You’re going to see quite a few questions on the exam that involve understanding what is and is not applicable to a specific type of connection protocol. These protocols are required to configure and complete remote authentication and thus verify that the user who wants to connect is actually the one you want connecting. Before we move forward, make sure you are familiar with the following protocols.

Authentication protocols

Clients must be authenticated before they can access network resources. Here are the most common authentication protocols:

• PAP. This protocol is the least secure and uses plaintext passwords. It is used as a last resort when other authentication methods can’t be negotiated. It’s not enabled by default on a Windows 8–based client and is not considered secure.

• CHAP. The protocol uses a three-way handshake between the client and server using a key for encryption. This is best used for legacy connections and is better than PAP, but other methods are preferred.

• MS-CHAP v2. This protocol uses a two-way mutual authentication and is stronger than CHAP. Still, better protocols exist, including EAP.

• EAP-MS-CHAPv2. This protocol authenticates using EAP. EAP offers the strongest and most flexible security option. With it, authentication can be negotiated using something other than passwords, including certificates and smart cards. This is the default selection for new connections on Windows 8–based machines.

You can explore these protocol and authentication options from a VPN connection’s Properties dialog box. An example is shown in Figure 5-1.

Figure 5-1. Explore protocol and authentication options from a VPN connection’s Properties dialog box.

More Info: Learn more about Remote Assistance and Netsh

Remote Assistance is covered in Chapter 3. Netsh is also covered there. Refer to Chapter 3 to learn more about these two technologies.

Exam Tip

IKEv2 supports VPN Reconnect. PPP, PPTP, SSTP, and L2TP do not. EAP supports smart cards. Other authentication protocols do not. If you want to use a preshared key, you have to choose L2TP/IPsec. DES and 3DES and IKE are used with L2TP.

You learned how to use Remote Desktop in Chapter 3, and you also learned how to make configuration choices in the Remote Desktop Connection dialog box and the available tabs there (General, Display, Programs, Experience, Advanced). Here you’ll learn a bit more about the technical aspects of Remote Desktop.

The Remote Desktop Protocol (RDP) is the protocol used to connect workers to their desktops when they are away from them, perhaps when they are at home or in a hotel. Additionally, Remote Desktop is used by network administrators to remotely administer computers and servers, often from another company computer in the same building or in another one close by. Users can connect to a remote desktop from almost any type of computer, including those running Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, or Windows RT. The computer that is the host must be running Windows XP Professional, Windows Vista Enterprise, Windows Vista Ultimate, Windows Vista Business, Windows 7 Ultimate, Windows 7 Enterprise, Windows 7 Professional, Windows 8 Pro, Windows 8.1 Pro, Windows 8 Enterprise, or Windows 8.1 Enterprise.

You can open the Remote Desktop Connection dialog box by typing mstsc.exe at a command prompt. You can see both in Figure 5-2.

Figure 5-2. Use the command-line tool mstsc.exe to open Remote Desktop.

There are parameters you can use with the command mstsc.exe when using Remote Desktop:

You can create a VPN from the Network And Sharing Center by clicking Set Up A New Connection Or Network. In the resulting dialog box, choose Connect To A Workplace and click Next. Once there, you choose how to create the VPN: Use My Internet Connection (VPN) or Dial Directly. See Figure 5-3.

Figure 5-3. Create a VPN connection in the Network And Sharing Center.

In the resulting dialog box you do the following:

You’ll see the connection in the Networks pane, shown in Figure 5-4. To activate the connection, click it and input the required credentials. The connection will be made.

Figure 5-4. The VPN connection appears in the Networks pane.

Now you can configure the properties for the VPN using its Properties dialog box, available from the Network Connections window in Control Panel. The options enable you to perform tasks including but not limited to the following:

When a user connects to a remote site using a VPN and that connection is lost, the user has to reconnect. This is an annoyance for users because it distracts them from their work and takes time. Additionally, with the prevalence of working via broadband and free Wi-Fi on the road, in subways, through tunnels, and on trains, service disruptions can happen frequently. When possible, it’s best to use and configure VPN Reconnect for your remote users.

To enable VPN Reconnect—and remember that this feature is only available if IKEv2 is used as the VPN protocol—follow these steps:

Some users have mobile devices that let them connect to the Internet when traditional options are unavailable. Traditional options include free and personal Mi-Fi networks, VPNs, workgroup and domain networks, broadband connections from ISPs, and connections to networks via Ethernet. When these options are unavailable, the user can opt for a built-in or personal cellular or metered broadband connection option or for another person’s shared Internet connection.

Windows 8.1 comes with built-in support for these newer connectivity models. For instance, any Windows 8.1 user can connect to a shared personal hotspot provided she has the required credentials. The connection is made through the traditional Networks pane used to connect to all other networks. Users can use that pane to disconnect as well. Figure 5-6 shows the Networks pane where the connected network is a shared personal hotspot. Note that the user can also opt to show usage for metered connections (from PC Settings, detailed next).

Figure 5-6. Use the Networks pane to connect to shared personal hotspots.

To configure the Networks pane to show the estimated usage, navigate to PC Settings, Network, Connections, and select the connection from the list. From there, enable the desired network settings. See Figure 5-7.

Some mobile devices (including those that are Long Term Evolution (LTE)–enabled) come with mobile broadband technology built in. Windows 8.1 supports this, too, and users can share these types of connections with others. This is the same as sharing a connection via a smartphone, but is provided by the mobile tablet. Users connect to the Internet using the connection they have available on their own devices, and then they can opt to share the connection with others. Again, this is done in PC Settings, Network, Connections by clicking the connection to share. Once shared, users can also change the SSID, change the password for the Wi-Fi network, and see how many people are sharing the connection. The person sharing the connection has to have purchased a data plan that supports tethering for this to work.

Figure 5-7. Configure the settings for a shared broadband connection.

Answer the following questions to test your knowledge of the information in this objective. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.

Users can connect to their desktop computers and network file servers when they are away from the office using many technologies, including connecting through VPNs and cellular connections as detailed in the first part of this chapter. Sometimes, though, no connection can be made, but this doesn’t stop the users from needing access to their work files and work folders. You can allow offline access so your users can access their data under these circumstances. You need to start by configuring Offline Files and then creating policies to manage it.

When Offline Files are enabled and configured, when the user works online files can be accessed from the network server. When the user must work offline, files are retrieved from the Offline Files folder available from the computer. A computer switches to Offline Mode when:

Administrators create policies that define the use of Offline Files, either in a domain or on the local machine. Those policies can be located in the applicable Group Policy Editor. Two policies are discussed here—enabling Always Offline mode and enabling file synchronization on costed networks—but you should become familiar with all of the Group Policy options for working with Offline Files.

To enable the Always Offline mode, use Group Policy to enable the Configure Slow-Link Mode policy setting and set the latency to 1 (millisecond). Doing so causes client computers running Windows 8, Windows 8.1, or Windows Server 2012 to automatically use the Always Offline mode. Follow these steps:

To enable background file synchronization of Offline Files for a group of users while using metered connections, use Group Policy to enable the Enable File Synchronization On Costed Networks policy setting for the appropriate GPO by following this procedure:

You can switch power plans from Control Panel, Hardware And Sound, Power Options. From there you can also configure these options:

If you aren’t already familiar with these features, take some time now to explore them. Make sure to create your own personal power plan by using the Create A Power Plan option in the Tasks pane of the Power Options window, as you might see something about that on the exam. You might also be asked to state how many minutes must pass for each of the three default plans (Balanced, High Performance, Power Saver) before the computer goes to sleep or turns off the display, when running on its battery, or when plugged in.

Additionally, and you can explore this on your own, you’ll have to know how to monitor battery usage (from the Notification area of the Taskbar and from Mobility Center) and how to use Mobility Center to change common mobility settings such as the power plan type, display brightness, and so on. Control Panel, the link to Power Options, and the Mobility Center are shown in Figure 5-9.

Figure 5-9. Review everything related to the Power Options from Control Panel.

Beyond these end-user tools for managing power, there are other power-related items on which you’ll be tested, including how to use the command-line tool Powercfg.exe to view and export power plans and configure power policies using Group Policy. Because these are less common and likely less familiar, we’ll use these pages to cover these concepts.

Use powercfg.exe

Powercfg.exe is a command-line tool you can use to configure settings that aren’t available from Control Panel or Group Policy. One of the things you can do here is to export a power management plan to a file and then import it to another computer. To get a list of the available power plans using this command, type powercfg.exe –list at a command prompt. If you haven’t yet created any custom plans, you’ll only see the three default plans that come with Windows 8.1, as shown in Figure 5-10. Choose the plan to export and note the GUID value. To export the policy, type powercfg.exe –export power.pow GUID (where this is the GUID value for the plan to export).

Figure 5-10. View power policies from the command line.

There are some other parameters you can use with Powercfg.exe, and they are listed here: http://technet.microsoft.com/en-us/library/cc748940(v=WS.10).aspx. You should review these so that you are familiar with everything that’s offered. Here are a few you might want to try now, just to get a feel for the command:

• –changename

• –delete

• –setactive

• –deviceenablewake and –devicedisablewake

Create power policies

As with practically everything else, you can use Group Policy to set policies related to the available power plans. Use the Group Policy Management Editor to navigate to Computer Configuration, Policies, Administrative Templates, System, Power Management. When you expand Power Management in the left pane you can see the additional containers: Button Settings, Hard Disk Settings, Notification Settings, Sleep Settings, and Video And Display Settings. In the right pane you can see two options: Specify A Custom Active Power Plan and Select An Active Power Plan. The available options from Windows 8.1 using the Local Group Policy Editor are shown in Figure 5-11. As with any other Group Policy, you double-click the policy to access the options to configure it.

Figure 5-11. Group policies can be configured for Power Management.

When you click one of the five nodes under Power Management, more options appear. You can control every aspect of the power options here. For instance, in the Sleep Settings node you can configure, enable, and disable the following (and more):

• Specify the system sleep timeout (plugged in)

• Specify the system sleep timeout (on battery)

• Require a password when the computer wakes (plugged in)

• Require a password when the computer wakes (on battery)

• Allow standby states (S1–S3) when sleeping (plugged in)

• Allow standby states (S1–S3) when sleeping (on battery)

Make sure to explore all of the policies in every node before continuing.

This objective focuses on configuring sync options, not on creating sync partnerships. However, you should know how to create a sync partnership anyway, so we briefly cover that here. With that done, you’ll learn how to configure sync options in Sync Center, including scheduling when syncing should happen and under what circumstances.

You can also configure Sync Settings from PC Settings, but this doesn’t have anything to do with syncing offline files. However, because it does have to do with syncing in general, we mention it for good measure. This kind of syncing is what occurs when the user logs on to multiple computers with her Microsoft account and what settings sync when she does.

You’ll also learn about a new feature in Windows 8.1, Work Folders. There are several steps to designing a Work Folder implementation in a domain, including installing Work Folders on the Active Directory Domain file server, creating security groups for those Work Folders, and creating sync shares for user data. Although that’s beyond the scope of this book, we introduce the concept here, and Work Folders is an option for end users in the Windows 8.1 Control Panel. There, users can opt to set up Work Folders (if you have set it up and configured it on the company network), if desired.

Sync Center and configuring Sync Options

To practice with Sync Center and configure options you must first create a sync partnership on a computer running Windows 8.1. To do this, navigate to a share on a different computer or file server, right-click that share, and click Always Available Offline. After that is done, on that same Windows 8.1 computer, open Sync Center. You can type Sync Center on the Start screen, if desired. You should see what’s shown in Figure 5-12. Make a note of the options on the left side before moving forward here; you can use these once syncing is configured to manage syncing. One option, Manage Offline Files, lets you view the Offline Files dialog box, where you can disable offline files, view offline files, check disk usage, encrypt your files, and more.

Figure 5-12. Open Sync Center to view and manage sync partnerships.

In Sync Center, once a sync partnership is available, you can opt to sync everything (Sync All is shown in Figure 5-12) or you can select the Offline Files folder, click Schedule (not shown), and work through the wizard provided to configure sync settings. There are two options:

• At A Schedule Time; for example, every Monday at 11 A.M. or every day at 2 A.M.

• When An Event Occurs; for example, every time you log on to your computer

Depending on your choice you can opt for more scheduling options, such as only syncing when the computer has been idle for a specific amount of time or if the computer is running on external power (and not on its battery). Figure 5-13 shows the options to schedule a time for syncing and the optional scheduling options.

Figure 5-13. You can be very specific about how and when to sync files.

Figure 5-14 shows the options that appear when you opt to trigger synchronization to coincide with a specific event. Again, there are additional scheduling options to configure (if you click More Options) and various events from which to choose, including When I Log On To My Computer.

Figure 5-14. Configure syncing to occur when trigger criteria are met.

Exam Tip

Users can force a sync from Windows Mobility Center by clicking Sync in the Sync Center box anytime they like.

Configure sync options in PC Settings

When you create and sign in with a Microsoft account, you are able to sync settings related to your Start screen, desktop, web browser, some passwords, language preferences, and so on, to servers in the cloud. Whatever you opt to sync will be applied to any computer you log on to later using that account. You configure what to sync in PC Settings, from SkyDrive and Sync Settings. These options are shown in Figure 5-15. Make sure you are familiar with what can be synced here; you might be tested on it.

Note

The name SkyDrive is changing to OneDrive and at some point the exam will also make the terminology change.

Figure 5-15. Use PC Settings to configure what settings to sync on the computers you log on to with your Microsoft account.

Work Folders

Work Folders is a new feature in Windows 8.1. Work Folders allows users to sync data from their user folder, located in their company’s domain or data center, to their device and back again. This is done automatically and is part of the file system. Before this feature was introduced, users had to be joined to the domain or were at least required to input domain credentials before syncing could occur. Now, users can retain local copies of their work files on their devices, with automatic synchronization back to the company file servers occurring behind the scenes.

There are Group Policies available for Work Folders that you as an administrator should be aware of. There are two to consider:

• From User Configuration, Policies, Administrative Templates, Windows Components, WorkFolders, you can specify Work Folders settings.

• From Computer Configuration, Policies, Administrative Templates, Windows Components, WorkFolders, you can force automatic setup of Work Folders for all users.

There is also an option end users can configure on their Windows 8.1 computers from Control Panel, Work Folders. To get to this option, open Control Panel, switch views to either Large Icons or Small Icons, and then click Work Folders. The Work Folders window appears with Set Up Work Folders available for configuring. See Figure 5-16.

Figure 5-16. Users can set up their own Work Folders from Control Panel.

For users to set up their own work folders, you have to have set up the Work Folders infrastructure required for them to have access to perform the setup tasks. A great walkthrough of the process is available at http://blogs.technet.com/b/canitpro/archive/2013/11/13/step-by-step-creating-a-work-folders-test-lab-deployment-in-windows-server-2012-r2.aspx.

Once the infrastructure is ready, when users opt to set up Work Folders they must work through the following setup tasks:

1. They must input their company email address.

2. They must wait while the wizard searches the network for their Work Folders.

3. Once the folders are found, the users must accept (or change) where the files will be saved on their computer.

4. The users must read the security policy and then accept those policies.

5. Once that is done, Work Folders appears, as a folder, in File Explorer when This PC is selected in the Navigation pane.

6. Users can now access the documents under the Work Folders location from any device, and the documents will be kept in sync by Work Folders automatically.

Note: Work Folders requirements

When using Work Folders, the client and server must be running the same milestone release for Work Folders to function properly. For example, if the server is running this milestone release of Windows Server 2012 R2, the client must be running the same milestone release of Windows 8.1.

More Info: Learn more about Work Folders

To learn more about Work Folders, refer to this article on TechNet: http://technet.microsoft.com/en-us/library/dn265974.aspx.

Windows 8–based computers can now directly connect to compatible devices one on one, using Wi-Fi Direct, without requiring an intermediary like a router or network access point. Users might use these types of connections to quickly transfer files with other workers using a computer-to-computer connection, or they might even transfer media or perform media streaming to other devices as they become compatible. Those devices might include smartphones and music players, as examples. Wi-Fi Direct might even replace Bluetooth eventually.

For now, you’ll need to use the Netsh command you learned about in Chapter 3 to pair the two devices (only one of which has to support Wi-Fi Direct). There aren’t any apps or GUIs built into Windows 8.1 for this feature yet. Once connected, the connected device will appear in PC Settings in the same way other devices do when they are connected (like smartphones).

You’ll combine Netsh with wlan and the desired parameters to connect with Wi-Fi Direct. Here are some of the available parameters you can use with Netsh wlan at an elevated command prompt:

Figure 5-17. Use the Netsh wlan command and the appropriate parameters to configure Wi-Fi Direct.

Windows To Go is a new feature that lets users run Windows 8.1 from a USB stick. They can use this on any computer that can be booted to a USB drive. It’s like having a virtual PC in your pocket. However, it does have limitations and specific requirements.

Windows To Go also has these features:

There are also a few Group Policy settings for Windows To Go. You can find those settings in Computer Configuration, Administrative Templates, Windows Components, Portable Operating System. Figure 5-18 shows this in the Local Group Policy Editor. You can enable or disable these to manage hibernation options and sleep states and to set default startup options. To learn more about these settings, double-click an option to review and read the relevant information in the Help window. The Help information for Allow Hibernate (S4) When Starting From A Windows To Go Workspace offers this: Specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. It goes on to explain that if enabled, the PC can hibernate; if disabled, the PC can’t hibernate.

Figure 5-18. Windows To Go settings are listed under Portable Operating System in Group Policy.

On the host side, users can search for Windows To Go from the Start screen and click Change Windows To Go Startup Options. From there they can enable the host to boot from a Windows To Go workspace. Note this and the Windows To Go requirements in the dialog box shown in Figure 5-19.

Figure 5-19. Configure the host to boot to a Windows To Go workspace.

To boot to the Windows To Go workspace, insert the USB drive and do one of the following:

Figure 5-20. Advanced Startup options in PC Settings lets users boot to a USB drive if the computer is turned on and available to them.

Answer the following questions to test your knowledge of the information in this objective. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.

BitLocker Drive Encryption lets you encrypt entire hard disks and disk volumes, which include the Windows operating system drive, user files, and system files. This is not EFS. EFS encrypts user files; BitLocker Drive Encryption protects the entire disk. You can use BitLocker to protect 32-bit and 64-bit computers running Windows 8.1 Professional, Windows 8.1 Enterprise, and Windows Server 2012. On computers that have a TPM version 1.2 or 2.0, BitLocker can also ensure that data is accessible only if the computer’s boot components haven’t been compromised (altered) and if the disk is still installed in the original computer.

When using BitLocker, you can require users to enter a password to unlock the drive when they want to use it. However, you can require multifactor authentication, too—perhaps by adding a smart card or a USB drive with a startup key on it—on computers with a compatible TPM. BitLocker can also be managed through Group Policy. For instance, you can require that BitLocker be enabled before the computer can be used to store data.

You’ll need to read all you can about BitLocker on TechNet, because there isn’t enough room here to discuss everything. Here, only the most basic information is listed. Refer to http://technet.microsoft.com/en-us/library/hh831507.aspx#BKMK_Overview to learn more about the following:

Configure BitLocker from Control Panel

Before you configure BitLocker, there are a few more things to know. The first time you enable BitLocker you’ll be prompted to create a startup key. This is what’s used to encrypt and decrypt the drive. The startup key can be stored on a USB drive or the TPM chip. If you opt for USB, you’ll have to insert that USB drive every time you want to access the computer, and you’ll also have to enter the key. If a compatible TPM chip is used, the key retrieval is automatic. You can also opt for a PIN. This can be created only after BitLocker is enabled. If you lose the startup key, you’ll have to unlock the drive using a recovery key. This is a 48-digit number that can be stored in numerous ways, including on a USB drive.

There are five authentication methods for protecting encrypted data using BitLocker, consisting of various combinations of TPM, startup PIN, and startup keys; just a TPM; or just a startup key. Here is a brief summary of these options:

• TPM + startup PIN + startup key. This is the most secure, but it requires three authentication tasks. The encryption key is stored on the TPM chip, but an administrator must type a PIN and insert the startup key (available on a USB drive).

• TPM + startup key. The encryption key is stored on the TPM chip, and an administrator must insert a USB flash drive that contains a startup key.

• TPM + startup PIN. The encryption key is stored on the TPM chip, and an administrator must enter a PIN.

• Startup key only. An administrator must insert a USB flash drive with the startup key on it. The computer does not have to have a TPM chip. The BIOS must support access to the USB flash drive prior to the operating system loading.

• TPM only. The encryption key is stored on the TPM chip, and no administrator login is required. TPM requires that the boot environment has not been modified or compromised.

In addition, the drive that contains the operating system must have two partitions, the system partition and the operating system partition, both of which must be formatted with NTFS.

To configure BitLocker and encrypt the operating system drive on a Windows 8.1 computer, follow these steps:

1. Open Control Panel, change the view to Small Icons or Large Icons, and click BitLocker Drive Encryption.

2. Click Turn On BitLocker. (If you receive an error that no TPM chip is available, enable the required Group Policy setting. See Figure 5-20 earlier.)

3. Choose how to unlock your drive at startup; we’ll choose Enter A Password in this example. See Figure 5-22.

   

   Figure 5-22. Enable BitLocker on a fixed drive.

4. Enter the password, reenter to confirm, then click Next.

5. Make a choice to save the password; we’ll choose Save To Your Microsoft Account. Click Next. (In this instance, you can perform this step again to perform a secondary backup before moving on.)

6. Choose to encrypt either the used disk space or the entire drive. Click Next.

7. Leave Run BitLocker System Check selected and click Continue.

8. Click Restart Now. If prompted, perform any final tasks, such as removing CDs or DVDs from drive bays, and then click Restart Now again if necessary.

9. On boot up, type or provide the startup key.

10. Note the pop-up notification in the Desktop taskbar that encryption is in progress. It will take some time to complete.

Return to Control Panel and review the BitLocker window. Note that from there you can perform additional tasks, including backing up your recovery key, changing your password, removing the passwords, and turning off BitLocker. You can see which actions require administrator approval by the icon next to the options. See Figure 5-23.

Figure 5-23. Once BitLocker is enabled, you can configure it.

Exam Tip

We’re not sure how many, if any, questions you’ll see on the exam about the available Group Policy settings for BitLocker and BitLocker To Go. However, it’s better to be safe than sorry. Make sure to at least scan the available options here: Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption from a Group Policy Editor console. There are three folders (Fixed Data Drives, Operating System Drives, and Removable Data Drives), along with a few stand-alone options you’ll find when the BitLocker Drive Encryption container is selected.

BitLocker To Go lets you protect removable USB devices with BitLocker Drive Encryption. These devices can be flash drives, Secure Digital (SD) cards, or removable hard disks formatted with NTFS, FAT16, FAT32, or exFat file systems. Just like BitLocker, users must input a password or a smart card with a PIN to unlock the drive. It can be automatically unlocked as well, with administrator approval. TPM isn’t required because there’s no boot device like there is with a laptop, tablet, or desktop computer.

The process used to create a BitLocker To Go drive is similar to the process used to encrypt a fixed disk using BitLocker. Just insert the USB drive, open Control Panel, and access the BitLocker window. Under Removable Data Drives – BitLocker To Go (see Figure 5-24), work through the setup process.

Figure 5-24. Configure BitLocker To Go from Control Panel’s BitLocker Drive Encryption window.

As noted in an Exam Tip earlier, you should familiarize yourself with the available BitLocker and BitLocker To Go Group Policy settings. You can locate them in a Group Policy Editor in Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption. The BitLocker To Go options are available in the Removable Data Drives container. The eight items listed are summarized briefly here.

This objective covers how to configure startup key storage. However, to understand what a startup key is, you must first understand what it isn’t. There are several key management terms to contend with:

Now that you know what a startup key is, you can save your computer’s startup key on a USB flash drive. Right-click the BitLocker-protected drive to get started and then follow the prompts.

Answer the following questions to test your knowledge of the information in this objective. You can find the answers to these questions and explanations of why each answer choice is correct or incorrect in the “Answers” section at the end of this chapter.