Move "Windows To Go" files to officearchive-pr (ADO task 8098862)
The articles about "Windows To Go" are moved to /officearchive-pr/windows-10/deployment/ and /officearchive-pr/windows-10/deployment/planning/. This relocation is for ADO task 8098862.
@ -311,23 +311,6 @@
|
|||||||
href: configure-a-pxe-server-to-load-windows-pe.md
|
href: configure-a-pxe-server-to-load-windows-pe.md
|
||||||
- name: Windows ADK for Windows 10 scenarios for IT Pros
|
- name: Windows ADK for Windows 10 scenarios for IT Pros
|
||||||
href: windows-adk-scenarios-for-it-pros.md
|
href: windows-adk-scenarios-for-it-pros.md
|
||||||
- name: Windows To Go
|
|
||||||
items:
|
|
||||||
- name: Deploy Windows To Go in your organization
|
|
||||||
href: deploy-windows-to-go.md
|
|
||||||
- name: "Windows To Go: feature overview"
|
|
||||||
href: planning/windows-to-go-overview.md
|
|
||||||
- name: Best practice recommendations for Windows To Go
|
|
||||||
href: planning/best-practice-recommendations-for-windows-to-go.md
|
|
||||||
- name: Deployment considerations for Windows To Go
|
|
||||||
href: planning/deployment-considerations-for-windows-to-go.md
|
|
||||||
- name: Prepare your organization for Windows To Go
|
|
||||||
href: planning/prepare-your-organization-for-windows-to-go.md
|
|
||||||
- name: Security and data protection considerations for Windows To Go
|
|
||||||
href: planning/security-and-data-protection-considerations-for-windows-to-go.md
|
|
||||||
- name: "Windows To Go: frequently asked questions"
|
|
||||||
href: planning/windows-to-go-frequently-asked-questions.yml
|
|
||||||
|
|
||||||
- name: Volume Activation Management Tool (VAMT) technical reference
|
- name: Volume Activation Management Tool (VAMT) technical reference
|
||||||
items:
|
items:
|
||||||
- name: VAMT technical reference
|
- name: VAMT technical reference
|
||||||
|
@ -1,50 +0,0 @@
|
|||||||
---
|
|
||||||
title: Best practice recommendations for Windows To Go (Windows 10)
|
|
||||||
description: Learn about best practice recommendations for using Windows To Go, like using a USB 3.0 port with Windows to Go if it's available.
|
|
||||||
manager: aaroncz
|
|
||||||
ms.author: frankroj
|
|
||||||
ms.prod: windows-client
|
|
||||||
author: frankroj
|
|
||||||
ms.topic: article
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.date: 10/28/2022
|
|
||||||
---
|
|
||||||
|
|
||||||
# Best practice recommendations for Windows To Go
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
The following are the best practice recommendations for using Windows To Go:
|
|
||||||
|
|
||||||
- Always shut down Windows and wait for shutdown to complete before removing the Windows To Go drive.
|
|
||||||
- Do not insert the Windows To Go drive into a running computer.
|
|
||||||
- Do not boot the Windows To Go drive from a USB hub. Always insert the Windows To Go drive directly into a port on the computer.
|
|
||||||
- If available, use a USB 3.0 port with Windows To Go.
|
|
||||||
- Do not install non-Microsoft core USB drivers on Windows To Go.
|
|
||||||
- Suspend BitLocker on Windows host computers before changing the BIOS settings to boot from USB and then resume BitLocker protection.
|
|
||||||
|
|
||||||
Additionally, we recommend that when you plan your deployment you should also plan a standard operating procedure for answering questions about which USB drives can be used for Windows To Go and how to enable booting from USB to assist your IT department or help desk in supporting users and work groups that want to use Windows To Go. It may be very helpful for your organization to work with your hardware vendors to create an IT standard for USB drives for use with Windows To Go, so that if groups within your organization want to purchase drives they can quickly determine which ones they should obtain.
|
|
||||||
|
|
||||||
## More information
|
|
||||||
|
|
||||||
|
|
||||||
[Windows To Go: feature overview](windows-to-go-overview.md)<br>
|
|
||||||
[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)<br>
|
|
||||||
[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)<br>
|
|
||||||
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)<br>
|
|
||||||
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)<br>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,179 +0,0 @@
|
|||||||
---
|
|
||||||
title: Deployment considerations for Windows To Go (Windows 10)
|
|
||||||
description: Learn about deployment considerations for Windows To Go, such as the boot experience, deployment methods, and tools that you can use with Windows To Go.
|
|
||||||
manager: aaroncz
|
|
||||||
ms.author: frankroj
|
|
||||||
ms.prod: windows-client
|
|
||||||
author: frankroj
|
|
||||||
ms.topic: article
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.date: 10/28/2022
|
|
||||||
---
|
|
||||||
|
|
||||||
# Deployment considerations for Windows To Go
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Windows To Go does not support operating system upgrades. Windows To Go is designed as a feature that is managed centrally. IT departments that plan to transition from one operating system version to a later version will need to incorporate re-imaging their existing Windows To Go drives as part of their upgrade deployment process.
|
|
||||||
|
|
||||||
The following sections discuss the boot experience, deployment methods, and tools that you can use with Windows To Go.
|
|
||||||
|
|
||||||
- [Initial boot experiences](#wtg-initboot)
|
|
||||||
- [Image deployment and drive provisioning considerations](#wtg-imagedep)
|
|
||||||
- [Application installation and domain join](#wtg-appinstall)
|
|
||||||
- [Management of Windows To Go using Group Policy](#bkmk-wtggp)
|
|
||||||
- [Supporting booting from USB](#wtg-bootusb)
|
|
||||||
- [Updating firmware](#stg-firmware)
|
|
||||||
- [Configure Windows To Go startup options](#wtg-startup)
|
|
||||||
- [Change firmware settings](#wtg-changefirmware)
|
|
||||||
|
|
||||||
## <a href="" id="wtg-initboot"></a>Initial boot experiences
|
|
||||||
|
|
||||||
The following diagrams illustrate the two different methods you could use to provide Windows To Go drives to your users. The experiences differ depending on whether the user will be booting the device initially on-premises or off-premises:
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
When a Windows To Go workspace is first used at the workplace, the Windows To Go workspace can be joined to the domain through the normal procedures that occur when a new computer is introduced. It obtains a lease, applicable policies are applied and set, and user account tokens are placed appropriately. BitLocker protection can be applied and the BitLocker recovery key automatically stored in Active Directory Domain Services. The user can access network resources to install software and get access to data sources. When the workspace is subsequently booted at a different location either on or off premises, the configuration required for it to connect back to the work network using either DirectAccess or a virtual private network connection can be configured. It isn't necessary to configure the workspace for offline domain join. DirectAccess can make connecting to organizational resources easier, but isn't required.
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee's home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized.
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn306081(v=ws.11)).
|
|
||||||
|
|
||||||
DirectAccess can be used to ensure that the user can log in with their domain credentials without needing a local account. For instructions on setting up a DirectAccess solution, for a small pilot deployment see [Deploy a Single Remote Access Server using the Getting Started Wizard](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831520(v=ws.11)) for a larger scale deployment, see [Deploy Remote Access in an Enterprise](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134200(v=ws.11)). If you don't want to use DirectAccess as an alternative user could log on using a local user account on the Windows To Go workspace and then use a virtual private network for remote access to your organizational network.
|
|
||||||
|
|
||||||
### <a href="" id="wtg-imagedep"></a>Image deployment and drive provisioning considerations
|
|
||||||
|
|
||||||
The Image Deployment process can be accomplished either by a centralized IT process for your organization or by individual users creating their own Windows To Go workspaces. You must have local Administrator access and access to a Windows 10 Enterprise or Windows 10 Education image to create a Windows To Go workspace, or you must be using Configuration Manager Service Pack 1 or later to distribute Windows To Go workspaces to users. The image deployment process takes a blank USB drive and a Windows 10 Enterprise image (WIM) and turns it into a Windows To Go drive.
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
The simplest way to provision a Windows To Go drive is to use the Windows To Go Creator. After a single Windows To Go workspace has been created, it can be duplicated as many times as necessary using widely available USB duplicator products as long as the device hasn't been booted. After the Windows To Go drive is initialized, it shouldn't be duplicated. Alternatively, Windows To Go Workspace Creator can be run multiple times to create multiple Windows To Go drives.
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> When you create your Windows To Go image use sysprep /generalize, just as you do when you deploy Windows 10 to a standard PC. In fact, if appropriate, use the same image for both deployments.
|
|
||||||
|
|
||||||
**Driver considerations**
|
|
||||||
|
|
||||||
Windows includes most of the drivers that you'll need to support a wide variety of host computers. However, you'll occasionally need to download drivers from Windows Update to take advantage of the full functionality of a device. If you're using Windows To Go on a set of known host computers, you can add any more drivers to the image used on Windows To Go to make Windows To Go drives more quickly usable by your employees. Especially ensure that network drivers are available so that the user can connect to Windows Update to get more drivers if necessary.
|
|
||||||
|
|
||||||
Wi-Fi network adapter drivers are one of the most important drivers to make sure that you include in your standard image so that users can easily connect to the internet for any additional updates. IT administrators that are attempting to build Windows 10 images for use with Windows To Go should consider adding additional Wi-Fi drivers to their image to ensure that their users have the best chance of still having basic network connectivity when roaming between systems.
|
|
||||||
|
|
||||||
The following list of commonly used Wi-Fi network adapters that aren't supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image.
|
|
||||||
|
|
||||||
|Vendor name|Product description|HWID|Windows Update availability|
|
|
||||||
|--- |--- |--- |--- |
|
|
||||||
|Broadcom|802.11abgn Wireless SDIO adapter|sd\vid_02d0&pid_4330&fn_1|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00d6106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00f5106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00ef106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00f4106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_010e106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00e4106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_433114e4&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_010f106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
|
|
||||||
|Marvell|Yukon 88E8001/8003/8010 PCI Gigabit Ethernet|pci\ven_11ab&dev_4320&subsys_811a1043|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619080)<br>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619082)|
|
|
||||||
|Marvell|Libertas 802.11b/g Wireless|pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619128)<br>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619129)|
|
|
||||||
|Qualcomm|Atheros AR6004 Wireless LAN Adapter|sd\vid_0271&pid_0401|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619086)<br>64-bit driver not available|
|
|
||||||
|Qualcomm|Atheros AR5BWB222 Wireless Network Adapter|pci\ven_168c&dev_0034&subsys_20031a56|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619348)<br>64-bit driver not available|
|
|
||||||
|Qualcomm|Atheros AR5BWB222 Wireless Network Adapter|pci\ven_168c&dev_0034&subsys_020a1028&rev_01|Contact the system OEM or Qualcom for driver availability.|
|
|
||||||
|Qualcomm|Atheros AR5005G Wireless Network Adapter|pci\ven_168c&dev_001a&subsys_04181468&rev_01|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619349)<p>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619091)|
|
|
||||||
|Ralink|Wireless-G PCI Adapter|pci\ven_1814&dev_0301&subsys_00551737&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619092)<p>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619093)|
|
|
||||||
|Ralink|Turbo Wireless LAN Card|pci\ven_1814&dev_0301&subsys_25611814&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619094)<p>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619095)|
|
|
||||||
|Ralink|Wireless LAN Card V1|pci\ven_1814&dev_0302&subsys_3a711186&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619097)<p>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619098)|
|
|
||||||
|Ralink|D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)|pci\ven_1814&dev_0302&subsys_3c091186&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619099)<p>[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619100)|
|
|
||||||
|
|
||||||
IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that isn't supported by class drivers. Some consumer devices require OEM-specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825212(v=win.10)).
|
|
||||||
|
|
||||||
### <a href="" id="wtg-appinstall"></a>Application installation and domain join
|
|
||||||
|
|
||||||
Unless you're using a customized Windows image that includes unattended installation settings, the initial Windows To Go workspace won't be domain joined and won't contain applications. This is exactly like a new installation of Windows on a desktop or laptop computer. When planning your deployment, you should develop methods to join Windows to Go drives to the domain and install the standard applications that users in your organization require. These methods probably will be similar to the ones used for setting up desktop and laptop computers with domain privileges and applications
|
|
||||||
|
|
||||||
### <a href="" id="bkmk-wtggp"></a>Management of Windows To Go using Group Policy
|
|
||||||
|
|
||||||
In general, management of Windows To Go workspaces is same as that for desktop and laptop computers. There are Windows To Go specific Group Policy settings that should be considered as part of Windows To Go deployment. Windows To Go Group Policy settings are located at `\\Computer Configuration\Administrative Templates\Windows Components\Portable Operating System\` in the Local Group Policy Editor.
|
|
||||||
|
|
||||||
The use of the Store on Windows To Go workspaces that are running Windows 8 can also be controlled by Group Policy. This policy setting is located at `\\Computer Configuration\Administrative Templates\Windows Components\Store\` in the Local Group Policy Editor. The policy settings have specific implications for Windows To Go that you should be aware of when planning your deployment:
|
|
||||||
|
|
||||||
**Settings for workspaces**
|
|
||||||
|
|
||||||
- **Allow hibernate (S4) when started from a Windows To Go workspace**
|
|
||||||
|
|
||||||
This policy setting specifies whether the PC can use the hibernation sleep state (S4) when started from a Windows To Go workspace. By default, hibernation is disabled when using Windows To Go workspace, so enabling this setting explicitly turns this ability back on. When a computer enters hibernation, the contents of memory are written to disk. When the disk is resumed, it's important that the hardware attached to the system, and the disk itself, are unchanged. This is inherently incompatible with roaming between PC hosts. Hibernation should only be used when the Windows To Go workspace isn't being used to roam between host PCs.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> For the host-PC to resume correctly when hibernation is enabled the Windows To Go workspace must continue to use the same USB port.
|
|
||||||
|
|
||||||
- **Disallow standby sleep states (S1-S3) when starting from a Windows To Go workspace**
|
|
||||||
|
|
||||||
This policy setting specifies whether the PC can use standby sleep states (S1–S3) when started from a Windows To Go workspace. The Sleep state also presents a unique challenge to Windows To Go users. When a computer goes to sleep, it appears as if it's shut down. It could be easy for a user to think that a Windows To Go workspace in sleep mode was actually shut down and they could remove the Windows To Go drive and take it home. Removing the Windows To Go drive in this scenario is equivalent to an unclean shutdown, which may result in the loss of unsaved user data or the corruption on the drive. Moreover, if the user now boots the drive on another PC and brings it back to the first PC, which still happens to be in the sleep state, it will lead to an arbitrary crash and eventually corruption of the drive and result in the workspace becoming unusable. If you enable this policy setting, the Windows To Go workspace can't use the standby states to cause the PC to enter sleep mode. If you disable or don't configure this policy setting, the Windows To Go workspace can place the PC in sleep mode.
|
|
||||||
|
|
||||||
**Settings for host PCs**
|
|
||||||
|
|
||||||
- **Windows To Go Default Startup Options**
|
|
||||||
|
|
||||||
This policy setting controls whether the host computer will boot to Windows To Go if a USB device containing a Windows To Go workspace is connected, and controls whether users can make changes using the **Windows To Go Startup Options** settings dialog. If you enable this policy setting, booting to Windows To Go when a USB device is connected will be enabled and users won't be able to make changes using the **Windows To Go Startup Options** settings dialog. If you disable this policy setting, booting to Windows To Go when a USB device is connected won't be enabled unless a user configures the option manually in the firmware. If you don't configure this policy setting, users who are members of the local Administrators group can enable or disable booting from USB using the **Windows To Go Startup Options** settings dialog.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Enabling this policy setting will cause PCs running Windows to attempt to boot from any USB device that is inserted into the PC before it is started.
|
|
||||||
|
|
||||||
## <a href="" id="wtg-bootusb"></a>Supporting booting from USB
|
|
||||||
|
|
||||||
The biggest hurdle for a user wanting to use Windows To Go is configuring their computer to boot from USB. This is traditionally done by entering the firmware and configuring the appropriate boot order options. To ease the process of making the firmware modifications required for Windows To Go, Windows includes a feature named **Windows To Go Startup Options** that allows a user to configure their computer to boot from USB from within Windows—without ever entering their firmware, as long as their firmware supports booting from USB.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Enabling a system to always boot from USB first has implications that you should consider. For example, a USB device that includes malware could be booted inadvertently to compromise the system, or multiple USB drives could be plugged in to cause a boot conflict. For this reason, the Windows To Go startup options are disabled by default. In addition, administrator privileges are required to configure Windows To Go startup options.
|
|
||||||
|
|
||||||
If you're going to be using a Windows 7 computer as a host-PC, see the wiki article [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951).
|
|
||||||
|
|
||||||
### <a href="" id="stg-firmware"></a>Roaming between different firmware types
|
|
||||||
|
|
||||||
Windows supports two types of PC firmware: Unified Extensible Firmware Interface (UEFI), which is the new standard, and legacy BIOS firmware, which was used in most PCs shipping with Windows 7 or earlier version of Windows. Each firmware type has completely different Windows boot components that are incompatible with each other. Beyond the different boot components, Windows supports different partition styles and layout requirements for each type of firmware as shown in the following diagrams.
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
This presented a unique challenge for Windows To Go because the firmware type isn't easily determined by end users—a UEFI computer looks just like a legacy BIOS computer and Windows To Go must boot on both types of firmware.
|
|
||||||
|
|
||||||
To enable booting Windows To Go on both types of firmware, a new disk layout is provided for Windows 8 or later that contains both sets of boot components on a FAT32 system partition and a new command-line option was added to bcdboot.exe to support this configuration. The **/f** option is used with the **bcdboot /s** command to specify the firmware type of the target system partition by appending either **UEFI**, **BIOS** or **ALL**. When creating Windows To Go drives manually, you must use the **ALL** parameter to provide the Windows To Go drive the ability to boot on both types of firmware. For example, on volume H: (your Windows To Go USB drive letter), you would use the command **bcdboot C:\\windows /s H: /f ALL**. The following diagram illustrates the disk layout that results from that command:
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
This is the only supported disk configuration for Windows To Go. With this disk configuration, a single Windows To Go drive can be booted on computers with UEFI and legacy BIOS firmware.
|
|
||||||
|
|
||||||
### <a href="" id="wtg-startup"></a>Configure Windows To Go startup options
|
|
||||||
|
|
||||||
Windows To Go Startup Options is a setting available on Windows 10-based PCs that enables the computer to be booted from a USB without manually changing the firmware settings of the PC. To configure Windows To Go Startup Options, you must have administrative rights on the computer and the **Windows To Go Default Startup Options** Group Policy setting must not be configured.
|
|
||||||
|
|
||||||
**To configure Windows To Go startup options**
|
|
||||||
|
|
||||||
1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and, then press Enter.
|
|
||||||
|
|
||||||

|
|
||||||
|
|
||||||
2. Select **Yes** to enable the startup options.
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog.
|
|
||||||
|
|
||||||
3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**.
|
|
||||||
|
|
||||||
### <a href="" id="wtg-changefirmware"></a>Change firmware settings
|
|
||||||
|
|
||||||
If you choose to not use the Windows To Go startup options or are using a PC running Windows 7 as your host computer, you'll need to manually configure the firmware settings. The process used to accomplish this will depend on the firmware type and manufacturer. If your host computer is protected by BitLocker and running Windows 7, you should suspend BitLocker before making the change to the firmware settings. After the firmware settings have been successfully reconfigured, resume BitLocker protection. If you don't suspend BitLocker first, BitLocker will assume that the computer has been tampered with and will boot into BitLocker recovery mode.
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
[Windows To Go: feature overview](windows-to-go-overview.md)<br>
|
|
||||||
[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)<br>
|
|
||||||
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)<br>
|
|
||||||
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)
|
|
Before Width: | Height: | Size: 5.1 KiB |
Before Width: | Height: | Size: 5.5 KiB |
Before Width: | Height: | Size: 9.9 KiB |
Before Width: | Height: | Size: 2.6 KiB |
Before Width: | Height: | Size: 5.7 KiB |
Before Width: | Height: | Size: 7.2 KiB |
Before Width: | Height: | Size: 29 KiB |
@ -1,106 +0,0 @@
|
|||||||
---
|
|
||||||
title: Prepare your organization for Windows To Go (Windows 10)
|
|
||||||
description: Though Windows To Go is no longer being developed, you can find info here about the what, why, and when of deployment.
|
|
||||||
manager: aaroncz
|
|
||||||
ms.author: frankroj
|
|
||||||
ms.prod: windows-client
|
|
||||||
author: frankroj
|
|
||||||
ms.topic: article
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.date: 10/28/2022
|
|
||||||
---
|
|
||||||
|
|
||||||
# Prepare your organization for Windows To Go
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the "what", "why", and "when" questions an IT professional might have when planning to deploy Windows To Go.
|
|
||||||
|
|
||||||
## What is Windows To Go?
|
|
||||||
|
|
||||||
Windows To Go is a feature of Windows 10 Enterprise and Windows 10 Education that enables users to boot Windows from a USB-connected external drive. Windows To Go drives can use the same image that enterprises use for their desktops and laptops, and can be managed the same way. A Windows To Go workspace isn't intended to replace desktops or laptops, or supplant other mobility offerings.
|
|
||||||
|
|
||||||
Enterprise customers utilizing Volume Activation Windows licensing will be able to deploy USB drives provisioned with Windows To Go workspace. These drives will be bootable on multiple compatible host computers. Compatible host computers are computers that are:
|
|
||||||
|
|
||||||
- USB boot capable
|
|
||||||
- Have USB boot enabled in the firmware
|
|
||||||
- Meet Windows 7 minimum system requirements
|
|
||||||
- Have compatible processor architectures (for example, x86 or AMD64) as the image used to create the Windows To Go workspace. ARM isn't a supported processor for Windows To Go.
|
|
||||||
- Have firmware architecture that is compatible with the architecture of the image used for the Windows To Go workspace
|
|
||||||
|
|
||||||
Booting a Windows To Go workspace requires no specific software on the host computer. PCs certified for Windows 7 and later can host Windows To Go.
|
|
||||||
|
|
||||||
The following articles will familiarize you with how you can use a Windows To Go workspace. They also give you an overview of some of the things you should consider in your design.
|
|
||||||
|
|
||||||
## Usage scenarios
|
|
||||||
|
|
||||||
|
|
||||||
The following scenarios are examples of situations in which Windows To Go workspaces provide a solution for an IT implementer:
|
|
||||||
|
|
||||||
- **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection, or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes.
|
|
||||||
|
|
||||||
- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker. Then they can be assisted with any necessary other user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive. And run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker's personal computer.
|
|
||||||
|
|
||||||
- **Managed free seating.** The employee is issued a Windows To Go drive. This drive is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return, they use the same USB flash drive but use a different host computer.
|
|
||||||
|
|
||||||
- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work. This boot caches the employee's credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity.
|
|
||||||
|
|
||||||
- **Travel lightly.** In this situation, you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace's computer object isn't potentially deleted from Active Directory Domain Services (AD DS).
|
|
||||||
|
|
||||||
## Infrastructure considerations
|
|
||||||
|
|
||||||
Because Windows To Go requires no other software and minimal configuration, the same tools used to deploy images to other PCs can be used by an enterprise to install Windows To Go on a large group of USB devices. Moreover, because Windows To Go is compatible with connectivity and synchronization solutions already in use—such as Remote Desktop, DirectAccess and Folder Redirection—no other infrastructure or management is necessary for this deployment. A Windows To Go image can be created on a USB drive that is identical to the hard drive inside a desktop. However, you may wish to consider making some modifications to your infrastructure to help make management of Windows To Go drives easier and to be able to identify them as a distinct device group.
|
|
||||||
|
|
||||||
## Activation considerations
|
|
||||||
|
|
||||||
Windows To Go uses volume activation. You can use either Active Directory-based activation or KMS activation with Windows To Go. The Windows To Go workspace counts as another installation when assessing compliance with application licensing agreements.
|
|
||||||
|
|
||||||
Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This method is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](/DeployOffice/vlactivation/plan-volume-activation-of-office).
|
|
||||||
|
|
||||||
You should investigate other software manufacturer's licensing requirements to ensure they're compatible with roaming usage before deploying them to a Windows To Go workspace.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Using Multiple Activation Key (MAK) activation isn't a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive.
|
|
||||||
|
|
||||||
For more information about these activation methods and how they can be used in your organization, see [Plan for Volume Activation](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj134042(v=ws.11)).
|
|
||||||
|
|
||||||
## Organizational unit structure and use of Group Policy Objects
|
|
||||||
|
|
||||||
You may find it beneficial to create other Active Directory organizational unit (OU) structures to support your Windows To Go deployment: one for host computer accounts and one for Windows To Go workspace computer accounts. Creating an organizational unit for host computers allows you to enable the Windows To Go Startup Options using Group Policy for only the computers that will be used as Windows To Go hosts. Setting this policy helps to prevent computers from being accidentally configured to automatically boot from USB devices and allows closer monitoring and control of those computers that can boot from a USB device. The organizational unit for Windows To Go workspaces allows you to apply specific policy controls to them, such as the ability to use the Store application, power state controls, and line-of-business application installation.
|
|
||||||
|
|
||||||
If you're deploying Windows To Go workspaces for a scenario in which they're not going to be roaming, but are instead being used on the same host computer, such as with temporary or contract employees, you might wish to enable hibernation or the Windows Store.
|
|
||||||
|
|
||||||
For more information about Group Policy settings that can be used with Windows To Go, see [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
|
|
||||||
|
|
||||||
## Computer account management
|
|
||||||
|
|
||||||
If you configure Windows To Go drives for scenarios where drives may remain unused for extended periods of time such as used in continuance of operations scenarios, the AD DS computer account objects that correspond to Windows To Go drives have the potential to become stale and be pruned during maintenance operations. To address this issue, you should either have users log on regularly according to a schedule, or modify any maintenance scripts to not clean computer accounts in the Windows To Go device organizational unit.
|
|
||||||
|
|
||||||
## User account and data management
|
|
||||||
|
|
||||||
People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to be able to get to the data that they work with, and to keep it accessible when the workspace isn't being used. For this reason, we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user's profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh848267(v=ws.11)).
|
|
||||||
|
|
||||||
Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace.
|
|
||||||
|
|
||||||
## Remote connectivity
|
|
||||||
|
|
||||||
If you want Windows To Go to be able to connect back to organizational resources when it's being used off-premises a remote connectivity solution must be enabled. Windows Server 2012 DirectAccess can be used as can a virtual private network (VPN) solution. For more information about configuring a remote access solution, see the [Remote Access (DirectAccess, Routing and Remote Access) Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn636119(v=ws.11)).
|
|
||||||
|
|
||||||
## Related articles
|
|
||||||
|
|
||||||
|
|
||||||
[Windows To Go: feature overview](windows-to-go-overview.md)
|
|
||||||
|
|
||||||
[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
|
|
||||||
|
|
||||||
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
|
|
||||||
|
|
||||||
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)
|
|
@ -1,68 +0,0 @@
|
|||||||
---
|
|
||||||
title: Security and data protection considerations for Windows To Go (Windows 10)
|
|
||||||
description: Ensure that the data, content, and resources you work with in the Windows To Go workspace are protected and secure.
|
|
||||||
manager: aaroncz
|
|
||||||
ms.author: frankroj
|
|
||||||
ms.prod: windows-client
|
|
||||||
author: frankroj
|
|
||||||
ms.topic: article
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.date: 12/31/2017
|
|
||||||
---
|
|
||||||
|
|
||||||
# Security and data protection considerations for Windows To Go
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure.
|
|
||||||
|
|
||||||
## Backup and restore
|
|
||||||
|
|
||||||
When you don't save data on the Windows To Go drive, you don't need for a backup and restore solution for Windows To Go. If you're saving data on the drive and aren't using folder redirection and offline files, you should back up all of your data to a network location such as cloud storage or a network share, after each work session. Review the new and improved features described in [Supporting Information Workers with Reliable File Services and Storage](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831495(v=ws.11)) for different solutions you could implement.
|
|
||||||
|
|
||||||
If the USB drive fails for any reason, the standard process to restore the drive to working condition is to reformat and reprovision the drive with Windows To Go, so all data and customization on the drive will be lost. This result is another reason why using roaming user profiles, folder redirection, and offline files with Windows To Go is recommended. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh848267(v=ws.11)).
|
|
||||||
|
|
||||||
## BitLocker
|
|
||||||
|
|
||||||
We recommend that you use BitLocker with your Windows To Go drives to protect the drive from being compromised if the drive is lost or stolen. When BitLocker is enabled, the user must provide a password to unlock the drive and boot the Windows To Go workspace. This password requirement helps prevent unauthorized users from booting the drive and using it to gain access to your network resources and confidential data. Because Windows To Go drives are meant to be roamed between computers, the Trusted Platform Module (TPM) can't be used by BitLocker to protect the drive. Instead, you'll be specifying a password that BitLocker will use for disk encryption and decryption. By default, this password must be eight characters in length and can enforce more strict requirements depending on the password complexity requirements defined by your organizations domain controller.
|
|
||||||
|
|
||||||
You can enable BitLocker while using the Windows To Go Creator wizard as part of the drive provisioning process before first use; or it can be enabled afterward by the user from within the Windows To Go workspace.
|
|
||||||
|
|
||||||
> [!Tip]
|
|
||||||
> If the Windows To Go Creator wizard isn't able to enable BitLocker, see [Why can't I enable BitLocker from Windows To Go Creator?](windows-to-go-frequently-asked-questions.yml#why-can-t-i-enable-bitlocker-from-windows-to-go-creator-)
|
|
||||||
|
|
||||||
When you use a host computer running Windows 7 that has BitLocker enabled, suspend BitLocker before changing the BIOS settings to boot from USB and then resume BitLocker protection. If BitLocker isn't suspended first, the next boot of the computer is in recovery mode.
|
|
||||||
|
|
||||||
## Disk discovery and data leakage
|
|
||||||
|
|
||||||
We recommend that you use the **NoDefaultDriveLetter** attribute when provisioning the USB drive to help prevent accidental data leakage. **NoDefaultDriveLetter** will prevent the host operating system from assigning a drive letter if a user inserts it into a running computer. This prevention means the drive won't appear in Windows Explorer and an Auto-Play prompt won't be displayed to the user. This non-display of the drive and the prompt reduces the likelihood that an end user will access the offline Windows To Go disk directly from another computer. If you use the Windows To Go Creator to provision a workspace, this attribute will automatically be set for you.
|
|
||||||
|
|
||||||
To prevent accidental data leakage between Windows To Go and the host system Windows 8 has a new SAN policy—OFFLINE\_INTERNAL - "4" to prevent the operating system from automatically bringing online any internally connected disk. The default configuration for Windows To Go has this policy enabled. It's recommended you do not change this policy to allow mounting of internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 operating system, mounting the drive will lead to loss of hibernation state and, therefore, user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted.
|
|
||||||
|
|
||||||
For more information, see [How to Configure Storage Area Network (SAN) Policy in Windows PE](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825063(v=win.10)).
|
|
||||||
|
|
||||||
## Security certifications for Windows To Go
|
|
||||||
|
|
||||||
Windows to Go is a core capability of Windows when it's deployed on the drive and is configured following the guidance for the applicable security certification. Solutions built using Windows To Go can be submitted for more certifications by the solution provider that cover the solution provider's specific hardware environment. For more information about Windows security certifications, see the following articles.
|
|
||||||
|
|
||||||
- [Windows Platform Common Criteria Certification](/windows/security/threat-protection/windows-platform-common-criteria)
|
|
||||||
|
|
||||||
- [FIPS 140 Evaluation](/windows/security/threat-protection/fips-140-validation)
|
|
||||||
|
|
||||||
## Related articles
|
|
||||||
|
|
||||||
[Windows To Go: feature overview](windows-to-go-overview.md)
|
|
||||||
|
|
||||||
[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
|
|
||||||
|
|
||||||
[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
|
|
||||||
|
|
||||||
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,455 +0,0 @@
|
|||||||
### YamlMime:FAQ
|
|
||||||
metadata:
|
|
||||||
title: Windows To Go frequently asked questions (Windows 10)
|
|
||||||
description: Though Windows To Go is no longer being developed, these frequently asked questions (FAQ) can provide answers about the feature.
|
|
||||||
ms.assetid: bfdfb824-4a19-4401-b369-22c5e6ca9d6e
|
|
||||||
ms.reviewer:
|
|
||||||
author: frankroj
|
|
||||||
ms.author: frankroj
|
|
||||||
manager: aaroncz
|
|
||||||
keywords: FAQ, mobile, device, USB
|
|
||||||
ms.prod: windows-client
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.pagetype: mobility
|
|
||||||
ms.sitesec: library
|
|
||||||
audience: itpro
|
|
||||||
ms.topic: faq
|
|
||||||
ms.date: 10/28/2022
|
|
||||||
title: 'Windows To Go: frequently asked questions'
|
|
||||||
summary: |
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature doesn't support feature updates and therefore doesn't enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
The following list identifies some commonly asked questions about Windows To Go.
|
|
||||||
|
|
||||||
- [What is Windows To Go?](#what-is-windows-to-go-)
|
|
||||||
|
|
||||||
- [Does Windows To Go rely on virtualization?](#does-windows-to-go-rely-on-virtualization-)
|
|
||||||
|
|
||||||
- [Who should use Windows To Go?](#who-should-use-windows-to-go-)
|
|
||||||
|
|
||||||
- [How can Windows To Go be deployed in an organization?](#how-can-windows-to-go-be-deployed-in-an-organization-)
|
|
||||||
|
|
||||||
- [Is Windows To Go supported on both USB 2.0 and USB 3.0 drives?](#is-windows-to-go-supported-on-both-usb-2-0-and-usb-3-0-drives-)
|
|
||||||
|
|
||||||
- [Is Windows To Go supported on USB 2.0 and USB 3.0 ports?](#is-windows-to-go-supported-on-usb-2-0-and-usb-3-0-ports-)
|
|
||||||
|
|
||||||
- [How do I identify a USB 3.0 port?](#how-do-i-identify-a-usb-3-0-port-)
|
|
||||||
|
|
||||||
- [Does Windows To Go run faster on a USB 3.0 port?](#does-windows-to-go-run-faster-on-a-usb-3-0-port-)
|
|
||||||
|
|
||||||
- [Can the user self-provision Windows To Go?](#can-the-user-self-provision-windows-to-go-)
|
|
||||||
|
|
||||||
- [How can Windows To Go be managed in an organization?](#how-can-windows-to-go-be-managed-in-an-organization-)
|
|
||||||
|
|
||||||
- [How do I make my computer boot from USB?](#how-do-i-make-my-computer-boot-from-usb-)
|
|
||||||
|
|
||||||
- [Why isn't my computer booting from USB?](#why-isn-t-my-computer-booting-from-usb-)
|
|
||||||
|
|
||||||
- [What happens if I remove my Windows To Go drive while it's running?](#what-happens-if-i-remove-my-windows-to-go-drive-while-it-s-running-)
|
|
||||||
|
|
||||||
- [Can I use BitLocker to protect my Windows To Go drive?](#can-i-use-bitlocker-to-protect-my-windows-to-go-drive-)
|
|
||||||
|
|
||||||
- [Why can't I enable BitLocker from Windows To Go Creator?](#why-can-t-i-enable-bitlocker-from-windows-to-go-creator-)
|
|
||||||
|
|
||||||
- [What power states do Windows To Go support?](#what-power-states-does-windows-to-go-support-)
|
|
||||||
|
|
||||||
- [Why is hibernation disabled in Windows To Go?](#why-is-hibernation-disabled-in-windows-to-go-)
|
|
||||||
|
|
||||||
- [Does Windows To Go support crash dump analysis?](#does-windows-to-go-support-crash-dump-analysis-)
|
|
||||||
|
|
||||||
- [Do "Windows To Go Startup Options" work with dual boot computers?](#do--windows-to-go-startup-options--work-with-dual-boot-computers-)
|
|
||||||
|
|
||||||
- [I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?](#i-plugged-my-windows-to-go-drive-into-a-running-computer-and-i-can-t-see-the-partitions-on-the-drive--why-not-)
|
|
||||||
|
|
||||||
- [I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?](#i-m-booted-into-windows-to-go--but-i-can-t-browse-to-the-internal-hard-drive-of-the-host-computer--why-not-)
|
|
||||||
|
|
||||||
- [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#why-does-my-windows-to-go-drive-have-an-mbr-disk-format-with-a-fat32-system-partition-)
|
|
||||||
|
|
||||||
- [Is Windows To Go secure if I use it on an untrusted machine?](#is-windows-to-go-secure-if-i-use-it-on-an-untrusted-computer-)
|
|
||||||
|
|
||||||
- [Does Windows To Go work with ARM processors?](#does-windows-to-go-work-with-arm-processors-)
|
|
||||||
|
|
||||||
- [Can I synchronize data from Windows To Go with my other computer?](#can-i-synchronize-data-from-windows-to-go-with-my-other-computer-)
|
|
||||||
|
|
||||||
- [What size USB Flash Drive do I need to make a Windows To Go drive?](#what-size-usb-flash-drive-do-i-need-to-make-a-windows-to-go-drive-)
|
|
||||||
|
|
||||||
- [Do I need to activate Windows To Go every time I roam?](#do-i-need-to-activate-windows-to-go-every-time-i-roam-)
|
|
||||||
|
|
||||||
- [Can I use all Windows features on Windows To Go?](#can-i-use-all-windows-features-on-windows-to-go-)
|
|
||||||
|
|
||||||
- [Can I use all my applications on Windows To Go?](#can-i-use-all-my-applications-on-windows-to-go-)
|
|
||||||
|
|
||||||
- [Does Windows To Go work slower than standard Windows?](#does-windows-to-go-work-slower-than-standard-windows-)
|
|
||||||
|
|
||||||
- [If I lose my Windows To Go drive, will my data be safe?](#if-i-lose-my-windows-to-go-drive--will-my-data-be-safe-)
|
|
||||||
|
|
||||||
- [Can I boot Windows To Go on a Mac?](#can-i-boot-windows-to-go-on-a-mac-)
|
|
||||||
|
|
||||||
- [Are there any APIs that allow applications to identify a Windows To Go workspace?](#are-there-any-apis-that-allow-applications-to-identify-a-windows-to-go-workspace-)
|
|
||||||
|
|
||||||
- [How is Windows To Go licensed?](#how-is-windows-to-go-licensed-)
|
|
||||||
|
|
||||||
- [Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?](#does-windows-recovery-environment-work-with-windows-to-go--what-s-the-guidance-for-recovering-a-windows-to-go-drive-)
|
|
||||||
|
|
||||||
- [Why won't Windows To Go work on a computer running Windows XP or Windows Vista?](#why-won-t-windows-to-go-work-on-a-computer-running-windows-xp-or-windows-vista-)
|
|
||||||
|
|
||||||
- [Why does the operating system on the host computer matter?](#why-does-the-operating-system-on-the-host-computer-matter-)
|
|
||||||
|
|
||||||
- [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#my-host-computer-running-windows-7-is-protected-by-bitlocker-drive-encryption--why-did-i-need-to-use-the-recovery-key-to-unlock-and-reboot-my-host-computer-after-using-windows-to-go-)
|
|
||||||
|
|
||||||
- [I decided to stop using a drive for Windows To Go and reformatted it – why it doesn't have a drive letter assigned and how can I fix it?](#i-decided-to-stop-using-a-drive-for-windows-to-go-and-reformatted-it---why-it-doesn-t-have-a-drive-letter-assigned-and-how-can-i-fix-it-)
|
|
||||||
|
|
||||||
- [Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?](#why-do-i-keep-on-getting-the-message--installing-devices---when-i-boot-windows-to-go-)
|
|
||||||
|
|
||||||
- [How do I upgrade the operating system on my Windows To Go drive?](#how-do-i-upgrade-the-operating-system-on-my-windows-to-go-drive-)
|
|
||||||
|
|
||||||
|
|
||||||
sections:
|
|
||||||
- name: Ignored
|
|
||||||
questions:
|
|
||||||
- question: |
|
|
||||||
What is Windows To Go?
|
|
||||||
answer: |
|
|
||||||
Windows To Go is a feature for users of Windows 10 Enterprise and Windows 10 Education that enables users to boot a full version of Windows from external USB drives on host PCs.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows To Go rely on virtualization?
|
|
||||||
answer: |
|
|
||||||
No. Windows To Go is a native instance of Windows 10 that runs from a USB device. It's just like a laptop hard drive with Windows 8 that has been put into a USB enclosure.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Who should use Windows To Go?
|
|
||||||
answer: |
|
|
||||||
Windows To Go was designed for enterprise usage and targets scenarios such as continuance of operations, contractors, managed free seating, traveling workers, and work from home.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How can Windows To Go be deployed in an organization?
|
|
||||||
answer: |
|
|
||||||
Windows To Go can be deployed using standard Windows deployment tools like Diskpart and DISM. The prerequisites for deploying Windows To Go are:
|
|
||||||
|
|
||||||
- A Windows To Go recommended USB drive to provision; See the list of currently available USB drives at [Hardware considerations for Windows To Go](windows-to-go-overview.md#wtg-hardware)
|
|
||||||
|
|
||||||
- A Windows 10 Enterprise or Windows 10 Education image
|
|
||||||
|
|
||||||
- A Windows 10 Enterprise, Windows 10 Education or Windows 10 Professional host PC that can be used to provision new USB keys
|
|
||||||
|
|
||||||
You can use a Windows PowerShell script to target several drives and scale your deployment for a large number of Windows To Go drives. You can also use a USB duplicator to duplicate a Windows To Go drive after it has been provisioned if you're creating a large number of drives. See the [Windows To Go Step by Step](https://go.microsoft.com/fwlink/p/?LinkId=618950) article on the TechNet wiki for a walkthrough of the drive creation process.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Is Windows To Go supported on both USB 2.0 and USB 3.0 drives?
|
|
||||||
answer: |
|
|
||||||
No. Windows To Go is supported on USB 3.0 drives that are certified for Windows To Go.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Is Windows To Go supported on USB 2.0 and USB 3.0 ports?
|
|
||||||
answer: |
|
|
||||||
Yes. Windows To Go is fully supported on either USB 2.0 ports or USB 3.0 ports on PCs certified for Windows 7 or later.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How do I identify a USB 3.0 port?
|
|
||||||
answer: |
|
|
||||||
USB 3.0 ports are usually marked blue or carry an SS marking on the side.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows To Go run faster on a USB 3.0 port?
|
|
||||||
answer: |
|
|
||||||
Yes. Because USB 3.0 offers significantly faster speeds than USB 2.0, a Windows To Go drive running on a USB 3.0 port will operate considerably faster. This speed increase applies to both drive provisioning and when the drive is being used as a workspace.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can the user self-provision Windows To Go?
|
|
||||||
answer: |
|
|
||||||
Yes, if the user has administrator permissions they can self-provision a Windows To Go drive using the Windows To Go Creator wizard which is included in Windows 10 Enterprise, Windows 10 Education and Windows 10 Professional. Additionally, Configuration Manager SP1 and later releases include support for user self-provisioning of Windows To Go drives.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How can Windows To Go be managed in an organization?
|
|
||||||
answer: |
|
|
||||||
Windows To Go can be deployed and managed like a traditional desktop PC using standard Windows enterprise software distribution tools like Microsoft Configuration Manager. Computer and user settings for Windows To Go workspaces can be managed using Group Policy setting also in the same manner that you manage Group Policy settings for other PCs in your organization. Windows To Go workspaces can be configured to connect to the organizational resources remotely using DirectAccess or a virtual private network connection so that they can connect securely to your network.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How do I make my computer boot from USB?
|
|
||||||
answer: |
|
|
||||||
For host computers running Windows 10
|
|
||||||
|
|
||||||
- Using Cortana, search for **Windows To Go startup options**, and then press Enter.
|
|
||||||
- In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB.
|
|
||||||
|
|
||||||
For host computers running Windows 8 or Windows 8.1:
|
|
||||||
|
|
||||||
Press **Windows logo key+W** and then search for **Windows To Go startup options** and then press Enter.
|
|
||||||
|
|
||||||
In the **Windows To Go Startup Options** dialog box select **Yes** and then click **Save Changes** to configure the computer to boot from USB.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Your IT department can use Group Policy to configure Windows To Go Startup Options in your organization.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually.
|
|
||||||
|
|
||||||
To do this, early during boot time (usually when you see the manufacturer's logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer's site to be sure if you don't know which key to use to enter firmware setup.)
|
|
||||||
|
|
||||||
After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first.
|
|
||||||
|
|
||||||
Alternatively, if your computer supports it, you can try to use the one-time boot menu (often F12), to select USB boot on a per-boot basis.
|
|
||||||
|
|
||||||
For more detailed instructions, see the wiki article, [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkID=618951).
|
|
||||||
|
|
||||||
**Warning**
|
|
||||||
Configuring a computer to boot from USB will cause your computer to attempt to boot from any bootable USB device connected to your computer. This potentially includes malicious devices. Users should be informed of this risk and instructed to not have any bootable USB storage devices plugged in to their computers except for their Windows To Go drive.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why isn't my computer booting from USB?
|
|
||||||
answer: |
|
|
||||||
Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation:
|
|
||||||
|
|
||||||
1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device.
|
|
||||||
|
|
||||||
2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don't support booting from a device connected to a USB 3 PCI add-on card or external USB hubs.
|
|
||||||
|
|
||||||
3. If the computer isn't booting from a USB 3.0 port, try to boot from a USB 2.0 port.
|
|
||||||
|
|
||||||
If none of these items enable the computer to boot from USB, contact the hardware manufacturer for additional support.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
What happens if I remove my Windows To Go drive while it's running?
|
|
||||||
answer: |
|
|
||||||
If the Windows To Go drive is removed, the computer will freeze and the user will have 60 seconds to reinsert the Windows To Go drive. If the Windows To Go drive is reinserted into the same port it was removed from, Windows will resume at the point where the drive was removed. If the USB drive isn't reinserted, or is reinserted into a different port, the host computer will turn off after 60 seconds.
|
|
||||||
|
|
||||||
**Warning**
|
|
||||||
You should never remove your Windows To Go drive when your workspace is running. The computer freeze is a safety measure to help mitigate the risk of accidental removal. Removing the Windows To Go drive without shutting down the Windows To Go workspace could result in corruption of the Windows To Go drive.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can I use BitLocker to protect my Windows To Go drive?
|
|
||||||
answer: |
|
|
||||||
Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you'll be prompted to enter this password every time you use the Windows To Go workspace.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why can't I enable BitLocker from Windows To Go Creator?
|
|
||||||
answer: |
|
|
||||||
Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three subfolders for fixed, operating system and removable data drive types.
|
|
||||||
|
|
||||||
When you're using Windows To Go Creator, the Windows To Go drive is considered a removable data drive by BitLocker. Review the following setting to see if these settings apply in your situation:
|
|
||||||
|
|
||||||
1. **Control use of BitLocker on removable drives**
|
|
||||||
|
|
||||||
If this setting is disabled BitLocker can't be used with removable drives, so the Windows To Go Creator wizard will fail if it attempts to enable BitLocker on the Windows To Go drive.
|
|
||||||
|
|
||||||
2. **Configure use of smart cards on removable data drives**
|
|
||||||
|
|
||||||
If this setting is enabled and the option **Require use of smart cards on removable data drives** is also selected the creator wizard might fail if you haven't already signed on using your smart card credentials before starting the Windows To Go Creator wizard.
|
|
||||||
|
|
||||||
3. **Configure use of passwords for removable data drives**
|
|
||||||
|
|
||||||
If this setting is enabled and the **Require password complexity option** is selected the computer must be able to connect to the domain controller to verify that the password specified meets the password complexity requirements. If the connection isn't available, the Windows To Go Creator wizard will fail to enable BitLocker.
|
|
||||||
|
|
||||||
Additionally, the Windows To Go Creator will disable the BitLocker option if the drive doesn't have any volumes. In this situation, you should initialize the drive and create a volume using the Disk Management console before provisioning the drive with Windows To Go.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
What power states does Windows To Go support?
|
|
||||||
answer: |
|
|
||||||
Windows To Go supports all power states except the hibernate class of power states, which include hybrid boot, hybrid sleep, and hibernate. This default behavior can be modified by using Group Policy settings to enable hibernation of the Windows To Go workspace.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why is hibernation disabled in Windows To Go?
|
|
||||||
answer: |
|
|
||||||
When a Windows To Go workspace is hibernated, it will only successfully resume on the exact same hardware. Therefore, if a Windows To Go workspace is hibernated on one computer and roamed to another, the hibernation state (and therefore user state) will be lost. To prevent this from happening, the default settings for a Windows To Go workspace disable hibernation. If you're confident that you'll only attempt to resume on the same computer, you can enable hibernation using the Windows To Go Group Policy setting, **Allow hibernate (S4) when started from a Windows To Go workspace** that is located at **\\\\Computer Configuration\\Administrative Templates\\Windows Components\\Portable Operating System\\** in the Local Group Policy Editor (gpedit.msc).
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows To Go support crash dump analysis?
|
|
||||||
answer: |
|
|
||||||
Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Do "Windows To Go Startup Options" work with dual boot computers?
|
|
||||||
answer: |
|
|
||||||
Yes, if both operating systems are running the Windows 8 operating system. Enabling "Windows To Go Startup Options" should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on.
|
|
||||||
|
|
||||||
If you have configured a dual boot computer with a Windows operating system and another operating system, it might work occasionally and fail occasionally. Using this configuration is unsupported.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?
|
|
||||||
answer: |
|
|
||||||
Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That's why you can't see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter.
|
|
||||||
|
|
||||||
**Warning**
|
|
||||||
It's strongly recommended that you don't plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?
|
|
||||||
answer: |
|
|
||||||
Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That's why you can't see the internal hard drives of the host computer when you're booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive.
|
|
||||||
|
|
||||||
**Warning**
|
|
||||||
It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefore user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?
|
|
||||||
answer: |
|
|
||||||
This is done to allow Windows To Go to boot from UEFI and legacy systems.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Is Windows To Go secure if I use it on an untrusted computer?
|
|
||||||
answer: |
|
|
||||||
While you are more secure than if you use a completely untrusted operating system, you are still vulnerable to attacks from the firmware or anything that runs before Windows To Go starts. If you plug your Windows To Go drive into a running untrusted computer, your Windows To Go drive can be compromised because any malicious software that might be active on the computer can access the drive.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows To Go work with ARM processors?
|
|
||||||
answer: |
|
|
||||||
No. Windows RT is a specialized version of Windows designed for ARM processors. Windows To Go is currently only supported on PCs with x86 or x64-based processors.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can I synchronize data from Windows To Go with my other computer?
|
|
||||||
answer: |
|
|
||||||
To get your data across all your computers, we recommend using folder redirection and client side caching to store copies of your data on a server while giving you offline access to the files you need.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
What size USB flash drive do I need to make a Windows To Go drive?
|
|
||||||
answer: |
|
|
||||||
The size constraints are the same as full Windows. To ensure that you have enough space for Windows, your data, and your applications, we recommend USB drives that are a minimum of 20 GB in size.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Do I need to activate Windows To Go every time I roam?
|
|
||||||
answer: |
|
|
||||||
No, Windows To Go requires volume activation; either using the [Key Management Service](/previous-versions/tn-archive/ff793434(v=technet.10)) (KMS) server in your organization or using [Active Directory](/previous-versions/windows/hh852637(v=win.10)) based volume activation. The Windows To Go workspace won't need to be reactivated every time you roam. KMS activates Windows on a local network, eliminating the need for individual computers to connect to Microsoft. To remain activated, KMS client computers must renew their activation by connecting to the KMS host on periodic basis. This typically occurs as soon as the user has access to the corporate network (either through a direct connection on-premises or through a remote connection using DirectAccess or a virtual private network connection), once activated the machine won't need to be activated again until the activation validity interval has passed. In a KMS configuration, the activation validity interval is 180 days.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can I use all Windows features on Windows To Go?
|
|
||||||
answer: |
|
|
||||||
Yes, with some minor exceptions, you can use all Windows features with your Windows To Go workspace. The only currently unsupported features are using the Windows Recovery Environment and PC Reset & Refresh.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can I use all my applications on Windows To Go?
|
|
||||||
answer: |
|
|
||||||
Yes. Because your Windows To Go workspace is a full Windows 10 environment, all applications that work with Windows 10 should work in your Windows To Go workspace. However, any applications that use hardware binding (usually for licensing and/or digital rights management reasons) may not run when you roam your Windows To Go drive between different host computers, and you may have to use those applications on the same host computer every time.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows To Go work slower than standard Windows?
|
|
||||||
answer: |
|
|
||||||
If you're using a USB 3.0 port and a Windows To Go certified device, there should be no perceivable difference between standard Windows and Windows To Go. However, if you're booting from a USB 2.0 port, you may notice some slowdown since USB 2.0 transfer speeds are slower than SATA speeds.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
If I lose my Windows To Go drive, will my data be safe?
|
|
||||||
answer: |
|
|
||||||
Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user won't be able to access your data without your password. If you don't enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Can I boot Windows To Go on a Mac?
|
|
||||||
answer: |
|
|
||||||
We're committed to give customers a consistent and quality Windows 10 experience with Windows To Go. Windows To Go supports host devices certified for use with Windows 7 or later. Because Mac computers aren't certified for use with Windows 7 or later, using Windows To Go isn't supported on a Mac.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Are there any APIs that allow applications to identify a Windows To Go workspace?
|
|
||||||
answer: |
|
|
||||||
Yes. You can use a combination of identifiers to determine if the currently running operating system is a Windows To Go workspace. First, check if the **PortableOperatingSystem** property is true. When that value is true, it means that the operating system was booted from an external USB device.
|
|
||||||
|
|
||||||
Next, check if the **OperatingSystemSKU** property is equal to **4** (for Windows 10 Enterprise) or **121** (for Windows 10 Education). The combination of those two properties represents a Windows To Go workspace environment.
|
|
||||||
|
|
||||||
For more information, see the MSDN article on the [Win32\_OperatingSystem class](/windows/win32/cimwin32prov/win32-operatingsystem).
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How is Windows To Go licensed?
|
|
||||||
answer: |
|
|
||||||
Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?
|
|
||||||
answer: |
|
|
||||||
No, use of Windows Recovery Environment isn't supported on Windows To Go. It's recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should reprovision the workspace.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why won't Windows To Go work on a computer running Windows XP or Windows Vista?
|
|
||||||
answer: |
|
|
||||||
Actually it might. If you've purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you've configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why does the operating system on the host computer matter?
|
|
||||||
answer: |
|
|
||||||
It doesn't other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer can't boot from USB there's no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?
|
|
||||||
answer: |
|
|
||||||
The default BitLocker protection profile in Windows 7 monitors the host computer for changes to the boot order as part of protecting the computer from tampering. When you change the boot order of the host computer to enable it to boot from the Windows To Go drive, the BitLocker system measurements will reflect that change and boot into recovery mode so that the computer can be inspected if necessary.
|
|
||||||
|
|
||||||
You can reset the BitLocker system measurements to incorporate the new boot order using the following steps:
|
|
||||||
|
|
||||||
1. Sign in to the host computer using an account with administrator privileges.
|
|
||||||
|
|
||||||
2. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**.
|
|
||||||
|
|
||||||
3. Click **Suspend Protection** for the operating system drive.
|
|
||||||
|
|
||||||
A message is displayed, informing you that your data won't be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click **Yes** to continue and suspend BitLocker on the drive.
|
|
||||||
|
|
||||||
4. Restart the computer and enter the firmware settings to reset the boot order to boot from USB first. For more information on changing the boot order in the BIOS, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) on the TechNet wiki.
|
|
||||||
|
|
||||||
5. Restart the computer again and then sign in to the host computer using an account with administrator privileges. (Neither your Windows To Go drive nor any other USB drive should be inserted.)
|
|
||||||
|
|
||||||
6. Click **Start**, click **Control Panel**, click **System and Security**, and then click **BitLocker Drive Encryption**.
|
|
||||||
|
|
||||||
7. Click **Resume Protection** to re-enable BitLocker protection.
|
|
||||||
|
|
||||||
The host computer will now be able to be booted from a USB drive without triggering recovery mode.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> The default BitLocker protection profile in Windows 8 or later doesn't monitor the boot order.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
I decided to stop using a drive for Windows To Go and reformatted it – why it doesn't have a drive letter assigned and how can I fix it?
|
|
||||||
answer: |
|
|
||||||
Reformatting the drive erases the data on the drive, but doesn't reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps:
|
|
||||||
|
|
||||||
1. Open a command prompt with full administrator permissions.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If your user account is a member of the Administrators group, but isn't the Administrator account itself, then, by default, the programs that you run only have standard user permissions unless you explicitly choose to elevate them.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. Start the [diskpart](/windows-server/administration/windows-commands/diskpart) command interpreter, by typing `diskpart` at the command prompt.
|
|
||||||
|
|
||||||
3. Use the `select disk` command to identify the drive. If you don't know the drive number, use the `list` command to display the list of disks available.
|
|
||||||
|
|
||||||
4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?
|
|
||||||
answer: |
|
|
||||||
One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers that aren't present on the new configuration. In general, this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations.
|
|
||||||
|
|
||||||
In certain cases, third-party drivers for different hardware models or versions can reuse device IDs, driver file names, registry keys (or any other operating system constructs that don't support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver.
|
|
||||||
|
|
||||||
This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message "Installing devices…" displaying every time that a Windows to Go drive is roamed between two PCs that require conflicting drivers.
|
|
||||||
|
|
||||||
- question: |
|
|
||||||
How do I upgrade the operating system on my Windows To Go drive?
|
|
||||||
answer: |
|
|
||||||
There's no support in Windows for upgrading a Windows To Go drive. Deployed Windows To Go drives with older versions of Windows will need to be reimaged with a new version of Windows in order to transition to the new operating system version.
|
|
||||||
|
|
||||||
additionalContent: |
|
|
||||||
|
|
||||||
## Additional resources
|
|
||||||
|
|
||||||
- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949)
|
|
||||||
- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950)
|
|
||||||
- [Windows To Go: feature overview](windows-to-go-overview.md)
|
|
||||||
- [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
|
|
||||||
- [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
|
|
||||||
- [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
|
|
||||||
|
|
@ -1,155 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows To Go feature overview (Windows 10)
|
|
||||||
description: Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that lets you create a workspace that can be booted from a USB-connected drive.
|
|
||||||
manager: aaroncz
|
|
||||||
ms.author: frankroj
|
|
||||||
ms.prod: windows-client
|
|
||||||
author: frankroj
|
|
||||||
ms.topic: overview
|
|
||||||
ms.technology: itpro-deploy
|
|
||||||
ms.collection:
|
|
||||||
- highpri
|
|
||||||
- tier2
|
|
||||||
ms.date: 10/28/2022
|
|
||||||
---
|
|
||||||
|
|
||||||
# Windows To Go: feature overview
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.
|
|
||||||
|
|
||||||
Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs.
|
|
||||||
|
|
||||||
PCs that meet the Windows 7 or later [certification requirements](/previous-versions/windows/hardware/cert-program/) can run Windows 10 in a Windows To Go workspace, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. Windows To Go isn't intended to replace desktops, laptops or supplant other mobility offerings. Rather, it provides support for efficient use of resources for alternative workplace scenarios. There are some other considerations that you should keep in mind before you start to use Windows To Go:
|
|
||||||
|
|
||||||
- [Windows To Go: feature overview](#windows-to-go-feature-overview)
|
|
||||||
- [<a href="" id="bkmk-wtgdif"></a>Differences between Windows To Go and a typical installation of Windows](#differences-between-windows-to-go-and-a-typical-installation-of-windows)
|
|
||||||
- [<a href="" id="bkmk-wtgroam"></a>Roaming with Windows To Go](#roaming-with-windows-to-go)
|
|
||||||
- [<a href="" id="wtg-prep-intro"></a>Prepare for Windows To Go](#prepare-for-windows-to-go)
|
|
||||||
- [<a href="" id="wtg-hardware"></a>Hardware considerations for Windows To Go](#hardware-considerations-for-windows-to-go)
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Windows To Go isn't supported on Windows RT.
|
|
||||||
|
|
||||||
## <a href="" id="bkmk-wtgdif"></a>Differences between Windows To Go and a typical installation of Windows
|
|
||||||
|
|
||||||
Windows To Go workspace operates just like any other installation of Windows with a few exceptions. These exceptions are:
|
|
||||||
|
|
||||||
- **Internal disks are offline.** To ensure data isn't accidentally disclosed, internal hard disks on the host computer are offline by default when booted into a Windows To Go workspace. Similarly if a Windows To Go drive is inserted into a running system, the Windows To Go drive won't be listed in Windows Explorer.
|
|
||||||
- **Trusted Platform Module (TPM) is not used.** When using BitLocker Drive Encryption, a pre-operating system boot password will be used for security rather than the TPM since the TPM is tied to a specific computer and Windows To Go drives will move between computers.
|
|
||||||
- **Hibernate is disabled by default.** To ensure that the Windows To Go workspace is able to move between computers easily, hibernation is disabled by default. Hibernation can be re-enabled by using Group Policy settings.
|
|
||||||
- **Windows Recovery Environment is not available.** In the rare case that you need to recover your Windows To Go drive, you should re-image it with a fresh image of Windows.
|
|
||||||
- **Refreshing or resetting a Windows To Go workspace is not supported.** Resetting to the manufacturer's standard for the computer doesn't apply when running a Windows To Go workspace, so the feature was disabled.
|
|
||||||
- **Upgrading a Windows To Go workspace is not supported.** Older Windows 8 or Windows 8.1 Windows To Go workspaces can't be upgraded to Windows 10 workspaces, nor can Windows 10 Windows To Go workspaces be upgraded to future versions of Windows 10. For new versions, the workspace needs to be re-imaged with a fresh image of Windows.
|
|
||||||
|
|
||||||
## <a href="" id="bkmk-wtgroam"></a>Roaming with Windows To Go
|
|
||||||
|
|
||||||
Windows To Go drives can be booted on multiple computers. When a Windows To Go workspace is first booted on a host computer, it will detect all hardware on the computer and install any needed drivers. When the Windows To Go workspace is next booted on that host computer, it will be able to identify the host computer and load the correct set of drivers automatically.
|
|
||||||
|
|
||||||
The applications that you want to use from the Windows To Go workspace should be tested to make sure they also support roaming. Some applications bind to the computer hardware, which will cause difficulties if the workspace is being used with multiple host computers.
|
|
||||||
|
|
||||||
## <a href="" id="wtg-prep-intro"></a>Prepare for Windows To Go
|
|
||||||
|
|
||||||
Enterprises install Windows on a large group of computers either by using configuration management software (such as Microsoft Configuration Manager), or by using standard Windows deployment tools such as DiskPart and the Deployment Image Servicing and Management (DISM) tool.
|
|
||||||
|
|
||||||
These same tools can be used to provision Windows To Go drive, just as if you were planning for provisioning a new class of mobile PCs. You can use the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) to review deployment tools available.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Make sure you use the versions of the deployment tools provided for the version of Windows you are deploying. There have been many enhancements made to support Windows To Go. Using versions of the deployment tools released for earlier versions of Windows to provision a Windows To Go drive is not supported.
|
|
||||||
|
|
||||||
As you decide what to include in your Windows To Go image, be sure to consider the following questions:
|
|
||||||
|
|
||||||
Are there any drivers that you need to inject into the image?
|
|
||||||
|
|
||||||
How will data be stored and synchronized to appropriate locations from the USB device?
|
|
||||||
|
|
||||||
Are there any applications that are incompatible with Windows To Go roaming that shouldn't be included in the image?
|
|
||||||
|
|
||||||
What should be the architecture of the image - 32bit/64bit?
|
|
||||||
|
|
||||||
What remote connectivity solution should be supported in the image if Windows To Go is used outside the corporate network?
|
|
||||||
|
|
||||||
For more information about designing and planning your Windows To Go deployment, see [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md).
|
|
||||||
|
|
||||||
## <a href="" id="wtg-hardware"></a>Hardware considerations for Windows To Go
|
|
||||||
|
|
||||||
**For USB drives**
|
|
||||||
|
|
||||||
The devices listed in this section have been specially optimized and certified for Windows To Go and meet the necessary requirements for booting and running a full version of Windows 10 from a USB drive. The optimizations for Windows To Go include the following items:
|
|
||||||
|
|
||||||
- Windows To Go certified USB drives are built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly.
|
|
||||||
- Windows To Go certified USB drives have been tuned to ensure they boot and run on hardware certified for use with Windows 7 and later.
|
|
||||||
- Windows To Go certified USB drives are built to last. Certified USB drives are backed with manufacturer warranties and should continue operating under normal usage. Refer to the manufacturer websites for warranty details.
|
|
||||||
|
|
||||||
As of the date of publication, the following are the USB drives currently certified for use as Windows To Go drives:
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> Using a USB drive that has not been certified is not supported.
|
|
||||||
|
|
||||||
- IronKey Workspace W700 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w700.html](https://www.kingston.com/support/technical/products?model=dtws))
|
|
||||||
- IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://www.kingston.com/support/technical/products?model=dtws))
|
|
||||||
- IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://www.kingston.com/support/technical/products?model=dtws))
|
|
||||||
- Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719))
|
|
||||||
|
|
||||||
- Super Talent Express RC4 for Windows To Go
|
|
||||||
|
|
||||||
-and-
|
|
||||||
|
|
||||||
Super Talent Express RC8 for Windows To Go
|
|
||||||
|
|
||||||
([http://www.supertalent.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618721))
|
|
||||||
|
|
||||||
- Western Digital My Passport Enterprise ([http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722))
|
|
||||||
|
|
||||||
We recommend that you run the WD Compass utility to prepare the Western Digital My Passport Enterprise drive for provisioning with Windows To Go. For more information about the WD Compass utility, see [http://www.wd.com/wtg](https://go.microsoft.com/fwlink/p/?LinkId=618722)
|
|
||||||
|
|
||||||
**For host computers**
|
|
||||||
|
|
||||||
When assessing the use of a PC as a host for a Windows To Go workspace, you should consider the following criteria:
|
|
||||||
|
|
||||||
- Hardware that has been certified for use with Windows 7 or later operating systems will work well with Windows To Go.
|
|
||||||
- Running a Windows To Go workspace from a computer that is running Windows RT isn't a supported scenario.
|
|
||||||
- Running a Windows To Go workspace on a Mac computer isn't a supported scenario.
|
|
||||||
|
|
||||||
The following table details the characteristics that the host computer must have to be used with Windows To Go:
|
|
||||||
|
|
||||||
|Item|Requirement|
|
|
||||||
|--- |--- |
|
|
||||||
|Boot process|Capable of USB boot|
|
|
||||||
|Firmware|USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you're unsure of the ability of your PC to boot from USB)|
|
|
||||||
|Processor architecture|Must support the image on the Windows To Go drive|
|
|
||||||
|External USB Hubs|Not supported; connect the Windows To Go drive directly to the host machine|
|
|
||||||
|Processor|1 GHz or faster|
|
|
||||||
|RAM|2 GB or greater|
|
|
||||||
|Graphics|DirectX 9 graphics device with WDDM 1.2 or greater driver|
|
|
||||||
|USB port|USB 2.0 port or greater|
|
|
||||||
|
|
||||||
**Checking for architectural compatibility between the host PC and the Windows To Go drive**
|
|
||||||
|
|
||||||
In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below.
|
|
||||||
|
|
||||||
|Host PC Firmware Type|Host PC Processor Architecture|Compatible Windows To Go Image Architecture|
|
|
||||||
|--- |--- |--- |
|
|
||||||
|Legacy BIOS|32-bit|32-bit only|
|
|
||||||
|Legacy BIOS|64-bit|32-bit and 64-bit|
|
|
||||||
|UEFI BIOS|32-bit|32-bit only|
|
|
||||||
|UEFI BIOS|64-bit|64-bit only|
|
|
||||||
|
|
||||||
## Other resources
|
|
||||||
|
|
||||||
- [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949)
|
|
||||||
- [Windows To Go Step by Step Wiki](https://go.microsoft.com/fwlink/p/?LinkId=618950)
|
|
||||||
- [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951)
|
|
||||||
|
|
||||||
## Related articles
|
|
||||||
|
|
||||||
[Deploy Windows To Go in your organization](../deploy-windows-to-go.md)<br>
|
|
||||||
[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.yml)<br>
|
|
||||||
[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)<br>
|
|
||||||
[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)<br>
|
|
||||||
[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)<br>
|
|
||||||
[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md)
|
|