Planning a Managed Environment

Transcription

1 C H A P T E R 1 Planning a Managed Environment Many organizations are moving towards a highly managed compting environment based on a configration management infrastrctre that is designed to redce the cost of managing a diverse set of organizational needs. The Microsoft Windows Server 2003 operating system incldes a set of configration management technologies collectively known as IntelliMirror that yo can se to centrally manage configrations for sers and compters. IntelliMirror and Grop Policy combine the advantages of centralized compting with the performance and flexibility of distribted compting. This book explains how to design and deploy a centrally managed distribted compting environment. In This Chapter Overview of Deploying a Managed Environment Process...2 Developing a Deployment Plan Defining the Scope of Yor Configration Management Project Assessing Yor Crrent Environment Determining Yor Reqirements for Configration Management Technologies Designing Managed Configrations Designing Yor Organizational Unit Strctre Testing Yor Configration Management Design Staging and Deploying Yor Design to the Prodction Environment Additional Resorces Related Information For more information abot designing and deploying yor Active Directory directory service infrastrctre, see Planning an Active Directory Deployment Project and Designing the Active Directory Logical Strctre in Designing and Deploying Directory and Secrity Services of this kit. For more information abot Grop Policy, see the Distribted Services Gide of the Microsoft Windows Server 2003 Resorce Kit (or see the Distribted Services Gide on the Web at

2 2 Chapter 1 Planning a Managed Environment Overview of Deploying a Managed Environment Process The IntelliMirror technologies inclded in Microsoft Windows 2000, Microsoft Windows XP, and Windows Server 2003 operating systems provide the capabilities for directory-based configration management. By sing IntelliMirror on the server and the client, yo can ensre that a ser s data, applications, and settings remain constant throghot the ser s environment. Yo also se Grop Policy to centralize the process for deploying and managing secrity for servers rnning Windows 2000 and Windows Server 2003 and clients rnning Windows 2000 and Microsoft Windows XP Professional. Together, Active Directory and Grop Policy provide the fondation for IntelliMirror. Based on the Grop Policy settings yo specify, IntelliMirror can deploy, recover, restore, and replace ser s data, software, and personal settings. Yo can set policy definitions once and rely on the system to apply the policy settings withot frther administrative intervention. By sing IntelliMirror, yo can centralize and simplify the management of sers, servers, desktops, and secrity. The term configration management as sed in this gide refers to a sbset of technologies in Windows Server 2003 (and Windows 2000) that administrators can se as part of their overall infrastrctre for change and configration management. By sing the IntelliMirror management technologies provided in Windows 2000 and later, yo can design configrations for servers, desktops, and sers. Microsoft has developed gidelines yo can se to help yo effectively design, develop, deploy, operate, and spport soltions bilt on Microsoft technologies. The gidelines are organized into two integrated frameworks, Microsoft Operations Framework (MOF) and Microsoft Soltions Framework (MSF). The gidelines inclde white papers, operations gides, assessment tools, best practices, case stdies, templates, spport tools, and services. MOF provides technical gidance that enables organizations to achieve system reliability, availability, spportability, and manageability of IT soltions. MOF addresses the people, process, technology, and management isses pertaining to operating complex, distribted, heterogeneos IT environments. For more information abot MOF, see the Microsoft Operations Framework (MOF) link on the Web Resorces page at For more information abot Microsoft Soltions Framework, see the Microsoft Soltions Framework link on the Web Resorces page at Advantages of Using IntelliMirror IntelliMirror refers to the ability to provide sers with consistent access to their applications, application settings, roaming ser profiles, and ser data, from any managed compter even when they are disconnected from the network. IntelliMirror is delivered via a set of Windows featres that enable IT administrators to implement standard compting environments for grops of sers and compters.

3 Overview of Deploying a Managed Environment Process 3 IntelliMirror can significantly boost ser prodctivity and satisfaction by doing the following: Allowing sers to contine working efficiently in intermittently connected or disconnected scenarios by enabling ninterrpted access to ser and configration data nder these conditions. Delivering a consistent compting environment to sers from any compter when their desktop or laptop compter is navailable or in scenarios where sers are not assigned a specific compter. Minimizing data loss by enabling centralized backp of ser data and configration files by the IT organization. Minimizing ser downtime by enabling atomated installation and repair of applications. Implementing IntelliMirror also boosts administrator efficiency and redces IT costs by doing the following: Eliminating the need to manally configre ser settings, install applications, or transfer ser files to provide sers access to their compting environments on any compter. Enabling scenarios where sers don t have an assigned compter bt log on to any available compter in a pool of compters. This helps redce hardware and administration costs. Easing the IT task of implementing centralized backp of ser files while satisfying need for these files to be available on the ser s compter. Redcing spport costs by sing Windows Installer to atomatically repair broken application installations. IntelliMirror is implemented by means of a set of Windows featres, inclding Active Directory, Grop Policy, Software Installation, Windows Installer, Folder Redirection, Offline Folders, and Roaming User Profiles. Deploying IntelliMirror technologies for configration management provides the following advantages. User data management IntelliMirror facilitates the centralized backp and restore of ser data. Storing the sers data on servers simplifies data backp and secrity and ensres that data is protected and highly available. Users can access their data from any compter on the network. User data management relies on Active Directory, Grop Policy, Folder Redirection, Offline Files, and disk qotas. User settings management Using the ser settings management capabilities, yo can manage ser settings and preferences (sch as ser-defined screen colors and display fonts) and make them available to sers regardless of which networked compter the sers log on to. Yo can centrally define managed configrations for sers and mirror ser settings to the network. User settings management relies on Active Directory, Grop Policy, Roaming User Profiles, Folder Redirection, Offline Files, and Synchronization Manager. Secrity settings Using Grop Policy, yo can manage the following types of secrity options for sers, clients, servers, and domain controllers: Internet Protocol secrity (IPSec), secrity settings, software restrictions policies, and wireless network policies.

4 4 Chapter 1 Planning a Managed Environment Grop Policy based software installation Using Grop Policy based software installation, yo can manage software installation throghot an application s life cycle. Yo can centrally manage software installation, repairs, pdates, and removal. Internet Explorer policy settings Using Microsof Internet Explorer policy settings yo can cstomize the appearance of the browser, define connection settings, and define cstom Universal Resorce Locators (URLs), secrity settings, and program associations. Scripts Yo can specify scripts to rn when the compter starts and shts down and when sers log on or log off. Remote setp and configration Using Remote Installation Services (RIS), yo can simplify operating system installations by remotely setting p and configring operating system installations on compters throghot the enterprise. To ensre the sccess of yor managed environment deployment, yo mst create a configration management plan that defines the resorces to be managed and the processes that yo are implementing. Yo start yor deployment plan by defining yor bsiness objectives for change and configration management and determining the scope of yor configration management deployment in terms of the sers and resorces yo need to manage. In the first phase, yo also need to perform an assessment of yor crrent environment and determine the reqirements for configration management. Next, determine which IntelliMirror configration management technologies meet yor bsiness reqirements, and then design managed configrations for the varios types of sers and compters in yor organization based on those reqirements. Before yo deploy configration management technologies into yor prodction environment, yo mst flly test yor designs in a controlled test environment, and then review yor test reslts to determine whether the systems meet the design reqirements. It is strongly recommended that yo stage yor deployment of Grop Policy and related technologies. For more information abot staging, see Staging Grop Policy Deployments in this book. After yo complete the testing of yor design in a controlled environment, yo can deploy to prodction. To learn abot sing the Windows Server 2003 Grop Policy Management Console (GPMC) to facilitate testing and staging yor deployments of Grop Policy, see Designing a Grop Policy Infrastrctre in this book. IntelliMirror Deployment Process Deploying IntelliMirror configration management technologies entails several processes. Yo begin yor deployment plan by establishing yor bsiness objectives and identifying the resorces to be managed, and then yo define the scope of yor project and evalate yor crrent environment in terms of the resorces yo need to manage and yor reqirements for configration management technologies. Based on these reqirements, yo design managed configrations, determine the scope of application of yor soltion, test, and then stage and deploy yor soltion.

5 Overview of Deploying a Managed Environment Process 5 What this Gide Contains Planning how yo organize sers and compters in Active Directory containers and how yo apply Grop Policy settings to manage them is an integral part of IntelliMirror. To help gide yor design decisions for creating managed desktop configrations, yo need a clear nderstanding of the appropriate technologies to se and the processes involved in implementing a desktop management soltion that meets yor bsiness needs. Althogh it is anticipated that yo will read only those chapters in this gide that apply to yor particlar deployment needs, be aware that the IntelliMirror technologies rely on Grop Policy and Active Directory for their delivery. Therefore, it is recommended that yo read Designing a Grop Policy Infrastrctre in addition to the chapters that pertain to yor particlar deployment. Each chapter is intended to assist yo in planning, designing, testing, deploying, and implementing managed desktop configrations sing IntelliMirror technologies. Designing a Grop Policy Infrastrctre Provides information abot the process of defining yor Grop Policy objectives and designing a Grop Policy infrastrctre. Read Designing a Grop Policy Infrastrctre before yo deploy Grop Policy based soltions that are described in other chapters in this book. Staging Grop Policy Deployments Discsses the processes for creating and testing yor Grop Policy deployments in a controlled test environment. For example, Staging Grop Policy Deployments explains how to create a test domain that mirrors a prodction domain by sing the sample scripts provided with the Grop Policy Management Console. Yo can perform incremental policy changes in the test environment, verify yor changes, and then se the Import fnctionality of GPMC and migration tables to migrate the Grop Policy objects (GPOs) yo created to the prodction domain. Deploying Secrity Policy Discsses incorporating the Windows 2003 Server Grop Policy secrity featres into yor overall secrity strategy to protect yor corporate environment. Deploying Secrity Policy explains how to evalate existing secrity policies, determine the level of risk acceptable for yor environment, and deploy secrity policies. Deploying Software Update Services Discsses how to se Microsoft Software Update Services (SUS) to collect, approve, and distribte critical Windows patches to resolve known secrity vlnerabilities and stability isses on compters rnning Windows XP; and Windows Server 2003 operating systems. Deploying Software Update Services gides yo throgh the process of designing and deploying servers rnning SUS within yor intranet.

6 6 Chapter 1 Planning a Managed Environment Migrating User State Discses how to se the ser state migration tools inclded in Windows Server 2003 to save and restore ser data and settings when yo move client compters to the Windows XP operating system from earlier versions of Windows. Migrating User State gides yo throgh the processes of planning and implementing ser state migration to conserve IT staff time, preserve important data, and minimize costs while maintaining ser prodctivity. Implementing User State Management Discsses the processes involved in implementing ser data and ser settings management technologies to set p, manage, and control the availability of ser data and personal settings across yor network. IntelliMirror allows data and settings to be available to sers even when their compters are disconnected from the network. Implementing User State Management helps yo plan, test, and configre managed desktop configrations by sing Roaming User Profiles, Folder Redirection, Offline Files and synchronization, and disk qotas and ser profile qotas. Deploying a Managed Software Environment Discsses the process of deploying a managed software environment sing the software installation extension of Grop Policy. By sing Grop Policy based software installation, yo create a controlled environment that provides on-demand software installation and atomatic repair of applications. Deploying a Managed Software Environment explains how to se Grop Policy based software deployment to manage software throghot all phases of the software administration life cycle. Deploying a Simple Managed Environment Discsses the process of combining the IntelliMirror technologies to create a simple managed environment. Deploying a Simple Managed Environment gides yo throgh the steps reqired to deploy a complete IntelliMirror soltion, which yo can se sed as an initial prodction environment for a small organization, or a test environment for a larger organization. Smmary of Job Aids As spplement to this book, yo can se job aids, sch as worksheets and checklists, which are designed to help yo collect data for planning yor configration management deployments. Each worksheet is created for the type of information yo need for planning, sch as qestions to answer, points to consider, and tables to help yo organize yor information. Yo can modify the designated job aids to develop yor configration management designs as appropriate for yor organization s needs. For worksheets to assist yo with the deployment processes discssed in this book, see Additional Resorces, later in this chapter.

7 Overview of Deploying a Managed Environment Process 7 Introdction to IntelliMirror Configration Management Technologies When yo se Windows XP and Windows 2000 clients, and Microsoft Windows 2000 Server and Windows Server 2003 networks with Active Directory installed, yo can take fll advantage of IntelliMirror and Grop Policy management featres. Active Directory and Grop Policy provide the fondation for IntelliMirror. Based on the Grop Policy settings yo specify, IntelliMirror can deploy, recover, restore, and replace ser s data, software, and personal settings. Table 1.1 lists the IntelliMirror core featres, the technologies that enable these featres, and the advantages of sing IntelliMirror. Table 1.1 IntelliMirror Featres, Advantages, and Technologies IntelliMirror Featre Advantages Technologies Used User Data Management User Settings Management Compter Settings Management Software Installation Data is protected and highly available. Users can access their data from any compter on the network. For example, if yo redirect specific ser data folders, sch as the My Docments folder, to a network location, and then making this location available to the sers for offline se, sers can access to their data wherever they log on. Yo can also manage configration settings for Internet Explorer by sing Grop Policy. Users get their preferred desktop configration from any compter on the network. Their preferences and settings for the desktop and applications are available wherever they log on. Yo can se Grop Policy to define options for compters, inclding secrity and network settings. For example, yo can set options sch as remote assistance, system restore, Windows file protection, and Terminal Services. Yo can centrally manage software installations, pdates, repairs and removal. Active Directory Grop Policy Offline Files Folder Redirection Synchronization Manager Disk Qotas Enhancements to the Windows shell Active Directory Grop Policy Offline Files Roaming User Profiles Enhancements to the Windows shell Active Directory Users and Compters snap-in Grop Policy Active Directory Grop Policy Windows Installer

8 8 Chapter 1 Planning a Managed Environment IntelliMirror Technologies Active Directory and Grop Policy together provide the fondation for IntelliMirror. The following technologies enable the IntelliMirror featres. Active Directory Windows based directory service stores information abot objects on a network and makes this information available to administrators and sers. By sing Active Directory, yo can view and manage network objects on their network from a single location, and sers can access permitted network resorces by sing a single logon. The Active Directory Users and Compters Microsoft Management Console (MMC) snap-in is the recommended tool for managing Active Directory objects, inclding organizational nits (OUs), sers, contacts, grops, compters, printers, and shared file objects. Grop Policy The infrastrctre within Active Directory that enables directory-based configration management of ser and compter settings on compters rnning Microsoft Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; and Windows Server 2003, Datacenter Edition operating systems and Windows 2000 and Windows XP Professional operating systems. The Grop Policy settings that yo create are contained in a Grop Policy object (GPO). To create a GPO, se the Grop Policy Object Editor snap-in for the MMC, which can be started from the Grop Policy Management Console MMC snap-in (GPMC). The GPMC tool provides nified management of all aspects of Grop Policy across an enterprise, inclding cross-forest management. Using GPMC, yo can manage all GPOs, Windows Management Instrmentation (WMI) filters, and permissions in yor network. GPMC consists of the following: a set of scriptable interfaces for managing Grop Policy, the Grop Policy Modeling Wizard for planning Grop Policy deployments prior to implementing them in the prodction environment, the Grop Policy Reslts Wizard for viewing GPO interaction and for trobleshooting Grop Policy deployments, and a new MMC snap-in that gives yo the ability to manage Grop Policy across yor organization throgh a single ser interface. For more information abot Grop Policy and GPMC, see Designing a Grop Policy Infrastrctre in this book. Yo can download GPMC from the Microsoft Download Center; see the Grop Policy Management Console link on the Web Resorces page at Yo can se GPMC to manage both Windows 2000 and Windows Server 2003 based domains with Active Directory. By sing GPMC to link a GPO to selected Active Directory system containers sites, domains, and OUs yo can apply the GPO s policy settings to the sers and compters in those Active Directory containers.

9 Overview of Deploying a Managed Environment Process 9 Yo can se Grop Policy to configre policy settings for the following: Registry-based policy settings The Administrative Templates extension contains all registrybased policy settings, inclding those for the Windows 2000 or Windows Server 2003 operating systems and their components as well as any registry-based policy settings provided by applications. Yo se these policies to mandate registry settings that control the behavior and appearance of the desktop, the operating system components, and applications that provide registry-based policy. Secrity settings Yo can set secrity options for compters and sers within the scope of a Grop Policy object. Yo can define local compter, domain, and network secrity settings. Scripts Yo can se scripts to atomate tasks when the compter starts and shts down, and when the ser logs on and logs off. Yo can se any langage spported by Windows Scripting Host. These inclde the Microsoft Visal Basic development system, Scripting Edition (VBScript), JavaScript, Perl, and MS-DOS -style batch files (.bat and.cmd). Folder Redirection Yo can redirect special folders on Windows 2000 Professional and Windows XP from their defalt ser profile location to an alternate location on the network. These special folders inclde My Docments, My Pictres, Application Data, Desktop, and the Start men. Software installation Yo can centrally manage software in yor organization. Yo can assign and pblish software to sers and assign software to compters. Microsoft Internet Explorer Maintenance Yo can manage and cstomize Internet Explorer on compters rnning Windows 2000, Windows XP, and Windows Server Yo can also export settings for Microsoft Windows 95, Windows 98, and Windows NT version 4.0 clients (the settings are exported into an.ins and.cab file format for those platforms). Administrators can set options for browser ser interface, connections, Uniform Resorce Locators (URLs), proxy settings, secrity zones, and the Favorites folder and the Links bar. Remote Installation Services Remote Installation Services (RIS) is sed to control the behavior of the Remote Operating System Installation featre as displayed to client compters. User profiles A ser profile describes the desktop compting configration for a specific ser, inclding the ser s environment and preferred settings. The ser profile is created when a ser first logs on to a compter rnning Windows XP, Windows 2000, Windows NT, or Windows Server A ser profile consists of a grop of settings and files, which defines the environment that the system loads when a ser logs on. It incldes all the ser-specific configration settings, sch as application settings, screen colors, network connections, printer connections, and mose settings.

10 10 Chapter 1 Planning a Managed Environment The following ser profiles are available in Windows Server 2003, Windows XP, and Windows 2000 Server and Microsoft Windows 2000 Professional: Local ser profile. This is created the first time that a ser logs on to a compter. The local ser profile is stored on a compter s hard disk. Any changes made to the local ser profile are specific to the compter on which the changes are made. Roaming ser profile. A copy of the local profile is copied to and stored on a server share. This profile is downloaded every time that a ser logs on to any compter on the network, and any changes made to a roaming ser profile are synchronized with the server copy when the ser logs off. Mandatory ser profile. A type of profile that administrators can se to specify particlar settings for sers. Only system administrators can make changes to mandatory ser profiles. Changes that a ser makes to desktop settings are lost when the ser logs off. Offline Files Offline Files complements Folder Redirection. By sing Offline Files, sers can disconnect from the network and contine working on the files as if they were still connected. When the compter is offline, the files and folders appear in the same directory as they do online as if they still resided in the same location on the network. The ser can then edit files even when not connected to the network. The next time the ser connects to the network, the offline changes are synchronized with the network share. Folder Redirection By sing Folder Redirection, sers and administrators can redirect the path of a folder to a new location. The new location can be a folder on the local compter or a directory on a network share. Users can work with docments on a server as if the docments were based on the local drive. For example, yo can redirect the My Docments folder (typically stored on the local hard disk) to a network location. The docments in the folder are available to the ser from any compter on the network. Synchronization Manager When sing Offline Files, sers can se Synchronization Manager to synchronize all network resorces. Users can set Synchronization Manager to atomatically synchronize some or all resorces. For example, sers can set certain files and folders to be synchronized every time they log on or off the network. Synchronization Manager qickly scans the system for any changes, and if it detects changes, only the resorces that have changed are pdated, speeds p the synchronization process. Disk qotas Yo can set disk qotas to track and manage the amont of disk space sed on the servers containing sers redirected folders. Yo can specify a disk qota limit and a disk qota warning level. If a ser exceeds their designated qota limit, the ser is prevented from storing additional files on the volme withot first clearing some disk space. Yo can configre the disk qota system to log a system event when the sers reach their qota warning level.

11 Overview of Deploying a Managed Environment Process 11 Software Update Services SUS is a server component that yo can install on a server rnning Windows 2000 or Windows Server 2003 to allow small and medim enterprises to bring critical pdates from Windows Update inside their firewalls for distribtion to compters rnning Windows 2000, Windows XP, and Windows Server Yo can se SUS to download the latest operating system patches to an intranet server, test the patches in yor operating environment, select the patches yo want to deploy to specific compters, and then deploy the patches. User State Migration tool If yo are performing a large deployment of the Windows XP Professional operating system, se the User State Migration tool (USMT) to atomate the migration of ser state information. By sing USMT, yo can migrate sers personal display properties, folder and taskbar options, Internet browser and mail settings, as well as specific files or entire folders (sch as My Docments, My Pictres, and Favorites) from their old compter to their new one. The USMT tool is inclded on the Windows Server 2003 CD in the \ValeAdd\Msft\USMT folder. For more information abot migrating ser state information, see Migrating User State in this book. For more information abot sing USMT, see the User State Migration Tool link on the Web Resorces page at Remote Installation Services Yo can se RIS to install the base operating system on a new compter or to replace a system that has failed. By sing RIS yo can do sch installations or replacements withot visiting the individal compter. Clients mst spport remote booting by means of the Pre-Boot exection Environment (PXE) ROM. For client compters that do not have a remote boot enabled ROM, yo can se a remote-startp floppy disk; these clients mst have a Peripheral Component Interconnect (PCI) based network adapter. Yo can centrally set client configration options for Remote Installation Services by sing Grop Policy. The remote operating system installation featre ses Active Directory, Grop Policy, Dynamic Host Configration Protocol (DHCP), and RIS. To facilitate compter replacement, yo can se RIS to install the operating system, Grop Policy based software installation to recover applications, Roaming User Profiles to restore ser profiles, and Folder Redirection to manage files centrally. Yo can se IntelliMirror featres separately or yo can combine them depending on yor bsiness and organizational reqirements. IntelliMirror Implementation Examples The examples that follow se some typical events at any organization to illstrate how the implementation of the IntelliMirror configration management featres in Windows Server 2003 impacts the compting environment. Example sitations illstrate how the featres and technologies of IntelliMirror can address typical desktop management needs.

12 12 Chapter 1 Planning a Managed Environment Setting p the New Employee s Compter Example A new ser logs on to a new compter and finds docments and shortcts already on the desktop. These shortcts link to common files, data, and URLs that are sefl to all sers. Some examples of docments and shortcts are the employee handbook or shortcts to the ser s departmental gidelines and procedres or to the intranet. Also, if yor compters come to yo withot an operating system, or if yo have yor own cstomized operating system installation, yo can completely atomate the installation of the client operating system for the new employee by sing RIS. No technician is reqired to visit the compter. For more information abot sing RIS, see the Remote Installation Services (RIS) link on the Web Resorces page at Implementing the Setting p of a New Employee s Compter Example A defalt domain ser profile and Grop Policy are sed to configre the new ser s environment based on the ser s job reqirements. The administrator created a cstomized defalt domain profile that applies to all new domain sers the first time they log on. When the sers log on, they receive the cstomized settings from this profile. The advantage for the administrator of sing a defalt domain profile is that all new sers start from a base configration that the administrator has chosen. Then, as the ser personalizes the desktop settings, these settings are saved in the ser s profile, which is stored either locally, or in a roaming ser profile in a predetermined location on the network. By implementing roaming ser profiles, yo can provide the ser with the reqired bsiness information and settings whenever needed. Logging on the First Time Example A new employee logs on for the first time and sees that reqired software, sch as Microsoft Word, on the Start men. When the new ser selects Word on the Start men, or doble-clicks a Word docment, Word is installed on demand. Implementing a First Time Logon Example Software Installation is implemented primarily throgh the se of Grop Policy and the Windows Installerservice. Based on the ser s Active Directory location and the Grop Policy object applied, the ser is assigned Word. IntelliMirror ensres that the necessary and correct items assigned to the ser appear in the Start men. Using Grop Policy, the administrator can assign or pblish differently configred versions of the same application to different grops of sers. When the ser starts Word or opens an employee handbook in Word for the first time, the Windows Installer service checks to see if the application is installed on the local compter. If not, Windows Installer downloads and installs the necessary files for Word to rn and sets p the necessary local ser and compter settings. Althogh Windows Installer contines to check each time the application is invoked, it does not attempt to reinstall or repair the application nless necessary files are missing.

13 Overview of Deploying a Managed Environment Process 13 Making Offline Files Accessible to a Portable Compter Example A portable-compter ser working at the office creates a nmber of docments and saves them to the My Docments folder. After saving the docments, the ser logs off, disconnects from the network, and takes the portable compter on a trip. While on the trip and off the network, the ser contines to edit the docments saved earlier in My Docments. Implementing Making Offline Files Accessible to a Portable Compter Example In this sitation, the docments are simltaneosly saved to a network location and cached to the local compter in a process that is transparent to the ser. This action takes place becase the network folder is configred to be available offline. This configration creates a copy of the network folder s contents on the local compter. The ser can then access the data offline. By combining Offline Files with Folder Redirection, yo can keep ser data files backed p and secre on a centrally managed server. If a folder is both redirected and set to offline, that folder receives the benefits of being secre on a server drive, accessible by any compter the ser logs on to, and remains available on the ser s compter even if the network becomes inaccessible. Retrning to the Corporate Network In this example, the ser who ses a portable compter retrns to the office and logs on to the network. Becase the ser made changes to files while working offline, a reminder ballon appears over the notification area showing that the changed files are being synchronized with the network files. In this sitation, IntelliMirror technology identifies that the data in My Docments has changed and atomatically pdates the version on the network. User Data Management and User Settings Management technologies are sed to allow sers to work on files offline and atomatically pdate network versions of those files when they later reconnect to the network. Offline Files allows sers to work on network files when not actally connected to the network. The Synchronization Manager coordinates synchronization of any changes between the offline version of a file and the network version. Synchronization Manager helps yo manage the mltiser se of network files. If mltiple sers modify the same network file, IntelliMirror notifies the sers abot the conflict and offers several resoltion methods. The ser can save the network version, the local version, or both versions. If both versions are to be kept, the ser is asked for a new file name to store one of the versions. Setting p a Shared Compter Environment Example Users work in a department, sch as a call center or IT spport environment, where they se different compters from day to day. A ser is working on a docment late one night when the shift ends. The ser saves the docment and logs off the compter. The next day the ser logs on to a different compter and connects to the network. The desktop has the same appearance and configration as the compter sed the previos night. The ser resmes working on the same docment that was saved in the My Docments folder the previos night.

14 14 Chapter 1 Planning a Managed Environment Implementing Setting Up a Shared Compter Environment Example A ser s desktop was configred to se Roaming User Profiles so that a copy of the ser s working environment was stored on a network server. When the ser logged onto the compter, the ser s existing preferences, shortcts, and docments were copied to the local compter. The ser was able to contine working as if sing the original compter. A variation of this example is when one ses Roaming User Profiles in conjnction with Folder Redirection. This approach saves downloading time becase the redirected folders do not need to be copied down to each compter. Users can have the same work environment and access to the same docments from any compter on the network. Changes that the ser makes on one compter are synchronized with the other compter the next time the ser logs on. Replacing a Compter Example The compter that a ser is working on sddenly has a complete hardware failre. The ser calls the technical spport, and a new compter with only the Windows XP operating system installed arrives. Withot frther technical assistance, the ser plgs in the new compter, connects it to the network, starts it, and can immediately log on. The ser finds that the desktop has the same configration as the compter it replaced the same color scheme, screensaver, application icons, shortcts, and preferences. More importantly, all the ser s data files have been restored. Implementing the Replacement of a Compter Example IntelliMirror helps the ser qickly get a compter installed and rnning with a minimm of spport becase data and settings are stored independently of any specific compter. By sing Roaming User Profiles, Folder Redirection, and Grop Policy, yo can make the ser s data, settings, and applications available wherever the ser logs on to the network. In this example, the soltion is not limited to getting the ser a new compter. Instead, the ser cold also move to another compter in the office becase all of the ser s data, settings, and environment are mirrored on the network. The featres of IntelliMirror can be sed separately or combined to address the range of needs, from minor configration changes and pdates to complete disaster recovery. This example only addresses IntelliMirror featres. In this case, the spport department shipped a compter that was preloaded with Windows XP Professional. However, by sing RIS, it is also possible to send ot compter hardware that has not been preloaded or configred. In that case, RIS can install Windows XP Professional after the compter is on site. Implementing a Cstomized Home Page URL for all Domain Users Example Yo are an administrator and yo want to stiplate that the home page in Internet Explorer is configred to se the URL address of yor organization s intranet home page for all domain sers. Implementing the Cstomized Home Page Example In this example, a GPO is created, and policy settings are defined to se a cstomized home page URL. The GPO is linked at the domain level to ensre it applies to all sers in that domain.

15 Overview of Deploying a Managed Environment Process 15 Managing Desktops in Non Active Directory Environments The availability of configration management tools and featres differs depending on whether yor network operates exclsively in an Active Directory environment or in another network environment. In a non Active Directory environment, yo can se other tools, sch as Microsoft Systems Management Server (SMS) for managing software distribtion, the Internet Explorer Administration Kit for managing Internet Explorer settings, and System Policy (for Windows 95, Windows 98, and Windows NT 4.0) for managing registry-based settings. In addition, each local compter rnning Windows 2000, Windows XP Professional, Microsoft Windows XP 64-Bit Edition, or a Windows Server 2003 operating system has exactly one local Grop Policy object (LGPO), even if it does not participate in a domain. Althogh it is possible to set a variety of settings by sing the LGPO, the System Policy scales more easily to a large nmber of clients. The LGPO can be sefl if yo only need to apply certain settings to a small nmber of clients rnning Windows XP in a Windows NT 4.0 domain. Note that a local GPO does not spport Folder Redirection or Grop Policy based Software Installation, and some secrity settings are not available in local GPOs. Table 1.2 smmarizes how desktop management tools differ between Active Directory and non Active Directory environments. Table 1.2 Desktop Management Tools and Featres in Active Directory and Non Active Directory Environments Management Task Active Directory Non Active Directory Configre registry-based settings for compters and sers Manage local, domain, and network secrity Centrally install, pdate, and remove software Manage Internet Explorer configration settings after deployment Administrative templates deployed by sing Grop Policy Administrative templates, deployed sing local Grop Policy object (LGPO) Secrity settings deployed by sing Grop Policy Secrity Settings deployed LGPO SMS Grop Policy based software distribtion Internet Explorer Maintenance in the Grop Policy Object Editor snap-in Internet Explorer Maintenance deployed by sing LGPO Internet Explorer Administration Kit (IEAK) System Policy LGPO LGPO SMS LGPO IEAK (contined)

16 16 Chapter 1 Planning a Managed Environment Table 1.2 Desktop Management Tools and Featres in Active Directory and Non Active Directory Environments (contined) Management Task Active Directory Non Active Directory Apply scripts dring ser logon/logoff and compter startp/shtdown Centrally manage sers folders and files on the network Centrally manage ser settings on the network Logon/logoff and startp/shtdown scripts can be centrally configred in Grop Policy or independently by sing the LGPO Folder Redirection in conjnction with Offline Files and Folders Roaming User Profiles LGPO System Policy Maniplation of registry settings Roaming User Profiles (for Windows domains) Developing a Deployment Plan To se the IntelliMirror technologies for managing configrations effectively, yo mst develop a plan that defines the resorces to be managed and the management processes to be implemented. To ensre the sccess of yor deployment of the technologies for managing configrations, yo need to do the following: Analyze yor organization s crrent configration management process. When yo develop yor configration management infrastrctre, determine how yor organization crrently manages its compting environment. Determine goals for yor managed environment deployment. As yo begin yor design process, establish the criteria that define the sccess of yor managed environment project. The bsiness reqirements of the varios organizational grops of sers may differ, and sccess, therefore, means different things to each grop. For example, a system administrator might consider a project sccessfl if it reslts in a redction in the ten most common spport calls, althogh for a department manager, sccess incldes increased ser prodctivity. It is important that yo set achievable and measrable goals, and that yo review them periodically to track yor progress. Design yor soltion for configration management by sing the IntelliMirror technologies to meet yor bsiness reqirements. Follow a process to implement a configration management infrastrctre. Analyze yor bsiness reqirements, service level agreements, secrity, network, and IT reqirements, and then determine the appropriate technologies to se to meet yor reqirements. By following the gidelines in this book for designing yor configration management infrastrctre, yo can establish the approach that best sits yor organization s needs.

17 Defining the Scope of Yor Configration Management Project 17 Create a configration management team. The majority of change and configration management deployments are likely to have cross-fnctional bondaries, so as part of preparing yor deployment, it is important to conslt with varios fnctional teams in yor organization and ensre they participate dring analysis, design, test, and implementation phases as appropriate. A recommended option is to se the Microsoft Soltions Framework (MSF) team model. In the MSF model, small mltidisciplinary teams are created, and team members share responsibilities to focs on the project. Yo can align yor team with the MSF model by inclding the six roles in the change and configration management design team. Prodct Management. Ensres the goals of the project are met. Program Management. Facilitates the team and manages resorces. Development. Designers and implementers of the CCM infrastrctre. Testing. Ensres all isses are known before the release of the design. Logistics Management. Treats physical reqirements of the deployment. User Edcation. Designs ser and team training materials. For more information abot the Microsoft Soltions Framework Team Model, see the Microsoft Soltions Framework link on the Web Resorces page at Defining the Scope of Yor Configration Management Project It is important to identify both the organizational and the technical scope for yor configration management deployment. The primary prpose is to deploy a configration management infrastrctre to meet the needs of a defined set of sers and to manage a clearly defined compting environment. Defining the scope is important both to set ser expectations and concrete goals for the project. Organizational Scope To nderstand the configration management reqirements of an organization, yo need to identify the organizational strctre and determine organizational goals. Yo can create a map of yor organization to show a representation of its logical hierarchy (an organizational chart). This chart is sefl as an inpt to the design process as it defines natral bondaries within the bsiness, which might fnction as separation points in the se of IntelliMirror technologies. The breakdown of the organization s resorces incldes all levels of job roles. Use the job roles as inpt when yo categorize sers by job type.

18 18 Chapter 1 Planning a Managed Environment Resorces to be Managed The technical scope for deploying a configration management infrastrctre involves all compting resorces to be managed, inclding hardware and software. It is sefl to develop a diagram of the network to serve as a logical representation of servers and services within the network. Work with the network administrators and the Active Directory deployment team to obtain this information. The diagram needs to illstrate the following information: Location of domain controllers and member servers Site configration Link speed within and across sites Servers that provide specific services, sch as Domain Naming Services (DNS) and DHCP Interfaces with infrastrctre elements otside the scope of configration management, sch as firewalls, networking eqipment, and systems rnning other operating systems Use the network diagram to indicate which components of the compting environment are to be managed by the configration management infrastrctre and which components are to remain nmanaged. Assessing Yor Crrent Environment Assessing yor crrent environment is the first step toward identifying how IntelliMirror can meet yor desktop management needs. To identify the areas where IntelliMirror can provide the most benefit for yor organization, examine how yo perform yor desktop management tasks. For example, evalate how yor IT staff handles common desktop management sitations sch as the following: New applications that need to be made available to sers as qickly as possible. Users who move from one location to another and mst retain access to their primary applications and data even on a different compter. Users who travel freqently and have intermittent network access, sometimes over slow links. New employees who reqire a newly configred compter that incldes all their reqired applications. Users who receive new compters and need to have an operating system installed, along with their applications and data.

19 Assessing Yor Crrent Environment 19 Use this process as a starting point to define the tasks yor IT grop performs for configration management. Yo need to determine: How yor organization crrently performs the tasks associated with change and configration management How yor organization crrently manages desktops After yo determine how yor organization manages desktops, yo can create a flowchart or table to identify the most common and freqently occrring desktop management tasks that yor IT department performs. Evalating Yor Desktop Management Processes Analyzing yor crrent configration management processes helps yo to identify ways yo can improve service and redce yor total cost of ownership (TCO). Yo need to assess yor desktop environment and evalate the crrent methods yor organization ses for installing operating system, applications and service packs. Yo also need to evalate the backp processes in place and determine the level of secrity to provide for desktops. For a worksheet to help yo evalate yor desktop environment, see Worksheet A.4 Assessing Yor Crrent Desktop Environment (DMEUSE_4.doc) on the Microsoft Windows Server 2003 Deployment Kit companion CD (or see Worksheet A.4 Assessing Yor Crrent Desktop Environment on the Web at Large organizations typically spport hndreds of software applications as well as mltiple versions of operating systems. To help redce the cost associated with client compting, yo can implement standards for corporate-wide software sch as virs protection, , word processing, and spreadsheets and then retire obsolete or nnecessary software. To develop yor client application standards, examine the operating system types and the versions yor organization has installed, the commercial applications yor organization ses (sch as word processing software), and the line-of-bsiness applications that yor corporation has developed for tasks sch as managing clients or filling orders. For a worksheet to help yo assess yor organization s software standards, see Worksheet A.5 Evalating Software Standards (DMEUSE_5.doc) on the Windows Server 2003 Deployment Kit companion CD (or see Worksheet A.5 Evalating Software Standards on the Web at

20 20 Chapter 1 Planning a Managed Environment Evalating Compter and User Roles It is recommended that yo configre a ser s environment according to the ser s job or role in the organization. Yo can then specify the secrity and other configration settings for different types of compters sch as member servers and desktops. The Grop Policy settings yo define for each grop of sers and compters shold be based on their bsiness reqirements. Domain controllers and member servers If yo have different types of member servers, sch as Microsoft Exchange 2000 Server, terminal servers, or file and print servers, it is likely that yo need to define and create different Grop Policy objects to configre the settings on each type of server. For example, when managing terminal servers, yo need to ensre that yo apply ser settings Grop Policy based on the compter that the ser logs on to. To achieve this, consider sing the Grop Policy setting for loopback policy processing. (The User Grop Policy loopback processing mode policy setting is an advanced option that applies ser settings based on the location of the compter object.) To simplify trobleshooting and problem solving, place the domain controllers and the different types of member servers into separate organizational nits and allocate Grop Policy objects accordingly. Desktops Different compters reqire different policy settings based on their roles. To spport these differences, yo need to create Grop Policy objects that configre each compter according to its role. To se IntelliMirror to create configrations for compters, yo need to consider things sch as whether a given compter is configred to allow mltiple sers to log on. Yo also need to determine if the compter retains or discards ser profiles between ser sessions and if the compter provides local storage space for copies of offline files. Categorizing Users by Job Types and Location Categorizing sers in yor organization according to their job reqirements, compter experience, and location is an important part of the process of developing Grop Policy objects for managing the varios desktop configrations sers reqire. Several ser types can be sed to describe the majority of job roles in most organizations. Every ser has specific job-based needs for data management, and sers often have mltiple roles. For example, a high-performance ser might also perform the tasks of a knowledge ser. For each ser category, consider what type of configration options to allow sers to make on their compters. Determine if sers shold rn with User or Power User privileges, whether sers can install software, or make desktop configration changes. For example, yo might allow highperformance sers to change the desktop colors, and yo probably want to prevent data-entry workers from making any desktop configration changes.