruses that invade system because of guests plugging in, employees connecting with VPN, and the everyday attacks on vulnerable computers in the network. In response to viruses and other threats, IT administrators are always on the lookout for tools to detect and manage threats, establish health policies, and require baseline compliance, keep the network resilient, remediate vulnerabilities, and manage the policy enforcement and remediation systems. What is Network Access Protection: One of the most time-consuming challenges that administrators face is ensuring that computers that connect to the private network meet health policy requirements. Network Access Protection for Windows Server 2008 and Windows Vista helps administrators enforce compliance with health policies for network access or communication. Developers and administrators can create solutions for validating computers that connect to their networks, can provide needed updates or access to needed resources—called health update resources—and can limit the access of noncompliant computers. Network Access Protection does not prevent an authorized user with a compliant computer from uploading a malicious program to the network or performing some other inappropriate task.Network Access Protection for Windows Server 2008 helps administrators enforce compliance with health policies for network access or communication. Network Access Protection verifies that all communications are authenticated, authorized and healthy. Administrators can use NAP for DHCP, VPN, IPsec, and 802.1x to set the security level that meets the needs of their organization. IT Professionals can set policy-based access controls to define access to their systems.Cisco and Microsoft Integration Story: Cisco and Microsoft worked on a joint architecture for NAC-NAP Interoperability. The new security architecture will enable customers and partners to deploy interoperable Cisco Network Admission Control and Microsoft Network Access Protection.In addition, the two companies have revealed a general road map for bringing Cisco NAC and Microsoft NAP interoperability to market, including a limited beta program set to start later in calendar year 2007. Customers will be able to start deploying the Cisco NAC-Microsoft NAP interoperable solution once Windows Server 2008 is available. Cisco and Microsoft have cross-licensed the Cisco NAC and Microsoft NAP protocols to help ensure interoperability and to enable both companies to respond to future market and customer requirements.Network Access Protection works with agents in the Windows XP SP2 or Windows Vista client operating systems. The client environment includes the System Health Agents (SHAs), a Quarantine Agent (QA) and an Enforcement Client (EC). The Secure Hash Algorithm (SHA) checks the state of a client and declares its health. Each SHA is defined for a system health requirement or a set of system health requirements. For example, there might be an SHA for antivirus signatures and an SHA for operating system updates.[BUILD1] Try to Connect to a Network: When a Windows client computer connects though DHCP, a VPN, or a router, the computer’s health state is validated against the health policies as defined by the administrator. [BUILD2] System Health Agent: The access device then forwards the network access request on to the NPS. The NPS includes the System Health Validator (SHV) and the Quarantine Server (QS). The QS coordinates the SHVs which certify declarations made by health agents.Active Directory stores user and computer accounts and their network access properties for authenticated network access. The NPS itself does not make the authentication decision, but evaluates the connection and then forwards the credentials on to Active Directory.[BUILD3] Remediation Server: If a computer is not compliant, it is sent to a restricted network, where the remediation servers can apply security updates or whatever else is needed to enable compliance. Remediation servers consist of servers, services, or other resources that a noncompliant computer on the restricted network can access. These resources might store the most recent software updates or components needed to make the computer comply with health requirements. For example, a secondary DNS server, an antivirus signature file server, and a software update server could all be remediation servers. Administrators can help ensure compliance with health policies by choosing to automatically update noncompliant computers with the missing requirements through management software, such as Microsoft Systems Management Server. Computers that do not comply with health policies may have limited access until the software and configuration updates are completed. Again, computers that are compatible with Network Access Protection can automatically become compliant and the administrator can define policy exceptions.[BUILD4] Computer that meets Health Policy: If a client is compliant, then the system is given access to the corporate network. Additional Information:Changes in Functionality to Windows Server Longhorn (January 2007).doc (also called the Book of Longhorn) www.microsoft.com/technet/Add-301.ppt , Add-302.pptwww.microsoft.com/presspass/events/ssc/docs/CiscoMSNACWP.pdfhttp://www.microsoft.com/presspass/press/2006/sep06/09-06SecStandardNACNAPPR.mspx
If you would like to host your demo on the Virtual Server, please use the myVPC demo slide, not this slide.
[Build 1] – The following slide provides a high level overview of the components in RDS. We will look at the new RDSH and RDVH technologies in depth later on.Remote Desktop Session Host Server provides a similar set of functionality as Terminal Server.RD Virtual Host Server is a hyper-v based server that is used to provide VDI functions.RemoteApp and Desktop Web Access Server provides a web based interface for RemoteApp enabled applications as well as one click access to virtual desktops. Highlight that you need Windows 7 on the client to take full advantage of Desktop Connections.RD Gateway to offer secure remote access to RDS servers and infrastructureAll components require an RDS licensing serverPermissions and policy is stored in Active Directory[Build 2]Remote Desktop Client gets connection information from the RD Web Access Server. If the client is outside the network the client connects through the RD Gateway server, if they are internal then can connect directly to an RDSH or RDVH server. In both cases the server that the client connects to is negotiated by the RD connection Broker. The connection broker plays a central role in RDS to make sure clients get connected to appropriate resources. It also helps clients reconnect to disconnected or interrupted session, and makes sure that clients are connecting to the correct servers for VDI resources. At a high level the remote client uses the RD Gateway to obtain access to the RDSH RD Session Host and RDVH servers.The RD Connection Broker connects clients to sessions and VMs on the RDSH and RDVH servers.All Remote Desktop Servers require validation with an RD Licensing Server.
Publishing Server:Implemented in the RD Connection Broker role serviceCommunicates with RemoteApp servers, as well as its own configuration to create a list of available objects Personal desktop Pooled desktop ApplicationPublishes this information via RD Web Access to:- Traditional web site (or Sharepoint site)- RemoteApp & Desktop Connections (Web feeds)Connection Broker Configuration- Remote Desktop Users:Users who will enumerate objects Session Broker Computers:Computers which have resources Web Access Administrators:Users who can configure the web partWeb Access Computers:Computers which run Web Access (local computer)
If you would like to host your demo on the Virtual Server, please use the myVPC demo slide, not this slide.
The RDS client has been enhanced to support rich multimedia and provide a more seamless end user experience. In the next section will take a look at how these enhancements improve the user experience and provide a full fidelity desktop. have been easily & seamlessly control the language setting (e.g. right to left) for RemoteApp programs using the local language bar.
If you would like to host your demo on the Virtual Server, please use the myVPC demo slide, not this slide.
Windows Server 2008 R2 has many features that are designed to specifically work with client computers running Windows 7. The features that are only available with running Windows 7 client computers with server computers running Windows Server 2008 R2 include: Simplified remote connectivity for corporate computers by using the Direct Access feature. (next slides) Improved performance for branch offices by using the Branch Caching feature. (a little further down) More efficient power management by using the new power management Group Policy settings for Windows 7 clients. Improved virtualized presentation integration by using the new desktop and application feeds feature. This allows TS/VDI administrators to construct centrally managed virtualized desktop and application resources, then assign those resources to users who subscribe to them in a ‘feed’ paradigm. Subscribing to a feed means you’re constantly updated when IT updates or manages the resource. For most users, this will also be invisible as Windows 7 integrates virtual applications in the same way it does locally installed apps.AD’s new GPOs also enhance security with the new BitLocker to Go feature which not only allows Windows 7 users to extend BitLocker encryption to portable drives (like USB flash drives or CompactFlash cards), but also lets administrators set policies on this feature as well for data syncing. The Offline Files feature allows administrators to designate files that are stored on network shared folders for use even when the network shared folders are unavailable (offline). For example, a mobile user disconnects a laptop computer from your intranet and works from a remote location. In Window Server 2008 RTM and Windows Vista this feature is configured in online mode by default. In Windows Server 2008 and Windows 7, this feature is configured in offline mode by default.
