Understanding Libraries CHAPTER 15 553 n Library name n Library locations n Default save location n Type of file content for which the library is optimized n Visibility of the library in navigation pane n Whether the library is shared (only in HomeGroup scenarios) Libraries can be customized further by editing their Library Description files, which are Extensible Markup Language (XML) files with the file extension .library-ms that are stored in the %Appdata%\Microsoft\Windows\Libraries folder. MoRe inFo For more information on editing Library Description files, see the post titled “Understanding Windows 7 Libraries” on the Windows blog at http://windowsteamblog.com /blogs/developers/archive/2009/04/06/understanding-windows-7-libraries.aspx. Viewing Libraries When a library is displayed in the navigation pane of Windows Explorer, selecting the library node will display all of the files in all configured locations (as shown in Figure 15-5). This allows users to view the contents of both local folders and remote shares from a single place, making it easier for them to browse for specific files they want. FIGURE 15-5 All files from all configured locations are displayed when you select a library in the navigation pane of Windows Explorer. Users can include more folders in a library or remove existing ones by clicking Locations (next to Includes) beneath the library name, as shown in Figure 15-5. Doing this opens a dialog box displaying a list of configured locations, as shown in Figure 15-6. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 15 Managing Users and User Data 554 FIGURE 15-6 Users can quickly include folders in a library or remove existing folders. As shown in Figure 15-7, typing text in the Search box when a library is selected in Windows Explorer will result in searching the entire library and all its locations for the specified text. FIGURE 15-7 Searching a library searches all configured locations for that library. For more information on the search functionality included in Windows 7, see Chapter 19, “Managing Search.” Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Understanding Libraries CHAPTER 15 555 Managing Libraries Administrators can control which default libraries are available directly on a user’s Start menu by configuring the following Group Policy settings found under User Configuration\Policies \Administrative Templates\Start Menu And Taskbar: n Remove Documents Icon From Start Menu n Remove Pictures Icon From Start Menu n Remove Music Icon From Start Menu n Remove Videos Link From Start Menu These policy settings will be applied to the targeted users after their next logon. Administrators can also hide selected default libraries such as Music and Videos in business environments where such libraries are not appropriate. However, hiding a library from view only removes the library from the navigation pane of Windows Explorer. To hide a default library such as the Music library, use Group Policy to run the following script the next time the targeted users log on. @echo off %SystemDrive% cd\ cd %appdata%\Microsoft\Windows\Libraries attrib +h Music.library-ms note If you hide a library using this script, you should also remove it from the users’ Start menus. Administrators can deploy additional custom libraries to users by manually creating Library Description files for them and then deploying them to users by using either logon scripts or Group Policy preferences to copy the Library Description files to the %UserProfile%\Appdata \Roaming\Microsoft\Windows\Libraries folder on the targeted computers. Administrators that have environments in which known folders are redirected to server shares that are not indexed remotely and cannot be made available for offline use can config- ure libraries to use basic-level functionality by enabling the following Group Policy setting: User Configuration\Administrative Templates\Windows Components\Windows Explorer \Turn off Windows Libraries Features That Rely On Indexed File Data Note that library functionality is severely degraded if this policy setting is enabled, even for libraries that contain only indexed files. However, if your environment does not support local indexing, enabling this Group Policy may help minimize user feedback, indicating that an unsupported location is included in a library, and can help reduce network impact from grep searches of remote nonindexed locations. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 15 Managing Users and User Data 556 Enabling this policy disables the following library functionality: n Searching libraries in the Start menu n Applying Arrange By views other than By Folder and Clear Changes n Using Library Search Filter suggestions other than Date Modified and Size n Using the Unsupported tag in the Library Management dialog box n Applying rich functionality to user-created libraries n Viewing file content snippets in the Content View mode n Notifying users that unsupported locations are included in libraries Implementing Corporate Roaming RUP and Folder Redirection are two technologies that provide enterprises with the ability for users to roam between computers and access their unique, personal, desktop environments with their personal data and settings. Corporate roaming also provides enterprises with flex- ibility in seating arrangements: Users are not (or need not be) guaranteed the same computer each time they work, such as in a call center where users have no assigned desk or seating and must therefore share computers with other users at different times or on different days. Corporate roaming has the additional benefit of simplifying per-user backup by providing administrators with a centralized location for storing all user data and settings, namely the file server where roaming user profiles are stored. Understanding Roaming User Profiles and Folder Redirection RUP is a technology that has been available on Windows platforms since Microsoft Windows NT 4.0. Roaming profiles work by storing user profiles in a centralized location, typically with- in a shared folder on a network file server called the profile server. Because roaming profiles store the entire profile for a user (except for the Local Settings profile subfolder), all of a user’s data and application settings can roam. When roaming profiles are enabled, a user can log on to any computer on the corporate network and access his desktop, applications, and data in exactly the same way as on any other computer. Understanding Roaming User Profiles in Earlier Versions of Windows Because of how it was implemented in Windows NT 4.0, Windows 2000, and Windows XP, RUP originally had the following drawbacks as a corporate roaming technology: n User profiles can grow very large over time For example, the Documents folder for a user might contain numerous spreadsheets, Microsoft Office Word documents, and other user-managed data files. Because the entire profile for the user is download- ed from the profile server during logon and uploaded again during logoff, the logon/ Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Implementing Corporate Roaming CHAPTER 15 557 logoff experience for the user can become very slow during profile synchronization, particularly over slow WAN links or over dial-up connections for mobile users. n Roaming profiles are saved only at logoff. This means that although adminis- trators can easily back up profiles stored on the central profile server, the contents of these profiles (including user data within them) may not be up to date. Roaming profiles therefore present challenges in terms of providing real-time access to user- managed data and ensuring the integrity of this data. n Roaming profiles cause all settings for a user to be roamed, even for applica- tions that do not have roaming capabilities and even for data and settings that have not changed. If a user has a shortcut on his desktop to an application installed on one computer and then roams to a second computer where that application has not been installed, the shortcut will roam, but it will not work on the second computer, which can cause frustration for users. n Roaming profiles do not support multiple simultaneous logons by a user across several computers. For example, if a user is logged on to two computers simultane- ously and modifies the desktop background differently on each computer, the conflict will be resolved on a last-writer-wins basis. n Roaming profiles take some effort to configure and manage on the part of administrators. Specifically, a profile file server must be deployed, roaming profiles must be created and stored on the server, and user accounts must be configured to use these roaming profiles. You can also use Group Policy to manage different aspects of roaming profiles. HoW it WoRKS Roaming User Profiles and Terminal Services T here are four different ways to configure roaming profiles for users. Windows 7 reads these roaming profile configuration settings in the following order and uses the first configured setting that it finds: 1. The Remote Desktop Services roaming profile path as specified by Remote Desktop Services policy setting 2. The Remote Desktop Services roaming profile path as specified on the Remote Desktop Services Profile tab of the properties sheet for the user account in Active Directory Users And Computers 3. The per-computer roaming profile path as specified using the policy setting Computer Configuration\Policies\Administrative Templates\System\User Profiles \Set Roaming Profile Path For All Users Logging Onto This Computer Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 15 Managing Users and User Data 558 4. The per-user roaming profile path as specified on the Profile tab of the proper- ties sheet for the user account in Active Directory Users And Computers Note that Remote Desktop connections to a Windows 7 computer do not support the Remote Desktop Server Profile path or Group Policy settings regarding Remote Desktop Services. Even though both use the Remote Desktop Protocol (RDP), Remote Desktop Services policies do not apply to Windows 7 Remote Desktop. Understanding Folder Redirection in Earlier Versions of Windows Because of the limitations of roaming profiles, a second corporate roaming technology called Folder Redirection was first introduced in Windows 2000 and was basically unchanged in Windows XP. Folder Redirection works by providing the ability to change the target location of special folders within a user’s profile from a default location within the user’s local profile to a different location either on the local computer or on a network share. For example, an administrator can use Group Policy to change the target location of a user’s My Documents folder from the user’s local profile to a network share on a file server. Folder Redirection thus allows users to work with data files on a network server as if the files were stored locally on their computers. Folder Redirection provides several advantages as a corporate roaming technology: n You can implement Folder Redirection with RUP to reduce the size of roaming user profiles. This means that not all the data in a user’s profile needs to be transferred every time the user logs on or off of the network—a portion of the user’s data and settings is transferred instead using Folder Redirection. This can considerably speed up logon and logoff times for users compared with using RUP alone. n You can also implement Folder Redirection without RUP to provide users with access to their data regardless of which computer they use to log on to the network. Folder Redirection thus provides full corporate roaming capabilities for any folders that are redirected. On Windows XP, these include the My Documents (which can optionally include My Pictures), Application Data, Desktop, and Start Menu folders within a user’s profile. Folder Redirection as implemented on earlier versions of Windows has some drawbacks, however: n Folder Redirection is hard-coded to redirect only a limited number of user profile fold- ers. Some key folders, such as Favorites and Cookies, are not redirected, which limits the usefulness of this technology for corporate roaming purposes unless combined with RUP. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Implementing Corporate Roaming CHAPTER 15 559 n Folder Redirection by itself does not roam an application’s registry settings, limiting its usefulness as a corporate roaming technology. For an optimum roaming experience, implement Folder Redirection with RUP. note RUP is the only way of roaming user settings (the HKCU registry hive); Folder Redirection is the primary way of roaming user data. Enhancements to Roaming User Profiles and Folder Redirection Previously Introduced in Windows Vista Because of the limitations of the way that RUP and Folder Redirection were implemented in earlier versions of Windows, these two corporate roaming technologies were enhanced in Windows Vista in several ways: n The changes made to the user profile namespace (described in the section titled “User Profile Namespace In Windows Vista and Windows 7” earlier in this chapter) separate user data from application data, making it easier to roam some data and settings using roaming profiles and to roam others using Folder Redirection. n The number of folders that can be redirected using Group Policy is considerably increased, providing greater flexibility for administrators in choosing which user data and settings to redirect. The list of folders that can be redirected in Windows Vista and later versions now includes AppData, Desktop, Start Menu, Documents, Pictures, Music, Videos, Favorites, Contacts, Downloads, Links, Searches, and Saved Games. n When you implement RUP with Folder Redirection, Windows Vista and later versions copy the user’s profile and redirect folders to their respective network locations. The net result is an enhanced logon experience that brings up the user’s desktop much faster than when you implement these two technologies on earlier versions of Windows. Specifically, when all user data folders are redirected and RUP is deployed, the only thing slowing logon is the time it takes to download Ntuser.dat (usually a relatively small file) from the profile server. (A small part of the AppData\Roaming\ Microsoft directory is also roamed, even when the AppData\Roaming folder has been redirected. This folder contains some encryption certificates.) n Offline Files, which can be used in conjunction with Folder Redirection, is enhanced in a number of ways in Windows Vista (and even more so in Windows 7). For more infor- mation concerning this, see the section titled “Working with Offline Files” later in this chapter. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 15 Managing Users and User Data 560 Additional Enhancements to Roaming User Profiles and Folder Redirection Introduced in Windows 7 Additional enhancements to support corporate roaming have now been introduced in Windows 7, especially concerning RUP. These enhancements, described in the next section, make using RUP together with Folder Redirection a more robust and reliable corporate roam- ing technology. BACKGROUND REGISTRY ROAMING Beginning in Windows 7, users with roaming user profiles will have their current user settings in HKCU (in other words, the entire NTuser.dat from their profile) periodically synchronized back to the server while they are logged on to their computers. This is a change from RUP in Windows Vista and earlier versions, in which roaming user profiles were synchronized back to the server only on logoff. This change will especially benefit enterprises that have a remote workforce with mobile computers because laptop users typically hibernate or sleep their computers instead of log- ging off. In previous versions of Windows, this meant that changes to user profiles might never get pushed up to the server, thus putting corporate data at risk. The change will also benefit enterprises that have mobile users who use virtual private network (VPN) connections to connect to their corporate network. VPN connections are typically initiated after the user logs on and before the user logs off, which again can prevent profiles from being properly synchronized to the server. Note that background synchronization of roaming user profiles takes place in only one direction: from the client to the server. As in previous versions of Windows, synchronization of roaming user profiles from the server to the client still occurs only at logon. Also as in previ- ous versions of Windows, any conflicts that arise roaming user settings are resolved based on timestamp at the file level. For example, when a user logs on using a roaming user profile, Windows checks whether the timestamp of the local version of NTuser.dat is newer than the server copy of NTuser.dat. If this is true, Windows loads the existing local version of NTuser.dat for the user and presents the user with her desktop. If this is false, Windows roams the newer version of NTuser.dat from the server to the local client, loads the new roamed version of NTuser.dat for the user, completes the rest of the load profile operation, and presents the user with her desktop. A similar process occurs during logoff. Background registry roaming is disabled by default in Windows 7 and can be enabled on targeted computers by using Group Policy. The following Group Policy setting can be used to control this behavior: Computer Configuration\Policies\Administrative Templates\System\User Profiles \Background Upload Of A Roaming User Profile's Registry File While User Is Logged On When you enable this policy setting, you can configure background registry roaming to synchronize on either of the following schedules: n At a set time interval (the default is 12 hours and can range from 1 to 720 hours) Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Implementing Corporate Roaming CHAPTER 15 561 n At a specified time of day (the default is 3 A.M.) A random offset of up to a one-hour delay is added to both of these scheduling options to avoid overloading the server with simultaneous uploads. For monitoring and troubleshooting background registry roaming, Windows 7 logs additional events in the following event log: Applications And Services Logs\Microsoft\Windows\User Profile Service\Operational The additional events logged include: n Background upload started n Background upload finished successfully n Hive not roamed due to a slow link n Hive not roamed due to the storage server being unavailable In addition, Windows will log the failure event “Background RUP upload failed, with error details” in the Windows Logs\Application event log. IMPROVED FIRST LOGON PERFORMANCE WITH FOLDER REDIRECTION Folder Redirection in Windows Vista and earlier versions has one large drawback: the poten- tially poor logon performance when a user logs on to her computer for the first time after it has been enabled. This occurs because, in Windows Vista and earlier versions, the user is blocked from logging on until all of her redirected data is migrated to the server. For a user with large amounts of data, this can result in long wait times during which she is prevented from doing useful work on her computer. The problem can be especially frustrating for a user who is logging on over a slow connection. In circumstances in which the user has large amounts of data that needs to be redirected, it can take an hour or longer for the user’s desk- top to appear when she logs on for the first time after Folder Redirection has been enabled. Beginning in Windows 7, however, if Offline Files is enabled on the user’s computer, first logon performance with Folder Redirection can be significantly improved, particularly for organizations with slower networks. This happens because instead of copying the user’s redirected data to the server during the logon process and forcing the user to wait for this operation to finish, the user’s redirected data is instead copied into the local Offline Files cache on the user’s computer, which is a much faster operation. The user’s desktop then ap- pears and the Offline Files cache uploads the user’s redirected data to the server using Offline Files synchronization and continues copying the user’s data to the server until all of the data is been copied. Additional enhancements in Windows 7 for improving first logon performance with Folder Redirection include the following: n Before Windows attempts to copy the user’s redirected data to the local Offline Files cache, it now checks to make sure there is enough room in the cache to hold the data. If the data won’t fit in the cache, the data will be uploaded to the server during logon, Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 15 Managing Users and User Data 562 resulting in behavior similar to what happens in Windows Vista and a possibly lengthy delay before the user’s desktop appears. n If the local Offline Files cache has been disabled on the user’s computer, Windows now checks whether the server has room for the user’s data before attempting to upload the data to the server. If there is not enough room on the server, no data is uploaded, resulting in the user’s desktop quickly becoming available. An event is logged in the event log to indicate that the logon occurred without redirecting any data. Because Offline Files is enabled by default on Windows 7 computers, this improved first logon performance with Folder Redirection also occurs by default. note A new feature of Offline Files in Windows 7 called background sync also enhances how Folder Redirection works. For more information on this feature, see the section titled “Additional Enhancements to Offline Files Introduced in Windows 7” later in this chapter. Implementing Folder Redirection You can use Group Policy to implement Folder Redirection in enterprise environments. The policy settings for configuring Folder Redirection of known folders is found under User Configuration\Policies\Windows Settings\Folder Redirection (shown in Figure 15-8). FIGURE 15-8 Folder Redirection policies in Group Policy To implement Folder Redirection in an AD DS environment, follow these steps: 1. Create a share on the file server where you will be storing redirected folders and assign suitable permissions to this share. (See the sidebar titled “Direct from the Source: Securing Redirected Folders” later in this chapter for information on the permissions needed for this share.) 2. Create a Folder Redirection Group Policy object (GPO) or use an existing GPO and link it to the organizational unit (OU) that contains the users whose folders you want to redirect. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... combination of computers running Windows 7 or Windows Vista and computers running Windows XP or Windows 2000: n n 570 If you configure a Folder Redirection policy on a computer running an earlier version of Windows and apply it to Windows Vista and later computers, the Windows Vista and later computers will apply this policy as if they are running the earlier version of Windows For example, suppose that... targeted by this GPO whether they are in pure Windows Vista and later environments or mixed environments containing earlier versions of Windows Thus, if you configure a Folder Redirection policy on a Windows 7, Windows Vista, or Windows Server 2008 computer and select the Also Apply Redirection Policy To Windows 2000, Windows 2000 Server, Windows XP And Windows Server 2003 Operating Systems option described... Server 2003 R2, and Windows Server 2008 Additional Enhancements to Offline Files Introduced in Windows 7 To improve Offline Files performance and overall user experience, the following additional enhancements have been made to Offline Files in Windows 7: n n 588 Slow-link mode enabled  Slow-link mode is on by default for Offline Files in Windows 7 The default slow-link threshold in Windows 7 is now an 80-millisecond... settings must now be managed from Windows Vista and later versions (Windows Vista and later versions keep both policy files synchronized.) n In mixed environments in which a Folder Redirection policy is configured on a Windows 7, Windows Vista, or Windows Server 2008 computer and applied to both Windows Vista and later computers and computers running an earlier version of Windows, be sure to choose Follow... of Windows (You can also use Folder Redirection policies configured from Windows 7, Windows Vista, or Windows Server 2008 computers to manage Folder Redirection for earlier versions of Windows, but only for shell folders that can be redirected on those earlier versions of Windows. ) For example, you can configure redirection of the Documents folder, which will redirect both the Documents folder on Windows. .. information about how to migrate user profiles for previous versions of Windows to environments running Windows Vista and later versions and Windows Server 2008, see Knowledge Base article 9 470 25, “Support Guidelines for Migrating Roaming User Profiles Data to Windows Vista or to Windows Server 2008” found at http://support.microsoft.com/kb/9 470 25 Managing User Profiles Using Group Policy You can manage the... computers running Windows Vista and later versions and computers running Windows XP or Windows 2000: n Default network profiles created for computers running an earlier version of Windows are not compatible with default network profiles created for Windows Vista and later computers because the profile namespace of Windows Vista and later versions is incompatible with the profile namespace of Windows XP Because... \system32\shell32.dll,-2 177 0 This means that when displaying the folder in Windows Explorer, it actually goes into Shell32.dll, fetches the resource ID 2 177 0, and then uses that resource to display the folder’s name The result is called the display name of the folder Different users can choose different user interface languages—the resources of these different languages will be different, so the same folder... following this approach will minimize confusion for users In a pure Windows Vista and later environment, however, you can redirect any of the known folders supported by Folder Redirection policy on Windows 7, Windows Vista, or Windows Server 2008 n When you create a Folder Redirection policy from a computer running an earlier version of Windows, the policy settings for Folder Redirection are stored in... policy is then modified from a Windows 7, Windows Vista, or Windows Server 2008 computer, a second file named Fdeploy1.ini is created in the same location as Fdeploy.ini, and only Windows Vista and later computers can recognize and apply the Folder Redirection policy settings contained in this file The presence or absence of these two files and their configuration indicates to Windows Vista and later computers . CHAPTER 15 571 running earlier versions of Windows. (You can also use Folder Redirection policies configured from Windows 7, Windows Vista, or Windows Server. configure a Folder Redirection policy on a Windows 7, Windows Vista, or Windows Server 2008 computer and apply it to both Windows Vista and later computers and