ts: windows server 2008 r2, desktop virtualization · 2019-10-18 · all servers run windows server...

TS: Windows Server 2008 R2, Desktop Virtualization

Number: 070-669Passing Score: 700Time Limit: 120 minFile Version: 1.0

http://www.gratisexam.com/

Microsoft

EXAM 70-669

TS:Windows Server 2008 R2,Desktop Virtualzation

Total Questions: 67 (EXAM A - 35 and EXAM B- 32)

By SharmaAshle (Junjunwala)

Updated by JunJunwala (2012-04-02) Due to size limitation I am spliting it into two parts.

Exam A

QUESTION 1Your company has an Active Directory Domain Services (AD DS) domain.All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Application Virtualization (App-V), Microsoft Enterprise DesktopVirtualization (MED-V), and Remote Desktop Services. You have three applications that are in one package and require authorization to run. You need to deploy the applications for offline use. What should you do?

A. Configure a MED-V revertible workspace policy.B. Configure the Remote Desktop Connection Broker (RD Connection Broker). Create a Group Policy object

(GPO) to configure the Configure server authentication for client setting.C. Use Microsoft Application Virtualization for Desktops. On each client computer, set the client cache

configuration settings to Use free disk space threshold and configure the ApplicationSourceRoot registrykey.

D. Use Microsoft Application Virtualization for Desktops. On each client computer, configure theAutoLoadTriggers, AutoLoadTarget and RequireAuthorizationIfCached registry parameters. Then launchany one of the applications while logged in with the computer users credentials.

Correct Answer: DSection: (none)Explanation

Explanation/Reference:A. MED-V revertible workspace policy

Self-cleaning (revertible) virtual machine —MED-V offers a unique method for managing an easy to supportvirtual desktop environment. It takes advantage of hardware independence enabled by virtualization, andmaintains the exact same image across multiple endpoints. All user changes to applications or the OS arediscarded once the virtual PC session ends, and the virtual machine reverts to the original image, as packagedand delivered by the administrator. This can significantly simplify management, support, and troubleshooting forvirtual machines. Updates, patches, new applications, and settings changes are applied to the master virtualimage, tested by the administrator, and uploaded as a new version of the virtual image to the MED-V imagerepository. The new version is delivered to all endpoints using Trim Transfer technology, removing the need toupdate each endpoint separately. This method is applicable only where no user data or settings need to be keptin the virtual image (for instance, when all user data and settings are stored on a network location). Also whenusing the revertible method, the virtual machine sh ould not be part of an Active Directory domain.

B. Remote Desktop Connection Broker

Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker (TSSession Broker), is used to provide users with access to RemoteApp and Desktop Connection. RemoteAppand Desktop Connection provides users a single, personalized, and aggregated view of RemoteApp programs,session-based desktops, and virtual desktops to users. RDConnection Broker supports load balancing andreconnection to existing sessions on virtual desktops, Remote Desktop sessions, and RemoteApp programsaccessed by using RemoteApp and Desktop Connection. RDConnection Broker also aggregates RemoteAppsources from multiple Remote Desktop Session Host (RDSession Host) servers that may host differentRemoteApp programs.

To configure which RemoteApp programs and virtual desktops are available through RemoteApp and DesktopConnection, you must add the RDConnection Broker role service on a computer running WindowsServer2008R2, and then use Remote Desktop Connection Manager (RDConnection Manager).For more information, seeRemoteApp and Desktop Connection.

Who will be interested in this feature?

The improvements to the RDConnection Broker role service will be of interest to organizations that are

implementing either a Virtual Desktop Infrastructure (VDI) or are deploying session-based desktops orRemoteApp programs. Additionally, these improvements will be of interest to organizations that currently use orare interested in Remote Desktop Services.

What does RD Connection Broker do?

RDConnection Broker extends the TS Session Broker capabilities included in Windows Server2008 by creatinga unified administrative experience for traditional session-based remote desktops and virtual machine-basedremote desktops. A virtual machine-based remote desktop can be either a personal virtual desktop or part of avirtual desktop pool. In the case of a personal virtual desktop, there is a one-to-one mapping of virtualmachines to users. Each user is assigned a personal virtual desktop that can be personalized and customized.These changes are available to users each time that they log on to their personal virtual desktop. For a virtualdesktop pool, a single image is replicated across many virtual machines. As users connect to the shared virtualdesktop pool, they are dynamically assigned a virtual desktop. Because users may not be assigned the samevirtual desktop when they connect, any personalization and customization made by a user are not saved. If youchoose to use a virtual desktop pool and users need their personalization and customizations saved, you canuse roaming profiles and folder redirection.

Which editions include this feature?

RDConnection Broker is available in the following editions of Windows Server2008R2:Windows Server2008R2 StandardWindows Server2008R2 EnterpriseWindows Server2008R2 Datacenter

RDConnection Broker is not available in the following editions of Windows Server2008R2:Windows Web Server 2008 R2Windows Server2008R2 for Itanium-Based Systems

Additional references

For information about other new features in Remote Desktop Services, seeWhat's New in Remote DesktopServices.

Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker(TSSession Broker), is a role service that provides the following functionality:Allows users to reconnect to their existing sessions in a load-balanced RDSession Host server farm. Thisprevents a user with a disconnected session from being connected to a different RDSession Host server in thefarm and starting a new session.

Enables you to evenly distribute the session load among RDSession Host servers in a load-balancedRDSession Host server farm.Provides users access to virtual desktops hosted on RDVirtualization Host servers and to RemoteAppprograms hosted on RDSession Host servers through RemoteApp and Desktop Connection.

Overview of Remote Desktop Connection Broker (RD Connection Broker)

Remote Desktop Connection Broker (RDConnection Broker), formerly Terminal Services Session Broker(TSSession Broker), is a role service that provides the following functionality:Allows users to reconnect to their existing sessions in a load-balanced RDSession Host server farm. Thisprevents a user with a disconnected session from being connected to a different RDSession Host server in thefarm and starting a new session.

Enables you to evenly distribute the session load among RDSession Host servers in a load-balancedRDSession Host server farm.Provides users access to virtual desktops hosted on RDVirtualization Host servers and to RemoteAppprograms hosted on RDSession Host servers through RemoteApp and Desktop Connection.

RDConnection Broker keeps track of user sessions in a load-balanced RDSession Host server farm. TheRDConnection Broker database stores session information, including the name of the RDSession Host server

where each session resides, the session state for each session, the session ID for each session, and the username associated with each session. RDConnection Broker uses this information to redirect a user who has anexisting session to the RDSession Host server where the user’s session resides.

If a user disconnects from a session (whether intentionally or because of a network failure), the applicationsthat the user is running will continue to run. When the user reconnects, RDConnection Broker is queried todetermine whether the user has an existing session, and if so, on which RDSession Host server in the farm. Ifthere is an existing session, RDConnection Broker redirects the client to the RDSession Host server where thesession exists.

With RDConnection Broker Load Balancing, when a user without an existing session connects to anRDSession Host server in the load-balanced RDSession Host server farm, the user will be redirected to theRDSession Host server with the fewest sessions. If a user with an existing session reconnects, the user isredirected to the RDSession Host server where the user’s existing session resides. To distribute the sessionload between more powerful and less powerful servers in the farm, you can assign a relative server weightvalue to a server.RDConnection Broker is also used to provide users with access to RemoteApp and Desktop Connection.RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtualdesktops to users. RDConnection Broker supports load balancing and reconnection to existing sessions onvirtual desktops accessed by using RemoteApp and Desktop Connection. To configure the RDConnectionBroker server to support RemoteApp and Desktop Connection, use the Remote Desktop Connection Managertool. For more information, see the Remote Desktop Connection Manager Help in Windows Server2008R2.

RD Connection Broker components

There are two RDConnection Broker components to consider in a load-balanced RDSession Host server farm.RD Connection Broker server. This is the server that runs the Remote Desktop Connection Broker serviceand tracks user sessions for one or more load-balanced RDSession Host server farms. RDConnection Brokeruses a farm name to determine which servers are in the same RDSession Host server farm.RDSession Host servers that use RD Connection Broke r.These are RDSession Host servers that aremembers of a farm in RDConnection Broker. To participate in RDConnection Broker, a server must meet thefollowing criteria:

The server must have the RDSession Host role service installed.The server must be a member of an ActiveDirectory domain.The server must be a member of the Session Broker Computers local group on the RDConnection Brokerserver.The server must be a member of a load-balanced RDSession Host server farm.

C. Use Microsoft Application Virtualization for Desktops. On each client computer, set the client cacheconfiguration settings to Use free disk space threshold and configure the ApplicationSourceRoot registry key.

The FileSystem cache space management feature uses a Least Recently Used (LRU) algorithm and is enabledby default. If the space that is required for a new package would exceed the available free space in the cache,the Application Virtualization (App-V) Client uses this feature to determine which, if any, existing packages itcan delete from the cache to make room for the new package. The client deletes the package with the oldestlast-accessed date if it is older than the value specified in the MinPkgAge registry value. Use of the FileSystemcache space management feature can also help to avoid low cache space problems.More than one package is deleted if necessary. Packages that are locked are not deleted.

To ensure that the cache has sufficient space allocated for all packages that might be deployed, use theUse free disk space thresholdthat the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache sizeaccordingly.

QUESTION 2Your company has an Active Directory Domain Services (AD DS) domain. You have multiple Remote DesktopSession Host (RD Session Host) servers. You have 100 Windows Server 2008 R2 Remote Desktop Servicesclient access licenses (RDS CALs) installed on your license server. You need to return 10 RDS CALs to thepool on the license server. What should you do?

A. Remove the Per User RDS CALs.B. Revoke the Per Device RDS CALs.C. Remove the Per Device RDS CALs.D. Repeat the installation of the RDS CALs.

Correct Answer: BSection: (none)Explanation

Explanation/Reference:Licensing Corner – CALs

We are often asked by clients “What are these CAL things and why do I need to buy them – I’m already buying(or I’ve already bought) a server license?” Well, this goes back to the way that Microsoft sells and licenses mostof their server products. If you remember the inaugural License Corner back in October 2010, we said thatwhen you pay Microsoft for software you are not acquiring a physical object that has intrinsic value in the objectitself but, rather, are acquiring a limited right to use the software. A software license provides the legal right toinstall, use, access, display, run, or otherwise interact with a software program.

For most server products Microsoft uses a Server + Client Access License (CAL) model as the primary methodfor licensing the use of the software. This means that first you must purchase a license to install and operatethe server software on the physical server. Then for every user or device that accesses the server to useservices on that server, such as file storage or printing or to utilize an application running on that server, aClient Access License (CAL) must be purchased. So the CAL simply permits access to the server. (Note: if youhave multiple Windows Servers in your network one CAL permits access to all the servers. You don’t have tobuy a CAL for every unique server.)There are two types of CALs and the decision on which to purchase is based on how users (employees,typically) will access the server. There are User CALs and Device CALs.

User CALsWith the User CAL, you purchase a CAL for every user who accesses the server to use services such as filestorage or printing, regardless of the number of devices they use for that access. Purchasing a User CAL mightmake more sense if your company employees need to have roaming access to the corporate network usingmultiple devices, or from unknown devices, or simply have more devices than users in your organization.

Device CALsWith a Device CAL, you purchase a CAL for every device that accesses your server, regardless of the numberof users who use that device to access the server. Device CALs may make more economic and administrativesense if your company has workers who share devices, for example, on different work shifts.The Microsoft products that utilize the User/Device CAL model are:Windows ServerRemote Desktop Services Server (formerly Terminal Server)SQL ServerExchange ServerLync Server (Formerly Office Communications Sever)SharePoint ServerSince every Microsoft server needs the Windows operating system running on it to function just about everyWindows server requires CALs to be accessed. Then if any of the Microsoft server systems listed above areinstalled on the Windows server, those CALs are also needed. So, for example, an Exchange server requiresWindows CALs and Exchange CALs.Pricing is typically the same for User and Device CALs. In addition, both types of CALs can be reassigned fromone device to another or from one user to another provided the reassignment is made either (a) permanentlyaway from the one device or user or (b) temporarily to accommodate the use of the Windows CAL either by aloaner device, while a permanent device is out of service, or by a temporary worker, while a regular employee isabsent. You can also have both User and Device CALs accessing the same server. You can only switchbetween User and Device CALs if the CALs have Software Assurance (see License Corner November 2010)and only upon renewal of the Software Assurance.

Per Device License (Device CAL)The licenses for device (Device CAL) grant the right to use the features provided by one or more servers for allthe devices are fully licensed CAL.Per User License (User CAL)Licenses Per User (User CAL) grant the right to use the features provided by one or more servers to a nameduser.The user can use the functions made available by one or more servers also using more than one device.For server licensesThis licensing model to a particular server is assigned a set number of CALs and the number of devicesallowed to concurrently access the server can not exceed the number of CALs purchased for the server.CALsare not permanently associated to a given device, if the organization decides to add another server WindowsServer 2003 R2, always in a per server, to access the second server will need to purchase additional CALs forWindows Server.For deployment in the server is the system administrator when configuring the serverdetermines the number of CALs to associate, based on the number of licenses purchased for the server.Forserver licenses are available for Windows Server 2003 R2.Processor licensesFor some server products are also available for per-processor licensing model, which includes the purchase ofa license for each processor installed on the server where the software must be run.The license allows theprocessor to access by an unlimited number of users that can connect from the LAN (Local Area Network) orWAN (Wide Area Network) or outside the firewall.Therefore, it is not necessary to purchase additional serverlicenses, CALs, or Internet Connector.Example Scenarios

Dismissal "To Device" or "Per User"In this scenario, the organization has chosen to deploy Windows Server 2003 R2 in mixed mode "To Device"and "Per User" by buying a mix of Device CALs and User.

Dismissal "Per Server"In this scenario, the organization has chosen to deploy Windows Server 2003 R2 on a per server, the purchaseof five CALs allow a maximum of five devices to connect simultaneously to the server.To provide an opportunityto connect to the server, by excluding devices, will be necessary to increase the amount of CALs, or wait forone of five devices that occupies a CAL terms the connection to the server and, therefore, makes it free.

How to: License Microsoft Windows Server in a VMware environment – Part 1Last week I had another nice discussion around the 90 day assignment rule for Windows Server licensing on aVMware environment. To answer this shortly: You may move running instances between licensed serverswithout acquiring additional licenses. However you cannot exceed the maximum number of instances eachserver is licensed to run.Microsoft Operating System Environments (OSE)Microsoft defines Operating System Environments for allocating licenses. This is a nice and flexible way toaccommodate customer demand. To understand how licensing works under virtualization, it is important tounderstand how Microsoft defines an OSE.An “operating system environment” is:1all or part of an operating system instance, or all or part of a virtual (or otherwise emulated) operating systeminstance which enables separate machine identity (primary computer name or similar unique identifier) orseparate administrative rights, and2instances of applications, if any, configured to run on the operating system instance or parts identified above.Microsoft makes a distinction between physical and virtual. A physical operating system environment isconfigured to run directly on a physical hardware system. The operating system instance used to run hardwarevirtualization software (for example, VMware) or to provide hardware virtualization services (for example,VMware) is considered part of the physical operating system environment. A virtual operating systemenvironment is configured to run on a virtual (or otherwise emulated) hardware system. A physical hardwaresystem can have either or both of the following:one physical operating system environment and one or more virtual operating system environmentsWhen running Windows on a VMware environment you will have multiple virtual OSE’s running on top off forinstance VMware ESX.

The breakeven point of licensing VMsWindows 2008 comes in several products and licensing opportunities.Product Maximum permitted running

virtual instancesPrice

Windows Server 2008 Standard (+10 CALs) 1 $ 1.209,-Windows Server 2008 Enterprise (+25 CALs) 4 $ 3.999,-Windows Server 2008 Datacenter (no CALs) Unlimited (1 Processor)

€ 2.999,-A CAL is roughly about $ 40,- (All retail prices) For keeping this simple I won’t take the CALs into account andwill blog about it in a blog post later on.When comparing the above licenses, when implementing a VMware virtual environment with servers containing2 Quad core processors (or higher, more core density) it is best to use Datacenter licenses if it is mostly aMicrosoft infrastructure running.4 * 1.209,- = $ 4.836,-2 * 3.999,- = $ 7.998,-2p * 2.999, = $ 5.999,-We found that 7 VMs is the breakeven point to switch to Datacenter edition licensing. If the virtual environmentis going to run more than 7 virtual machines on top of an ESX server, Datacenter licensing is the way to go.Some real life casesWe use Microsoft Enterprise licensing for ESXi servers running 4 virtual XenApp servers and we use MicrosoftDatacenter licensing for most of the environments we have build. Often running with 16 or more VirtualMachines on top of an ESX server, makes the licensing cost per virtual machine 4.510,- / 16 = 282,-Things you should know about Datacenter licensingServers with Windows Server Standard or Enterprise licenses covered by Software Assurance can be “steppedup” to a Windows Server Datacenter Edition processor license to take advantage of its unlimited virtualizationrights.The 64-bit version of Datacenter Edition can be licensed for 128-way systems, with each partition capable ofsupporting a maximum of 64 processors.You may not run instances ofDatacenter on a server with less than two processors.Note that partitioning of a Datacenter system is supported logically at a licensing level and physical level. Inother words, you are not required to obtain more Datacenter Edition server licenses than the total number ofprocessors on that server (2 processor minimum).Licensing for Peak CapacityAn ESX server running virtual OSE’s must have assigned licenses equal to or exceeding the number of runninginstances. You need to be aware and look sharp on the peak capacity running on the ESX server, with HA andDRS check how many instances could be running/landing on an ESX server. For instances a VMware cluster of3 ESX servers all running 8 virtual OSE’s in normal production, will run 12 virtual instances on 2 ESX serverswhen in maintenance mode or when a HA failure is detected. So every ESX server must have 12 Windows2008 Standard licenses assigned or 3 Windows 2008 Enterprise server licenses or must have 2 Windows 2008Datacenter licenses assigned.Myths and AnswersThere is a lot of Fear Uncertainty and Doubt (FUD) out in the field around the whole licensing MicrosoftProducts on a VMware environment. So will bust the most common myths out there.Myth:You may not move a virtual Windows server from 1 ESX server to another ESX server within 90 days.

Answer:From page 10 of theLicensing Brief Microsoft Windows Server 2008 to Run with VirtualizationTechnologiesis the following quote:‘For Windows Server software, except in a few cases (see “Assignment of Licenses” above), licenses may onlybe reassigned to new hardware after 90 days. This, however, does not restrict the dynamic movement of virtualOSEs between licensed servers. As long as the servers are licensed and do not simultaneously run moreinstances than the number for which they are licensed,you are free to use VMotion and System Center VirtualMachine Manager to move virtualized instances between licensed servers at will’Myth:You do have to license every template and non-running virtual machines stored on the SAN.Answer:You only need to license the servers running the workload, so not templates standby servers ordisaster recovery machines on an other site. As long as they don’t run any load.If a server is licensed, thenstored or non-runninginstances of Windows Server and other Microsoft servers donot require separate licenses. The use rights permit you to store any number of instances under each license.You can also store instances on a large storage area network (SAN) or store instances on your servers withoutneeding additional licenses for each instance. (See also page 2 of the Licensing Brief Microsoft WindowsServer 2008 to Run with Virtualization Technologies)Myth:I cannot run Windows 2003 anymore or I need to acquire special licensing to run Windows 2003/8standard edition.Answer:In place of the licensed version, you may run prior versions or lower editions in any of the OSEs of thelicensed server. For example, if you have a server licensed for Windows Server 2008 Enterprise, you may runinstances of Windows Server 2008 Standard or Windows Server 2003 R2 Enterprise Edition or WindowsServer 2003 R2 Standard Edition in any of the allowed five instances on the server. As an extension of theabove rights, you may also run prior versions of lower editions. You may not run more instances on the serverthan your licenses allow. (See also page 4 of the Licensing Brief Microsoft Windows Server 2008 to Run withVirtualization Technologies)ConclusionI must say the last year Microsoft went from the bad boy on the block of virtual environments to the good guys,helping their customers out with redesigning licensing around their products for virtual environments. Next tocome is the VECD licensing that will be shifted into SA or you can buy a special Windows Virtual DesktopAccess (Windows VDA) costing $100 per year per device and aimed at organizations who are using endpointsthat do not have a Windows SA license.As long as the servers are licensed and do not simultaneously run more instances than the number for whichthey are licensed, you are free to use VMotion to move virtualized instances between licensed servers at will.You are allowed and may downgrade to a prior version like for example Windows 2003 if needed.You won’t have any problems with the 90 day reassignment rule of Windows licenses, if you make sure youhave the proper licensing in place for the physical VMware boxes.We talked about licensing Windows Server on a VMware environment but that’s only one part of thelicensingnightmare. You will also need client access licenses also called CALs.Client Access LicensingIn addition of the Windows Server 2008 License you also need a Windows Server 2008 Client Access Licensealso called CAL. This is required for each user or device (or combination of both) that accesses or uses theWindows 2008 software.RequirementsEvery user or device accessing the Windows Server 2008 needs a CAL. Youdon’tneed a CAL when:You access the instance of server software only through the internet without being authenticated or individuallyidentified by the server software;You access Windows Web Server 2008;If external users are accessing the instances of server software and you have acquired a Windows Server 2008External Connector License for each server being accessed;You only administer the server software with two devices or users;You use the Windows Server 2008 solely as a virtualization host.The last point doesn’t impact us much because we use VMware ESXi solely as our virtualization platform.How to choose the correct CAL licensing?Step 1 – Choose your CAL type: Device CAL or User CALYou can choose between two types of Windows CALs: device-based (Device CALs) or user-based (WindowsUser CALs).

With a device-CAL you access the network and the Windows Server 2008 resources from a device which mightbe used by multiple users. For every device which accesses the network you need a device CAL.

With a user-CAL one user uses multiple devices to access the resources on the network for every user in theorganization that accesses the network you will need a user-CAL license.Step 2 – Choose your Client Access Licensing Mode: Per User/Per Device Mode or Per Server modeAfter choosing a user-based or device-based license you have the option to use the server software in twodifferent modes: Per User/Per Device mode or Per Server mode. Both modes are available for either type oflicense.Per User/Per Device modeThis mode is the mode where 1 user may access several servers, it replaces the Per Seat mode found in olderversions of Windows. (99.9% of the customers run the software in this mode)Per Server modeIn this mode you need a CAL for every user/device who accesses a server. So if you have multiple servers youneed per user/device a CAL for every server accessed.Now that we have the Server licenses and the different forms let’s try an example.Example:An organization uses 3 VMware vSphere 4 ESXi servers, with 2 Six Core CPUs per server to host 60 Windows2008 and 5 Windows 2003 virtual machines. These machines are accessed by 2500 Internet users withoutbeing authenticated, 1200 employees who work in 3 – 8 hour shifts on about 2000 different devices.What licensing do we need here?6 Windows Server 2008 Datacenter licenses and 1200 Windows User CALs (user based licenses) and theservers in per user/per device mode.If you deploy Windows Server 2003 virtual machines onto VMware ESXi, you do not require Windows Server2008 CALs for your virtual machine users. (You will still require CALs for your appropriate Windows Serveredition, in this case, for Windows Server 2003), because of the server mode and the CALs best be user-basedyou already have the appropriate licenses for the Windows 2003 servers if you bought new ones for theWindows 2008 servers.

Do we need a CAL or an External Connector License?

Core CAL SuitesWe discussed the basic CALs you need when running Windows virtual machines in a VMware environment, butinside the virtual machines we tend to run Microsoft applications like: Exchange, SQL, Sharepoint, OCS,System Center and Forefront. For each of these applications you also need a CAL besides the server side ofthe licensing.There are a lot of different CALs and types out there; some are combined in suites but also exclusivelyavailable. The suites can only be purchased through volume licensing.The Core CAL includes CALs for:Microsoft Windows ServerMicrosoft Exchange ServerMicrosoft Systems Management ServerMicrosoft SharePoint Portal ServerFor SQL Server you can also buy a processor license instead of CALs. For System Center you buyManagement Server CALs. With the Enterprise CAL Suite you get more options on top of the Core CAL suite.What types of CALs are out there?As you can see there are a lot of flavors and different CALs out there, some we mentioned are:Windows User CALDevice CALTS CAL (Terminal Services)RDS CAL (Remote Desktop Services)Per Processor CALManagement Server CALCore CAL (Suite)Enterprise CAL (Suite)RMS CALVECDCAL SuitesCore CAL SuiteEnterprise CAL SuiteBecause CAL Suites contain licenses to products that are released independently, CAL Suites are version-less.CAL Suites are only offered with Software Assurance coverage, and accordingly give customers the right to usethe most recent version of every product in the suite.All Enterprise CAL Suite components are available for individual purchase also. For more information aroundlicensing the core CAL and Enterprise Suite follow thislink.VECDEither VECD or VECD for SA is required for any VDI environment running Windows as the guest operatingsystem, regardless of the choice of infrastructure or hypervisor vendor that the customer chooses. Moreinformation about the VECD license can be found at the followinglink.CAL TrackingBecause of all the different CALs and software licenses it becomes hard too find out which software you useand which license you will need, Microsoft made a tool called the MAP Toolkit to help us track which software isused in the environment so we get a picture of what licenses we should get to get compliant with the terms andconditions.The Microsoft Assessment and Planning (MAP) Toolkit is an agentless tool designed to simplify and streamlinethe IT infrastructure planning process across multiple scenarios through network-wide automated discovery andassessments. MAP performs an inventory of heterogeneous IT environments and provides you with usageinformation for SQL Server and servers in the Core CAL Suite.The Microsoft Assessment and Planning (MAP) Toolkit 5.0 includes the following new features for simplified ITinfrastructure planning:Heterogeneous IT environment inventorySoftware usage tracking for Windows Server, SharePo int Server, System Center ConfigurationManager, Exchange Server, and SQL ServerMicrosoft Office 2010 readiness assessmentSQL Server discovery and assessment for consolidationWindows 2000 migration assessmentYou can use this toolkit to track the use of Windows Server and several Microsoft applications like Sharepoint,SCCM , Exchange Server and SQL Server.

QUESTION 3Your company has an Active Directory Domain Services (AD DS) domain.

All servers run Windows Server 2008 R2.You are deploying Remote Desktop Services (RDS). You install a Remote Desktop Session Host (RD Session Host) server in the environment. You need to install Remote Desktop Services client access licenses (RDS CALs). What should you do first?

A. Run the Install Licenses Wizard.B. Run the Manage RDS CALs Wizard.C. Add the Remote Desktop Licensing role service.D. Add the RD Session Host server to a new group in the Remote Desktop Connection Manager console.

Correct Answer: CSection: (none)Explanation

Explanation/Reference:

QUESTION 4Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host)server. You need to select a digital certificate for signing Remote Desktop Protocol (.rdp) files.Which two certificate types can you use to achieve this goal? (Each correct answer presents a completesolution. Choose two.)

A. Code SigningB. Authenticated SessionC. Workstation AuthenticationD. Remote Desktop Protocol (RDP) Signing

Correct Answer: ADSection: (none)Explanation

Explanation/Reference:Code signing is the process of digitally signing executables and scripts to confirm the software author andguarantee that the code has not been altered or corrupted since it was signed by use of a cryptographic hash.

Code signing can provide several valuable features. The most common use of code signing is to providesecurity when deploying; in some programming languages, it can also be used to help prevent namespaceconflicts. Almost every code signing implementation will provide some sort of digital signature mechanism toverify the identity of the author or build system, and a checksum to verify that the object has not been modified.It can also be used to provide versioning information about an object or to store other meta data about anobject.

About Digitally Signing RemoteApp ProgramsYou can use a digital signature to sign .rdp files that are used for RemoteApp connections to the RemoteDesktop Session Host (RDSession Host) server. This includes the .rdp files that are used for connectionsthrough RDWeb Access to RemoteApp programs and to the desktop of an RDSession Host server.

To connect to a RemoteApp program by using a digitally signed .rdp file, the client must be running at least Remote Desktop Client (RDC)6.1. (The RDC6.1 client supportsRemote Desktop Protocol6.1.)If you use a digital certificate, the cryptographic signature on the connection file provides verifiable informationabout your identity as its publisher. This enables clients to recognize your organization as the source of theRemoteApp program or the remote desktop connection, and allows them to make more informed trustdecisions about whether to start the connection. This helps protect against the use of .rdp files that were alteredby a malicious user.You can sign .rdp files that are used for RemoteApp connections by using a Server Authentication certificate[Secure Sockets Layer (SSL) certificate], a Code Signing certificate, or a specially defined Remote DesktopProtocol (RDP) Signing certificate. You can obtain SSL and Code Signing certificates from public certificationauthorities (CAs), or from an enterprise CA in your public key infrastructure hierarchy. Before you can use anRDP Signing certificate, you must configure a CA in your enterprise to issue RDP Signing certificates.If you are already using an SSL certificate for RDSession Host server or RDGateway connections, you can usethe same certificate to sign .rdp files. However, if users will connect to RemoteApp programs from public orhome computers, you must use either of the following:A certificate from a public CA that participates in the Microsoft Root Certificate Program Members program(http://go.microsoft.com/fwlink/?LinkID=59547).If you are using an enterprise CA, your enterprise CA-issued certificate must be co-signed by a public CA thatparticipates in the Microsoft Root Certification Program Members program.Membership in the localAdministrators group, or equivalent, on the RDSession Host server that you plan toconfigure, is the minimum required to complete this procedure.Review details about using the appropriateaccounts and group memberships athttp://go.microsoft.com/fwlink/?LinkId=83477.To configure the digital certificate to useOn the RDSession Host server, open RemoteApp Manager. To open RemoteApp Manager, clickStart , pointtoAdministrative Tools , point toRemote Desktop Services , and then clickRemoteApp Manager .In theActions pane of RemoteApp Manager, clickDigital Signature Settings . (Or, in theOverview pane, nexttoDigital Signature Settings , clickChange .)Select theSign with a digital certificate check box.In theDigital certificate details box, clickChange .In theSelect Certificate dialog box, select the certificate that you want to use, and then click OK.

The Select Certificate dialog box is populated by certificates that are located in the local computer's certificates store or in your personal certificate store. Thecertificate that you want to use must be located in one of these stores.Using Group Policy settings to control client behavior when opening a digitally signed .rdp fileYou can use Group Policy to configure clients to always recognize RemoteApp programs from a particularpublisher as trusted. You can also configure whether clients will block RemoteApp programs and remotedesktop connections from external or unknown sources. By using these policy settings, you can reduce the

number and complexity of security decisions that users face. This reduces the chances of inadvertent useractions that may lead to security vulnerabilities.The relevant Group Policy settings are:Specify SHA1 thumbprints of certificates representi ng trusted .rdp publishersAllow .rdp files from valid publishers and user’s d efault .rdp settingsAllow .rdp files from unknown publishersThese Group Policy settings are located inComputer Configuration\Policies\Administrative Temp lates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client andUserConfiguration\Policies\Administrative Templates\Win dows Components\Remote Desktop Services\Remote Desktop Connection Client .These Group Policy settings can be configured by using either the Local Group Policy Editor or the GroupPolicy Management Console (GPMC).For more information about Group Policy settings for Remote Desktop Services, see the Remote DesktopServices Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

QUESTION 5Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs WindowsServer 2008 R2. Client computers run Windows Vista and Windows 7. You need to automate the migration of user settings from client computers to the RD Session Host server. Which tool should you use?

A. Windows Easy TransferB. User State Migration Tool (USMT)C. Windows System Image Manager (Windows SIM)D. Deployment Image Servicing and Management (DISM)


Explanation/Reference:The User State Migration Tool (USMT) is a Microsoft command line utility program intended to allow advancedusers, comfortable with Scripting language, to transfer files and settings between PCs. This task is alsoperformed by Windows Easy Transfer, recommended for general users. USMT supports the high-volume,automated deployment of files and settings from Microsoft Windows versions 2000, XP, Vista and Windows 7and is useful in migrating user settings and files during OS upgrades. 32-bit to 64-bit migrations are supported,but 64-bit to 32-bit are not.Because USMT has high complexity and a command line interface, there have been several attempts toprovide access to its useful functionality by creating GUI wrappers for it.

Windows® User State Migration Tool (USMT) 4.0 is a scriptable command-line tool that provides a highly-customizable user-profile migration experience for IT professionals. USMT includes two components,ScanState and LoadState, and a set of modifiable .xml files: MigApp.xml, MigUser.xml, and MigDocs.xml. Inaddition, you can create custom .xml files to support your migration needs. You can also create a Config.xmlfile to specify files or settings to exclude from the migration.

For the latest updates to this documentation, as well as USMT 4.0 white papers, go to thisMicrosoft Web site.

Benefits

USMT 4.0 provides the following benefits to businesses that are deploying Windows® operating systems:Safely migrates user accounts, operating system and application settings.Lowers the cost of deploying Windows® by preserving user stateReduces end-user downtime required to customize desktops and find missing filesReduces help-desk calls

Reduces the time needed for the user to become familiar with the new operating systemIncreases employee satisfaction with the migration experience.Limitations

USMT is intended for administrators who are performing large-scale automated deployments. If you are onlymigrating the user states of a few computers, you can useWindows Easy Transferfor computers runningWindowsVista® or Windows®7.

There are some scenarios in which the use of USMT 4.0 is not recommended. These include:Migrations that require end-user interaction.Migrations that require customization on a machine-by-machine basis.

QUESTION 6Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7.You have a Remote Desktop Session Host (RD Session Host) server. You have the following requirements:Local devices from remote desktop clients must be redirected to the RD Session Host server.USB devices fromremote desktop clients must not be redirected to the RD Session Host server. What should you do?

A. Disable drive redirection on the remote desktop clients.B. Disable drive redirection on the RD Session Host server.C. Enable the Prevent installation of removable devices Group Policy setting on the remote desktop clients.D. Enable the Prevent installation of removable devices Group Policy setting on the RD Session Host server.



QUESTION 7Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host)server. You need to ensure that remote desktop users can print only to the printers that are installed on the RDSession Host server. What should you do?


A. Enable the Do not allow client printer redirection Group Policy setting.B. Disable the Do not allow client printer redirection Group Policy setting.C. Enable the Do not set default client printer to be default printer in a session Group Policy setting.D. Disable the Do not set default client printer to be default printer in a session Group Policy setting.

Correct Answer: ASection: (none)Explanation


QUESTION 8Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7.You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that computeridentities are validated before user authentication is performed. What should you do?

A. Configure the Set TS Gateway authentication method Group Policy setting to Use smart card.B. Configure the Set TS Gateway authentication method Group Policy setting to Use locally logged- on

credentials.C. Enable the Configure server authentication for client Group Policy setting and then select Do not connect if

authentication fails.D. Enable the Configure server authentication for client Group Policy setting and then select Always connect,

even if authentication fails.



QUESTION 9Your companys main office and a branch office are connected by a slow WAN link. All servers run WindowsServer 2008 R2. All client computers run Windows 7. You install an application on a Remote Desktop SessionHost (RD Session Host) server. Users in the branch office experience slow performance when accessing theapplication through Remote Desktop. You need to minimize the bandwidth utilization to the RD Session Hostserver. What should you do?

A. Configure BranchCache in Hosted Cache mode.B. On the RD Session Host server, configure the RDP-TCP properties to allow only Network Level

Authentication.C. On each client computer, set the display colors in the Remote Desktop Connection client to High Color (15

bit).D. On each client computer, configure the Connect From Anywhere settings in the Remote Desktop

Connection client.



Choosing 15 bit color will diminish the graphic quality you see on the child computer, but unless you’re usingPhotoshop or other graphic intensive programs on the child computer, the difference won’t matter. And, the lessvisual data that has to be streamed back to the parent computer means a snappier remoting experience!

QUESTION 10

Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7.You have a Remote Desktop Session Host (RD Session Host) server. You need to ensure that each user isauthenticated to the RD Session Host server before a session is created. What should you do?

A. Set the security layer option to SSL (TLS 1.0).B. Set the encryption level option to FIPS Compliant.C. Set the log on option to Always prompt for password.D. Set the security option to Allow connections only from computers running Remote Desktop with Network

Level Authentication.



QUESTION 11Your company runs Remote Desktop Services. You have a Remote Desktop Session Host (RD Session Host) server.You enable Microsoft Word as a RemoteApp application on the RD Session Host server. You need to ensure that the RemoteApp application opens when a user double-clicks a Word (.docx) file on aclient computer. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Create a Windows Installer (.msi) file.B. Create a Remote Desktop Protocol (.rdp) file.

C. In the properties of the RemoteApp application, enable the Allow any command-line arguments setting.D. Enable the Associate client extensions for this program with the RemoteApp program setting for the file.

Correct Answer: ADSection: (none)Explanation

Explanation/Reference:The Generate Microsoft Windows Installer (MSI) Package option creates an MSI file,which can be used to distribute this virtual application to a stand-alone machine withno need for a streaming server. This is helpful for contract or home workers who needaccess to an application but don’t have Active Directory domain access.

Understanding Supported Deployment ScenariosA very common misconception is to think that App-V is an all-or-nothing proposition requiringmuch complexity and architectural considerations. With the latest technologies built intothe App-V client, it is possible to get your feet wet with App-V with no additional backendinfrastructure whatsoever and achieve a very quick return on investment (ROI). In this scenario

App-V is reduced in complexity to that of a packaging technology. Chances are your organizationis already packaging or repackaging MSI files, so packaging to an App-V standard requireslittle extra training because it is a very similar skill set. Be sure that the business justification for an App-Vproject plays a central role in determining which deployment scenario you choose.shows high-level descriptions of the relative complexity of three deployment models.

Stand-alone MSI DeploymentWhen the App-V client is put into stand-alone mode, it does not change the nature of the virtualapplication. The application still exists virtually, and all of the benefits of isolation betweenapplications, packaging with dependencies, and others are still there. What is different, however,is that a sequencer-generated MSI file performs many of the functions of the managementserver, because in this model there is no management server or any other backend requirements.The MSI will copy the SFT file into cache, register file-type associations, and publishthe shortcuts to their locations specified during sequencing.A stand-alone MSI app is managed in a fashion similar to a locally installed application. Itwill register itself with Programs and Features (appwiz.cpl) and will be available to all usersof that PC. Since there is no streaming server to update the virtual app, it is also updated asa physical MSI using your existing processes. Nearly any form of distribution can deploy anApp-V MSI such as USB flash drive, DVD, UNC path, or Group Policy. A shrink-wrappedapplication installer to a deployed virtual application is essentially a three-step process, asshown in Figure

To configure an App-V client for stand-alone operation, first delete all applications listed inthe Application Virtualization Client console and make the following dword value changes inthe Registry:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Configuration]"RequireAuthorizationIfCached"=dword:00000000[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Network]"AllowDisconnectedOperation"=dword:00000001"Online"=dword:00000000[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftGrid\4.5\Client\Permissions]"ToggleOfflineMode"=dword:00000000The last step is to reboot the machine. The machine is now configured as a stand-aloneclient. Remember that this can also be configured centrally via Group Policy with the MicrosoftApplication Virtualization Administrative Template.To install an MSI-wrapped virtual application, launch the MSI file located in the same folderas the virtual application’s SFT file

MSI Install of a virtual application

The stand-alone MSI deployment model is usually the best choice for the following scenarios:◆ In rarely connected or severely bandwidth-limited situations◆ Remote users or contractors who do not have access to Active Directory or to your App-V infrastructure◆ In mature environments where existing application deployment processes are extremely efficient

The stand-alone MSI deployment model’ considerations are◆ No centralized reporting◆ No package upgrade

QUESTION 12Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service & the Microsoft ApplicationVirtualization (App-V) 4.6 client on a server that runs Win2k8 R2. You publish applications to the RD Session Host server by using App-V. Partner companies require access toan internal application.You provide each partner company with a preconfigured Remote Desktop Protocol (.rdp) file that enables thecompany to access the application by using the Connect From Anywhere feature. You need to specify the protocol that each partner company must allow through its firewall to establish theconnection. Which protocol should you specify?

A. RDPB. HTTPSC. RTSPD. RTSPS


Explanation/Reference:Microsoft Windows Server Remote Desktop ServicesMicrosoft’s solution for presentation virtualization has traditionally been called Terminal Services.In Windows Server 2008 R2, Terminal Services has been renamed to Remote DesktopServices (RDS) to better reflect the solution’s abilities to deliver both presentation virtualizationand VDI services.Microsoft Windows Server 2008 R2 RDS can be used to deliver a desktop environment toan endpoint device via RDP. This can be accomplished via the Microsoft Remote Desktop Connection, with aweb browser via (RD) Web Access and via the Windows 7 Start menu. Inaddition, the RD gateway can also be used to provide remote access to an organization’s RDSapplications and remote desktops via RDP over HTTPS.

QUESTION 13Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7.Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You use MED-V to support temporary test environments. You need to ensure that the disk space used by obsolete Workspaces is automatically minimized. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Configure the Workspace as revertible.B. Set an expiration date for the Workspace.C. Specify the number of image versions to keep.D. Configure automatic deletion of the Workspace.

Correct Answer: BDSection: (none)Explanation


Usage Policy and Data Transfer Control A MED-V workspace controls the access and use ofthe Virtual PC image running on the desktop. MED-V uses Microsoft Active Directory DomainServices to provide authentication and authorization services. In addition, workspace usagesettings like offline use, browser behavior, copy and paste rights, access to removable devices,and the expiration period are configured via the Management Console and controlled by theManagement Server.

Configure the Deployment settings. The Deployment configuration settings include areasfor defining which users and groups have access to the Workspace, Workspace expirationdata, offline restriction, data transfer behavior, and device control.a. Click the Deployment tab.b. For the General settings, select Enable Workspace For ‘Everyone.’ You can add orremove users and groups by clicking the Add or Remove button under the Users /Groups pane on the left. Leave the check boxes for Workspace expiration and offlinework restriction unchecked.c. For the Data Transfer settings, select the check boxes for Support Clipboard BetweenHost And Workspace and Support File Transfer Between The Host And Workspace.Note that we are enabling these settings for the purpose of evaluating these featuresin a MED-V test environment. If you are deploying MED-V in a productionenvironment, configure these settings based on your organization’s guidelines andpolicies.d. For the Device Control settings, select the check box for Enable Printing To PrintersConnected To The Host and Enable Access To CD / DVD. We are enabling these settingsfor the purpose of evaluating these features in a MED-V test environment. If youare deploying MED-V in a production environment, configure these settings based onyour organization’s guidelines and policies.

QUESTION 14Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7.

You use Microsoft Enterprise Desktop Virtualization (MED-V). You need to prepare the MED-V server for cluster mode. What should you do?

A. Copy the ConfigurationServer folder to a network share.B. Add the Failover Clustering feature to the MED-V server.C. Add the Network Load Balancing (NLB) feature to the MED-V server.D. Migrate the MED-V server to a highly available virtual machine (HAVM).



The Global Data Location is a single location where all virtual applications on a computerare stored in an immutable state. This folder must be on a local drive and accessible to allusers who will log in to this machine. The preferred drive letter is a logical mount point onthe client and is a pointer to a local cache in the Global Data Location. The User-SpecificData Location is where the user’s application state is located. This can be a network shareto allow the user state to roam with the user. You should test to determine the size becausethe size of user states can vary widely across applications, and it could become too large toroam and lead to decreased user satisfaction.

How to Share Folders Between the Host and the MED-V Workspace

This topic has not yet been rated Rate this topicUpdated: April 1, 2010

Applies To: Microsoft Enterprise Desktop Virtualization

You can share folders between the host and the MED-V workspace. The shared folders can be stored on thefollowing:

An external computer on the network

The host computer

The following procedures demonstrate how to share folders between the host and the MED-V workspace.

To share folders located on the network

Configure MED-V in full desktop mode.

In MED-V management, on the Network tab, click Use different IP address than host (Bridge).

Do the following on the host computer:

In Control Panel, click View network status and tasks, and set Network discovery to On.

On the Start menu, right-click Computer, and click Map network drive.

In the Map Network Drive dialog box, in the Drive field, select a drive.

NoteEnsure that the same drive letter is not in use on both computers.Click Browse.

In the Browse For Folder dialog box, browse to the shared drive, and click OK.

Click Finish.

Repeat step 3 in the MED-V workspace. Point to the same drive as on the host computer.

To share folders located on the host

Configure the folder to be shared with the appropriate permissions.

From the MED-V workspace, go to My network places and locate the shared folder.

From the MED-V workspace, locate the shared folder.

NoteEnsure that both the host and MED-V workspace computers are in the same domain or workgroup.

QUESTION 15Your company has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7.You are deploying Microsoft Enterprise Desktop Virtualization (MED-V) virtual machines (VMs) on several clientcomputers. You need to ensure that names of the new VMs follow a naming convention. What should you do?

A. In the MED-V Management console, configure the Image Update Settings.B. In the MED-V Management console, add a script action and set the VM computer name pattern.C. In the VM, configure the Identification String option by using the Setup Manager Wizard.D. In the VM, run the System Preparation Tool (Sysprep) and choose to start the factory session after

rebooting.



Using Variables to Manage the Naming of your Persistent MED-V WorkspacesMany organizations want to use variables to simplify the naming and manageability of MED-V workspaces.While regular operating system environment variables cannot be used inside the workspace policy, MED-V hasvariables that can be used for persistent workspaces. The workspace policy must use the VM Setup script toimplement these variables.These variables can be selected when configuring the MED-V workspace policy inside the MED-Vmanagement console (run from the client.)To view and select these variables, do the following:1.) Log into the MED-V Management Server (policy server) using the MED-V Management utility.2.) When the policy loads, navigate to the Policy node.3.) Select your desired workspace, then click on the VM Setup Tab. (Be advised that this option is only availablefor persistent workspaces which is defined in the Virtual Machine tab.)4.) In the VM Setup tab you will see an option for "VM Computer Name Pattern" near the bottom of the page.

The default pattern for the machine image name is: MED-V%workspace########## where %workspacerepresents the name of the workspace used by this image on the client computer. The remaining # charactersdenote a random generated character. It is here where you have the option to insert different variables andwhere you can define your own computer name pattern. The variables that can be used are:%Workspace : The name of the MED-V workspace being used by this image during the VM setup.%User : The name of the user logged on to MED-V during the VM setup.%Domain : The domain name (short name) of the authenticating MED-V Active Directory domain.%Hostname : The hostname of the physical machine running the MED-V Client using this workspace.%VMName: The name of the Virtual Machine name (Name of the virtual machine image file used by theworkspace.)

Examples:

If a user named Ernie from the domain CORPORATE logged on to a machine named CLIENT234 using theworkspace called IE_7 leveraging the image XP01 will have the following name translations after generation:VM Computer Name Pattern Actual NameMED-V%Domain##### MED-VCORPORATE5%Workspace-%User IE_7-ERNIE%UserMED-V ERNIEMED-V%Hostname-MEDV CLIENT234-MEDV%VMNameMEDV##### XP01MEDV64345

NOTE: The maximum limit for a name is 15 characters. Any pattern that generates a result that exceeds thislimit will be truncated to the first 15 characters.

5.) Once this is determined, you will need to include the action within the VM setup script. This will require youto click the "Script Editor" option under Persistent VM Setup. Click on this button. The "Rename Computer"Action is required to generate the computer name. Also note, this will need to be followed by a "RestartComputer" action.

QUESTION 16Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You update the MED-V Workspace virtual machines (VMs) several times and notice that the server is runningout of disk space. You need to configure the Workspace to minimize the disk space requirements. What should you do?

A. Configure the Workspace as revertible.B. Set an expiration date for the Workspace.C. Specify the number of image versions to keep.D. Specify that clients should use Trim Transfer when downloading images.



the default Image Update Settings of not enabling the Keep Only (#) Old Image Versions and Suggest UpdateWhen A New Version Is Available. Also accept the default setting of enabling Clients Should Use Trim TransferWhen Downloading Images For This Workspace. Trim Transfer is a MED-V technology that optimizes theprocess of deploying or updating a Workspace image to a client. Prior to MED-V deploying an image to a client,

Trim Transfer indexes the client hard drive and compares this data to the Workspace image, looking forduplicated operating system and application data. Once this process is complete, Trim Transfer will transferonly image data from the Repository Server that doesn’t already reside on the client hard disk, minimizing theamount of data transferred, optimizing network bandwidth, and reducing deployment and update time.

Enable legacy applications and accelerate upgrades to new operating systems Incompatibility of applications with newer versions of Microsoft Windows can delay enterprise operatingsystem (OS) upgrades. Testing and migrating applications can be time-consuming, and meanwhileusers are unable to take advantage of the new capabilities and enhancements offered by the new OS. By delivering applications in a Virtual PC that runs a previous version of the OS (e.g., Windows XP orWindows 2000), MED-V removes the barriers to OS upgrades), MED-V removes the barriers tooperating system upgrades and allows administrators to complete testing and to deal with incompatibleapplications after the upgrade.

From the user’s perspective, these applications are accessible from the standard desktop Start menuand appear side-by-side with native applications—so there is minimal change to the user experience.

What is Microsoft Desktop Enterprise Virtualization (MED-V) v1 SP1?Desktop Enterprise Virtualization (MED-V), Microsoft’s solution for a local desktop virtualization with centralizedmanagement.

IntroductionIn this article, you will learn about Microsoft Desktop Enterprise Virtualization (MED-V), Microsoft’s solution for alocal desktop virtualization with centralized management. Using MED-V, you can deliver multiple virtualmachines to execute on end-user desktops while retaining policy-based control over virtual machineconfiguration, provisioning, and availability.Desktop Virtualization Strategy: Central or Local?While server virtualization is primarily about consolidating and centralizing the workloads of physical machineson a smaller number of more powerful servers, there are two main strategies to consider for desktopvirtualization. If an organization has the goal to virtualize desktop workloads onto centralized data center

servers, desktop virtualization can be accomplished through the implementation of a Virtual DesktopInfrastructure (VDI). Virtual desktops are accessed using rich or thin client devices that support a remotedesktop application such as Microsoft RDP for connection. The benefits of a VDI strategy are:Support for personal (dedicated) or pooled (shared) virtual desktopsSupport for mobile or roaming users on a variety of client devicesEnhanced control over the desktop environment and user data storageEnhanced desktop environment business continuity solutionsNow consider the scenario of an organization that wants to migrate physical machines to the Windows 7 clientoperating system to take advantage of its new feature set, but has one or more groups of users that needaccess to legacy applications that are compatible only with older Windows clients such as Windows XP. Inaddition, users must access new and legacy applications through a single common interface to maximizeusability and minimize user training requirements. There are multiple solutions to satisfy these requirements,including Remote Desktop Services (RDS) with Remote App. However, if an organization has not deployed anRDS infrastructure, a local desktop virtualization strategy is another option. This strategy includes thedeployment of a hosted virtualization application to a physical desktop, providing local access and execution ofmultiple workloads (operating system and application stack) running in distinct virtual machines (VM) with aseamless desktop user experience. MED-V is the Virtual PC 2007 based Microsoft solution that allowsimplementation of this type of local desktop virtualization strategy. The benefits of a MED-V strategy are:Support to deploy Virtual PC 2007 VMs to Windows Vista or Windows 7Support of a centralized repository for VM storage, versioning, and deliverySupport for bandwidth-conservation during delivery and update of VMsSupport for Active Directory integration to control VM provisioning and accessIn summary, VDI and MED-V provide solutions at opposite ends of the virtualization spectrum. Within aMicrosoft centric solution, VDI uses Hyper-V as a platform to provide a centralized strategy for desktopvirtualization, whereas MED-V uses Virtual PC 2007 as a platform to provide a localized strategy for desktopvirtualization with centralized management.MED-V AvailabilityIf you browsed the Microsoft product list, you might be confused as you will not find MED-V in it. Microsoftprovides MED-V as part of the Microsoft Deployment Optimization Pack (MDOP) for Software Assurance.Microsoft Software Assurance is a volume licensing maintenance offering that includes software updates,services, training, and tools. If you are interested in learning more about MDOP, refer to theMDOP site.MED-V v1 TerminologyBefore exploring the MED-V architecture, it is important to understand the terminology that is used with thissolution. The following terms are of particular importance:Image– A virtual machine in which an operating system and applications are installedUsage Policy – A collection of settings that define the user or group assignment, user interface, usagerestriction, image configuration, and application associationWorkspace – A combination of an image and usage policySeamless Mode – A functionality that allows an application running in a VM to present as an application runningon the physical desktop operating systemIn seamless mode, a user can be unaware that a virtual machine is used to host applications that areincompatible with the operating system installed on the physical desktop. Applications are available to usersthrough the standard desktop Start Menu and are launched just like the applications that are natively installedon the desktop operating system.MED-V v1 ArchitectureMED-V includes several components that combine together to provide a solution to manage the creation,testing, provisioning, maintenance, and troubleshooting of virtual machines from a central location. The mainMED-V components include:MED-V Management ServerMED-V Management ConsoleMED-V Image Repository ServerMED-V ClientVirtual PC 2007MED-V Management ServerThe MED-V management server provides the centralized management of VMs stored in the MED-V imagerepository and deployed VMs. It also maintains the mappings between VMs, usage policies, and the ActiveDirectory (AD) users and groups to which they are assigned. Using Active Directory Domain Services (ADDS),the MED-V management server enables provisioning of VMs based on user or group membership, as well asenabling user authentication prior to VM access. MED-V clients also connect to the MED-V management server

to authenticate and retrieve up-to-date usage policy.In addition, the MED-V management server enables aggregation of client events that it maintains in an externalSQL Server, and that are used to monitor and report on client status.MED-V Management ConsoleThe MED-V management console is the graphical user interface (GUI) through which administrators gainaccess and interact with the MED-V management server and MED-V image repository. The MED-Vmanagement console enables administrators to update usage policies, provision MED-V workspaces to usersand de-provision existing users, as well as create, manage, update, or delete images stored in the MED-Vimage repository. Image updates are automatically distributed to relevant users when they work online.MED-V Image Repository ServerThe MED-V image repository server is an IIS Server which stores VMs and enables VM versioning, as well asVM retrieval and distribution using Trim Transfer technology. Trim Transfer technology provides a mechanismto eliminate the transfer of data that is identical between the VM image and the destination desktop. In addition,when an updated VM image is delivered, only the data that has changed will be transferred to the destinationdesktop.MED-V ClientThe MED-V client component is installed on the desktop client machines. The MED-V client is used to connectand authenticate to the MED-V management server, which in turn queries AD for access control and securitypolicy settings. Following completion of the authentication process, the MED-V client retrieves up-to-date usagepolicy from the MED-V management server and retrieves VM image data from the MED-V image repository.The MED-V client is also responsible to customize the VM based on policy, as well as initiating, suspending andterminating a VM session within the Virtual PC 2007 environment.Virtual PC 2007 SP1Virtual machines provisioned to a MED-V client run in Virtual PC 2007 SP1 (and requires the hotfix rolluppackage contained inKB958162). Virtual PC 2007 SP1 is a hosted virtualization platform that runs on top of adefined set of Windows operating systems, providing support for 32-bit guest VMs.Virtual PC 2007 SP1 also supports hardware-assisted virtualization, but does not require it. Hardware-assistedvirtualization is configurable on an individual VM basis. Virtual PC 2007 SP1 is a freedownloadavailable on theMicrosoft website.MED-V v1 System RequirementsMED-V v1 provides support for client desktops running 32-bit Windows XP SP2 and SP3, and 32-bit WindowsVista SP1 and SP2. It supports VM images based on Windows XP Pro SP2 and SP3, as well as Windows 2000SP4. The MED-V management components support installation on Windows Server 2008.MED-V v1 SP1 is currently in the Release Candidate phase and planned for release in April 2010. With MED-Vv1 SP1, Microsoft adds client desktop support for 32-bit and 64-bit Windows 7.ConclusionIf your organization has a requirement to deploy Windows 7, but still has legacy applications that run onWindows XP and there is no RDS or virtualization infrastructure to leverage, MED-V v1 SP1 is a local desktopvirtualization solution that can help you meet your desktop operating system upgrade objectives. Available aspart of the MDOP for Software Assurance, MED-V v1 SP1 provides a virtual machine provisioning andmanagement environment for client desktops, with limited additional infrastructure requirements, and with aseamless desktop experience for end users.

QUESTION 17Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows7. You use Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 to manage your Hyper-V hosts. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V).You plan to deploy a virtual machine (VM) image to all client computers.You need to ensure that user state information is maintained between sessions in the VM. What should youdo?

A. Use VMM to configure placement settings.B. Configure a MED-V revertible workspace policy.C. Configure a MED-V persistent workspace policy.D. Use Hyper-V Manager to create a revert snapshot.



A revertible VM is a MED-V Workspace image that returns to its original state after each session. Leave theSynchronize Workspace Time Zone With Host option at its defaultsetting of being selected.

A Workspace can also be configured to be persistent. A persistent VM is a MED-V Workspace image thatsaves its state after each session. Other options for a persistentWorkspace include shutting down the VM when stopping the Workspace, logging into Windows, running in theVM, and using MED-V credentials to support Single Sign-on (SSO).

Client virtualization is the decoupling of computer resources on the client endpoint device,such as hardware, operating system, applications, and user settings and data. Virtualizationsolutions including desktop virtualization, application virtualization, and user-state virtualizationenable the decoupling or separation of client computing resources. This separationprovides a more flexible or agile environment, reducing complexity and costs and improvingdeployment, security, and manageability. All of these benefits have the potential to improve theoverall desktop environment. A model of the traditional client endpoint device and virtualizedclient architecture is illustrated in Figure

QUESTION 18Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server2008 R2. All client computers run Windows 7.You use Microsoft Enterprise Desktop Virtualization (MED-V) to support client virtualization requirements. You need to ensure that all MED-V virtual machine (VM) images can be centrally stored and are available to allclient computers.What should you do?

A. Install and configure IIS on a member server.B. Configure a shared folder on a member server.C. Create a single workspace for all client computers.D. Install and configure Microsoft SQL Server 2008 on a member server.



QUESTION 19Your company has an Active Directory Domain Services (AD DS) domain.All servers run Windows Server 2008 R2. All client computers run Windows 7.You manage client computers by using Microsoft System Center Configuration Manager 2007 R2. You are deploying Microsoft Enterprise Desktop Virtualization (MED-V) to support client virtualizationrequirements. You need to ensure that administrators can centrally store MED-V logging information and generate reports. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Install and configure IIS on a member server.B. Configure a shared folder on a member server.C. Install and configure Microsoft SQL Server 2008 on a member server.D. Configure Microsoft Asset Inventory Service on the Configuration Manager server.

Correct Answer: ACSection: (none)Explanation


Microsoft® Enterprise Desktop Virtualization (MED-V), a core component of the Microsoft Desktop OptimizationPack (MDOP)for Software Assurance, enables deployment and management of Microsoft virtual PC Windowsdesktops to enable key enterprise scenarios. Primarily, MED-V helps enterprises upgrade to the latest versionof Windows even when some applications are not yet functional or supported. MED-V builds on top of Virtual PC to run two operating systems on one device,adding virtual image delivery, policy-based provisioning, and centralizedmanagement. With MED-V, you can easily create, deliver and manage corporate Virtual PCimages on any Windows®-based desktop.

Table 1: Recommended System Configuration Memory 2 GB RAM or greater Processor Recommended: 2 GHz or faster Operating system Windows Server 2008 Standard/

Enterprise Edition Database MS SQL Server Enterprise/Express

Edition

Configuring Image Distributions Server

An image repository is an optional server which is used for image distribution (where administrators upload newimages; and client machines check the server every 15 minutes and update their image if a new one isavailable). Note: The Image Repository is optional and this section is only relevant if an Image Repository willbe used.

2.1.1.1. Server System Requirements The recommended system configuration for use of MED-V is provided in the following table. Systemperformance will be improved when utilizing a system with the recommended system configuration.

QUESTION 20Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7. Your environment includes Microsoft Enterprise Desktop Virtualization (MED-V). You are preparing to update a MED-V Workspace that is used by 1000 client computers. You need to minimize the network impact of updating the Workspace. What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choosetwo.)

A. Pack the Workspace images.B. Enable Trim Transfer on the Workspace.C. Send each virtual machine file storage folder to a compressed (zipped) folder.D. On each virtual machine file in the Workspace, enable file system compression.

Correct Answer: ABSection: (none)Explanation


the default Image Update Settings of not enabling the Keep Only (#) Old Image Versions and Suggest UpdateWhen A New Version Is Available. Also accept the default setting of enabling Clients Should Use Trim Transfer When Downloading Images ForThis Workspace. Trim Transfer is a MED-V technology that optimizes the process of deploying or updating a Workspace imageto a client. Prior to MED-V deploying an image to a client, Trim Transfer indexes the client hard drive and compares thisdata to the Workspace image, looking for duplicated operating system and application data. Once this processis complete, Trim Transfer will transfer only image data from th e Repository Server that doesn’t alreadyreside on the client hard disk, minimizing the amou nt of data transferred, optimizing networkbandwidth, and reducing deployment and update time .

MED-V Trim Transfer Technology

The MED-V advanced Trim Transfer de-duplication technology accelerates the download of initial and updated

virtual machine images over the LAN or WAN, thereby reducing the network bandwidth needed to transport aMED-V workspace virtual machine to multiple end users. This technology uses existing local data to build thevirtual machine image, leveraging the fact that in many cases, much of the virtual machine (for example,system and application files) already exists on the end user's disk. For example, if a virtual machine containingWindows XP is delivered to a client running a local copy of Windows XP, MED-V will automatically remove theredundant Windows XP elements from the transfer. To ensure a valid and functional workspace, the MED-Vclient cryptographically verifies the integrity of local data before it is utilized, guaranteeing that the local blocksof data are absolutely bit-by-bit identical to those in the desired virtual machine image. Blocks that do not matchare not used.

The process is bandwidth-efficient and transparent, and transfers run in the background, utilizing unusednetwork and CPU resources. When updating to a new image version (for example, when administrators want to distribute a new applicationor patch), only the elements that have changed ("deltas") are downloaded, and not the entire virtual machine,significantly reducing the required network bandwidth and delivery time.

0000

QUESTION 21Your organization has an Active Directory Domain Services (AD DS) domain. All client computers run Windows 7.You need to create a single distribution file containing Windows Virtual PC and a virtual machine image that willbe deployed to all client computers. Which should you use?

A. Microsoft Deployment Toolkit (MDT) 2010B. Deployment Image Servicing and Management (DISM)C. Microsoft Enterprise Desktop Virtualization (MED-V) Packaging WizardD. Microsoft System Center Virtual Machine Manager (VMM) 2008 R2 with a template


Explanation/Reference:Removable Media DeploymentRemovable media such as a DVD or USB storage device can also be used to initially deploy a MED-VWorkspace. The process for deploying a MED-V Workspace using removable media is provided in thefollowing steps:

1. Create the MED-V Workspace, and upload the packed image to the repository using the MED-VManagement Console. You can skip this step if you have already created theMED-V Workspace and image.

2. Download the image to the desired Management Console workstation using the MED-V ManagementConsole. The image files will be downloaded to C:\MED-V_Images\PackedImages\imagename directory on the local hard disk of the Management Console.

You can skip this step if you have already downloaded the MED-V Workspace and image.

3. To prepare for the Packaging Wizard deployment package process, create a local or network directory withseparate subdirectories for the MED-V client, Virtual PC, and .NET Framework installation files, and copy the associated setup files into these directories. The PackagingWizard will ask for the location of these installation files during this process.4. �On the MED-V Management Console top menu bar, select Tools Packaging Wizard.5. On the Packaging Wizard Deployment Package screen, click Next.6. On the Workspace Image screen, mark the check box to include the image in the package. Select the image we just downloaded and click Next.7. On the MED-V Installation Settings screen, select the path where we located the MED-V installation files,enter the MED-V server address and port, select Install MED-V Using Default Installation Settings if appropriate, and click Next.8. On the Additional Installations screen, select the appropriate check boxes and installation path for Virtual PC2007 SP1, Virtual PC QFE, and .NET Framework 2.0, and click Next.9. On the Finalize screen, enter the path for the package destination and package name, and click Finish.10. Copy the contents of the MED-V deployment package to the removable media (DVD or USB storagedevice). a. On the personal computer targeted for the Workspace deployment, insert the DVD or USB storagedevice that has the deployment package files that we previously copied. b. Open the removable media device, and launch the MedvAutorun.exe application. The MED-V screen willappear, asking if you would like to install the MED-V package now. The Installer screen will be also be displayed and will provide progress information for the installation ofVirtual PC 2007 SP1, Virtual PC 2007 SP1 Update, MED-V Client, and the importing of theWorkspace image. At the end of the process, the MED-V Installer window will display a message saying thatMED-V was successfully installed. c. The MED-VWorkspace is now ready to use.

QUESTION 22All client computers in your company run Windows 7.Windows Virtual PC is installed on all client computers.You create and configure a virtual machine (VM) named Guest1. You need to use the Guest1 virtual hard disk (VHD) as a base for additional VMs that will run on the same hostcomputer, and minimize the disk space required for each new VM. Which type of VHD should you create for thenew VMs?

A. fixed sizeB. differencingC. dynamically expandingD. linked to a physical hard disk



Differencing . A differencing virtual hard disk stores the differences from the virtual hard disk on themanagement operating system. This allows you to isolate changes to a virtual machine and keep a virtual harddisk in an unchanged state. The differencing disk on the management operating system can be shared withvirtual machines and, as a best practice, must remain read-only. If it is not read-only, the virtual machine’svirtual hard disk will be invalidated.

Bump

QUESTION 23All client computers in your company run Windows 7 Enterprise. Users run Windows XP Mode guest virtualmachines (VMs) on their computers.Each client computer runs two guest VMs. Each guest VM requires network connectivity to the other guest VM on the host computer, but must not havenetwork connectivity to the host computer operating system or to the Internet. You need to configure each guest VM to meet the requirements. What should you do?

A. Set each VM network adapter to Not connected.

B. Configure each VM to use one Internal Network network adapter.C. Configure each VM to use one Shared Networking (NAT) network adapter.D. Disable Integration Features for each VM. Configure Windows Firewall to allow incoming ICMP traffic, and

remove all other Windows Firewall exceptions.



Windows Server-based hosts on a perimeter network

Aperimeter networkis separate from an organization's internal network and the Internet and has the followingcharacteristics:Allows external users to access specific computers located on the perimeter network.Prevents access to computers on the organization's internal network.Can be set up to allow limited access from users on the internal network to computers located on the perimeternetwork.For example, a perimeter network can include the company's Web server so that it can deliver Web content tothe Internet. However, the perimeter network does not allow external users to access any private company dataon computers on the internal network. Even if an external user penetrates the perimeter network security, onlythe perimeter network servers might be compromised.

You can deploy virtual machines on a host on a perimeter network from within the internal network. However,after you deploy virtual machines on a host on a perimeter network, you cannot migrate those virtual machinesback to a host on the internal network or to another host on the perimeter network.

Because a perimeter network is separate from the internal network, security for a host on a perimeter networkmust be provided by a local service account.

QUESTION 24All client computers in your company run Windows 7 Enterprise. You are planning to deploy a custom application that runs only on Windows XP to all users. You install Windows XP Mode on each host computer and install the application in the Windows XP guestvirtual machines (VMs).

You verify that the application runs in the guest VMs. An application shortcut does not appear on the Windows 7 host computers. You need to ensure that the application can be launched directly from the Windows 7 host computers. What should you do in the guest VMs?

A. Repair the application.B. Upgrade the Virtual PC Integration Components.C. Copy the application shortcut to the Start menu for All Users.D. Assign the Full Control permission to the application shortcut to the Everyone group.



QUESTION 25Your company has an Active Directory Domain Services (AD DS) domain that runs at die Windows Server 2008functional level.All domain controllers run Windows Server 2008 R2 (Core Installation).You have a Remote Desktop Services infrastructure that Includes a Remote Desktop Connection Broker (RDConnection Broker) server and a Remote Desktop Session Host (RD Session Host) server in redirection mode.You configure a virtual machine (VM) as a personal virtual desktop for an employee.The Personal Virtual Desktop tab is not visible when you display the properties or the employee's user account.You need to assign a personal virtual desktop to the user account.What should you do?

A. Use the Active Directory Users and Computers console on a server that runs Windows Server 2008 R2.B. Raise the domain functional level to Windows Server 2008 R2.C. Configure a virtual desktop pool on the RD Connection Broker server. Add the VM to the pool.D. Run the Configure Virtual Desktops Wizard.



QUESTION 26Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. You have a Remote Desktop Services infrastructure that hosts remote desktop sessions for users.You need to be able to revoke 240 Remote Desktop Services client access licenses (RDS CALS).What should you do?

A. Configure the Remote Desktop Session Host (RD Session Host) server to use Per Device licensing mode.Install 20 RDS CALs.

B. Configure the Remote Desktop Session Host (RD Session Host) server to use Per User licensing mode.Install 100 RDS CALs.

C. Conngure the Remote Desktop Session Host (RD Session Host) server to use Per User licensing mode.Install 20 RDS CALs.

D. Configure the Remote Desktop Session Host (RD Session Host) server to use Per Device licensing mode.Install 100 RDS CALs.



We talked about licensing Windows Server on a VMware environment but that’s only one part of thelicensingnightmare. You will also need client access licenses also called CALs.Client Access LicensingIn addition of the Windows Server 2008 License you also need a Windows Server 2008 Client Access Licensealso called CAL. This is required for each user or device (or combination of both) that accesses or uses theWindows 2008 software.RequirementsEvery user or device accessing the Windows Server 2008 needs a CAL. Youdon’tneed a CAL when:You access the instance of server software only through the internet without being authenticated or individuallyidentified by the server software;You access Windows Web Server 2008;If external users are accessing the instances of server software and you have acquired a Windows Server 2008External Connector License for each server being accessed;You only administer the server software with two devices or users;You use the Windows Server 2008 solely as a virtualization host.The last point doesn’t impact us much because we use VMware ESXi solely as our virtualization platform.How to choose the correct CAL licensing?Step 1 – Choose your CAL type: Device CAL or User CALYou can choose between two types of Windows CALs: device-based (Device CALs) or user-based (WindowsUser CALs).

With a device-CAL you access the network and the Windows Server 2008 resources from a device which mightbe used by multiple users. For every device which accesses the network you need a device CAL.

With a user-CAL one user uses multiple devices to access the resources on the network for every user in theorganization that accesses the network you will need a user-CAL license.Step 2 – Choose your Client Access Licensing Mode: Per User/Per Device Mode or Per Server modeAfter choosing a user-based or device-based license you have the option to use the server software in twodifferent modes: Per User/Per Device mode or Per Server mode. Both modes are available for either type oflicense.Per User/Per Device modeThis mode is the mode where 1 user may access several servers, it replaces the Per Seat mode found in olderversions of Windows. (99.9% of the customers run the software in this mode)Per Server modeIn this mode you need a CAL for every user/device who accesses a server. So if you have multiple servers youneed per user/device a CAL for every server accessed.Now that we have the Server licenses and the different forms let’s try an example.Example:An organization uses 3 VMware vSphere 4 ESXi servers, with 2 Six Core CPUs per server to host 60 Windows2008 and 5 Windows 2003 virtual machines. These machines are accessed by 2500 Internet users withoutbeing authenticated, 1200 employees who work in 3 – 8 hour shifts on about 2000 different devices.What licensing do we need here?6 Windows Server 2008 Datacenter licenses and 1200 Windows User CALs (user based licenses) and theservers in per user/per device mode.If you deploy Windows Server 2003 virtual machines onto VMware ESXi, you do not require Windows Server2008 CALs for your virtual machine users. (You will still require CALs for your appropriate Windows Serveredition, in this case, for Windows Server 2003), because of the server mode and the CALs best be user-basedyou already have the appropriate licenses for the Windows 2003 servers if you bought new ones for theWindows 2008 servers.Do we need a CAL or an External Connector License?

QUESTION 27Your company has an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2.You provide access to some applications through a virtual desktop infrastructure (VDI) environment. All virtual desktop computers are located in an organizational unit (OU) named VirtuaIDesktops.All other client computer objects are located in an OU named Desktops.Many users experience long logon times when logging into virtual desktop computers due to large roamingprofiles.You need to reduce the user logon times for virtual desktop computers.What should you do?

A. On each virtual desktop computer, set a disk quota on the system drive.B. On each client computer, set the temporary folders option to not use session-specific temporary folders.C. Create a Group Policy object (GPO) that enables folder redirection for all users. Enable slow link detection,

and link the GPO to the VirtuaIDesktops OU.D. Create a Group Policy object (GPO) that enables folder redirection for all users. Enable loopback

processing, and link the GPO to the VirtualDesktops OU.


Explanation/Reference:An Overview on Folder Redirection

Folder Redirection is a Group Policy feature that enables users to redirect the system folders containing theprofile of a user on the network, through the use of the Folder Redirection node in the Group Policy ObjectEditor console. This basically makes folder redirection a user configuration option. Through the use of theFolder Redirection feature, users can configure that the system folders’ contents on the user remains the same,irrespective of the particular computer used to log onto the system. The system folders that users can configurefor folder redirection are listed below:

Application Data: This folder contains user configuration files, user specific data that applications utilize, andPublic Key Infrastructure files.Desktop: This folder holds the shortcuts and files that appear on the user’s desktop.My Documents: This folder holds the user’s files and pictures.Start Menu: This folder holds the shortcuts and files that appear on the Start menu.Folder redirection settings are stored in the User Configuration node of the Group Policy Object Editor. TheOffline Files feature can be configured to enable users to access redirected folders when no networkconnection exists. Users can use the Offline Folder node in Group Policy to configure this feature.

Folder redirection provides the benefits listed below:

Redirecting the My Documents folder ensures that users can access their data from any computer. This appliesto all other redirected folders as well.Because redirected folder data is stored on a network server, the user can back up the data to an offlinestorage media.The disk quotas feature specifies the amount of space that each user’s redirected folders are allowed to use.By configuring the Offline files feature, users can ensure that they have access to the My Documents folderwhen the network connection is lost. This capability is useful to individuals that use laptop computers.When roaming profiles are utilized for users, the network path to My Documents is included in the roaming userprofile. The folder is not included in the profile.The situations in which users should enable folder redirection for the different types of system folders aresummarized below:

Redirect the My Documents folder to allow access to the same documents from any computer on the network.Redirect the Application Data folder when applications should operate in the same manner for a user wheneverthe user utilizes a new system. When the Application Data folder is redirected, the user does not need to beconfigured again when he/she changes systems.Redirect the Desktop folder when users save files that contain data to the desktop.Redirect the Start Menu folder in the following situations:When a user saves files containing data to icons located on the Start menu.When there are consistent software installations through the network.When a user needs to access the Favorites and Printers and Faxes foldersIf an organization already has home folders, Windows Server 2003 includes an option that allows users toredirect My Documents to the user’s home folder. One requirement though is that the user’s home folder needsa Windows XP Professional client. Windows XP Home Edition, Microsoft Windows 2000, and Windows NTclient cannot be utilized.

The manners in which users can configure folder redirection are listed below:

Users can redirect folders to a location based on the security group’s membership.Users can redirect folders to a single location for all users in a site, domain, or OU.

When specifying the location for the redirected folders, the following options exist:

Create a folder for the user beneath the root pathRedirect the folders to a specified location.Redirect the folders to the user’s local profileRedirect the folders to the user’s home folderHow to Redirect Folders to a Location Based on Security Group Membership

Windows Server 2003 includes additional options for redirecting folders that the Windows 2000 Server does notoffer. With Windows 2000 Server, users could only specify the location for the target folder location in the oneprovided text box. Windows Server 2003 offers more options in the Target Folder Location list.

Use the steps below to redirect folders to a location based on security group membership:

Open the GPO linked to the site, domain, or OU that holds the users for which folder redirection should beenabled.Expand the User Configuration node, expand the Windows Settings node, and then expand the FolderRedirection node.Right-click the folder that should be redirected and then select Properties from the shortcut menu.When the Properties dialog box for the folder selected for redirection opens, in the Setting list of the Target tab,choose the Advanced-Specify Locations For Various User Groups option.When the Specify Group And Location dialog box opens, click the Browse button in the Security GroupMembership area.When the Select Group dialog box opens, specify the name of the security group for whom the folder should beredirected. Click OK.In the Specify Group And Location dialog box, choose the location for the redirected folder. Choose one of theoptions listed below:Create A Folder For Each User Under The Root Path – a folder with the user’s name is created under the rootpath. The option is not available if the user selected to redirect the Start Menu folder.Redirect To The Following Location – the folder is redirected to a location specified.Redirect To The Local Userprofile Location – the folder is redirected to the default folder location.Redirect To The User’s Home Folder – the folder is redirected to the user’s home directory. The option isavailable when the My Documents folder is redirected.Enter the path to which the folder should be redirected if the Create A Folder For Each User Under The RootPath option was selected or the Redirect To The Following Location option in Step 7. Enter the UNC path or apath on the user’s local computer.Click OK.Click the Settings tab.The Grant The User Exclusive Rights To Redirected Folder checkbox is enabled by default. It is recommendedto leave this option unchanged.The Move The Contents Of User’s Current Folder To The New Location checkbox is enabled by default. It isrecommended to also leave this option unchanged.In the Policy Removal box of the Settings tab, it is recommended to leave the Leave The Folder In The NewLocation When Policy Is Removed option selected.In the My Pictures Preferences box of the Settings tab, it is recommended to leave the Make My Pictures ASubfolder Of My Documents option enabled. This is the default configuration setting.Click OK.How to Redirect Folders to a Single Location for All Users in a Site, Domain, or OU

Open the GPO linked to the site, domain, or OU that holds the users for whom the folder redirection should beenabled.Expand the User Configuration node, expand the Windows Settings node, and then expand the FolderRedirection node.Right-click the folder that should be redirected and then select Properties from the shortcut menu.When the Properties dialog box for the folder selected for redirection opens, in the Setting list of the Target tab,choose the Basic-Redirect Everyone’s Folder To The Same Location option.Select one of the following options from the Target Folder Location list:Create A Folder For Each User Under The Root Path – a folder with the user’s name is created in the root path.Redirect To The Following Location – the folder is redirected to a specified location.Redirect To The Local Userprofile Location – the folder is redirected to the default folder location.

Redirect To The User’s Home Folder – the folder is redirected to the user’s home directory.Enter the path to which the folder should be redirected if the Create A Folder For Each User Under The RootPath option was selected or the Redirect To The Following Location option in the previous step.Click the Settings tab.It is recommended to leave The Grant The User Exclusive Rights To Redirected Folder checkbox and MoveThe Contents Of User’s Current Folder To The New Location checkbox enabled or selected. This is the defaultsetting for those two checkboxes.In the Policy Removal box of the Settings tab, it is recommended to leave the Leave The Folder In The NewLocation When Policy Is Removed option enabled.In the My Pictures Preferences box of the Settings tab, leave the Make My Pictures A Subfolder Of MyDocuments option enabled. This is the default configuration setting.Click OK.How to set up the network share for offline files and folders

As mentioned earlier, the user can configure the Offline Files feature so that others can still access redirectedfolders when the network connection is lost. When configured, the Offline Files feature stores any files that areaccessed via folder redirection on the local computer’s hard drive. The file is updated locally when the useraccesses a file of a redirected folder. When the user logs off the computer, the file is moved to the server andstored.

Configuring the network share for offline files and folders is the initial step in the configuration of the OfflineFiles feature.

Navigate to and right-click the shared folder that includes the offline files, then select Sharing And Security onthe shortcut menu.Click Offline Settings on the Sharing tab.When the Offline Settings dialog box opens, select one of the options listed below:Only The Files And Programs That Users Specify Will Be Available Offline – allows users to specify files foroffline availability.All Files And Programs That Users Open From The Share Will Be Automatically Available Offline – all files thatusers access are available offline.Files Or Programs From The Share Will Not Be Available Offline – no files will be available offline.Click OK.How to Set Up the Offline Files Feature for Computers and Servers

Open My Computer.Click Folder Options on the Tools menu.When the Folder Options dialog box opens, select the Offline Files tabCheck the Enable Offline Files checkbox.The options that can be selected for a full synchronization of Offline Files are listed below:Synchronize All Offline Files When Logging On checkbox – for a full synchronization of Offline Files when theuser logs onSynchronize All Offline Files Before Logging Off checkbox – for a full synchronization of Offline Files when theuser logs off.Users can enable the Display A Reminder Every checkbox so that reminder balloons are displayed when thecomputer goes offline. The reminder balloons are displayed on the desktop’s notification area. Specify howfrequently the reminders should be displayed.To display a shortcut to the Offline Files folder on the desktop, select the Create An Offline Files Shortcut OnThe Desktop checkbox.To encrypt offline files, select the Encrypt Offline Files To Secure Data checkbox.Set the amount of disk space to use for temporary offline files by using the slider.Click the Advanced Button.When the Offline Files-Advanced Settings dialog box opens, choose one of the options listed below:Notify Me And Begin Working Offline – enables the user to continue to access files when the networkconnection is unavailable.Never Allow My Computer To Go Offline – prevents the user from accessing files when the network connectionis unavailable.Click Add to access the Offline Files-Add Custom Action dialog box. This is where users can configure aspecific action for a computer so that it is treated differently when another computer loses a networkconnection.

Enter the name of the computer in the Computer text box.Specify how the computer should be treated by selecting an option in the When A Network Connection Is Lostarea of the dialog box.Click OK.Click OK in the Offline Files-Advanced Settings dialog box.Click OK in the Folder Options dialog box.How to Configure Synchronization of Offline Files and Folders

Click Start, All Programs, Accessories, and click Synchronize.Click Setup on the Items To Synchronize dialog box.The Synchronization Settings dialog box opens.On the Logon/Logoff tab of the dialog box, in the When I Am Using This Network Connection list, select theconnection to be utilized.In the Synchronize The Following Checked Items list, choose the items that should be synchronized.Enable the When I Log On To My Computer checkbox to allow synchronization to occur when the user logs onto the computer.Enable the When I Log Off My Computer checkbox to allow synchronization to occur when the user logs off thecomputer.In order to display a message, asking for permission to perform synchronization, enable the Ask Me BeforeSynchronizing The Items checkbox.Click OK.Best Practices for Implementing Folder Redirection

A few best practices for implementing folder redirection using Group Policy are summarized below:

It is recommended to accept the default folder redirection settings on the Settings tab when configuring folderredirection.It is always best to allow the system to create the folders.Because users typically need to access the contents of redirected folders when the network connection is lost,enable the Offline Files feature for redirected folders.The My Pictures folder should exist within the My Documents folder.When specifying the location for redirected folders, use fully qualified UNC paths.Only redirect the My Documents folder to the user’s home folder if there is an existing home folderenvironment.The Application Data folder should not be redirected if using the Encrypting File System (EFS).

Situation: An organization has users that log into workstations interactively and also log into a Terminal Serverwith the same user account, but stricter policies are desired for the Terminal Server session than for the users’interactive session with their own computer. Also, certain users (such as Administrators) should be exemptfrom these policies.ex: When a domain user logs on to Terminal Server, they do not have access to the Control Panel and cannotchange the Desktop wallpaper; on their own machine these actions are allowed. Administrators that log on tothe Terminal Server still must have access to the Control Panel and all other areas of the system.Problem: Since users can only be contained in a single OU, and user policies assigned to OUs that contain onlycomputers are not processed, it may seem that this is not possible without creating separate user accounts justfor accessing the Terminal Server. Strict local policies could be used on the Terminal Server itself, but thesewould also apply to Administrators making the server difficult to manage.

Solution: Use loopback processing of group policy in conjunction with security filtering of certain GPOs to allowdifferent user policies to be applied depending on what computer the user logs on to.

In Active Directory Users and Computers, make sure that the Terminal Server is in its own OU just for TerminalServers. If the Terminal Server is also a Domain Controller, a new OU can be created inside of the DomainControllers OU so that domain controller policies are still applied as well.In the Group Policy Management MMC, create a new GPO called “Loopback” and link it to the TerminalServers OU created in step 1.Edit the new Loopback policy to enable Loopback processing. The setting is under Computer Configuration ->Policies -> Administrative Templates -> Group Policy -> User Group Policy loopback processing mode. Seeexample below:

Now create another GPO linked to the same Terminal Servers OU. This one will contain the user policies thatwill be in effect when users from another OU log on to a computer in this OU. Name it something like “TerminalServer Lockdown”, or whatever suits the situation.Before editing this policy, it is important to set up some security filters first. Assuming you do not want thispolicy applied to Domain Administrators, perform the following steps:Select the GPO and go to the “Delegation” tab.

Click “Advanced…” to view the ACL.Add the “Domain Admins” group (or whichever group is appropriate) and grant the group all permissions exceptDENY the “Apply group policy” permission as shown below:Click “OK” to save the ACL.Edit this “Lockdown” policy just as you would any other user policy, making sure that you edit items in the “User”section, not the “Computer” section. Remove the Control Panel, lock the taskbar, customize Internet Explorer,etc.If everything went properly, this policy will be applied to any user that logs on to the Terminal Server (or anycomputer in the “Terminal Servers” OU) except those that are members of the Domain Admins group. If thepolicies do not immediately work, try running gpupdate /force when logged on to the server as a Domain User.-nRelated content:Group Policy Not Applied To Remote VPN UsersHow To: Time Sync Across Windows NetworkAdding Sites to Internet Security Zones Using Group PolicyTerminal Server Does Not Accept Enough Client ConnectionsRedirected Printer: Access Denied in Remote Desktop Session

QUESTION 28Your company has an Active Directory Domain Services (AD DS) domain. You install the Remote Desktop Session Host (RD Session Host) role service on a server that runs WindowsServer 2008 R2.All RD Session Host servers are located in an Organizational Unit (OU) named RDSessionHosts.All user accounts are located in an OU named Employees. Users connect to multiple RD Session Host servers by using the Remote Desktop Connection client on theirWindows 7 client computers.You need to ensure that users can access the files stored in their own Documents folders regardless of the RDSession Host server to which they are connected.\What should you do?

A. Create a mandatory profile on each client computer.B. Create a mandatory profile on each RD Session Host server.C. Create a Group Policy object (GPO) that redirects the Documents folder, and link the GPO to the

Employees OU.D. Create a Group Policy object (GPO) that redirects the Documents folder, and link the GPO to the

RDSessionHosts OU.


Explanation/Reference:How to configure Folder Redirection as an alternati ve to Roaming ProfilesCreate and configure a location for the folder redirection

1. Create a folder called ‘Fldredir’

2. Turn off inheritance on the folder and copy the permissions.

a. Click the Advanced button found on the Security tab.

b. Clear Allow inheritable permissions to propagate to this object check box in the Advanced Security Settingsdialog box.c. Click Copy when prompted by the Security dialog box.

3. Click OK to return to the Security tab. Ensure we have the following permissions set:

Administrators: Full ControlSystem: Full ControlCreator Owner: Full ControlAuthenticated Users: Modify

5. Change permissions for Authenticated Users so they cannot access other users’ folders. You do this by:

a. Click Advanced on the Security tab.b. Click Authenticated Users, and then click Edit.c. On the Permissions Entry for ‘Fldrredir’ dialog box, drop down the Apply onto and select This folder only.d. Click OK twice.

Create a Group Policy Object to redirect selected profile components

1. Create a GPO and link to the OU. It needs to be linked to an Users OU

2. Configure the GPO as follows (click on the image to zoom):

3. Clear the old Roaming Profile path from user account properties

Verify the operation of Folder redirection

The user redirected folders should start appearing inside the ‘Fdlredir’

*****EDIT*****

For ‘Documents’ folder: you need to choose ‘redirect…’ instead of ‘create…’ Otherwise the policy will createDocuments folder for each user.

QUESTION 29Your organization has an Active Directory Domain Services (AD DS) domain, You use Microsoft System CenterVirtual Machine Manager (VMM) 2008 R2 to manage your Hyper-V hosts.

Your environment includes Windows Server Update Services (WSUS).

You create a new Windows 7 virtual machine (VM) image and run the sysprep /oobe /generalize /shutdowncommand. You store the image in the VMM library.

You need to apply operating system updates to the image without affecting licensing or activation status of theimage.

What should you do?

A. Use the Deployment Image Servicing and Management (DISM) tool to service an offline image.B. Use VMM to deploy the image, and then apply the operating system updates.C. Use the Windows Optional Component Setup (OCSetup.exe) tool with an online image.D. Use the Sysprep Tool to service the image.



http://www.elbacom.com/blog/page/6/

QUESTION 30Your companys main office and a branch office are connected by a slow WAN link. All servers run Windows Server 2008 R2. All client computers run Windows 7.

You install an application on a Remote Desktop Session Host (RD Session Host) server. Users in the branch office experience slow performance when accessing the application through RemoteDesktop.

You need to minimize the bandwidth utilization to the RD Session Host server.

What should you do?

A. Configure BranchCache in Hosted Cache mode.B. On the RD Session Host server, configure the RDP-TCP properties to allow only Network Level

Authentication.C. On each client computer, configure the Remote Desktop Connection Client Experience.D. On each client computer, configure the Connect From Anywhere settings.



QUESTION 31Your company runs Remote Desktop Services on Windows Server 2008. You have a Remote Desktop Session Host (RD Session Host) server.You plan to install an application on the RD Session Host server by running a setup.exe file.You need to ensure that the application will install properly and be useable by all users on the RD Session Hostserver.What should you do first on the RD Session Host server?

A. Run the Change user /install command.B. Set the Remote Desktop licensing mode to RDS Per User CAL.C. Run the Change user /execute command.D. Set the Remote Desktop licensing mode to RDS Per Device CAL.


Explanation/Reference:http://support.microsoft.com/kb/320185

You must put a Terminal Services server in Install mode to install or remove programs on the server. You canput a Terminal Services server in Install mode either by using the Add/Remove Programs tool in Control Panelto add or remove a program, or by using the change user command at a command prompt. This articledescribes how to use the change user command.

To Switch Terminal Services to Install ModeWhen you want to add or remove programs, put the Terminal Services server in Install mode. To do this:Click Start, and then click Run.In the Open box, type cmd, and then click OK.At the command prompt, type change user /install , and then press ENTER. The following messageappears:User session is ready to install applications.Type exit, and then press ENTER.Add or remove the programs that you want.Back to the topTo Switch Terminal Services to Execute ModeWhen you are finished adding or removing programs, return the Terminal Services server to Execute mode. Todo this:Click Start, and then click Run.In the Open box, type cmd, and then click OK.At the command prompt, type change user /execute , and then press ENTER. The following messageappears:User session is ready to execute applications.Type exit, and then press ENTER.

QUESTION 32You have an Active Directory Domain Services (AD DS) domain. All servers run Windows Server 2008 R2. All client computers run Windows 7.All client computers are configured to extend the desktop display across two monitors.You have a Remote Desktop Session Host (RD Session Host) server.You need to ensure that users can extend the Remote Desktop Connection window across both monitors.What should you do?

A. Configure the screen resolution of the RD Session Host server.B. Configure the Ease of Access options on the RD Session Host server.C. Configure the display configuration settings of the Remote Desktop Connection client to use all monitors.D. Configure the display configuration settings of the Remote Desktop Connection client to set the size of the

remote desktop to Full Screen.



If you have dual or multiple monitors setup on your desktop and often use remote desktop client log into remoteterminal server, you may want to have the same screen setup over on remote desktop session as well to havemore screen real state. And here is how.

The version of remote desktop client that comes with Windows 7 supports multiple monitors natively, so youdon’t need 3rd party tools to help make that happen.

If you are remote desktop to a windows prior to Windows 7 or Windows server 2008 R2

Launch the remote desktop client from the command line by using the following command:

mstsc.exe /span

What it does is to match the remote desktop width and height with the local virtual desktop, spanning acrossmultiple monitors if necessary. It works pretty smooth but with some of the limitations:

The set of monitors must form a rectangle. In other words, the set of monitors have to use the exact samescreen resolution. If one monitor sets to 1600×1200 and the second one to 1400×1050, span option will beignored, and you are still stuck in one monitor.The total of the resolutions must be below 4096×2048.The multiple monitors are in span mode. Maximizing one application window will maximize the window acrossall monitors, instead of one.

QUESTION 33Your company runs Remote Desktop Services.You have a Remote Desktop Web Access (RD Web Access) server.You publish several applications on the internal network by using RD Web Access.You need to ensure that the published applications are accessible from the internet via an HTTPS connectionover port 443.What should you do first?

A. Install and configure the Remote Desktop Connection Broker (RD Connection Broker) role service on meRD Web Access server.

B. Use Intemet Information Services (IIS) Manager to enable Windows Authentication.C. Use Intemet Information Services (IIS) Manager to disable Forms Authentication.D. Install and configure the Remote Desktop Gateway (RD Gateway) role service on the RD Web Access

server.


Explanation/Reference:Creating a Remote Desktop Gateway (RD Gateway) is straight forward and can be used to securely accessyour Windows servers over port 443 using the Remote Desktop Connection Client. I use this to access myhome lab when I’m on the road or at work, and it saves exposing your machines to the internet directly overRDP (TCP 3389). The RD Gateway isn’t new, in fact it was available on Windows Server 2008 as TS Gateway,and the installation is the same. For this article, I will be using Windows Server 2008 R2.

Step 1: Build a new virtual machine and install Windows Server 2008 R2.Step 2: Click on Add Roles (in Server Manager). You will then be presented with the following wizard dialogboxes. Click on each image for full screen.

Step 3: Configuring the RD GatewayNow the RD Gateway is installed, go to Start > Administrative Tools > Remote Desktop Services > RemoteDesktop Gateway Manager.Right click on the RD Gateway server within the RD Gateway Manager console and select Properties.Select “Create a self-signed certificate” then click “Create and Import Certificate”. You will then be presentedwith the following:

Make sure that the certificate name is the internet DNS (domain) name that resolves to the internet IP addressof the RD Gateway server. The firewall will need to allow communication to the server on TCP port 443.Tick “Store the root certificate” and choose a file location to save the certificate. For example: C:\rd-cert.cerAs this is a self-signed certificate, you will need to import the certificate to your machine that you are accessingthe RD Gateway from. To do this, follow these steps:From the client machine accessing the RD Gateway, right click on the certificate file and click “InstallCertificate”Click Next then select “Place all certificates in the following store”Browse to “Trusted Root Certification Authorities”, then click Next.Click FinishNote: You will need to ensure that the internet (DNS) host name can be resolved to the internet IP address ofthe RD Gateway server, so make sure that this is the case. This domain name must match the certificate name(E.g. rdg.mydomain.com)Step 4: Configuring the Remote Desktop Connection ClientLaunch the Remote Desktop Connection client.Select the “Advanced” tab and click “Settings”.Select “Use these RD Gateway server settings” (Windows XP will be “Use these TS Gateway settings”)Enter the server / host name (E.g. rdg.mydomain.com) of your RD Gateway serverOptional: Select “Use my RD Gateway credentials for the remote computer”Click OK.Finally, under the “General” tab enter the local IP address or server name of the machine you wish to connectto.Your connection will be tunnelled over SSL, providing your firewall configuration permits TCP port 443 from theinternet to your RD Gateway server and TCP port 3389 from the RD Gateway server to your internal network.

QUESTION 34Your company runs Remote Desktop Services. All client computers run Windows XP SP3. You have a Remote Desktop Session Host (RD Session Host) server.You need to ensure that users can print by using Easy Print while connected to the RD Session Host server.

What should you do on the client computers?

A. Enable a Windows Firewall Inbound Rule for File and Printer Sharing.B. Enable a Windows Firewall Outbound Rule for File and Printer Shanng.C. Enable Network Level Authentication (NLA)D. Install .NET Framework 3.5.


Explanation/Reference:To use the Terminal Services Easy Print driver, clients must be running both of the following:

Remote Desktop Connection (RDC) 6.1NoteThe RDC 6.1 (6.0.6001) client supports Remote Desktop Protocol 6.1.At least Microsoft .NET Framework 3.0 Service Pack 1 (SP1)

http://technet.microsoft.com/en-us/library/cc753853(v=ws.10).aspx

Using Remote Desktop Easy Print in Windows 7 and Windows Server 2008 R2Remote Desktop Easy Print configuration properties:The following table displays the Client/Server combinations that support Easy Print.

Client / Server -> Windows 7 Windows Server Windows Server

|v

2008 2008 R2

Windows XP Client : (1), (2) Client : (1), (2)Server : (3)

Client : (1), (2)Server : (4)

Windows Vista Client : (1), (2) Client : (1), (2)Server : (3)

Client : (1), (2)Server : (4)

Windows 7 Server : (3) Server : (4)Windows Server2008

Client : (2) Client : (2)Server : (3)

Client : (2)Server : (4)

Windows Server2008 R2

Server : (3) Server : (4)

(1) RDC 6.1 or above (Windows XP with Service Pack 3 and above includes this).(2) Even if RDC 6.1 or above is used,the user must install a supported version of.NET Framework separately . Microsoft .NET Framework 3.5 (which includes .NETFramework 3.0 SP1) can be downloaded from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkId=109422).*In Windows Vista SP2 with RDC 7.0 andKB971644installed, .NET Framework is notrequired(3) Terminal Services role.

(4) Remote Desktop Session Host Role.If all the requirements are met, the Easy Print driver is listed in the Model field of the redirected printer’sProperties dialog.

Troubleshooting:If you experience formatting problems using Easy Pr int.Refer to the KB- 954744 article athttp://support.microsoft.com/kb/954744(related: KB954743).Refer to the KB- 970603 article athttp://support.microsoft.com/kb/970603Refer to the KB- 959442 article athttp://support.microsoft.com/kb/959442If the client printers are not redirected as Easy P rint:First check the RDP version on the RDP client computer as well as the .NET framework version with respect tothe operating system used (as explained above). Also verify that the RD Session Host / Terminal Server role isinstalled if the host computer is running Windows Server 2008 R2 or Windows Server 2008.Group Policy must be correctly set to enable Easy Print on the Server. The policy location is “ComputerConfiguration -> Administrative templates -Windows Components -> Remote Desktop Services > RemoteDesktop Session Host -> Printer Redirection”. The setting “Use Remote Desktop Easy Print printer driver first”must be set to “Enabled” for Easy Print redirection, and it has to be “Disabled” for Legacy Print. For “Notconfigured”, Easy Print is chosen by default.

Check The Remote Desktop Configuration Tool (tsconfig.msc) settings to ensure that the “Windows Printer”option is not disabled (it is not disabled by default).Make sure that the “Printers” check box in the client (mstsc.exe) window on the “Local Resources” tab ischecked. The corresponding setting in the associated RDP file is “redirectprinters:i:1”.Ensure that the spooler service is running on both the RDP Client & Server.Windows Server 2008 added the ability for an Admin to configure spooler security and Windows 7/WindowsServer 2008 R2 adds the UI for this. Therefore, it would be possible to alter the RDP server’s spooler securitydescriptor which might prevent RDP client printers from being redirected on the session. The spooler securitydescriptor must contain the “AU” (Authenticated User) ACL (Access Control List) which allows anyauthenticated user to open the spooler service for reading operations. Therefore,if that ACL is missing from thespooler security descriptor, it must beaddedlike the example below using the command prompt (elevated).> sc sdshow spoolerD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)> sc sdset spooler D:(A;;CCLCSWLOCRRC;;;AU) (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)[SC] SetServiceObjectSecurity SUCCESSIf you connect over RD Gateway, ensure that the policy that disables printer redirection is turned off.If everything listed so far is correct and you still have a redirection problem, check the event logs.

Some of the events to look for are:

Event ID Message Explanation1105 Printer security information for the

printer could not be set.1109 The printer could not be set as the

default printer.The default client printerand the default printer inthe RDP session must bethe same.

1111 The driver required for the printer isunknown. Contact the administratorto install the driver before you log inagain.

If the Easy Print driver ismissing in the host, thisevent will be logged.

1116 The printer cannot be redirected by Make sure you’ve met all

using Remote Desktop EasyPrint.The client computer may nothave a version of the RemoteDesktop Connection client orMicrosoft .NET Frameworkinstalled that supports this driver.

the requirements in thetable above.

1103 An internal communication erroroccurred. Redirected printing will nolonger function for a single usersession. Check the status of theRemote Desktop Device Redirectorin the System folder of DeviceManager.

1124 The number of printers per sessionlimit was reached.

If the number of redirected printers is less than t he number of the RDP client printers.The maximum number of printers that can be redirected is controlled by the registry key“MaxPrintersPerSession REG_DWORD” which is under the node “HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services”.The default value for this is 20 printers per session.If Easy Print is unable to print on a domain contro ller.Refer to the Knowledge Base Article 968605 athttp://support.microsoft.com/kb/968605/EN-USIf the client printer is redirected as Easy Print a nd the user is unable to stop a print job on theredirected printer.Take ownership of the printer and allow the “Print” & “Manage printers” permissions. But note that when loggedoff from the RD Session, the remote printer settings are not retained.

QUESTION 35Your company has an Active Directory Domain Services (AD DS) domain. You are installing the RD Session Host (RD Session Host) role service in Server Manager on a server that runsWindows Server 2008 R2.

The Audlo and video playback check box on the Configure Client Experience page is not available.

You need to ensure that you can enable audio and video playback for users connecting to the RD Session Hostserver.

Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)

A. Start the Windows Audio EndPoint Builder service.B. Install the Desktop Experience feature.C. Start the Windows Audio service.D. Install Connection Manager Administration Kit feature.

Correct Answer: BCSection: (none)Explanation
