Printer Friendly Version      Send     
Click to Rate and Give Feedback
Related Articles
Michael Murgolo is back with an update to his Elevation PowerToys. You'll find enhanced Run as Administrator functionality that works with third-party scripting tools, a way to replace a handy Windows XP feature removed from Windows Vista, and many more useful tools.

By Michael Murgolo (June 2008)
Windows Vista SP1 and Windows Server 2008 introduce important changes to BitLocker, including support for data volumes and improved protection against cryptographic attacks. Byron Hynes explores the new features, demonstrates how to use BitLocker on a server, and discusses some of the recent media coverage affecting BitLocker.

By Byron Hynes (June 2008)
When you want to reduce the total cost of ownership of the desktop machines in your organization, application lockdown can be a great help, letting you limit IT issues related to unsupported applications. See how you can use software restriction policies and Group Policy to control the applications being run throughout your IT infrastructure.

By Chris Corio and Durga Prasad Sayana (June 2008)
The recent update to the Windows Vista Firewall offers some impressive new features that make it a compelling choice for the corporate environment. Jesper M. Johansson gives a brief overview of the evolution of the Windows Firewall and delves into enhancements—such as new rules and profiles, domain isolation, and encryption—that will have administrators taking a closer look.

By Jesper M. Johansson (June 2008)
More ...
Articles by this Author
ADM files are both necessary and often confusing. Don't let this slow your Group Policy efforts. This guided tour will help you better understand what's inside ADM files and the new ADMX format, which tools you can use to handle them, and how you can make the best use of these files.

By Jeremy Moskowitz (January 2008)
USB thumb-disk keys and other removable devices can make your personal life easier but your professional life harder. For improved security, you need a way to control what hardware devices your users are installing on their work systems. Now you can use Group Policy to control which devices they can use and which ones they can’t.

By Jeremy Moskowitz (June 2007)
The Group Policy infrastructure has been overhauled, delivering new management features, new policy settings, support for multiple local GPOs, and much more. This article looks under the hood at the many changes Windows Vista brings to Group Policy.

By Jeremy Moskowitz (November 2006)


By Jeremy Moskowitz (October 2006)


By Jeremy Moskowitz (August 2006)
One of the most common requests I get at my Group Policy forum, GPanswers. com, is how to take machines and "lock them down. " People want to ensure their machines can’t be broken by Joe User or Harry Badguy.

By Jeremy Moskowitz (July 2006)


By Jeremy Moskowitz (May • June 2006)
An essential, though sometimes time-consuming, task for protecting your computing environment is to keep systems current with the latest software updates and patches. To help streamline this process, Microsoft recently released

By Jeremy Moskowitz (November • December 2005)
More ...
Popular Articles
The introduction of Hyper-V makes virtualization an even more compelling solution for IT environments. Get an overview of today’s virtualization market and see how Hyper-V improves the manageability, reliability, and security of virtualization

By Rajiv Arunkundram (October 2008)
Microsoft Office Groove and SharePoint Server both provide powerful collaboration capabilities. Compare how they differ from and complement one another, and find out how you can integrate Groove and SharePoint to provide an easy and flexible collaboration solution that will support users at different locations.

By Alan Maddison (July 2008)
The key to successfully scaling an ASP.NET application is having a collaborative effort between developers and network administrators, starting at the beginning of the application’s lifecycle. Find out what factors are necessary to scale an application, and see how this collaboration can help ensure the application will run as intended.

By Richard Campbell (August 2008)
Virtualization isn’t limited to virtual machines and the virtualization of operating systems. Terminal Services has been abstracting the presentation layer of remotely run applications and desktops for years. Take a close look at key improvements to Terminal Services in Windows Server 2008 and get some tips for using these new features.

By Joshua Schnoll (November 2008)
More ...
Read the Blog
With SP1 installed, ConfigMgr works with Windows Server 2008 just as it does with other versions of Windows. The November 2008 issue of TechNet Magazine offers a quick overview ...
Read more!
The much-anticipated release of Windows Server 2008 introduced significant changes to the OS, adding powerful functionality such as server core, server roles,  read-only DCs, Hyper-V, Terminal Services Gateway, and enhancement support for Internet Protocol version 6 (IPv6). While these changes and new features are beneficial, they ...
Read more!
Virtualization is hot nowadays, but Terminal Services has been abstracting the presentation layer of remotely run applications and desktops for years. A lot has changed over the years, and with Windows Server 2008, Terminal Services has truly become a mature, robust presentation virtualization ...
Read more!
If you’re an OpsMgr 2007 administrator, chances are good that you’ll be creating custom monitoring objects (rules, groups, and so forth), and for each one you build, you have to decide what target to use. That’s a critical decision, but knowing how to go about choosing the correct target is not always clear. Steve ...
Read more!
The November 2008 issue of TechNet Magazine is now available online.   FEATURE ARTICLES                                                                   ...
Read more!
It's been about 8 years since Scott Culp published "The 10 Immutable Laws of Security." It is one of the best and most important essays on computer security ...
Read more!
More ...
Windows Administration
Changes to Offline Files in Windows Vista
Jeremy Moskowitz
 
At a Glance:
  • Online and offline continuity
  • File availability
  • How offline folders are evolving

One of the toughest problems in desktop management is letting offline users work just as if they were working online. The need is greater than you might think—users are a lot more mobile than they were even five years ago. Though there are a number of cases where you might need to work
offline, the three most common are when you disconnect your laptop from the office network and go on the road, when you connect over a slow or intermittent link, and when your branch office loses connectivity to the main office.
In these circumstances, how do you maintain a copy of a file on the offline computer while the original is on the main server? More importantly, how do you handle a conflict if someone in the home office changes the file on the server while someone else changes it on the road? Fortunately, these issues are handled by the Offline Files engine, which is built into Windows® 2000, Windows XP, and Windows Vista®.

Caching Is the Answer
The Offline Files engine is really a giant caching machine. Indeed, underneath the hood (and inside Microsoft) it's referred to as client-side caching (CSC). The Offline Files engine is configurable and flexible enough to let users decide what they want to cache as well as help you get the system to cache what you want. It allows you to access the same files offline as online—and the namespace doesn't change. That is, files are accessed using the same UNC path or drive letter whether you're working online or offline.
You can set up the files to be cached either manually or automatically. If you know you often use particular files or folders while on the road, you can simply designate a file or folder as one that will travel with you. To do this, a Windows XP user would right-click on a file that is stored locally or on a network share and select the option to make files available offline (see Figure 1). In Windows Vista the option is called Always available offline. Manually making a file available offline is sometimes called pinning a file.
Figure 1 Making a file available offline (Click the image for a larger view)
Figure 1a The Offline Files Folder 
The share you're using can be connected via UNC path or mapped with a drive letter. Indeed, the file doesn't even need to be one that's stored on a machine running Windows Server®. It can reside on anything that serves up the SMB (Server Message Block) protocol, such as a Samba server or NAS device (with some rare exceptions), which also adhere to the SMB protocol.
The first time you choose to pin a file, Windows XP walks you through a series of wizard screens, asking when to synchronize. If you click Next on every screen and take the defaults, synchronization happens every time you log on or log off, and also in the background when idle. When the wizard completes, you'll see an icon change indicating that the file is now available offline.
Once you disconnect from the network, all other files on the share become unavailable except those chosen for offline use. That's sometimes problematic: the icon shows which files are always available offline, but it's not immediately clear before you've disconnected that not all the other files will be available. I'll discuss this in more detail later in the article.
Making files available offline manually has its merits, but sometimes it makes sense to do it in a more automated manner. I'll explore that scenario next, using what's often called autocaching.

When Automatic Caching Beats Manual Caching
Autocaching is set up on a server on a share-by-share basis. So if you have a share called Sales and want to let salespeople take their files with them as they travel, you can instruct the CSC engine to do that. Figure 2 shows the Offline Settings dialog that appears when you click the Caching tab in Windows Server 2003. The settings are explained in Figure 3.
Figure 2 Offline Settings dialog in Windows Server 2003 (Click the image for a larger view)
To see how autocaching works, let's assume you have a Sales share with 10 files in it—Sales01.txt through Sales10.txt—and that you've enabled the setting called All files and programs that users open from the share will be automatically available offline. The results are not immediately obvious. To the user, there's no outward sign that more files are suddenly available to them offline. Plus, only files that are opened by Windows (and hence cached) are later available to be used offline. In short, you need to actually open the files online that you want to use offline before actually disconnecting from the network. Otherwise, they won't be available offline when you need them.
Moreover, files that are autocached won't necessarily stay around forever in the cache. Windows XP and Windows Vista handle this temporary space a little differently, but the key point is that files can be ejected based on space constraints. Files are kept on an as-used basis. Those that haven't been opened in a while are ejected to make space for new files as those are opened. So, while there's a high probability that a file you recently touched is still in the cache, don't assume that autocaching guarantees that files are available. If you want to be sure a file is available, you need to pin the file. As the administrator, you can also use Group Policy to pin files with the Administratively assigned offline files setting.
Let's take a look at an actual working example. Suppose that a Windows XP user named EastSalesUser1 opened up a file named Sales05.txt and a Windows Vista user named EastSalesUser2 opened up Sales05.txt on the \\server\sales share.
Because autocaching has been set on the sales share, when the EastSalesUser1 (on Windows XP) and EastSalesUser2 (on Windows Vista) went offline, those files could still be worked on. Windows has stored a copy of those files in the Offline Files cache. But what about the other files the users haven't yet used?
Windows XP and Windows Vista have a different reaction to files left behind at the office, as you can see inFigures 4 and 5. Windows XP makes no indication that there even were files left behind uncached. When you go offline, those files just disappear in a potentially confusing manner. Windows Vista, in contrast, has an icon overlay and shows a little dimmed X against files that haven't been cached. This is a huge leap forward in showing which files are available offline. The only problem is, you only see it after disconnecting, not during an online session. So making a file's status more explicit would be a hugely welcome addition.
Figure 4 Windows XP only shows available files after going offline (Click the image for a larger view)
Figure 5 Windows Vista shows the unavailable files while offline (Click the image for a larger view)

Available—or Not
Some administrators are hesitant to take advantage of Offline Files, precisely because of the potential confusion: which files are definitely available offline and which are not, and how you can tell. In Figure 5, the green circle icon over sales01.txt indicates that the file is guaranteed to be available. (Again, when files are pinned, the file is guaranteed to be available offline.)
However, as I explained, Sales05.txt, which both Windows XP and Windows Vista have made available offline via autocache, is not necessarily available offline. Remember, only the files you touch will be available offline. So it would be better if the system indicated that the files are temporarily or possibly available offline. Since there is no icon differentiation, determining which files will be available offline can be confusing. The Windows Vista UI is better, but it still takes a keen eye to spot. An Explorer property in Windows Vista titled Offline Availability does provide availability information. That property is displayed in the preview pane when an item is selected. If the item is pinned, the value is "Always available." If not pinned but cached, the value is "Available."
The idea of temporarily available offline files is similar for Windows XP and Windows Vista, but the implementations are slightly different. Figure 6 shows how Windows XP and Windows Vista handle offline files.
Figure 6 Windows XP and Windows Vista offline file areas 
To put it simply, both Windows XP and Windows Vista have one place in which to hold Offline Files, but the Always Available Offline files and the Temporarily Available Offline files are stored a little differently for each operating system.
For Windows XP, files that are always available offline (designated by the icon change as seen in Figure 1) are placed where they stay forever. If you pin 10GB of files manually, thereby making them Always Available Offline, all 10GB would always be available. There is no limit to the number of files a user can pin (outside of the maximum partition size). However, Windows XP has a 2GB maximum for autocached files. The idea is that only files that are routinely opened are stored here while those that haven't been used for a while are kicked out when necessary. By default, the Temporary Available Cache is allocated 10 percent of the free space on the hard drive, as shown in Figure 7. This setting is only available to administrators on Windows XP.
Figure 7 Setting disk space for offline files in Windows XP 
Windows Vista can also store files permanently or temporarily. However, there's a difference. The Temporary Files Cache is contained within the overall cache. By default, the entire cache (both Temporary Files and Always Available Offline files) is limited to 25 percent of the free space on the hard drive. The reason this was changed is because in Windows XP a user could keep manually caching files (perhaps multiple tens of gigabytes)—and run right out of hard drive space. With the new scheme, the administrator sets aside a specific amount of space for the entire cache so that can't happen. When you look at Figure 8, note that the 25 percent of the free space on the drive is confusingly shown as 15.2 percent of the whole drive. Note also that the second slider, which sets the temporary space, can never be set higher than the first slider, which sets maximum space of all offline files. These Offline Files Disk Usage Limits sliders are accessed by clicking the Change Limits option, but be aware that you need administrator credentials to do this.
Figure 8 Space available for offline files in Windows Vista 

Preventing Too Much Caching
Folder Redirection is another Windows feature that lets you ensure that certain key folders normally local on the machine are actually stored on servers. The idea is that you don't have to worry if that local machine goes belly-up; you've got a copy of important files on a network share.
Suppose you have a redirected My Documents folder (for Windows XP) or Documents folder (for Windows Vista). In this case (in fact when any folder is redirected), the operating system assumes you always want these files available offline and every file within the redirected folder will receive the symbol shown in Figure 1. The downside is that if you're on a well-connected, always-online network and you roam to a new machine, you're caching the entire contents of the redirected folder on the new machine—even if you only plan to use it for one session. Not only is this a waste of space, it's a security risk if not properly handled.
Another case where files are automatically and unknowingly cached is when you use Windows Explorer to browse the files on a share. If you merely look at a gaggle of, say, graphic files on a network share with Explorer and autocache is turned on, it's very likely those files will be automatically downloaded and placed into your cache. That's because using Explorer to touch a file is pretty much all it takes to put it into the temporarily offline cache. Often every file in the share is touched to get metadata such as file size or a preview of an image. When this happens over a fast, well-connected link, it's no big deal. Windows quickly and quietly caches the file for later use. But when you're connected to that network share with autocache over a slow link, things can really get bogged down. The situation is basically unchanged by default for Windows XP Explorer and Windows Vista Explorer. The good news is that the Windows Vista Offline Caching engine can be trained to better recognize a slow link.

Offline Files with Group Policy
Top Changes to Windows Vista Offline Files
The Offline Files team members want you to know about their favorite changes, but there wasn't room to explore all of them in the article. So, in a nutshell, here are the major changes in Offline Files:
  1. Seamless offline-to-online transitions means that open handles no longer block transition.
  2. Per-file offline granularity so one offline share no longer takes the entire server offline.
  3. Forced offline mode via a Work online\offline button in Windows Explorer.
  4. Per-user encryption of cached content.
  5. New synchronization engine that's much faster at detecting and analyzing changes.
  6. Integration with Windows Search so that redirected folders can be indexed.
  7. Local-to-remote synchronization can leverage Differential Bitmap Transfer feature.
  8. Deferred conflict resolution via Sync Center.
  9. Notification area balloons are gone; no longer bother user.
  10. New comprehensive COM API and WMI support for management; documented on MSDN® at msdn2.microsoft.com/bb530662.
  11. Script support through a WMI provider (which will be documented on MSDN shortly).
  12. New shell item properties Offline Status and Offline Availability.
  13. Ghosting to represent unavailable namespace elements while offline. Explorer displays these as dimmed items with a gray X overlay, helping to avoid drastic shell folder view changes when transitioning from online to offline.
  14. New Control Panel applet.
You'll find lots of information on these in my book and in Microsoft documentation, if you decide you want to learn more.

As we noted, whenever a user (or Explorer) touches a file, the whole file is brought into the cache. And if that file is an 80MB Visio® or Word document, so be it. Both Windows XP and Windows Vista understand what a slow link is. Indeed, by default, Windows XP thinks a slow link is 64Kbps. If the connection speed is greater than this and the client is Windows XP, that file is brought down through that slow pipeline at logon time, much to the dismay of the user. So it's best to configure Windows to better manage what to do over that slow link. As you'll see in a moment, you can accomplish this via Group Policy by creating a Group Policy Object (GPO) to be linked to an organizational unit (OU) that contains the target accounts—Windows XP or Windows Vista.
When the user connects over a slow link, Windows XP tries to use the locally cached files before attempting to use the network copy. This makes sense. But Windows XP still does something you might not expect: it downloads big files the user does not yet have in the cache if the user opens them from the network or Explorer touches them. Ouch. And, in my testing, if synchronization is scheduled to happen at logoff (the default), the remainder of those files are then downloaded over the slow link and put into the cache. (Double ouch.)
Windows Vista behavior is different. It doesn't recognize any situation as slow by default. Indeed, if you connect over a tin can, getting 1-bit per second, Windows Vista treats that connection as fast and uses the copy of the files on the network. But Windows Vista can be trained to understand what shares you want to designate to transition when the connection is slow. When such a scenario occurs, things get a little better. The Windows Vista behavior (once configured using Group Policy) is such that the contents of slow-link-defined shares are simply not available over a slow link using normal file and Explorer operations.
The background synchronization performed by the Offline Files service does not occur over a slow connection. However, it should be noted that manual synchronization can be performed via Sync Center.
Configuring Windows Vista to modify its handling of slow links is done via the Group Policy setting Configure Slow-link Mode (not to be confused with the similarly named Windows XP setting Configure Slow Link Speed). Configure Slow-link Mode takes the following values: the names of servers and shares you want to automatically transition to offline when the connection is slow, and how slow that connection needs to be before that server\share combination goes offline. The server\share combination can be any combination of \\server\share or even just a single star (*) to indicate all shares on all servers. The second set of values is a declaration of the throughput (in kbps) and latency (in milliseconds) that has to be crossed in order to be declared slow. Here's the scoop, though: the more useful of the pair (throughput) does not get checked when downloading files. So if you have 10GB of files in a redirected Documents folder and you're on a slow link on a laptop that doesn't yet contain any of those files—be prepared for a long wait. However, if you pair it up with the latency check, and the latency dips below the prescribed value, the share will transition to offline, sparing the user the painful delay of waiting for those files.
The Windows Vista hotfix in Knowledge Base article 934202 (a change that's slated for inclusion with Windows Vista Service Pack 1) should improve performance over certain slow VPN conditions. (This article is available online at support.microsoft.com/kb/934202.) In fact, this hotfix should enable the throughput value to be checked when downloading occurs over a slow link.

Synchronization Conflicts
You're probably wondering what happens if someone changed a file offline (say, while on an airplane), while another person changed it online (hardwired at the main-office). This situation is handled at the client level. When you transition from offline to online, the Windows Vista Offline Files background synchronization occurs immediately. Then you're prompted about what to do (through an entry in the Sync Center after an icon appears in the taskbar notification area). The user interface has been redesigned to show that one file seems to be newer and to show more information about the collision. A user can preserve files with collisions by choosing to rename the file that's currently only on his machine when saving it back on the server, as in Figure 9.
Figure 9 Windows Vista file change conflict notice (Click the image for a larger view)

Want to Learn More?
Offline Files is a nice feature for both you and your users. Indeed, if you're using Folder Redirection, you're already using it, so getting smarter about it is in your best interest. I've mentioned a number of changes to Offline Files in Windows Vista, but not all of them. For more on this, see the sidebar "Top Changes to Windows Vista Offline Files."
You'll find a lot more information about Offline Files online at go.microsoft.com/fwlink/?LinkId=98141 for Windows XP and go.microsoft.com/fwlink/?LinkId=98138 for Windows Vista.
There's also a huge section dedicated to Offline Files—including the ins and outs of every Group Policy setting—in my book (see the bio at the end of the article). Finally, for even more information and to talk with others about your Offline Files experiences, spend some time at GPanswers.com in the community forum where there's a section dedicated to just this topic.

Jeremy Moskowitz MCSE and MVP in Group Policy, runs GPanswers.com, a community forum on Group Policy. He also runs a series of Group Policy intensive training workshops. His latest book is Group Policy: Management, Troubleshooting, and Security (Sybex, 2007). Contact Jeremy and learn more at www.GPanswers.com.
© 2008 Microsoft Corporation and CMP Media, LLC. All rights reserved; reproduction in part or in whole without permission is prohibited.
Page view tracker