Windows 10 What to Do Now
Total Page:16
File Type:pdf, Size:1020Kb
WINDOWS 10 WHAT TO DO NOW ARRAYA SOLUTIONS Educating, Engaging, and Elevating IT since 1999 Chuck Kiessling Director, Cloud and Workspace Solutions AGENDA Why are we here? What is your story? What are some key items to help your journey? Changes to Desktop Security WaaS: Servicing your Security Needs INTRODUCTIONS Chuck Kiessling Director, Cloud and Modern Workspace Practice [email protected] Twitter: @CKiessling WHAT IS YOUR INTEREST IN THIS SESSION? Windows and Office Active ConfigMgr Directory Windows Exchange Server SharePoint On-premises Legacy devices Modern devices Windows 7 Windows 10 Office Office 365 Active Directory + Azure Active Directory ConfigMgr + Microsoft Intune Windows Defender + Microsoft Threat Protection Cloud-connect what you have today What is your Digital Transformation Story? WHAT YOU CAN DO TO PROTECT YOUR BUSINESS WITH WINDOWS 10 WINDOWS 10 IS THE MOST SECURE WINDOWS EVER Device safeguards Threat resistance Identity protection Information security Threat detection and response *For the supported lifetime of the device THE MICROSOFT INTELLIGENT SECURITY GRAPH 450B monthly authentications Cyber threat intelligence collected 200+ global from unparalleled security cloud consumer and commercial information sources services Billions of data points Detect threats before they do damage +1B Windows Powered by machine learning and 18+ billion devices Bing web updated human intelligence pages scanned 400B e-mails analyzed THE MOST SECURITY, BUILT IN Where do these data points come from? WINDOWS 10: THE MOST SECURE WINDOWS EVER PROTECT, DETECT, and RESPOND Secure your Protect enterprise Enhance threat Secure your devices Detect, investigate, identities data resistance and connections and respond to breaches PRE-BREACH POST-BREACH WINDOWS 7 SECURITY FEATURES Device Threat Identity Information Breach detection protection resistance protection protection investigation & response Pre-breach Post-breach 1Requires TPM 1.2 or greater WINDOWS 10 SECURITY ON LEGACY DEVICES Device Threat Identity Information Breach detection protection resistance protection protection investigation & response Pre-breach Post-breach 1Requires TPM 1.2 or greater. 2Windows Hello requires specialized hardware such as fingerprint reader, illuminated IR sensor, or other biometric sensors depending on the authentication enabled. 3Windows Information Protection requires either Mobile Device Management (MDM) or System Center Configuration Manager to manage settings. These products sold separately. Active Directory makes management easier but is not required. 4Windows Enterprise feature. WINDOWS 10 SECURITY ON MODERN DEVICES Device Threat Identity Information Breach detection protection protection protection protection investigation & response Pre-breach Post-breach 1Requires TPM 1.2 or greater. 2Windows Hello requires specialized hardware such as fingerprint reader, illuminated IR sensor, or other biometric sensors depending on the authentication enabled. 3Windows Information Protection requires either Mobile Device Management (MDM) or System Center Configuration Manager to manage settings. These products sold separately. Active Directory makes management easier but is not required. 4Windows Enterprise feature. HARDWARE BASED ISOLATION IN WINDOWS 10 #2 #3 Apps #1 Trustlet Trustlet Trustlet Windows Platform Services Kernel Kernel Windows System Container Operating System Hyper-V Hyper-V Device Hardware Hypervisor DEVICE GUARD AND CREDENTIAL GUARD Apps #3 Guard Trustlet Device Guard Credential Windows Platform Services Kernel Kernel Windows System Container Operating System Hyper-V Hyper-V Device Hardware Hypervisor APPLICATION GUARD Microsoft Edge Apps #3 Device Guard Credential Guard Trustlet Windows Platform Windows Platform Services Services Kernel Kernel Kernel Windows Defender Windows System Container Application Guard Operating System Hyper-V Hyper-V Device Hardware Hypervisor Windows Information Protection Information Windows Separates personalwork and data Separates Windows Operating System Work File File File System Kernel Personal File Work File Work Mail Personal Mail ENHANCE WINDOWS 10 DEPLOYMENT WHAT'S NEW WITH WINDOWS 10 DEPLOYMENT? DEPLOYMENT CHOICES A brand new way of building, deploying, and servicing Windows Transform new devices existing Windows 7 and 8.1 devices WINDOWS AS A SERVICE: SERVICING WINDOWS Changes being implemented for older Windows releases as well WINDOWS AS A SERVICE: DEPLOYING WINDOWS Windows Insider Preview Branch Current Branch Current Branch for Business Long Term Servicing Branch Specific feature and performance feedback Deploy to appropriate audiences Application compatibility Test and prepare for broad validation deployment Information workers Specialized systems General population Early adopters, initial pilots, Deploy for mission critical systems IT devices Benefits from new features Test machines, small pilots No need for frequent new Begins broad deployment features (or any sort of change) Too expensive for general population NUMBER OF DEVICES NUMBER STAGE Release THINKING THROUGH DEPLOYMENT STRATEGY 1 Configure Insider PCs • Lab or secondary PCs • Enough to explore new features, measure compatibility 2 Identify special PCs • Deploy Windows 10 Enterprise LTSB • Limited numbers (we hope) 3 Recruit volunteers for pilots • Willing participants who will provide feedback • Cover the broadest set of apps and devices possible 4 Divide broad population of PCs • Standard deployment best practice • Focus on risk reduction, minimizing disruption Deploying Windows 10 and Office ProPlus with Confidence We have new insights and solutions that reduce uncertainty from planning upgrades and decrease the time and effort to successfully deploy Windows 10 and Office ProPlus. • We have seen far fewer upgrade issues than in the past and most devices have no issues. 1. Plan Upgrades 2. Pilot for Confidence 3. Stay Current • Windows Analytics and • Pilots are a best practice to • Semi-Annual Channel Readiness Toolkit for Office frontload regression risk. (Targeted) for pilot and pre- can help you plan an upgrade • Ensure coverage of in-house production user groups is a and assess your risk with add- apps. recommended best practice. in and macro inventory, • Pilot with representative users • This provides an early macro issue scanning and who best understand your assessment up to 6 months adoption of 3rd party add- business-critical solutions. ahead of the Semi-Annual ins. release. • They can also identify devices where you can deploy faster with higher confidence. Windows MSFT Cloud Analytics Azure Log Analytics Data Flow Telemetry Service Microsoft, as the “IT admin” for consumers, uses telemetry to ensure OS, app and driver releases land with the right level of quality/health/compat Windows Analytics gives IT and Partners telemetry-based insights Configure about their devices, exposed via Control Azure Log Analytics IT controls the level of telemetry collected, which impacts Analytics Telemetry availability GP/SCCM/Intune Upload Per Solution Requirements Solution OS Min Telemetry Level Required Windows Versions License Upgrade Win7, 8, 10 Basic for most things No additional Readiness requirements Enhanced for Win10 App Usage and IE site discovery insights Update Win10 Basic No additional Compliance requirements Device Win10 Enhanced E3, E5 health Note: All Windows Analytics are “zero rated” within Azure log analytics; not charged, don’t count against data limits Servicing from the cloud • Built on top of Windows Update for global scale • Implemented through additional policies configurable via Group Policy, Intune (or other MDM services), Configuration Manager • Controls for deferring feature updates, quality updates • “Active Hours” to specify when users are likely away Windows Analytics for compliance reporting Servicing from the cloud • Built on top of Windows Update for global scale • Implemented through additional policies configurable via Group Policy, Intune (or other MDM services), Configuration Manager • Controls for deferring feature updates, quality updates • “Active Hours” to specify when users are likely away Windows Analytics for compliance reporting Simple mechanism for Stay current: updating: • Each Windows 10 release • Right-click, Install Update supported by previous Pack ConfigMgr release • Full functionality with next release Windows 10 Servicing • Define servicing plans to indicate the schedule for deploying to devices • Servicing plans are executed automatically for each feature update • Reduces size of updates via use of ESD files Task Sequence Servicing • For additional control over the feature update deployment process Windows 10 Servicing • Define servicing plans to indicate the schedule for deploying to devices • Servicing plans are executed automatically for each feature update • Reduces size of updates via use of ESD files Task Sequence Servicing • For additional control over the feature update deployment process Wireless Access Wireless Access Point Point Router Router Data Center Switches Data Center Switches Server Server Without peer-to-peer With peer-to-peer Modern Deployment (a.k.a. Provisioning) PROVISIONING, NOT REIMAGING Take off-the-shelf hardware Device is ready for productive use Transform with little or no user interaction www.microsoft.com/store/surfacepro Tom www.microsoft.com/store/checkout Anna Anderson ([email protected]) 123 Maple Street Seattle, WA Tomas Koska 1 Contoso Way Seattle, WA Tomas Koska **5555 7/2021 Tomas Koska 1 Contoso Way Seattle, WA [email protected]