What’s Changed in This Release Candidate of Windows Server 2008 R2

Applies To: Windows Server 2008 R2

This document describes key changes to functionality between the beta and Release Candidate (RC) of Windows Server® 2008 R2.

Unless otherwise specified, these items apply to all editions and installation options of Windows Server 2008 R2.

In this document:

• Core services

• Networking and mobility

• Security

• Server management

• Miscellaneous

Core services

Networking and mobility

DirectAccess

This item applies to Windows Server 2008 R2 Standard, Windows Server 2008 R2 Enterprise, and Windows Server 2008 R2 Datacenter.

DirectAccess includes many improvements in smart card use, diagnostics, and user experience:

• Smart cards. Smart card support no longer requires Windows Server 2008 R2 Domain Functional Mode. Smart card management has been simplified to focus on edge enforcement (rather than edge enforcement and local client enforcement). Beta feedback suggested that the local client enforcement option could create an increased number of support issues for organizations. Therefore, the option to enforce smart cards for all interactive logins is no longer available in the DirectAccess Wizard. Also, if a smart card is required, there is an enhanced user notification that is provided to help the user learn when a smart card is required.

  

• Troubleshooting. Support for troubleshooting is enhanced, including a Windows Troubleshooting entry point within Control Panel. If a resource is not reachable (for example, a Web site fails to load), use Diagnose Connection in Internet Explorer or Troubleshoot problems entry points to help determine the cause of the issue.

  

• User experience. Corporate Connectivity Notification has been removed to simplify the user experience; only Internet Access is displayed. If a resource is not reachable, the user should use the troubleshooting features to determine the reason.

For more information, see the DirectAccess (https://go.microsoft.com/fwlink/?LinkId=150441) home page on Microsoft® TechNet.

Security

User Account Control

In the beta release, a user could change the notification level in the User Account Control (UAC) control panel without receiving a prompt for administrative credentials. The UAC control panel now runs in a high integrity process—changing the level of the UAC prompts for confirmation. When a user is logged on with a standard user account, that user must provide administrative credentials to change the default UAC notification level.

AppLocker

• The AppLocker UI includes a new administrative template, which can be configured by an administrator to display a customized URL when AppLocker blocks an application from starting. The message can be used to reduce help desk calls by directing users to a help desk intranet site.

  To customize the administrative template, follow these steps:

  1. Open the Group Policy Management snap-in, right-click a Group Policy object (GPO), and then click Edit.

  2. In the Group Policy Management Editor snap-in, expand Administrative Templates, expand Windows Components, and then click Windows Explorer.

  3. In the details pane, under Setting, double-click Set a support web page link.

  4. Select Enabled, and then type a custom URL in the Support Web page URL text box.

     

  5. Click OK.

• New Windows PowerShell cmdlets, used in conjunction with the AppLocker UI, provide building blocks that help author, test, maintain, and troubleshoot AppLocker policies. These cmdlets allow an organization to build and import new AppLocker rules from event log information collected by running AppLocker in audit mode. As a result, these cmdlets help automate the IT processes required to build appropriate rule sets easily and confidently.

Print administrator delegation

On computers running Windows 7, the default permissions do not allow non-administrative users to perform any print administrative operations.

An administrator can now again delegate specific printer administrative tasks to non-administrative users, thereby reducing costs. No security risks are introduced because non-administrative personnel are not granted system administrative rights.

To add a printer by IP address or hostname, you must be a member of the local Administrators group or be granted the Manage Server permission.

Server management

Windows Remote Management and Windows PowerShell remoting

The default HTTP/HTTPS ports for Windows Remote Management (WinRM) and Windows PowerShell remoting have changed from 80/443 to 5985/5986 since the Beta release. This change provides a more secure default configuration by avoiding accidental exposure of the WinRM interface to Web traffic on an Internet-facing server.

As a result of this change, pre-RC and post-RC computers that are not configured properly cannot communicate. When pre-RC and post-RC computers are used together for remote management, either directly (by using the WinRM command-line tool or the WSMan APIs) or through an application that uses WinRM (such as Windows PowerShell or Event Collector), an error message occurs. This is the same error message that displays when the server has not been configured for WinRM traffic, because it is contacting the wrong port.

To avoid this issue, upgrade all computers by installing Windows 7 or Windows Server 2008 R2 or by installing WinRM 2.0.

Server Migration Tools

Server Migration Tools cmdlets now support the following migration scenarios:

• IPv6 configuration migration

• BranchCache feature migration

These improvements ease the process of migrating server roles, operating system settings, and data from an existing server that is running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 to a computer that is running Windows Server 2008 R2. For more information, see the BranchCache Migration Guide and the updated IP Configuration Migration Guide on the TechNet Migration portal (https://go.microsoft.com/fwlink/?LinkID=128554).

Miscellaneous

Hyper-V technology

Hyper-V™ technology provides processor compatibility settings to make it easier to use an older operating system and to make it easier to perform a live migration of a virtual machine to another physical computer with a different processor version. The Migrate to a physical computer with a different processor version setting ensures that the virtual machine uses only the features of the processor that are available on all versions of a virtualization-capable processor by the same processor manufacturer. It does not provide compatibility between different processor manufacturers. The setting is useful for high availability and backup and recovery scenarios because it makes it easier to move a highly available virtual machine to another node in a cluster or restore the virtual machine to different hardware.