MEDV Architecture June09

download MEDV Architecture June09

of 20

Transcript of MEDV Architecture June09

  • 8/8/2019 MEDV Architecture June09

    1/20

  • 8/8/2019 MEDV Architecture June09

    2/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    Contents

    1 Introduction to Microsoft Enterprise Desktop Virtualization (MED-V) ........................................... 3 1.1 Terminology ........................................................................................................................... 4 1.2 Key Capabilities....................................................................................................................... 4

    2 High-level Architecture ......................................................................................................... 6 2.1 System Requirements for MED-V v1 .............................................. ........................................... 7

    3 Virtual Image Overview ........................................................................................................ 8 3.1 Managing a virtual machine .................................................................................... ............... 10

    4 The MED-V Client ................................................................................................................ 11 4.1 Authentication and Policy Enforcement ................................................... ................................ 11 4.2 Virtual Machine Operation ................................................... .................................................. 11 4.3 Virtual Image Encryption ................................................................................................ ....... 12 4.4 Offline Mode ..................................................... ..................................................... ............... 12 4.5 Published Applications and Menus Single Desktop User Experience .......................................... 13 4.6 Web Browser Redirection ....... ...................................................... ......................................... 13 4.7 Printing .................................................................... ...................................................... ...... 14 4.8 File Transfer ............................................ .................................................... ......................... 14 4.9 Copy and Paste Control ....................................................................... .................................. 14

    5 MED-V Client Deployment ................................................................................................... 15 5.1 Client Deployment and Image Delivery Methods ...................................................... ............... 15 5.2 Customized, First-time Setup ........................................................................ ......................... 15

    6 MED-V Image Delivery and Update .................................................................................... 16 6.1 MED-V Trim Transfer Technology .................................................. ......................................... 17

    7 MED-V Management Server ................................................................................................ 18 7.1 Workspace Policy ...................................................... ...................................................... ...... 18 7.2 Events Database and the MED-V Dashboard .................................................. ......................... 18

    8 MED-V Enterprise Architecture ........................................................................................... 19

    8.1 Scalability and Multi-Locations ...................................................... ......................................... 19 8.2 High Availability ................................................ ..................................................... ............... 19

  • 8/8/2019 MEDV Architecture June09

    3/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    1 Introduction to Microsoft Enterprise Desktop Virtualization (MED-V)

    Microsoft Enterprise Desktop Virtualization (MED-V), a core component of the Microsoft DesktopOptimization Pack (MDOP)for Software Assurance, enables deployment and management of Microsoftvirtual PC Windows desktops to enable key enterprise scenarios. Primarily, MED-V helps enterprisesupgrade to the latest version of Windows even when some applications are not yet functional orsupported.

    MED-V builds on top of Virtual PC torun two operating systems on one

    device, adding virtual image delivery,policy-based provisioning, andcentralized management.

    With MED-V, you can easily create,deliver and manage corporate VirtualPC images on any Windows-baseddesktop.

    Enable legacy applications and accelerate upgrades to new operating systems

    Incompatibility of applications with newer versionsof Microsoft Windows can delay enterpriseoperating system (OS) upgrades. Testing andmigrating applications can be time-consuming, andmeanwhile users are unable to take advantage ofthe new capabilities and enhancements offered bythe new OS.

    By delivering applications in a Virtual PC that runsa previous version of the OS (e.g., Windows XP orWindows 2000), MED-V removes the barriers to

    OS upgrades), MED-V removes the barriers tooperating system upgrades and allowsadministrators to complete testing and to deal withincompatible applications after the upgrade.

    From the users perspective, these applications are accessible from the standard desktop S tart menu andappear side-by-side with native applications so there is minimal change to the user experience.

  • 8/8/2019 MEDV Architecture June09

    4/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    1.1 TerminologyHost The operating system instance installed on the end-user s physical device.

    Virtual PC / Machine An additional instance of an operating system running concurrently with thehost on the same physical device using virtualization software (such as, Microsoft Virtual PC).

    Guest The operating system installed on a virtual machine.

    Virtual image A file that represents the file system of a virtual machine and can be delivered tomultiple endpoints independent of their hardware or software.

    1.2 Key Capabilities

    MED-V adds the following additional layers to Microsoft Virtual PC to enable enterprise deployment ofdesktop virtualization:

    Virtual images repository and delivery MED-V provides the following mechanisms for simplifyingthe process of creating, testing, delivering, and maintaining virtual images from a central location:

    Administrator console for virtual image creation and testing.

    Centralized virtual images repository for image storage, versioning, and delivery based onMicrosoft IIS web servers.

    A client component (standard MSI installation) that automatically retrieves virtual images from the

    centralized repository.

    Auto-installation package for self-deployment of the client component and the virtual images viaremovable media (such as DVD) or from a website.

    An efficient, bandwidth-conserving, Trim Transfer mechanism for delivering and updating virtualimages over the network.

    Support for image delivery through standard enterprise content distribution systems.

    Centralized management and monitoring MED-V helps administrators manage the entire life-cycle of virtual machines deployed on desktops throughout the enterprise. The centralizedmanagement and monitoring capabilities MED-V provides include:

    A central management server that controls all deployed virtual machines.

    Integration with Microsoft Active Directory Domain Services to enable provisioning of virtualimages based on group membership or user identity.

    User authentication prior to accessing the virtual image (whether the host is online or offline).

  • 8/8/2019 MEDV Architecture June09

    5/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    A mechanism for automating the first-time setup of virtual machines at the endpoint, includingassignment of a unique computer name, performing initial network setup, and joining the virtualmachine to a corporate domain.

    Support for deployment throughout a heterogeneous environment, adjusting memory allocationfor the virtual PC according to the available RAM of the endpoint, and changing network settingsaccording to the local network.

    A central database of client activity and events facilitating monitoring and remote troubleshooting.

    Usage policy and data transfer control MED-V client enforces the following user or group usagepolicies, access permissions to virtual images, and data transfer permissions:

    Virtual image protection that prevents unauthorized execution.

    A configurable expiration for the virtual image or a time limit for offline use (to force the user to re-authorize before continuing to work offline).

    The ability to allow or block data transfer between the virtual machine and the endpoint, via copyand paste, file transfer, or printing.

    Web browser redirection of administrator-defined domains (such as the corporate intranet or sitesthat require an older version of the browser) from the endpoint browser, to a browser within thevirtual machine.

    Seamless end-user experience The following can be configured in MED-V to provide a seamlessexperience, making users unaware of the virtual machines running in the background. It reduces thetraining required for deploying virtualization to non-technical users:

    Invisible virtual machine A simplified work process for operating virtual machines through auser-friendly tray menu. The user is not required to learn the principles of virtualization or view anadditional desktop as is usually required when running a virtual PC.

    Published applications Applications installed on the virtual machine are available through thestandard desktop Start menu. These applications run in Virtual PC, but are seamlessly integratedinto the user desktop and appear side-by-side with native applications.

    Power user mode Technical users and administrators can view the virtual machine loadingprocesses and desktop if required.

  • 8/8/2019 MEDV Architecture June09

    6/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    2 High-level Architecture

    The MED-V solution comprises the following elements:

    Administrator-defined virtual machine Encapsulates a full desktop environment, including anoperating system, applications and optional management and security tools.

    Image repository Stores all virtual images on a standard IIS server and enables virtual imagesversion management, client-authenticated image retrieval, and efficient download (of a new image or

    updates) via Trim Transfer technology. Management server Associates virtual images from the image repository along with administrator

    usage policies to Active Directory users or groups. The Management Server also aggregatesclients' events, and stores them in an external database (Microsoft SQL Server) for monitoring andreporting purposes.

    Management console Enables administrators to control the management server and the imagerepository.

  • 8/8/2019 MEDV Architecture June09

    7/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    End-user client

    1. Virtual image life-cycle Authentication, image retrieval, enforcement of usage policies.

    2. Virtual machine session management Start, stop, lock the virtual machine.

    3. Single desktop experience Applications installed in the virtual machine seamlessly availablethrough the standard desktop Start menu and integrated with other applications on the userdesktop.

    All communication between the client and the servers (management server and image repository) iscarried on top of a standard HTTP or HTTPs channel.

    2.1 System Requirements for MED-V v1

    Management Server

    Operating system : Windows Server 2008 Standard/Enterprise Edition x86 & 64-bit Recommended hardware : Dual Processor (2.8 GHz), 4GB RAM Active-directory : Management server should be joined to a domain Scale : The setup above was tested with 5000 concurrent active clients. Other setups can scale to

    support larger number of users.

    Additional Server Components Image repository : Web server(s) based on Microsoft IIS Reporting database (optional) : Microsoft SQL Server 2005 SP2 Enterprise Edition SP2 or

    Microsoft SQL Server 2008 Express/Standard/Enterprise editions

    Client Operating system:

    o Windows Vista SP1 (Enterprise, Home Basic, Home Premium, Business, Ultimate) 32-bit (2GB RAM Recommended )

    o Windows XP SP2 or SP3 (Professional, Home) 32bit (1GB RAM Recommended) Languages: The user interface is only available in English. Support is available for a localized

    Western-European operating system. Virtual PC: Microsoft Virtual PC 2007 SP1 with KB958162 (or newer) is required

    Note: MED-V v1 is supported on managed desktops only.It is recommended to install the end user client within IT-managed desktop environments on desktopsthat are members of a Microsoft Active Directory Domain.

    Guest Operating System Windows XP SP2 or SP3 32bit Windows 2000 SP4 32bit

  • 8/8/2019 MEDV Architecture June09

    8/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    3 Virtual Image Overview

    The following describes the typical process of creating, deploying, and utilizing a MED-V virtual image:

    Create a virtual image within Microsoft Virtual PC.

    Define a MED-V workspace.

    Create a list of applications installed in the virtual image, which are to be made available to endusers through their standard desktop Start menu.

    Define Web sites that should be viewed inside or outside the virtual machine browser and that areredirected to the appropriate location by MED-V client.

    Provision the MED-V workspace to Active Directory users and groups.

    Set usage policy (such as expiration, permission to work offline) and data transfer permissions(such as file transfer, copy andpaste, and printing) to the various users and groups.

    Test the Image through the MED-V management console, and load it to the MED-V ImageRepository.

    Deploy the MED-V client via one of the following methods:

    Enterprise software distribution tools The MED-V client and Virtual PC software can bedeployed as standard Windows Installer files.

    Self-install package Deliver a MED-V installation package, which includes MED-V clientinstallation and Virtual PC software using one of the following:

    o A self-service Website.

    o Removeable media for example, CD, DVD).

    The installation process is automated, silent and easy for end users. .

  • 8/8/2019 MEDV Architecture June09

    9/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    Deliver the virtual image:

    Over the network After the MED-V Client is installed, the virtual image can be retrieved overthe network using standard HTTP or HTTPs tunnel. Trim Transfer technology will acceleratedownload speed and reduce required bandwidth, as described in a following section.

    Using enterprise distribution mechanisms Administrators may choose to deliver packagedvirtual PC images (created by the MED-V management console) by using existing systems. TheMED-V Client will look for the package in a pre-defined path, and extract the image.

    Via removable media (for example, DVD) When delivering removable media to the end user,it is possible to add the virtual image to the self-install package. As part of the installation, thevirtual image is copied to the local drive.

    End-users start working Users authenticate against the MED-V management server and they areready to work within the virtual machine. After the first online authentication, offline work is alsosupported, if permitted by the administrator.

    Manage and update the MED-V workspace The management console enables administrators toeasily update usage policies, provision MED-V workspaces to additional users, deprovision existingusers, and update the virtual images. All updates are automatically distributed to relevant users whenthey work online.

    Monitoring clients The MED-V management console presents an updated report of all the users. Itprovides detailed information on all client events, and when an error occurs, it can help theadministrator understand the source of the problem remotely and instruct the user on how to solve it.The MED-V diagnostic tool runs automatically when client installation fails, and can be executedmanually in other cases of malfunction. The report can assist Microsoft support in understanding the

    cause of the problem and recommending the administrator on how to fix it.

  • 8/8/2019 MEDV Architecture June09

    10/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    3.1 Managing a virtual machineAfter the first version of a virtual image is deployed, it becomes a desktop operating system that requirescorporate IT management. This includes delivering new applications, patching, updating securitydefinitions and policies, and more.

    Administrators can choose one of the following two methods of virtual machine management:

    Domain-managed virtual machine Manage virtual machines just like physical corporate devices.MED-V provides a first-time customization process for every deployed virtual image, where theadministrator can choose to join the virtual machine to an Active Directory domain. This way,administrators can patch, update, deliver applications, and apply policies using existing tools.

    Self-cleaning (revertible) virtual machine MED-V offers a unique method for managing an easyto support virtual desktop environment. It takes advantage of hardware independence enabled byvirtualization, and maintains the exact same image across multiple endpoints. All user changes toapplications or the OS are discarded once the virtual PC session ends, and the virtual machinereverts to the original image, as packaged and delivered by the administrator. This can significantlysimplify management, support, and troubleshooting for virtual machines.

    Updates, patches, new applications, and settings changes are applied to the master virtual image,tested by the administrator, and uploaded as a new version of the virtual image to the MED-V imagerepository. The new version is delivered to all endpoints using Trim Transfer technology, removingthe need to update each endpoint separately.

    This method is applicable only where no user data or settings need to be kept in the virtual image (forinstance, when all user data and settings are stored on a network location). Also when using therevertible method, the virtual machine should not be part of an Active Directory domain.

  • 8/8/2019 MEDV Architecture June09

    11/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    4 The MED-V Client

    4.1 Authentication and Policy Enforcement

    The MED-V client requires authentication to ensure that only authorized users access the MED-V virtualimages. This verification is performed against the management server, which queries Active Directory foruser and group information. Therefore, the management server must be part of the domain to which theuser is trying to authenticate.

    MED-V leverages Active Directory security policies. When an account is disabled or locked in ActiveDirectory (for instance, if the user typed a wrong password three times), the user is not allowed to tart theMED-V workspace. In addition, if the password is about to expire, the user is offered to change thepassword before completing the MED-V authentication.

    Once the authentication process is complete, the MED-V client queries the MED-V management serverfor the most recent policies and settings. This action ensures that the endpoint is using the most updatedMED-V workspaces and allows administrators to control and monitor active users, as described infollowing sections.

    The domain credentials used for authenticating the MED-V client are also used to login to the Windowsinstance inside the virtual machine, so that the user is not required to type the domain credentials twice.The user may choose to save the credentials for future sessions of the same user, so that they areautomatically used by MED-V client the next time the user attempts to start a MED-V workspace. Notethat the user is required to authenticate by the MED-V client, even if the host and the guest operating

    system use the same credentials.When the virtual machine is running in a MED-V session, it is locked after a predefined idle time or whenthe physical device enters hibernation or sleep mode. The authenticated user is required to type hispassword to unlock the virtual machine and continue working.

    MED-V v1 only supports authentication based on Active Directory domain credentials (username andpassword). Future releases may include two-factor authentication (such as smart card certificates).

    4.2 Virtual Machine Operation

    MED-V uses Microsoft Virtual PC to run a virtual machine locally on the endpoint. The MED-V clientcontrols all aspects of virtual machine management, including retrieving or updating a virtual image,customizing the virtual machine for the specific user or device, initiating, suspending or terminating avirtual machine session, and monitoring the virtualization engine for malfunctions (watchdog).End users remain unaware that a virtual machine is running in the background.

    The MED-V client can be configured to take a snapshot of the virtual machine (similar to a laptop sleepmode) at the end of each work session or when the user logs off the host workstation. This reduces thetime required for re-initiating the virtual machine.

    When a virtual machine is suspended, and a different, authorized user attempts to use it, the virtualmachine shuts down first (pending user confirmation). The existing session is lost, similar to Windowsbehavior when an authorized user attempts to access a locked device.

  • 8/8/2019 MEDV Architecture June09

    12/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    4.3 Virtual Image EncryptionVirtual images are encrypted by the management console when packaged for distribution (over thenetwork or media) to protect the virtual image from unauthorized use (such as, unauthenticated users, onusers not complying with the administrator-defined usage policies). For each image, encryption keys aregenerated on the server and are securely transferred to clients authorized to work with the specific image.The virtual images remain encrypted on the endpoint local drive, and decryption is completed on the flywhen the virtual machine is running. Any new data is saved encrypted.

    4.4 Offline Mode

    If users are authorized to work with the virtual machine offline, the policy files and encryption keys arecached locally after a first successful online authentication.

    If there are multiple authentication failures, further attempts will be delayed (similar to Windows login).Additionally, if the user account is disabled, locked, expired in Active Directory, or if the account passwordhas changed, MED-V client deletes the locally cached credentials when connecting to the managementserver.

    Offline work permissions may be limited by the administrator to a predefined period of time, after whichthe user must reconnect to the management server and re-authenticate. This ensures users are kept upto date with the most recent policy and permissions, and enforces expiration and de-provisioning settingson end users.

  • 8/8/2019 MEDV Architecture June09

    13/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    4.5 Published Applications and Menus

    Single Desktop User ExperienceAdministrators may publish applications or submenus installed on the virtual machine, making themavailable to end users through the host Start menu. The applications launch from the Start menu ordesktop shortcuts and appear side-by-side with native applications on the user desktop, optionallydifferentiated by a colored frame. The virtual machine desktop is not visible, simplifying user experienceand avoiding changes to user workflows.

    The single desktop mode simplifies training and work processes and is therefore recommended for mostusers. However, administrators can set the virtual machine to work in a full desktop mode, whenadvanced users prefer to view the whole virtual machine. In this mode users have to manually togglebetween their physical desktop and the virtual machine desktop.

    4.6 Web Browser Redirection

    For Web applications, administrators can define a set of Websites (based on allow or deny lists of domainsuffixes or IP prefixes) to be launched in a browser running on the virtual machine. Corporate Websites orincompatible Web applications can start in the virtual machine, while all other sites still work in the hostbrowser normally. The MED-V client manages the browser redirection automatically, providing aseamless browsing experience for the end user.

  • 8/8/2019 MEDV Architecture June09

    14/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    4.7 PrintingWhen a MED-V policy allows printing from MED-V workspace applications (in the guest operating system)to locally installed printers, no driver needs to be installed for locally attached or network printers insidethe virtual machine.

    4.8 File Transfer

    Files can be transferred between the virtual machine and the endpoint or vice versa, according toadministrator-defined permissions. File transfers are subject to centrally defined filters that allow inboundand outbound transfer of specific file types and may be pending on anti-virus scanning upon theirdestination.

    4.9 Copy and Paste ControlCopy and paste operations between a MED-V workspace and native applications can be allowed ordenied based on administrator policies. All copy and paste operations inside the virtual machine (betweenguest applications), and between endpoint host applications, are always allowed; the MED-V Client doesnot interfere with existing copy and paste behavior.

  • 8/8/2019 MEDV Architecture June09

    15/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    5 MED-V Client Deployment

    5.1 Client Deployment and Image Delivery Methods

    MED-V can be deployed in the following ways:

    Software distribution system The MED-V client installation is based on a standard Windows .msipackage. Therefore, when deploying MED-V, administrators can use any existing softwaredistribution system. The MED-V .msi package does not include Virtual PC software that shouldseparately be deployed to all endpoints.

    When installing MED_V through a distribution system, administrators may choose to let the MED-Vclient retrieve the virtual image from the image repository according to the user policy, or deliver thevirtual image package using other methods to a pre-defined location, so that MED-V client will use itand not download it from the repository.

    "MED-V deployment package Administrators can provide end users with an installation packagethat includes the MED-V client, Microsoft Virtual PC, and optionally, the virtual image. The processrequires almost no user interference, and automatically installs everything required for MED-Voperation on the local drive. The package can be delivered on a removable media (such as CD orDVD), or downloaded from a self-service Web server by the end-user.

    5.2 Customized, First-time Setup

    MED-V allows administrators to customize every deployment of a virtual image. This procedure caninclude allocating a unique computer name for the virtual image (according to user name, endpointparameters, or a random ID) so that, for instance, administrators can assign the virtual machine anidentifier that is based on the host computer name, and therefore easily identify this virtual machine insoftware management systems. Other customizations include Sysprep to allocate a unique SID for thevirtual machine, joining the virtual machine to the corporate Active Directory domain, or running anadministrator script.

    The MED-V Client handles first time setup automatically and transparently for the end user, includingrepeating failed steps or the whole process, and reporting back to the management server in casetroubleshooting is required.

  • 8/8/2019 MEDV Architecture June09

    16/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    6 MED-V Image Delivery and Update

    The MED-V images repository contains all available virtual machine images. The MED-V managementconsole provides an easy way to create, manage, update or delete images from the MED-V imagesrepository.

    Whenever administrators provision a new virtual machine or update an existing one, the MED-Vmanagement server detects the change in the image repository and notifies MED-V clients on their nextpolicy query, referring them to the most recent virtual machine from the respective images repository.

    Delivery is implemented using MED-V Trim Transfer technology over the network. Alternatively, virtual

    machines can be delivered via removable media (such as DVDs) or by other preferred methods ofnetwork delivery.

    The images repository is based on Microsoft IIS Web servers. Therefore when using Trim Transferdelivery, organizations may leverage standard Web scalability and high availability infrastructure. Toimprove download performance, organizations can create images repository replicas at branch offices orremote geographic locations. Administrators can choose whether the download is done over a standardHTTP or HTTPs session.

  • 8/8/2019 MEDV Architecture June09

    17/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    6.1 MED-V Trim Transfer TechnologyThe MED-V advanced Trim Transfer de-duplication technology accelerates the download of initial and updated virtual machine images over the LAN or WAN, thereby reducing thenetwork bandwidth needed to transport a MED-V workspace virtual machine to multiple endusers. This technology uses existing local data to build the virtual machine image,leveraging the fact that in many cases, much of the virtual machine (for example, systemand application files) already exists on the end user's disk. For example, if a virtual machinecontaining Windows XP is delivered to a client running a local copy of Windows XP, MED-Vwill automatically remove the redundant Windows XP elements from the transfer. To ensurea valid and functional workspace, the MED-V client cryptographically verifies the integrity of local data before it is utilized, guaranteeing that the local blocks of data are absolutely bit-by-bit identical to those in the desired virtual machine image. Blocks that do not match arenot used.

    The process is bandwidth-efficient and transparent, and transfers run in the background,utilizing unused network and CPU resources.When updating to a new image version (for example, when administrators want to distribute a newapplication or patch), only the elements that have changed ("deltas") are downloaded, and not the entirevirtual machine, significantly reducing the required network bandwidth and delivery time.

  • 8/8/2019 MEDV Architecture June09

    18/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    7 MED-V Management Server

    The MED-V management server stores and manages all MED-V configurations including user policies. Itcan be installed on top of Microsoft Windows Server (see system requirements). All server functionalitycan be controlled from the MED-V management console, which is a standalone client application.

    All MED-V Clients connect to the MED-V management server, authenticate and retrieve the most updatedpolicy. All sessions (from MED-V clients or management consoles) are carried over HTTP or HTTPS(according to server configuration).

    7.1 Workspace Policy

    Using the MED-V management console, administrators can create a new policy or change existingpolicies stored on the MED-V management server. Any change is automatically detected and updated byall online clients. Offline clients are updated once they connect. All policies are signed by a private key,generated upon server installation; the MED-V client verifies the authenticity and integrity of every policy itretrieves using a public key it retrieves in its first communication with the server.

    7.2 Events Database and the MED-V Dashboard

    The MED-V management server aggregates events from all MED-V clients. The events include systemnotifications and MED-V workspace monitoring (Workspace started, stop, failed to start due to lack ofmemory, etc).

    All events are stored in an external Microsoft SQL Server (see system requirements) that can be installedon the same server or separately.

    The MED-V management console provides a report generator that filters events according to date andusers. In addition, a dashboard status report enables monitoring of all installed clients including machinename, user name, offline and online indication, client version, image name, image version, etc.

    The client status enables administrators to monitor virtual image downloads or update progress in realtime.

  • 8/8/2019 MEDV Architecture June09

    19/20

    MICROSOFT DESKTOP OPTIMIZATION PAC

    8 MED-V Enterprise Architecture

    8.1 Scalability and Multi-Locations

    A typical MED-V management server can support thousands of users, depending on its hardware. Theclient-server communication is lightweight. Clients are normally configured to poll the server for a policyevery 15 minutes and for image updates every 4 hours. If the policy polling time is increased, the servershould be able to increase its scale.

    The only client-server heavy-duty operation occurs when a new image is available, and multiple clientsretrieve hundreds of megabytes from the images repository. Since the images repository is a standardMicrosoft IIS Web server, it is possible to scale the image delivery based on IIS capabilities.

    To improve the download rate, optimize bandwidth efficiently, and further balance the load, the imagedelivery servers can be placed in multiple geographic locations. DNS resolution can be used to direct theMED-V client to the best available location.

    Alternatively, a separate distribution mechanism can be used to deliver the virtual images to theendpoints. The MED-V client looks for the image in a pre-defined location, and removes the need forimage download and MED-V image delivery Web infrastructure.

    8.2 High Availability

    The MED-V client operates independently of MED-V servers. If the management server is malfunctioning

    or has stopped responding, all clients already running a MED-V workspace may continue working. Newattempts to start a MED-V workspace will run in offline mode. Only online authentication, policy changes,and image updates are unavailable, and client events are aggregated at the client side until the server isavailable again.

    However, to ensure fast recovery of a server failure, MED-V supports a failover structure, where twoidentical management servers are placed behind a third-party high-availability cluster: one is active, theother is passive. Once the active server fails, the cluster automatically shifts to the passive server. In thissetup, all server resources -- policy files, settings, virtual machine images, and reports database areseparated from the management servers to an external highly available, clustered file system.

  • 8/8/2019 MEDV Architecture June09

    20/20

    This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein.The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date ofpublication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part ofMicrosoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

    This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, ASTO THE INFORMATION IN THIS DOCUMENT.Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of thisdocument may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic,mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in thisdocument. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give youany license to these patents, trademarks, copyrights, or other intellectual property.

    2008 Microsoft Corporation. All rights reserved.Microsoft, Windows, Windows Vista, Active Directory, Microsoft SQL Server are either registered trademarks or trademarks of MicrosoftCorporation in the United States and/or other countries.The names of actual companies and products mentioned herein may be the trademarks of their respective owners.