Medium Business Solution for Client Configuration
Plan
This section provides guidance on choosing the right types of client devices for different users and choosing the hardware and software configurations for these client devices. It is not possible to study the requirements of each user in the IT environment; therefore, the Medium Business Solution for Client Configuration recommends creating broad categories of client devices that are required in the environment. This solution provides guidance on assessing the user requirements and creating different categories of client devices. It also provides considerations and recommendations for choosing the client hardware and software for each category of client devices. The following figure represents the medium IT infrastructure and highlights the client devices. On This PageIdentifying the Types of Client Devices RequiredThe first step in planning for deployment of client devices is identifying the different types of client devices that will be required in the environment. The Medium Business Solution for Client Configuration provides guidance on deploying the following types of client devices in the medium IT environment.
The following table provides the advantages and disadvantages of using these different types of client devices.
Table 1. Client Device Choices The types of client devices users may require depends on the kind of work they do. Some users may require multiple devices to enable them to work efficiently. The following table presents a simple matrix that IT generalists can use to decide and recommend different devices for different users performing different roles in the organization. A lot of these decisions and recommendations also depend on the IT budget of the organization.
Table 2. Client Device Requirement Matrix The following table lists the user roles identified for Lucerne Publishing, a brief description of how they operate, and the client devices recommended for them.
Table 3. User Roles and Client Devices Recommended for Users in Lucerne Publishing Standardizing Client DevicesStandardizing the client devices, typically, involves standardizing the desktop computers and portable computers (laptops, and Tablet PCs). Standardizing home computers may be very difficult or not possible at all in most cases. Standardizing the configurations of mobile devices and public computers is also not possible, although you should consider standardizing the handheld device hardware. Client devices can be grouped into categories based on the performance requirements of the users. In the medium IT environment, the devices can be grouped into the following three categories:
Standardized configuration settings, software, hardware, and preferences should be designed for each of these groups of devices. In addition, it should be ensured that all client devices existing in the environment meet the defined criteria. It is easy to standardize desktop configurations of client devices because Windows XP Professional is recommended for all client devices in the medium IT environment. Standardization makes it easier to install, update, manage, support, and replace these client devices. Standardization also makes it easier to deploy the operating system, upgrade applications, and make changes to the configuration that can be guaranteed to work on all computers. Standard desktop configurations also make it easier for support personnel to identify and resolve problems encountered by users. Problems can occur when users install operating system upgrades, hardware devices, applications, and device drivers and when users configure new or change existing settings and preferences that have not been approved for use in the organization. Creating standards helps to eliminate these potential problems. If a computer fails, having a standard configuration minimizes downtime by ensuring that users have the same settings, applications, drivers, and preferences that they had before the problem occurred. Some organizations might require multiple, standardized desktop images depending on the business of the organization and job-related functions. For example, an accounting desktop will have a different configuration from a design and engineering desktop. In such scenarios, the first step in creating images is to properly plan and create a standard image that can be used as the base image across the organization. The following table presents the categories assigned by Lucerne Publishing to all client computers that were identified in the previous section.
Table 4. Categories of Desktop and Portable Client Computers at Lucerne Publishing The table reveals that Lucerne Publishing requires the following categories of client computer hardware:
Operating System RecommendationsThe Microsoft® Windows® family has an operating system for each type of client device considered in the Medium Business Solution for Client Configuration. This solution recommends using the latest version of the appropriate Windows operating systems for each type of client devices. The following table lists the recommended Windows operating system for each type of client devices.
Table 5. Recommended Windows Operating System for Different Client Devices Note that the organization has no control over the operating system used on the public computer, and in most cases, it has no control over the operating system used on the home computers either. Hardware RecommendationsThe following sections present the considerations and the Medium Business Solution for Client Configuration recommendations for client device hardware. The following table presents the minimum hardware recommended for the Windows XP operating system.
Table 6. Minimum Hardware Requirements for the Windows XP Operating System ConsiderationsThe business requirements and the role of the client computer determine the hardware configuration. The following sections detail some of the elements that need to be considered while choosing the hardware for client devices. Hardware CompatibilityBefore buying hardware, check the compatibility of the operating system with the hardware. Microsoft provides catalogs of products, both hardware and software, that are compatible with different versions of Windows XP and the Microsoft® Windows Server™ 2003 family. Windows Catalogs are replacing the Hardware Compatibility List (HCL), which used to provide lists of compatible hardware devices for Windows® 2000 Server and earlier operating systems. Microsoft provides the following catalogs:
Ensure that the computer hardware is compatible with Windows XP, and that the computer on which the operating system is being installed supports the minimum system requirements for installation. For a list of hardware devices that have successfully passed the hardware compatibility tests for Windows XP, perform the following steps:
Hardware compatibility is not an issue with Pocket PCs and Smartphones because they use software developed by original equipment manufacturers (OEMs). Processor and Memory (RAM)Applications may be:
Therefore, the applications that the users in each of the standardized groups will be running need to be evaluated before deciding the processor and memory requirements. Lucerne Publishing used the following standard:
StorageThe disk space should be enough to store the working files of the users. There should be provisions for larger disks for users who work with large files, such as computer-aided design (CAD) and animation files. It should be kept in mind that if folder redirection is being used to redirect user data to a network share, the actual files will not be stored on the local disks. Therefore, storage may be required only to accommodate system files and temporary files. When considering storage for mobile devices, look for the size of Flash ROMs. In addition, consider CompactFlash (CF) or Secure Digital (SD) storage cards that can store up to 1 GB, or support up to 30 GB with a Personal Computer Memory Card International Association (PCMCIA) storage cards. Removable StorageMost computers come with floppies and CD-ROM drives. CD or DVD writers may also be considered for some users. Another type of removable device is the USB (Universal Serial Bus) mass storage device. USB mass storage devices include:
A serious consideration with removable drives is data security. Removable storage devices are a convenient means of stealing valuable information. High-capacity pen drives can be plugged into any computer with a USB port and large volumes of data can be stolen. Therefore, it is important that the users do not leave computers with critical or confidential data unlocked. In addition, organizations may need to enforce policies such as restricting the use of removable storage to certain trusted users only or to users who need to use these devices to perform their job. CommunicationsEach computer requires a means to communicate with the network. Communication devices include wired and wireless network adapters, modems, and in case of mobile devices, Bluetooth and infrared. This solution recommends standard 10/100 Mbps network adapters on all client computers. In addition, portable computers should have modems and either built-in or add-on wireless network cards. It is recommended that the wireless adaptors should support both the 802.1b and 802.1g standards. For Pocket PC-based devices, getting an integrated wireless capability with the device will allow the device to access resources on the network. Pocket PC Phone Edition and Smartphones both come with built-in communications capability. Sound and GraphicsBetter graphics cards, with additional RAM on the graphics card, may be required for users who work with graphics and animations. Sound cards are standard in most client computers. Better and more advanced cards may be needed for some specialized users. Lucerne Publishing used the following standard:
DisplayMonitors are an important peripheral for users, especially for users who have to work continuously or for long durations. 17-inch color monitors are a popular choice for most environments. One may choose wider screens and higher resolution monitors to improve the comfort of users. Consider the following options while choosing a monitor:
Colored screens in mobile devices might be useful for viewing charts, pictures, presentations, slides, and videos. A high-resolution screen is useful for viewing multimedia content. A specialized set of rugged Pocket PCs that can be dropped and can work in rainy or dusty industrial environments are available from vendors like Casio, Compaq, Intermec, and Symbol. Lucerne Publishing used the following standard:
Human Interface DevicesSimilar to monitors, a good keyboard and mouse can help increase the long-term productivity of users. Care must be taken when buying these devices and importance should be given to user comfort. Typically, optical mouse devices are a good choice because:
Consider using mouse devices with scroll wheels because they increase user productivity, especially for users who require browsing through documents and Web pages. Battery UsageThis is a special consideration for portable computers and mobile devices. Consider employing both the main and the backup battery. Smartphones usually do not come with a backup battery. The rechargeable batteries in Pocket PCs support longer usage times. Typically, during constant use, these batteries will operate in the six to eight hour range, similar to a cell phone. Some devices have a lithium polymer plate battery that is rated for up to 16 hours on a single charge. Other manufacturers offer extended batteries that operate for up to 24 hours on a single charge (with the backlight switched off). When mission-critical data (for example, a sales order, medical prescription, test result, or stock trade) is placed on the client devices, it is important to protect data from accidental loss. The accidental loss can happen if there is not enough space to store all the data or if the battery were to run out of power. DesignDevice design is a special consideration for all portable and mobile devices, including laptops, Tablet PCs, Pocket PCs, and Smartphones. Consider the following when evaluating the device design:
In addition, for Tablet PCs, you need to consider the form factor. Tablet PCs come in two forms—the convertible form that has a built-in keyboard and the slate form (the approximate size of an actual paper notebook) that has no keyboard. PeripheralsWhen buying client devices, look for peripherals that accompany these devices. This especially applies to mobile devices. To meet the mobile computing needs for special operating capabilities, look for the following hardware features on a Pocket PC:
Many peripherals for data capture, storage, and connectivity are available because of the inclusion of SD, MMC, CF, and PCMCIA industry standard slots in handheld devices. Some Pocket PCs support two slots enabling storage and connectivity cards to be used at the same time. With industry-standard Infrared (IrDA) supported on a Pocket PC, the devices can exchange data over wireless connections and synchronize with desktop computers. Data-ready cellular phones can be used as modems for handheld devices. Socket and Xircom offer CF cards with different connectors that plug into these digital cellular phones. Bluetooth-enabled products for personal area networks are available for handheld devices through CF and PCMCIA cards as well as slide-on jackets. Bluetooth provides the capability for wireless connections with computers, other PDAs, cell phones, printers, cameras, and bridges to Ethernet networks over time. Hardware VendorMany hardware vendors offer comparable hardware solutions for desktops. When choosing the hardware vendors, consider the following factors:
RecommendationsBased on considerations presented in the previous section, Lucerne Publishing developed the following standard configurations for the identified client device categories. The following categories were required by Lucerne Publishing:
The standard configurations developed for these client computers are presented in the following sections. DesktopsThe following table lists the standard configurations for different categories of desktop computers required by Lucerne Publishing.
Table 7. Standard Hardware for the Desktop Computer Categories Required by Lucerne Publishing Portable ComputersAs with desktop computers, it is very important to standardize the configuration of portable computers. The business needs of an organization determine the type and configuration of laptop or Tablet PC. The following table presents the configurations for different categories of portable computers required by Lucerne Publishing.
Table 8. Standard Hardware for the Portable Computer Categories Required by Lucerne Publishing Laptop vendors have dedicated sites that can help you make appropriate decision. Home ComputersIn most cases, organizations have no control on the hardware purchased by employees for their home computers. However, organization can make deals with hardware vendors to provide discounts to employees for certain configurations. This encourages the employee to buy a computer that meets your configuration standards and helps employees save money on the purchase. The hardware recommendations for home computers are similar to the desktop computer with the addition of multimedia hardware such as speakers, microphones, and sound card. The minimum configuration that the users should use is 1-GHz processor-based computers with 256 MB of RAM. Mobile DevicesSome of the vendors manufacturing Pocket PCs are Casio, Compaq, Fujitsu, Hewlett-Packard, Intermec, Mitsubishi, NEC, Sagem, Siemens, Symbol Technologies, and UR There. These manufactures provide detailed lists of peripherals and components that can be added to Pocket PC devices. For more information, refer to the Web site of the specific manufacturer. The following table presents the minimum hardware requirements and the Medium Business Solution for Client Configuration hardware recommended for Pocket PCs.
Table 9. Minimum Hardware Requirements and Medium Business Solution for Client Configuration Recommendations for Pocket PCs Product ActivationMicrosoft Product Activation is an anti-piracy technology that is designed to reduce a type of piracy known as "casual copying" or "softlifting" of Microsoft software. Typically, the computer is activated trough the telephone or the Internet activation methods; however, the following cases are exceptions:
For additional information on automating the activation process using scripts, refer to the “Deploying Windows XP Using Windows Product Activation” TechNet article available at the following URL: http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/wpadepl.mspx Desktop Computer ConfigurationThis section provides information on automating the deployment of Microsoft Windows XP Professional, managing computers with Group Policy, securing client computers, and configuring printers. Automated DeploymentDeploying Windows XP Professional becomes much simpler and can be automated more easily if standardized desktop configurations are used. Automated installations run with minimal or no user interaction. This provides for a faster, more consistent, and trouble-free installation. The automated installation tools use the following two basic methods to accomplish an automated installation:
Windows XP supports the automation of custom installations. An automated installation of Windows XP can be customized by:
ChoicesThe following table lists some of the methods of installation.
Table 10. Automated Deployment Options Based on their suitability to the medium IT environment, the following deployment methods were considered in the Medium Business Solution for Client Configuration:
The following table lists the advantages and disadvantages of each of these methods.
Table 11. Advantages and Disadvantages of Various Deployment Methods RecommendationsThe deployment method depends greatly on the location of the client computers and the network structure. For medium businesses with small or limited IT support, the best way to deploy Windows XP is to have the manufacturer or value added provider (VAP) pre-build desktops with the required configuration. Some hardware vendors will provide custom images for a fee. If this is not possible, use Sysprep or RIS installation methods. For detailed instructions on these two methods, refer to the following URL: Group PolicyActive Directory® Group Policy objects (GPOs) should be used to configure the client computers. Some of the configurations that should be made include:
SecurityAt the minimum, the following features or applications should be configured on the desktop and portable computers to maintain security:
Windows FirewallThe Windows Firewall is a feature included in Windows XP with SP2 to help protect the computers from threats on the Internet. Group Policy should be used to enable the Windows Firewall on all computers in the environment. Microsoft Windows UpdateClient computers should automatically be updated with critical software updates. Critical updates can be obtained and installed on Windows XP computers by the following means:
If the Medium Business Solution for Patch Management has been implemented in the environment, the software updates will be configured automatically. For more information on patch management, refer to the Medium Business Solution for Patch Management. Antivirus SoftwareAn antivirus software program protects the computer against viruses, worms, Trojan horses, and other malicious code. Antivirus software continually scans the computer for viruses and helps detect and remove viruses. Keeping the antivirus signature files up-to-date is critical to maintaining a secure desktop or portable computer. User education regarding safe e-mail practices is critical in preventing virus attacks. Users should not open an e-mail or take action on an e-mail attachment unless they are expecting the file. All e-mail attachments should be scanned with the antivirus software prior to execution. For information on the types of malicious programs and the risks and for guidance on planning an effective antivirus strategy for your organization and responding quickly and effectively to infections or incidents when they occur, refer to “The Antivirus Defense-in-Depth” at the following URL: http://www.microsoft.com/technet/security/guidance/serversecurity/avdind_0.mspx For guidance on choosing the right antivirus for the medium IT environment, refer to the Medium Business Guide for Antivirus. PrintingIn scenarios where a user needs to print confidential information frequently (for example, HR staff), a direct-attached printer needs to be connected and configured on the client computer for the following reasons:
Unless there is a specific requirement to have a standalone printer attached to a particular client computer, all remaining printers should be shared and published in the Active Directory® directory service with the appropriate drivers to support the various client computers on the network. For detailed information and recommendations on print services, refer to the Medium Business Solution for Print Services. Portable Computer ConfigurationThe process of deploying and configuring a portable computer (laptop or Tablet PC) is similar to the process of deploying and configuring a desktop computer. You should ensure you have the same standardized deployment method for desktops, laptops, and Tablet PCs. Note: For detailed instructions on how to deploy a Tablet PC, refer to the following URL: http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/tpcdploy.mspx Basic functionality for laptops and Tablet PCs running Windows XP do not differ from the desktop computer. In addition to the considerations and recommendations provided for desktop computers, consider the following mobility and security considerations for portable computers:
The following sections detail these features and considerations. Offline File SynchronizationThe offline files feature is designed primarily for mobile users who use a laptop or a Tablet PC to connect to the network periodically. These users can mark shared folders on the company network or Web page to be made available offline. The contents of these shared folders or pages are copied to a temporary folder on the hard disk of their local computer. After disconnecting from the network, the files can be opened and edited. The files are synchronized with the originals when the user reconnects to the network and logs on to or logs off from the domain. Wireless Network ConfigurationFor medium businesses, the Wi-Fi Protected Access (WPA) standard is recommended for wireless authentication and data encryption. 802.1x authentication with PEAP (Protected Extensible Authentication Protocol) should be deployed, if there are a large number of mobile devices. The basic requirements for WPA security are:
To find the latest list of access points and wireless network cards that support WPA specifications, refer to the Wi-Fi Alliance organization page, available at the following URL: Encrypting File SystemPortable computers and other mobile devices have a higher risk of being stolen than a non-portable device such as desktop computer. Often portable computers and mobile devices hold important company data. If these were to be stolen, all the security features such as NTFS permissions and strong password would fail. This is because all that a person with physical access to a computer needs to do, to extract data, is take out the hard disk from the stolen computer and attach it to a computer on which he or she has administrative rights and reset the NTFS permissions. Encrypting File System (EFS) protects you from such data theft. EFS encrypts the data on the hard disk and decrypts the data only when the credentials that were used while encrypting it are provided. Individual files and folders (or subfolders) on NTFS volumes can be set with the encryption attribute. Although it is common to refer to folders with the encryption attribute set as encrypted, the folder itself is not encrypted. No public-private key pair is required to set the encryption attribute for a folder. When encryption is set for a folder, EFS automatically encrypts the following:
EFS is available by default and any user that has the permission to modify the files can encrypt files. EFS relies on a public key to encrypt files. Therefore, a public-private key pair and a public key certificate are needed for encryption. To use EFS, users must have EFS certificates for which the following two options are available:
The following table lists the advantages and disadvantages of these choices.
Table 12. Advantages and Disadvantages of PKI and Self-signed Certificates Windows XP automatically generates EFS certificates. Users obtain a certificate by encrypting a file. Each user who logs on to the computer can encrypt files. EFS generates a unique certificate and key pair for each user. Unless a user shares the encrypted files with other, no user can access the files owned by another user. Backed-up Recovery KeyNot having a backed-up recovery key can result in irrevocable loss of encrypted data. Backing up a recovery key helps ensure that encrypted data can be recovered in the event that the user holding the EFS encryption certificate is not able to decrypt the data. The recovery key back up operation must be performed using the recovery agent account that has the file recovery certificate and private key in its private store. The domain administrator is the default recovery agent. To allow an account to read or recover data encrypted by using EFS, make the account a recovery agent. In a domain environment, it is advisable to use domain accounts for that purpose. Recovery agent can be created for any site, domain, or organizational unit (OU) in an Active Directory service forest. By default, the built-in administrator account for a domain is a recovery agent; in that case, you do not need to create a recovery agent. Accessing E-mail RemotelyRemote users can access e-mail remotely from the OWA Web site using an SSL capable Web browser, such as Microsoft Internet Explorer. In the Medium Business Solution for Client Configuration, the URL to OWA is https://mail.businessname.com. In addition, Exchange 2003 combined with Microsoft Office Outlook® 2003 on a Windows XP client can support Outlook over HTTP. Accessing Data RemotelyRemote users can access data remotely by visiting the company extranet site. Home Computer ConfigurationThis section provides best practices for home computer configuration, such as software, security, and access to business network. Standardizing the home computer configuration is not possible in most cases. This is because the computers do not belong to the organization and the organization has no control over them. Access to information on the internal network can be provided using technologies such as Web sites, VPN, or dial-in access. Some of the basic tasks that should be performed before allowing home users access to the internal network are:
In the Medium Business Solution for Client Configuration, the following applications can be accessed through thin clients:
Using thin clients provides better security and improved performance than the security and performance provided by a remote connection to the main office. Remote connection should only be allowed for uses that need it. When providing VPN access to home users, use the following best practices:
For more information, refer to “Network Access Quarantine Control in Windows Server 2003” at the following URL: http://www.microsoft.com/windowsserver2003/techinfo/overview/quarantine.mspx Windows Mobile Devices ConfigurationThis section provides guidance and best practices on how to configure mobile devices in the medium IT environment. It provides considerations that need to be kept in mind to ensure that these devices do not become a threat to the security of confidential data in the organization. SynchronizationActiveSync® technology keeps data consistent between a mobile device and a client computer. ActiveSync starts automatically when the client computer is connected to the Pocket PC and can continuously update changes until the device is disconnected. Connections can be serial, infrared, USB, Ethernet, or dial-up. Data from the Office Outlook messaging and collaboration client, such as appointments, contacts, tasks, notes, and e-mail with attachments, can be synchronized along with many other types of data including pictures, music or audible files, Web pages, PowerPoint® slides, Word documents, and Excel spreadsheets. The Pocket PC device can also directly synchronize with a Microsoft Exchange or Lotus Notes server without having to go through a client computer. E-mail, calendar, and contacts can now flow directly between the Internet-connected Pocket PC devices and Microsoft Exchange Server. ActiveSync can be remotely installed from a centralized location by the IT generalists, making it easier for the users to configure device. SecurityOrganizations using mobile devices should establish security practices at an appropriate level based on their needs. Most organizations are subject to legal and other external obligations to protect certain kinds of data, for example, to protect the personal information of the employees. There are many ways in which unauthorized users can get access to sensitive information, such as:
A comprehensive plan needs to be prepared to ensure that mobile devices do not become a security threat. The security plan must cover the following:
Risk AnalysisRisk analysis helps identify the appropriate levels of security required for each potential risk area. For example, if the mobile device has connectivity to the business network and access to data on the network, greater protection measures must be taken. There are many risk assessment methodologies that can help you analyze risk associated with any computing devices including mobile devices. You might want to consider using Security Risk Management Discipline (SRMD) risk assessment methodology. For more information on this methodology, refer to the following URL: http://www.microsoft.com/technet/Security/prodtech/win2000/secwin2k/03secrsk.mspx Mobile Devices Security PolicyOrganizations that are concerned about the security of their data should set the following mobile device security policies:
Enforce and Automate Mobile Devices Security PolicyIn addition to establishing security policies, it is also necessary to automate enforcement of the policies. Systems management solutions that can enforce policies are available from numerous companies. These solutions enable IT organizations to maintain a centralized asset inventory of the devices that connect to the corporate network and to automatically fix configuration settings and distribute software updates as these devices become available. For a sample list of systems management solutions for Windows Mobile-based devices, refer to the Microsoft Mobile resources Web site available at the following URL: http://www.microsoft.com/windowsmobile/business/solutions/default.mspx. Note: When you visit this URL, you will be prompted with the option to search. Search for System Management under Software Solutions. Backup and RestoreBackup and restore solutions that are available for Pocket PCs and Smartphones are listed in the following table.
Table 15. Backup and Restore Solutions for Pocket PCs and Smartphones For more information on non-Microsoft backup solutions, refer to the "Windows Mobile – Solutions Providers Home" page, available at the following URL: http://www.microsoft.com/windowsmobile/business/solutions/default.mspx Note: When you visit this URL, you will be prompted with the option to search. Search for “Backup” under Software Solutions.
|
In This Article
|
