Month: August 2017
It’s no secret that with the introduction of Windows 10 that Microsoft has moved into the direction of releasing new feature updates twice per year, which is commonly referred to as Windows as a Service. An organization could be faced with challenges around the frequency, size, and the new administrative cadence of feature updates to Windows (even though Microsoft has done and is doing great work to address these challenges).
In light of these challenges, it can be tempting for an organization to try to “standardize” on version of Windows 10 that is supported for 10 years. This version is called the Long Term Servicing
Branch Channel, or LTSC for short, and is designed for “Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization.” (Side note that the nomenclature usage of the word “Branch” was recently dropped
While it may sound great that there is a version of Windows 10 which is supported for 10 years, there are many considerations and risks with trying to use it across the board. This posting is an attempt to pull together and consolidate disparate references to help highlight, educate, and inform on Win10 LTSC for general production use. Even Gartner says Rethink Windows 10 LTSB Deployment Based on Microsoft’s Updated Guidance.
General guidelines state that devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 using the Current Channel servicing option:
- Devices that run productivity software such as Microsoft Office
- Devices that use Windows Store applications
- Devices that are used for general Internet browsing
(for example, research or access to social media)
Support for the latest processor / chipsets:
- LTSC will support the currently released silicon at the time of release of the LTSC version
- As future silicon is released, support will be created through future LTSC releases that customers can deploy for those systems
- This enables Microsoft to focus on deep integration between Windows and the silicon, while maintaining maximum reliability and compatibility with previous generations of platform and silicon
- Multiple LTSC versions would be required to be used and managed within the organization for the life of the hardware
- Hope you’re ready to buy hundreds or thousands of computers with supported chipsets to just keep on hand
LTSC, being that it’s code base and features are set “in stone” for 10 years and will not be modified, then it will be unable to keep up with current security capabilities and needs. Case in point, the LTSB 2015 and 2016 releases do not have support for the following, only the current channels of Win10. This would further widen the security gap of an organization until they are added into a future LTSC release (which is only every few years).
- Memory protection features
- Control Flow Guard (CFG) – a highly-optimized platform security feature that was created to combat memory corruption vulnerabilities
- Data Execution Prevention (DEP)
- Structured Exception Handling Overwrite Protection (SEHOP)
- Address Space Layout Randomization (ASLR)
- Hardening against recent zero-day exploits
- Win32k elevation of privilege
- Open type font elevation of privilege
- Windows Hello for Business on-premises
- Windows Defender Application Guard (also because LTSC does not support Edge)
- Windows Defender Exploit Guard (formerly known as EMET)
Windows Analytics provides data-driven insights that reduce the cost of deploying, servicing, and supporting Windows 10. It gives an organization actionable information to help gain deep insights into operational efficiency and the health of Windows 10 devices in the environment. But Windows 10 LTSC is not supported for Upgrade Readiness. The three tools include:
- Upgrade Readiness provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without additional infrastructure requirements.
- Update Compliance provides a unified view of Windows Update and Windows Defender Antivirus compliance for Windows 10 devices, regardless of the management solution being used. It allows organizations to keep their devices secure and up-to-date, track protection and threat status, and monitor update deployments and troubleshoot issues as they arise.
- Device Health provides proactive insights to help detect and remediate end-user impacting issues. This new service uses telemetry data to provide such insights without additional infrastructure requirements. Proactively remediating end-user issues enables you to reduce support costs and improve efficiency.
Examples of functionality missing that was included in the Windows 10 Creators Update (1703) in April 2017 include the following. For each and every release of Windows 10, this list would grow.
- Unified Update Platform
- MBR to GPT conversion tool
- New MDM and MAM capabilities
- Customization of the Settings app to hide/show different pages
- Dynamic lock
- Express updates in SCCM
- The list goes on…
Various other limitations
- Fewer non-security and reliability fixes
- Visual Studio is not supported on LTSC
- Office ProPlus (traditional MSI) is highly recommended, and not using Office 365 ProPlus (aka click-to-run) on LTSC
- In-place upgrade of Win7 to LTSC is not supported – a full reimage, backup/restore of data and applications, just like the old days
- Depending upon IHV and ISV, there may be support and limitations on LTSC
- Doesn’t contain in-box apps, such as Store, Calculator, Photos, Camera, Music, Clock, and Edge – and yes, Edge is also a more secure browser
- Windows Feature Updates, including enhancements such as:
- Improvements to Direct Ink and palm rejection provided in Windows 10 1607
- Improved support for high DPI applications provided in Windows 10 1703
- Pressure sensitivity settings provided by the Surface app
- The Windows Ink Workspace
- Key touch-optimized in-box applications including Microsoft Edge, OneNote, Calendar, and Camera
- Driver and firmware updates are not explicitly tested against releases of Windows 10 Enterprise LTSC
- If you encounter problems, Microsoft Support will provide troubleshooting assistance. However, due to the servicing nature of the Windows LTSC, issue resolution may require that devices be upgraded to a more recent version of Windows 10 Enterprise LTSC, or to Windows 10 Pro or Enterprise with the Current Channel servicing option.
In summary, in this blog post I have tried to outline evidence to support you in your decision making process for choosing Windows 10 Current Channel over LTSC. I hope that it leads to the proper choice for you! Points covered were
- Guidelines of what is a general use device vs. a specialized device
- Support for the latest processor / chipsets
- Security features that are not present in LTSC
- Windows Analytics for data-driven insights, is not supported
- Example of missing functionality that was delivered in Windows 10 Creators Update (1703)
- Various other limitations and their potential impact
- Core Surface device experiences are impacted
Updated 3/21/18 to account for changes in support for the Windows Analytics tools.
Windows 10 news for August 2017. Categories:
deployment | security | productivity | windows insider highlights
Deployment & Management
- Details have been released as to which processors can be used with Windows products (including Custom Images). For each listed edition, your company must use only the processors listed, as specified in the table below. The requirements below apply whenever the edition below is pre-installed or provided on external media, including as downgrade or down edition software.
- Recommended settings and configurations for Win10 VDI desktops
- Features that are removed or deprecated in Windows 10 Fall Creators Update
- As part of the alignment with Windows 10 and Office 365 ProPlus, we are also adopting common terminology to make it as easy as possible to understand the servicing process. The names Current Branch (and CB for Business) and Long-Term Servicing Branch (LTSB) are being replaced with Semi-Annual Channel and Long-Term Servicing Channel.
- Now Available: Update 1706 for System Center Configuration Manager
- For the past several months, Microsoft has shared insights on our roll out approach for Windows 10 Creators Update (version 1703). We’re now moving from a targeted offering to full availability for all compatible devices running Windows 10 Creators Update globally via Windows Update. Similarly, our commercial customers should feel confident to deploy this release broadly across their organizations.
- IT use has evolved. The modern workplace encompasses multiple device platforms, user- and business-owned devices, and the ability for users to work anywhere. Transforming the process for deploying new Windows 10 PCs is an important part of Microsoft’s vision for modern IT.
- Last month Microsoft announced Windows Analytics Device Health, the latest addition to the suite of Windows Analytics functionality designed to ensure employees have the best possible experience with Windows 10. Through the proactive insights provided by Device Health, we believe we can help you save time and money by reducing helpdesk calls and keeping employees productive. We are happy to announce that the public preview of Windows Analytics Device Health is available for you to try.
- After October 10, 2017, Windows 10 devices running version 1511 will no longer receive security and quality updates. Microsoft recommends updating devices to the latest version of Windows 10.
- Microsoft IT looked to the capabilities of the cloud to help address the challenges of monitoring and protecting the corporate network from advanced adversaries and threats. Windows Defender Advanced Threat Protection (ATP) combines built-in behavioral sensors, machine learning, and security analytics that quickly adapt to changing threats.
- Windows Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware. In Windows 10 Creators Update, the Windows Defender AV client uploads suspicious files to the cloud protection service for rapid analysis. Our ability to make a swift assessment of new and unknown files allows us to protect customers from malware the first time we see it.
- Solving the TLS 1.0 Problem – This document presents guidance on rapidly identifying and removing Transport Layer Security (TLS) protocol version 1.0 dependencies in software built on top of Microsoft operating systems. It is intended to be used as a starting point for building a migration plan to a TLS 1.2+ network environment.
- With Windows 10, your needs have guided our product development. We’ve designed Windows 10 to be the safest, most secure Windows yet. Our goals are to simplify IT administration and to deliver more personal and productive experiences with a lower total cost of ownership (TCO) on modern, powerful devices. Find out how your organization can prepare for today’s security threats.
- Microsoft would like to provide you with the latest information to keep you up-to-date with modern security advancements from Windows, through the latest Modern Security Information Kit.
- We’re excited to introduce you to the Microsoft Modern Keyboard with Fingerprint ID, a premium quality keyboard that brings the convenience and security of Windows Hello fingerprint sign-in to any PC running Windows 10. With the new Microsoft Modern Keyboard with Fingerprint ID, you can use your finger to sign into your Windows devices, and compatible apps**, with Windows Hello in less than 2 seconds – that’s 3 times faster*** than a password that you have to remember and type in.
- If there’s anything we learned, it’s that after 32 years, MS Paint has a lot of fans. It’s been amazing to see so much love for our trusty old app. Amidst today’s commentary around MS Paint we wanted to take this opportunity to set the record straight, clear up some confusion and share some good news: MS Paint is here to stay, it will just have a new home soon, in the Windows Store where it will be available for free.
Windows Insider Highlights
- Beginning in the Windows 10 Fall Creators Update, we intend to disable VBScript execution in IE 11 for websites in the Internet Zone and the Restricted Sites Zone by default, to provide a more secure experience.
- The End of an Era – Adobe announced that Flash will no longer be supported after 2020. Microsoft will phase out support for Flash in Microsoft Edge and Internet Explorer ahead of this date.