70-688 Ms Exam

Front 1

App-V
ACT
USMT
ACM
BCD
DISM
VHD
pwcreator.exe

Back 1

App-V - Application Virtualization
ACT - Application Compatibility Toolkit
USMT - User State Migration Tool
ACM - Application Compatibility Manager
BCD - Boot Configuration Data
DISM - Deployment Image Service and Management
VHD - Virtual Hard Disk
pwcreator.exe - Workspace to Go Creator

Front 2

App-V

ACT

USMT

ACM

BCD

DISM

VHD

pwcreator.exe

Back 2

App-V - Application Virtualization

ACT - Application Compatibility Toolkit

USMT - User State Migration Tool

ACM - Application Compatibility Manager

BCD - Boot Configuration Data

DISM - Deployment Image Service and Management

VHD - Virtual Hard Disk

pwcreator.exe - Workspace to Go Creator

Front 3

GPO

gpmc.msc

MDOP

MED-V

RDP

USV

UE-V

VDI

Back 3

GPO - Group Policy Object

gpmc.msc - Group Policy Management Console

MDOP - Microsoft Desktop Optimization Pack

MED-V - Microosft Enterprise Desktop Virtualization

RDP - Remote Desktop Service

USV - User State Virtualization

UE-V - User Experience Virtualizaion

VDI - Virtual Desktop Infrastructure

Front 4

Windows To Go

Back 4

Windows To Go is feature in Win 8 Enterprise that allows you to create a Windows To Go workspace on a USB drive.

Managed in the same manner as corporate desktop or laptop.

The USB must be connected to a PC with at least Win 7

Front 5

pwcreator.exe

Back 5

The Workspace to Go Creator is used to create Windows To Go workspaces.
You can also use a USB duplicator product but that will require you to duplicate the drive
before it is booted and initialized.

To create a Windows To Go workspace, you will need:
• A USB drive that supports Windows To Go (32GB or larger).
• A computer running Windows 8 Enterprise edition.
• A Windows 8 Enterprise ISO, Windows 8 Enterprise installation media, or a corporate
Windows image (.wim) created from Windows 8 Enterprise media.
• Local administrator access on the computer.

Front 6

BitLocker To Go

Back 6

BitLocker To Go allows you to encrypt a
removable drive and restrict access with a password or a smart card.

Front 7

To create a Windows to Go workspace, log on as an administrator to a computer running Windows 8 Enterprise edition and then perform the following steps:

Back 7

1. Connect a Windows To Go USB certifi ed device to the host.
2 . Press the Windows logo key 1 w.
3 . Type Windows To Go and then select it from the Results list.
4 . Select the USB drive you connected earlier and then click Next .
5 . Click the Windows image that appears or click Add search location to locate one.
Click Next to continue.
6 . Click Create to format the drive.
7 . (Optional) Select the Use BitLocker with my Windows To Go workspace checkbox
and then type a password. Click Next.

8 . Click Create to setup the Windows To Go workspace.
9 . Click Yes to automatically boot from the USB drive when you restart the host
or click No if you want to change the PC’s fi rmware settings to use the
workspace.

Front 8

CHANGE WINDOWS TO GO STARTUP OPTIONS

Back 8

To change Windows to Go startup options, perform the following steps:
1. Log in to your Windows 8 client device with administrative privileges.
2. Press the Windows log key 1 r .
3. In the Run dialog box, type control panel .
4. Click the Hardware and Sound category.
5. In the Devices and Printers category, click Change Windows To Go startup options .
6. Click Yes to automatically boot from an attached USB drive or click No to
confi gure the settings manually.

Front 9

Hardware Requirements for Windows To Go Workspace Hosts

Back 9

Must support boot from USB

No USB hub

1GHz ++

2 GB ++

DirectX 9+

32GB USB

Front 10

The settings that are applicable to Windows To Go workspace can be found in the following
section of a GPO (gpmc.msc):

Back 10

1)Allow hibernate (S4) when starting from a Windows To G o workspace : Specifies whether
the PC can go into hibernation mode when started from a Windows To Go workspace.

Windows To Go Default Startup Options : This policy controls whether the PC will boot
to Windows To Go if a USB device containing a 2)Windows To Go workspace is connected
and also controls whether users can make changes to the startup options in the
Windows To Go Startup Options Control Panel.
3)Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace :
Determines if the PC can use standby sleep states (S1-S3) when starting from a
Windows To Go workspace. S1 through S4 are sleeping states.

Front 11

Desktop virtualization focuses on three key deployment models:

Back 11

• Operating system virtualization (VDI, Client Hyper V, and MED-V)
• Application virtualization (App-V and Remote App)
• User State virtualization (UE-V)

Front 12

Operating system virtualization

Application virtualization

User State virtualization (UE-V)

Back 12

Operating system virtualization is designed to provide your users with the ability to use a
single computer to run one or more virtual operating systems. These virtual operating systems can be delivered locally or from a centralized data center.

Application virtualization (App-
V) provides your users with the ability to run applications side-by-side that would normally
cause conflicts or run multiple versions of the same application on the same computer.

User State virtualization (UE-V) allows your
user’s data and personal settings to follow them as they login to Windows 7 and Windows 8 client computers.

Front 13

VIRTUAL DESKTOP INFRASTRUCTURE (VDI)

Back 13

Virtual Desktop Infrastructure (VDI) is desktop delivery model that allows users to access
centrally managed desktops running in a data center.

Front 14

VDI can be deployed by in the form of a

Back 14

personal virtual desktop (PVD) or a virtual desktop pool (VDP)

PVD deployment, each of your users, within Active Directory, will be assigned their own dedicated virtual desktop. The user can customize this desktop and it is for their
exclusive use.

VDP deployment, users share a pool of virtual desktops that identical in configuration. VDP are dynamically assigned from the pool to
users when they log on. Since all of these virtual desktops are the same, the user will see the
same desktop regardless of which one they use. When they log off, the virtual desktop is reset to its original state.

Front 15

Microsoft Desktop Optimization Pack
(MDOP)

Back 15

MDOP is a suite of monitoring, perform emergency recovery, application and desktop virtualization tools .

Front 16

session virtualization

Back 16

your users can access individual applications (RemoteApps) or entire desktops (remote desktops or “sessions”)

Front 17

RemoteApps def

Back 17

RemoteApps are programs that are accessed
through Remote Desktop Services (RDS) and appear as if they are running on the client’s local
computer. RemoteApps removes the need to deliver the entire desktop to the remote system in order to launch an application.

Front 18

The typical components of a session-based deployment include the following

Back 18

RD Session Host servers

Front 19

The typical components of a session-based deployment include the following

Back 19

RD Session Host servers

RD Licensing servers

RD Connection Broker servers

RD Gateway servers

Front 20

RD Session Host servers (part of session-based deployment)

Back 20

RD Session Host servers: Servers running this role host RemoteApp programs or session-based desktops. Users connect a RD Session Host server to run programs, save their files and use other resources on those servers.

Front 21

RD Licensing servers (part of session-based deployment)

Back 21

RD Licensing servers: Servers running this role manage the licenses required to connect ot the RD Session Host server or a virtual desktop.

Front 22

RD Connection Broker servers (part of session-based deployment)

Back 22

RD Connection Broker servers: Servers running this role are used to distribute the load across multiple RD Session Host servers and allow users to reconnect to their RemoteApp programs, session-based desktops, and virtual desktops.

Front 23

RD Gateway servers (part of session-based deployment)

Back 23

RD Gateway servers: Servers running this role allow authorized users connecting from the Internet to gain access to their virtual desktops, RemoteApp programs, and sessionbased desktops located on the internal network.

Front 24

RD Web Access servers (part of session-based deployment)

Back 24

Servers running this role provide the ability for users to access RemoteApp and desktop connection through the Start menu on Windows 7/8 or through a web browser. Both RemoteApp and Desktop Connection provide a custom
view of the RemoteApp programs and session-based desktops

Front 25

MED-V def

Back 25

Microsoft Enterprise Desktop Virtualization (MED-V) , another desktop delivery model,
is designed to remove barriers from upgrading to a newer version of the Windows operating
system due to incompatible or legacy applications. By creating a virtual environment called a MED-V workspace you can run a legacy application that has not been supported or tested on Windows 8.

Front 26

MED-V workspace def

Back 26

MED-V workspace is the desktop environment your user interacts with and
consists of both an image and a policy which defines the rules and how the workspace functions.
From an administrator perspective, using a MED-V workspace will allow you to move
forward with a rollout of Windows 8 instead of getting sidetracked addressing applicationcompatibility
issues.

Front 27

The typical components of Med-V include:

Back 27

MED-V Management Server

MED-V Management console

MED-V Image Repository

MED-V Client

Front 28

MED-V Management Server def

Back 28

MED-V Management Server associates virtual images (located in the Image Repository)
with administrator usage policies to Active Directory users and groups. It also stores
event information for reporting and monitoring purposes .

Front 29

MED-V def

Back 29

MED-V Management console is used by administrators to control the management
server and the image repository.

Front 30

MED-V Image Repository

Back 30

MED-V Image Repository stores the virtual images on a standard Internet Information
Server (IIS) and handles virtual image version management and requests from authenticated
MED-V clients for images.

Front 31

MED-V Client

Back 31

MED-V Client allows you to start, stop and lock virtual machines and runs seamlessly
on the desktop, making applications appear as if they are running on the local desktop’s
operating system.

Front 32

Hyper-V role in Windows Server 2012

Back 32

Hyper-V role in Windows Server 2012 provides you with the tools needed to create
a virtualized environment.

Front 33

guest operating system def

Back 33

The operating system that runs inside the virtual machine is called a guest operating system .

Front 34

virtual machine def

Back 34

is a software implementation of a computer that executes programs just
like a real physical computer. The software operating inside the virtual operating system is
limited to the resources provided by the virtual machine

Front 35

hypervisor
or virtual machine manager

Back 35

hypervisor
or virtual machine manager is responsible for creating and running the virtual machines.

Front 36

Client Hyper-V def

Back 36

Client Hyper-V is available in Windows 8 Professional/Enterprise (64-bit version only) provides the same virtualization capabilities found in Windows Server 2012.

Client Hyper-V enables you to create and manage virtual machines (VMs) using a virtual
switch. These VMs can be used to test your applications for compatibility with new
operating systems.

Front 37

INSTALL THE CLIENT HYPER-V FEATURE IN WINDOWS 8

Back 37

As admin

1. Press the Windows logo key 1 q .
2. Set the search context to Settings , type Windows Features , and then click OK .
3. Click Turn Windows features on and off .
4. Click Hyper-V and then click OK .
5. Reboot the Windows 8 client computer

Front 38

User State Virtualization (USV)

Back 38

With the mobility of today’s workforce, it is critical that employees can access their files
and folders whether they are offline or online and also maintain the look and feel of their
desktop across multiple devices. User State Virtualization (USV) is a collection of technologies
that enables data and user settings to follow the user.

Front 39

User Experience Virtualization (UE-V) def

Back 39

User Experience Virtualization (UE-V) provides a similar approach to roaming profiles
but maintains the experience across multiple devices (desktop computers, laptops, and
VDI sessions) and regardless of the application used. Prior to the release of UE-V, you had
to create separate profiles for a user who worked from a physical desktop and then connected
over a session-based desktop from home. Using UE-V, for example, you can switch
between a laptop running Windows 7 or 8 and a tablet running Windows 8 using the
same profile.

Front 40

Application Virtualization (App-V) def

Back 40

Application Virtualization (App-V) is a set of products that provides virtualization at
the application level, which allows you to run applications side by side without conflicts.

Front 41

Virtual Hard Disk (VHD) def

Back 41

is single file on your disk that functions like a separate drive. It can host native file systems function as a boot disk, and support standard disk and file operations. This allows virtual disks to run on a computer that doesn’t have a VM or hypervisor and simplifies the image management
process.

Front 42

Native VHD boot def

Back 42

Native VHD boot means
the computer can mount and boot from the operating system contained within the VHD
file. Native VHD boot will also work without an operating system present on the host
computer

Front 43

There are two VHD formats to choose from when creating a VHD boot file

Back 43

• VHD format supports virtual disks up to 2TB in size.
• VHDX format supports virtual disks up to 64TB. VHDX is more resilient to power
failure but is only supported on Windows 8 systems.

Front 44

In VHD there are two hard disk types available:

Back 44

• Fixed Size is allocated to its maximum size when the VHD is created. It works well with
production servers where user data protection and overall performance is critical.
• Dynamically Expanding will grow to its maximum size as data is written to the virtual
hard disk. It should be used in testing and non-production environments. If you are
using this disk type, consider storing your critical applications and user data outside the
VHD. This reduces the overall file size and makes it easier to recover should the VHD
image become corrupted.

Front 45

diskmgmt.msc

Back 45

Disk Management c onsole (diskmgmt.msc)

To create a VHD file, you can use the Disk Management c onsole (diskmgmt.msc) and/
or the Disk p art tool. The Disk Management console is used to partition, format, delete,
shrink and assign and change drive letters for hard disks (internal/external), optical disk
drives, and flash drives. Diskpart is a command-line a tool that enables you to manage objects (disks, partitions, or volumes) by using scripts or direct input at a command
prompt.

Front 46

Installing win 8 on VHD

Back 46

Windows 8 setup will take you through the normal setup screens, prompting you for the
language to install, time/currency formats, keyboard or input methods, and licensing terms.
When you reach the Where do you want to install Windows? screen, you can open a command
prompt by pressing Shift 1 F10 .

Front 47

command line cmd to use to attach a VHD

Back 47

Attaching the VHD ensures it appears on the host as a drive and not a static file.

X:\Sources > diskpart
select vdisk file 5 “c:\vhdfiles\win8Ent.vhd”
attach vdisk
exit

Front 48

Deployment Image Servic ing and Management (DISM)

Back 48

DISM is a command-line tool used to
service Windows images offline before they are deployed. It can also be used to install, uninstall,
configure, and update Windows packages and drivers

Front 49

.wim file

Back 49

Windows 8 image .wim file.

Front 50

bcdedit and bcdboot

Back 50

bcde dit and bcdb oot are command-line utilities used to control the boot process and manage the boot configuration store.

Front 51

BCD

Back 51

The Windows startup process is controlled by parameters located in the Boot Configuration
Data (BCD) store. The BCD store contains information about what boot manager to use
and the specific boot application/loaders available.

Front 52

The location of BCD store

Back 52

The location of the store is based
on the computer’s firmware. On BIOS-based operating systems, you will find it in the \
Boot\Bcd directory of the active partition. On Extensible Firmware Interface (EFI)-based
systems, it is stored in the EFI system partition.

Front 53

BCD Editor (bcdedit.exe)

Back 53

a command-line utility, to view and manage
the BCD store.

Front 54

CHANGE THE DEFAULT TIMEOUT VALUE USING BCDEDIT

Back 54

To change the default timeout value using bcdedit , log on as an administrator to a
Windows 8 Enterprise computer and then perform the following steps:
1. Press the Windows logo key 1 r .
2. In the Run dialog box, type cmd to open a command console.
3. Type bcdedit at the command prompt to view the BCD store. Make a note of the
current timeout setting under the Windows boot manager section. It should be set
to 30 seconds by default.
4. Type the following at the command prompt. (Entering a timeout value of 0 will
boot the default operating system automatically.)
C:\Users\Administrator > bcdedit /timeout 10
5. Type bcdedit at the command prompt to confirm the timeout setting has been
modified.

Front 55

bcdedit commands

/createstore

/export

/import

Back 55

/createstore - Creates a new empty boot configuration store.
/export - Exports the contents of the system store to a file. This file can be used later to restore the state of the system store.
/import - Restores the state of the system store using a backup file created with the /export command

Front 56

bcdedit commands

/copy

/create

/delete

/mirror

Back 56

/copy - Makes copies of the entries of the store.
/create - Creates new entries in the store.
/delete - Deletes entries from the store.
/mirror - Creates mirror of entries in the store.

Front 57

bcdedit commands

/bootsequence

/default

/displayorder

/timeout

Back 57

/bootsequence - Sets the one-time boot sequence for the boot manager.
/default - Sets the default entry that the boot manager will use.
/displayorder - Sets the order in which the boot manager displays the
multi-boot menu
/timeout - Sets the boot manager timeout value.

Front 58

BCDboot (bcdboot.exe)

Back 58

BCDboot (bcdboot.exe) is a command-line utility that allows you to set up a system partition
when you deploy a new computer, to set up Windows to boot to a virtual hard disk, and to
repair the boot environment if your system partition becomes corrupted.

Front 59

bcdboot command

<source>

/l <locale>

/s <volume letter>

/f <firmware type>

/v

/m [{OS Loader GUID}]

Back 59

<source> - Specifies the location of the Windows directory to use as the
source for copying boot environment files.
/l <locale> - Specifies the optional locale parameter to use. The default is US English (en-us).
/s <volume letter> - Specifies the volume letter for the system partition. Use it to
specify a system partition when you are configuring a drive that will be booted on another computer (USB flash drive or
secondary drive).
/f <firmware type> - Specifies the firmware type. Values can include UEFI , BIOS ,
and ALL .
/v Enables verbose mode.
/m [{OS Loader GUID}] - Merges the value from an existing boot entry into a new
boot entry.

Front 60

Windows 8 System Requirements

Back 60

Processor 1 GHz + PAE + NX processor bit + SSE2

Memory 1 GB for 32bit, 2 GB for 64bit

Disk Space - 16 GB for 32bit, 20 GB for 64bit

Graphics - DirectX 9 + WDDM driver

Front 61

PAE

ACT

USMT

Back 61

Physical Address Extension (PAE)

Application Compatibility Toolkit (ACT)

User State Migration Tool (USMT)

Front 62

Microsoft provides the following tools to streamline your move to Windows 8:

Back 62

• Application Compatibility Toolkit (ACT)
• User State Migration Tool (USMT) 5.0
• Windows Easy Transfer

Front 63

Application Compatibility Toolkit (ACT)

Back 63

The ACT Application Compatibility Toolkit (ACT) kit is used to determine whether or
not applications, devices, and computers will work with a new operating system. Use it
to gather inventory and assess your current environment in preparation for upgrades and
migrations.

Front 64

Application Compatibility Toolk it (ACT) 6.0, includeds

Back 64

Application Compatibility Manager (ACM)

Inventory-collector package

Runtime-analysis package

ACT Log Processing Service (LPS)

ACT LPS share

ACT database

Microsoft Compatibility Exchange

Front 65

Application Compatibility Manager (ACM) (part of ACT)

Back 65

Application Compatibility Manager (ACM): This is used to create your data-collection
package and analyze the collected inventory and compatibility data.

Front 66

Inventory-collector package (part of ACT)

Back 66

Inventory-collector package: This package is deployed to computers in a test environment
to gather inventory data to upload to the ACT database.

Front 67

Runtime-analysis package (part of ACT)

Back 67

Runtime-analysis package: This is a data-collection package that can be deployed
to computers in a test environment to test compatibility with the new operating
system.

Front 68

ACT Log Processing Service (LPS) (part of ACT)

Back 68

ACT Log Processing Service (LPS): This is a service used to process the ACT log files
uploaded from computers where your data-collection packages have been installed. It
adds information to the ACT database

Front 69

ACT LPS share (part of ACT)

Back 69

ACT LPS share: This is a file share accessed by the ACT LPS to store the log files. The
log files will be processed and added to the ACT database.

Front 70

ACT database (part of ACT)

Back 70

ACT database: A This is a Microsoft SQL Server database used to store the collected
inventory and compatibility data.

Front 71

Microsoft Compatibility Exchange (part of ACT)

Back 71

Microsoft Compatibility Exchange: This is a web service that broadcasts applicationcompatibility
issues

Front 72

CREATE AN INVENTORY COLLECTOR PACKAGE

Back 72

To create an inventory collector package, log on as an administrator to a computer
running Windows 7 Professional and then perform the following steps:
1. Start the Application Compatibility Manager (ACM) and then click Collect . The
Collect screen appears.
2. Click File . New .
3. Click Inventory collection package . The Set up your inventory package page
appears.
4 . Provide the Name , Output Location , and the Label for the inventory package

5. Click Create .
6. Browse to the location where you want to save the Windows Installer (.msi) fi le
for the package, type a name for the .msi fi le and then click Save .
7. Click Finish .

Front 73

User State Migration Tool (USMT) 5.0

Back 73

User State Migration Tool (USMT) 5.0 is a command-line tool that migrates user
data from a previous installation of Windows to a new installation of Windows. It provides
you with the ability to customize the user-profile migration experience.

USMT captures user accounts, user files, operating system settings, and application settings to The USMT 5.0 includes three command-line toolsmigrate to your new Windows installation.

Front 74

The USMT 5.0 includes three command-line tools

Back 74

ScanState.exe scans the source
computer, collects the files and settings and creates a store that contains the user’s files
and settings.
• LoadState.exe restores the files and settings on the destination computer.
• UsmtUtils.exe deletes hardlink folders in use by applications no longer removable
through normal measures; checks the store file’s consistency; and restores selected files.

Front 75

hardlink folder def

Back 75

hardlink folder provides a way for the New Technology File System (NTFS) to point
to the same file from multiple locations on the same volume. The store file contains the
user state migration data. UsmtUtils can be used to check for corrupted files or a corrupted
catalog in the store file.

Front 76

USMT also includes the following modifiable .xml files. These files can be used with ScanState and LoadState to perform a targeted migration

Back 76

MigApp.xml includes rules to migrate application settings.
• MigDocs.xml includes rules to migrate user documents from the source computer.
• MigUser.xml includes rules to migrate user profiles and user data.

Front 77

Windows Easy Transfer def

Back 77

When are migrating information from only a few computers, use Windows Easy Transfer ,
a utility that lets you migrate files and settings from a Windows 7 computer to a Windows 8
computer. Using this utility, you can transfer user accounts, documents, music, pictures,
e-mail, Internet favorites, and videos.

Front 78

Windows Easy Transfer can use one of the following to transfer files

Back 78

• A Windows Easy Transfer cable
• A network connection
• An external hard disk or USB flash drive

Front 79

Client Hyper-V can run only on

Back 79

Win 8 64-bit but can emulate 32 and 64 bit VM

To run Hyper-V, you need the following:
• Windows 8 Enterprise (64-bit) version
• A 64-bit processor that incorporates second level address translation (SLAT) technology
• A minimum of 4 GB of memory (running more than one VM at a time requires more)

Front 80

ENABLE THE HYPER-V FEATURE

Back 80

1. Press the Windows logo key + w.
2. Type Features ; from the Results list, click Turn Windows features on and off .
3 . Click the + displayed next to the Hyper-V folder.

Select the check box next to Hyper-V and then click OK.
Windows searches for the required fi les and then applies the changes to the computer.
5 . Click Close .
6 . Restart your computer to complete the installation.
A restart starts the Windows hypervisor and the Virtual Machine Management service.

Front 81

Hyper-V Manager def

Back 81

This is the management console for creating and
managing your VMs and setting up your test network.

Front 82

Hyper-V Virtual Machine Connection def

Back 82

This is used when working with a single VM
that you have already created. It is very similar to the Remote Desktop Connection utility.

Front 83

Hyper-V includes three types of virtual switches

Back 83

• External : Creates a virtual switch that binds to the physical network adapter. This
enables your VMs to access your physical network.
• Internal : Creates a virtual switch that is used only by the VMs that run on the physical
computer and between the VMs and the physical computer.
• Private : Creates a VM that can only be used by the VMs running on the computer.

Front 84

The Windows server running the RDS role includes the following services:

Back 84

RD Virtualization Host

RD Session Host

RD Connection Broker

RD Web Access

RD Licensing

RD Gateway

Front 85

RD Virtualization Host

RD Session Host

Back 85

RD Virtualization Host : Integrates with Hyper-V to enable users to connect to a VM
on a server hosting Hyper-V.

RD Session Host : Enables a server to host RemoteApp programs or session-based desktops.

Front 86

RD Connection Broker

RD Web Access

Back 86

RD Connection Broker : Used for session load balancing; enables users to reconnect to
a virtual desktop and RemoteApp programs, and provides access to virtual desktops in a
virtual desktop collection.

RD Web Access : Enables users to access RemoteApps and desktop connection via the
Start menu or through a web browser.

Front 87

RD Licensing

RD Gateway

Back 87

RD Licensing : Manages licenses needed to connect to the RD Session Host.

RD Gateway : Enables users to connect to virtual desktops, RemoteApp programs, and
session-based desktops from any device connected to the Internet.

Front 88

ADK

Back 88

Assessment and Development Kit (ADK),

The Application Compatibility Toolkit (ACT) 6.0, included with the Windows Assessment and
Development Kit (ADK), includes a set of tools, packages, and services that you can use.
ACT can help you diagnose and fix problems associated with those incompatibilities.

Front 89

Creating App-V Programs

Back 89

Creating applications that can run in a virtualized environment enables you to isolate the
program from other applications that might be running on the same target computer.
This enables you to avoid application conflicts and reduces the amount of time needed
for predeployment application testing.

Front 90

App-V components:

Back 90

• App-V Management server : Provides the overall management functions for the App-V
infrastructure.
• App-V Publishing server : Provides the functionality needed to host and stream the
virtual applications.
• App-V Reporting server : Enables authorized users to run and view App-V reports and
ad-hoc reports to aid in managing the App-V infrastructure.
• App-V Reporting database server : Facilitates database predeployments for App-V 5.0
reporting.

Front 91

SCCM

Microsoft provides several tools and programs to help keep your applications current and
secure. They include

Back 91

System Center Configuration Manager (SCCM)

Group Policy, Windows Intune, and SCCM

Front 92

Windows Intune

Back 92

Windows Intune is Microsoft’s integrated, cloud-based client management solution for
managing computers, tablets, and phones.

Front 93

When deploying software using Windows Intune, you have two installation types:

Back 93

• A required install automatically installs or pushes the software to the managed computer
and requires no user interaction.
• An available install publishes the software to the Windows company portal or on
the mobile company portal so your users can choose whether they want to install
the software.

Front 94

SCCM def

Back 94

System Center 2012 Configuration Manager

System Center 2012 Configuration Manager (SCCM) provides tools to deploy and
manage your applications by setting up a server infrastructure within your network.

Front 95

Windows SmartScreen def

Back 95

Windows SmartScreen was a feature introduced in Internet Explorer 8 to help detect phishing
sites. The primary goals behind the design of SmartScreen were to develop a reliable reputation
system that users could trust, and reduce the number of generic warnings seen when
visiting websites and downloading files. In Windows 8, SmartScreen protection has been
integrated with both Internet Explorer 10 and File Explorer.

Front 96

IEAK def

Back 96

The Windows Internet Explorer Administration Kit (IEAK) 10 enables you to customize,
distribute, and deploy Internet Explorer 10. By using IEAK, you can standardize your
browser across all users and control home page settings, add favorites, and set up special
links to company help pages.

Front 97

Windows Apps def

Back 97

Windows Apps, also called packaged apps, are available from the Windows Store. These applications differ from traditional applications in that they are designed to run in a single, full window display across multiple form factor devices (desktops, laptops, tablets).

Front 98

LOB def

Back 98

Line of Business (LOB) apps . LOB apps include apps that are critical to running the business of the company as well as apps that are unique to the main business of the company

Front 99

Sideloading Windows Apps

Back 99

Sideloading Windows Apps provides you with a way to enjoy the look/feel of Windows
Apps without having to make them available using the Windows Store.

Sideloading is installing a Windows App
without going through the Store by using a tool such as DISM, Windows PowerShell,
System Center Configuration Manager (SCCM), or Windows Intune

Front 100

To use sideloading, you need to make sure the following are in place with your computers

Back 100

• A Windows 8 Enterprise/Professional computer joined to an Active Directory domain ( sideloading product activation key if the Windows 8 Enterprise/Windows 8
Professional computer is not joined to a domain)
• Group Policy must be set to Allow all trusted apps to install.
• The App must be signed by a Certificate Authority (CA) that is trusted by the targeted
PCs on the network.

Front 101

You can sideload Windows Apps only on

Back 101

You can sideload Windows Apps only on Windows Server 2012, Windows 8 Enterprise, and Windows 8 Professional devices that are joined to a domain.

Front 102

VLSC

DISM

Appx

Back 102

Volume Licensing Service Center (VLSC)

Deployment Imaging Servicing and Management (DISM)

Appx (Packaged apps and Packaged app installers) (.appx) – This includes Windows
Apps and side-loaded LOB apps.

Front 103

If you receive an activation key from the VLSC, you can add it by using the following commands,
from a command prompt window (cmd), while logged on as a local administrator

Back 103

To add the key:
Slmgr /ipk , sideloading product key .
To activate the key:
Slmgr /ato ec67814b-30e6-4a50-bf7b-d55daf729d1e

Front 104

(Sideloading)

After the computer is prepared, you can install the package on a per-user basis with the following Windows PowerShell command:

Back 104

Add-appxpackage –Path c:\<directory>\<Winappv1.appx>

Front 105

(Sideloading)

To update the package at a later date, you can manually update the Windows App with the
following command:

Back 105

Add-appxpackage –Path
\\ <servername>\<share>\<winappv2.appx>

Front 106

There are two ways to prevent users from installing and using Apps from the Windows Store

Back 106

• Use Group Policies
• Configure AppLocker

Front 107

When working with Group Policy settings, you should be aware of the order in which they
are applied to your Windows 8 client devices

Back 107

1. Local G roup Policy object.
2. Group Policies linked to the Site container.
3. Group Policies linked to the Domain container.
4. Group Policies linked to the Organizational Unit that is highest in the OU hierarchy are processed
first, followed by GPOs linked to the child OU, and so on. If there are multiple GPOs
linked to the same OU, they will be processed in the order specified by the administrator

Front 108

AppLocker

Back 108

AppLocker is a feature found in Windows Server 2012, Windows 7, and Windows 8 that
can be used to control how users access and use programs and files and extends the functionality originally provided by the Software Restriction policy found in earlier versions of Windows operating systems.

AppLocker uses rules and file properties to determine the programs and files that are
allowed to run on the computer.

Front 109

Main funticonality that MSA account allows

Back 109

Microsoft user accounts

Front 110

Main functionality that MSA allows

Back 110

Microsoft user accounts enable you to synchronize your desktop across multiple Windows 8 devices.

Front 111

The following accounts are installed by default on Windows 8:

Back 111

• Administrator: The administrator account provides complete access to the system. This account is hidden and disabled by default. When you first install Windows 8 you are prompted to create a new user account, which becomes a member of the built-in Administrators group.
• Guest: The guest account, disabled by default, allows for temporary access to the computer.

Front 112

UAC def

Back 112

User Account Control (UAC)

The UAC is a feature designed to
inform you when you are about to perform an administrative level task. If you click Yes when
prompted, you are given the rights temporarily to perform the task and then your permissions
are returned to that of a standard user

Front 113

User profiles

Back 113

User profiles contain network environment settings as well as desktop configurations.
Centralizing these settings along with their data enables your users to access their resources
regardless of where they log on.

Front 114

Folder Redirection

Back 114

Folder Redirection : Replicates user data to a centralized folder stored on a server in the
data center. This enables users to access their files from any computer.

Front 115

Offline Files /Folders

Back 115

Offline Files /Folders : Takes files and folders located on a server and makes them accessible
to users. This enables users to continue to work in case of network outages or while
away on travel.

Front 116

Roaming User Profiles

Back 116

Roaming User Profiles : Enables users to store their choices in personalization in a
centralized folder and then download to another computer when they log on.

Front 117

Windows 8 introduces a new feature that controls on which computers the user can use
roaming profiles and Offline Files/Folders. These assigned systems are called

Back 117

These assigned systems are called primary
computers . By using primary computers, you can protect against exposing sensitive data
on a system.

Front 118

UE-V

Back 118

With UE-V, a user can make changes to his personal settings (operating system or applications)
and then log in to a Windows 7 or Windows 8 computer without having to reconfigure
them each time. It does this by roaming the operating system settings.

UE-V does not virtualize system and application settings, but instead monitors those changes using XML templates and then saves them to a file.

Front 119

UE- V Agent

Back 119

UE- V Agent : Watches the applications and operating system processes identified within
the templates while you are connected. When you close the application or the operating
system is shut down/locked, the information regarding the changes is saved to the
settings storage location.

Front 120

UE-V Generator

Back 120

A tool used to create your own custom templates. It works by monitoring
what the application reads and writes to the registry and what it does with supporting
files. After this information is captured, you can use it to create a custom
template and deploy it to your computers.

Front 121

To determine when a computer is on another network, your computer uses the subnet mask and a process called logical

Back 121

ANDing

Front 122

When a network card is configured In Windows 8, it automatically has both an IPv4 and
IPv6 address by default. This is called

Back 122

dual stack.

Front 123

Resolve-DNSName

Back 123

Type PowerShell .
Type Resolve-DNSName , website address . (for example, Resolve-DNSName
www.cnn.com) and then press Enter .

Front 124

Windows 8 can use three protocols for name resolution

Back 124

The Windows operating system supports three name resolution systems:
• Domain Name System (DNS)
• Windows Internet Name Service (WINS)
• Link Local Multicast Name Resolution (LLMNR)

Front 125

record types you will find in a zone database file

SOA

NS

A

AAAA

PTR

MX

Back 125

• Start of Authority (SOA) records are the first records added to a zone. They define
parameters for the zone and include the name of the primary name server.
• Name Server (NS) records list any additional name servers for the zone.
• Address (host name) (A) records associate a host name to an IP4 address.
• Address (host name) (AAAA) records associate a host name to its IPv6 address.

• Pointer (PTR) records associate an IP address to a host name.
• Mail Exchange (MX) records identify the mail host(s) for the domain.

Front 126

DNSSEC def

Back 126

DNS SECURITY EXTENSIONS

In its original configuration, DNS was not designed with security in mind. When a local
resolver received a response to its request for a host IP address, it accepted the first response
it received. This response could be from a valid server or it could be from a rogue server
attempting to redirect it to another host.
DNS Security Extensions ( DNSSEC) was implemented to provide a way to confirm that the server sending the response is who it claim s to be.

Front 127

DNSSEC uses public key cryptography to digitally sign a zone that in turn signs all the
records in the zone. It adds four new DNS resource records:

Back 127

resource record signature (RRSIG), DNS public key (DNSKey), delegation signer (DS), and next secure (NSEC).

These records are called resource record signature (RRSIG) records. The public key is stored inside the DNSKey resource records. The resolver uses the public key to validate the signatures and thus authenticate them.

Front 128

WINS

Back 128

Windows Internet Name Services (WINS)

another name resolution service on some networks to help pre–Windows 2000 computers to resolve a computer name to
an IP address.

These older systems use NetBIOS over TCP/IP, which requires either a static LMHOSTS file (located on each computer) or a WINS server to resolve the names.

Without a WINS server, these systems rely on broadcast messages to communicate.

Front 129

LLMNR

Back 129

USING LINK LOCAL MULTICAST NAME RESOLUTION (LLMNR)

fallback name resolution technique when DNS or WINS is not available

LLMNR works only on the local subnet, so it does not resolve names for systems that are located on another network.

Front 130

There are two ways to configure DHCP when using it for IPv6 implementations:

Back 130

stateless address configuration and stateful address configuration .

If you are using DHCP to assign IPv6 addresses to stateful mode clients, they work similarly
to the IPv4 when obtaining their IP addresses.

Stateless mode clients work a little differently; they assign both a link local address and additional
non–link local addresses by exchanging messages with neighboring routers. When a
DHCP server is set up to serve stateless clients, the DHCP clients will autoconfigure using
router advertisements. These clients do not use the DHCP server to obtain an IP address,
but instead use it to only obtain additional configuration information such as DNS recursive name servers and a DNS search list

Front 131

WEP def

Back 131

Wireless Equivalent Privacy (WEP) was designed to provide the same level of
security found on wired networks. Over the years, WEP has proven to be very insecure,
permitting a successful brute force password attack in seconds. WEP uses a data encryption
scheme called RC4 with a shared key, which is used to encrypt and decrypt data. Because
this key does not change automatically over time, anyone who can capture the wireless
traffic can break the key and then gain access to your network.

Front 132

WPA def

Back 132

Wi-Fi Protected Access (WPA) was created to improve upon the encrypting and
authentication features of WEP while WPA v2 was under development. It did
this through the use of the TKIP to provide integrity, the AES protocol to provide
encryption, and EAP to improve authentication capabilities

Front 133

Wi-Fi Protected Access (WPA) v2

Back 133

Wi-Fi Protected Access (WPA) v2 : In 2006, WPA v2 replaced WPA. WPA v2
requires the use of stronger encryption (a new AES mode) and does not use TKIP,
which introduced security limitations within the WPA implementation. Using
WPA v2, the keys are changed regularly rather than staying the same, as they were
in WEP implementations. WPA is compatible with 802.11a, 802.11b, 802.11g,
and 802.11n.

Front 134

WPA devices can operate in the following modes

Back 134

Personal mode: This mode uses a preshared key or password

Enterprise mode: This mode uses two sets of keys: a session key, changed each time the
client communicates with the AP, and a master key. The master key is shared with all
clients connected to the AP. Both keys are generated automatically and are changed on a
regular basis.

Front 135

EAP def

Back 135

The Extensible Authentication Protocol (EAP) is used in wireless networks to expand the
number of authentication methods available. It supports one-time passwords, certificates,
smart cards, and public key encryption. When users connect to an AP using EAP, their
authentication request is forwarded to a Remote Authentication Dial-In User Service
(RADIUS) server.

Front 136

WFAS

Back 136

Windows Firewall with Advanced Security (WFAS) combines a stateful host-based firewall
with IPsec. It is designed to protect against attacks that originate from within your network
or those that might bypass the network perimeter firewall(s). WFAS inspects both IPv4 and IPv6 packets that enter and leave your computer and then compares them against the criteria contained in the firewall’s rules. If the packet matches a rule, the action configured in the rule is applied. If the packet does not match a rule, the firewall will discard it and record an entry in its log files.

Front 137

WFAS profiles

Back 137

A domain profile is used when your computer is connected to its corporate domain and
can authenticate to the domain controller

A private profile is used when your computer is connected to a private network location and is located behind a firewall and/or a device that performs NAT.

public profile is used when your computer is connected to a public network

Front 138

PPTP

L2TP

SSTP

Back 138

• Point to Point Tunneling Protocol (PPTP)
• Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec)
• Secure Socket Tunneling Protocol (SSTP)

Front 139

There are four types of VPN Tunneling protocols you will encounter:

Back 139

• Point to Point Tunneling Protocol (PPTP)
• Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec)
• Secure Socket Tunneling Protocol (SSTP)
• VPN Reconnect (or IKEv2)

Front 140

PNs can provide the following capabilities:

Back 140

• Data encryption (confidentiality)
• Authentication
• Data Integrity: Ensure the packets are not modified while in transit
• Non-Repudiation: Guarantee the packets came from the source at a specific time

Front 141

PPTP def

Back 141

Point to Point Tunneling Protocol (PPTP) has widespread support with nearly all versions
of Windows. It uses the Microsoft Point to Point Encryption (MPPE) protocol with
RC4 (128 bit key) to protect data that is in transit. Although not as secure as L2TP/IPsec
(discussed later) it can provide a reasonably secure option for remote access and site-to-site VPNs when used on combination with an authentication protocol such as MS-CHAPv2.

PPTP provides confidentiality but no integrity

Front 142

L2TP/IPSEC

Back 142

PPTP supports authentication of the user only, L2TP/IPsec requires that the
computers mutually authenticate themselves to each other. The computer to computer
authentication takes place before the user is authenticated

L2TP provides a support mechanism for pre-shared keys, digital certificates or Kerberos for mutual authentication.

L2TP/IPsec provides data
confidentiality and data integrity as well as proof that an authorized individual sent the message

Front 143

abr

PPP

PKI

MPPE

NAP

Back 143

PPP - Point to Point Protocol

PKI - Public Key Infrastructure

MPPE - Microsoft Point to Point Encryption

ESP - Encapsulating Security Payload

NAP - Network Access Compliance

Front 144

SSTP def

Back 144

Secure Socket Tunneling Protocol ( SSTP )

works by sending PPP or L2TP traffic through an SSL 3.0 channel. The SSTP protocol uses SSL and TCP port 443 to relay traffic By using TCP port 443, it ill work in environments with highly restricitve firewall

Front 145

VPN Reconnect (IKEv2)

Back 145

introduced with Routing and Remote Access Services (RRAS) in Windows Server 2008 R2 and Windows 7. It is designed to provide users with consistent VPN connectivity and automatically reestablish a VPN when users temporarily lose their Internet connection.

Front 146

DirectAccess

Back 146

DirectAccess allows your remote users to connect automatically whenever their clients
detect an Internet connection. RRAS is used to provide support for legacy VPN clients.

DirectAccess is designed for use by domain-based clients (Windows 7 (Enterprise and Ultimate), Windows 8 (Enterprise), Windows Server 2008 R2, and Windows Server 2012) while Routing and Remote Access Services (RRAS) provides traditional VPN access for legacy clients, non-domain clients, third party VPN clients and site-to-site connections between servers.

Front 147

Force tunneling

Back 147

Force tunneling (sends all traffic through the Direct Access connection)

Front 148

DirectAccess works by

Back 148

DirectAccess works by establishing two IPsec tunnels from the client to the DirectAccess
server. The IPv6 packets, protected using IPsec, are encapsulated inside IPv4 packets to make
the transition across the Internet.

The first is an infrastructure tunnel that is used to communicate with the DNS server
and domain controller to obtain group policy and to request authentication. The second
tunnel is used to authenticate the user and provide access to resources inside the network.

Front 149

NLS

Back 149

Network Location Server (NLS)

NLS plays a critical role in whether the DirectAccess client components are enabled. In fact, NLS is basically a web server used by the client to determine if it is on the corporate network. If it detects that it is on the corporate network, the DA client components are not enabled. If it cannot connect to the NLS, it assumes it is not on the corporate network and enables DirectAccess.

Front 150

WMI filter

Back 150

WMI filter is used to control the application of the GPO. The WMI filter is evaluated on
the target computer during the processing of the Group Policy. The GPO will only be applied
if the WMI filter evaluates as true.

Front 151

For OTP authentication

Back 151

You can use one-time password (OTP) for user authentication. OTP requires thet Remote Access server to be already deployerd.

Front 152

Network Access Protection (NAP)

Back 152

Network Access Protection (NAP) is a feature that combines client and server elements. NAP
allows you to create and enforce health requirement polices that specify the required software and system configurations that computers must have to connect to your network. NAP works by inspecting and assessing the health of computers and limiting their access

Front 153

CMAK

Back 153

Connection Manager Administration Kit (CMAK)

Connection Manager is a client network connection tool that helps administrators to
simplify the management of their remote connections.

You use the Connection Manager Administration Kit (CMAK) to create and customize the profiles for Connection Manager and to distribute them to users. The profile, once completed, contains all the settings necessary for the user to connect including the IP address of the VPN server.

Front 154

PowerShell cmd to create vpn connection

Back 154

PS C:\Add-VpnConnection –Name MyPSVPN –ServerAddress
RemoteServer.Bridgehill.com

Front 155

PowerShell cmd to Remove split-tunneling for VPN

Back 155

C:\Set-VpnConnection –name VPNInt –Server RemoteServer.
Bridgehill.com –splittunneling 0

Front 156

RSAT

Back 156

The Remote Server Administration Tools (RSAT) allow you to manage roles and features
installed on Windows Server 2012 from a PC running Windows 8. The tools included with
RSAT include:
• Server Manager
• Microsoft Management Console (MMC) snap-ins consoles
• Windows PowerShell cmdlets and providers
• Command line tools for managing roles and features running on Windows Server 2012

Front 157

Windows PowerShell Remoting

Back 157

Windows PowerShell Remoting is a server-client application that allows you to securely
connect to a remote Windows PowerShell host and run script interactively. It allows you
to run commands on a remote system as though you were sitting physically at its console.
Windows PowerShell Remoting is built upon the Web Services for Management protocol
and uses Windows Remote Management service to handle the authentication and communication elements.

Front 158

Authentication def

Back 158

Authentication : Represents the way that security principals (users, computers, and
processes) prove their identity before they are allowed to connect to your network. In
the past, authentication was handled through the use of passwords. Today, additional
authentication tools, including digital certificates, smart cards, picture passwords, and biometrics, are used.

Front 159

Authorization def

Back 159

Authorization : After security principals prove their identity, authorization determines
what they can do. This is determined through the use of access control lists (ACLs) that
are attached to each resource.

Front 160

Confidentiality def

Back 160

Confidentiality: This process is about preventing people from reading information they
are not authorized to read. Confidentiality is handled through the use of encryption
technologies.

Front 161

Integrity def

Back 161

Integrity: This is the ability to guarantee that the information has not been arbitrarily changed from the time it was sent from the original source and received by the other party.

Front 162

Nonrepudiation def

Back 162

Nonrepudiation: This is a method used to provide proof that a security principal (user,
computer, process) is the source of data, an action, or a communication. This is usually
provided through the use of public key/private key technologies

Front 163

Windows 8 supports the following
methods of authentication

Back 163

passwords, picture passwords, digital certificates, smart cards, and biometrics.

Front 164

VSC

Back 164

virtual smart cards (VSCs), which makes additional hardware (smart card readers and smart cards) unnecessary. These cards emulate the functionality of regular smart cards but require a Trusted Platform Module (TPM) chip to protect the private keys

Front 165

WBF def

Back 165

Fortunately, Microsoft introduced
native support for biometric technologies through its Windows Biometric Framework (WBF). WBF enables users to manage device settings for biometric devices through the Control Panel, provides support for managing device drivers; and manages Group Policy settings that can be used to enable, disable, or limit use of biometric data for a local computer or domain

Front 166

SAM def

Back 166

Security Accounts Manager (SAM) , contains user accounts and their associated passwords

Front 167

LSA def

Back 167

Local Security Authority (LSA )

When you enter your user name and password on a Windows computer, a process called the Local Security Authority (LSA ) queries the SAM database to determine whether an account with the user name and password you used exists. If it does, you will be granted
access to the system

Front 168

Global Catalog

Back 168

When you implement multiple domains, a feature called the Global Catalog is used to find users, computers, and resources throughout the other domains

Front 169

NTLM

Back 169

WINDOWS NT LAN MANAGER (NTLM) v2

NTLM is a family of authentication protocols first introduced with Windows NT. It is a based on a challenge/response mechanism used to authenticate users and computers.

Front 170

TLS Handshake protocol

TLS Record protocol

Back 170

• TLS Handshake protocol : Establishes the encryption/decryption keys and algorithm,
and resumes connections
• TLS Record protocol : Uses encryption/decryption keys to secure the data, and validate where it comes from and its overall integrity

Front 171

SNI def

Back 171

Windows 8/Windows Server have introduced new features including TLS support for Server
Name Indication (SNI) extensions . SNI provides enhanced support when a client connects
to a server that is virtually hosting multiple domains

Front 172

Forest trusts def

Back 172

can be created between two forest root domains if the forest functional level is Windows Server 2003 or later. For example, if Contoso acquires Acme and both are running Windows Server 2003 or later forests, you can create a forest trust to allow access for users in both forests.

Front 173

Realm trusts def

Back 173

are used to form relationships between an Active Directory domain and a non–Windows Kerberos realm. For example, if Contoso acquired another company that was running a UNIX network, you could create a realm trust to provide users at
Company B with access to Contoso resources.

Front 174

Shortcut trusts def

Back 174

can be used to optimize the authentication process. Even if domains within a forest trust each other, authentication has to walk a trust path from the child domain to the parent domain. A shortcut trust can be made between two domains within the forest to optimize this process. This works well when users have to cross multiple domains to access resources or if a parent domain is located across a slower wide area network (WAN) link.

Front 175

Disk quotas requirments

Back 175

• Quotas can be configured only on NTFS volumes.
• Users are charged only for the files they own.
• Quotas must be enabled separately on each volume and are applied on a per-user basis.
• Quotas do not apply to administrators.
• Only domain administrators or local administrators can enable the feature.

Front 176

diskmgmt.msc

BITS

Back 176

Disk Management

Background Intelligent Transfer Service (BITS)

Front 177

File Server Resource Manager def

Back 177

File Server Resource Manager , a feature in Windows Server 2012, provides a
more enhanced approach to quota management. This tool enables you to configure
disk quotas on a per-volume and per-folder basis and comes with several templates to
work from.

Front 178

Storage Spaces def

Back 178

Storage S paces is a feature in Windows 8/Windows Server 2012 that allows you to
combine multiple disks into a single logical volume that can be mirrored to protect against
one or more drive failures.

Front 179

storage pool

Back 179

When the drives are combined, Windows places them into a storage pool . These storage
pools can then be segmented into multiple storage spaces, which are then formatted with
a file system and can be used just like any other regular disk on your computer

Front 180

When creating storage spaces, there are four resiliency types to select from.
Only three of them provide real fault-tolerance

Back 180

• Simple (no resiliency) : Writes one copy of your data but doesn’t protect against drive
failures; requires at least one drive.
• Two -way mirror : Writes two copies of your data to protect against a single drive failure;
requires at least two drives.
• Three -way mirror : Writes three copies of your data to protect against two simultaneous
drive failures; requires at least five drives.
• Parity : Writes data with parity information to protect against single drive failures;
requires at least three drives.

Front 181

thin provisioning

Back 181

you can create a storage space that is larger
than the available capacity of the storage pool. After setting the size, the Wizard will create
the storage space based on the parameters you provided.

Front 182

BranchCache

Back 182

a feature available in Windows 8 and Windows Server 2012

designed to optimize the link between branch offices and main offices
by caching information from content servers on local computers within the branch. This
reduces traffic on the wide area network links, reduces response time for opening files, and
improves the experience for users connecting over slow links

Front 183

BranchCache- enabled server , also called a c ontent server

Back 183

Content obtained from a BranchCache- enabled server , also called a c ontent server , can
be cached on the client systems at the branch office or on BranchCache servers at the
branch office. Future requests for the same content can be delivered from the client system
or the BranchCache server without having to cross the slower WAN link

Front 184

operating modes for BranchCache

Back 184

hosted-cache mode and distributedcache
mode. You typically use hosted-cache mode when you have more than 50 systems
at the branch office. If you have fewer than 50, distributed-cache mode may be a more
viable option.

Front 185

ENABLE BRANCHCACHE ON A WINDOWS 8
CLIENT USING WINDOWS POWERSHELL

Back 185

Execute the following Windows PowerShell command:
Enable-BCHostedClient

Front 186

Share permissions

Back 186

Share permissions are the permissions you set for folders when you share them either on
a workgroup or domain-based network. The permissions you set determine the type of
access users have to the folder and its contents.

Front 187

List share permissions

Back 187

read

change

full control

Front 188

NTFS permissions differ from share permissions in two ways

Back 188

• They apply to files and folders on NTFS volumes.
• They apply whether the user attempts to access them over the network or locally.

Front 189

NTFS Permissions

Back 189

read,

read & execute,

write,

modify,

list folder contents,

full control

Front 190

certmgr.msc

Back 190

Certification snap-in (certmgr.msc)

Front 191

ERA def

Back 191

When EFS is used, an EFS recovery agent (ERA) is automatically created, whether the
computer is a member of a domain or workgroup. The ERA can recover files/folders that have been encrypted in situations in which the person loses keys or leaves the company. The Domain ERA is automatically created the first time you install a domain controller on the
network.

Front 192

gpmc.msc

Back 192

GPOs are associated with Active Directory containers (sites, domains, and organizational units [OUs]) and are managed from the Group Policy Management Console (GPMC). The GPMC (gpmc.msc) provides a single interface for managing GPOs across your entire organization.

Front 193

LGPE

RSAT

GPMC

TPM

Back 193

Local Group Policy Editor (LGPE; gpedit.msc)

Remote Server Administration Tools

Group Policy Management Console

Trusted Platform Module

Front 194

MBAM

Back 194

Microsoft BitLocker Administration and Monitoring (MBAM) is a simple administrative
interface for setting encryption policies, monitoring computers against those policies, and
reporting the encryption status across your organization.

Front 195

When you combine share and NTFS permissions, the more _____________ of the two wins.

Back 195

restrictive

Front 196

Certified drivers are stored in the Windows 8 driver store. This store can be found in the

Back 196

%systemroot%\system23\driverstore

Front 197

Exchange ActiveSync (mobile management)

Back 197

Exchange ActiveSync: Exchange Server 2013 enables you to manage which mobile
devices are allowed to connect to your network; and to control encryption, password and
access requirements. You can also remotely wipe a device if it is lost or stolen.

Front 198

System Center Configuration Manager (SCCM) 2012 (mobile management)

Back 198

System Center Configuration Manager (SCCM) 2012: SCCM 2012 comes with an
Exchange Server connector that enables you to manage your mobile devices that are
synced with your Exchange Server. You can collect inventory information, perform
a remote wipe of devices, quarantine or block the device, and change and manage
Exchange ActiveSync mailbox policies.

Front 199

Exchange ActiveSync

Back 199

Exchange ActiveSync is a client synchronization protocol based on XML that enables you to
connect your mobile device to your Exchange mailbox.

Front 200

CAS

AD CS

NFC

SIM

Back 200

Client Access Server (CAS)

Active Directory Certificate Services (AD CS)

Near field communication (NFC)

Subscriber Identity Module (SIM)

Front 201

System Center Configuration Manager (SCCM) 2012 provides an Exchange connector

Back 201

SCCM 2012 comes with an Exchange Server connector, which enables you to manage
your mobile devices that are synced with your Exchange Server. You can collect inventory
information, perform remote wipe of devices, quarantine or block the devices, and
change and manage Exchange ActiveSync mailbox policies. The Exchange connector
establishes a connection with the Exchange Server and pulls the mobile device details into
the SCCM database.

Front 202

Two mobile device management types are available when using SCCM 2012:

Back 202

• Light mobile device management
• In-depth mobile device management

Front 203

Light Mobile Device Management

Back 203

This type of mobile device management works through the Exchange Server connector and
uses the capabilities of ActiveSync available to Exchange Server (i.e., device policies). Because
not all manufacturers incorporate all ActiveSync features, SCCM is limited to those available
for managing the device.

Front 204

In-Depth Mobile Device Management

Back 204

In-depth mobile device management, handled through SCCM 2012, enables you to
enroll and manage your mobile devices by installing the mobile device client.

Front 205

PC Reset

Back 205

Removes everything and reinstalls Windows

A PC Reset is used when you want to return the computer back to its original state when
it was purchased or when you first set it up. It removes all your personal data, applications
(traditional and Windows Store apps), and custom settings.

Front 206

PC Refresh

Back 206

Refreshes your PC without affecting your files

PC Refresh is a little less intrusive than a PC Reset. It enables you to keep your personal
data, Windows Store apps, and basic settings: drive letter assignments (mapped drives), personalization settings, BitLocker or BitLocker To Go settings, and wireless network settings

Front 207

recimg.exe

Back 207

recimg.exe: Creates an image that can include traditional desktop applications. Traditional
desktop applications are those installed from a website or installed from a CD/DVD.

Front 208

File History

Back 208

File History is designed to only back up your personal files. If you need to back up your applications and system files, consider using either PC Reset or PC Refresh. If these tools do not meet your needs for managing your system and application files, the Windows 7 File Recovery tool can be used in Windows 8 as an alternative to a third-party backup program.

Front 209

Windows 8 System Restore

Back 209

Windows 8 System Restore saves information about your drivers, registry settings, programs,
and system files in the form of restore points for drives with system protection turned on.
You can then use the restore points to return these items to an earlier state without affecting
your personal files. You should create restore points prior to performing any major system
event such as the installation of a program or a new device driverFile History

Front 210

File History

Back 210

In Windows 8, File History simplifies the process of protecting your personal files. It eliminates
the need to use a more complicated backup process included with previous releases of
the operating system and introduces a process that is automatic and transparent to your user.
It is disabled by default, so you need to enable it to take advantage of its features.

Front 211

recimg.exe

Back 211

If you want to keep your settings and traditional desktop applications, use a utility called
recimg.exe to make an image of the computer.

Front 212

WSUS

SCEP

WID

Back 212

Windows Server Update Services (WSUS)

System Center Endpoint Protection (SCEP)

Windows Internal Database (WID)

Front 213

Application Reputation

Back 213

Application Reputation provides protection from downloading malware through the use of
SmartScreen, which is used in Internet Explorer and File Explorer. In this lesson, you learn
more about how each of these works.

Front 214

WSUS def

Back 214

Windows Server Update Services
(WSUS) . WSUS enables you to centrally manage the deployment of updates released
through Microsoft, track compliance, and provide basic reporting functions

Front 215

upstream server

Back 215

When multiple servers are used, the server that obtains updates from Microsoft is called the
upstream server .

Front 216

downstream servers

Back 216

The server(s) that obtain their updates from the upstream server are called
downstream servers .

Front 217

WSUS uses port

Back 217

WSUS uses port 8530 for the HTTP protocol and port 8531 for HTTPS to obtain updates from the Microsoft Update
servers. In order to communicate with the Microsoft Update servers, make sure you do not block them at your
perimeter firewall

Front 218

MAPS

Back 218

Microsoft Active Protection Service (MAPS)

MAPS is an online community that can
help you decide how to respond to certain threat types and it serves as a resource to
help stop the spread of new viruses and malware.

Front 219

SCEP

Back 219

System Center Endpoint Protection (SCEP) client, a product in the Microsoft System Center 2012 suite, is designed to protect clients and servers from malware threats. Although many of the products were offered as standalone versions in previous releases, SCEP is now integrated with the System Center Configuration Manager.

Front 220

Action Center

Back 220

Action Center provides a central location for viewing notifications regarding problems
with your hardware and software. It also provides information related to security and
maintenance of the computer. When a problem does occur, you receive a notification in
the task bar

Front 221

WSUS supports both replica mode and autonomous mode configurations

Back 221

WSUS supports both replica mode and autonomous mode configurations. Replica
mode mirrors update approvals, settings, computers, and groups from the upstream
server, whereas autonomous mode allows you to configure separate update approval
settings.

Front 222

DaRT

Back 222

Microsoft Diagnostics and Recovery Toolset (DaRT) 8 is part of the Microsoft Desktop
Optimization Pack (MDOP) . DaRT provides you with a set of tools that diagnose and
recover your Windows systems when they are offline

Front 223

DEM

Back 223

System Center Desktop Error Monitoring (DEM )

a core component of the Microsoft
Desktop Optimization Pack (MDOP), is designed to capture all application and operating system failures that are typically under reported by end users. DEM leverages the Windows Error Reporting function that is available on all Windows-based computers by redirecting the information to a central server on your network

Front 224

App-V Client

Back 224

Through the App-V Client Management console you can update and download virtual applications, view the packages for the current user, and see the applications that make up a virtual package.
The App-V Client software can be found on the Microsoft Desktop Optimization Pack (MDOP

Front 225

App-V components include the following:

Back 225

App-V 5 Sequencer

App-V 5 Client

App-V 5 Shared Content Store

App-V 5 Server

Front 226

App-V 5 Sequencer

Back 226

The App-V Sequencer is software that converts applications into virtual packages.

The App-V Sequencer should be installed on a computer running a virtual machine. This process involves installing the sequencer pre-requisites, installing the App-V Sequencer tool and then taking a snapshot. By taking a snapshot of the machine, you can sequence an application and then return to a clean starting point before sequencing your next application.

Front 227

App-V 5 Client

Back 227

App-V 5 Client : The App-V Client is used to run the virtualized application on the
computer. Through the client, the user is able to interact with icons and double-click file
types to start a virtualized app package. The client is also used to obtain the virtual apps
from the App-V Management server. There are two types of clients: Client for Remote
Desktop Services (used on the RD Session Host Server systems) and the App-V Client,
which runs on all other computers.

Front 228

App-V 5 Shared Content Store

Back 228

App-V 5 Shared Content Store : The App-V Client typically obtains the virtual application
content from the App-V Management Server and then caches it before it starts
the app. If the client is configured to use a Shared Content Store, the package contents
are not saved to the computer but instead are streamed.

Front 229

App-V 5 Server

Back 229

App-V 5 Server : The App-V server is comprised of five roles: Management Server,
Management Database, Publishing Server, Reporting Server, and the Reporting
Database. The Management Server provides the overall management functionality,
and the Publishing Server is used to host and stream virtual apps.

Front 230

You need to allow iOS devices to access file servers that are members of the domain

Back 230

You should use Workplace Join.

It allows iOs, Windwos Phone 8/8.1 to access domain resources. To implement it you need to configure an AD FS 2.0 server with Device Registration Service.

In addition tom implementing Workplace Join, you will need to make additional changes to allow iOS devices to access the file share, including an app that accesses the Windows file system on the iOS device.

Front 231

Dynamic Access Control

Back 231

Dynamic Access Control allows you to classify files and apply policies that limit who can access them and the auditing that should be applied.

Device claims can be used to restrict file access to specific computer running Windows 8/8.1

Front 232

Offline domain join

Back 232

Offline domain join

can be used to join a remote computer to an AD domain

Front 233

Windows Intune

Back 233

Windows Intune can be used to manage iOS devices, but not allow them to connect to domain resources

Front 234

Direct access

Back 234

direct access is used to provide remote access to domain resources for computers running Win 7/8/8.1

Front 235

System Center 2012 R2 def

Back 235

System Center 2012 R2 def cam be used to manage domain members

Front 236

Work folders def

Back 236

Work folders is a synchronization technology that allows users to synchronize their files across devices, while ensuring that the files are locating on-premises storage

Front 237

Windows Intune Stand-Alone Cloud configuration

Back 237

Windows Intune Stand-Alone Cloud configuration

administer devices and computers through the Administrator console.

Does not support the dicovery of mobile devices.

Front 238

Windows Intune Cloud + On-premise Configuration

Back 238

Windows Intune Cloud + On-premise Configuration

Integrates windows intune with the existing AD and exchange environments

You can discover mobile devices using Exchange ActiveSync, sync with user accounts in AD.

Front 239

Windows Intune + System Center Configuration Manager

Back 239

Windows Intune + System Center Configuration Manager

This configuration allows you to manage your computers and mobile devices from the SCCM

Front 240

To deploy an .ipa package you need to

Back 240

select software link on the Software Setup page. oOS app packages require a manifest so you need to specify the path to the iOS app's manifest

Front 241

Windows Intune can distribute Windows Phone packages in the ___________ file format

Back 241

.xap

To deploy .xap pacakge you need to select software link on the Software setup page. You also need to enter the code signing certificate provided when you configure Mobile Device Management

Front 242

External link and application deployment

Back 242

External links are used to deploy application form an app store or browser0based applications

Front 243

Location aware printing

Back 243

is only used in scenarios where the client computer is used in multiple location and you need to be able to choose which printer should be the default printer in that location

Front 244

When should you run AgentSetup.exe with SyncMethod set to none.

Back 244

The UE-V 2 Agent uses SyncProvider by default. The SyncProvider synchronizes settings every 30 minutes. To cause setting to be synchronized immediately, you need to change the SynchMethods to None.

For pooled VDI images, the inly way to configure the SyncMethods is to run AgentSetup with the SyncMethod set to None.

Front 245

You are configuring client computers in your company. The computers are running a mix of MS Win 8.1 Ent and Win 8.1 RT. The company has purchased a Windows Intune. How can you prevent users from using a pic password.

Back 245

Mobile Device Security Policy

Front 246

When upgrading 32 bit Windows to 64-bit Win 8.1 what items will be preserer

Back 246

Nothing fresh install

Same applies for XP 64 to Win 8.1 64

Front 247

How can you prevent users from synching application settings, browsing history, favorites, and passwords among devices using their MSA

Back 247

Configure the Security Options under Computer Configuration\Windows Settings\Security Settings\Local Policies node of Group Policy

Front 248

Windows Intunes client software needs to be installed on desktop versions of Windows such as

Back 248

Win 8 ent and pro

Win 7 ent, ultimate, & pro

Vista ent, ultimate, & business

XP Pro SP3

Front 249

Windows Intune does not require client software to be installed on mobile device such as

Back 249

Win RT

Win RT 8.1

Win Phone 8/8.1

Win 8.1 pro & ent

iOS 5 & up

Androind 2.3.4 & up

Front 250

When directory synch is configured between Office 365 and an Active Directory, you can only delete a user account from ____________

Back 250

AD

The change is then synch to Office 365

You can delete a user account form AD either via Remove-ADUser or Active Directory Users and Computers

Front 251

Before deploying UE-V to the Win 8.1 environment, you should prevent users from enabling ...

Back 251

the Sync Your Settings feature on Win 8.1. You can do this by configuring the Do not sync policy setting under the Computer Configuration\Administrative Templates\Windows Components\Sync settings node of Group Policy

Front 252

To deploy a DaRT image to the WDS server you need to

Back 252

extract boot.wim from the ISO image. You can dp this by mounting the ISO image or burning the image to a CD or DVD, and then copying the boot.wim file

Front 253

What storage solution should you use to store UE-V settings

Back 253

Active Directory Home Dir

Network Share on a file server

OneDrive is not supported by UE-V for the settings storage location

Front 254

Workplace Join def

Back 254

workers can join their personal devices with their company's workplace computers to access company resources and services. When you join your personal device to your workplace, it becomes a known device and provides seamless second factor authentication and Single Sign-On to workplace resources and applications. When a device is joined by Workplace Join, attributes of the device can be retrieved from the directory to drive conditional access for the purpose of authorizing issuance of security tokens for applications. With Windows Server 2012 R2, Windows 8.1 and iOS devices can be joined by using Workplace Join.

Front 255

DRS

Back 255

Workplace Join is made possible by Device Registration Service (DRS) that is included with the Active Directory Federation Services role in Windows Server 2012 R2. When a device is joined by Workplace Join, DRS provisions a device object in Active Directory and sets a certificate on the consumer device that is used to represent the device identity. DRS is meant to face both internal and external resources. Companies that deploy both DRS and the Web Application Proxy can join devices that use Workplace Join from any Internet-connected location.

Front 256

To ensure that the IMA{4 connection to MS Office 365 is secured using SSL encryption you should use TCP port

Back 256

993

Front 257

App-V publishing servers are automatically removed from an App-V client when Configuration manager deploys virtual application. App-V 5.0 clients can be managed by

Back 257

App-V server or

System Center 2012 Configuration Manager, but they cannot be managed by both at the same time

Front 258

You can use the Windows Intune Administrator console to customize a wide range of the elements in the Windows Intune company portal such as

Back 258

support website URL

company privacy statement URL

company name,

IT department contacts and

company logo

Front 259

You plan to create a DaRT 8.1 recovery image by using the DaRT Recovery Image Wizard what you install first on the computer that is used to create the image

Back 259

You should install the ADK to use the DaRT Recovery Image wizard. ADK contains the deployment tolls required to customize, deploy, and service Windows Images

Front 260

List the filtering configuration types are supported by the Directory Synch tool

Back 260

OU - based allows you to select which OUs are synchronized

AD DS domain based allows you to select which domains are synchronized.

User-attribute-based allows you to control which objects are synchronized based on attribute-based filter for user objects.

Front 261

Tools that can be user to streamline the upgrade and migration to Windows 8

Back 261

ACT - used to determine if application, devices and computers will work with windows 8

USMT - is a cmd line tool that can help you migrate user data to Win 8

Windwos Easy Transfer provides a solution for migrating files and setting from win 7 to win 8

Front 262

One of your users has been promoted to a new position and has been given a new computer. The user needs the new apps that the job requires. The user also needs to have the documents and settings from the old Windows 7 computer transferred to the new computer. How should you perform the Windows 8.1 installation?

Clean installation
Side-by-side migration
In-place upgrade

Back 262

Side-by-side migration

Front 263

What is the recommended minimum physical memory for an installation of a 64-bit edition of Windows 8.1 Enterprise?

512 MB
1 GB
2 GB
4 GB

Back 263

2 gb

Front 264

Which of the following editions of Windows support the Workplace Join feature?

Windows 7 Ultimate
Windows 8.1 Enterprise
Windows RT

Back 264

Windows 8.1 Enterprise

Front 265

Steps to deploy a third-party plug-in for MS Outlook via App-V

Back 265

1. Sequence the plug in

2. Create a new App-V package that contains the plug in

3. Create a Connection Group that includes the Office 2013 App-V package and the plug-in

Front 266

Realibility monitor use and def

Back 266

realibility monitor uses event viewer to display events related to system stability in a graphical format

Front 267

An infrastructure using MS Office 365 is configured with Single sign-on (SSO) for Office 365 by using Active Directory Federation Service wit def config. Some mail enabled groups are not synched to MS Windows Azure Active Directory. What are the possible reasons.

Back 267

DisplayName attribute is empty

ProxyAddress does not have a primary SMTP address and mail attribute is not present or is invalid

Group has more than 15000 immediate members

Front 268

mandatory user profile

Back 268

A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. With mandatory user profiles, a user can modify his or her desktop, but the changes are not saved when the user logs off. The next time the user logs on, the mandatory user profile created by the administrator is downloaded.

There are two types of mandatory profiles: normal mandatory profiles and super-mandatory profiles.

User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) on the server to NTuser.man. The .man extension causes the user profile to be a read-only profile.

Front 269

super-mandatory user profile

Back 269

User profiles become super-mandatory when the folder name of the profile path ends in .man; for example, \\server\share\mandatoryprofile.man\.

Super-mandatory user profiles are similar to normal mandatory profiles, with the exception that users who have super-mandatory profiles cannot log on when the server that stores the mandatory profile is unavailable. Users with normal mandatory profiles can log on with the locally cached copy of the mandatory profile.

Only system administrators can make changes to mandatory user profiles.

Front 270

Workplace Join as a seamless second factor authentication

Back 270

Companies can manage the risk that is related to information access and drive governance and compliance while granting consumer devices access to corporate resources. Workplace Join on devices provides the following capabilities to administrators:

* Provides a more seamless sign-in experience for users to access company resources from trusted devices.

Front 271

Roaming User Profiles

Back 271

If a computer is running Windows 2000 Server or later on a network, users can store their profiles on the server. These profiles are called roaming user profiles.

Roaming user profiles have the following advantages:

* Automatic resource availability.
* Simplified computer replacement and backup.

Front 272

Are roaming user profiles supported on Win RT

Back 272

No

Windows XP and Windows Server 2003 support Roaming User Profiles only when set up on user accounts by using AD DS - they don’t support enabling Roaming User Profiles on a per-computer basis by using Group Policy.

Front 273

How can I manage Storage Spaces?

Back 273

The Storage Spaces item in Control Panel

The File and Storage Services section of Server Manager

The Storage module in Windows PowerShell

Front 274

ReFS

SSO

Back 274

ReFS - Resilient File System

SSO - Single Sing-On

Front 275

In case that you have MS Exchange Active Sync policy setting to manage mobile devices and you want to supplement it with Windows Intune direct management in addition the Intune Exchange connector is not used.

How conflicts between the two will be resovled?

Back 275

If user device is controlled by both Exchange ActiveSync polict settings and Windows Intune direct management and the Intune Exchange connector is not used, the more settings in the last policy applied will win

Front 276

There are several way to enable Client Hyper-V feature in Windows 8 Pro, you can use

Back 276

PS, Programs and Features Control Panel applet, DISM utility

Front 277

UEFI

Back 277

Unified Extensible Firmware Interface (UEFI) is a specification that defines a software interface between an operating system and platform firmware. UEFI is a more secure replacement for the older basic input/output system (BIOS) firmware interface present in some personal computers, which is vulnerable to malware that performs attacks during the boot or power on self-test processes

Front 278

SRP

Back 278

Software Restriction Policies

Software Restriction Policies are a security feature that enables you to specify exactly which applications are allowed to run on user desktops.

Front 279

What Is AppLocker?

Back 279

AppLocker is a security feature that enables you to specify exactly which applications are allowed to run on user desktops.

Benefits of AppLocker:

Controls how users can access and run all types of applications

Ensures that user desktops are running only approved, licensed software

Provides much better granularity and control than SRP

Can restrict Windows Store apps

Only works on Windows 7 and later operating systems

Front 280

PowerShell cmdlet command-line equivalent

ping

ipconfig

route print

net use

netstat

netsh advfirewall

Back 280

Test-Connection - ping
Get-NetIPConfiguration - ipconfig
Get-NetRoute - Route print
New_SmbMapping - Net use
Get-NetTCPConnection - Netstat
New-NetFirewallRule - Netsh advfirewall

Front 281

DNSSEC

RRSIG

DNSKey

DS

NSEC

Back 281

DNS Security Extensions adds four new DNS source records

RRSIG - resource signature record

DNSKey - DNS public key

DS - delegation signer

NSEC - next secure

Front 282

IPv6 APIPA equivalent address

Back 282

IPv4 - 169.254.0.0 255.255.255.0

IPv6 - FE80:: /64

Front 283

What cmd should you use set up a virtual smart card

Back 283

TpmVscMgr.exe