Search This Blog

Friday, September 30, 2011

Do Not Require Login to Access Shared Folders

Open access to shared folders so users don't have to enter a username and password.

If you share folders on your Windows PCs, you can require remote users on the network to login in order to access them. If you don’t want remote users to be required to login, you can also disable this functionality:

Open the Run dialog or a Command Prompt, and then enter the following and hit Enter: control userpasswords2

On the dialog box that appears, uncheck the Users must enter a user name and password to use this computer check box, and then click OK.

Thursday, September 29, 2011

Advanced Group Policy Management - Editing Controlled GPOs

Editing a Controlled GPO

In the previous article of this series, Jacky Chen, an AGPM Editor, proposed creating a new controlled GPO named New York Computers – Power GPO. Karen Berg, an AGPM Approver, received Jacky's request and approved it. Karen then deployed the new GPO into the CONTOSO production environment and linked it to the New York Computers OU so the policy settings configured in the GPO would be applied to computers in that OU. However, the New York Computers – Power GPO was deployed in a pristine state, that is, with no policy settings configured. In line with company policy, Jacky now proposes that the active power plan for New York computers be changed to Power Saver.

Jacky begins by logging on to his administrator workstation and opens the Group Policy Management Console (GPMC). He selects the Change Control node and then on the Controlled tab as shown here:


Figure 1: Step 1 of editing the controlled GPO.

Before Jacky can edit the controlled GPO, he must first check the GPO out of the AGPM archive. Checking a GPO out of the archive prevents any other AGPM Editor from making changes to the GPO until Jacky finishes working with it. To check out the New York Computers – Power GPO, Jacky right-clicks on it and selects Check Out as shown here:


Figure 2: Step 2 of editing the controlled GPO.

In the Check Out GPO dialog that displays next, Jacky enters a comment to help track the history of all changes made to the GPO:


Figure 3: Step 3 of editing the controlled GPO.

After clicking OK, the checked out GPO is displayed with a red icon on the Controlled tab:


Figure 4: Step 4 of editing the controlled GPO.

The checked out GPO can now be edited, so Jacky right-clicks on the GPO and selects Edit from the context menu:


Figure 5: Step 5 of editing the controlled GPO.

Doing this opens the New York Computers – Power GPO in the Group Policy Management Editor for editing. Jacky navigates to the Select An Active Power Plan policy setting as shown next:


Figure 6: Step 6 of editing the controlled GPO.

Jacky double-clicks on the Select An Active Power Plan policy setting to open it for editing. He then enables the policy setting and selects Power Saver as the Active Power Plan:


Figure 7: Step 7 of editing the controlled GPO.

After clicking OK to close the policy setting and then closing the Group Policy Management Editor, Jacky returns to the Change Control node of the GPMC. He then right-clicks on the New York Computers – Power GPO on the Controlled tab and selects Check In to check the modified GPO back into the AGPM archive:


Figure 8: Step 8 of editing the controlled GPO.

In the Check In GPO dialog that is displayed next, Jacky enters a comment so the history of changes made to this GPO can be more easily tracked in the future:


Figure 9: Step 9 of editing the controlled GPO.

The New York Computers – Power GPO has now been configured, but only on the copy that is stored in the AGPM archive. The copy of this controlled GPO that exists in the CONTOSO production environment (i.e. in SYSVOL) has not been changed at this point, but Jacky is confident that he's configured the right policy changes so he decides to request redeployment of the GPO he has just modified. To do this, Jacky again right-clicks on the New York Computers – Power GPO and this time he selects Deploy from the shortcut menu:


Figure 10: Jacky requests redeployment of the controlled GPO he just modified.

Jacky adds his comment to the Submit Deploy Request as shown below:


Figure 11: Jacky's request for redeploying the controlled GPO to production.

Once Karen receives Jacky's Submit Deploy Request email via AGPM, it's up to her to review the changes and decide whether the modified GPO should be rolled out production. That's what we'll look at next.

Reviewing and Redeploying the Modified GPO

Karen, who as an AGPM Approver also holds the AGPM Reviewer role, is now going to review the changes that Jacky has made to the archived copy of the New York Computers – Power GPO and then redeploy the modified GPO into the production environment. To begin doing this, Karen logs on to her administrator workstation, opens the GPMC, selects the Change Control node, selects the Controlled tab, right-clicks on the New York Computers – Power GPO and selects History from the shortcut menu:


Figure 12: Step 1 of reviewing and redeploying a controlled GPO that has been modified.

In the History For dialog that displays next, the All States tab provides more information that Karen needs at he moment concerning the change history of the New York Computers – Power GPO:


Figure 13: Step 2 of reviewing and redeploying a controlled GPO that has been modified.

So Karen selects the Unique Versions tab and sees that the most recent change version was checked in by Jacky and is ready for her review:


Figure 14: Step 3 of reviewing and redeploying a controlled GPO that has been modified.

Karen then clicks the Differences button at the bottom left of the History For dialog shown above. Doing this opens Internet Explorer and displays any differences between the selected version of the controlled GPO (the version labeled "Checked in" in Figure 14 above) and the previous version of the same controlled GPO (the version labeled "Created" in Figure 14 above). The Difference Report shows that the only change Jacky made to the GPO was to enable the Active Power Plan policy setting and set it to Power Saver:


Figure 15: Step 4 of reviewing and redeploying a controlled GPO that has been modified.

Karen decides that the changes Jacky has made to the New York Computers – Power GPO are OK, so she closes Internet Explorer and clicks the Close button in the History For dialog shown in Figure 14 previously. Doing this displays the Approve Pending Operation dialog shown here:


Figure 16: Step 5 of reviewing and redeploying a controlled GPO that has been modified.

After typing her comment into the above dialog, Karen clicks Advanced to make sure the modified GPO will be redeployed properly. Clicking the Advanced button opens the GPO Links For Selected GPOs dialog, and Karen notes that redeploying the New York Computers – Power GPO will re-link it to the New York Computers OU as expected:


Figure 17: Step 6 of reviewing and redeploying a controlled GPO that has been modified.

Karen clicks OK to close the GPO Links For Selected GPOs dialog. Then she clicks OK in the Approve Pending Operation dialog shown previously in Figure 16. A progress bar indicates when the modified New York Computers – Power GPO has been redeployed into production:


Figure 18: Step 7 of reviewing and redeploying a controlled GPO that has been modified.

The modified GPO will now be applied to computers in New York according the usual Group Policy processing mechanisms.

Conclusion

In this article we've learned how to modify a controlled GPO, review changes made, and redeploy the modified GPO into your production environment. In the next article we'll examine how to roll back changes and perform other tasks with controlled GPOs using AGPM.

Hardware Considerations for RemoteFX

Microsoft® RemoteFX™ enables a rich 3-D experience in virtual desktop scenarios. RemoteFX is integrated into the Remote Desktop Virtualization Host role service, and IT administrators can provide 3-D capabilities to client computers (including thin clients). This topic provides hardware considerations for server and client computers when you are planning your RemoteFX deployment.

In this topic:

RemoteFX for RD Virtualization Host server hardware requirements

There are several hardware requirements that must be met when you deploy a RemoteFX server:

  • SLAT-enabled processor The processor in the RemoteFX server must support Second-Level Address Translation (SLAT). In virtualization scenarios, hardware-based SLAT support improves performance. On Intel processors, this is called Extended Page Tables (EPT), and on AMD processors, it is called Nested Page Tables (NPT).

  • GPU At least one graphics processing unit (GPU) is required on the RemoteFX server. The GPU driver must support DirectX 9.0c and DirectX 10.0. If more than one GPU is installed in the RemoteFX server, the GPUs must be identical. The GPU must have sufficient dedicated video memory that is separate from system memory.

    ImportantImportant
    For a list of GPUs that will work with RemoteFX in Windows Server 2008 R2 with SP1, see the blog post More partner momentum around Microsoft RemoteFX in Windows Server 2008 R2 SP1 Beta (http://go.microsoft.com/fwlink/?LinkID=197416).

    The final release of Windows Server 2008 R2 with SP1 will include an evolved list of GPUs. For a list of recommended GPU drivers, see the blog post Beta testing Microsoft RemoteFX in Service Pack 1 (http://go.microsoft.com/fwlink/?LinkID=197417).

  • RemoteFX encoder The RemoteFX encoder is optional and can be installed for additional scalability on the Microsoft® RemoteFX™ server.

  • Hyper-V The Hyper-V hardware requirements must be supported on the server. The Hyper-V hardware requirements for Windows Server 2008 R2 are available in the Windows Server 2008 R2 Technical Library (http://go.microsoft.com/fwlink/?LinkID=180919).

ImportantImportant
To use Live Migration, the source and destination RemoteFX servers must have the same GPU installed.

As the maximum monitors and resolutions are increased for each RemoteFX-enabled virtual machine, the amount of required video memory also increases. The GPUs in the server must have sufficient video memory for all virtual machines that are turned on at the same time. The following is a list of video memory requirements for a maximum resolution and number of monitors:

Maximum resolutionMaximum number of monitors in virtual machine setting

1 monitor

2 monitors

3 monitors

4 monitors

1024 x 768

75 MB

105 MB

135 MB

165 MB

1280 x 1024

125 MB

175 MB

225 MB

275 MB

1600 x 1200

184 MB

257 MB

330 MB

N/A

1920 x 1200

220 MB

308 MB

N/A

N/A

noteNote
In addition to the previous video memory table, Windows Server 2008 R2 with SP1 has been tested for up to 12 virtual machines per GPU, for a total of 24 virtual machines on two physical GPUs, providing the necessary dedicated video memory. This number will continue to be refined in later releases.

Using a baseboard management controller

A baseboard management controller is used to remotely manage the server, such as remotely configuring a server’s BIOS or viewing the server’s console. Some examples of baseboard management controllers include the Dell iDRAC, the IBM IMM, and the HP iLO. For more information about WDDM drivers can be found in the Windows Server Technical Library(http://go.microsoft.com/fwlink/?LinkId=209889).

RemoteFX requires a WDDM driver for the GPU installed on the server, but baseboard management controllers likely use an XPDM driver for its integrated video adapter. A video adapter that uses an XPDM driver and a video adapter that uses a WDDM driver cannot be simultaneously running. When a user connects to a baseboard management controller with RemoteFX enabled, the display for the server’s console will not be visible while the operating system is running.

noteNote
Any GPUs with an XPDM driver must be disabled through the BIOS or by using the RemoteFX cap driver. This includes baseboard management controllers that are used for KVM over IP. For more information about installing the RemoteFX cap driver, see Installing the RemoteFX cap driver later in this topic. For more information about disabling a GPU in the BIOS, consult the manufacturer.

When to use the RemoteFX cap driver

The RemoteFX cap driver allows you to use a baseboard management controller to view the server console during the BIOS sequence, while in safe mode, or when the Windows operating system stops unexpectedly and an error message appears on a blue screen.

ImportantImportant
If you install the RemoteFX cap driver, the integrated video adapter is disabled while the operating system is running.

The following table provides considerations for whether to use the RemoteFX cap driver. Each row is a separate option for how to enable RemoteFX when using a baseboard management controller that uses an XPDM driver.

OptionIs the console visible by using a baseboard management controller or KVM?

BIOS

Safe mode

Windows is running

The integrated video adapter that uses an XPDM driver is disabled in the server’s BIOS.

No

No

No. (The server can be viewed by using an RDP connection but not through the baseboard management controller.)

An external KVM is connected to the GPU on the RemoteFX server, which uses a WDDM driver. The integrated video adapter that uses an XPDM driver is disabled in the BIOS.

Yes

Yes

Yes. (The server can be viewed through the external KVM or by using an RDP connection.)

The RemoteFX cap driver is installed and the integrated onboard video adapter remains enabled.

Yes

Yes

No. (The server can be viewed by using an RDP connection but not through the baseboard management controller.)

Installing the RemoteFX cap driver

Before installing the RemoteFX cap driver, the WDDM driver for the video adapter should be installed and RemoteFX should be enabled. When installing the RemoteFX cap driver, ensure that the following steps are completed in order:

  1. Install the WDDM driver for the video adapter.

  2. Enable RemoteFX by using Server Manager.

  3. Install the RemoteFX cap driver.

To install the RemoteFX cap driver, type the following at a command prompt: dism /online /enable-feature /featurename:Microsoft-Windows-RemoteFX-EmbeddedVideoCap-Setup-Package, press ENTER, and then restart the computer.

ImportantImportant
In some cases, the RemoteFX cap driver may be installed on video adapters other than the integrated video adapter. To resolve this issue, you must reinstall the WDDM video adapter drivers.

You may choose to disable the RemoteFX cap driver to troubleshooting issues on the RemoteFX server. To disable the RemoteFX cap driver, type the following at a command prompt: dism /online /disable-feature /featurename:Microsoft-Windows-RemoteFX-EmbeddedVideoCap-Setup-Package, press ENTER, and then restart the computer.

RemoteFX for RD Session Host server hardware requirements

If you are using RemoteFX on an RD Session Host server, the processor on the RD Session Host server must support Streaming SIMD Extensions 2 (SSE2). The RemoteFX encoder is optional server hardware, and it can be installed for additional scalability on the RemoteFX server. The hardware encoder card must be installed in a PCI Express x4 slot or greater.

Client options

A RemoteFX-enabled client can run as software or by using a RemoteFX hardware decoder.

  • The client software is part of the Remote Desktop Connection that is included with Windows Server 2008 R2 with Service Pack 1.

  • The RemoteFX hardware decoder will be available as a complete solution through Microsoft partners.