Adventures in home working

Boot volume security has previously relied on third party products, that have a lot of limitations for example support for suspend and hibernation, and general concerns over stability and management.   Secure startup in Longhorn for the system volume combined with EFS for data volumes looks like a very promising solution for security, negating the reliance on either physical security and/or third party solutions.  By building it deep into the OS stability issues should be a thing of the past as well (at least lets hope so).   It will be interewsting to see what the performance implications are,  but you can imagine this being a must have for portables that have a TPM chip (note to anyone specifying corporate laptops – make sure it has TPM 1.2 chip!!).  I assume this will kill off dual-boot and ironically might make Linux live distro’s acceptable, as they cann’t be mis-used.

Here is a bit more information from Microsoft, and the attachment provides further details:

Secure Startup – FVE prevents access to files on the system volume when the operating system is shut down by encrypting the system volume and storing the key required for decryption inside the Trusted Platform Module. During the startup process the Trusted Platform Module verifies the integrity of the Windows operating system before allowing it to access the key required to decrypt the system volume.

The integrity of the Windows operating system is verified by fingerprinting the operating system when it is assumed to be secure and only releasing access to an operating system with a matching fingerprint. If an attacker attempted to view the files on the system volume by starting another operating system from the CD drive, the fingerprint would not match, Secure Startup – FVE would not release access, and all files on the system volume would be unreadable. This includes operating system files, application data, documents, temporary files, hibernation files, the page file, and registry data stored on the system volume.

and a bit more on the positioning wrt EFS:

Secure Startup – FVE and the Encrypting File System (EFS) work together to enhance the security of Windows. Secure Startup – FVE does not replace EFS, but files encrypted with EFS are more secure on a system that uses Secure Startup – FVE.

Secure Startup – FVE can be used to encrypt data on the system volume before Windows is started. Data stored on other volumes is not encrypted by Secure Startup – FVE. To encrypt data on volumes other than the system volume, use the Encrypting File System (EFS). EFS encrypted data can be accessed only by using keys stored on the system volume. As a result, files encrypted with EFS are more secure on a system with Secure Startup – FVE enabled even when those files are not located on the system volume. EFS can also be used to encrypt data on the system volume after the operating system is running.

WDS replaces RIS and adds the following:

Windows Deployment Services for Windows Server “Longhorn” Beta 1 includes several modifications to RIS features. These modifications support the deployment of Microsoft Windows Code Name “Longhorn” and Windows Server “Longhorn” operating systems. These changes include the following:

·      Native support for the Windows PE as a boot operating system.

·      Native support for the Windows Imaging (WIM) format.

·      An extensible and higher-performing PXE server component.

·      A new boot menu format for selecting boot operating systems.

·      A new graphical user interface you can use to select and deploy images.

For more details check out the attachment.

One of the big plus factirs for Citrix Presentation Server has always been support for seamless windows, well longhorn server will have a simillar capability:

Remote Programs are programs that are accessed remotely through Terminal Services and behave as if they are running on the end user’s local computer. Users can run Remote Programs side-by-side with their local programs. If a user is running more than one remote program on the same terminal server, Remote Programs will share the same Terminal Services. For Beta 1, in order to enable Remote Programs you will need to create and distribute an .rdp file.

Check out the attachment for more details

This has existed in Small Business Server for a while, and I considered deploying SBS in my home lab for this reason alone,  but this is a grown up implementation.  It will take a bit more reading to see how it compares to Citrix and Tarentella’s alternative solutions.  For more info check out the attachment!

What is a TS Proxy?

Microsoft Windows Terminal Services Proxy (TS Proxy) acts as a gateway that allows users within your enterprise to log on to terminal servers from anywhere on the Internet, using RDP over HTTPS. TS Proxy allows you complete control of network resource security by allowing you to create fine-grained network access policies (NAPs) and resource access policies (RAPs), granting specific users and groups access to specific servers.

For anyone who has fought – and in my case given up trying - to use offline files, Longhorn seems to have made some major improvements.  I use RoboCopy for all of my synching because it lives up to its name “Robust” but easy its not!  Here are some of the highlights, for more info check out the attachment:

·      You can transition the Offline Files status to “online” without waiting for all cached files to be synchronized. For example, if you have Offline Files configured on a notebook computer and have been working offline, you can connect to the network and change your working status to “online” without waiting for all of your Offline Files to completely synchronize.

·      If you have open file handles on your local computer when connecting to the network, the open file handles will be converted to file handles on the server without requiring you to close the files. For example, you could have a file open in Microsoft Word when you reconnect to the network. Rather than being prompted to close the file before synchronizing, the file handle will transition to the server and you can keep the file open in Word without issue.

·      In Microsoft Windows® XP, if a single file cannot be synchronized then the entire server is considered offline and no shares on the server can be accessed, whether these shares are cached in local store or not. In “Longorn” versions of Windows operating systems, file availability is determined at the individual file level. If a single file is unavailable, yet other files in the same share and other shares are available, those files will still be available online. This provides better interoperation with the Distributed File System (DFS).

·      Sync Manager is improved in Windows Server “Longhorn.” New features include reporting synchronization errors, listing the files with errors, and providing multiple options for resolving synchronization conflicts when files have been modified offline.

·      The property page for any file or folder has an Offline Files tab that provides status and allows control of the offline status of the file or folder. To access this page, right click a file or folder, click Properties, and then click the Offline Files tab. Offline Files can be enabled by policy on the client. A Group Policy object (GPO) can be set to create a share or to make a path available offline. If Folder Redirection (Intellimirror) has been deployed, then Offline Files are automatically enabled. Folder Redirection applies the GPO to the My Documents folder after redirecting the folder to a server.