Features for Roaming & Branch Office Users

Windows 7 has come up with quite a few new enhancements for enterprise users
but most of them are dependent upon Windows Server 2008 R2 to work, except
AppLocker and BitLocker.

These two don't need any configuration at the server end thus you can easily
deploy them. You can also refer to the hand-on stories we have done around them
in this issue. However, for both Branch Caching and DirectAccess, you need to do
most of the configuration at the server end. Here, we will discuss about the
features from a technology point of view and will cover the in-depth
implementation of Branch Caching and DirectAccess in the coming issues.

DirectAccess for roaming users

This feature is meant for corporate users who would like to access their
corporate intranet while on the move over the Internet. Well, this might sound
like yet another VPN solution, but is actually different. In DirectAccess, you
don't need a VPN client to be configured or installed to access your corporate
network. Rather, it uses the IPv6 and its native features to tunnel and secures
data over the public network. The support for native IPv6 protocol was there in
Microsoft OSes for quite some time, but this possibly is the first application
by Microsoft which fully and natively works on IPv6 and its features.

By now you must be wondering if DirectAccess natively works on Ipv6, you will
require IPv6 aware devices at both end points -enterprise gateway level and at
the router or ISP level. No, you can even use DirectAccess over the old IPv4
aware NAT and routing devices. The only requirement is that both the corporate
network and the roaming client machine should have IPv6 support.

This wizard takes care of the DirectAccess service installation in Windows Server 2008 R2..

The ISP link with IPv4 is managed by a native technique of IPv6 called Teredo
Tunneling, which uses a protocol called 6 to4 to tunnel IPv6 packets through
IPv4. It can grant connectivity of two endpoints using IPv6 located behind
native devices which are unaware of IPv6. This technology is developed to make
sure people can start adopting IPv6 in corporate networks and remote
connectivity without even requiring supported end point devices.

Configuring DirectAccess is not that simple. The whole deployment needs
meeting a lot of pre-requisites and some of them are unique. For example, for
deploying DirectAccess service on top of a Windows Server 2008 R2 box, you need
two consecutive public IPs. Why exactly is this kind of a resource required is
still a mystery to us. The DirectAccess setup wizard refused to proceed till the
time we actually gave them two consecutive public IPs. Plus, a lot of
configuration is required which you have to do before DirectAccess setup takes
charge and configures the whole thing. From the client end i.e, from the Windows
7 end, all you need to do is to enable the Teredo feature by running the
following command from an elevated command prompt:

C:\netsh interface teredo set state enterpriseclient

This command will create a virtual network adapter for which it will get the
IPv6 IP and will support Teredo functionality.

This is how distributed caching is different from hosted cache. In the first case, we only have the client machines accessing the cache from all the peers, but in the hosted caching, you can see the data is accessed from a single source.

BranchCache for branch offices

This feature helps enterprises optimize their WAN usage. Though, it can't be
compared to a full fledged WAN optimization solution, it does some sort of WAN
optimization. Essentially, it's a mechanism by which one can configure a
centralized data caching server at the branch office level which connects to the
head office. This part is common and there are many solutions which can do the
same. The unique part is that, you can even have a setup without central data
caching server and can do the caching on individual machines. Also, if all the
machines are a part of the same domain, then they can share cached data with
each other.

The only disadvantage of this where you don't have a centralized caching
solution and have laptops in place instead is that, once laptop goes out of the
network you lose the caching data sitting on that particular node. This feature
only supports HTTP and SMB protocols which is enough for connecting and
accessing file servers and online business applications.The configuration is
again very simple. Either it can be done through the Group Policy if you want to
do the setting across a large number of machines, else a simple command can
enable the Branch Caching on individual machines. The command is as follows:

C:\netsh branchcache set service distributed

Next -

BitLocker Enhancements