Windows To Go: A deployment guide for education

Windows To Go is a feature of the Windows 8.1 Enterprise operating system that enables the operating system to run from a USB drive. Using Windows To Go in an education environment provides numerous benefits to faculty and students alike. It enables faculty and students to use a personalized copy of Windows 8.1 on virtually any PC, at almost any location. This guide provides an overview of Windows To Go deployment for schools. It is for IT pros and discusses the benefits, limitations, and processes involved in deploying Windows To Go.

Windows To Go A deployment guide for education January 2014 Table of contents 1 Understanding Windows To Go 1 Windows To Go for IT 2 Windows To Go for faculty 2 Windows To Go for students 4 Preparing to use Windows To Go 4 Windows To Go limitations 5 Roaming with Windows To Go 5 Determine user setting storage 6 Determine remote access requirements 6 Determine host computer requirements 7 Select the USB drive for Windows To Go 7 Understand Windows To Go image creation 9 Creating a Windows To Go drive 9 Using the Windows To Go Creator Wizard 10 Using Windows PowerShell cmdlets 12 Starting a Windows To Go drive 13 Enabling the Windows Store 14 Activating Windows To Go workspaces 15 Managing Windows To Go 15 Group Policy settings related to the Windows To Go workspace 17 Group Policy settings related to the host computer 18 Storing user data and settings 19 UE-V with Folder Redirection 19 Cloud storage 21 Conguring Windows To Go for remote access 22 Securing Windows To Go drives 23 ConguringBitLockerbeforedistribution 23 ConguringBitLockerafterdistribution 25 Building multiple Windows To Go drives 26 Talking about Windows To Go 27 Conclusion 1WINDOWS TO GO Windows To Go A deployment guide for education Windows To Go is a feature of the Windows 8.1 Enterprise operating system that enables the operating system to run from a USB drive. Using Windows To Go in an education environment provides numerous benets to faculty and students alike. It enables faculty and students to use a personalized copy of Windows 8.1 on virtually any PC, at almost any location. This guide provides an overview of Windows To Go deployment for schools. It is for IT pros and discusses the benets, limitations, and processes involved in deploying Windows To Go. Understanding Windows To Go WindowsToGocreatesabootableWindows8.1imageonaUSBdrive.Thismeansthatthe standardizedWindowsimagealreadyusedoninstitution-owneddevicesnowbecomesavailable withgreatlyincreasedportabilityandconvenience.Usersdonotneedtolugaroundalaptop orotherdevicetohavetheirWindowsdesktopavailable:Thatdesktopisnowavailableona USBdrive,andtheycanrunitonanyPCthatiscompatiblewithWindows7,Windows8,or Windows8.1. Windows To Go for IT WindowsToGohelpsITinseveralways: • Portability WindowsToGoenablesITtooffertheexibilityoffreeseating.Facultyand studentscanusetheirownWindowsdesktopfromalmostanyPCintheschool. • Cost savings ITdoesnotneedtodeployindividualcomputersbutrathercandeploythe WindowsToGoworkspaceonUSBdrivestoprovideaconsistent,personalizedWindows8.1 experience.Itiseasytosetupandcongure,anddistributionissimple. • Management Today’sITinfrastructureusesGroupPolicyandtechnologieslikeBitLocker Drive Encryption, Microsoft BranchCache, Application Virtualization, DirectAccess, and other 2WINDOWS TO GO advancedtechnologiestoensurehighlyreliableandsecureservicestousers.WindowsToGo supportsallofthosetechnologiesandmore.YoudonotneedtochangeyourITprocesses andmanagementtoolstoaddWindowsToGotoyourITinfrastructure. Windows To Go for faculty WindowsToGogivesfacultyaconsistentWindows8.1experiencefromalmostanywhere.Is seatingavailableinacomputerlab?Needtomovetoanotherclassroom?Theeducator’spersonal Windows8.1desktopisavailableatalloftheselocationsbybootingintotheWindowsToGo workspace. Facultymembersusenumeroustoolstoprovidethebestlearningexperiencefortheclassroom, suchasMicrosoftOfceandthespecializedLearningManagementSystem(LMS).Atthesame time, computers with that specialized software are typically shared among two or more educators, makingitdifculttondatimetogetclassroom-relatedadministrativeworkdone. WithaWindowsToGoworkspace,sharingacomputerbecomesathingofthepast.WithWindows ToGo,anycompatiblecomputer,regardlessoftheoperatingsysteminstalledonit,canbeused. ThismeansthatfacultymemberscanuseaWindowsToGoworkspaceatwork,fromhome,or fromanoff-campuslocation,providingthesameexperienceregardlessoflocation.Facultyareno longertetheredtoaspeciccomputer,room,orbuilding. Windows To Go for students Likefaculty,studentscanbenetfromtheWindowsToGoexperience.Studentscanusea WindowsToGoworkspacetobootintotheirownWindowsworkspacefromhomeorfromafree seatinschool.TheycanhavethesamepersonalWindows8.1experienceineachclassroom. Students can also use Windows To Go workspaces to get their homework done and perform research-relatedtasksbyusingspecializedsoftwarewithoutneedingtoinstallthatsoftwareon theirowndevice.AlltheyneedisacompatiblecomputerandUSBdrive,andtheworkspaceisup andrunning. YoucancustomizeWindowsToGoworkspacesforparticularcurriculums,gradelevels,andso on,thendistributethemtostudents.Doingsohelpstofacilitatethelearningexperiencewhile minimizingthetimeinvestedinconguringthetechnology. WindowsToGoworkspaceshavelowreplacementcost.IfastudentlosestheUSBdrivewiththe workspaceonitorifthedrivebecomesdamaged,itcanbereplacedatamuchlowercostthana PC. 3WINDOWS TO GO Additionalresources: • “Windows8EnterpriseinYourPocket”athttp://www.microsoft.com/en-us/windows/ enterprise/products-and-technologies/devices/windowstogo.aspx • “WindowsToGo:FrequentlyAskedQuestions”athttp://technet.microsoft.com/en-us/library/ jj592680.aspx 4WINDOWS TO GO Preparing to use Windows To Go Thissectiondescribestheinfrastructure-relateditemsthatyoumustconsiderforaWindows ToGodeploymentandalsoprovidesconsiderationsforthatpreparation.Inadditiontothe considerationsthatthefollowingsectionsdescribe,seeWindows 8.1 deployment planning: A guide for education at http://www.microsoft.com/download/details.aspx?id=39682 for considerations affectinganyWindows8.1deploymentinaneducationalinstitution. Windows To Go limitations AlthoughWindowsToGoissimilartoatypicalWindows8.1EnterpriseinstallationonaPC,some differencesexist: • No access to internal disks Bydefault,thehostcomputer’sdisksarenotaccessibleby a Windows To Go installation, and a USB drive with a Windows To Go workspace is not accessiblebytheWindowsoperatingsysteminstalledonthecomputer.Youcaneliminate bothoftheselimitationsbyusingGroupPolicy.However,theserestrictionsareinplaceto protect the security and privacy of the Windows To Go workspace, and to help prevent end- userconfusion. • Recovery options are limited TheWindowsRecoveryEnvironment(WindowsRE)isnot availableinWindowsToGo,norarerefreshandresetoptions.Youshouldre-provisionthe Windows To Go workspace onto the USB drive in the event a Windows To Go workspace becomesunrecoverable.Becauserecoveryoptionsarelimited,Microsoftdoesnot recommendstoringuserdataontheWindowsToGoUSBdrive.Instead,useanetwork-or cloud-basedsolutionlikeFolderRedirectionorSkyDrive. • Trusted Platform Module (TPM) is not used TheTPMistiedtoaspecicphysical computer.Therefore,becauseWindowsToGoworkspacesmoveamongcomputers,theTPM isnotusedinaWindowsToGoworkspace.Initsplace,apasswordisrequiredforBitLocker onaWindowsToGoworkspace. • Windows Store is disabled (Windows 8 only) InWindows8,theWindowsStoreisdisabled bydefault,becauseappsaretiedtothecomputeritself.YoucanuseGroupPolicytoenable theWindowsStore.InWindows8.1,thislimitationisgone,andtheWindowsStoreisenabled bydefault.RegardlessoftheWindowsStorestatus,youcanstillsideloadappsforwhich youhaveinstallationles.FormoreinformationaboutsideloadingWindowsStoreapps, see Windows Store apps: A deployment guide for education at http://www.microsoft.com/ download/details.aspx?id=39685. 5WINDOWS TO GO • Hibernate is disabled Hibernationexpectstondthesamehardwarewhentheoperating systemresumes.BecauseWindowsToGoworkspaceswilllikelyroamamongcomputers, hibernationisdisabled.LiketheWindowsStore,youcanre-enablehibernate,butonly enablehibernationifyouarecertainthatthedevicewillonlybeusedonthesamephysical computer. Roaming with Windows To Go Duringthebootprocess,WindowsToGoexaminesthehostcomputer’shardwareandinstalls thenecessarydevicedrivers.Thisprocessgenerallyworkswell,especiallyifpeoplewillbe usingWindowsToGoonhostcomputerswithsimilarhardwarecongurations.However,ifthe workspacewillbeusedondifferenthardwarewithdifferentdevicecongurations,thenyoumight needtoinjectadditionaldriversintotheimage.Testingtheimageonthehardwareisakeystepto ensurecompatibilityforthedevicestobeusedwithWindowsToGo. Someapplicationscanbindtospecichardware.Forexample,anapplicationmighttieitslicensing oractivationtothecomputer’shardware.IftheWindowsToGoworkspacewillbeusedon multiplehostcomputerswithdifferenthardwarecongurations,theapplicationsmightnotroam. Ensure that each application you are installing in a Windows To Go workspace supports roaming or provide for an alternate method of using those applications, such as Windows Server 2012 R2 RemoteApp. Studentsandfacultyarenotusuallyawareofwhichtypeofrmwaretheircomputershave,and sotheywilllikelyboottheirworkspacesondifferenttypes.TheycanbootWindowsToGoon computerswithdifferenttypesofrmware.ComputerscertiedforWindows8.1haveUnied ExtensibleFirmwareInterface(UEFI),whileWindows7computersusethelegacyBIOSrmware. Ratherthancreatingseparateworkspacesfordifferentrmwaretypes,WindowsToGocanboot oneitherrmwaretype. Determine user setting storage Users need access to their data and settings within the Windows To Go workspace in addition totheirusualdevice.Determinehowbesttoprovidethisaccess,whetherthroughauserstate virtualization(USV)technologyorthroughothermeans.Optionsincludelocalstorage,Microsoft UserExperienceVirtualization(UE-V)withFolderRedirectionandOfineFiles,SkyDrive,Microsoft Ofce365,andothercloud-basedstoragesolutions.Windows8.1alsoenableslogonwitha Microsoftaccount,whichincludestheoptionofroamingformanyusersettings.Thisaspectof Windows To Go is discussed in the section “Storinguserdataandsettings”onpage18 in this guide. 6WINDOWS TO GO Determine remote access requirements IfWindowsToGoworkspaceswillbeusedfromoff-campuslocations, thenyoumightprovideamethodforremoteaccess.Youcandoso byusingDirectAccessorbyusinganexistingvirtualprivatenetwork (VPN)solution.Moredetailonremoteaccessisgivenin“Conguring WindowsToGoforremoteaccess”onpage21. Determine host computer requirements WindowsToGosupportsmanydifferenttypesofhardware.This supportenablesuserstorunWindowsToGoworkspaceson hardwarecertiedforWindows8.1,Windows8,andWindows7alike. Notethefollowinghostcomputerrequirements: • Booting ThecomputermustbecapableofbootingfromaUSB drive,andthedrivemustbedirectlyconnected;USBhubsare notsupported. • Firmware ThecomputercanuseUEFIorBIOS. • Graphics The computer should have Microsoft DirectX 9 with WindowsDisplayDriverModel1.2orlaterdriver. • Processor Thecomputershouldhavea1GHzorfaster processor,andthearchitecturecanbe32or64bit,asdiscussed laterinthisguide. • RAM The computer should have at least 2 GB of physical memory. • USB port ThecomputershouldhaveatleastoneUSB2.0or 3.0port. Whenconsideringtheprocessorarchitecture,thermwareis animportantconsideration.Table1onpage7describesthe processorarchitectureconsiderationsforWindowsToGo. NOTE Windows To Go workspaces are not supported on Windows RT orAppleplatforms. 7WINDOWS TO GO Host firmware Host processor arcHitecture windows to Go arcHitecture BIOS 32-bit 32-bitonly BIOS 64-bit 32-bitand64-bit UEFI 32-bit 32-bitonly UEFI 64-bit 64-bitonly Select the USB drive for Windows To Go TheUSBdriveusedforWindowsToGomustbeWindowsToGo certied.WindowsToGo–certieddrivesareoptimizedfortherateof I/OoperationsnecessaryforWindows.Theyarecapableofbooting onhardwarecertiedforWindows7,Windows8,andWindows8.1. Thedriveshavemanufacturerwarrantiesandaremeanttobeused tosupportatypicalWindowsworkload.Severalhardwarevendors offerthesedrivesinavarietyofsizes.See“WindowsToGoOverview” at http://technet.microsoft.com/en-us/library/hh831833.aspx#wtg_ hardwareforalistofcurrentlysupporteddrives. NOTE AWindowsToGoimagerunningWindows8.1can bootfromadrivethatcontainsabuilt-insmartcard.These compositedrivescombineamassstoragedriveandsmartcard inonedevice.Windows8.1canenumeratethesmartcardwhen bootingfromtheWindowsToGodriveorbyconnectingthe devicetoanotherhostmachine.Formoreinformation,see “What’sNewinSmartCards”athttp://technet.microsoft.com/ library/hh849637.aspx. Understand Windows To Go image creation EaseofdeploymentisakeyfeatureofWindowsToGo.AWindows8.1 releasetomanufacturing(RTM)imageisallthatisneededtobegin theWindowsToGoimage-creationprocess.Alternately,youcanfully TABLE 1 Processor Architecture and Windows To Go NOTE YoucanalsouseMicrosoft System Center 2012 R2 CongurationManager todistributeworkspaces. SeetheMicrosoftTechNet article“HowtoProvision Windows To Go in CongurationManager” at http://technet. microsoft.com/en-us/ library/jj651035.aspx for moreinformation. [...]... workspaces Windows To Go can use Active Directory-Based Activation (ADBA) and Key Management Service (KMS) activation, similar to a typical installation of Windows 8.1 However, Windows To Go cannot use Multiple Activation Key (MAK) activation, as MAK activation binds to the host computer’s hardware Windows To Go uses a standard Windows license and counts as an installation for applicable licensing agreements... easily than before You can create Windows To Go workspaces and manage them by using the same tools you already use within your organization You can create a Windows To Go workspace by using a wizard or Windows PowerShell, and you can manage Windows To Go workspaces through Group Policy To learn about other ways you can deploy Windows 8.1 in your school, see Windows 8.1 deployment planning: A guide for. .. cmdlets to create Windows To Go workspaces when you need additional flexibility Windows PowerShell enables you to create a custom, scripted solution for large-scale Windows To Go workspace creation WINDOWS TO GO 10 The tools used to create a Windows To Go workspace are essentially the same tools you use to manually provision and deploy Windows images They include: • Disk partitioning cmdlets such as Clear-Disk,... Favorites, desktop wallpaper, and so on) when logging on to the Windows To Go workspace with a Microsoft account Table 3 describes the options for data and setting storage Table 3  Options for Data and Setting Storage in Windows To Go Local storage in the Windows To Go UE-V with Folder Redirection SkyDrive workspace Requires no additional configuration Requires agent installation in the workspace and... to duplicate the workspace You can use a USB drive duplicator to create a large number of copies of a given workspace This scenario is appropriate when the workspace has the same applications and tools and will be distributed to the same types of users, such as students; it also enables you to create multiple workspaces, one for students and one for faculty When using a drive duplicator, be aware of... technet.microsoft.com/en-us/library/jj592678.aspx • Deployment Considerations for Windows To Go” at http:// technet.microsoft.com/en-us/library/jj592685.aspx WINDOWS TO GO 17 Storing user data and settings In a typical Windows installation, user data and settings are stored on the computer’s internal disk However, with Windows To Go, access to the internal disk is disabled Data and settings are instead stored within the workspace itself... Store disabled Educational apps that you sideload are unaffected by this policy and can still be loaded, run, and managed through normal app management processes Additional resources: • Windows Store apps: A deployment guide for education at http://www.microsoft.com/ download/details.aspx?id=39685 • “Management of Windows To Go using Group Policy” at http://technet.microsoft.com/en-us/ library/c598d28c-5829-42ce-8d43 -a7 a 5a4 382537#BKMK_wtggp... to provide for the resulting Windows To Go workspace to be joined to the domain and for applications to be installed in the workspace You can use Group Policy to manage the workspace, and you may want to customize certain settings for your environment See the section “Managing Windows To Go” on page 15 or the section “Image deployment and drive provisioning considerations” in the TechNet article Deployment. .. http://technet.microsoft.com /windows/ intune aspx for more information • System Center 2012 Configuration Manager  See “System Center Configuration Manager” at http://technet.microsoft.com/systemcenter/bb507744.aspx for more information You can also use Group Policy to manage Windows To Go, and Microsoft recommends that you create a separate organizational unit (OU) for the Windows To Go workspaces and one for host computers You can use... the Windows Store are tied to the device’s hardware and can be installed on as many as five devices This means that the app will not run if the Windows To Go workspace is booted from more than five different devices You can enable the Windows Store by using the Allow Store to install apps on Windows To Go workspaces Group Policy setting found at \Computer Configuration\Administrative Templates\ Windows . http://technet.microsoft.com/en-us/ library/0fd5 2a8 1-c87 1-4 567-aaaf-bd29c2ee65d4 1 4WINDOWS TO GO Activating Windows To Go workspaces Windows To Go canuseActiveDirectory-BasedActivation(ADBA)andKeyManagementService (KMS)activation,similar to a typicalinstallationof Windows 8.1.However, Windows To Go cannot useMultipleActivationKey(MAK)activation,asMAKactivationbinds to thehostcomputer’s hardware. Windows To Go uses a standard Windows licenseandcountsasaninstallation for applicablelicensingagreements. The Windows To Go workspaceneeds to renewitsactivationevery180days.Itdoesthiswhenever theworkspaceisbootedwithintheschool’snetworkorwhenusing a remoteconnectionlike DirectAccessor a VPN.Ifworkspacesarenotusedwithinthe180-dayperiod,youwillneed to reactivatethembyconnectingthem to thenetworkcontainingtheADBAorKMSservices. Applications to beusedwithintheworkspacemightalsoneed to beactivated.Ofce2013usesthe sameactivationmethodsas Windows To Go, butsoftwarefromothervendors,suchasLMSsand othereducationalapplications,mighthavedifferentlicensing.Verifythe Windows To Go usage scenariowiththeappropriatevendors to ensurelicensingcompliance. Additionalresources: •. Windows To Go athttp:// social.technet.microsoft. com/wiki/contents/ articles/12911.tips -for- conguring-your-bios- settings -to- work-with- windows- to- go. aspx for moreinformation. 1 3WINDOWS TO GO Enabling the Windows Store The Windows Storeisenabledbydefaulton Windows To Go drivesrunning Windows 8.1.Userscan startthedriveonanynumberofhostcomputers,accessthe Windows Store,andruntheirapps. In Windows 8,the Windows Storeisdisabledin a Windows To Go workspacebydefault,because appspurchasedthroughthe Windows Storearetied to thedevice’shardwareandcanbeinstalled onasmanyasvedevices.Thismeansthattheappwillnotrunifthe Windows To Go workspaceis bootedfrommorethanvedifferentdevices. Youcanenablethe Windows StorebyusingtheAllow. “VolumeactivationofOfce2013”athttp://technet.microsoft.com/en-US/library/ee705504. aspx 1 5WINDOWS TO GO Managing Windows To Go Youcanusethesame Windows managementtoolswithwhichyouarealreadyfamiliar to manage Windows To Go drives.Youdonotneed to learnanynewtools to manage Windows To Go within yourinstitution. For example,youcanmanage Windows To Go workspacesbyusing: •