Office365 on Terminal server done right

So this is a blogpost based upon a session I had at NIC conference, where I spoke about how to optimize the delivery of Office365 in a VDI/RSDH enviroment.

There are multiple stuff we need to think / worry about. Might seem a bit negative, but that is not the idea just being realistic

So this blogpost will cover the following subjects

• Federation and sync
• Installing and managing updates
• Optimizing Office ProPlus for VDI/RDS
• Office ProPlus optimal delivery
• Shared Computer Support
• Skype for Buisness
• Outlook
• OneDrive
• Troubleshooting and general tips for tuning
• Remote display protocols and when to use when.

So what is the main issue with using Terminal Servers and Office365? The Distance….

This is the headline for a blogpost on Citrix blogs about XenApp best pratices

So how to fix this when we have our clients on one side, the infrastructure in another and the Office365 in a different region ? Seperated with long miles and still try to deliver the best experience for the end-user, so In some case we need to compromise to be able to deliver the best user experience. Because that should be our end goal Deliver the best user experience

User Access

First of is, do we need to have federation or just plain password sync in place? Using password sync is easy and simple to setup and does not require any extra infrastructure. We can also configure it to use Password hash sync which will allow Azure AD to do the authentication process. Problem with doing this is that we lose a lot of stuff which we might use on an on-premises solution

• Audit policies
• Existing MFA (If we use Azure AD as authentication point we need to use Azure MFA)
• Delegated Access via Intune
• Lockdown and password changes (Since we need change to be synced to Azure AD before the user changes will be taken into effect)

NOTE: Now since I am above average interested in Netscaler I wanted to include another sentence here, for those that don’t know is that Netscaler with AAA can in essence replace ADFS since Netscaler now supports SAML iDP. Some important issues to note is that Netscaler does not support • Single Logout profile; • Identity Provider Discovery profile from the SAML profiles. We can also use Netscaler Unified Gateway with SSO to Office365 with SAML. The setup guide can be found here

https://msandbu.wordpress.com/2015/04/01/netscaler-and-office365-saml-idp-setup/

NOTE: We can also use Vmware Identity manager as an replacement to deliver SSO.

Using ADFS gives alot of advantages that password hash does not.

• True SSO (While password hash gives Same Sign-on)
• If we have Audit policies in place
• Disabled users get locked out immidietly instead of 3 hours wait time until the Azure AD connect syng engine starts replicating, and 5 minutes for password changes.
• If we have on-premises two-factor authentication we can most likely integrate it with ADFS but not if we have only password hash sync
• Other security policies, like time of the day restrictions and so on.
• Some licensing stuff requires federation

So to sum it up, please use federation

Initial Office configuration setup

Secondly, using the Office suite from Office365 uses something called Click-to-run, which is kinda an app-v wrapped Office package from Microsoft, which allows for easy updates from Microsoft directly instead of dabbling with the MSI installer.

In order to customize this installer we need to use the Office deployment toolkit which basically allows us to customize the deployment using an XML file.

The deployment tool has three switches that we can use.

setup.exe /download configuration.xml

setup.exe /configure configuration.xml

setup.exe /packager configuration.xml

NOTE: Using the /packager creates an App-V package of Office365 Click-To-run and requires a clean VM like we do when doing sequencing on App-V, which can then be distributed using existing App-V infrastructure or using other tools. But remember to enable scripting on the App-V client and do not alter the package using sequencing tool it is not supported.

The download part downloads Office based upon the configuration file here we can specify bit editions, versions number, office applications to be included and update path and so on. The Configuration XML file looks like this.

<Configuration>

<Add OfficeClientEdition=»64″ Branch=»Current»>

<Product ID=»O365ProPlusRetail»>

<Language ID=»en-us»/>

</Product>

</Add>

<Updates Enabled=»TRUE» Branch=»Business» UpdatePath=»\\server1\office365″ TargetVersion=»16.0.6366.2036″/>

<Display Level=»None» AcceptEULA=»TRUE»/>

</Configuration>

Now if you are like me and don’t remember all the different XML parameters you can use this site to customize your own XML file –> http://officedev.github.io/Office-IT-Pro-Deployment-Scripts/XmlEditor.html

When you are done configuring the XML file you can choose the export button to have the XML file downloaded.

If we have specified a specific Office version as part of the configuration.xml it will be downloaded to a seperate folder and storaged locally when we run the command setup.exe /download configuration.xml

NOTE: The different build numbers are available here –> http://support2.microsoft.com/gp/office-2013-365-update?

When we are done with the download of the click-to-run installer. We can change the configuration file to reflect the path of the office download

<Configuration> <Add SourcePath=»\\share\office» OfficeClientEdition=»32″ Branch=»Business»>

When we do the setup.exe /configure configuration.xml path

Deployment of Office

The main deployment is done using the setup.exe /configure configuration.xml file on the RSDH host. After the installation is complete

Shared Computer Support

<Display Level="None" AcceptEULA="True" /> 
<Property Name="SharedComputerLicensing" Value="1" />

In the configuration file we need to remember to enable SharedComputerSupport licensing or else we get this error message.

If you forgot you can also enable is using this registry key (just store it as an .reg file)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration]
«InstallationPath»=»C:\\Program Files\\Microsoft Office 15»
«SharedComputerLicensing»=»1

Now we are actually done with the golden image setup, don’t start the application yet if you want to use it for an image. Also make sure that there are no licenses installed on the host, which can be done using this tool.

cd ‘C:\Program Files (x86)\Microsoft Office\Office15’
cscript.exe .\OSPP.VBS /dstatus

This should be blank!

Another issue with this is that when a user starts an office app for the first time he/she needs to authenticate once, then a token will be stored locally on the %localappdata%\Microsoft\Office\15.0\Licensing folder, and will expire within a couple of days if the user is not active on the terminalserver. Think about it, if we have a large farm with many servers that might be the case and if a user is redirected to another server he/she will need to authenticate again. If the user is going against one server, the token will automatically refresh.
NOTE: This requires Internet access to work.

And important to remember that the Shared Computer support token is bound to the machine, so we cannot roam that token around computers or using any profile management tool.

But a nice thing is that if we have ADFS setup, we can setup Office365 to automatically activate against Office365, this is enabled by default. So no pesky logon screens.

Just need to add the ADFS domain site to trusted sites on Internet Explorer and define this settings as well

Automatic logon only in Intranet Zone

Which allows us to basically resolve the token issue with Shared Computer Support

Optimizing Skype for Buisness

So in regards to Skype for Buisness what options do we have in order to deliver a good user experience for it ? We have four options that I want to explore upon.

• VDI plugin
• Native RDP with UDP
• Natnix PCoIP
• Native ICA (w or without audio over UDP)
• Local app access
• HDX Optimization Pack 2.0

Now the issue with the first one (which is a Microsoft plugin is that it does not support Office365, it requires on-premises Lync/Skype) another issue that you cannot use VDI plugin and optimization pack at the same time, so if users are using VDI plugin and you want to switch to optimization pack you need to remove the VDI plugin

ICA uses TCP protcol works with most endpoints, since its basically running everyone directly on the server/vdi so the issue here is that we get no server offloading. So if we have 100 users running a video conference we might have a issue If the two other options are not available try to setup HDX realtime using audio over UDP for better audio performance. Both RDP and PCoIP use UDP for Audio/Video and therefore do not require any other specific customization.

But the problems with all these are that they make a tromboning effect and consumes more bandwidth and eats up the resources on the session host

Local App from Citrix access might be a viable option, which in essence means that a local application will be dragged into the receiver session, but this requires that the enduser has Lync/Skype installed. This also requires platinum licenses so not everyone has that + at it only supports Windows endpoints…

The last and most important piece is the HDX optimization pack which allows the use of server offloading using HDX media engine on the end user device

And the optimization pack supports Office365 with federated user and cloud only users. It also supports the latest clients (Skype for buisness) and can work in conjunction with Netscaler Gateway and Lync edge server for on-premises deployments. So means that we can get Mac/Linux/Windows users using server offloading, and with the latest release it also supports Office click-to-run and works with the native Skype UI

So using this feature we can offload the RSDH/VDI instances from CPU/Memory and eventually GPU directly back to the client. And Audio/video traffic is going to the endpoint directly and not to the remote session

Here is a simple test showing the difference between running Skype for buisness on a terminal server with and without HDX Optimization Pack 2.0

Here is a complete blogpost on setting up HDX Optimization Pack 2.0 https://msandbu.wordpress.com/2016/01/02/citrix-hdx-optimization-pack-2-0/

Now for more of the this part, we also have Outlook. Which for many is quite the headache…. and that is most because of the OST files that is dropped in the %localappdata% folder for each user. Office ProPlus has a setting called fast access which means that Outlook will in most cases try to contact Office365 directly, but if the latency is becoming to high, the connection will drop and it will go and search trough the OST files.

Optimizing Outlook

Now this is the big elefant in the room and causes the most headaches. Since Outlook against Office365 can be setup in two modes either using Cached mode and the other using Online mode. Online modes uses direct access to Office365 but users loose features like instant search and such. In order to deliver a good user experience we need to compromise, the general guideline here is to configure cached mode with 3 months, and define to store the OST file (Which contains the emails, calender, etc) and is typically 60-80% than the email folder) on a network share. Since these OST files are by default created in the local appdata profile and using streaming profile management solutions aren’t typically a good fit for the OST file.

. Important to note that Microsoft supports having OST files on a network share, IF! there is adequate bandwidth and low latency… and only if there is one OST file and the users have Outlook 2010 SP1

NOTE: We can use other alternatives such as FSLogix, Unidesk to fix the Profile management in a better way.

Ill come back to the configuration part later in the Policy bits. And important to remember is to use Office Outlook over 2013 SP1 which gives MAPI over HTTP, instead of RCP over HTTP which does not consume that much bandwidth.

OneDrive

In regards to OneDrive try to exclude that from RSDH/VDI instances since the sync engine basically doesnt work very well and now that each user has 1 TB of storagee space, it will flood the storage quicker then anything else, if users are allowed to use it. Also there is no central management capabilities and network shares are not supported.

There are some changes in the upcoming unified client, in terms of deployment and management but still not a good solution.

You can remove it from the Office365 deployment by adding  this in the configuration file.

<ExcludeApp ID=»Groove» />

Optimization and group policy tuning

Now something that should be noted is that before installing Office365 click-to-run you should optimize the RSDH sessions hosts or the VDI instance. A blogpost which was published by Citrix noted a 20% in performance after some simple RSDH optimization was done.

Both Vmware and Citrix have free tools which allow to do RSDH/VDI Optimization which should be looked at before doing anything else.

Now the rest is mostly doing Group Policy tuning. Firstly we need to download the ADMX templates from Microsoft (either 2013 or 2016) then we need to add them to the central store.

We can then use Group Policy to manage the specific applications and how they behave. Another thing to think about is using Target Version group policy to manage which specific build we want to be on so we don’t have a new build each time Microsoft rolls-out a new version, because from experience I can tell that some new builds include new bugs –> https://msandbu.wordpress.com/2015/03/09/trouble-with-office365-shared-computer-support-on-february-and-december-builds/

Now the most important policies are stored in the computer configuration.

Computer Configuration –> Policies –> Administrative Templates –> Microsoft Office 2013 –> Updates

Here there are a few settings we should change to manage updates.

• Enable Automatic Updates
• Enable Automatic Upgrades
• Hide Option to enable or disable updates
• Update Path
• Update Deadline
• Target Version

These control how we do updates, we can specify enable automatic updates, without a update path and a target version, which will essentually make Office auto update to the latest version from Microsoft office. Or we can specify an update path (to a network share were we have downloaded a specific version) specify a target version) and do enable automatic updates and define a baseline) for a a specific OU for instance, this will trigger an update using a built-in task schedulerer which is added with Office, when the deadline is approaching Office has built in triggers to notify end users of the deployment. So using these policies we can have multiple deployment to specific users/computers. Some with the latest version and some using a specific version.

Next thing is for Remote Desktop Services only, if we are using pure RDS to make sure that we have an optimized setup.  NOTE: Do not touch if everything is working as intended.

Computer Policies –> Administrative Templates –> Windows Components –> Remote Desktop Services –> Remote Desktop Session Host –> Remote Session Enviroment

• Limit maximum color depth (Set to16-bits) less data across the wire)
• Configure compression for RemoteFX data (set to bandwidth optimized)
• Configure RemoteFX Adaptive Graphics ( set to bandwidth optimized)

Next there are more Office specific policies to make sure that we disable all the stuff we don’t need.

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> Miscellaneous

• Do not use hardware graphics acceleration
• Disable Office animations
• Disable Office backgrounds
• Disable the Office start screen
• Supress the recommended settings dialog

User Configuration –> Administrative Templates  –>Microsoft Office 2013 –> Global Options –> Customizehide

• Menu animations (disabled!)

Next is under

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> First Run

• Disable First Run Movie
• Disable Office First Run Movie on application boot

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> Subscription Activation

• Automatically activate Office with federated organization credentials

Last but not least, define Cached mode for Outlook

User Configuration –> Administrative Templates –> Microsoft Outlook 2013 –> Account Settings –> Exchange –> Cached Exchange Modes

• Cached Exchange Mode (File | Cached Exchange Mode)
• Cached Exchange Mode Sync Settings (3 months)

Then specify the location of the OST files, which of course is somewhere else

User Configuration –> Administrative Templates –> Microsoft Outlook 2013 –> Miscellanous –> PST Settings

• Default Location for OST files (Change this to a network share

Network and bandwidth tips

Something that you need to be aware of this the bandwidth usage of Office in a terminal server enviroment.

Average latency to Office is 50 – 70 MS

• 2000 «Heavy» users using Online mode in Outlook
About 20 mbps at peak

• 2000 «Heavy» users using Cached mode in Outlook
About 10 mbps at peak

• 2000 «Heavy» users using audio calls in Lync About 110 mbps at peak

• 2000 «Heavy» users working Office using RDP About 180 mbps at peak

Which means using for instance HDX optimization pack for 2000 users might “remove” 110 mbps of bandwidth usage.

Microsoft also has an application called Office365 client analyzer, which can give us a baseline to see how our network is against Office365, such as DNS, Latency to Office365 and such. And DNS is quite important in Office365 because Microsoft uses proximity based load balancing and if your DNS server is located elsewhere then your clients you might be sent in the wrong direction. The client analyzer can give you that information.

(We could however buy ExpressRoute from Microsoft which would give us low-latency connections directly to their datacenters, but this is only suiteable for LARGER enterprises, since it costs HIGH amounts of $$)

But this is for the larger enterprises which allows them to overcome the basic limitations of TCP stack which allow for limited amount of external connection to about 4000 connections at the same time. (One external NAT can support about 4,000 connections, given that Outlook consumes about 4 concurrent connections and Lync some as well)

Because Microsoft recommands that in a online scenario that the clients does not have more then 110 MS latency to Office365, and in my case I have about 60 – 70 MS latency. If we combine that with some packet loss or adjusted MTU well you get the picture  

Using Outlook Online mode, we should have a MAX latency of 110 MS above that will decline the user experience. Another thing is that using online mode disables instant search. We can use the exchange traffic excel calculator from Microsoft to calculate the amount of bandwidth requirements.

Some rule of thumbs, do some calculations! Use the bandwidth calculators for Lync/Exchange which might point you in the right direction. We can also use WAN accelerators (w/caching) for instance which might also lighten the burden on the bandwidth usage. You also need to think about the bandwidth usage if you are allow automatic updates enabled in your enviroment.

Troubleshooting tips

As the last part of this LOOONG post I have some general tips on using Office in a virtual enviroment. This is just gonna be a long list of different tips

• For Hyper-V deployments, check VMQ and latest NIC drivers
• 32-bits Office C2R typically works better then 64-bits
• Antivirus ? Make Exceptions!
• Remove Office products that you don’t need from the configuration, since this add extra traffic when doing downloads and more stuff added to the virtual machines
• If you don’t use lync and audio service (disable the audio service! )
• If using RDSH (Check the Group policy settings I recommended above)
• If using Citrix or VMware (Make sure to tune the polices for an optimal experience, and using the RSDH/VDI optimization tools from the different vendors)
• If Outlook is sluggish, check that you have adequate storage I/O to the network share (NO HIGH BANDWIDTH IS NOT ENOUGH IF STORED ON A SIMPLE RAID WITH 10k disks)
• If all else failes on Outlook (Disable MAPI over HTTP) In some cases when getting new mail takes a long time try to disable this, used to be a known error)

Remote display protocols

Last but not least I want to mention this briefly, if you are setting up a new solution and thinking about choosing one vendor over the other. The first of is

• Endpoint requirements (Thin clients, Windows, Mac, Linux)
• Requirements in terms of GPU, Mobile workers etc)

Now we have done some tests, which shown the Citrix has the best feature across the different sub protocols

• ThinWire (Best across high latency lines, using TCP works over 1800 MS Latency)
• Framehawk (Work good at 20% packet loss lines)

While PcoIP performs a bit better then RDP, I have another blogpost on the subject here –> https://msandbu.wordpress.com/2015/11/06/putting-thinwire-and-framehawk-to-the-test/

#chelsea, #citrix, #hdx, #ica, #office365, #pcoip, #punchflix, #rds, #vmware

Citrix HDX Optimization pack 2.0

With the late release of XenDesktop 7.7, Citrix also released a new version of the HDX optmization pack for Skype/Lync. The earlier release 1.8 had some limitations which the 2.0 release managed to fix. This is the list of improvements.

• Native Skype for Business 2015 UI – Provides the full Skype for Business UI experience and eliminates the limitations of a hybrid UI. Examples of features that were not supported in HDX RealTime Optimization Pack 1.8 but are now available through the native Skype for Business UI include:
  • Call Delegation – Enables setting up a Skype for Business meeting on behalf of someone else. For example, an administrative assistant setting up meetings for a manager.
  • Voicemail access, playback, and delete – Ability to access your voicemail, play it, and delete from Skype for Business.
  • Response groups – Enables the response group feature, which routes incoming calls to groups of people called response group agents. 
  • Team call groups – Set up a team of people who can answer your calls. You add and remove members and specify when they can answer calls for you. Members phones ring and once someone answers the call, the other phones stop ringing.
• Authentication and SIP signaling  handled exclusively by the Skype for Business client – This release introduces architectural simplifications that improve robustness and user experience (for example, initialization time).
• Web proxy support – Enables external access using a web proxy with limitations. For more information, see Limitations in 2.0.
• Click-to-Run – Devices where Microsoft Office applications have been installed using Click-to-Run support HDX RealTime Optimization Pack. 
• Pairing Status Indicator – Icon that displays these status states:
  • Connecting – MediaEngine.Net is trying to establish a RealTime Connector connection.
  • Connected – There is a RealTime Connector connection over a virtual channel and the version of remote RealTime Media Engine matches the version of mediaEngine.Net exactly.
  • Fallback – There is a RealTime Connector connection to a local RealTime Media Engine process.
  • Disconnected – A registry setting (policy) prevented MediaEngine.Net from running RealTime Media Engine locally.
  • Version mismatch – Same as Connected but the version match is not exact (different patch or build numbers)
• Improved audio-video quality – Improvements to the RealTime Media Engine:
  • Improved resilience to packet loss 
  • improved echo cancelation
• Skype server settings – HDX RealTime Optimization Pack obeys the Skype for Business Server settings that control whether or not the endpoint can do audio and/or video calling.
• Active speaker identification – Displays a photo of the current speaker.
• Call and video call buttons added to the contact card – Enables calls and video calls to be started with a click of a button in the contact card.
• Automatically join meeting audio controls – You can use Settings to specify how you want to join a meeting:
  • Use Skype for Business (full audio and video experience)
  • Use a phone number
  • Don’t join audio

Now the biggest improvements are, click-to-run support which allows full integration with Office365 software. Remember that if using Office365 on an RDS enviroment you need shared computer support enabled. Another big thing is full Skype for Buisness UI support, in 1.8 you needed to convert the Lync UI.

Like before we need to install the Citrix Media Engine on the supported clients and the Realtime connector on the VDA which has Skype installed.

Now unlike previous versions, there is no longer any help icon within the Skype UI, this is now moved to the taskbar to its own config

 

Connected to a Citrix XenDesktop 7.7 behind a Netscaler Gateway against Office365

Now if you for instance have some issues with the connector, there are some quick things to think about.

• Save version of Realtime Connector?

• Failback policy enabled? (NOTE: Using fallback means that it goes back to regular HDX Realtime processing, which does not give the same benefits and all processing is happening on the VDA agent. This can be disabled by registry on the VDA agent by using adding the following

Key: HKLM\Software\Citrix\HDXRTConnector or HKCU\Software\Citrix\HDXRTConnector

Value: DWORD DisableFallback

• Exception in the Firewall made?

Anyhow, with this release we can now support almost any client with full support against skype for buisness on-premises and in Office365

As we can see from a Skype Call, the mediaengine service acts like a Skype client and has a real-time connection to the “edge” server in this case its the Office365 edge server

Also noticed that there is now no longer need for ADFS since it automatically authenticated using the Skype for Buisness credentials, awesome!

#citrix-hdx-optimization-pack, #office365, #skype-for-buisness

Office365 on Terminal Servers done right

So this is a blogpost based upon a session I had at NIC conference, where I spoke about how to optimize the delivery of Office365 in a VDI/RSDH enviroment.

There are multiple stuff we need to think / worry about. Might seem a bit negative, but that is not the idea just being realistic

So this blogpost will cover the following subjects

• Federation and sync
• Installing and managing updates
• Optimizing Office ProPlus for VDI/RDS
• Office ProPlus optimal delivery
• Shared Computer Support
• Skype for Buisness
• Outlook
• OneDrive
• Troubleshooting and general tips for tuning
• Remote display protocols and when to use when.

So what is the main issue with using Terminal Servers and Office365? The Distance….

This is the headline for a blogpost on Citrix blogs about XenApp best pratices

So how to fix this when we have our clients on one side, the infrastructure in another and the Office365 in a different region ? Seperated with long miles and still try to deliver the best experience for the end-user, so In some case we need to compromise to be able to deliver the best user experience. Because that should be our end goal Deliver the best user experience

User Access

First of is, do we need to have federation or just plain password sync in place? Using password sync is easy and simple to setup and does not require any extra infrastructure. We can also configure it to use Password hash sync which will allow Azure AD to do the authentication process. Problem with doing this is that we lose a lot of stuff which we might use on an on-premises solution

• Audit policies
• Existing MFA (If we use Azure AD as authentication point we need to use Azure MFA)
• Delegated Access via Intune
• Lockdown and password changes (Since we need change to be synced to Azure AD before the user changes will be taken into effect)

NOTE: Now since I am above average interested in Netscaler I wanted to include another sentence here, for those that don’t know is that Netscaler with AAA can in essence replace ADFS since Netscaler now supports SAML iDP. Some important issues to note is that Netscaler does not support • Single Logout profile; • Identity Provider Discovery profile from the SAML profiles. We can also use Netscaler Unified Gateway with SSO to Office365 with SAML. The setup guide can be found here

https://msandbu.wordpress.com/2015/04/01/netscaler-and-office365-saml-idp-setup/

NOTE: We can also use Vmware Identity manager as an replacement to deliver SSO.

Using ADFS gives alot of advantages that password hash does not.

• True SSO (While password hash gives Same Sign-on)
• If we have Audit policies in place
• Disabled users get locked out immidietly instead of 3 hours wait time until the Azure AD connect syng engine starts replicating, and 5 minutes for password changes.
• If we have on-premises two-factor authentication we can most likely integrate it with ADFS but not if we have only password hash sync
• Other security policies, like time of the day restrictions and so on.
• Some licensing stuff requires federation

So to sum it up, please use federation

Initial Office configuration setup

Secondly, using the Office suite from Office365 uses something called Click-to-run, which is kinda an app-v wrapped Office package from Microsoft, which allows for easy updates from Microsoft directly instead of dabbling with the MSI installer.

In order to customize this installer we need to use the Office deployment toolkit which basically allows us to customize the deployment using an XML file.

The deployment tool has three switches that we can use.

setup.exe /download configuration.xml

setup.exe /configure configuration.xml

setup.exe /packager configuration.xml

NOTE: Using the /packager creates an App-V package of Office365 Click-To-run and requires a clean VM like we do when doing sequencing on App-V, which can then be distributed using existing App-V infrastructure or using other tools. But remember to enable scripting on the App-V client and do not alter the package using sequencing tool it is not supported.

The download part downloads Office based upon the configuration file here we can specify bit editions, versions number, office applications to be included and update path and so on. The Configuration XML file looks like this.

<Configuration>

<Add OfficeClientEdition=»64″ Branch=»Current»>

<Product ID=»O365ProPlusRetail»>

<Language ID=»en-us»/>

</Product>

</Add>

<Updates Enabled=»TRUE» Branch=»Business» UpdatePath=»\\server1\office365″ TargetVersion=»16.0.6366.2036″/>

<Display Level=»None» AcceptEULA=»TRUE»/>

</Configuration>

Now if you are like me and don’t remember all the different XML parameters you can use this site to customize your own XML file –> http://officedev.github.io/Office-IT-Pro-Deployment-Scripts/XmlEditor.html

When you are done configuring the XML file you can choose the export button to have the XML file downloaded.

If we have specified a specific Office version as part of the configuration.xml it will be downloaded to a seperate folder and storaged locally when we run the command setup.exe /download configuration.xml

NOTE: The different build numbers are available here –> http://support2.microsoft.com/gp/office-2013-365-update?

When we are done with the download of the click-to-run installer. We can change the configuration file to reflect the path of the office download

<Configuration> <Add SourcePath=»\\share\office» OfficeClientEdition=»32″ Branch=»Business»>

When we do the setup.exe /configure configuration.xml path

Deployment of Office

The main deployment is done using the setup.exe /configure configuration.xml file on the RSDH host. After the installation is complete

Shared Computer Support

<Display Level="None" AcceptEULA="True" /> 
<Property Name="SharedComputerLicensing" Value="1" />

In the configuration file we need to remember to enable SharedComputerSupport licensing or else we get this error message.

If you forgot you can also enable is using this registry key (just store it as an .reg file)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration]
«InstallationPath»=»C:\\Program Files\\Microsoft Office 15»
«SharedComputerLicensing»=»1

Now we are actually done with the golden image setup, don’t start the application yet if you want to use it for an image. Also make sure that there are no licenses installed on the host, which can be done using this tool.

cd ‘C:\Program Files (x86)\Microsoft Office\Office15’
cscript.exe .\OSPP.VBS /dstatus

This should be blank!

Another issue with this is that when a user starts an office app for the first time he/she needs to authenticate once, then a token will be stored locally on the %localappdata%\Microsoft\Office\15.0\Licensing folder, and will expire within a couple of days if the user is not active on the terminalserver. Think about it, if we have a large farm with many servers that might be the case and if a user is redirected to another server he/she will need to authenticate again. If the user is going against one server, the token will automatically refresh.
NOTE: This requires Internet access to work.

And important to remember that the Shared Computer support token is bound to the machine, so we cannot roam that token around computers or using any profile management tool.

But a nice thing is that if we have ADFS setup, we can setup Office365 to automatically activate against Office365, this is enabled by default. So no pesky logon screens.

Just need to add the ADFS domain site to trusted sites on Internet Explorer and define this settings as well

Automatic logon only in Intranet Zone

Which allows us to basically resolve the token issue with Shared Computer Support

Optimizing Skype for Buisness

So in regards to Skype for Buisness what options do we have in order to deliver a good user experience for it ? We have four options that I want to explore upon.

• VDI plugin
• Native RDP with UDP
• Natnix PCoIP
• Native ICA (w or without audio over UDP)
• Local app access
• HDX Optimization Pack 2.0

Now the issue with the first one (which is a Microsoft plugin is that it does not support Office365, it requires on-premises Lync/Skype) another issue that you cannot use VDI plugin and optimization pack at the same time, so if users are using VDI plugin and you want to switch to optimization pack you need to remove the VDI plugin

ICA uses TCP protcol works with most endpoints, since its basically running everyone directly on the server/vdi so the issue here is that we get no server offloading. So if we have 100 users running a video conference we might have a issue If the two other options are not available try to setup HDX realtime using audio over UDP for better audio performance. Both RDP and PCoIP use UDP for Audio/Video and therefore do not require any other specific customization.

But the problems with all these are that they make a tromboning effect and consumes more bandwidth and eats up the resources on the session host

Local App from Citrix access might be a viable option, which in essence means that a local application will be dragged into the receiver session, but this requires that the enduser has Lync/Skype installed. This also requires platinum licenses so not everyone has that + at it only supports Windows endpoints…

The last and most important piece is the HDX optimization pack which allows the use of server offloading using HDX media engine on the end user device

And the optimization pack supports Office365 with federated user and cloud only users. It also supports the latest clients (Skype for buisness) and can work in conjunction with Netscaler Gateway and Lync edge server for on-premises deployments. So means that we can get Mac/Linux/Windows users using server offloading, and with the latest release it also supports Office click-to-run and works with the native Skype UI

So using this feature we can offload the RSDH/VDI instances from CPU/Memory and eventually GPU directly back to the client. And Audio/video traffic is going to the endpoint directly and not to the remote session

Here is a simple test showing the difference between running Skype for buisness on a terminal server with and without HDX Optimization Pack 2.0

Here is a complete blogpost on setting up HDX Optimization Pack 2.0 https://msandbu.wordpress.com/2016/01/02/citrix-hdx-optimization-pack-2-0/

Now for more of the this part, we also have Outlook. Which for many is quite the headache…. and that is most because of the OST files that is dropped in the %localappdata% folder for each user. Office ProPlus has a setting called fast access which means that Outlook will in most cases try to contact Office365 directly, but if the latency is becoming to high, the connection will drop and it will go and search trough the OST files.

Optimizing Outlook

Now this is the big elefant in the room and causes the most headaches. Since Outlook against Office365 can be setup in two modes either using Cached mode and the other using Online mode. Online modes uses direct access to Office365 but users loose features like instant search and such. In order to deliver a good user experience we need to compromise, the general guideline here is to configure cached mode with 3 months, and define to store the OST file (Which contains the emails, calender, etc) and is typically 60-80% than the email folder) on a network share. Since these OST files are by default created in the local appdata profile and using streaming profile management solutions aren’t typically a good fit for the OST file.

. Important to note that Microsoft supports having OST files on a network share, IF! there is adequate bandwidth and low latency… and only if there is one OST file and the users have Outlook 2010 SP1

NOTE: We can use other alternatives such as FSLogix, Unidesk to fix the Profile management in a better way.

Ill come back to the configuration part later in the Policy bits. And important to remember is to use Office Outlook over 2013 SP1 which gives MAPI over HTTP, instead of RCP over HTTP which does not consume that much bandwidth.

OneDrive

In regards to OneDrive try to exclude that from RSDH/VDI instances since the sync engine basically doesnt work very well and now that each user has 1 TB of storagee space, it will flood the storage quicker then anything else, if users are allowed to use it. Also there is no central management capabilities and network shares are not supported.

There are some changes in the upcoming unified client, in terms of deployment and management but still not a good solution.

You can remove it from the Office365 deployment by adding  this in the configuration file.

<ExcludeApp ID=»Groove» />

Optimization and group policy tuning

Now something that should be noted is that before installing Office365 click-to-run you should optimize the RSDH sessions hosts or the VDI instance. A blogpost which was published by Citrix noted a 20% in performance after some simple RSDH optimization was done.

Both Vmware and Citrix have free tools which allow to do RSDH/VDI Optimization which should be looked at before doing anything else.

Now the rest is mostly doing Group Policy tuning. Firstly we need to download the ADMX templates from Microsoft (either 2013 or 2016) then we need to add them to the central store.

We can then use Group Policy to manage the specific applications and how they behave. Another thing to think about is using Target Version group policy to manage which specific build we want to be on so we don’t have a new build each time Microsoft rolls-out a new version, because from experience I can tell that some new builds include new bugs –> https://msandbu.wordpress.com/2015/03/09/trouble-with-office365-shared-computer-support-on-february-and-december-builds/

Now the most important policies are stored in the computer configuration.

Computer Configuration –> Policies –> Administrative Templates –> Microsoft Office 2013 –> Updates

Here there are a few settings we should change to manage updates.

• Enable Automatic Updates
• Enable Automatic Upgrades
• Hide Option to enable or disable updates
• Update Path
• Update Deadline
• Target Version

These control how we do updates, we can specify enable automatic updates, without a update path and a target version, which will essentually make Office auto update to the latest version from Microsoft office. Or we can specify an update path (to a network share were we have downloaded a specific version) specify a target version) and do enable automatic updates and define a baseline) for a a specific OU for instance, this will trigger an update using a built-in task schedulerer which is added with Office, when the deadline is approaching Office has built in triggers to notify end users of the deployment. So using these policies we can have multiple deployment to specific users/computers. Some with the latest version and some using a specific version.

Next thing is for Remote Desktop Services only, if we are using pure RDS to make sure that we have an optimized setup.  NOTE: Do not touch if everything is working as intended.

Computer Policies –> Administrative Templates –> Windows Components –> Remote Desktop Services –> Remote Desktop Session Host –> Remote Session Enviroment

• Limit maximum color depth (Set to16-bits) less data across the wire)
• Configure compression for RemoteFX data (set to bandwidth optimized)
• Configure RemoteFX Adaptive Graphics ( set to bandwidth optimized)

Next there are more Office specific policies to make sure that we disable all the stuff we don’t need.

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> Miscellaneous

• Do not use hardware graphics acceleration
• Disable Office animations
• Disable Office backgrounds
• Disable the Office start screen
• Supress the recommended settings dialog

User Configuration –> Administrative Templates  –>Microsoft Office 2013 –> Global Options –> Customizehide

• Menu animations (disabled!)

Next is under

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> First Run

• Disable First Run Movie
• Disable Office First Run Movie on application boot

User Configuration –> Administrative Templates –> Microsoft Office 2013 –> Subscription Activation

• Automatically activate Office with federated organization credentials

Last but not least, define Cached mode for Outlook

User Configuration –> Administrative Templates –> Microsoft Outlook 2013 –> Account Settings –> Exchange –> Cached Exchange Modes

• Cached Exchange Mode (File | Cached Exchange Mode)
• Cached Exchange Mode Sync Settings (3 months)

Then specify the location of the OST files, which of course is somewhere else

User Configuration –> Administrative Templates –> Microsoft Outlook 2013 –> Miscellanous –> PST Settings

• Default Location for OST files (Change this to a network share

Network and bandwidth tips

Something that you need to be aware of this the bandwidth usage of Office in a terminal server enviroment.

Average latency to Office is 50 – 70 MS

• 2000 «Heavy» users using Online mode in Outlook
About 20 mbps at peak

• 2000 «Heavy» users using Cached mode in Outlook
About 10 mbps at peak

• 2000 «Heavy» users using audio calls in Lync About 110 mbps at peak

• 2000 «Heavy» users working Office using RDP About 180 mbps at peak

Which means using for instance HDX optimization pack for 2000 users might “remove” 110 mbps of bandwidth usage.

Microsoft also has an application called Office365 client analyzer, which can give us a baseline to see how our network is against Office365, such as DNS, Latency to Office365 and such. And DNS is quite important in Office365 because Microsoft uses proximity based load balancing and if your DNS server is located elsewhere then your clients you might be sent in the wrong direction. The client analyzer can give you that information.

(We could however buy ExpressRoute from Microsoft which would give us low-latency connections directly to their datacenters, but this is only suiteable for LARGER enterprises, since it costs HIGH amounts of $$)

But this is for the larger enterprises which allows them to overcome the basic limitations of TCP stack which allow for limited amount of external connection to about 4000 connections at the same time. (One external NAT can support about 4,000 connections, given that Outlook consumes about 4 concurrent connections and Lync some as well)

Because Microsoft recommands that in a online scenario that the clients does not have more then 110 MS latency to Office365, and in my case I have about 60 – 70 MS latency. If we combine that with some packet loss or adjusted MTU well you get the picture  

Using Outlook Online mode, we should have a MAX latency of 110 MS above that will decline the user experience. Another thing is that using online mode disables instant search. We can use the exchange traffic excel calculator from Microsoft to calculate the amount of bandwidth requirements.

Some rule of thumbs, do some calculations! Use the bandwidth calculators for Lync/Exchange which might point you in the right direction. We can also use WAN accelerators (w/caching) for instance which might also lighten the burden on the bandwidth usage. You also need to think about the bandwidth usage if you are allow automatic updates enabled in your enviroment.

Troubleshooting tips

As the last part of this LOOONG post I have some general tips on using Office in a virtual enviroment. This is just gonna be a long list of different tips

• For Hyper-V deployments, check VMQ and latest NIC drivers
• 32-bits Office C2R typically works better then 64-bits
• Antivirus ? Make Exceptions!
• Remove Office products that you don’t need from the configuration, since this add extra traffic when doing downloads and more stuff added to the virtual machines
• If you don’t use lync and audio service (disable the audio service! )
• If using RDSH (Check the Group policy settings I recommended above)
• If using Citrix or VMware (Make sure to tune the polices for an optimal experience, and using the RSDH/VDI optimization tools from the different vendors)
• If Outlook is sluggish, check that you have adequate storage I/O to the network share (NO HIGH BANDWIDTH IS NOT ENOUGH IF STORED ON A SIMPLE RAID WITH 10k disks)
• If all else failes on Outlook (Disable MAPI over HTTP) In some cases when getting new mail takes a long time try to disable this, used to be a known error)

Remote display protocols

Last but not least I want to mention this briefly, if you are setting up a new solution and thinking about choosing one vendor over the other. The first of is

• Endpoint requirements (Thin clients, Windows, Mac, Linux)
• Requirements in terms of GPU, Mobile workers etc)

Now we have done some tests, which shown the Citrix has the best feature across the different sub protocols

• ThinWire (Best across high latency lines, using TCP works over 1800 MS Latency)
• Framehawk (Work good at 20% packet loss lines)

While PcoIP performs a bit better then RDP, I have another blogpost on the subject here –> https://msandbu.wordpress.com/2015/11/06/putting-thinwire-and-framehawk-to-the-test/

#citrix, #fcbars, #garyspants, #lcfc, #netscaler, #office365, #punchflix, #slbbvb, #xendesktop

Netscaler and Office365 SAML iDP setup

With Netscaler 10.5, Citrix announced the support for SAML Identity Provider on the Netscaler feature. That basically meant that we could in theory use the Netscaler as an identity provider for Office365 / Azure AD. Now I have been trying to reverse engineering the setup since Citrix hasen’t created any documentation regarding the setup.

But now! Citrix recently announced the setup of Netscaler iDP setup for Office365 setup http://support.citrix.com/article/CTX200818

Yay!

on another part Citrix also released a new build of Netscaler VPX (build 56.12) which fixes the CPU utilization bug on Vmware you can see more about the release note here –> http://support.citrix.com/article/CTX200818

And there is also a new PCI DSS report which shows compliance for version 3.

#azure-ad, #netscaler, #office365, #saml-idp

How to setup Azure Active Directory applications and Office365 dashboard

So this is something I’ve just recently gotten aware of. (Just comes to show that so much news is coming to EMS pack. But this feature is really usefull for customers which has Office365 and Azure Active Directory.

Now if you are familiar with the Azure AD application portal you know that here users can access their applications which we have defined for them.

Which might be SaaS applications, other Microsoft Azure AD based applications or on-prem apps using Application proxy. That great but the typical user might have Office365 as their start portal (start page) is there any way to show the apps there instead ? indeed!

So inside the application portal of Office365 you have a option here called myapps

If users click here they will get the apps available to them

And here I can choose to attach the application to the application portal for a user.

Great stuff! since this allows the user to have access to all their applications from within Office365.

#azure, #azure-active-directory, #office365

Trouble with Office365 Shared Computer Support on February and December builds

This is an issue I have seen a couple of times now, therefore I decided to write a blogpost about it. In january I got some issues with out test servers running Office365 and Shared Computer support that the credential tokens where not working and users needed to reauthenticate when opening another Office application.

Now I have also gotten a couple of questions on email and some on the Microsoft forum asking about the same.

Now I did a bit of troubleshooting and didn’t figure out what the issue was right away, but this feature had been working for quite some time therefore It must have been an update that was the issue and since Office365 is Click-to-run which is updated by Microsoft it must have been a new build that makes this happen.

Therefore I used the Group policy templates that comes with Office365 (Which can be downloaded here –> http://www.microsoft.com/en-us/download/details.aspx?id=35554)

(Here are the version builds) http://support2.microsoft.com/gp/office-2013-365-update

And specified which build to use, then I choose the November build and Shared computer support worked as intended again. Therefore it seems like there is an bug/issue on the December and february build.

#office2013, #office365, #rds

Citrix XenMobile and Microsoft Cloud happily ever after ?

There is no denying that Microsoft is moving more and more focus into their cloud offerings, even with solution such as Office365, EMS (Enterprise Mobility Suite) and of course their Azure platform.

EMS being the latest product bundle in the suite gives customers Intune, Azure Rights Management and Azure Active Directory Premium. So if a customer already has Office365 (their users are already placed with Azure AD and can then easily be attached to EMS for more features)

We are also seeing that Microsoft is adding more and more management capabilities against Office365 into their Intune suite (Which is one of the keypoints which no other vendors have yet) but is this type of management something we need ? or is it just to give it a “key” selling point?

Now Microsoft has added alot of MDM capabilities to Intune, but they are nowhere close to the competition yet. Of course they have other offerings in the EMS pack, like Azure Rights Management, which are quite unique on the way it functions and integrates with Azure AD and Office365. As of 2014 Microsoft isn’t even listed on the Gartner quadrant for EMM (which they stated would be the goal for 2015)

But it will be interesting to se if Microsoft’s strategy is to compete head-to-head on the other vendors or if they wish to give the basic features and dvelve more into the part of Azure AD and identity management across clouds and SaaS offerings.

Citrix on the other hand, have their XenMobile offering which is a more complete EMM product suite (MDM and MAM, Follow me data with Sharefile, and so on) Now Citrix has a lot of advantages for instance over using Sharefile against OneDrive.  Sharefile has encryption of data even thou it is locally and running on a sandboxed application( on a mobile device), while the only option that OneDrive has is using as a part of Rights Management Service (of course OneDrive has extensive data encryption in-transit and at rest https://technet.microsoft.com/en-us/library/dn905447.aspx

Citrix also has MicroVPN functionality and secure browser access running VPN access using Netscaler, while Microsoft also has a secure browser application which is much more limited to restricting which URLs to open and what content can be viewed from that browser.

So from a customer side you need to ask yourself.

• what kind of requirement does my buisness have?
• Do I use Office365 or a regualr on-premise setup?
• Do I need the advanced capabilities ?
• How are my users actually working ?

Is there a best of both worlds using both of these technologies ?

While yes!

Now of course there are some feature that overlaps using Offic365 and EMS + XenMobile, but there are also some features which are important to be aware of.

• Citrix has Sharefile storage controller templates in Azure (Meaning that if a customer has an IaaS in Azure, they can setup a Sharefile connector in Azure and use that to publish files and content without using OneDrive)

• Citrix has a Sharefile connector to Office365 (Which allows users to use Sharefile almost as a file aggregrator for communicating between Office365 and their regular fileservers) which allows for secure editing directly from ShareFile.

• Citrix XenMobile has alot better MDM features for Windows Phone that Intune has at the moment.

• Azure AAD has a lot of built-in SSO access to many of Citrix web based applications (Sharefile, GTM, GTA and so on) since users are already in Azure AD premium it can be used to grant access to the different applications using SSO)

• Netscaler and SAML iDP (If we have an on-premise enterprise solution we can use the Netscaler to operate as an SAML identity provider against Office365 which allows for replacement for ADFS which is required for full SSO of on-premise AD users to Office365

• Office365 ProPlus with Lync is supported on XenApp/XD with Lync optimization pack (Note that this is not part of XenMobile but of Workspace suite)

• Netscaler and Azure MFA (We can use Azure MFA against Netscaler to publish web based applications with traffic optimization)

• Netscaler will also soon be available in Azure which allows for setting up a full Citrix infrastructure in Azure

But in the future I would be guessing that Microsoft is moving forward with the user collaboration part, it is going to become the heart of identity management with Azure AD directory and rights management, while Citrix on the other hand will focus more and enabling mobility using solutions like EMM ( MAM ) and follow me data aggregator and secure file access and devices. Citrix will also play an important part in hybrid setup using Netscaler with Cloud bridge and as an identity provider on-premise

#citrix, #ems, #intune, #microsoft, #office365, #xenmobile

Think you manage to get all the news that has appeared from Microsoft the last month ? don’t think so

So there is alot happening at Microsoft these days. I’ve had trouble my self keeping track what has happend the last weeks or so. Therefore I decided to write this blog to just get an overview myself what’s happend.

Microsoft and Dell launch Cloud Platform Suite
http://www.microsoft.com/en-us/server-cloud/products/cloud-platform-system/

Azure: D-series virtual machine instances
https://weblogs.asp.net/scottgu/new-d-series-of-azure-vms-with-60-faster-cpus-more-memory-and-local-ssd-disks

Azure: Network security Groups, Multi NICs on virtual machines, Announcement of Azure Marketplace, New VPN gateway sizes, Force tunnelig, GA of Automation Services, preview of Batch Services, Antimalware of VMs in Azure
https://weblogs.asp.net/scottgu/azure-new-marketplace-network-improvements-new-batch-service-automation-service-more

Azure: Docker and Microsoft
https://weblogs.asp.net/scottgu/docker-and-microsoft-integrating-docker-with-windows-server-and-microsoft-azure

Azure: Traffic manager, nested profiles
http://azure.microsoft.com/blog/2014/10/29/new-azure-traffic-manager-nested-profiles/

Azure: Website migration tool
http://azure.microsoft.com/blog/2014/10/28/introducing-azure-websites-migration-assistant/

Azure: Operations Insight announced
http://azure.microsoft.com/blog/2014/10/28/exciting-updates-to-microsoft-azure-at-teched-europe-enabling-simplicity-scale-and-innovation/
https://preview.opinsights.azure.com/

Azure: G-sizes, Premium Storage
http://azure.microsoft.com/blog/2014/10/20/azures-getting-bigger-faster-and-more-open/

Azure: Netscaler and Azure
http://azure.microsoft.com/blog/2014/10/30/multiple-vm-nics-and-network-virtual-appliances-in-azure/

Azure: General availability for disaster recovery
http://blogs.technet.com/b/in_the_cloud/archive/2014/10/02/announcing-the-ga-of-disaster-recovery-to-azure-using-azure-site-recovery.aspx

Azure: PowerShell DSC extensions
http://blogs.msdn.com/b/powershell/archive/2014/10/28/manage-the-powershell-dsc-extension-in-the-azure-preview-portal.aspx

Office365: Outlook for Mac
http://blogs.office.com/2014/10/31/new-outlook-mac-available-office-365-customers/

Office365: Builtin MDM
http://blogs.office.com/2014/10/28/introducing-built-mobile-device-management-office-365/

Office365: DLP in Office365
http://blogs.office.com/2014/10/28/expanding-data-loss-prevention-dlp-sharepoint-online-onedrive-business-windows-file-share-office-clients/

Office365: new plans
http://blogs.office.com/2014/10/02/announcing-availability-new-office-365-plans-small-midsized-businesses/

Office365: Unlimited Storage
https://blog.onedrive.com/office-365-onedrive-unlimited-storage/

 

Intune: Secure browser
http://blogs.technet.com/b/in_the_cloud/archive/2014/11/03/success-with-enterprise-mobility-secure-browser.aspx

Intune: MAM features for Office
http://blogs.technet.com/b/in_the_cloud/archive/2014/10/28/emm-game-changing-announcement-1.aspx

Intune: Mobile data management
http://blogs.technet.com/b/in_the_cloud/archive/2014/10/31/success-with-enterprise-mobility-containing-corporate-data.aspx

System Center and Windows Server vNext announced
http://blogs.technet.com/b/server-cloud/archive/2014/10/01/announcing-availability-of-windows-server-technical-preview-and-system-center-technical-preview.aspx

#azure, #intune, #office365

Shared Computer Support for Office365

One of the problems with using OFfice365 licenses in RDS/Citrix enviroment was that you needed a volume licenses Office to use just ot install. But now! Microsoft announced something called Shared Computer support for Office365, which allows us to install Office365 on RDS/Citrix enviroments without the need to purchase a volume licenses Office.

Quote from the official Microsoft blog –> http://blogs.technet.com/b/uspartner_ts2team/archive/2014/09/03/office-365-shared-computer-activation.aspx

“

Well I’m pleased to announce that this support is now available as of September 1, 2014.  All SKUs containing Office 365 ProPlus, Project Pro for Office 365, or Visio Pro for Office 365 can be used by multiple users on a shared device or virtual machine.  This is referred to as shared computer activation.

Shared computer activation lets you to deploy Office 365 ProPlus to a computer in your organization that is accessed by multiple users. For example, several nurses at a hospital connect to the same remote server to use their applications, or a group of workers share a computer at a factory.

“

Now how do I setup this ?

You need to create a configuration.xml file that includes the following lines:

<Display Level=»None» AcceptEULA=»True» /> <Property Name=»SharedComputerLicensing» Value=»1″ />

The display level = none, makes it an silent install, and you also define the shared computer licensing value. Then you use the Office Deployment tool to deploy Office365 with Shared Computer support. Office deployment tool can be found here –> http://www.microsoft.com/en-us/download/details.aspx?id=36778

So how does it work ?

When a user logs on a RDS server he/her will get a dialog box first time they log on

Then they need to enter their associated Office365 user account, after that the application tries to verify against office online and a license token is stored in the user profile for that particular user.

You can verify that the shared computer support is activated by going into the   %localappdata%\Microsoft\Office\15.0\Licensing folder. (DO NOT ALTER THESE FILES)

There are a few gotchas here…

1: The license token expires after a couple of days, As the expiration date for the licensing token nears, Office 365 ProPlus automatically attempts to renew the licensing token when the user is logged on to the computer and using Office 365 ProPlus.If the user doesn’t log on to the shared computer for several days, the licensing token can expire. The next time that the user tries to use Office 365 ProPlus, Office 365 ProPlus contacts the Office Licensing Service on the Internet to get a new licensing token.

Activation limits   Normally, users can install and activate Office 365 ProPlus only on up to five computers. Using Office 365 ProPlus with shared computer activation enabled doesn’t count against the five computer limit.

Microsoft allows a single user to activate Office 365 ProPlus on a reasonable number of shared computers in a given time period. The user gets an error message in the unlikely event the limit is exceeded.

#office365, #shared-computer-support

Office365 74-325 study resources

So I see more and more questions regarding Office365, and therefore I suggest looking on this exam , Administering Office 365 for Small Businesses 74-325 https://www.microsoft.com/learning/en-us/exam-74-325.aspx

I have taken the exam so therefore I wanted to create a study guide to make it easier to study for this exam. First of I suggest looking at the jumpstart on Microsoft Virtual Academy which covers most of the topics. (This requires a MVA account) http://www.microsoftvirtualacademy.com/training-courses/administering-office-365-for-small-business-jump-start

Important to note that this exam is purely multiple choice and remember to read the questions carefully.

Also remember to take note of the different PLANs and the amount of users and what it includes in data storage.

I have also added technet articles under each topic. So this is what the exam covers:

• Provision and manage users, groups, and domains

  • Create users; configure user and group properties and settings; manage user licenses and subscriptions; Bulk Add Users Wizard (CSV import); use Microsoft Online Services Directory Synchronization Tool to provision and manage users and groups; recover identities and users; add and verify domains; Microsoft Online Services module for Windows PowerShell

  • User administration –> http://technet.microsoft.com/en-us/library/office-365-user-account-management.aspx

  • Add and verify domains –> http://technet.microsoft.com/en-us/library/office-365-domains.aspx

  • PowerShell module –> http://technet.microsoft.com/en-us/library/jj151815.aspx

• Manage roles

  • Office 365 administrator roles; delegated administration; Exchange role-based access control (RBAC) roles, including management role assignment policies for users

  • Users and RBAC –> http://office.microsoft.com/nb-no/office365-suite-help/tilordne-administratorroller-HA102816050.aspx?redir=0

  • Assigning users and roles –> http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff637584.aspx

• Prepare the client computer and configure remote connectivity

  • Prepare the client computer (prerequisites, desktop integration, Group Policy settings, manage desktop shortcuts, Microsoft Online Services Sign-In Assistant); troubleshoot remote connectivity issues (Windows Firewall and network firewall for Lync, Exchange, and SharePoint); autodiscover and service location, trusted zones; configure remote administration (enable administrator for remote Windows PowerShell, Exchange Management Console), Office Professional Plus 2010

  • Client Support –> http://technet.microsoft.com/library/office-365-system-requirements.aspx

  • Ports and protocols users by Office365 –> http://technet.microsoft.com/en-us/library/hh852522.aspx

  • Deployment Office365 Proplus –> http://technet.microsoft.com/en-us/library/gg998766(v=office.15).aspx

• Manage mailboxes, contacts, and groups

  • Single item recovery; recover mailboxes; migrate mailboxes; Email Migration Wizard; configure global policy settings, including Outlook Web App mailbox policy and Exchange ActiveSync policies; security and distribution groups (moderated, restricted, dynamic, and self-service)

  • Manage devices in ActiveSync –> http://help.outlook.com/en-us/140/ms.exch.ecp.activesyncaccess.aspx

  • Item recovery Office365 –> http://help.outlook.com/en-us/140/hh125820.aspx

  • Migrate options office365 from Exchange  –> http://support.microsoft.com/kb/2798131

• Manage messaging security and compliance

  • Antivirus/antispam (Exchange Online Protection); Exchange Data Loss Prevention; S/MIME; Information Rights Management (IRM); journal rules; certificates; Mutual TLS (MTLS); create and manage retention policies and retention tags; administrator audit logging; mailtips; litigation hold; archive mailbox (personal and online) –>

  • Complliance –> http://technet.microsoft.com/library/exchange-online-message-policy-recovery-and-compliance.aspx

  • Ligiation hold office365 –> http://blogs.technet.com/b/exchange/archive/2013/12/11/litigation-hold-and-in-place-hold-in-exchange-2013-and-exchange-online.aspx

  • Mailtips Offic365 –> http://help.outlook.com/en-us/140/ff872400.aspx

• Manage Lync in an Office 365 environment

  • Configure Lync services; configure federation and public IM connectivity (PIC); configure user settings (audio/video, file transfer, dial-in audio conferencing settings) –>

  • Lync Administraton –> http://technet.microsoft.com/library/lync-online-administration-and-management.aspx

  • Enabling features in Lync Online –> http://onlinehelp.microsoft.com/en-us/office365-enterprises/hh416768.aspx

• Manage site collections

  • Create site collections; manage site collection properties (quotas, owners, administrators, and external user policies); create and configure the public website

  • Creating site collection and defining quotas –> http://office.microsoft.com/en-us/windows-sharepoint-services-it/configuring-site-collection-quotas-and-locks-HA001160794.aspx

  • Setting public website Office365 –> http://office.microsoft.com/en-us/office365-sharepoint-online-enterprise-help/set-up-a-public-website-HA102476205.aspx

• Manage user profiles

  • Configure user and organization properties and policies; manage social tags and notes; configure MySite properties; manage audiences

  • Create audiences –> http://office.microsoft.com/en-ca/office365-sharepoint-online-enterprise-help/manage-audiences-HA102466380.aspx

• Manage sites

  • Manage team site; external user permissions; send external invites; create permission sets; define roles and groups; site templates; solution and feature framework (activating, deactivating, sandbox solutions); mobile device support; Recovery and Recycle Bin

  • Mobile Device support –> http://technet.microsoft.com/en-us/library/office-365-mobile-devices.aspx

  • Recycle Bin –> http://office.microsoft.com/en-001/office365-sharepoint-online-enterprise-help/restore-content-with-the-recycle-bin-HA102825651.aspx

  • External user permissions and invitations –> http://office.microsoft.com/en-us/office365-sharepoint-online-small-business-help/manage-sharing-with-external-users-HA102849862.aspx

• Manage public-facing website

  • Create a public website with the default domain; create a public website with a custom domain name; change the domain name of your existing public website; view the public website DNS information

  • Configuring pulblic website and domain –> http://office.microsoft.com/en-us/office365-sharepoint-online-enterprise-help/set-up-a-public-website-HA102476205.aspx

#74-325, #office365