Microsoft Ignite 2015 4/16/2017 3:59 PM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Managing Windows 10: Back to Basics Microsoft Ignite 2015 4/16/2017 3:59 PM BRK2337 Managing Windows 10: Back to Basics Heike Ritter Product Marketing Manager, Microsoft Samesh Singh Architect, Microsoft © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows offers the management features that businesses need. 4/16/2017 Windows offers the management features that businesses need. © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/16/2017 Business needs are evolving. Windows 10 offers management choices to meet those needs. © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What needs to be managed Management My Personal Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device

Management Options IDENTITY GROUPING Active Directory Microsoft Ignite 2015 4/16/2017 3:59 PM Management Options IDENTITY GROUPING Active Directory Domain join | Workgroup Azure Active Directory Azure AD join MANAGEMENT Group policy New GPOs | AGPM scripting ConfigMgr MDM policies via WMI bridge MDM New configuration | Initial provisioning Exchange Active Sync Powershell | WMI © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Management Features 4/16/2017 Windows Management Features Products System Center Configuration Manager Microsoft Desktop Optimization Pack (MDOP) Cloud Services Azure Active Directory Azure RMS Microsoft Intune Windows Store Windows Update Windows Server Active Directory Group Policy Windows Server Update Services (WSUS) Windows Client Windows Management Instrumentation (WMI) Windows Remote Management (WinRM) Windows Update Group Policy Client Mobile Device Management (MDM) PowerShell AppLocker © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Identity Management My Personal Data My Corporate Data My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device

Windows 10 Identity Choices 4/16/2017 Windows 10 Identity Choices Active Directory Azure Active Directory Computer joins AD to establish trust User signs on using AD account Group Policy + System Center Computer joins Azure AD to establish trust User signs on using Azure AD account Intune/MDM Settings roaming Single sign-on to enterprise + cloud-based services © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Common Identity Cloud Identity Synchronized Identity Independent cloud identity Microsoft Azure Active Directory Active Directory Directory Sync and Password Sync Synchronized Identity  Single identity, enabling a same sign-on experience with password hash sync Microsoft Azure Active Directory Federated Identity Active Directory Directory Sync Single federated identity, enabling single sign-on in some scenarios and additional flexibility Microsoft Azure Active Directory Federation

Demo Sign in with Azure Active Directory Microsoft Ignite 2015 4/16/2017 3:59 PM Demo Sign in with Azure Active Directory © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Client Management My Personal Data My Corporate Data Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device “Deploying Windows 10: Back to Basics” by Tim Mintner

WMI and WinRM Disk Network Service Process Operating System Microsoft Ignite 2015 4/16/2017 3:59 PM WMI and WinRM Disk Network Service Process Operating System WMI Service WMI Repository (Database) Management Applications Scripts WMI Providers & Managed Objects COM/ DCOM WMI Infrastructure COM/ DCOM WMI Consumers © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

PowerShell Get-help Get-item Start-Service Restart-Computer Microsoft Ignite 2015 4/16/2017 3:59 PM PowerShell Get-help Get-item Start-Service Restart-Computer ipconfig | select-string -pattern 255 get-service get-service | get-member cmdlets Windows Commands & Utilities Objects Object Pipelines © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Querying system information using PowerShell and WMI Microsoft Ignite 2015 4/16/2017 3:59 PM Demo Querying system information using PowerShell and WMI © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Diagnostics & Recovery Toolkit (DaRT) Disk and File Administrative Recovery Disk and File Administrative Recovery Disk Commander Disk Wipe Explorer File Restore Search SFC Scan Crash Analyzer Defender Locksmith Hotfix Uninstall Disk and File Administrative Recovery Disk and File Administrative Recovery Computer Management Registry Editor TCP/IP Config Remote Connection

Applications Management My Personal Data My Corporate Data My Personal Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device “Preparing for Windows 10 Deployment: Application Compatibility and Planning” by Michael Niehaus

Business store Flexible app deployment Support for any organization 4/16/2017 Business store Flexible app deployment Online, offline, or included in images Through the store, via MDM, or using System Center LOB apps can be kept private Support for any organization Teacher and classroom Small businesses and other organizations Large enterprises Simplify via convergence One store, one Dev Center, one Business Store Portal Universal apps across all device types Reconciled sideloading processes © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Business Store Portal Scenarios 4/16/2017 Business Store Portal Scenarios Online Offline All org users need Azure AD accounts Installation files managed and deployed by the Windows Store Licenses tracked by the Windows Store Updates installed via Windows Update Org users do not need Azure AD accounts Installation files are downloaded and deployed using org’s infrastructure No license tracking Updates installed via Windows Update Private Store MDM / ConfigMgr (deep links) Direct Assignment Imaging MDM / ConfigMgr (sideload) Manual © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

App-V App-V Client System Center 2012 Configuration Manager App-V Microsoft Ignite 2015 4/16/2017 3:59 PM App-V App-V Client System Center 2012 Configuration Manager App-V Streaming Infrastructure Sequencing Application installer © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Sequencing and streaming a desktop app using App-V

User Settings Management My Personal Data My Corporate Data Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device “Better Dynamic Application Delivery Through App-V and UE-V” by Aaron Ruckman

User Profile %userprofile% Application Generated Content User Generated Content Machine Dependent Roaming User Profiles Offline Files User Experience Virtualization Machine Independent Folder Redirection AppData Local Low Local Roaming NTUSER.DAT

Local Settings Package Microsoft Ignite 2015 4/16/2017 3:59 PM UE-V Windows Instance 1. App Settings 2. Agent Hook 1 4 3. Settings Package Sync 2 3 Registry 4. Settings Apply/Collect Network File Server Local Files Local Settings Package Remote Settings Package Agent Settings Location Template UE-V Service © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

UE-V GPOs Templates Setting store UE-V Agent

Demo Roaming app settings with UE-V

User Data Management My Personal Data My Corporate Data My Personal Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device

Information protection journey 4/16/2017 Information protection journey DEVICE PROTECTION BitLocker enhancements in Windows 8.1 InstantGo 3rd party adoption Protect data when device is lost or stolen © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

MBAM Client Portals Web Services SQL DBs Compliance GPO Microsoft Ignite 2015 4/16/2017 3:59 PM MBAM Client Portals Web Services SQL DBs Compliance GPO HelpDesk Portal Admin Web Service Compliance and Audit SSRS MBAM Client and BitLocker Self Service Portal Self Service Web Service Recovery Reporting Web Site Recovery Web Service Reporting Web Service “Improving Data Protection and Security Compliance with BitLocker and MBAM” by Lance Crandall © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Information protection journey 4/16/2017 Information protection journey DEVICE PROTECTION DATA PROTECTION THE GAP BitLocker enhancements in Windows 8.1 InstantGo 3rd party adoption Protect data when ….. Rights Management Services (RMS) Office Information Rights Management (IRM) Azure AD, Azure Rights Management in 2013 3rd party solutions Accidental/intentional data leakage © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

IN A CLOUD & MOBILE WORLD DATA PROTECTON IN A CLOUD & MOBILE WORLD REQUIRES Protection everywhere (at rest, in transit, across devices, storage location...everywhere) Enable wipe and other management fundamentals Supported by all the apps you use, fully integrated experience

Enterprise Data Protection Protects data at rest, and wherever it rests or may roam to Seamless integration into the platform, No mode switching and use any app Corporate vs personal data identifiable wherever it rests on the device Prevents unauthorized apps from accessing business data IT has fully control of keys and data IT can remote wipe data on demand Common experience across all Windows devices Cross platform support “Protecting your data with containers without boxing yourself in” by Yogesh Mehta

Enterprise Data Protection: Provisioning 4/16/2017 Enterprise Data Protection: Provisioning User enrolls with enterprise MDM or domain join User 1 MDM or SCCM provisions policy and encryption keys 2 Policies: Enterprise allowed apps Network policies App restriction policy © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Protecting corporate data with EDP

Enterprise Management My Personal Identity My Personal Data My Corporate Data My Corporate Identity My Personal Settings My Corporate Settings My Personal Applications My Corporate Applications Windows 10 Device

Group Policy Security Access / Connectivity Desktop OS / Application Proxy Settings Block Downloads /Installs Registry Settings Security Updates Block Control Panel Microsoft Passport PIN Access / Connectivity Identity Access Rights VPN Settings DNS Settings Wireless Settings Roaming Profiles Desktop OS / Application Win32 app mgmt Disable Screensavers Lock Background Printer Settings Drive Mapping Start screen Start Menu UApp Mgmt Internet Explorer Settings Block Websites Block IE Updates Company Logo on IE Clearing Cache Security Settings Firewall Settings Spartan browser Power Management Hibernation Settings

Advanced Group Policy Management (AGPM) Fully integrated into the GPMC Offline Editing Delegation of Administration GPO Change Management Group Policy Preferences GPO Deployment process GPO Settings Report and Comparisons GPO Disaster Recovery PowerShell Cmdlets to allow routine AGPM tasks to be automated and executed from the console View controlled GPOs, Control, Check In, Check Out, Undo Check Out, Delete from AGPM, Deploy

Microsoft Ignite 2015 4/16/2017 3:59 PM AppLocker Rules based on file attributes (publisher name (derived from the digital signature), product name, file name, and file version Rules based on the file path and hash Rule assigned to a security group or an individual user Exceptions to rules Audit-only mode to deploy the policy and understand its impact before enforcing it Windows PowerShell cmdlets for AppLocker © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Configuring AppLocker Microsoft Ignite 2015 4/16/2017 3:59 PM © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Configuration Manager Asset Management & Support Application Management Device Management Operating System Deployment Out of Band Management Point Remote Control Inventory Enterprise Device Management Mobile Device Management Application Catalog Web Service Point Application Catalog Website Point Asset Intelligence Synchronization Point Software Update Point State Migration Point PXE Boot Microsoft Intune Connector Endpoint Protection Point Software Update Point System Health Validation Point Internet-Based Client Management Certificate Registration Point Enrollment Management Distribution Fallback Status Role Based Administration Reporting Services Database

Exchange ActiveSync Disable desktop ActiveSync Disable removable storage Disable camera Disable SMS text messaging Disable Wi-Fi   Disable Bluetooth Disable IrDA Allow internet sharing from device Allow desktop sharing from device Disable POP3   /IMAP4   email Allow consumer email Allow browser Allow unsigned applications Allow unsigned CABs Application allow list Application block list Require signed S/MIME messages Require encrypted S/MIME messages Require signed S/MIME algorithm Require encrypted S/MIME algorithm Allow S/MIME encrypted algorithm negotiation Allow S/MIME SoftCerts Device encryption Minimum number of complex characters Configure message formats (HTML or plain text) Include past email items (duration) Email body truncation size HTML email body truncation size Include past calendar items (duration) Require manual sync when roaming

Mobile Device Management 4/16/2017 Mobile Device Management Significant investments in added functionality for both mobile and desktop devices Fully managed corporate device Phone Desktop Device Lockdown Phone Desktop BYOD: simple security settings Windows 8.1 Windows 10 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

APPLICATION MANAGEMENT DEVICE CONFIGURATION AND SECURITY MDM in Windows 10 Un-enrollment in two phases & alerts Removal of Enterprise configuration (apps, certs, profiles, policies) and Enterprise encrypted data (with EDP) ENROLLMENT INVENTORY APPLICATION MANAGEMENT DEVICE CONFIGURATION AND SECURITY REMOTE ASSISTANCE UNENROLLMENT Provisioning Bulk enrollment Simple bootstrap Converged protocol Azure AD Integration One consistent set of MDM capabilities across Mobile, Desktop, and Embedded products Full device wipe Remote Lock, PIN reset, Ring, Find Enhanced inventory for compliance decisions Additional device inventory Curated Windows Store Business Store Portal app deployment; License reclaim/re-use Enterprise App management Simplified LOB app management Win32 app management App inventory (MDM/store apps) App allow/deny lists through Applocker Enterprise data protection Greatly extended set of policies (Parity with Windows Phone 8.1) Context based policies Client certificates – Direct install (PFX) Enterprise Wi-Fi VPN management Email provisioning MDM Push when user not logged in Device Update control Kiosk Mode, Start screen / Start menu configuration and control “Windows 10 Mobile Device Management in Depth” by Janani Vasudevan

Microsoft Intune User Mobile device management Mobile application management PC management IT Intune helps organizations provide their employees with access to corporate applications, data, and resources from virtually anywhere on almost any device, while helping to keep corporate information secure.

Demo Enrolling a Windows device in Microsoft Intune Microsoft Ignite 2015 4/16/2017 3:59 PM Demo Enrolling a Windows device in Microsoft Intune © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Quality-Based Releases Time Enterprise-ready Current Branch for Business Long Term Servicing Branch Current Branch Hundreds of millions Broad External Flights Several million Limited External 100’s of thousands Broad Internal Validation 10’s of Engineering Builds # Users “Getting Ready for Windows 10: Servicing Windows Client and Server in a managed Environment Today”

Windows as a Service Long Term Servicing Branch Mission–critical ready Current Branch for Business Up to date with the latest innovation Receive security updates regularly; no new features Similar to what you have today with Windows 7 SP1/Windows 8.1 Your mission critical environments are supported with no change in functionality for duration of mainstream and extended support (5+5 years) You control deployment of patches using WSUS You are able to use in-place upgrade to move from one LTSB to another Update your devices frequently with latest features New enterprise deployment option for Windows 10 Your devices can take advantage of the latest innovation on an ongoing basis Features are released first to tech enthusiasts and Windows Insiders and validated prior to getting installed on your business devices You have several months to plan and test the updates You choose how you want the devices to be updated: Via Windows Update - reducing your management costs Via WSUS using traditional mechanics

Management Choices Available Choices Identity Management Updates 4/16/2017 Management Choices Available Choices Identity Active Directory; Azure Active Directory Management Group Policy, System Center Configuration Manager, 3rd party PC management; Intune, 3rd party MDM Updates Windows Update; Windows Server Update Services (WSUS); Intune, 3rd party MDM Infrastructure On-premises or in the cloud Ownership Corporate-owned, CYOD; BYOD Organizations may mix and match, depending on their specific scenario © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Management Choices Basic Lightweight Full Control Exchange ActiveSync 4/16/2017 Management Choices Exchange ActiveSync Basic Windows Update BYOD (personal) devices E-mail access only Active Directory and/or Azure Active Directory Mobile Device Management Lightweight Windows Update/MDM Company-owned and BYOD devices Internet-facing or corporate network Active Directory Group Policy System Center Full Control WSUS Company-owned devices Corporate network © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows 10 Works with Existing Infrastructure 4/16/2017 Windows 10 Works with Existing Infrastructure Product Supports Windows 10 Management Supports Windows 10 Deployment System Center 2012 R2 Configuration Manager System Center 2012 Configuration Manager System Center Configuration Manager 2007 Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 Microsoft Deployment Toolkit 2013 Updates will be required. New OS features may require newer versions for full support. © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session 4/16/2017 3:59 PM Please evaluate this session Your feedback is important to us! Visit Myignite at http://myignite.microsoft.com or download and use the Ignite Mobile App with the QR code above. © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/16/2017 3:59 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.