Windows 7Customer Solution Case Study

Ministry of Foreign Affairs andEuropean Integration

Croatian Ministry Deploys Operating System to Better Protect Sensitive Data

OverviewCountry or Region: Republic of CroatiaIndustry: Government agencies

Customer ProfileThe basic foreign policy aims of the Ministry of Foreign Affairs and European Integration of the Republic of Croatia include strengthening of Croatia’s international position, achieving full membership in the European Union, strengthening Croatia’s economic position, and promoting Croatia’s image.

Business SituationAs an important government entity, the ministry needed to apply stringent security measures to its IT infrastructure. It wanted to give employees at its 80 branches the best PC technology.

SolutionThe ministry created an exemplary data center and is using Microsoft System Center Configuration Manager 2007 to deploy Windows 7 Enterprise to its 1,000 employee PCs.

Benefits Tightens data security Improves IT manageability Enhances user productivity

“A lot of Windows 7 security features work in the background and make a huge difference in bolstering security.”

Hrvoje Budiselic, Chief Information Officer, Ministry of Foreign Affairs and European Integration of the Republic of Croatia

The Ministry of Foreign Affairs and European Integration of the Republic of Croatia is responsible for international promotion of Croatia as a modern, dynamic, and democratic Mediterranean and Central European country. Its IT staff, which oversees 80 branch offices around the world, needed an easy-to-manage infrastructure with high security standards. It also wanted to give users a first-class PC experience. Working with Microsoft Services, the ministry created a world-class data center that takes advantage of virtualization and central control through Microsoft System Center Configuration Manager 2007, which it is using to deploy Windows 7 Enterprise to the organization’s 1,000 PCs. The ministry expects to benefit from having an optimized security infrastructure, greater manageability, and increased employee productivity.

Works the way you want

SituationFormed in 1991, the Ministry of Foreign Affairs and European Integration of the Republic of Croatia is responsible for strengthening the country’s economic position, implementing the highest democratic standards, and promoting the country’s image in international relations. Its mission includes developing an organizational infrastructure that will help promote Croatia in the international community. “Our primary objective is developing political and economic relations with all democratic countries in the world,” says Hrvoje Budiselic, Chief Information Officer of the Ministry of Foreign Affairs and European Integration of the Republic of Croatia. “We also have the goal of achieving membership in the European Union, as well as fulfilling assumed international obligations.”

The ministry, which has 80 branch offices around the world, employs 1,200 people, 1,000 of whom operate computers. Its PC infrastructure features 80 percent desktop and 20 percent mobile computers. As of 2009, all of these were running either the Windows XP or Windows Vista operating systems, along with third-party antivirus products to protect against security risks. Most of the ministry’s computers were also running Microsoft Office 2007 productivity software.

By November 2009, the ministry had upgraded all Internet browsers throughout its infrastructure to Windows Internet Explorer 8. It did so to support a web-based proprietary business application called IKOS. The three-part IKOS system is based on Microsoft Office SharePoint Portal

Server 2003 and is used to exchange political documents, issue visas, and distribute passports for citizens who are temporarily or permanently residing outside of the Republic of Croatia. The ministry also uses Internet Explorer 8 to support various web-based financial and human resources applications. It has experienced no compatibility issues, and is taking advantage of security features in the browser. For example, the ministry employs many of the almost 1,300 Group Policy settings, including options for controlling access to web content and restricting software downloads. It also uses the Trusted Sites security zone to configure which websites are safe to view.

As a high-level government entity, the ministry has to employ stringent security measures to protect data, beyond those already described. To that end, it had been regularly backing up its network domain and configuration rules, so it could rebuild the network quickly if it were compromised. It also relies on a firewall. In addition, the ministry used third-party virtual private networks (VPNs) to facilitate data and voice communications between its main office and the branches. “Our branches have two channels of communications with the main office,” says Budiselic. “The first is data communications, and the second is voice communications. Both have been integrated with our IT network through VPN.” Some employees, however, were having issues connecting to the infrastructure, and the organization’s IT professionals were concerned that some of the VPN clients were unstable. Moreover, some of its workforce experienced slow or unreliable computer response time.

26Works the way you want

“From an IT perspective, what Windows 7 provides for us is manageability, because it provides for much better control over applications and policy settings.”

Boris Breznik, Head of the System Support and Networks Group, Ministry of Foreign Affairs and European Integration

of the Republic of Croatia

The ministry wanted to standardize its operating system infrastructure to increase employee productivity and make it easier to manage its computers. It also wanted to ensure it was satisfying the highest security benchmark possible. “To improve employee efficiency and lessen the burden of troubleshooting for IT staff, we needed to have unified surroundings—all of our computers needed to be the same,” says Boris Breznik, Head of the System Support and Networks Group for the Ministry of Foreign Affairs and European Integration of the Republic of Croatia. “That said, security was our main driver, and any new technology has to meet high standards for protecting our data and addressing threats to the infrastructure.”

SolutionThe ministry is working with Microsoft Services to implement the Windows 7 Enterprise operating system to all the organization’s computers. To prepare for the upcoming deployment, the ministry first upgraded its server infrastructure in September 2009. First, it installed Microsoft System Center Virtual Machine Manager 2008 R2 on computers running the Windows Server 2008 R2 operating system. By using Windows Server 2008 Hyper-V virtualization technology, the organization was able to consolidate servers through virtualization. With System Center Virtual Machine Manager, it can centrally create, optimize, and manage all the virtual machines in the ministry’s data center.

From each Hyper-V instance, the organization is running Microsoft System Center Configuration Manager 2007 to

assess, deploy, and update its computer infrastructure. System Center Configuration Manager is optimized for, and is tightly integrated with, Windows 7. “Our data center is exemplary,” says Budiselic, “We use the best servers and have well-designed virtualization capabilities. It’s a high-quality, on-premises solution configured for stability and security.”

In October 2010, the ministry conducted a month-long pilot program of Windows 7 Enterprise that featured 10 computers in four typical hardware configurations. The only challenge the organization faced during the pilot program was outdated hardware that couldn’t support Windows 7. Because the ministry periodically purchases new hardware anyway, it decided to replace those computers.

After a successful pilot program, in November 2010, the ministry began preparing to upgrade client operating systems throughout its infrastructure. It employed the Microsoft Assessment and Planning (MAP) Toolkit to test its hardware and line-of-business applications. MAP is an inventory, assessment, and reporting tool that can assess an IT environment’s readiness for migrations and virtualization without the use of any software agents. “We needed to make sure that our business-critical applications would run in the Windows 7 and Internet Explorer 8 environment,” says Breznik. “We also had to test applications on different hardware and configurations. We needed four different Windows 7 Enterprise images to accommodate the variety of existing hardware.”

36Works the way you want

“From an IT perspective, what Windows 7 provides for us is manageability, because it provides for much better control over applications and policy settings.”

Boris Breznik, Head of the System Support and Networks Group, Ministry of Foreign Affairs and European Integration

of the Republic of Croatia

“We realize that BitLocker and BitLocker To Go are the best means of securing data—especially on mobile computers—because those features are integrated with the operating system.”

Hrvoje Budiselic, Chief Information Officer, Ministry of Foreign Affairs and

European Integration of the Republic of Croatia

After finding no compatibility problems, the ministry kicked off its full-scale deployment by deploying Windows 7 Enterprise to the computers of IT managers and prominent personnel. For those critical machines, it implemented BitLocker drive encryptions, a Windows 7 feature that helps protect data on computers and removable drives. The organization uses BitLocker to help keep everything from documents to passwords safer by encrypting the entire drive on which Windows 7 and the data reside. Once BitLocker is turned on, any file saved on the drive is encrypted automatically.

By March 2011, the organization had upgraded 450 computers at 20 branches. Because of security concerns, IT professionals are deploying to one branch at a time, and they’re implementing the operating system to desktop computers first. The ministry is using System Center Configuration Manager to manage the majority of the upgrades, though some computers require manual deployment. “It’s easy and automated to deploy Windows 7 with System Center Configuration Manager,” says Budiselic. “For the most part, we don’t have to go to the various branches because we can deploy the operating system to new users over the network.”

The ministry is in the process of procuring mobile computers, which has delayed implementation to some branches. Those new machines and all remaining ministry computers will have Windows 7 by September 2011. In addition, the organization is implementing the Microsoft Office Professional 2010 productivity suite

to each computer as part of the operating system upgrade.

When the ministry completes its upgrade to Windows 7, it intends to implement that operating system’s important security features. Most notably, it plans to use DirectAccess to link employees’ PCs to the main office infrastructure without the need for a VPN connection; BranchCache to make it faster and easier to open documents and web pages from a branch office; and BitLocker and BitLocker To Go to help protect data on all employee computers.

The ministry is currently rolling out Internet Explorer 9 and is planning to standardize on that web browser to take advantage of advanced security features. It is developing browser add-ins that will boost employee productivity on the web-based IKOS system.

BenefitsBy deploying Windows 7 throughout its organization, the ministry is improving employee productivity and satisfaction, streamlining the efficiency of IT tasks, and—most importantly—enhancing the security of its data and infrastructure. “It’s important that we upgrade to Windows 7 Enterprise because the whole world is using that operating system,” says Budiselic. “It can literally change your life and the way you work.”

Tightens Data SecurityThe ministry’s main driver for upgrading to Windows 7 Enterprise was the need for strengthened security. It is already taking advantage of security features available

46Works the way you want

“DirectAccess is one of the best features of Windows 7. It’s basically VPN without VPN. You don’t need to use a card or connect manually with a third-party solution. You get access to corporate data and documents, and you get a higher security level.”

Hrvoje Budiselic, Chief Information Officer, Ministry of Foreign Affairs and

European Integration of the Republic of Croatia

throughout its cutting-edge infrastructure—from the improved access control and authentication capabilities in Windows Server 2008 R2 to the data encryption and security-enhanced access to corporate resources available with Windows 7. “We’re using all the security features available with Windows 7 and Windows Server 2008 R2,” says Budiselic. “A lot of Windows 7 security features work in the background and make a huge difference in bolstering security. It’s totally new and totally different.” With BitLocker, the ministry puts a virtual lock on sensitive data stored on computer drives. Also, because BitLocker technology is included with Windows 7, the ministry can eliminate third-party security applications. Says Budiselic, “We realize that BitLocker and BitLocker To Go are the best means of securing data—especially on mobile computers—because those features are integrated with the operating system.”

By using DirectAccess, the organization also eliminates the cost of third-party solutions for VPN access. “DirectAccess is one of the best features of Windows 7,” says Budiselic. “It’s basically VPN without VPN. You don’t need to use a card or connect manually with a third-party solution. You get access to corporate data and documents, and you get a higher security level than you would have with a VPN solution.”

Improves IT ManageabilityThe ministry expects its infrastructure will become easier to manage because of the superior performance and stability of the Windows 7 operating system. “From an IT perspective, what Windows 7 provides for us is manageability, because it provides for

much better control over applications and policy settings,” says Breznik. “System Center Configuration Manager helps in this effort by giving us a unified platform for operating system and application deployment, and reducing the amount of manual intervention needed to support our computing environment.”

By deploying DirectAccess, the company expects to help its mobile employees work more efficiently by giving them seamless access to the information and tools they need. Says Budiselic, “It will be easier to manage remote computers without having to maintain a corporate VPN.”

Enhances User ProductivityEmployees at the ministry are eager to take advantage of the user interface enhancements in the operating system. “With Windows 7 Enterprise, we get the ‘wow’ effect from employees who are delighted by its performance and user interface enhancements,” says Breznik. “Windows 7 is also much easier to operate. We’re anticipating much greater productivity from our users.”

In particular, the organization is expecting that BranchCache will facilitate employees’ access to ministry data and documents. Employees in branch offices will be able to use network services as if they were hosted on a local server. “With BranchCache, our users can access files at a higher speed, because it is likely that someone at one our 80 branches already has those files on a PC,” says Budiselic. “It’s a safe method, and it speeds up processes.”

56Works the way you want

Windows 7Works the way you want: Windows 7 will help your organization use information technology to gain a competitive advantage in today’s new world of work. Your people will be able to be more productive anywhere. You will be able to support your mobile workforce with better access to shared data and collaboration tools. And your IT staff will have better tools and technologies for enhanced corporate IT security and data protection, and more efficient deployment and management.

For more information about Windows 7, go to:www.microsoft.com/windows/windows-7

66Works the way you want

For More InformationFor more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers in the United States and Canada who are deaf or hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to:www.microsoft.com

For more information about Republic of Croatia Ministry of Foreign Affairs and European Integration products and services, call (385) (1) 4569 964 or visit the website at: www.mvpei.hr

This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.

Document published May 2011

Software and Services Windows 7 Enterprise Microsoft Server Product Portfolio− Windows Server 2008 R2 Enterprise− Microsoft System Center

Configuration Manager 2007 Service Pack 1

− Microsoft System Center Virtual Machine Manager 2008 R2

Microsoft Office− Microsoft Office Professional 2010

Services− Microsoft Premier Support

Technologies:− Hyper-V− Microsoft Assessment and Planning

Toolkit− Windows Internet Explorer 9