Six Myths Of Windows RT Revealed! - MilitaryCAC

Six myths of Windows RTrevealed!There has been a lot of (mis)information being circulated about capabilitiesof Windows RT, the new Microsoft operating system for ARM tablets. Thisdiscussion should dispel a number of those myths and will highlight the robustcapabilities of this new and exciting operating system powering the nextgeneration of Dell tablets.Myth # 1 – Windows RT is not manageableAlthough Windows RT is not as openly manageableas a Windows 8 Pro or Windows 8 Enterprise PC, ITAdministrators will still be able to remotely manage manyaspects of a Windows RT device.SCCM and InTuneMicrosoft System Center Configuration Manager (SCCM)and Microsoft’s SaaS product, InTune, are widely adoptedsystems management solutions.Utilizing Exchange Active Sync extensions, Windows RTwill have built-in hooks so that it is manageable by SCCMand InTune. For example, using Exchange Server, SCCMand InTune, the IT admin is able to configure a set ofpolicies including: Allow convenience logon Maximum failed password attempts Maximum inactivity time lockMinimum device password complex charactersMinimum password lengthPassword enabledPassword expirationPassword historyIt also has the ability to query and report back: Drive encryption statusAuto update statusAntivirus statusAnti-spyware statusThis is just a start. In the future, there are manyopportunities for Microsoft to open up additionalmanagement capabilities beyond these critical oneslisted. As Windows RT becomes more mature, we expectMicrosoft to continue expanding the list.

Myth #2 – Windows RT is not secureOut of the box, Windows RT devicesare loaded with a number of built-insecurity features that will appeal to abroad set of customers with varyinglevels of security enforcement policies.Secure BootSecure Boot effectively locks downWindows RT devices by preventingit from loading (or booting for thatmatter) non-Windows operatingsystems. This effectively stops usersfrom loading rogue or pirated copiesof OS onto Windows RT devices.This maintains the integrity of theoperating system so that it can alwaysbe trusted.This same system also helps enforcethat all applications be digitally signedusing a trusted certificate beforebeing installed on the device. Itensures authenticity (knowing wherethe app came from) and integrity(verifying the app hasn’t beentampered with since its publication)for each application on a WindowsRT device, preventing installation ofunauthorized applications.Windows DefenderAlthough the Secure Boot system willprevent the majority of unauthorizedapplications from being installed, thenext line of defense will be built-inWindows Defender, protecting thesystem against spyware and unwantedsoftware. Windows Defender willcontinuously monitor and helpremove malicious and potentiallyunwanted programs from the device.Full device encryptionProtecting data on the system isimportant for a number of reasons andencrypting the data on the device isthe most widely accepted method ofsecuring private information. Windows2RT devices come with full volume dataencryption, which is based on their ownbitlocker technology (although will notbe branded BitLocker by Microsoft). Thisensures that any sensitive data on thedevice will be inaccessible in the eventthe device is lost or stolen. The recoverykey is stored on the user’s SkyDriveaccount for easy access if needed.Firmware Trusted Platform ModuleTPMs are devices that securely storecryptographic keys, such as passwordand login credentials (typed andsmartcard based) and encryptionkeys. Windows RT supports a firmwarebased TPM so that user’s passwordsand credentials remain secure andprotected.Remote wipe of company sensitive dataIn the event that a Windows RTdevice is lost or stolen, the user orIT administrator with the propercredentials has the ability to remotelywipe EAS managed data (like email,contacts, and calendar events) onthe device, even though the datais encrypted (just to be safe!). If theapplications were installed throughthe Enterprise Application Store, ITadmins will also be able to disableaccess to these line of business (LoB)apps (see Myth #4 below).Myth #3 – Setting up WindowsRT to work in an enterpriseenvironment is difficultMulti-factor authenticationWindows RT supports many formsof secure login, including picturepassword, typed password, biometric(fingerprint) and smartcards (PIV,GIDS) utilizing firmware trustedplatform module (TPM), dependingon the hardware configuration.Through the InTune managementconsole, IT admins can also forcepolicies such as strong password,password expiration, inactivity timelock, etc.Separate user profiles are alsosupported which isolates andprotects user’s data from beingaccessed by other users loggedinto the device at the same time.Although separate local user profilesare possible, only one EnterpriseApplication Store credential issupported (i.e. authentication via AD).Windows RT comes with a number ofbuilt-in, out-of-the-box tools that allowthe device to easily connect the userto their enterprise environment anddownload LoB applications. So eventhough Windows RT does not directlysupport features like Domain Join, it isexceptionally “enterprise ready”.VPNVirtual Private Networking (VPN)creates a secure, reliable tunneldirectly through a company’s firewallthat allows users to access corporatedata and email. Windows RT has abuilt-in VPN that is compliant with themajority of advanced VPN systems inthe marketplace today. Inbox VPN client included forMicrosoft, Cisco, CheckPoint, andJuniper servers VPN protocols supported: L2TP,PPTP, SSTP, Ipsec (IKEv2) Multiple ways of configuration(client UX, scripts, or managementinfrastructure) Encryption protocols: WEP, WPA,WPA2, WPA-Enterprise, WPA2Enterprise, 802.1X Certificate-based authenticationUsing the built-in managementagent, Windows RT allows automaticconfiguration of VPN profiles for theuser, so that Windows RT deviceseasily connect to a corporate networkrequiring little user action.

VDI supportFor companies using Virtual DesktopInfrastructure (VDI), Windows RTallows the user to connect directlyto their full Windows desktop andaccess legacy applications using thebuilt-in VDI receiver application. Thisallows for: Full VDI experience Rich experience everywhere(RemoteFX, USB redirection, multitouch remoting) Best value for VDI (Fairshare) Efficient managementSo even though legacy native appswritten purely in native WIN32 codecannot execute directly on WindowsRT devices, these apps may still beaccessible to the user through aconnected VDI session. Plus, all theadvantages of VDI such as sessionmobility, security and IT imagemanagement will be available to theWindows RT user through the built-inVDI receiver.Myth #4 – It’s difficult to installline of business (LoB) apps onWindows RTEnterprise customers have manyoptions available to distribute LoBapplications to their employees (orstudents). One way is through theWindows Store or through the DellShop (store within a store) application.Although this method is a convenientway to discover and download mostpopular off-the-shelf apps, it requiresthe user to log on using their personalMicrosoft Live ID, which may not beappropriate for companies or schoolsystems that have developed ornegotiated separate volume licenseagreements for their LoB applications.Enterprise Application StoreSo by using the built-in Windows RTManagement Agent and EnterpriseApplication Store, a curated set ofcompany approved LoB apps canbe easily discovered, downloadedand installed directly to the device.Microsoft allows the user to browseand discover these types of LoB appsthat have been made available to themby the IT admin:3 Internally developed Windows RTapps that are not published in theWindows Store Apps produced by independentsoftware vendors that are licensedto the organization for internaldistribution Web links that launch websitesand web-based apps directly inthe browser Links to app listings in the WindowsStore. This is a convenient wayfor IT to make users aware ofuseful business apps that arepublicly available.Discovering anddownloading LoBapplications on WindowsRT devices is quitesimple. The Windows RTManagement Agent andEnterprise ApplicationStore allows the userto simply enter theircorporate email addressand password and thedevice will automaticallypresent a set of LoBavailable for the user todownload and install.This same system alsoallows the IT Administratorto populate, manage andaudit which applicationsare available to each user.This is accomplishedby simply adding theuser’s credentials to theActive Directory (AD)service in the SCCM orInTune console.By specifying which ADdomain a particular useris a member of, IT adminscan offer different applications todifferent sets of users. For example,they can offer expense management,contact management and salestracking applications to their roadwarriors and offer quality control,inventory management and logisticsapplications to team members on thefactory floor.