Using Windows 7 and Windows Server 2008 R2 - Controlling Communication With The Internet

Using Windows 7 and Windows Server 2008
R2: Controlling Communication with the

Internet
Microsoft Corporation
Published: December 2009
Abstract
This document provides information about the communication that flows between the features in
Windows 7 and Windows Server 2008 R2 and sites on the Internet. It describes steps to take to
limit, control, or prevent that communication in an organization with many users. This document is
designed to assist administrators in planning strategies for deploying and maintaining Windows
Server 2008 R2 and Windows 7 in a way that helps provide an appropriate level of security and
privacy for an organization’s networked assets.
Copyright information
Information in this document, including URL and other Internet Web site references, is subject to
change without notice. Unless otherwise noted, the companies, organizations, products, domain
names, e-mail addresses, logos, people, places, and events depicted in examples herein are
fictitious. No association with any real company, organization, product, domain name, e-mail
address, logo, person, place, or event is intended or should be inferred. Complying with all
applicable copyright laws is the responsibility of the user. Without limiting the rights under
copyright, no part of this document may be reproduced, stored in or introduced into a retrieval
system, or transmitted in any form or by any means (electronic, mechanical, photocopying,
recording, or otherwise), or for any purpose, without the express written permission of Microsoft
Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
© 2009 Microsoft Corporation. All rights reserved.
Active Directory, ActiveX, Authenticode, DirectX, Internet Explorer, Hyper-V, InPrivate, Microsoft,
MSDN, PowerShell, Windows Media, SmartScreen, Windows, Windows Server, Windows Vista
are trademarks of the Microsoft group of companies.
All other trademarks are property of their respective owners.
Contents
Using Windows 7 and Windows Server 2008 R2: Controlling Communication with the Internet.. 13
Introduction to Controlling Communication with the Internet in Windows 7 and Windows Server
2008 R2 ...................................................................................................................................... 17
What this document includes ..................................................................................................... 18
Standard computer information sent by Internet-enabled features ........................................ 18
Types of features covered in this document ........................................................................... 18
Types of features not covered in this document ..................................................................... 19
Security basics that are beyond the scope of this document ................................................. 19
Resources about security basics ......................................................................................... 20
Active Directory-Related Services and Resulting Internet Communication in Windows Server

2008 R2 ...................................................................................................................................... 21
Benefits and purposes of AD FS and AD RMS .......................................................................... 21
Overview of AD FS, federated applications and resulting communication across the Internet . 22
Port configurations for AD FS .................................................................................................... 22
Additional references for AD FS and federated Web application design ................................... 22
Additional references for AD RMS ............................................................................................. 23
Remote Desktop Gateway and Resulting Internet Communication in Windows Server 2008 R2 24
Benefits and purposes of Remote Desktop Gateway ................................................................ 24
Examples of security-related features in Remote Desktop Gateway......................................... 25
Procedure for viewing or changing Group Policy settings that affect Remote Desktop Gateway
in Windows Server 2008 R2 ................................................................................................... 26
Additional references ................................................................................................................. 27
Remote Desktop Licensing and Resulting Internet Communication in Windows Server 2008 R2 28
Purpose of Remote Desktop Licensing ...................................................................................... 28
Overview: Using Remote Desktop Licensing in a managed environment ................................. 28
How Remote Desktop Licensing communicates with Internet sites .......................................... 29
Controlling Remote Desktop Licensing to limit the flow of information to and from the Internet 31
Remote Desktop Web Access and Resulting Internet Communication in Windows Server 2008
R2 ............................................................................................................................................... 33
Benefits and purposes of Remote Desktop Web Access .......................................................... 33
Roles and role services used with Remote Desktop Web Access ............................................ 34
Default port and authentication settings with Remote Desktop Web Access ............................ 34
Additional ports required for Remote Desktop Web Access ...................................................... 34
Activation and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 . 36
Purposes of activation for Windows Server 2008 R2 and Windows 7 ....................................... 36
Overview: Activation in the context of a managed environment ................................................ 37
Activation options with volume licensing ................................................................................ 37
How a computer communicates with sites on the Internet during activation ............................. 38
Certificate Support and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 ...................................................................................................................................... 41
Benefits and purposes of certificate functionality ....................................................................... 41
The Update Root Certificates feature in Windows 7 and Windows Server 2008 ................... 42
Overview: Using AD CS features in a managed environment ................................................... 42
How Update Root Certificates communicates with Internet sites .............................................. 43
Controlling the Update Root Certificates feature to prevent the flow of information to and from
the Internet .............................................................................................................................. 44
How turning off Update Root Certificates on a computer can affect users and applications . 44
Procedures for viewing or changing Group Policy settings that affect certificates in Windows 7
and Windows Server 2008 R2 ................................................................................................ 45
Device Manager, Hardware Wizards, and Resulting Internet Communication in Windows 7 and
Windows Server 2008 R2 .......................................................................................................... 47
Benefits and purposes of Device Manager and hardware wizards ............................................ 47
Device Manager ...................................................................................................................... 48
Hardware wizards ................................................................................................................... 48
Overview: Using Device Manager in a managed environment .................................................. 48
How hardware wizards communicate with Internet sites ........................................................... 49
Controlling hardware wizards to limit the flow of information to and from the Internet .............. 50
Procedures for controlling communication between hardware wizards and the Windows Update
Web site .................................................................................................................................. 51
Dynamic Update and Resulting Internet Communication in Windows 7 and Windows Server 2008
R2 ............................................................................................................................................... 55
Benefits and purposes of Dynamic Update ................................................................................ 55
Overview: Using Dynamic Update in a managed environment ................................................. 57
How Dynamic Update communicates with sites on the Internet ................................................ 57
Controlling Dynamic Update to limit the flow of information to and from the Internet ................ 59
Event Viewer and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2
.................................................................................................................................................... 60
Benefits and purposes of Event Viewer ..................................................................................... 60
Forwarding and collecting events ........................................................................................... 60
Overview: Using Event Viewer in a managed environment ....................................................... 61
How Event Viewer communicates with Internet sites ................................................................ 62
Controlling Event Viewer to prevent the flow of information to and from the Internet ................ 63
Procedures for preventing the flow of information to and from the Internet through Event Viewer
................................................................................................................................................ 63
File Association Web Service and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 .......................................................................................................................... 65
Benefits and purposes of the file association Web service ........................................................ 65
Overview: Using the file association Web service in a managed environment ......................... 65
How the file association Web service communicates with Internet sites ................................... 66
Controlling the file association Web service to limit the flow of information to and from the
Internet .................................................................................................................................... 67
Procedures for limiting Internet communication generated by the file association Web service 67
Disabling the file association Web service ............................................................................. 68
Specifying associations between file name extensions and applications or features ............ 68
Help and Support Features that Communicate Through the Internet in Windows 7 and Windows
Server 2008 R2 .......................................................................................................................... 70
Benefits and purposes of features within Help and Support that communicate through the
Internet .................................................................................................................................... 70
Overview: Using Help and Support in a managed environment ................................................ 71
How features within Help and Support communicate with Internet sites ................................... 72
Online Help ............................................................................................................................. 72
Help ratings and feedback ...................................................................................................... 73
Help Experience Improvement Program ................................................................................ 74
Controlling features within Help and Support that communicate through the Internet .............. 75
Procedures for disabling features within Help and Support that communicate through the
Internet .................................................................................................................................... 76
Internet Explorer 8 and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 ...................................................................................................................................... 79
Benefits and purposes of Internet Explorer 8 ............................................................................. 80
Internet Explorer enhanced security configuration ..................................................................... 81
Examples of the security-related features in Internet Explorer 8 ............................................... 81
Resources for learning about topics related to security in Internet Explorer 8 .......................... 83
Learning about security and privacy settings in Internet Explorer 8 ....................................... 83
Learning about mitigating the risks inherent in Web-based applications and scripts ............. 84
Learning about Group Policy objects that control configuration settings for Internet Explorer 8
............................................................................................................................................. 85
Learning about the Internet Explorer Administration Kit ......................................................... 85
Procedures for controlling Internet Explorer in Windows 7 and Windows Server 2008 R2 ....... 86
Procedures for controlling the Web browsers that are available for use in Windows 7 and
Windows Server 2008 R2 .................................................................................................... 86
Procedure for turning Internet Explorer enhanced security configuration on or off ................ 87
Procedures for setting the security level to high for specific Web sites .................................. 88
Internet Information Services and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 .......................................................................................................................... 90
Benefits and purposes of IIS ...................................................................................................... 90
Examples of security-related features in IIS 7.5 ........................................................................ 91
Finding information about features in IIS 7.5 ............................................................................. 92
Procedures for installing or uninstalling features in IIS 7.5 ........................................................ 92
Internet Printing and Resulting Internet Communication in Windows 7 and Windows Server 2008
R2 ............................................................................................................................................... 95
Benefits and purposes of Internet printing ................................................................................. 95
Overview: Using Internet printing in a managed environment ................................................... 95
How Internet printing communicates with Internet sites............................................................. 96
Controlling Internet printing to prevent the flow of information to and from the Internet ............ 97
A computer being used as a printing client ............................................................................. 97
A computer being used as a server ........................................................................................ 97
Procedures for controlling Internet printing ................................................................................ 97
Internet Protocol Version 6, Teredo, and Related Technologies in Windows 7 and Windows
Server 2008 R2 ........................................................................................................................ 100
Overview: IPv6 and Teredo implementation in Windows 7 and Windows Server 2008 R2 .... 100
Controlling the Teredo client in Windows 7 and Windows Server 2008 R2 ......................... 101
Additional references for IPv6 .................................................................................................. 103
Plug and Play and Resulting Internet Communication in Windows 7 and Windows Server 7 .... 104
Benefits and purposes of Plug and Play .................................................................................. 104
Additional references ............................................................................................................... 105
Program Compatibility Features and Resulting Internet Communication in Windows 7 and

Windows Server 2008 R2 ........................................................................................................ 106
Benefits and purposes of program compatibility features ........................................................ 106
Overview: Using program compatibility features in a managed environment .......................... 108
How program compatibility features communicate with Internet sites ..................................... 108
Aspects of Internet communication that are similar for all program compatibility features .. 108
Triggers and user notifications for program compatibility features ....................................... 110
How information is stored locally for the Program Compatibility Assistant ....................... 110
Controlling program compatibility feature information to the Internet ...................................... 111
Procedure for controlling Internet communication related to program compatibility features .. 112
Remote Assistance and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 113
Benefits and purposes of Remote Assistance ......................................................................... 113
Overview: Using Remote Assistance in a managed environment ........................................... 114
The Remote Assistance invitation and the Remote Assistance session .......................... 115
Types of assistance that are included in Remote Assistance .............................................. 115
Windows Firewall settings in relation to Remote Assistance ............................................... 116
How Remote Assistance communicates through the Internet ................................................. 118
Controlling Remote Assistance to prevent the flow of information to and from the Internet .... 120
Using Group Policy to limit communication through Remote Assistance ............................. 121
Procedures for controlling or disabling Remote Assistance .................................................... 122
Controlling Remote Assistance on an individual computer running Windows 7 or Windows
Server 2008 R2 ................................................................................................................. 122
Controlling Remote Assistance by using Group Policy ........................................................ 125
Controlling Remote Assistance during an unattended installation by using an answer file . 126
SmartScreen Filter and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 128
Benefits and purposes of SmartScreen Filter in Internet Explorer 8........................................ 128
Overview: Using SmartScreen Filter in a managed environment ............................................ 129
How SmartScreen Filter communicates with a Web service on the Internet ........................... 130
Controlling SmartScreen Filter to limit the flow of information to and from the Internet .......... 131
Windows Customer Experience Improvement Program and Resulting Internet Communication in

Windows 7 and Windows Server 2008 R2 ............................................................................... 134
Purposes of the Windows Customer Experience Improvement Program ................................ 134
Overview: Using the Windows Customer Experience Improvement Program in a managed
environment .......................................................................................................................... 134
How the Windows Customer Experience Improvement Program communicates with a site on
the Internet ............................................................................................................................ 135
Procedures for controlling the Windows Customer Experience Improvement Program .......... 136
Windows Defender and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 140
Benefits and purposes of Windows Defender and the online Microsoft SpyNet community ... 140
Windows Defender................................................................................................................ 140
The online Microsoft SpyNet community .............................................................................. 141
Overview: Using Windows Defender and information from the Microsoft SpyNet community in a
managed environment .......................................................................................................... 142
How Windows Defender communicates with Internet sites (without Microsoft SpyNet
membership) ......................................................................................................................... 142
How Windows Defender communicates with Internet sites when combined with Microsoft
SpyNet .................................................................................................................................. 144
Procedures for configuring Windows Defender ....................................................................... 146
Windows Error Reporting and the Problem Reports and Solutions Feature in Windows 7 and
Windows Server 2008 R2 ........................................................................................................ 148
Benefits and purposes of Windows Error Reporting and the Problem Reports and Solutions
feature ................................................................................................................................... 148
Consent levels in Windows Error Reporting ......................................................................... 149
Options for controlling Windows Error Reporting on a computer running Windows
Server 2008 R2 ................................................................................................................. 149
Overview: Using Windows Error Reporting and the Problem Reports and Solutions feature in a
managed environment .......................................................................................................... 150
How Windows Error Reporting communicates with an Internet site ........................................ 150
Types of data collected ......................................................................................................... 152
Overview of the data that Windows Error Reporting collects ............................................ 152
Data collected from application errors ............................................................................... 153
Data collected from handwriting recognition errors ........................................................... 153
Data collected from the Japanese Input Method Editor .................................................... 154
Data collected from Windows kernel failures .................................................................... 154
Controlling Windows Error Reporting to prevent the flow of information to and from the Internet
.............................................................................................................................................. 155
Using an answer file with an unattended installation ............................................................ 155
Selected Group Policy settings for Windows Error Reporting .............................................. 155
Setting to redirect Windows Error Reporting to a server on your intranet ......................... 155
Setting to control the degree of prompting that occurs before data is sent ...................... 156
Setting to disable reporting handwriting recognition errors ............................................... 157
Setting for disabling Windows Error Reporting ................................................................. 157
Procedures to configure Windows Error Reporting .................................................................. 157
Windows Media Player and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 163
Benefits and purposes of Windows Media Player .................................................................... 163
Overview: Using Windows Media Player in a managed environment ..................................... 164
How Windows Media Player communicates with Internet sites ............................................... 166
Communication with the WindowsMedia.com site ............................................................... 166
Communication with the Windows Media site on Microsoft.com .......................................... 167
Communication with other sites ............................................................................................ 167
Data exchanged during communication with the Internet .................................................... 167
Information sent or received when specific features are used .......................................... 168
Default settings, triggers, and user notifications ............................................................... 170
Logging, encryption, and privacy....................................................................................... 173
Transmission protocols and ports ..................................................................................... 173
Enabling and disabling features ........................................................................................ 174
Controlling Windows Media Player to limit the flow of information to and from the Internet .... 174
Controlling Windows Media Player through the user interface ............................................. 174
Settings that can be controlled through Group Policy .......................................................... 177
Other ways to control Windows Media Player ...................................................................... 177
Procedures for configuring Windows Media Player ................................................................. 178
Specifying information for streaming media protocols .......................................................... 179
Windows Media Services and Resulting Internet Communication in Windows Server 2008 R2 182
Benefits and purposes of Windows Media Services ................................................................ 182
Requirements for Windows Media Services ......................................................................... 183
Examples of features that help you control communication to and from a server running
Windows Media Services ...................................................................................................... 184
Authentication ....................................................................................................................... 184
Authorization ......................................................................................................................... 184
Firewall information for Windows Media Services ................................................................... 185
Configuring firewalls for unicast streaming ........................................................................... 185
Configuring firewalls for multicast streaming ........................................................................ 187
Installable features associated with Windows Media Services ................................................ 188
Procedures for installing or removing Windows Media Services and its associated features . 189
Printed reference .................................................................................................................. 191
Windows Time Service and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 192
Benefits and purposes of Windows Time Service .................................................................... 192
Overview: Using Windows Time Service in a managed environment ..................................... 192
How Windows Time Service communicates with sites on the Internet .................................... 193
When a computer running Windows 7 or Windows Server 2008 R2 is part of a workgroup 193
When a computer running Windows 7 or Windows Server 2008 R2 is a member of a domain
........................................................................................................................................... 193
Communication between Windows Time Service and the Internet ...................................... 194
Controlling Windows Time Service to limit the flow of information to and from the Internet .... 195
How Windows Time Service can affect users and applications ........................................... 195
Configuration settings for Windows Time Service ................................................................... 196
Procedures for configuring Windows Time Service ................................................................. 198
Starting and stopping Windows Time Service ...................................................................... 199
Synchronizing computers with time sources ........................................................................ 200
Troubleshooting a computer that is unable to synchronize with a time server ........................ 201
To resynchronize the time on a client computer with a time server .................................. 201
Windows Update and Resulting Internet Communication in Windows 7 and Windows Server 2008
R2 ............................................................................................................................................. 203
Benefits and purposes of Windows Update ............................................................................. 203
Windows Update options ...................................................................................................... 204
Alternatives to automatic updating and the Windows Update Web servers ......................... 205
Windows Server Update Services ..................................................................................... 205
Systems management software ........................................................................................ 205
Overview: Using Windows Update in a managed environment ............................................... 206
How automatic updating communicates through the Internet .................................................. 206
Controlling automatic updating and access to Windows Update to limit the flow of information to
and from the Internet ............................................................................................................ 207
How disabling automatic updating or preventing access to Windows Update can affect users
and applications................................................................................................................. 208
Procedures for controlling automatic updating and access to Windows Update ..................... 209
Appendix A: Resources for Learning About Automated Installation and Deployment for Windows
7 and Windows Server 2008 R2 .............................................................................................. 212
Overview: Automated installation and deployment methods in a managed environment ....... 212
Methods for automating the setup process .............................................................................. 212
Using Windows System Image Manager to create answer files ....................................... 214
Using scripts for configuring computers ............................................................................ 214
Appendix B: Resources for Learning About Group Policy for Windows 7 and Windows Server
2008 R2 .................................................................................................................................... 215
Installing the Group Policy Management Console on a computer running Windows 7 ........... 215
Installing the Group Policy Management Console on a server running Windows Server 2008 R2
.............................................................................................................................................. 216
Using the Group Policy Management Console to view or change Group Policy settings ....... 216
Appendix C: Group Policy Settings Listed Under the Internet Communication Management
Category in Windows 7 and Windows Server 2008 R2 ........................................................... 218
Overview of Group Policy settings listed under the Internet Communication Management
category ................................................................................................................................ 218
Controlling multiple Group Policy settings through the Restrict Internet Communications setting
.............................................................................................................................................. 219
Group Policy settings that affect computer configuration......................................................... 219
Individual Group Policy settings that affect computer configuration for Windows
Server 2008 R2 ................................................................................................................. 220
Group Policy settings that affect user configuration ................................................................. 223
Group Policy settings that affect user configuration in Windows 7 and Windows
Server 2008 R2 ................................................................................................................. 223
Appendix D: Search, Games, and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 ........................................................................................................................ 227
Start menu Search and Internet communication ...................................................................... 227
Games Explorer and Internet communication .......................................................................... 227
Appendix E: Telnet Client and Telnet Server in Windows 7 and Windows Server 2008 R2....... 229
How to turn on Telnet and Telnet features ............................................................................... 229
Appendix F: Internet Connection Sharing, Network Bridge, and HomeGroup in Windows 7 and
Windows Server 2008 R2 ........................................................................................................ 230
Overview: Internet Connection Sharing, Network Bridge, and HomeGroup ............................ 230
Using ICS, Network Bridge, and HomeGroup in a managed environment .............................. 231
Controlling the use of ICS, Network Bridge, and HomeGroup ................................................. 232
Viewing ICS settings on a computer running Windows 7 or Windows Server 2008 R2 ....... 232
Disabling ICS and Network Bridge by using an answer file for unattended or remote
installation .......................................................................................................................... 232
Disabling ICS and Network Bridge by using Group Policy ................................................... 233
Managing HomeGroup settings for domain-joined computers ............................................. 233
Appendix G: Windows Firewall in Windows 7 and Windows Server 2008 R2 ............................ 236
Overview: Windows Firewall .................................................................................................... 236
Group Policy setting for disabling Windows Firewall ............................................................... 237
Appendix H: Network Connectivity Status Indicator and Resulting Internet Communication in

Windows 7 and Windows Server 2008 R2 ............................................................................... 239
Benefits and purposes of the Network Connectivity Status Indicator ...................................... 239
Overview: Using NCSI in a managed environment .................................................................. 240
How NCSI communicates with an Internet site ........................................................................ 240
Controlling communication between NCSI and an Internet site .............................................. 241
Procedures for controlling communication between NCSI and an Internet site ...................... 241
Appendix I: Message Queuing and Internet Communication in Windows Server 2008 R2 ........ 243
Purposes of Message Queuing 5.0 .......................................................................................... 243
Overview: Using Message Queuing in a managed environment ............................................. 243
Examples of security-related features in Message Queuing ................................................... 244
Procedures for installing, uninstalling, and viewing Help for Message Queuing ..................... 244
Viewing the operating system Help documentation for Message Queuing .......................... 245
Appendix J: Wizards in Windows 7 and Windows Server 2008 R2 Related to Connecting to the
Internet ..................................................................................................................................... 247
Connect to the Internet Wizard ................................................................................................ 247
Making the Setup button in Internet Options unavailable.................................................. 247
Add Network Location Wizard .................................................................................................. 248
Using Group Policy to control the Add Network Location Wizard ........................................ 248
Using Windows 7 and Windows Server 2008
R2: Controlling Communication with the
Internet
This document provides information about the communication that flows between the features in
Windows® 7 and Windows Server® 2008 R2 and sites on the Internet. It also describes steps to
take to limit, control, or prevent that communication in an organization with many users.
For more information about what is and is not covered in this document, see Introduction to
Controlling Communication with the Internet in Windows 7 and Windows Server 2008 R2.
Note
For a Web version of this document, see Using Windows 7 and Windows
Server 2008 R2: Controlling Communication with the Internet in the Windows Server
TechCenter (http://go.microsoft.com/fwlink/?LinkId=161322).
Previous versions of this document discussed the client and server versions of Windows
separately, although most of the information and guidance pertained to both. This document
combines the information about Internet communication as it pertains to Windows 7 and Windows
Server 2008 R2. If applicable, differences in how a feature is implemented in Windows 7 and
Windows Server 2008 R2 are noted in each section. For example, certain features that are
included automatically in Windows 7 must be installed separately on computers running Windows
Server 2008 R2.
The following sections of the document pertain only to Windows Server 2008 R2:
 Active Directory-Related Services and Resulting Internet Communication in Windows Server
2008 R2
 Remote Desktop Gateway and Resulting Internet Communication in Windows Server 2008
R2
 Remote Desktop Licensing and Resulting Internet Communication in Windows Server 2008
R2
 Remote Desktop Web Access and Resulting Internet Communication in Windows Server
2008 R2
The following sections of this document pertain to both Windows 7 and Windows Server 2008 R2:
 Activation and Resulting Internet Communication in Windows 7 and Windows Server 2008
R2
13
 Certificate Support and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Device Manager, Hardware Wizards, and Resulting Internet Communication in Windows 7
and Windows Server 2008 R2
 Dynamic Update and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Event Viewer and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 File Association Web Service and Resulting Internet Communication in Windows 7 and
Windows Server 2008 R2
 Help and Support Features that Communicate Through the Internet in Windows 7 and
 Internet Explorer 8 and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Internet Information Services and Resulting Internet Communication in Windows 7 and
 Internet Printing and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Internet Protocol Version 6, Teredo, and Related Technologies in Windows 7 and Windows
Server 2008 R2
 Plug and Play and Resulting Internet Communication in Windows 7 and Windows Server 7
 Program Compatibility Features and Resulting Internet Communication in Windows 7 and
 Remote Assistance and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2
 SmartScreen Filter and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Windows Customer Experience Improvement Program and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2
 Windows Defender and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2
 Windows Error Reporting and the Problem Reports and Solutions Feature in Windows 7 and
 Windows Media Player and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2
 Windows Media Services and Resulting Internet Communication in Windows Server 2008 R2
 Windows Time Service and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2
14
 Windows Update and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
15
The following appendices provide additional valuable information that pertains to both
Windows 7and Windows Server 2008 R2:
 Appendix A: Resources for Learning About Automated Installation and Deployment for
Windows 7 and Windows Server 2008 R2
 Appendix B: Resources for Learning About Group Policy for Windows 7 and Windows Server
2008 R2
 Appendix C: Group Policy Settings Listed Under the Internet Communication Management
Category in Windows 7 and Windows Server 2008 R2
 Appendix D: Search, Games, and Resulting Internet Communication in Windows 7 and
 Appendix E: Telnet Client and Telnet Server in Windows 7 and Windows Server 2008 R2
 Appendix F: Internet Connection Sharing, Network Bridge, and HomeGroup in Windows 7
 Appendix G: Windows Firewall in Windows 7 and Windows Server 2008 R2
 Appendix H: Network Connectivity Status Indicator and Resulting Internet Communication in
 Appendix I: Message Queuing and Internet Communication in Windows Server 2008 R2
 Appendix J: Wizards in Windows 7 and Windows Server 2008 R2 Related to Connecting to
the Internet
16
Introduction to Controlling Communication
with the Internet in Windows 7 and Windows
Server 2008 R2
Windows Server® 2008 R2 and Windows® 7 include a variety of technologies that communicate
with the Internet to provide increased ease-of-use and functionality. Browser and e-mail
technologies are examples, but there are also technologies such as automatic updating that help
you obtain the latest software and product information, including bug fixes and software updates.
These technologies provide many benefits for users, but they also involve communication with
Internet sites, which administrators might want to control.
You can control this communication through a variety of options that are built in to individual
features, the operating system, and features that are designed for managing configurations
across your organization. For example, as an administrator, you can use Group Policy settings to
control the way some features communicate. For some features, you can create an environment
in which all communication is directed to the organization’s internal Web site instead of to an
external Internet site.
This document provides information about the communication that flows between features in
Windows Server 2008 R2 and Windows 7 and Internet sites, and it describes steps to take to
limit, control, or prevent that communication in an organization with many users. This document is
designed to assist you, the administrator, in planning strategies for deploying and maintaining
Windows Server 2008 R2 and Windows 7 in a way that helps provide an appropriate level of
security and privacy for your organization’s networked assets.
This document provides guidelines for controlling features in the following operating systems:
 Windows 7 Ultimate
 Windows 7 Enterprise
 Windows 7 Professional
 Windows Web Server 2008 R2
 Windows Server 2008 R2 Standard
 Windows Server 2008 R2 Enterprise
 Windows Server 2008 R2 Datacenter
For more information about the features that are available in each edition of Windows
Server 2008 R2 and Windows 7, see the following sites on the Microsoft.com Web site:
 Windows Server 2008 R2 Product Information
 What's New for IT Pros in Windows 7
17
What this document includes
This document is organized around individual features that are found in Windows Server 2008 R2
and Windows 7, so that you can find detailed information for any feature you are interested in.
In this section
Standard computer information that is sent by Internet-enabled features
Types of features that are covered in this document
Types of features that are not covered in this document
Security basics that are beyond the scope of this document and resources for these security
basics
Standard computer information sent by Internet-enabled

features
When you use software with Internet-enabled features, information about your computer
("standard computer information") is sent to the Web sites you visit and online services you use.
Microsoft® uses standard computer information to provide you with Internet-enabled services, to
help improve our products and services, and for statistical analysis. Standard computer
information typically includes information such as your IP address, operating system version,
browser version, and regional and language settings. In some cases, standard computer
information may also include hardware ID, which indicates the device manufacturer, device
name, and version. The purpose of this document is not to describe standard computer
information sent by Internet-enabled features in Windows Server 2008 R2 and Windows 7.
Instead this document describes the additional information that can be sent or received by these
features and how to manage this information.
Types of features covered in this document

This document provides the following:
 Information about features that in the normal course of operation send information to or
receive information from Internet sites. An example of this type of feature is Windows Error
Reporting. If you choose to use this feature, it sends information to a site on the Internet.
For more information, see Windows Error Reporting and the Problem Reports and Solutions
Feature in Windows 7 and Windows Server 2008 R2 later in this document.
 Information about features that routinely display buttons or links that make it easy for you to
initiate communication with Internet sites. An example of this type of feature is Event Viewer.
If you open an event in Event Viewer and click a link, you are prompted with a message box
that says, "Event Viewer will send the following information across the Internet. Is this OK?" If
you click OK, information about the event is sent to a Web site, which replies with information
that might be available about that event.
 Brief descriptions of features like Internet Information Services (IIS), which is designed to
communicate with the Internet. It is beyond the scope of this document to describe all
18
aspects of maintaining appropriate levels of security in an organization running servers that
communicate across the Internet. This document does, however, provide basic information
about how components such as Internet Information Services work. It provides sources of
information about balancing your organization’s requirements for Internet communication with
requirements for protecting networked assets.
Types of features not covered in this document

This document does not provide the following:
 Information about managing or working with applications, scripts, utilities, Web interfaces,
Microsoft ActiveX® controls, extensible user interfaces, Microsoft .NET Framework, and
application programming interfaces (APIs). These are applications or layers that support
applications, and they provide extensions that go beyond the operating system itself.
 Information about Windows Installer—although Windows Installer includes some technology
that you can choose to use for installing drivers or other software from the Internet. Windows
Installer packages are not described here because they involve scripts or utilities that are
created specifically for communicating across the Internet.
Note
Among the applications that are not covered in this document are Web-based
and server-based applications such as databases, e-mail, or instant messaging.
You must work with your software provider to learn how to mitigate risks that are
part of using particular applications (including Web-based or server-based
applications), scripts, utilities, and other software that runs on Windows
Server 2008 R2 and Windows 7
 Information about features that store local logs that could potentially be made available to
support personnel or others. You may want to treat this information like other sensitive
information by providing guidelines for your support staff about handling logs and other
information that you want to protect.
Security basics that are beyond the scope of this document

This document is designed to assist you, the administrator, in planning strategies for deploying
and maintaining Windows Server 2008 R2 and Windows 7 in a way that provides an appropriate
level of security and privacy for your organization’s networked assets. This document does not
describe security basics, that is, strategies and risk-management methods that provide a
foundation for security across your organization. It is assumed that you are actively evaluating
and studying these security basics as a standard part of network administration.
Some security basics that are a standard part of network administration include:
 Monitoring. This includes using a variety of software tools, including tools to assess which
ports are open on servers and clients.
 Virus-protection software.
19
 The principle of least privilege (for example, not logging on as an administrator if logging on
as a user is just as effective).
 The principle of running only the services and software that are necessary—that is, stopping
unnecessary services and keeping computers (especially servers) free of unnecessary
software.
 Strong passwords—that is, requiring all users and administrators to choose passwords that
are not easily broken.
 Risk assessment as a basic element in creating and implementing security plans.
 Software deployment and maintenance routines to help ensure that your organization’s
software is running with the latest security updates and patches.
 Defense-in-depth. In this context, defense-in-depth (also referred to as in-depth defense)
means creating redundancy in security systems. An example is using firewall settings
together with Group Policy to control a particular type of communication with the Internet.
Resources about security basics

The following books and Web sites are a few of the many sources of information about the
security basics described previously:
 Meier, J.D., et al. "Improving Web Application Security: Threats and Countermeasures."
Redmond, WA: Microsoft Press, 2003
For more information, see Improving Web Application Security: Threats and
Countermeasures.
 Howard, Michael, and David LeBlanc. "Writing Secure Code, Second Edition." Redmond,
WA: Microsoft Press, 2003
 Howard, Michael, and David LeBlanc. ―Writing Secure Code for Windows Vista.‖ Redmond,
WA: Microsoft Press, 2007
 Anderson, Ross J. ―Security Engineering: A Guide to Building Dependable Distributed
Systems, Second Edition.‖ Hoboken, NJ: John Wiley & Sons, 2008
 Johansson, Jesper M., and the Microsoft Security Team. "Microsoft Windows Security
Resource Kit, Second Edition." Redmond, WA: Microsoft Press, 2008
 Security Central
 Infrastructure Planning and Design
 Security and Protection for Windows Server 2008 and Windows Server 2008 R2
 Featured Security Content on the Security Developer Center
 Security TechCenter
 Security Guidance
 Microsoft Trustworthy Computing: Privacy
20
Active Directory-Related Services and
Resulting Internet Communication in
In this section
Benefits and purposes of AD FS and AD RMS
Overview of AD FS, federated applications and resulting communication across the Internet
Port configurations for AD FS
Additional references for AD FS and federated Web application design
Additional references for AD RMS
This section provides overview information about how Active Directory® Federation Services
(AD FS) communicates across the Internet. It also provides brief overview information about
Active Directory Rights Management Services (AD RMS), which your organization might use to
send information across the Internet.
For information about Active Directory Certificate Services (AD CS), which focuses on the
handling of certificates in your organization, see Certificate Support and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2 later in this document.
Note
It is beyond the scope of this document to describe all aspects of maintaining appropriate
levels of security in an organization that is running servers that support users who are
communicating across the Internet. This section, however, provides overview information
and suggestions for other sources of information about using AD FS. You can use AD FS
as part of a strategy for balancing your organization’s requirements for Internet
communication with requirements for protecting networked assets.
Benefits and purposes of AD FS and AD RMS

Active Directory Federation Services (AD FS) is a server role in Windows Server® 2008 R2 that
you can use to create a highly extensible, security-enhancing, and scalable identity Internet
access solution that can operate across multiple platforms, including Windows® and non-
Windows environments. AD FS provides browser-based clients (internal or external to your
network) with a seamless "one prompt" logon process. This logon allows access to one or more
protected Internet-facing applications, even when the user accounts and applications are located
in different networks or organizations.
Active Directory Rights Management Services (AD RMS) is a server role in Windows
Server 2008 R2 that you can use to augment your organization's security strategy. You can
protect information through persistent usage policies, which remain with the information
21
regardless of where it is moved. You can use AD RMS to help prevent sensitive information, such
as financial reports, product specifications, customer data, and confidential e-mail messages,
from intentionally or accidentally being compromised by a malicious user.
Overview of AD FS, federated applications and

resulting communication across the Internet
If you want to support Web single-sign-on (SSO) technologies to authenticate a user to multiple
Web applications over the life of a single online session, you can use AD FS in connection with
appropriately designed Web applications, also known as federated applications. AD FS provides
support to federated applications by helping secure digital identity and entitlement rights, or
"claims," which are shared across security and enterprise boundaries. Because of the relationship
between AD FS and federated Web applications, you can control the resulting Internet
communication by controlling the design of the applications and the design of your AD FS
configuration.
It is beyond the scope of this document to provide guidelines about how to design an AD FS
configuration or a federated Web application. For more information, see Additional references for
AD FS and Federated Web Application Design later in this section.
Port configurations for AD FS

Because AD FS serves Web browser clients over a Hypertext Transfer Protocol Secure (HTTPS)
connection, the connectivity through HTTPS must be available to the federation servers and
federation server proxies. The default port for HTTPS is port 443, but other port numbers may be
configured depending on your IIS configuration. Your firewalls between clients and federation
servers or federation server proxies must be configured to allow HTTPS traffic.
Just as clients need HTTPS connectivity to the federation server, the federation server proxy
requires HTTPS connectivity to the federation server.
If any certificate that you use has certificate revocation lists (CRLs), the server with the configured
certificate must be able to contact the server that distributes the CRLs. The type of CRL
determines the ports that are used.
The AD FS design called "Federated Web SSO with Forest Trust" has specific port requirements.
For more information, see Federated Web SSO with Forest Trust design.
For information about the port requirements that are associated with forest trusts, see the last
section of How Domain and Forest Trusts Work.
Additional references for AD FS and federated

Web application design
Extensive information is available on TechNet and MSDN about AD FS and about federated
application design. For information about Active Directory Certificate Services (AD CS), which
22
focuses on the handling of certificates in your organization, see Certificate Support and Resulting
Internet Communication in Windows 7 and Windows Server 2008 R2 later in this document.
 For a list of links to information about AD FS, see:
Active Directory Federation Services
 For information about designing an AD FS configuration and about key concepts for AD FS
designs, see:
 ADFS Design Guide
 Appendix B: Reviewing Key ADFS Concepts
 For information about how AD FS can affect privacy, see:
Review how ADFS may affect privacy
 For information about how a developer can build AD FS-aware Web applications, see:
Active Directory Federation Services
Additional references for AD RMS

Extensive information is available on TechNet and MSDN about AD RMS.
 For a list of links to information about AD RMS, see:
Active Directory Rights Management Services
 For an overview of AD RMS, see:
Active Directory Rights Management Services Overview
 For information about using AD RMS with AD FS, see:
AD RMS with AD FS Identity Federation Step-by-Step Guide
23
Remote Desktop Gateway and Resulting
Internet Communication in Windows Server
2008 R2
In this section
Benefits and purposes of Remote Desktop Gateway
Examples of security-related features in Remote Desktop Gateway
Procedure for viewing or changing Group Policy settings that affect Remote Desktop Gateway in
Additional references
This section provides overview information about Remote Desktop Gateway (RD Gateway) and
information about some Group Policy settings that affect RD Gateway. The section also provides
suggestions for other sources of information about RD Gateway to help you balance your
organization’s requirements for communication across the Internet with your organization’s
requirements for protection of networked assets. However, it is beyond the scope of this
document to describe all aspects of maintaining appropriate levels of privacy and security in an
organization running servers that use RD Gateway to support remote users who are
communicating across the Internet.
Benefits and purposes of Remote Desktop

Gateway
Remote Desktop Gateway is a role service that enables authorized remote users to connect to
resources on an internal corporate or private network, from any Internet-connected device that
can run the Remote Desktop Connection (RDC) client version 6. The network resources can be
Remote Desktop Session Host (RD Session Host) servers, RD Session Host servers running
RemoteApp programs, Remote Desktop Virtualization Host, or computers with Remote Desktop
enabled.
RD Gateway uses the Remote Desktop Protocol (RDP) over Hypertext Transfer Protocol Secure
(HTTPS) to establish a secure, encrypted connection between remote users on the Internet and
the internal network resources on which their productivity applications run.
RD Gateway enables remote users to connect to internal network resources over the Internet by
using an encrypted connection without configuring a virtual private network (VPN) connection.
For more information about RD Gateway, see Additional references later in this section.
24
Examples of security-related features in Remote
Desktop Gateway
RD Gateway includes a variety of settings and features related to security, some of which are
described in the following list. For additional information about security-related improvements in
RD Gateway, see Additional references later in this topic.
 RD Gateway provides a comprehensive security configuration model that enables you to
control access to specific internal network resources.
 RD Gateway provides a point-to-point RDP connection, rather than allowing remote users
access to all internal network resources.
 RD Gateway enables most remote users to connect to internal network resources that are
hosted behind firewalls in private networks and across network address translators. You do
not need to perform additional configuration for the RD Gateway server or clients for this
scenario.
Prior to Windows Server® 2008, security measures prevented remote users from connecting
to internal network resources across firewalls and network address translators. This is
because port 3389, the port used for RDP connections, is typically blocked for network
security purposes at the firewalls and proxies. Remote Desktop transmits RDP traffic by
using RPC over HTTPS tunnel on port 443. Because most corporations open port 443 to
enable Internet connectivity, RD Gateway takes advantage of this network design to provide
remote access connectivity across multiple firewalls and proxies.
 The Remote Desktop Gateway Manager enables you to configure authorization policies that
define conditions that must be met for remote users to connect to internal network resources.
For example, you can specify the following:
 Who can connect to network resources (the user groups that can connect)
 What network resources (computer groups) users can connect to
 Whether client computers must be members of Active Directory® security groups
 Whether device redirection is allowed
 Whether clients need to use smart card authentication or password authentication, or
whether they can use either method
 You can configure RD Gateway servers and Remote Desktop Services clients to use
Network Access Protection (NAP) to further enhance security. NAP is a health policy
creation, enforcement, and remediation technology that is included in Windows
Server 2008 R2, Windows Server 2008, Windows® 7, Windows Vista®, and Windows XP
Service Pack 3. With NAP, system administrators can enforce health requirements, which
can include software requirements, security update requirements, required computer
configurations, and other settings.
Note
Computers running Windows Server 2008 R2 or Windows Server 2008 cannot
be used as NAP clients when RD Gateway enforces NAP. Only computers
25
running Windows 7, Windows Vista, and Windows XP SP3 can be used as NAP
clients when RD Gateway enforces NAP.
For information about how to configure RD Gateway to use NAP for health policy
enforcement for Remote Desktop Services clients that connect to RD Gateway servers, see
Remote Desktop Services.
 You can use RD Gateway server with Microsoft® Internet Security and Acceleration (ISA)
Server to enhance security. In this scenario, you can host RD Gateway servers in a private
network rather than a perimeter network, behind an ISA Server. The SSL connection from the
Remote Desktop Services client can be terminated at the ISA Server, which is accessible
from the Internet.
For information about how to configure ISA Server as an SSL termination device for
RD Gateway server scenarios, see Remote Desktop Services.
 The Remote Desktop Gateway Manager provides tools to help you monitor RD Gateway
connection status, health, and events. By using Remote Desktop Gateway Manager, you can
specify events (such as unsuccessful connection attempts to the RD Gateway server) that
you want to monitor for auditing purposes.
Procedure for viewing or changing Group Policy

settings that affect Remote Desktop Gateway in
The following procedure explains how to view or change Group Policy settings that affect
RD Gateway in Windows Server 2008 R2.
To view or change Group Policy settings that affect Remote Desktop Gateway
1. As needed, see Appendix B: Resources for Learning About Group Policy for Windows 7
and Windows Server 2008 R2, and then edit an appropriate Group Policy object (GPO).
2. Expand User Configuration, expand Policies (if present), expand Administrative
Templates, expand Windows Components, expand Remote Desktop Services, and
then click RD Gateway.
3. In the details pane, double-click each setting that you want to view or change. If you want
more information about a setting, double-click the setting and then click the Explain tab.
For all of these settings, if you select Enabled, you can then select or clear a check box
labeled Allow users to change this setting. The settings are as follows:
 Set RD Gateway authentication method
 Enable connection through RD Gateway
 Set RD Gateway server address
26
For more information, see the following resources:
 Remote Desktop Services
R2
2008 R2
27
Remote Desktop Licensing and Resulting
2008 R2
In this section
Purpose of Remote Desktop Licensing
Overview: Using Remote Desktop Licensing in a managed environment
How Remote Desktop Licensing communicates with Internet sites
Controlling Remote Desktop Licensing to limit the flow of information to and from the Internet
This section provides overview information about Remote Desktop Licensing (RD Licensing),
formerly Terminal Services Licensing (TS Licensing), and also provides suggestions for other
sources of information about RD Licensing to help you balance your organization’s requirements
for communication across the Internet with your organization’s requirements for protecting
networked assets. However, it is beyond the scope of this document to describe all aspects of
maintaining appropriate levels of privacy and security in an organization running servers that use
RD Licensing.
Purpose of Remote Desktop Licensing

RD Licensing manages the Remote Desktop Services client access licenses (RDS CALs) that are
required for each device or user to connect to a Remote Desktop Session Host (RD Session
Host) server. You use RD Licensing to install, issue, and track the availability of RDS CALs on a
Remote Desktop license server. Although there is a licensing grace period during which no
license server is required, after the grace period ends, clients must have a valid RDS CAL issued
by a license server before they can log on to an RD Session Host server.
For more information about RD Licensing, see Overview of Remote Desktop Licensing in the
Windows Server® 2008 R2 Technical Library.
Overview: Using Remote Desktop Licensing in a

managed environment
The RD Licensing role service is not installed by default in Windows Server 2008 R2.
If you install the RD Licensing role service on a computer, you will need to communicate with the
Microsoft® Clearinghouse to configure and maintain RD Licensing. To perform these operations,
you use the Remote Desktop Licensing Manager tool. The Remote Desktop Licensing Manager
tool is automatically installed on a computer on which the RD Licensing role service is installed.
28
Note
RD Licensing is not available in Windows® Web Server 2008 R2, Windows
Server 2008 R2 for Itanium-Based Systems, or the Server Core installation option of
Windows Server 2008 R2.
The Microsoft Clearinghouse is the facility that Microsoft maintains to activate Remote Desktop
license servers, issue RDS CALs to license servers, recover RDS CALs, and deactivate or
reactivate license servers. The Microsoft Clearinghouse stores information about all activated
license servers and RDS CALs that have been issued.
You can control the communication that occurs between RD Licensing and the Microsoft
Clearinghouse by choosing the server or servers on which to install the RD Licensing role
service, and by choosing among three methods of communication. The three methods of
communication are as follows:
 Automatic. This method requires Internet connectivity from the computer running the
Remote Desktop Licensing Manager tool. Internet connectivity is not required from the
license server itself. This method uses TCP/IP (TCP port 443) to connect directly to the
Microsoft Clearinghouse.
 Web Browser. This method can be used when the computer running the Remote Desktop
Licensing Manager tool does not have Internet connectivity, but you have access to the
Internet by means of a Web browser from another computer.
 Telephone. This method allows you to talk to a Microsoft customer service representative to
complete the desired action. The appropriate telephone number is determined by the country
or region that you have specified in Remote Desktop Licensing Manager.
To configure the method of communication, use the Remote Desktop Licensing Manager tool.
The Remote Desktop Licensing Manager tool uses the term "connection method" to refer to the
method of communication.
How Remote Desktop Licensing communicates

with Internet sites
The Remote Desktop Licensing Manager tool communicates with the Microsoft Clearinghouse on
the Internet only when you initiate certain actions, such as activating the license server or
installing RDS CALs, and only when you are using the Automatic connection method. If you use
the Web Browser connection method, information will be passed between the computer on which
you are using the Web browser and the Remote Desktop Services Licensing Web site.
Note
The information in the following list applies only when you are using the Automatic
connection method or Web Browser connection method. It does not apply when you use
the Telephone connection method.
The rest of this subsection describes various aspects of the RD Licensing data that is sent to and
from the Internet and how the exchange of information takes place.
29
 Specific information sent: Depending on which user action is being performed and the
Remote Desktop configuration, some or all of the following information is sent to the Microsoft
Clearinghouse by using an encrypted connection:
 User account information, which may include:
 First name
 Last name
 Company
 Country or Region
 E-mail
 Organizational unit
 Company address
 City
 State/province
 Postal code
 License server ID
 Product ID
 License program
 License code
 Agreement number
 Product version
 License type
 License quantity
 Reason for reactivating the license server
 Reason for migrating RDS CALs
 Reason for rebuilding the RD Licensing database
 Specific information received: Depending on which action is being performed, some or all
of the following information is received from the Microsoft Clearinghouse by using an
encrypted connection:
 License server ID
 Limited-use X.509 industry standard digital certificate, which is used to validate license
server ownership and identity
 License key pack ID
 Default settings: RD Licensing is not installed by default.
 User notification and triggers: The administrator triggers the activation, deactivation, and
reactivation of license servers, and triggers the installation and migration of RDS CALs by
using the Remote Desktop Licensing Manager tool.
30
 Logging: RD Licensing logs events in the system log. These events can be viewed through
Event Viewer.
 Encryption: RD Licensing uses the HTTP protocol over Secure Sockets Layer (SSL) to
communicate on the Internet.
 Access: The Microsoft Clearinghouse is the database that Microsoft maintains to activate
license servers and to issue client license key packs. Microsoft customer service
representatives have access to the licensing information, and they can successfully re-create
the information on your Remote Desktop license server if technical problems occur.
 Privacy: For information about privacy, see Remote Desktop Services License Management
and Your Privacy in the Windows Server 2008 R2 Technical Library.
 Transmission protocol and port: HTTPS over port 443 and remote procedure call (RPC)
over port 135.
 Ability to disable: The RD Licensing role service is not installed by default. However, when it
is installed, it can be uninstalled. For more information, see Uninstall the Remote Desktop
Licensing Role Service in the Windows Server 2008 R2 Technical Library.
Controlling Remote Desktop Licensing to limit the

flow of information to and from the Internet
You can control RD Licensing-related communication that occurs with Internet sites in the
following ways:
 Install the Remote Desktop Licensing role service only on selected servers. This follows
the basic principle of stopping unnecessary services and keeping computers (especially
servers) free of unnecessary software. For information about installing the RD Licensing role
service, see Checklist: Remote Desktop Licensing Installation Prerequisites in the Windows
Server 2008 R2 Technical Library.
 Install or run the Remote Desktop Licensing Manager tool only on selected computers.
The computer running Remote Desktop Licensing Manager is the computer that
communicates directly with the Microsoft Clearinghouse when you perform actions by using
the Automatic connection method. For more information, see Running Remote Desktop
Licensing Manager in the Windows Server 2008 R2 Technical Library.
 Review the connection method that you want to use to perform Remote Desktop
Licensing-related actions. For information about the three connection methods that are
available, see Overview: Using Remote Desktop Licensing in a managed environment.
 Remote Desktop Licensing Manager Help in the Windows Server 2008 R2 Technical Library
 Remote Desktop Services page in the Windows Server 2008 R2 Technical Library
31
R2
2008 R2
32
Remote Desktop Web Access and Resulting
2008 R2
In this section
Benefits and purposes of Remote Desktop Web Access
Roles and role services used with Remote Desktop Web Access
Default port and authentication settings with Remote Desktop Web Access
Additional ports required for Remote Desktop Web Access
This section provides overview information and suggestions for other sources of information
about balancing your organization’s requirements for communication across the Internet with your
organization’s requirements for protection of networked assets. It is beyond the scope of this
document to describe all aspects of maintaining appropriate levels of security in an organization
running servers that use Remote Desktop Web Access (RD Web Access) to offer applications
across the Internet.
Benefits and purposes of Remote Desktop Web

Access
Remote Desktop Web Access (RD Web Access), formerly Terminal Services Web Access
(TS Web Access), enables users to access RemoteApp and Desktop Connection through the
Start menu on a computer that is running Windows® 7 or Windows Server® 2008 R2 or through
a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp
programs and virtual desktops to users.
Additionally, RD Web Access includes Remote Desktop Web Connection, which enables users to
connect remotely from a Web browser to the desktop of any computer where they have Remote
Desktop access.
When a user starts a RemoteApp program, a Remote Desktop Services session is started on the
Remote Desktop Session Host (RD Session Host) server that hosts the RemoteApp program. If a
user connects to a virtual desktop, a remote desktop connection is made to a virtual machine that
is running on a Remote Desktop Virtualization Host (RD Virtualization Host) server.
33
Roles and role services used with Remote
Desktop Web Access
The Web Server (IIS) role is installed as a required component when you install RD Web Access.
For information about some of the security-related features in IIS, and links to additional
information, see Internet Information Services and Resulting Internet Communication in Windows
7 and Windows Server 2008 R2 in this document.
In addition, you can deploy RD Web Access with the Remote Desktop Gateway (RD Gateway)
role service to enable users to connect from the Internet without having to first establish a virtual
private network (VPN) connection. RD Gateway helps you secure remote connections to
resources on your corporate network, such as RD Session Host servers, RemoteApp programs,
or virtual desktops. For information about some of the security-related features in RD Gateway,
and links to additional information, see Remote Desktop Gateway and Resulting Internet
Communication in Windows Server 2008 R2 in this document.
Default port and authentication settings with

Remote Desktop Web Access
When you install RD Web Access, the following default settings apply:
 The RD Web Access Web site uses Forms-based authentication.
 The RD Web Access Web site is configured to use HTTPS for client connections to the Web
site. The default port that is used for Secure Sockets Layer (SSL) connections is TCP port
443.
Additional ports required for Remote Desktop

Web Access
When you install RD Web Access, Windows Firewall is automatically configured to allow
Windows Management Instrumentation (WMI) traffic. The RD Web Access server must be able to
communicate through WMI to the RD Session Host source server that hosts the RemoteApp
programs. Therefore, if the RD Web Access server is located in the perimeter network to allow
access from the Internet, you must ensure that the firewall rules allow WMI traffic from the
RD Web Access server to the RD Session Host source server in the internal network.
Note
To view the firewall rules that are created for WMI when you install RD Web Access,
open Windows Firewall with Advanced Security (available in the Administrative Tools
folder).
34
 Remote Desktop Web Access Help in the Windows Server 2008 R2 Technical Library
 Remote Desktop Services in the Windows Server 2008 R2 Technical Library
 Remote Desktop Gateway and Resulting Internet Communication in Windows Server 2008
R2
R2
35
Activation and Resulting Internet
Communication in Windows 7 and Windows
Server 2008 R2
In this section
Purposes of activation for Windows Server 2008 R2 and Windows 7
Overview: Activation in the context of a managed environment
How a computer communicates with sites on the Internet during activation
This section discusses the purposes of product activation in Windows® 7 and Windows Server®
2008 R2 and how activation-related features communicate across the Internet, and it explains
steps to take to limit, control, or prevent that communication in an organization with many users.
Purposes of activation for Windows

Server 2008 R2 and Windows 7
Product activation reduces software piracy and ensures that Microsoft® customers are receiving
genuine Microsoft software. Genuine Windows provides assurance that the software is reliable
and helps protect against the security threats and increased cost of ownership that can be
introduced by counterfeit software. Windows Activation Technologies help customers ensure that
they are using genuine Windows while helping to avoid the risks associated with the use of
unlicensed software. Using Genuine Windows helps ensure that software is reliable as follows:
 Ensures that the software is supported by Microsoft and its partners.

 Assists with license compliance.
 Enhances protection from the risks associated with counterfeit software, such as spyware,
malware, and viruses.
 Protects against the potential financial penalties and risks to a company’s reputation due to
using non-licensed software.
Activation of Windows operating systems is required unless you purchase new computers with
the operating system preinstalled by the manufacturer and bound to the computer’s basic
input/output system (BIOS). A person who purchases a Windows operating system to install on
an individual computer can complete activation and verify that their software is genuine through
the Internet or by phone.
If you acquire licenses through a volume license program, you can perform volume activation and
verify that the software is genuine in one of two ways: the Key Management Service (KMS) or a
Multiple Activation Key (MAK). For more information about volume activation, see Activation
Options with Volume Licensing later in this section.
36
Note
Product activation means that a specific product key becomes associated with the
computer hardware that it is installed on. Making significant changes to computer
hardware or other significant configuration changes may require that the activation
process be completed again.
For more information about product activation, see Product Activation for Windows Vista and
Windows Server 2008.
Overview: Activation in the context of a managed

environment
In an environment with many computers running Windows 7 and Windows Server 2008 R2, you
will probably want to use an activation option that is designed for use with volume licensing. The
following subsection describes these options.
Note
To avoid the activation process (online activation or telephone activation), you can
purchase new computers with the operating system preinstalled by the manufacturer and
bound to the computer’s basic input/output system (BIOS). For these computers,
activation is not necessary.
Activation options with volume licensing

Organizations that have a volume license agreement have multiple options for activation:
 Key Management Service: In managed environments where five or more computers running
Windows 7 or Windows Server 2008 R2 will be connected to the corporate network, you can
use Key Management Service (KMS) to simplify the activation process. With KMS, you
manage activations within your organization's network, rather than having each computer
communicate with a Microsoft server during activation. The computers that you activate
through KMS must connect to your organization's network at least twice a year to stay
activated.
 Multiple Activation Key: In networks where users rarely or never connect to the corporate
network, you can use a Multiple Activation Key (MAK). Each MAK belongs to a specific
organization, and it can activate multiple computers running Windows 7 or Windows
Server 2008 R2, up to the limit assigned to that MAK. You can activate these computers one
at a time (in which case each computer connects to a Microsoft server during activation) or
use MAK Proxy Activation, where a centralized activation request is sent (through a single
connection to Microsoft) on behalf of multiple computers by using the Volume Activation
Management Tool.
For more information about the Volume Activation Management Tool, see Volume Activation
Management Tool (VAMT) 1.1 (x86).
37
For more information about volume activation, see Volume Activation 2.0 for Windows Vista and
Windows Server 2008.
How a computer communicates with sites on the

Internet during activation
You can activate Windows Server 2008 R2 and Windows 7 through the Internet or by phone. The
following list describes how Windows Server 2008 R2 and Windows 7 communicate with Web
sites when they are activated through the Internet:
 Specific information sent or received: During the activation process, the following
information is sent to an activation server that is maintained by Microsoft:
 Computer make and model
 Version information for the operating system and software using Genuine Advantage
 Region and language settings
 A unique number assigned to your computer by the tools (globally unique identifier or
GUID)
 Product key (hashed) and product ID
 BIOS name, revision number, and revision date
 Hard drive volume serial number (hashed)
Important
The tools do not collect your name, address, e-mail address, or any other
information that Microsoft can use to identify you or contact.
In addition to the configuration information above, status information (such as the following) is
also transferred:
 Whether the installation was successful, if one was performed
 The result of the validation check, including information about any activation exploits and
any related malicious or unauthorized software that is found, disabled, or removed
 The name and a hash of the contents of the computer's start-up instructions file
(commonly called the boot file) to help Microsoft discover activation exploits that modified
this file
Note
If your system is identified as non-genuine, additional information may be sent to
Microsoft to better understand why your system failed validation. This information
can include error codes and the names and paths of files that compromise the
integrity of your.
For activation of an individual computer (where volume licensing is not being used), owners
can allow the preceding information to be sent over the Internet to the activation system at
38
Microsoft, or they can present the product key information and hardware hash (combined into
one number) by phone.
 Default setting and ability to disable: Product activation cannot be disabled, but if you
acquire licenses through a volume license program, you can perform Volume Activation,
through the Key Management Service (KMS) or a Multiple Activation Key (MAK). For more
information, see Activation Options with Volume Licensing earlier in this section and the
following pages on the Microsoft Web site:
 Volume Activation 2.0 for Windows Vista and Windows Server 2008
 Microsoft Volume Licensing
Note
Product activation is not necessary if you purchase new computers with the
operating system preinstalled by the manufacturer and bound to the computer’s
basic input/output system (BIOS).
 Trigger and notification: When activation is required, the operating system provides a
reminder each time a user logs on and at common intervals until the end of the activation
grace period stated in the Microsoft Software License Terms (30 days is the typical grace
period).
 Logging: Entries that track the progress of activation (for example, return codes and error
codes) are logged in Event Viewer. If activation fails, you can use these events to
troubleshoot the problem. To locate the events, click Windows Logs, click Application, and
the Source is Security-Licensing-SLC.
 Encryption and storage: The data is encrypted during transmission by using HTTPS, that is,
Secure Sockets Layer (SSL) or Transport Layer Security (TLS) with HTTP, and it is stored in
Microsoft-controlled facilities. The data is accessible to a restricted number of support
personnel who oversee and maintain the activation servers and the product activation
program.
 Privacy: Customer privacy was a paramount design goal in building the product activation
technology. Microsoft uses the information to confirm that you have a licensed copy of the
software, and then it is aggregated for statistical analysis. Microsoft does not use the
information to identify you or contact you.
 Transmission protocol and port: When Windows 7 and Windows Server 2008 R2 are
activated through the Internet and a modem is not used, the first transmission uses HTTP
through port 80. It communicates with go.microsoft.com to check the HTTP response code. A
response code of less than 500 indicates that a product activation server is available. (With a
modem, there is a check to see whether the modem can currently make a connection to the
Internet.) If the product activation server can be reached (or if the modem can make a
connection to the Internet), any activation data that is sent by Windows Product Activation
uses HTTPS through port 443 to sls.microsoft.com.
39
For more information about volume licensing, activation, and Genuine Advantage, see the
following pages on the Microsoft Web site:
 Microsoft Volume Licensing
 Volume Activation 2.0 for Windows Vista and Windows Server 2008
 Volume Activation Management Tool (VAMT) 1.1 (x86)
 Genuine Windows in the Enterprise
40
Certificate Support and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of certificate functionality
Overview: Using AD CS features in a managed environment
How Update Root Certificates communicates with Internet sites
Controlling the Update Root Certificates feature to prevent the flow of information to and from the
Internet
Procedures for viewing or changing Group Policy settings that affect certificates
This section describes how certificate-related services in Windows® 7 and Windows Server®
2008 R2 communicate across the Internet, and it explains steps to take to limit, control, or
prevent that communication in an organization with many users.
Benefits and purposes of certificate functionality

Certificates and public key infrastructures (PKIs) are an important means of enhancing the
security of communication on open networks such as the Internet, extranets, and intranets.
Certificates serve as digitally-signed statements that bind the value of a public key to the person,
device, or service that holds the corresponding private key. With certificates, host computers on
the Internet establish trust in a certification authority (CA) that certifies individuals and resources
that hold private keys. Trust in a PKI is hierarchical and ultimately based on a root certificate, that
is, a certificate from a CA at the top of a public key hierarchy that establishes a well-defined level
of integrity and security for the hierarchy.
For example, a certificate might be used when a user:
 Uses a smart card to log onto a computer or network.
 Evaluates and accepts a certificate as part of installing software.
 Encrypts an e-mail message so that only intended recipients can view it.
 Digitally signs a document to verify the identity of the signer.
When learning about PKIs, it is important to learn how certificates are issued and validated and
how they expire or are revoked (if they need to be invalidated before they expire). This can help
you understand the importance of up-to-date certificate revocation information, which can be
crucial when an application is seeking to verify that a particular certificate is currently considered
trustworthy. Certificate revocation information can be managed and distributed in the form of
certificate revocation lists (CRLs), and through Online Responders that are based on the Online
41
Certificate Status Protocol (OCSP). Applications that are presented with a certificate might
contact a site on an intranet or the Internet not only for information about CAs, but also for
certificate revocation information.
In an organization where servers run the Windows Server 2008 R2 operating system, you have a
variety of options in the way certificates and certification revocation are handled. For more
information about these options, see Additional references later in this section.
In the Group Policy settings for Windows Server 2008 R2, you can control public key policies
more specifically than in previous Windows operating systems. For more information, see
Procedures for viewing or changing Group Policy settings that affect certificates in Windows
Server 2008 R2 later in this section.
The Update Root Certificates feature in Windows 7 and Windows

Server 2008
The Update Root Certificates feature in Windows 7 and Windows Server 2008 R2 is designed to
automatically check the list of trusted authorities on the Windows Update Web site when this
check is needed by an application on the server. If the application is presented with a certificate
issued by a certification authority in a PKI that is not directly trusted, the Update Root Certificates
feature (if it is not turned off) contacts the Windows Update Web site to see if Microsoft® has
added the certificate of the root CA to its list of trusted root certificates. If the CA is on the list, its
certificate is automatically added to the set of trusted root certificates on the server.
The Update Root Certificates feature can be turned off in Windows 7 and Windows
Server 2008 R2 by using Group Policy. For more information, see Procedures for viewing or
changing Group Policy settings that affect certificates later in this section.
Overview: Using AD CS features in a managed

environment
In an organization where servers run the Windows Server 2008 R2 operating system, you have a
variety of options for handling certificates. For example, you can use the role services in Active
Directory® Certificate Services (AD CS) to establish a trusted public key infrastructure with one or
more CAs inside your organization. Another AD CS role service that can enhance the flexibility
and manageability of a PKI is the AD CS Online Responder service, which can respond to
individual client requests for information about whether certificates have been revoked.
Two AD CS role services were introduced in Windows Server 2008 R2: the Certificate Enrollment
Policy Web Service and the Certificate Enrollment Web Service. They enable certificate policy
retrieval and certificate enrollment over HTTPS to give you sophisticated control over certificate
enrollment and enrollment-related Internet communications. For more information, see Certificate
Enrollment Web Services in Windows Server 2008 R2.
When implementing public key infrastructure, we recommend that you also learn about Group
Policy settings that apply to certificates. For more information about Group Policy and the role
42
services that are available in the AD CS server role, see Additional references later in this
section.
When you configure a CA inside your organization, the certificates it issues can specify a location
of your choice for retrieval of additional evidence for validation. That location can be a Web server
or a directory within your organization. Because it is beyond the scope of this document to
provide full details about working with CAs, root certificates, certificate revocation, and other
aspects of PKIs, the following list provides conceptual information about certificates, and
Additional references later in this section, provides a list of links.
Some of the concepts to study when learning about certificates include:
 Certificates and the X.509 V3 standard (the most widely used standard for defining digital
certificates), and the public key infrastructure for X.509 (PKIX).
For more information, see the following Web sites:
 Internet Engineering Task Force
 Public-Key Infrastructure (X.509)
 Standard protocols that relate to certificates, for example, Transport Layer Security (TLS),
Secure Sockets Layer (SSL), and Secure Multipurpose Internet Mail Extensions (S/MIME),
including the following:
 Encryption keys and how they are generated
 Certification authorities, including the concept of a certification authority hierarchy and the
concept of an offline root certification authority
 Certificate revocation
In a medium to large organization, for the greatest control of Internet communication, you can
manage the list of CAs by using Group Policy to turn off the Update Root Certificates feature on
Windows 7 and Windows Server 2008 R2 and to configure public key policies.
How Update Root Certificates communicates with

Internet sites
This subsection focuses on how the Update Root Certificates feature communicates with Internet
sites.
If the Update Root Certificates feature has not been turned off through Group Policy, and the
application on your server is presented with a certificate issued by a root CA that is not directly
trusted, the Update Root Certificates feature communicates across the Internet as follows:
 Specific information sent or received: The Update Root Certificates feature sends a
request to the Windows Update Web site, asking for the current list of root CAs in the
Microsoft Root Certificate Program. If the root CA that is not directly trusted is on the list,
Update Root Certificates obtains the certificate for that root CA and places it in the trusted
certificate store on the server. No authentication or unique identification of the administrator
or user is used in this exchange.
43
 Default setting and ability to disable: Update Root Certificates is turned on by default in
Windows 7 and Windows Server 2008 R2. You can turn off this feature by using Group
Policy. For more information, see Procedures for viewing or changing Group Policy settings
that affect certificates in Windows 7 and Windows Server 2008 R2 later in this section.
 Trigger and user notification: Update Root Certificates is triggered when the administrator
or user at the computer is presented with a certificate issued by a root CA that is not directly
trusted. There is no user notification.
 Logging: Events are logged in Event Viewer. To locate the events, click Windows Logs,
click Application, and the Source is CAPI2. Events containing information such as the
following are logged:
For Event ID 4100:
Description: Successful auto update retrieval of a non-Microsoft root list sequence number
from: URL_for_Windows_Update_Web_Site
For Event ID 4101:
Description: Failed auto update retrieval of a non-Microsoft root list sequence number from:
URL_for_Windows_Update_Web_Site with error: hexadecimal_error_value
 Encryption, privacy, and storage: When requests or certificates are sent to or from Update
Root Certificates, no encryption is used. Microsoft does not track access to the list of trusted
CAs that it maintains on the Windows Update Web site.
 Transmission protocol and port: The transmission protocol is HTTP and the port is 80.
Controlling the Update Root Certificates feature to

prevent the flow of information to and from the
Internet
If you want to prevent the Update Root Certificates feature in Windows 7 and Windows
Server 2008 R2 from communicating automatically with the Windows Update Web site, you can
turn off this feature by using Group Policy. For more information, see To turn off the Update Root
Certificates feature by using Group Policy later in this section.
How turning off Update Root Certificates on a computer can

affect users and applications
If the user at the server is presented with a certificate issued by a root CA that is not directly
trusted, and the Update Root Certificates feature is turned off through Group Policy, the user can
be prevented from completing the action that required authentication. For example, the user can
be prevented from installing software, viewing an encrypted or digitally-signed e-mail message, or
using a browser to engage in an SSL session.
44
Procedures for viewing or changing Group Policy
settings that affect certificates in Windows 7 and
The procedures in this section describe:
 How to use Group Policy to turn off the Update Root Certificates feature for computers
running Windows 7 and Windows Server 2008 R2.
 How to view Group Policy for controlling public key policies for computers running Windows 7
and Windows Server 2008 R2.
To turn off the Update Root Certificates feature by using Group Policy
2. Expand Computer Configuration, expand Policies (if present), expand Administrative
Templates, expand System, expand Internet Communication Management, and then
click Internet Communication settings.
3. In the details pane, double-click Turn off Automatic Root Certificates Update, and
then click Enabled.
Important
You can also restrict Internet access for this and a number of other features by applying
the Restrict Internet communication Group Policy setting. Expand Computer
Configuration, expand Policies (if present), expand Administrative Templates,
expand System, expand Internet Communication Management, and then click
Internet Communication settings, and then select the Restrict Internet
communication Group Policy setting.
For more information about this Group Policy and the policies that it controls, see
Appendix C: Group Policy Settings Listed Under the Internet Communication
Management Category in Windows 7 and Windows Server 2008 R2.
To view Group Policy for controlling public key policies for Windows 7 and Windows
Server 2008 R2
1. For information about using Group Policy, see Appendix B: Resources for Learning About
Group Policy for Windows 7 and Windows Server 2008 R2. Using an account with
domain administrative credentials, log on to a computer that is running Windows
Server 2008 R2 (with the Group Policy Management feature installed) or Windows 7.
Then open Group Policy Management Console (GPMC) by running gpmc.msc and edit
an appropriate Group Policy object (GPO).
2. Expand Computer Configuration, expand Policies (if present), expand Windows
Settings, expand Security Settings, and then click Public Key Policies.
45
3. View the settings that are available.
4. Expand User Configuration, expand Policies (if present), expand Windows Settings,
expand Security Settings, and then click Public Key Policies.
5. View the settings that are available.
For more information, see AD CS: Policy Settings.
The following list of resources on the Microsoft TechNet Web site can help you as you plan or
modify your implementation of certificates and public key infrastructure:
 Active Directory Certificate Services
 Active Directory Certificate Services Role
 AD CS: Policy Settings
 Active Directory Certificate Services and Public Key Management
 Certificate Revocation and Status Checking
 Microsoft Root Certificate Program
For information about Active Directory Federation Services (AD FS) or Active Directory Rights
Management Services (AD RMS), see Active Directory-Related Services and Resulting Internet
Communication in Windows Server 2008 R2 in this document.
46
Device Manager, Hardware Wizards, and
In this section
Benefits and purposes of Device Manager and hardware wizards
Overview: Using Device Manager in a managed environment
How hardware wizards communicate with Internet sites
Controlling hardware wizards to limit the flow of information to and from the Internet
Procedures for controlling communication between hardware wizards and the Windows Update
Web site
This section provides information about:
 The benefits of Device Manager and hardware wizards.
 How hardware wizards communicate with Internet sites.
Device Manager provides an interface for viewing the configuration of hardware devices, and
the wizards help you install and configure the correct driver for a device. This section
describes how the wizards communicate with the Internet and provides background about
Device Manager.
 How to control hardware wizards to limit the flow of information to and from the Internet.
Notes
Hardware wizards are not the only means that you can use to download a device driver
from the Internet. On a computer running Windows® 7 or Windows Server® 2008 R2, if
automatic updating is enabled, device drivers that are specific to the devices on that
computer can be downloaded from Windows Update Web servers. For information about
Windows Update and procedures related to turning off automatic updating, see Windows
Update and Resulting Internet Communication in Windows 7 and Windows Server 2008
R2 later in this document.
This information about Device Manager and hardware wizards is also related to Plug and
Play (PnP), which is described briefly in Plug and Play and Resulting Internet
Communication in Windows 7 and Windows Server 7 later in this document.
Benefits and purposes of Device Manager and

hardware wizards
Hardware wizards supplement Device Manager functionality.
47
Device Manager
Device Manager is one of a group of technologies that support the installation of hardware
devices and the device driver software that enables them to communicate with Windows
operating systems. Features in Windows 7 and Windows Server 2008 R2 give administrators the
ability to control the devices that can be installed on the computers they manage.
Note
By default, only administrators or users with administrative credentials can install or
update device drivers. However, this default can be changed by modifying Group Policy
settings.
Hardware wizards
Hardware wizards simplify the process of obtaining the correct device driver for a particular
device. Hardware wizards can be especially important if a new device is attached to the computer
and no device driver is available locally. If the Found New Hardware Wizard is allowed to search
the Windows Update Web servers and the device driver is available there, the device driver can
quickly be downloaded and the device can then be used. Otherwise, the device driver must be
installed manually, or the device driver can be downloaded and installed the next time Windows
Update (if enabled) completes an update.
Overview: Using Device Manager in a managed

environment
Administrators can access Device Manager through Control Panel\System and
Maintenance\System. Users can access Device Manager in the same way to view information
about the hardware that is installed on their computers, but they must have administrative
credentials to add or update device drivers.
Administrators (or users with administrative credentials) will typically use Device Manager to
check the status of the hardware on their computers and to update device drivers. Administrators
who have a thorough understanding of computer hardware might also use Device Manager's
diagnostic features to resolve device conflicts and change resource settings.
Device Manager can work in conjunction with hardware wizards and the Windows Update Web
site to deliver updated drivers for installed hardware. If an administrator attaches a new device
and Windows 7 or Windows Server 2008 R2 does not find an appropriate device driver on the
computer, the Found New Hardware Wizard searches the Windows Update Web site (if an
Internet connection is available) for the device driver.
If the administrator requests to upgrade a device driver, the response is slightly different: by
default, a prompt appears asking whether the search for a device driver should include the
Internet or only the local computer.
As an administrator, you can control whether Device Manager or hardware wizards search the
Internet for device drivers. You can do this through Control Panel or Group Policy. Another option
48
is to use Windows Server Update Services (WSUS) to direct device driver searches to a server in
your network instead of to the Windows Update Web servers. A third option is to turn off all
access to Windows Update by using Group Policy.
For more information about these options, see the following topics later in this section:
 Controlling hardware wizards to limit the flow of information to and from the Internet
 Procedures for controlling communication between hardware wizards and the Windows
Update Web site
You can also use a registry key to specify the search path for hardware wizards. For more
information, see Additional references later in this section.
How hardware wizards communicate with Internet

sites
Hardware wizards search for device drivers in slightly different ways, depending on what type of
device driver is needed. Devices include:
 An existing device for which a new device driver is available. To update a device driver,
a person logged on to Windows 7 or Windows Server 2008 R2 as an administrator opens
Device Manager, selects a hardware device, and on the Action menu, clicks Update Driver
Software. Alternatively, the person can open Device Manager, right-click a hardware device,
and click Update Driver Software. This activates the Update Driver Software Wizard. If
Windows Update device driver search is not disabled, a prompt appears asking whether the
search for a device driver should include the Internet or only the local computer.
 A new PnP device for which no driver is included in Windows 7 or Windows
Server 2008 R2. To install a new PnP device, a user who is logged on to Windows 7 or
Windows Server 2008 R2 as an administrator first attaches the device. In some instances,
Windows 7 or Windows Server 2008 R2 finds the appropriate driver locally and installs it
without input from the user. In other instances, Windows 7 or Windows Server 2008 R2
cannot find an appropriate driver locally, and the Found New Hardware Wizard starts. By
default, the Found New Hardware Wizard searches the Windows Update Web servers for an
updated device driver (but an administrator can control this through Control Panel or Group
Policy).
 A device that is not PnP. If users are logged on to Windows 7 or Windows Server 2008 R2
as an administrator, and they attach a device that is not PnP, they can double-click Add
Hardware in the Classic View of Control Panel to start the Add Hardware Wizard. This wizard
does not connect to the Internet to locate device drivers.
In cases where a hardware wizard communicates with the Windows Update Web servers, the
communication is like other communication with Windows Update. Therefore, some items in the
following list refer to Windows Update and Resulting Internet Communication in Windows 7 and
Windows Server 2008 R2 later in this document.
Hardware wizards communicate with sites on the Internet as follows:
49
 Specific information sent or received: See Windows Update and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2 later in this document.
 Default settings: By default, hardware wizards are capable of searching Windows Update
Web servers for a device driver. For a description of the defaults that are used for prompting,
see "User notification" later in this list.
 Triggers: A person logged on as an administrator starts the Update Driver Software Wizard
or adds a new PnP device for which Windows 7 or Windows Server 2008 R2 cannot find an
appropriate driver locally.
Important
Hardware wizards are not the only way that you can download a device driver
from the Internet. For example, let’s say that a user attaches a new device for
which there is no driver to a computer that is running Windows 7 or Windows
Server 2008 R2. Later, when automatic updating discovers that a device driver is
available on the Windows Update Web servers, the driver will be downloaded.
For procedures to turn off automatic updating, see Windows Update and
Resulting Internet Communication in Windows 7 and Windows Server 2008 R2
later in this document.
 User notification: By default, if the Found New Hardware Wizard does not locate a device
driver locally for a device that has just been attached, it does not notify the user before
searching the Windows Update Web site for a device driver. By default, when the Update
Driver Software Wizard is started, a prompt appears asking whether the search for a device
driver should include the Internet or only the local computer.
You can control whether these wizards prompt in this way. For details, see Procedures for
controlling communication between hardware wizards and the Windows Update Web site
later in this section.
 Logging: Errors that result from problems installing hardware devices without drivers are
logged to the event log.
 Encryption, access, privacy, transmission protocol, and port: See Windows Update and
Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 later in this
document and the Update Services Privacy Statement on the Microsoft® Web site.
 Ability to disable: You cannot disable Device Manager, but you can use Control Panel or
Group Policy to prevent hardware wizards from searching for drivers on the Windows Update
Web site. Alternatively, you can turn off all access to Windows Update.
Controlling hardware wizards to limit the flow of

information to and from the Internet
To prevent hardware wizards from searching the Windows Update Web servers for device
drivers, you can use Control Panel or Group Policy.
50
Another option for preventing hardware wizards from communicating with the Internet is to use
Windows Server Update Services (WSUS) to send device driver searches to a server in your
network instead of to the Windows Update Web servers. For more information, see the following
topics on TechNet:
 Microsoft Windows Server Update Services
 Windows Server Update Services (WSUS)
A third option is to turn off all access to Windows Update by using Group Policy. If you turn off all
access to Windows Update, users who are logged on can still use Device Manager to view
information about their hardware devices. In addition, administrators still have the option to
manually download driver updates from an Internet site or from an intranet server that you
maintain on your network.
It is also possible to use a registry key to specify the search path for hardware wizards to use. For
more information about this option, see Additional references later in this section.
Procedures for controlling communication

between hardware wizards and the Windows
Update Web site
This section includes procedures for:
 Controlling Windows Update device driver search and prompts by using Control Panel.
 Specifying driver search locations for PnP devices by using Group Policy.
When you install new hardware, Windows 7 and Windows Server 2008 R2 will search the
following locations for drivers, if available: the hard disk drive, the floppy disk drive, the CD
drive, the DVD drive, removable storage devices, and Windows Update. However, you can
configure the driver search locations to remove selected locations.
 Turning off Windows Update device driver search by using Group Policy.
For the procedures to turn off all access to the Windows Update Web site or configure automatic
updating, see Windows Update and Resulting Internet Communication in Windows 7 and
Important
On a computer that is running Windows 7 or Windows Server 2008 R2, if automatic
updating is enabled, device drivers that are specific to the devices on that computer could
be downloaded from the Windows Update Web servers. For procedures related to turning
off automatic updating, see Windows Update and Resulting Internet Communication in
Windows 7 and Windows Server 2008 R2 later in this document.
To control Windows Update Device Driver searching and prompts by using Control
Panel
1. Click Start, and then click Control Panel, or point to Settings and then click Control
51
Panel.
2. Double-click System.
3. Click Advanced system settings, and then click the Hardware tab.
4. Click Device Installation Settings.
5. Choose one of the following options:
 Yes, do this automatically (recommended).
 No, let me choose what to do. If you select this option, you must then choose one
of the following options:
 Always install the best driver software from Windows Update.
 Install driver software from Windows Update if it is not found on my
computer.
 Never install driver software from Windows Update.
To specify driver search locations for PnP devices by using Group Policy
Templates, expand System, and then click Driver Installation.
3. In the details pane, double-click Configure driver search locations, and then click
Enabled.
4. Select or clear check boxes to prevent or allow searching of available locations such as
DVD drives, removable storage devices, or Windows Update.
Important
Group Policy contains a setting called Allow non-administrators to install
drivers for these device classes. To access this setting, expand Computer
Configuration, expand Policies (if present), expand Administrative
Templates, expand System, and then click Driver Installation. When this
setting is enabled and a non-administrator uses a hardware wizard, the
wizard does not search the Windows Update Web servers or Windows
Server Update Services (WSUS) for drivers. If you want to use this setting to
allow non-administrators to install device drivers that are not included in
Windows 7 or Windows Server 2008 R2, make the drivers available through
some means other than WSUS, for example, by placing them in a shared
folder and notifying users of the folder location.
To turn off Windows Update Device Driver searching by using Group Policy
and Windows Server 2008 R2, and then edit an appropriate GPO.
52
3. In the details pane, double-click Turn off Windows Update device driver searching,
and then click Enabled.
Important
You can also restrict Internet access for hardware wizards and a number of
other features by applying the Restrict Internet communication policy
setting. To access this setting, Expand Computer Configuration, expand
Policies (if present), expand Administrative Templates, expand System,
and expand Internet Communication Management.
The following Group Policy settings can also be used to regulate Internet
communications behavior during device driver installation:
 Under Administrative Templates\System\Device Installation:
 Allow remote access to the Plug and Play interface
 Prevent device metadata retrieval from the Internet
 Do not send a Windows error report when a generic driver is installed on a
device
 Prevent Windows from sending an error report when a device driver
requests additional software during installation
 Under Administrative Templates\System\Driver Installation:
 Driver Installation, Turn off Windows Update device driver search prompt
For more information, see Appendix C: Group Policy Settings Listed Under
the Internet Communication Management Category in Windows 7 and
 For a description of PnP, see Plug and Play and Resulting Internet Communication in
Windows 7 and Windows Server 7 later in this document.
 An extensive list of topics that are related to device management and installation is available.
Included is a step-by-step guide to controlling device installation and usage with Group Policy
and a step-by-step guide to device driver signing and staging. See the list of topics on the
following Microsoft TechNet Web site:
Device Management and Installation
 For a description of Windows Update, see the following section in this document:
Windows Update and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 For a collection of resources for system designers, driver developers, and test engineers, see
the Microsoft Web site:
53
Windows Hardware Developer Central
 For information about a registry setting called DevicePath through which you can set the
search path for device drivers, see the MSDN® Web site:
Preloading Driver Packages
 For information about how Setup locates and selects a function driver for a PnP device, see
the MSDN Web site:
Device Identification Strings
54
Dynamic Update and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Dynamic Update
Overview: Using Dynamic Update in a managed environment
How Dynamic Update communicates with sites on the Internet
Controlling Dynamic Update to limit the flow of information to and from the Internet
This section explains how Dynamic Update communicates across the Internet, and it explains
steps to take to limit, control, or prevent that communication in an organization with many users.
Benefits and purposes of Dynamic Update

With Dynamic Update, if you start a computer from an existing operating system (for example,
Windows Vista®) and then run Setup for Windows® 7 from that operating system, Setup can
check for new Setup files, including drivers and other files.
Note
If you perform a network boot, for example, from a Pre-Boot Execution Environment
(PXE)-enabled computer, and then run Setup for Windows 7, Dynamic Update does not
occur. Similarly, if you start a computer with the Windows Preinstallation Environment
(Windows PE), even if media is used, Dynamic Update does not occur.
In an interactive installation, the person installing Windows 7 or Windows Server® 2008 R2 is
prompted to choose whether to allow Dynamic Update to occur. In an unattended installation
using an answer file, an entry in the answer file can control whether Dynamic Update occurs.
Using Dynamic Update reduces the need to apply patches to recently installed systems, and it
makes it easier to run Setup with hardware that would otherwise prevent Setup from being
completed successfully.
Note
Additional drivers that were recently added or updated that would not prevent Setup from
completing successfully are downloaded to the system the first time the user runs
Windows Update.
Dynamic Update performs the same type of check for software updates as can be performed
through the existing, installed operating system (for example, through Windows Server 2003 with
Service Pack 2), However, Dynamic Update runs during Setup in Windows Server 2008 R2, and
a limited set of software updates can be downloaded through Dynamic Update. All files that are
made available through Dynamic Update are very carefully tested and fall into three categories:
55
 Setup software updates: These updates help Setup run correctly. Dynamic Update handles
only limited, important Setup updates.
 New or changed drivers: These are drivers that are known to be necessary for success with
Setup. They include only network, video, audio, and mass storage drivers. Dynamic Update
downloads only the files that are required for a particular computer, which means that the
Dynamic Update software briefly examines the computer hardware. The information that is
collected is not saved. The only purpose for examining the hardware is to select appropriate
drivers for it. This keeps the download time as short as possible and ensures that only
necessary drivers are downloaded to the hard disk drive.
Note
Another alternative for installing drivers during Setup is to use interactive Setup
and press F6 when prompted. A third alternative is to make use of a deployment
technology (such as unattended setup) that allows you to create operating
system images and control the drivers that are included in a specific image.
 Updates to operating system features: These are high-priority updates that can help make
operating system features more resistant to attack immediately after installation. These
updates help increase the security of a newly-installed operating system when it first
connects to a network, during the time before you begin your standard software update
process (whether you use the Windows Update Web servers, Windows Server Update
Services, or a system management solution).
Dynamic Update checks for the new files in the same location that the existing operating system
used for software updates. (This is the same location from which Setup for Windows 7 or
Windows Server 2008 R2 was run.) This location could be any of the following:
 The Windows Update Web servers: On a computer that had been receiving software
updates from the Internet, Dynamic Update continues to go to the Internet, that is, Windows
Update Web servers.
 A Windows Server Update Services server: On a computer that previously used Windows
Server Update Services (WSUS), Dynamic Update continues to go to a WSUS server.
For information about WSUS, see the following pages on TechNet:
 Windows Server Update Services 3.0 SP1
 A system management server: On a computer that previously used system management
servers, for example, servers running Microsoft Systems Management Server 2003 R2,
Dynamic Update continues to use a management server.
For more information, see Microsoft Systems Management Server
56
Overview: Using Dynamic Update in a managed
environment
In a managed environment where you are installing Windows 7 or Windows Server 2008 R2 on
many computers, you might choose to prevent Dynamic Update from connecting to the Windows
Update Web servers. To do this, you can use Windows Server Update Services or a system
management solution, or you can perform an unattended installation with an answer file entry that
prevents Dynamic Update. For more information, see Controlling Dynamic Update to Limit the
Flow of Information to and from the Internet later in this section.
How Dynamic Update communicates with sites on

the Internet
This subsection focuses on the communication that occurs between Dynamic Update and the
Windows Update Web servers during an interactive installation (or a preinstallation compatibility
check) when the computer has access to the Internet. This subsection also provides a description
of the default behavior of Dynamic Update with an unattended setup.
Note
This subsection describes how Dynamic Update works if a computer runs an existing
operating system (for example, Windows Server 2003 with Service Pack 2), the computer
is currently configured to go to the Windows Update Web servers for software updates,
and you run Setup for Windows Server 2008 R2 from the operating system already
running on the computer. Adjust the description to fit other scenarios, for example, when
you are upgrading from Windows Vista to Windows 7 or where WSUS is being used.
For a description of how you can control the behavior of Dynamic Update during unattended
installations, see Controlling Dynamic Update to Limit the Flow of Information to and from the
Internet later in this section.
 Specific information sent or received: When Dynamic Update contacts the Windows
Update Web servers, it sends only the exact operating system version and the information
that is necessary to select appropriate drivers (network, video, audio, or mass storage
drivers).
The files that Dynamic Update downloads are only those that are important to:
 Ensure that Setup runs successfully.
 Help protect operating system features immediately after installation (until the normal
software-update process can begin).
Files with minor updates that have little impact on the preceding items are not made available
through Dynamic Update. Some of the updated files will be replacements (for example, an
updated Setup file) and some will be additions (for example, a driver that was not available at
the time that the Setup CD was created).
57
 Default behavior and triggers: During interactive installation, the person installing the
software is offered the following options:
 Go online to get the latest updates for installation.
 Do not get the latest updates for installation.
If the person installing chooses the first option, Dynamic Update occurs.
During an unattended installation with an answer file, if the answer file does not contain any
entries related to Dynamic Update, Dynamic Update will occur.
Note
For an interactive or an unattended installation, if the computer is not connected
to the Internet during installation, Dynamic Update cannot occur.
 User notification: During an interactive installation, the person installing the software is
notified when the choice to run Dynamic Update is offered. A progress indicator appears that
enables the person to track the status of the update process. During an unattended
installation, there is no notification (unattended installation by definition means that no user
interaction is required).
 Logging: By default, the progress of Setup is logged in
systemroot\Sources\Panther\setupact.log in the installation folders for the operating system
that is being upgraded. After the upgrade is complete, the information about the new
installation of Windows 7 or Windows Server 2008 R2 is stored in
systemroot\Panther\setupact.log. You can view this log if you have questions about Dynamic
Update, for example, if you want to know whether Dynamic Update occurred or which files
were successfully downloaded during Dynamic Update.
 Encryption: Dynamic Update uses the same encryption methods as Windows Update. This
means that the initial data is transferred using HTTPS (that is, Secure Sockets Layer (SSL) or
Transport Layer Security (TLS) with HTTP) and updates are transferred using HTTP.
 Access and privacy: No information about the hardware devices on a particular computer is
saved or stored by Dynamic Update, so no one can access this information. The information
is used only to select appropriate drivers.
For information about access and privacy for a related feature, Windows Update, see
2008 R2 later in this document.
 Transmission protocol and port: Dynamic Update uses the same transmission protocols
and ports as Windows Update: HTTP with port 80 and HTTPS with port 443.
 Ability to disable: During interactive Setup, the prompt for Dynamic Update always appears
(it cannot be disabled), but the person installing the software can decline at the prompt.
During an unattended installation with an answer file, Dynamic Update is disabled if the
answer file includes the following lines:
58
<DynamicUpdate>
<Enable>false</Enable>
</DynamicUpdate>
Controlling Dynamic Update to limit the flow of

As summarized in Overview: Using Dynamic Update in a Managed Environment earlier in this
section, if you do not want Dynamic Update to connect to the Windows Update Web servers
during the installation of Windows Server 2008 R2, you have several options:
 Use Windows Server Update Services or a system management solution: You can use
Windows Server Update Services or a system management solution to cause Dynamic
Update to use a server that you configure instead of the Windows Update Web servers.
 Windows Server Update Services
 Windows Server Update Services 3.0 SP1
 Microsoft Systems Management Server
 Avoid Dynamic Update: You can avoid using Dynamic Update, which means that Setup will
use only the files and drivers that are provided on the CD for Windows Server 2008 R2. The
method to avoid using Dynamic Update depends on how you are performing the installation:
 Interactive installation: During an interactive installation, when prompted, you can
choose to not use Dynamic Update. As an alternative, you can ensure that the computer
does not have Internet access.
 Unattended setup: During an unattended installation with an answer file, Dynamic
Update does not occur if the answer file includes the following lines:
<DynamicUpdate>
<Enable>false</Enable>
</DynamicUpdate>

Windows Deployment Services
Windows Automated Installation Kit (Windows AIK) User's Guide
For additional information about performing automated installations, see Appendix A:
Resources for Learning About Automated Installation and Deployment for Windows 7 and
59
Event Viewer and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Event Viewer
Overview: Using Event Viewer in a managed environment
How Event Viewer communicates with Internet sites
Controlling Event Viewer to prevent the flow of information to and from the Internet
Procedures for preventing the flow of information to and from the Internet through Event Viewer
This section explains how Event Viewer in Windows® 7 and Windows Server® 2008 R2
communicates across the Internet, and it explains steps to take to limit, control, or prevent that
communication in an organization with many users.
Benefits and purposes of Event Viewer

Administrators can use Event Viewer to view and manage event logs. Event logs contain
information about hardware and software problems and about security events on your computer.
A computer that is running Windows 7 or Windows Server 2008 R2 records events in at least
three types of logs: application, system, and security. A computer that has Windows
Server 2008 R2 configured as a domain controller records events in two additional logs, the
Directory Service log and the File Replication Service log. A computer that has Windows
Server 2008 R2 configured as a Domain Name System (DNS) Server records events related to
DNS in an additional log.
Note
Other types of events and event logs are available on a computer depending on what
services are installed.
Forwarding and collecting events

Windows Server 2008 R2 can collect copies of events from multiple remote computers and store
them on one computer. Windows Server 2008 R2 can forward and collect events across the
Internet, and it can encrypt the events, depending on how it is configured. Using the event
collecting feature requires that you configure the forwarding and the collecting computers. The
configuration that you create for forwarding and collecting events is called an ―event subscription.‖
The process of collecting events depends on the Windows Remote Management (WinRM)
service and the Windows Event Collector service. These services must be running on computers
60
that are participating in the forwarding and collecting process. The WinRM service supports
communication through HTTPS (you can specify that the events you forward across the Internet
are encrypted before being sent).
It is outside the scope of this document to fully describe event collecting, event subscriptions, the
Windows Remote Management (WinRM) service, or the Windows Event Collector service. For
more details about forwarding and collecting events, see Additional references later in this
section.
Overview: Using Event Viewer in a managed

environment
In Windows 7 or Windows Server 2008 R2, Event Viewer is located in Administrative Tools (click
Start, click Administrative Tools, and then click Event Viewer).
In Windows Server 2008 R2, you can also view Event Viewer data in Server Manager. In the
Server Manager console tree, expand Diagnostics, and then click Event Viewer. You can obtain
detailed information about a particular event by double-clicking the event (or through other
methods, such as right-clicking and then clicking Event Properties). The dialog box gives a
description of the event, and it can contain one or more links to Help.
In Event Properties, the link next to More Information is labeled Event Log Online Help. By
default, Event Log Online Help appends the information that is explained in How Event Viewer
communicates with Internet sites later in this section. Detailed message explanations,
recommended user actions, and links to additional support and resources are presented on the
following site:
Events and Errors Message Center.
When you click the link, you are asked to confirm that the information presented can be sent over
the Internet. If you click Yes, the information listed about the event will be sent across the
Internet. This information is described in more detail in How Event Viewer communicates with
Internet sites later in this section.
You might want to prevent users from sending this information over the Internet. Or you may want
to redirect the requests that result from users clicking links in Event Viewer to a Web server in
your organization. In Windows 7 or Windows Server 2008 R2, you can control these through
Group Policy.
You might also want to collect copies of events from multiple remote computers and store them
on one computer. For information about this option, see Forwarding and Collecting Events earlier
in this section and Additional references later in this section.
61
How Event Viewer communicates with Internet
sites
To access the relevant Help information that is provided by the link in the Event Properties
dialog box, you must send the information that is listed about the event. This data is limited, and
you can use it to retrieve more information about the event from the Event Log Online Help. User
names, e-mail addresses, and names of files unrelated to the logged event are not collected.
For information about how to collect copies of events from multiple remote computers and store
them on one computer, see Forwarding and Collecting Events earlier in this section and
Additional references later in this section.
The communication that occurs across the Internet when a user clicks the Event Log Online
Help link in the Event Properties dialog box is described in the following list:
 Specific information sent or received: Information about the event that is sent across the
Internet is appended to a URL. By default, the site is:
Events and Errors Message Center.
The information appended to the URL includes:
 Company name (software vendor)
 Date and time
 Product name and version (for example, Windows Server 2008 R2)
 Event ID (for example, 1010)
 Event source (for example, Microsoft-Windows-DHCP-Client)
 Locale ID (for example, 1033 for English - United States)
The information that the user receives is the available information about the event, and it may
include additional links.
 Default settings: Access to Event Viewer is enabled by default.
 Triggers: The user chooses to send information about the event across the Internet to obtain
more information about the event.
 User notification: When a user clicks this link, a dialog box listing the information that will be
sent is provided.
 Logging: This is a feature of Event Viewer.
 Encryption: The information may be encrypted, depending on whether the link uses HTTP or
HTTPS.
 Access: No information is stored.
 Privacy: Event information that is collected and sent to Microsoft® when a user clicks the
Event Log Online Help link is used to locate and provide additional information about the
event. Microsoft does not use this information to contact or identify the user. The information
is not stored.
62
 Transmission protocol and port: Communication occurs over the standard port for the
protocol in the URL. It uses HTTP with port 80 or HTTPS with port 443.
 Ability to disable: The ability to send information across the Internet or link to a Web site
can be prevented through a Group Policy setting.
Controlling Event Viewer to prevent the flow of

You can prevent users from sending information across the Internet and accessing Internet sites
through Event Viewer by configuring Group Policy. Alternatively, you can redirect the requests
that result from users clicking links in Event Viewer to a Web server in your organization. You can
control these by configuring Group Policy.
These Group Policy settings affect only the flow of information to and from an intranet or the
Internet through Event Viewer, not the other functions of Event Viewer.
Procedures for preventing the flow of information

to and from the Internet through Event Viewer
The following procedure explains how to use Group Policy to prevent users from sending
information across the Internet and accessing Internet sites through Event Viewer.
To use Group Policy to prevent the flow of information to and from the Internet through
Event Viewer
click Internet Communication Settings.
3. In the details pane, double-click Turn off Event Viewer "Events.asp" links, and then
click Enabled.
Important
You can also restrict Internet access for this and a number of other features
by applying the Restrict Internet communication Group Policy setting
(expand Computer Configuration, expand Policies (if present), expand
Administrative Templates, expand System, expand Internet
Communication Management, and then click Restrict Internet
communication). For more information about this Group Policy setting and
the policies that it controls, see Appendix C: Group Policy Settings Listed
Under the Internet Communication Management Category in Windows 7 and
63
The following procedure explains how to use Group Policy to redirect the requests that result from
users clicking links in Event Viewer so that the requests go to a Web server in your organization.
To use Group Policy to redirect links in Event Viewer to a Web server in your
organization
Templates, expand Windows Components, and then click Event Viewer.
3. In the details pane, double-click Events.asp URL, click Enabled, and then type the URL
for the Web page that you want Event Viewer links to go to. Click OK.
4. In the details pane, double-click Events.asp program, click Enabled, and then type the
path for the program to be used for displaying the URL that you typed in the previous
step. If you want the page to be displayed in the Web browser and the Web browser is in
the system path, you can type the name of the Web browser executable alone, for
example, iexplore.exe.
5. In the details pane, double-click Events.asp program command line parameters, click
Enabled, and then type any command line parameters that are required for the program
you typed in the previous step. If the program you typed in the previous step does not
use parameters, clear the text box.
Note
After the preceding settings go into effect, when users click a link in Event
Viewer, the user notification still appears stating that Event Viewer will send
information across the Internet and asking for confirmation. Regardless of the
user notification, if you carry out the preceding procedure and redirect events
to a Web server in your organization, the information goes to that server, not
For more information, see the following resources on the Microsoft Web site:
 Windows 7 Technical Library Roadmap
 Windows Server 2008 and Windows Server 2008 R2
 Windows Remote Management
 Windows Event Collector Reference
64
File Association Web Service and Resulting
Internet Communication in Windows 7 and
In this section
Benefits and purposes of the file association Web service
Overview: Using the file association Web service in a managed environment
How the file association Web service communicates with Internet sites
Controlling the file association Web service to limit the flow of information to and from the Internet
Procedures for limiting Internet communication generated by the file association Web service
This section describes how the file association Web service in Windows® 7 and Windows
Server® 2008 R2 communicates across the Internet, and it explains steps to take to limit, control,
or prevent that communication in an organization with many users.
Benefits and purposes of the file association Web

service
The file association Web service in Windows Server 2008 R2 and Windows 7 extends the scope
of information that is stored locally by the operating system. The locally stored information and
the file association Web service provide users with the ability to open a file (by double-clicking)
without having to specify which application or feature to open it with. The operating system
associates the file name extension (for example, .txt or .jpg) with the application or feature to use
when opening that file type. For example, file name extensions .htm and .html can be associated
with a Web browser that can open them.
The operating system first checks for the file association information locally. If no local information
is available about the file name extension, the operating system offers you the option of looking
for more information on a Microsoft® Web site. For details about this Web site, see How the file
association Web service communicates with Internet sites later in this section.
Overview: Using the file association Web service

in a managed environment
You can limit the flow of information from the file association Web service to the Internet in a
number of ways. Some of these options are:
 Use firewall settings.
 Use Group Policy to disable the file association Web service.
65
 Train people who work on servers to manage the association between file name extensions
and the applications or operating system features to be used to open that file type.
 Use scripts to limit the types of files that can be stored, viewed, or used on computers in your
organization.
How the file association Web service

communicates with Internet sites
The file association Web service communicates with sites on the Internet as follows:
 Specific information sent or received: If the operating system does not find local
information about a file name extension, it offers the user the option of sending a query to
look for more information on a Microsoft Web site. The site is language-specific. The file
name extension that you double-click is appended to the query. The query takes the following
form:
http://shell.windows.com/fileassoc/nnnn/xml/redir.asp?Ext=AAA
where nnnn is a hexadecimal value used in Windows 7 and Windows Server 2008 R2 to map
to a language identifier (an RFC1766 identifier), and AAA is the file name extension for which
information is needed. An example of a hexadecimal value and its corresponding language
identifier is 0409 for en-us (English - United States). The string represented by AAA is the
extension only, not the file name.
Note
For more information about these hexadecimal values, see Internet Explorer
Multiple-Language API Registry
Settingshttp://go.microsoft.com/fwlink/?linkid=29165 on the MSDN® Web site.
To search for information about MLang registry settings or the Microsoft Internet Explorer®
Multiple Language application programming interface (MLang API), use the Search tool on
the Microsoft Developer Network.
 Default setting and ability to disable: The service is enabled by default. It can be disabled
by using Group Policy, as described in Disabling the file association Web service later in this
section.
 Trigger and user notification: When you try to open a file (for example, by double-clicking
the file), and there is no local information about the correct application or operating system
feature to use when opening the file, the operating system offers the options to "Use the Web
service to find the correct program" or "Select a program from a list of installed programs."
 Logging: No events are logged by the file association Web service.
 Encryption, storage, and privacy: The file name extension sent in a query to the Internet is
not encrypted. If the local computer’s browser is configured to store information about
recently visited Internet sites, the browser stores the query containing the file name
extension. Otherwise, the query that contains the file name extension is not stored anywhere.
 Transmission protocol and port: The transmission protocol is HTTP and the port is 80.
66
Controlling the file association Web service to
limit the flow of information to and from the
Internet
If you want to limit the flow of information from the file association Web service to the Internet,
you can use one or more of the following methods:
 Use your firewall to block access to any Web site that contains the following string:
http://shell.windows.com/fileassoc/
 Disable the file association Web service by using Group Policy, as described in Disabling the
file association Web service later in this section.
 Train users to work with file associations as follows:
 Instruct them that the local operating system stores an association between a file name
extension and the application or feature that is used to open that file type.
 Provide them with information about the file name extensions for the files they need to
work with most often and the application that should be used to open those files.
 Instruct them to always click Select a program from a list of installed programs if they
see a message box offering the following two options:
 Use the Web service to find the correct program
 Select a program from a list of installed programs
 Instruct them that after they initially click Select a program from a list of installed
programs, they can select the check box for Always use the selected program to
open this kind of file. This associates that file name extension with the program that the
user wants to open that file type.
 Use scripts to scan your organization’s computers for the types of files that you do not want
to store, view, or use. Take actions to ensure that these files do not remain on individual
computers’ hard disk drives. If unwanted file types do not exist on the hard disk drives, it
decreases the need for users to obtain information about which application to use for that file
name extension.
Procedures for limiting Internet communication

generated by the file association Web service
This section contains the following procedures:
 Disable the file association Web service by using Group Policy.
 Train users about file name extensions and the application or operating system feature to be
used to open a specific file type.
67
Disabling the file association Web service
The following procedure explains how to disable the file association Web service by using Group
Policy.
To disable the file association Web service by using Group Policy

2. If you want the Group Policy setting to apply to all users of a computer and to come into
effect when the computer starts or when Group Policy is refreshed, expand Computer
Configuration. If you want the policy setting to apply to users and to come into effect
when users log on or when Group Policy is refreshed, expand User Configuration.
3. Expand Policies (if present), expand Administrative Templates, expand System,
expand Internet Communication Management, and then click Internet
Communication settings.
4. In the details pane, double-click Turn off Internet File Association service, and then
click Enabled.
Important
by applying the Restrict Internet communication Group Policy setting. To
locate this setting, click Computer Configuration or User Configuration,
expand Policies (if present), expand Administrative Templates, expand
System, expand Internet Communication Management, and then click
Restrict Internet communication. For more information about this Group
Policy setting and the policies that it controls, see Appendix C: Group Policy
Settings Listed Under the Internet Communication Management Category in
Windows 7 and Windows Server 2008 R2.
Specifying associations between file name extensions and

applications or features
You can use the following procedure as a basis for training users about file name extensions and
the application or operating system feature to be used to open a specific file type.
To associate a file name extension with a program

1. In Windows Explorer or on the desktop, right-click a file that has the file name extension
that you want to associate with a program.
2. Choose one of the following options, depending on what is available:
 If Open With is available, point to Open With and then click Choose Default
Program.
68
 If Open With is not available, click Open, click Select a program from a list of
installed programs, and then click OK.
3. Choose a program from the list, or click Browse to find and choose a program.
4. Select the check box for Always use the selected program to open this kind of file.
69
Help and Support Features that
Communicate Through the Internet in
In this section
Benefits and purposes of features within Help and Support that communicate through the Internet
Overview: Using Help and Support in a managed environment
How features within Help and Support communicate with Internet sites
Controlling features within Help and Support that communicate through the Internet
Procedures for disabling features within Help and Support that communicate through the Internet
This section provides information about the Help and Support feature in Windows® 7 and
Windows Server® 2008 R2. (Users can locate Help and Support from the Start menu, through
Control Panel, through Windows Explorer, and in several other ways.) It does not describe the
Help that displays from Microsoft® Management Console (MMC) snap-ins, because this Help
does not communicate across the Internet. This section includes information about the following:
 The capabilities within the Help and Support feature in Windows 7 and Windows
Server 2008 R2. These capabilities are Online Help, Help ratings and feedback (this is a link
at the bottom of a Help topic that allows a user to provide feedback when Online Help is
turned on), and the Help Experience Improvement Program. The links to the Internet that are
displayed in Help and Support are also described.
 How Online Help, Help ratings and feedback, and the Help Experience Improvement
Program communicate with sites on the Internet.
 How to control Online Help, Help ratings and feedback, and the Help Experience
Improvement Program to limit the flow of information to and from the Internet.
Benefits and purposes of features within Help and

Support that communicate through the Internet
Help and Support in Windows 7 and Windows Server 2008 R2 displays information that helps you
understand how to accomplish some of the tasks that can be performed by using the Windows
interface.
Note
This section provides information about the Help and Support feature in Windows 7 and
Windows Server 2008 R2. It does not describe the Help that displays from MMC snap-
ins, because this Help does not communicate across the Internet. MMC snap-ins are
interfaces that you use to administer most server roles and features.
70
The information that is displayed through the Help and Support feature can be local information
that is built into Windows 7 or Windows Server 2008 R2, or it can be updated information that is
obtained through the Internet. Help and Support also has the ability to ask users to send
feedback or other data to Microsoft, which enables Microsoft to improve Help.
The features in Help and Support that communicate through the Internet provide the following
types of functionality:
 Online Help display: In Help and Support, when Online Help is turned on, you can see
information about Windows 7 or Windows Server 2008 R2 that is more extensive or more
recently updated than the local information that is stored within the operating system.
 Help ratings and feedback: In Help and Support, when Online Help is turned on, you can
enter feedback into a brief form at the bottom of a Help topic, and send that feedback to
Microsoft. This feedback can be used to help Microsoft improve that topic and similar Help
topics.
 Help Experience Improvement Program: Through this optional program, customers allow
data to be collected about how they navigate through the Help and Support feature—typing
search queries, clicking links to local Help and Support topics, clicking links to information on
the Web, and so on. This data is collected and associated with a non-descriptive ID value,
which shows that the information is all from a single user, but otherwise does not collect
characteristics about that user (for example, name or location). The collected data is sent to
Microsoft, where it is used to improve the Help and Support experience (better responses to
searches, better choice and placement of links, and so on) for future Help.
 Links to the Internet that appear when Help and Support is opened: The display that
appears when Help and Support is first opened offers a variety of links, including some that
can help you find Web-based information about Windows 7 or Windows Server 2008 R2.
These links go to Windows communities, Microsoft online support, and similar Web sites.
Overview: Using Help and Support in a managed

environment
You can access Help and Support in a number of ways, including:
 Selecting Help and Support from the Start menu.
 Pressing F1 within locations such as Control Panel, Windows Explorer, Computer,
Documents, and Network. In some interfaces, such as Windows Explorer, you can also click
the Help icon to view Help and Support.
From within Help and Support, by default, you can choose whether to:
 Access Online Help content or only offline content.
 Provide Microsoft with feedback about a Help topic (if Online Help is turned on).
 Participate in the Help Experience Improvement Program (if Online Help is turned on).
 Click a link to information that is online, for example, the Script Center or Knowledge Base.
71
By using Group Policy or the Windows user interface, you can disable Online Help, Help ratings
and feedback, and the Help Experience Improvement Program. The links in Help and Support
that go to Web-based resources such as Script Center or Knowledge Base can be disabled only
by blocking communication with the Internet.
More details about the methods and procedures for controlling Online Help, Help ratings and
feedback, and the Help Experience Improvement Program are described in the following
subsections.
How features within Help and Support

communicate with Internet sites
Online Help
Help and Support can display Help topics that are built into the local operating system, or it can
display Web-based topics that are more extensive or more recently updated than the local
information. This subsection describes how the Online Help feature communicates so that it can
display Web-based Help information from Microsoft.
Note
If this feature is disabled through Group Policy, Help and Support does not display
banners or options for turning it on.
 Specific information sent or received: To help determine the correct Help topic to display,
certain information is collected from the computer and uploaded to a server (in a Microsoft-
controlled facility) that hosts the updated Help topics. Following is a list of the information
collected:
 The search text string that you entered (if you are searching) or the unique identifier for
the topic to be displayed (if you clicked a topic link).
 The language/locale identifier, for example en-us for English (United States).
 If you are searching, the edition of the operating system that is installed, for example,
Windows 7 as contrasted with Windows Server 2008 R2 or another edition of the
operating system. If you clicked a topic link, information about the operating system is not
sent.
 A standard parameter that specifies a preferred form for downloading. The topic will be
sent in a compressed form (a .cab file) if it is available.
 User notification and default setting and triggers: When you first open Help, the following
prompt appears: "Do you want to get the latest online content when you search Help?" After
you make a choice, Online Help or Offline Help is displayed on the menu in the lower-right
corner of the Help display. You can click the menu and change to the other option whenever
Help and Support is running. The Online/Offline feature keeps track of the last setting
selected and uses that setting the next time it is opened. If a connection to the Internet is not
72
available, this is indicated by a red and white X icon next to the words Offline Help in the
lower-right corner of the Help display, and a banner at the top with the same icon.
 Logging: You can view the event log that is related to Online Help searches by opening
Event Viewer and expanding Applications and Services Logs\Microsoft\Windows\Help.
 Encryption: The data that is transferred to Microsoft is not encrypted.
 Access: Information about queries is held for a short time on servers in Microsoft facilities,
and it is used to improve the performance of subsequent searches of Online Help content.
After the search optimization is completed, the information is discarded. The information from
these searches is not analyzed unless you have chosen to participate in the Help Experience
Improvement Program.
 Privacy: Microsoft uses search query information to return the most relevant Help topics and
to improve existing content. Information that is collected by Online Help and Support is not
used to identify you. If you type information that identifies you into the Search text box, the
information will be sent, but Microsoft does not use the information to identify you or contact
you.
 Transmission protocol and port: The transmission protocol used is HTTP and the port is
80.
 Ability to disable: An administrator can disable Online Help by using Group Policy. A user or
administrator can turn off Online Help through the Help and Support Center user interface.
Help ratings and feedback

If you use Help and Support to view a topic while Online Help is turned on, the question "Was this
information helpful?" appears at the bottom of the topic. You can click a response and after a
short series of prompts, you can type a comment about the topic. After you click Finish, the
information about the topic is sent to Microsoft. The information is used to help improve that topic
and similar Help topics. This subsection describes how the Help ratings and feedback capability
communicates through the Internet.
 Specific information sent or received: The following information is sent to Microsoft when
you provide feedback by responding to prompts at the bottom of a topic in Help and Support:
 Your answers to the prompts at the bottom of the Help topic, plus any comment that you
type
 An ID code that identifies the topic that the comment was about and, if applicable, the
search query that you typed before selecting that topic
 Default setting: If Online Help is turned on after the prompt appears for the first display of
Help, Help ratings and feedback is turned on (that is, the prompt appears at the bottom of
each Help topic). However, Help ratings and feedback can be disabled through a Group
Policy setting.
 Triggers and user notification: Your feedback about the topic in Help and Support is sent
when you click Finish (after typing responses to a short series of questions at the bottom of
the Help topic). After you click Finish, a statement displays thanking you for the comments.
73
 Logging: The feedback that you send is logged on a server in a Microsoft-controlled facility.
 Access: User assistance teams at Microsoft can view the feedback that users send, but the
teams receive no information about the identity of the person sending the feedback.
 Privacy: Microsoft uses the information to develop new content and to improve existing
content. Information that is collected by Online Help and Support is not used to identify you. If
you type information that identifies you into the feedback text boxes, the information will be
sent, but Microsoft does not use the information to identify you or contact you.
80.
 Ability to disable: An administrator can disable this feature by using Group Policy. If Online
Help is turned off (through Group Policy or the Help and Support Center interface), this also
turns off the Help ratings and feedback capability.
Help Experience Improvement Program

Through the Help Experience Improvement Program, you have the option to allow data to be
collected about how you navigate while using Online Help—typing search queries, clicking links
to Help topics, clicking links to Web sites, and so on. This data (which does not include a user
name or computer name) is collected and sent to Microsoft, where it is used to better understand
how to improve navigation (better responses to searches, better choice and placement of links,
and so on) for future Help and Support topics.
Note
If this feature is disabled through Group Policy. Help and Support does not display menus
or options for turning it on.
 Specific information sent or received: Information about the following is sent when the
Help Experience Improvement Program is enabled on the computer. This information is sent
about actions taken in Help and Support only, not actions taken in the Help that is displayed
from MMC snap-ins. The information includes the following:
 Search queries
 Choices of Help and Support topics (from lists in Search results or the Table of Contents)
 Information that shows how you navigate through Help and Support, and how you view
topics—clicking links to local Help topics, clicking links to information on the Web, using
the Back and Forward buttons, printing a topic, and closing Help and Support.
In addition, the following information is sent when the Help Experience Improvement Program
is enabled on the computer:
 A unique, non-descriptive ID value, which shows that the information is all from a single
person; otherwise, it does not collect characteristics about that person (for example,
name or location).
74
 Default setting and triggers: By default, the Help Experience Improvement Program is not
turned on. If it is turned on, this triggers the process of collecting data and (on occasion)
sending the data to Microsoft.
 User notification: Turning on the Help Experience Improvement Program serves as the user
notification. After the program is turned on, data is sent without further notification.
 Logging: Data that is sent from the Help Experience Improvement Program is logged on a
server in a Microsoft-controlled facility, but it is not logged locally.
 Access: User assistance teams at Microsoft can view the data that is sent, but the teams
receive no information about the identity of the person whose Help navigation activity is
recorded in the data.
 Privacy: Microsoft uses the information to develop new content and to improve existing
content. Information that is collected by Online Help and Support is not used to identify you. If
you type information that identifies you into the Search text box, the information will be sent,
but Microsoft does not use the information to identify you or contact you.
80.
 Ability to disable: An administrator can disable the Help Experience Improvement Program
by using Group Policy. A user or administrator can also turn participation in the program on or
off through the Help and Support Center user interface. If Online Help is turned off (through
Group Policy or the Help and Support Center user interface), this also turns off the Help
Experience Improvement Program.
Controlling features within Help and Support that

communicate through the Internet
The following list summarizes how you can control the features within Help and Support that
communicate through the Internet:
 Online Help
 Through the Windows interface: In Help and Support, Online Help can be turned off
through a menu in the lower-right corner or through Options\Settings in the upper-right
corner.
 Through Group Policy: In User Configuration under Policies (if present), in
Administrative Templates\System\Internet Communication Management\Internet
Communication settings, you can enable Turn off Windows Online.
 Help ratings and feedback
 Through the Windows interface: In Help and Support, you can turn off the Help ratings
and feedback capability by turning off Online Help, which is controlled through a menu in
the lower-right corner or through Options\Settings in the upper-right corner.
75
Communication settings, you can enable Turn off Help Ratings.
 Help Experience Improvement Program
 Through the Windows interface: In Help and Support, you can turn off the Help
Experience Improvement Program by clicking the menu in either the upper-right or lower-
right corner and then clicking Settings. If Online Help is turned off, this also turns off the
Help Experience Improvement Program. Also, in the Settings interface, you can turn off
only the Help Experience Improvement Program and leave other Online Help features
turned on.
Communication settings, you can enable Turn off Help Experience Improvement
Program.
Procedures for disabling features within Help and

Support that communicate through the Internet
The following procedures describe how to:
 Turn off Online Help on an individual computer running Windows 7 or Windows
Server 2008 R2. This also turns off the Help ratings and feedback capability and the Help
 Turn off the Help Experience Improvement Program on an individual computer running
Windows 7 or Windows Server 2008 R2.
 Use Group Policy to disable any of the features within Help that communicate through the
Internet.
To turn off online Help and the Help Ratings and Feedback Capability on an individual
computer running Windows 7 or Windows Server 2008 R2
1. Click Start, and then click Help and Support.
2. In the lower-right corner of Help and Support, find a menu titled either Online Help or
Offline Help.
Note
If the menu does not appear, it means that Group Policy settings are in effect
that turn off the associated Help and Support capabilities.
3. Confirm or configure the setting as follows:
 If the menu says Offline Help and it does not have a red and white X icon, Online
Help is already turned off.
 If the menu says Offline Help and it has a red and white X icon, Online Help is
76
turned on but there is no connection to the Internet. To turn off Online Help, click Get
offline Help.
 If the menu says Online Help, Online Help is turned on and there is a connection to
the Internet. To turn it off, click Get offline Help.
Note
When Online Help is turned off, the Help ratings and feedback capability and
the Help Experience Improvement Program are turned off.
To turn off the Help Experience Improvement Program on an individual computer

running Windows 7 or Windows Server 2008 R2
1. Click Start, and then click Help and Support.
2. In the upper-right corner of Help and Support, click Options, and then click Settings.
Note
If the Settings command does not appear, it means that a Group Policy that
controls these settings is in effect.
3. Make sure that the Join the Help Experience Improvement Program check box is
cleared.
To use Group Policy to disable features within Help that communicate through the
Internet
1. Using an account with domain administrative credentials, log on to a computer that is
running Windows Server 2008 R2 or Windows 7 (with the Group Policy Management
Console (GPMC) installed).
Note
For information about using Group Policy, see Appendix B: Resources for
Learning About Group Policy for Windows 7 and Windows Server 2008 R2
later in this document.
2. Click Start, type gpmc.msc, and then press ENTER.
3. Select an appropriate Group Policy object (GPO) and expand User Configuration.
Important
For these settings, do not select Computer Configuration. The settings
under Computer Configuration that relate to Help do not affect Windows 7
or Windows Server 2008 R2.
5. In the details pane, double-click Turn off Help Ratings, click Enabled, and then click
OK.
77
(For all settings in this procedure, you can also click the Explain tab to view information
about the setting, and then click the Setting tab again.)
6. In the details pane, double-click Turn off Help Experience Improvement Program, click
Enabled, and then click OK.
7. In the details pane, double-click Turn off Windows Online, click Enabled, and then click
OK. (When you turn off Windows Online, you also turn off Help Ratings and the Help
Experience Improvement Program.)
Important
by applying the Restrict Internet communication Group Policy setting,
which is located in User Configuration under Policies (if present), in
Administrative Templates\System\Internet Communication
Management. For more information about this Group Policy setting and the
policies that it controls, see Appendix C: Group Policy Settings Listed Under
the Internet Communication Management Category in Windows 7 and
78
Internet Explorer 8 and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Internet Explorer 8
Internet Explorer enhanced security configuration
Examples of the security-related features offered in Internet Explorer 8
Resources for learning about topics related to security in Internet Explorer 8
Procedures for controlling Internet Explorer in Windows 7 and Windows Server 2008 R2
This section provides information about:
 The benefits of Internet Explorer® 8 in Windows® 7 and Windows Server® 2008 R2.
 A description of Internet Explorer Enhanced Security Configuration, which is enabled by
default when you install Windows Server 2008 R2.
 Examples of the security-related features in Internet Explorer 8.
Note
SmartScreen® Filter, one of the security-related features in Internet Explorer 8, is
described in SmartScreen Filter and Resulting Internet Communication in
Windows 7 and Windows Server 2008 R2 later in this document.
 Resources for learning about topics related to security in Internet Explorer 8. This includes
resources to help you learn about:
 Security and privacy settings in Internet Explorer 8.
 Mitigating the risks inherent in Web-based applications and scripts.
 Methods for controlling the configuration of Internet Explorer 8 in your organization by
using Group Policy settings, the Internet Explorer Administration Kit (IEAK), or both.
 Information about performing specific actions related to Internet Explorer 8 in Windows 7 and
Windows Server 2008 R2. These actions include:
 Choosing a Web browser during unattended installation or by using the Default Programs
interface.
 Turning Internet Explorer Enhanced Security Configuration off and on.
 Setting the security level to High for specific Web sites.
Note
This section of this document describes Internet Explorer 8, but it does not describe
related features such as Content Advisor or the wizard for making a connection to the
Internet. It also does not describe SmartScreen Filter in Internet Explorer or error
79
reporting for Internet Explorer. For information about these features, see the following
sections of this document:
 Appendix J: Wizards in Windows 7 and Windows Server 2008 R2 Related to Connecting to
the Internet
 SmartScreen Filter and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2
 Windows Error Reporting and the Problem Reports and Solutions Feature in Windows 7 and
It is beyond the scope of this document to describe all the aspects of maintaining appropriate
levels of security in an organization where users perform such actions as connecting to Web
sites, running software from the Internet, or downloading items from the Internet. This section,
however, provides overview information and suggestions for sources of information about how to
balance user requirements for Internet access with your organization's requirements for
protection of networked assets.
For more information about Internet Explorer, see the following resources:
 Help for Internet Explorer (with Internet Explorer open, press F1)
 Internet Explorer 8: Home page
 Internet Explorer 8 Privacy Statement
Benefits and purposes of Internet Explorer 8

Internet Explorer 8 is designed to make it easy to browse and interact with sites on an intranet or
on the Internet. It differs from many of the other features that are described in this document in
that its main function is to communicate with sites on the Internet or an intranet (which contrasts
with features that communicate with the Internet in the process of supporting another activity).
Internet Explorer 8 is also designed to be highly configurable, with security and privacy settings
that can help protect your organization's networked assets while at the same time providing
access to useful information and tools. In addition, Internet Explorer Enhanced Security
Configuration, which is enabled by default when you install Windows Server 2008 R2, helps to
make your server more secure by limiting its exposure to malicious Web sites.
Note
With this enhanced level of security, however, you might find that some Web sites are not
displayed correctly in Internet Explorer when you are browsing from a server. Also, you
might be prompted to enter your credentials when accessing network resources, such as
files in shared folders with Universal Naming Convention (UNC) names. As an
administrator, you can turn Internet Explorer Enhanced Security Configuration off and on.
80
Internet Explorer enhanced security configuration
Internet Explorer Enhanced Security Configuration is turned on by default when you install
Windows Server 2008 R2. This configuration assigns specific levels of security settings to four
zones that are defined in Internet Explorer 8: the Internet zone, the Local intranet zone, the
Trusted sites zone, and the Restricted sites zone. For example, it assigns High security settings
to both the Internet zone and the Restricted sites zone.
The configuration also contains a variety of other settings. These include specific settings such as
whether the Temporary Internet Files folder is emptied when the browser is closed, and settings
that determine which zone certain standard Web sites are added to (for example, the Windows
Update Web site is added to the Trusted sites zone).
For more information about Internet Explorer Enhanced Security Configuration, on a server that is
running Windows Server 2008 R2, click Start, click Internet Explorer and then click a link that is
displayed:
 If Internet Explorer Enhanced Security Configuration is turned on, click Effects of Internet
Explorer Enhanced Security Configuration.
 If Internet Explorer Enhanced Security Configuration is turned off, click Internet Explorer
Enhanced Security Configuration.
Examples of the security-related features in

Internet Explorer 8
This subsection describes some of the security-related features in Internet Explorer 8, which
include:
 SmartScreen Filter. Internet Explorer 8 provides protection against social engineering
attacks by helping to identify malicious Web sites that attempt to obtain personal information
or install malicious software. The SmartScreen Filter does this by blocking the download of
malicious software and providing enhanced anti-malware support. Administrators can use
Group Policy to configure the behavior of the SmartScreen Filter, for example, to prevent
users from overriding the option to fully block access to known unsafe sites. The Microsoft®
SmartScreen Filter is described in SmartScreen Filter and Resulting Internet Communication
in Windows 7 and Windows Server 2008 R2 later in this document.
 Restrictions on the installation of ActiveX controls. Internet Explorer 8 allows for greater
management of ActiveX® controls, such as where and how they can load and which users
can load them. Internet Explorer 8 also allows the administrator to help set up the ActiveX
control installation process for future ActiveX controls. The installation of ActiveX controls can
be set on a per-site and per-user basis.
 Enhanced Delete Browsing History. Delete Browsing History enables users and
organizations to delete browsing history for all Web sites except those in the user's Favorites
folder. Administrators can configure Delete Browsing History options through Group Policy
or the Internet Explorer Administration Kit. Administrators can also configure which sites are
81
automatically included in Favorites, allowing them to create policies that help ensure security
by aggressively clearing Internet files, and without affecting day-to-day interactions with
preferred and favorite Web sites. The Delete Browser History on Exit check box (on the
General tab of the Internet Options dialog box) allows users and administrators to
automatically delete the browsing history on exit.
 InPrivate Browsing. The InPrivate™ browsing feature in Internet Explorer 8 deletes the
user’s browsing history data that is accumulated on the computer, as soon as the Internet
Explorer browsing windows for that session are closed. A network administrator can use
Group Policy to control how InPrivate Browsing is used in their enterprise.
 InPrivate Filtering. InPrivate Filtering helps prevent parties that serve or gather content
(such as analytics, ad networks, or maps) on a Web page from tracking the user's activities.
InPrivate Filtering monitors the frequency with which all outside-party content appears across
all Web sites that are visited by the user. It does not discriminate between different types of
outside party content, but rather it blocks content from a specific outside party only if it
appears on more than a predetermined number of sites that the user has visited. This
number can be configured by the user. In addition, a network administrator can choose to
completely disable InPrivate Filtering in their enterprise through Group Policy.
 Protected Mode. Internet Explorer Protected Mode helps reduce the severity of threats to
both Internet Explorer and Internet Explorer add-ons by requiring user interaction for actions
that would affect the operating system. Even if the user gives permission, Internet Explorer
can affect only areas that are directly controlled by the user, meaning a more secure locked-
down environment. This feature uses other operating system features, called the integrity
mechanism and User Interface Privilege Isolation (UIPI). Protected Mode also includes
compatibility features that allow most extensions to continue running with no changes and
provide affected extensions with clear alternative options.
For more information, see:
 Application Compatibility: Internet Explorer Protected Mode
 Understanding and Working in Protected Mode Internet Explorer
 Secure Sockets Layer (SSL). Internet Explorer 8 makes it easier to see whether Web
transactions are secured by SSL or Transport Layer Security (TLS). A security report icon
appears to the right of the address bar when you view a page that uses a Hypertext Transfer
Protocol Secure (HTTPS) connection. Clicking this icon displays a report describing the
certificate used to encrypt the connection and the certification authority (CA) that issued the
certificate. The security report also provides links to more detailed information. Internet
Explorer 8 also supports High Assurance certificates, giving further guidance to users that
they are communicating with a verified organization. This verification will be granted by
existing CAs and show up in the browser as a clear green fill in the address bar.
 Microsoft ActiveX Opt-In. Internet Explorer 8 disables all ActiveX controls that were not
used in Internet Explorer 6 and all ActiveX controls that are not flagged for use on the
Internet. When users encounter an ActiveX control for the first time, they see a gold bar
asking if they want to use the control. Users can then selectively allow or prevent running the
82
control. By default, the ActiveX opt-in does not apply to Intranet and Trusted Site zones;
controls on those zones, including a short list of preapproved controls, run without prompting.
The following list names some of the security-related features that have been continued from
Internet Explorer 6.
 A Privacy tab. This tab provides flexibility in blocking and allowing cookies, based on the
Web site that the cookie came from or the type of cookie. Types of cookies include first-party
cookies, third-party cookies, and cookies that do not have a compact privacy policy.
 Security settings that define security zones. For each zone, users can control the way
that Internet Explorer 8 handles higher-risk items such as ActiveX controls, downloads, and
scripts.
 Support for content-restricted inline floating frames (IFrames). This type of support
enables developers to implement IFrames in a way that makes it more difficult for malicious
authors to start e-mail-based or content-based attacks.
 A configurable pop-up blocker. This helps you control pop-ups.
 An improved interface for managing add-ons. Add-ons are programs that extend the
capabilities of the browser.
Documentation for Internet Explorer 6, Internet Explorer 7, or Internet Explorer 8 describes these
features in more detail. For more information about features that are available in Internet
Explorer, see the information in the next subsection and at the following Web site:
Internet Explorer 8: Home page
Resources for learning about topics related to

security in Internet Explorer 8
This subsection lists resources that can help you learn about the following topics related to
security in Internet Explorer 8:
 Security and privacy settings available in Internet Explorer 8
 Methods for mitigating the risks that are inherent in Web-based programs and scripts
 Ways to use Group Policy objects to control configuration settings for Internet Explorer 8
 The Internet Explorer Administration Kit
In addition, for information about unattended installation, see the resources listed in Appendix A:
Learning about security and privacy settings in Internet

Explorer 8
Following are sources of detailed information about the security and privacy settings in Internet
Explorer 8 in Windows 7 and Windows Server 2008 R2:
 Internet Explorer TechCenter
83
 Windows Internet Explorer 8 Technology Overview for Enterprise and IT Pros (This overview
provides information about Phishing Filter, Protected Mode, and other enhancements to
security features.)
 Application Compatibility: Internet Explorer Protected Mode
 Understanding and Working in Protected Mode Internet Explorer
In addition, the privacy statement for Internet Explorer 8 includes information about some of the
features in Internet Explorer 8: Windows Internet Explorer 8 Privacy Statement.
Learning about mitigating the risks inherent in Web-based

applications and scripts
In a network-based and Internet-based environment, code can take a variety of forms including
scripts within documents, scripts within e-mail messages, or applications or other code objects
that are running within Web pages. This code can move across the Internet, and it is sometimes
referred to as "mobile code." Configuration settings provide ways for you to control how Internet
Explorer 8 responds when a user tries to run mobile code.
Following are two examples of how you can customize the Internet Explorer configuration that is
deployed in your organization:
 You can control the code (in ActiveX controls or in scripts, for instance) that users can run.
Do this by customizing Authenticode® settings. For example, this can prevent users from
running any unsigned code or enable them to only run code that is signed by specific authors.
For more information, see Code-Signing Best Practices.
 If you want to permit the use of ActiveX controls, but you do not want users to download code
directly from the Internet, you can specify that when Internet Explorer 8 looks for a requested
executable, it looks on your internal Web site instead of the Internet. You can do this by
changing a registry key.
Caution
Incorrectly editing the registry may severely damage your system. Before making
changes to the registry, you should back up any valued data on the computer.
You can also use the Last Known Good Configuration startup option if you
encounter problems after manual changes have been applied.
The registry key to change specifies an Internet search path for Internet-based code:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft \Windows\CurrentVersion\Internet
Settings\CodeBaseSearchPath
This registry key usually contains the keyword CODEBASE, which allows software to specify
its own Internet search path for downloading components (that is, when CODEBASE is
present, calls to CoGetClassObjectFromURL check the szCodeURL location for
downloading components). After CODEBASE, the CodeBaseSearchPath registry key
usually lists additional URLs in the Internet search path, with each URL enclosed in angle
brackets and separated by a semicolon. If you remove CODEBASE from the registry key and
84
instead specify a site on your intranet, software will check that site, not an Internet site, for
downloadable components. The URL specified in CodeBaseSearchPath will receive an
HTTP POST request with data in the following format and respond with the object to install
and load.
CLSID={class id}
Version=a,b,c,d
MIMETYPE=mimetype
For more information, search for all instances of CodeBaseSearchPath in the following
MSDN® topic: Implementing Internet Component Download.
For more information about how a particular Microsoft programming or scripting language works,
see the Microsoft Developer Network.
Learning about Group Policy objects that control configuration

settings for Internet Explorer 8
You can control configuration settings for Internet Explorer 8 by using Group Policy objects
(GPOs). (You can also control the configuration of Internet Explorer by using the Internet Explorer
Administration Kit. For more information, see "Learning about the Internet Explorer Administration
Kit" later in this section.) More than 100 Group Policy settings were added for Internet Explorer 8,
bringing the total to more than 1,300. For sources of information about Group Policy, see
Appendix B: Resources for Learning About Group Policy for Windows 7 and Windows Server
2008 R2 later in this document.
To learn about specific Group Policy settings that can be applied to computers running
Windows 7 and Windows Server 2008 R2, see the following sources of information:
 Windows Server Group Policy
 Group Policy Settings Reference for Windows Server 2008 and Windows Vista SP1
Learning about the Internet Explorer Administration Kit

You can use the Internet Explorer Administration Kit (IEAK) to create a customized Internet
Explorer package for use in your organization. You can then deploy your customized package by
using standard means such as network shares, intranet sites, media such as CDs, or through a
system management solution, such as Microsoft System Center Configuration Manager 2007.
(You can also control the configuration of Internet Explorer by using Group Policy.
For more information, see Learning About Group Policy Objects that Control Configuration
Settings for Internet Explorer 8 earlier in this section.
A few of the features and resources in the IEAK include:
 Internet Explorer Customization Wizard. Step-by-step screens guide you through the
process of creating customized browser packages that can be installed on client computers.
 IEAK Profile Manager. After you deploy Internet Explorer, you can use the IEAK Profile
Manager to change browser settings and restrictions automatically.
85
 IEAK Toolkit. This toolkit contains a variety of helpful tools, programs, and sample files.
 IEAK Help. The IEAK Help includes many conceptual and procedural topics that you can
view by using the Contents and Search tabs. You can also print topics from IEAK Help.
For more information about the IEAK, see What Internet Explorer Administration Kit Can Do For
You.
Procedures for controlling Internet Explorer in

The following subsections provide procedures for carrying out two types of tasks:
 Controlling the browsers that are available for use in Windows 7 and Windows
Server 2008 R2
 Turning Internet Explorer Enhanced Security Configuration on or off
 Setting the security level to High for specific Web sites
Procedures for controlling the Web browsers that are available

for use in Windows 7 and Windows Server 2008 R2
This subsection provides information about controlling the browsers that are available for use in
Windows 7 and Windows Server 2008 R2. Methods of controlling browser availability include:
 Unattended installation by using an answer file
 The Default Programs interface
To specify a browser during unattended installation by using an answer file

1. Use the methods that you prefer for unattended installation or remote installation to
create an answer file. For more information about unattended and remote installation,
see Appendix A: Resources for Learning About Automated Installation and Deployment
for Windows 7 and Windows Server 2008 R2 later in this document.
2. Confirm that your answer file includes the following lines. If you already have a
<ClientApplications> section in your answer file, the "Internet" line (the line containing
information about your browser) should be included in the <ClientApplications> section
rather than repeating the section.
<ClientApplications>
<Internet>browser_canonical_name</Internet>
</ClientApplications>
For browser_canonical_name, specify the canonical name that is coded into your Web
browser.
86
To remove visible entry points to Internet Explorer during unattended installation by
using an answer file
for Windows 7 and Windows Server 2008 R2 later in this document.
<WindowsFeatures> section in your answer file, the "ShowInternetExplorer" line should
be included in the <WindowsFeatures> section rather than repeating the section.
<WindowsFeatures>
<ShowInternetExplorer>false</ShowInternetExplorer>
</WindowsFeatures>
Note
This procedure removes visible entry points to Internet Explorer, but it does not prevent
Internet Explorer from running.
To specify a browser through the default programs interface

1. Click Start, click Control Panel, click Default Programs, and then click Set your
default programs.
2. Under Programs (on the left), click the browser that you want to select as the default.
Note
For the preceding step, if the Web browser that you want to use does not
appear by name, contact the vendor of that program for information about
how to configure it as the default. Also, for related information about registry
entries that are used to designate a program for Internet browsing, e-mail
service, media playback, or instant messaging, see The Windows 7 and
Windows Server 2008 R2 Developer Story: Application Compatibility
Cookbook.
3. To use the selected program as the default for opening all file types and protocols, click
Set this program as default.
As an alternative, you can click Choose defaults for this program, and then specify
which file types and protocols the selected program should open by default.
Procedure for turning Internet Explorer enhanced security

configuration on or off
Confirm that no instances of Internet Explorer are running (otherwise you will have to close and
reopen all instances of Internet Explorer after you complete this procedure).
87
To turn Internet Explorer enhanced security configuration on or off
1. If Server Manager is not already open, click Start, click Administrative Tools, and then
click Server Manager. If the User Account Control dialog box appears, confirm that the
action it displays is what you want, and then click Continue.
2. Confirm that Server Summary is expanded and that Security Information is expanded.
3. On the right, click Configure IE ESC.
4. Under Administrators, click On or Off, and under Users, click On or Off.
Procedures for setting the security level to high for specific Web
sites
The procedures that follow provide information about how to set the security level for a particular
Web site to High, which prevents actions such as running scripts and downloading files from the
site.
For information about planning a configuration for your organization to control whether Internet
Explorer allows downloads or allows plug-ins, ActiveX controls, or scripts to run, see Examples of
the Security-Related Features Offered in Internet Explorer 8 and Learning About Security and
Privacy Settings in Internet Explorer 8 earlier in this section.
To configure a specific computer with a security level of high for specific sites
1. On the computer that you want to configure a security level of High for specific sites, in
Internet Explorer, click Tools, click Internet Options, and then click the Security tab.
2. Select Restricted sites.
3. Under Security level for this zone, make sure that the slider for the security level is set
to High.
If the Internet Explorer Enhanced Security Configuration is turned on, the slider will be set
to High, and it cannot be adjusted.
If the Internet Explorer Enhanced Security Configuration is turned off, the slider can be
adjusted, and the security level can be set to a Custom level. If it is set to a Custom
level, click Default Level, and then make sure that the slider for the security level is set
to High.
4. With Restricted sites still selected, click Sites.
5. In Add this Web site to the zone, type the Web site address that you want to add to the
list of Restricted sites. You can use an asterisk as a wildcard character. For example, for
Web sites at Example.Example.com and www.Example.com, you could type:
http://*.Example.com
6. Click Add.
88
To use Group Policy to set the security level to high for specific sites that users in your
organization might connect to
2. In Group Policy, expand User Configuration, expand Windows Settings, expand
Internet Explorer Maintenance, and then click Security.
3. In the details pane, double-click Security Zones and Content Ratings.
4. Under Security Zones, click Import the current security zones and privacy settings,
and then click Modify Settings.
5. Select Restricted sites.
6. Under Security level for this zone, make sure that the slider for the security level is set
to High.
7. With Restricted sites still selected, click Sites.
8. In Add this Web site to the zone, type a Web site address that you want to restrict. You
can use an asterisk as a wildcard character. For example, for Web sites at
Example.Example.com and www.Example.com, you could type:
http://*.Example.com
9. Click the Add button.
89
Internet Information Services and Resulting
In this section
Benefits and purposes of IIS
Examples of security-related features in IIS 7.5
Finding information about features in IIS 7.5
Procedures for checking or controlling the installation of features in IIS 7.5
organization’s requirements for protection of networked assets. However, it is beyond the scope
of this document to describe all aspects of maintaining appropriate levels of privacy and security
in an organization that is running Web servers that communicate across the Internet.
Note
If you do not want to offer content on an intranet or the Internet from a computer that is
running Windows Server® 2008 R2, you do not need to remove Internet Information
Services (IIS) version 7.0. By default, it is not installed with Windows Server 2008 R2.
The exception is Windows Web Server 2008 R2, on which IIS is installed by default. If
you use a server as a Web server with content, and then you deploy it for some other
purpose, remove IIS from that server.
Benefits and purposes of IIS

Internet Information Services version 7.5 is one of the optional role services in Windows
Server 2008 R2, although it is installed by default in Windows Web Server 2008 R2. IIS provides
a way to publish information on the Internet or an intranet. In a managed environment, IIS is
usually installed on selected servers only. IIS includes innovative security features and a broad
range of administrative features for managing Web sites. By using programmatic features like
Active Server Pages (ASP) and ASP.NET, you can create and deploy scalable, flexible Web
applications.
IIS and related features can be added by using the Initial Configuration Tasks interface or Server
Manager. When IIS 7.5 is installed with the default set of IIS features (also called role services), it
can accept requests for static files only. To serve dynamic content, you must install additional IIS
features, not just the default features.
90
For more information about IIS features, including features that are related to security, see the
following resources:
 Internet Information Services (IIS) 7.0 for Windows Server 2008
 Configure Web Server Security (IIS 7.0)
 The Official Microsoft Internet Information Services Web site
 Enhanced Server Protection
Examples of security-related features in IIS 7.5

IIS 7.5 includes a variety of settings and features related to security, some of which are described
in the following list. For additional information about security-related features in IIS 7.5, see the
links in the previous section.
 WebDAV and FTP: WebDAV and File Transfer Protocol (FTP) functionality that is available
in IIS 7 enable Web authors to publish content more reliably and securely. The new WebDAV
and FTP modules also offer Web server administrators more options for authentication,
auditing, and logging.
 Request Filtering: The Request Filtering module, previously available as an extension for
IIS 7, helps prevent potentially harmful requests from reaching the server by allowing you to
restrict or block specific HTTP requests.
 Configuration logging and tracing: Configuration logging and tracing uses the Event
Viewer to audit access to the IIS configuration and to track successful or failed modifications.
 Application hosting enhancements: IIS 7.5 offers a variety of new features that help
increase security and improve diagnostics, and it provides a flexible and manageable
platform for many types of Web applications, including those that are based on the ASP.NET
platform and Hypertext Preprocessor (PHP) scripting.
 Service hardening: Building on the IIS 7 application pool isolation model that increased
security and reliability, every IIS 7.5 application pool now runs each process as a unique,
less-privileged identity.
 Ability to limit the Web server feature set: IIS 7.5 includes a completely modular Web
server with more than four times the number of installable components as previous versions
of IIS. You can limit your installation to the components that are necessary for your
environment. This decreases the attack surface of the Web server.
The default installation for the Web Server (IIS) role includes the installation of role services
for serving static content, making minor customizations (such as default documents and
HTTP errors), monitoring and logging server activity, and configuring static content
compression.
 Key simplifications of security management: The simplifications of security management
include:
 Delegated administration support. This enables you to securely delegate configuration
and management tasks to non-administrators.
91
 Unified authentication and authorization management. This allows authentication and
authorization for all types of content, including Forms authentication and URL
Authorization, to be managed in a single location.
 Managed service accounts improve identity management in IIS 7.5. This means that
server administrators no longer have to worry about application-pool passwords expiring.
Finding information about features in IIS 7.5

One way to minimize the attack surface of a server running IIS is to install only the role services
(IIS features) that are needed for that server. The following topics can help you plan the role
services that you want to install and identify the correct name for the service. You can select and
name role services in the graphical interface of the Add Roles Wizard or the Add Role Services
Wizard, which can be started from Server Manager, or in a command or script that is used for
automated installation.
 For information about features that are available in IIS 7.5, see the TechNet Web site at:
Internet Information Services (IIS) 7.0 for Windows Server 2008
 For information about installing the features in IIS by using a command line, see the TechNet
Web site at:
Installing IIS 7 on Windows Server 2008
Note
For more details about features in IIS, follow the steps in "To View Help After Installing
IIS," later in this section.
Procedures for installing or uninstalling features

in IIS 7.5
The following procedures explain how to:
 Add the Web Server (IIS) role and select the role services to install on a computer running
 View the role services that are installed for a Web Server
 Install additional IIS role services on a server that already has the Web Server (IIS) role
installed
 Uninstall IIS role services on a server that already has the Web Server (IIS) role installed
 View Help for IIS 7.5
For information about using the Server Core installation option of Windows Server 2008 R2that
will run IIS, see Additional references later in this section.
To add the Web server role and select the role services to install
1. If you recently installed Windows Server 2008 R2, and the Initial Configuration Tasks
92
interface is displayed, under Customize This Server, click Add roles. Then skip to
step 3.
2. If the Initial Configuration Tasks interface is not displayed and Server Manager is not
running, click Start, click Administrative Tools, and then click Server Manager. (If the
User Account Control dialog box appears, confirm that the action it displays is what you
want, and then click Continue.)
3. In Server Manager, under Roles Summary, click Add Roles.
4. In the Add Roles Wizard, if the Before You Begin page appears, click Next.
5. On the Select Server Roles page, under Roles, select Web Server (IIS) and then click
Next.
Note
If IIS is already installed on the server, the Web Server (IIS) check box will
be selected and dimmed. For information about viewing or installing IIS role
services in this situation, see the following two procedures.
6. On the Web Server (IIS) page, click and view links for Help topics that you want to read.
Close the topics when you have finished reading them, and then click Next.
7. On the Select Role Services page, select the role services that you want to install for
Web Server (IIS), and then click Next.
8. Follow the instructions in the wizard to complete the installation process.
To view the role services that are installed for a Web server
2. In the console tree, under Roles, click Web Server (IIS).
3. In the right pane, ensure that Role Services is expanded, and view the list of role
services that are installed.
To install additional IIS role services on a server that already has the Web server role
installed
2. In the console tree, click Web Server (IIS).
3. In the right pane, in the Role Services section, click Add Role Services.
4. Follow the instructions in the wizard to select role services and complete the installation
process.
93
To uninstall IIS role services on a server that has the Web server role installed
2. In the console tree, click Web Server (IIS).
3. In the right pane, in the Role Services section, click Remove Role Services.
4. Follow the instructions in the wizard to identify and remove role services.
To view Help after installing IIS

1. After installing IIS (including the IIS Management console, which is included in default
installations of IIS), click Start, point to Administrative Tools, and then click Internet
Information Services (IIS) Manager. If the User Account Control dialog box appears,
confirm that the action it displays is what you want, and then click Continue.
2. Click the Help menu, click IIS Help, click Search, and then type available role services
in the Search text box.
 For information about the Server Core installation option, which can help reduce the attack
surface of servers running various roles including the Web Server (IIS) role, see:
Server Core Installation Option Getting Started Guide
 For information about controlling Internet printing on Windows Server 2008 R2, see Internet
Printing and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2
in this document.
94
Internet Printing and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Internet printing
Overview: Using Internet printing in a managed environment
How Internet printing communicates with Internet sites
Controlling Internet printing to prevent the flow of information to and from the Internet
Procedures for controlling Internet printing
This section describes how Internet printing features in Windows 7 or Windows Server 2008 R2
communicate across the Internet, and it explains steps to take to limit, control, or prevent that
Benefits and purposes of Internet printing

Internet printing makes it possible for computers running Windows® 7 or Windows
Server® 2008 R2 to use printers that are located anywhere in the world. The computers send
print jobs by using Hypertext Transfer Protocol (HTTP).
Additionally, computers running Windows Server 2008 R2 can use Microsoft® Internet
Information Services (IIS) to create a Web page that provides information about the printers and
provides the transportation for printing over the Internet.
Overview: Using Internet printing in a managed

environment
Internet printing has server and client aspects. The following list describes these aspects:
 Server: The administrator of a server running Windows Server 2008 R2 can install the Web
Server (IIS) role, the Print Services role, and the Internet Printing role service in the Print
Services role. When these roles and role service are installed, you can enable Internet
printing on the server.
Important
To remotely manage a print server that is running Windows Server 2008 R2, we
recommend that you use interfaces such as the Print Management snap-in,
Remote Desktop, or the command-line tools. This provides a lower security risk
than installing IIS and the Internet Printing role service on a computer that is
used as a print server and not as a Web server.
95
 Client: A computer running Windows 7 or Windows Server 2008 R2 can be used as a client
computer if you install an Internet printer by using a Web browser, the Add Printer Wizard, or
the Run dialog box.
How Internet printing communicates with Internet

sites
The Internet printing process is as follows:
1. From a client computer that is running Windows 7 or Windows Server 2008 R2, a user types
the URL for a printing device.
2. The HTTP request is sent over the Internet to the print server.
3. The print server requires the client to provide authentication information. This ensures that
only authorized users print documents on the print server.
4. After the server authenticates the user, the server presents status information to the user by
using Active Server Pages (ASP), which contain information about currently available
printers.
5. When the client first tries to connect to any of the printers on the Internet, the client attempts
to find a driver for the printer locally. If an appropriate driver cannot be found locally, the print
server generates a cabinet file (.cab file, also known as a setup file) that contains the
appropriate printer driver files. The print server downloads the .cab file to the client computer.
The user on the client computer is prompted to download the .cab file.
The client computer downloads the printer driver and connects to the printer by using Internet
Printing Protocol (IPP) or a remote procedure call (RPC), depending on the security zone
where the printer is shared. (The security zone is configured on the client computer through
Internet Options in Control Panel.) With a Medium-high or Medium security zone, IPP is
used, and with a Medium-low security zone, RPC is used.
6. After the user connects to an Internet printer, documents can be sent to the print server.
Communication for Internet printing uses IPP or RPC with HTTP (or HTTPS) over any port that
the print server has configured for this service. Because the service is using HTTP or HTTPS, this
is typically port 80 or port 443. Because Internet printing supports HTTPS traffic, communication
can be encrypted, depending on the user’s Internet browser settings.
By default, a computer running Windows 7 or Windows Server 2008 R2 can act as a client
computer that uses Internet printing. Users who make print requests must be authenticated by the
print server, however, before they can use any of the printers connected to that server. To enable
a computer running Windows Server 2008 R2 to act as a server that supports Internet printing,
you must install the Web Server (IIS) role, the Print Services role, and the Internet Printing role
service in the Print Services role.
The print server can use IIS and other technologies to collect and log extensive data about the
user, the computer that sends the printing request, and the request itself. It is beyond the scope
of this document to describe Web site operations and the specifics about the information that can
96
be collected. For more information about IIS, see the resources listed in Internet Information
Services and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 in
this document.
Controlling Internet printing to prevent the flow of

A computer being used as a printing client
To prevent the use of Internet printing from a computer running Windows 7 or Windows
Server 2008 R2, you can use Server Manager on an individual computer or configure Group
Policy settings.
A computer being used as a server

To control Internet printing on a server running Windows Server 2008 R2, you can avoid installing
the Internet Printing role service in the Print Services role. Another alternative is to allow printing
to a limited set of user identifications.
Procedures for controlling Internet printing

 Ensure that the Internet printing feature for the client computer is not installed on a computer
running Windows Server 2008 R2.
 Disable the client side of Internet printing on computers running Windows 7 or Windows
Server 2008 R2 by using Group Policy.
 Prevent downloading print drivers over HTTP by using Group Policy. (During the process of
Internet printing, print drivers might be downloaded to a client, as described in How Internet
Printing Communicates with Sites on the Internet earlier in this section. You can prevent this
type of print driver download by using Group Policy.)
To ensure that the Internet printing feature for the client is not installed on a computer
running Windows Server 2008 R2
1. If Server Manager is not running, click Start, click Administrative Tools, and then click
Server Manager. (If the User Account Control dialog box appears, confirm that the
action it displays is what you want, and then click Continue.)
2. Make sure Features Summary is expanded, and under it, Features is expanded.
3. In the list of features, look for Internet Printing Client. If it is not an installed feature, skip
the rest of this procedure.
4. If Internet Printing Client is in the list of features, under Features Summary, click
Remove Features (on the right).
97
5. In the Remove Features Wizard, clear the check box for Internet Printing Client.
6. Follow the instructions in the wizard to complete the removal.
To disable Internet printing from computers running Windows 7 or Windows

Server 2008 R2 by using Group Policy
Configuration. If you want the Group Policy setting to apply to users and to come into
effect when users log on or when Group Policy is refreshed, expand User
Configuration.
4. In the details pane, double-click Turn off printing over HTTP, and then click Enabled.
Note
This policy setting controls whether a request for Internet printing can be
made, but it does not control whether a computer can act as an Internet print
server.
Important
by applying the Restrict Internet communication Group Policy setting. This
setting is located in Computer Configuration or User Configuration, under
Policies (if present), in Administrative Templates\System\Internet
Communication Management. For more information about this Group
To prevent downloading print drivers over HTTP to computers running Windows 7 or

Windows Server 2008 R2 by using Group Policy
Configuration.
98
4. In the details pane, double-click Turn off downloading of print drivers over HTTP, and
then click Enabled.
Important
setting is located in Computer Configuration or User Configuration, under
 For links to more information about Group Policy, see Appendix B: Resources for Learning
About Group Policy for Windows 7 and Windows Server 2008 R2.
 For more information about the use of IIS in a controlled environment, see Internet
Information Services and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 in this document.
 For more information about downloading drivers (including printer drivers) in Windows
Server 2008 R2, see Device Manager, Hardware Wizards, and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2 and Plug and Play and
Resulting Internet Communication in Windows 7 and Windows Server 7 in this document.
99
Internet Protocol Version 6, Teredo, and
Related Technologies in Windows 7 and
In this section
Overview of IPv6 implementation in Windows 7 and Windows Server 2008 R2
Additional references for IPv6 in Windows 7 and Windows Server 2008 R2
This section provides a brief overview of how Internet Protocol version 6 (IPv6) transition
technologies are implemented in Windows® 7 and Windows Server® 2008 R2. This section also
provides brief information about Teredo. (Teredo is a tunneling communication protocol that
makes it possible for a computer that is behind a network address translation (NAT) device to use
IPv6 to communicate with other computers that use IPv6.) It is beyond the scope of this
document to fully describe IPv6 or how it affects communication across the Internet for a
computer running Windows 7 or Windows Server 2008 R2.
Overview: IPv6 and Teredo implementation in

IPv6 and IPv4 are supported networking protocols in Windows 7 and Windows Server 2008 R2.
Both protocols are installed and enabled by default, and they can be configured through Control
Panel (in the Network and Sharing Center, click Manage network connections). By default,
computers running Windows 7 and Windows Server 2008 R2 will use IPv6 to connect to other
IPv6-enabled computers in the local network, subject to the applicable address selection rules
that are defined in RFC 3484. In this scenario, IPv6 does not require any special configuration.
However, a computer running Windows 7 or Windows Server 2008 R2 cannot use IPv6 to
communicate outside of the local network without additional configuration. In an IPv6-enabled
network, that configuration will typically be supplied by a network device such as an IPv6-enabled
router or home gateway. In an IPv4-only network, the additional configuration is provided by a
protocol built into Windows 7 and Windows Server 2008 R2 called Teredo.
The Teredo client in Windows 7 and Windows Server 2008 R2 is enabled but inactive by default.
To become active, an application that recognizes Teredo must be installed or the Windows
Firewall must be configured to allow Teredo on a per-application basis. When activated, the
Teredo client must initially obtain information such as the type of NAT device that is being used.
To obtain this information, the client interacts with one or more Teredo servers. This interaction
sends no data, personal or otherwise, to the Teredo servers or to Microsoft®. It is an empty
transaction that maintains a communication tunnel for the Teredo client through its NAT device.
This awareness allows Teredo to initiate connections between peers, which otherwise would
have been blocked at the NAT device.
100
In a managed network with a configured domain controller where the administrator wants to
prevent Teredo connectivity, Teredo automatically deactivates. This protects the network from
traffic that may cross the NAT device without user or administrator knowledge.
To determine the IPv4 addresses of Teredo servers, the client can send a Domain Name System
(DNS) query to resolve the name teredo.ipv6.microsoft.com. You can prevent this DNS query
by disabling or controlling Teredo in Windows 7 and Windows Server 2008 R2 by using the
following methods:
 Using a netsh command
 Changing a registry entry
 Through Group Policy settings
In most situations Teredo can be disabled because other technologies, such as Intra-Site
Automatic Tunnel Addressing Protocol (ISATAP), can be used instead,
For more information, see Using IPv6 and Teredo on the TechNet Web site.
Controlling the Teredo client in Windows 7 and Windows

Server 2008 R2
The following procedures describe three ways to control Teredo in Windows 7 and Windows
Server 2008 R2:
 Provide the Teredo client with the IPv4 address of a Teredo server by using a netsh
command. When you use this command, the Teredo client does not send a DNS query to
resolve the name teredo.ipv6.microsoft.com. Instead, it stores and uses the IPv4 address
that you provide.
 Turn off Teredo by using a netsh command.
 Turn off Teredo by changing a registry entry.
To provide the Teredo client with the IPv4 address of a Teredo server by using the netsh
command
1. To open a Command Prompt window as an administrator, click Start, click All
Programs, click Accessories, right-click Command Prompt, and then click Run as
administrator.
2. If the User Account Control dialog box appears, confirm that the action it displays is
what you want, and then click Continue.
3. At the command prompt, type the following lines (press ENTER after each line):
netsh
interface
teredo
4. At the netsh interface teredo command prompt, type the following (where IPv4_address
is the IPv4 address of a Teredo server):
101
set state servername=IPv4_address
Note
To see other options for set state, at the netsh interface teredo command
prompt, type set state /?, and then press ENTER.
To turn off Teredo by using the netsh command

administrator.
3. At the command prompt, type the following lines (press ENTER after each line):
netsh
interface
teredo
4. At the netsh interface teredo command prompt, type:
set state disabled
Note
To see other options for set state, at the netsh interface teredo command
prompt, type set state /?, and then press ENTER.
To turn off Teredo by specifying a registry setting

1. For best results, close all programs on the computer on which you are changing the
registry setting.
administrator.
4. Type:
regedit
Caution
Incorrectly editing the registry may severely damage your system. Before
making changes to the registry, you should back up any valued data on the
computer. You can also use the Last Known Good Configuration startup
option if you encounter problems after manual changes have been applied.
5. Navigate to:
102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6
6. Right-click Parameters, click New, click DWORD, and then type the following name for
the new value (type the name exactly as shown, including capitalization):
DisabledComponents
7. Double-click DisabledComponents, select Hexadecimal, and then in Value data, type:
8e
8. Click OK.
9. Restart the computer.
To turn off Teredo by using a Group Policy setting

administrator.
3. At the command prompt, type the following line (and then press ENTER):
gpedit.msc
4. Under Computer Configuration expand Administrative Templates.
5. Expand Network, expand TCPIP Settings, and then click IPv6 Transition
Technologies.
6. In the right pane, double-click the setting labeled Teredo State. Select Disabled, and
then click OK.
Additional references for IPv6

This following links on the Microsoft Web site provide additional information about IPv6 in
Windows 7 and Windows Server 2008 R2:
 IPv6
 The Cable Guy Web site
 Using IPv6 and Teredo
 Manageable Transition to IPv6 using ISATAP
 Microsoft's Objectives for IP Version 6
 Address Selection standards
 Using Windows Tools to Obtain IPv6 Configuration Information
In addition, you can search the Internet Engineering Task Force (IETF) Web site for information
about IPv6 or related technologies, such as Intra-Site Automatic Tunnel Addressing Protocol
(ISATAP) or Teredo:
Internet Engineering Task Force
103
Plug and Play and Resulting Internet
Server 7
This section provides information about how Plug and Play (PnP) for Windows® 7 and Windows
Information about how PnP communicates with Internet sites is provided in another section of this
document, Device Manager, Hardware Wizards, and Resulting Internet Communication in
Benefits and purposes of Plug and Play

Plug and Play for Windows 7 and Windows Server 2008 R2 provides ease-of-support for
installing devices on computers in your network. Installing a PnP device typically does not require
user input. You can connect a PnP device to your computer, and Windows searches for a driver,
downloads (if necessary) and installs the driver, and then allocates resources for the device. By
default, PnP searches Windows Update when a new device is connected for the first time.
Note
All drivers that are obtained through Windows Update are signed by Windows Hardware
Quality Labs (WHQL). The WHQL tests hardware and drivers for compatibility with
Windows operating systems.
PnP also searches administrator or OEM-configured network shares and local paths, and the
Driver Store for drivers if one is not found on Windows Update.
Note
For the best performance with certain types of devices, such as removable storage
devices, Windows searches locally first.
PnP in Windows 7 and Windows Server 2008 R2 performs several tasks, including the following:
 Detects a PnP device and determines its hardware resource requirements and device
identification number (PnP ID).
 Locates an appropriate device driver for each newly installed device.
 Allocates hardware resources.
 Dynamically loads, initializes, and unloads drivers.
 Notifies other drivers and applications when a new device or device interface is available.
 Handles stop and start processes for devices during hibernation, standby, start up, and shut
down (in conjunction with power management).
104
 Stages driver packages in the driver store,
 Creates a Windows error report when there is a problem installing a device driver.
Note
Some buses, such as Peripheral Component Interconnect (PCI) and Universal Serial Bus
(USB), take full advantage of PnP. Older buses, such as Industry Standard Architecture
(ISA) require more user interaction to ensure that the devices are correctly installed. You
may need to log on as an administrator or as a member of the Administrators group to
install these devices.
 Device and Driver Installation
 Device Management and Installation
 Plug and Play—Architecture and Driver Support
 For information about how PnP communicates with sites on the Internet, see the following
section in this document:
Device Manager, Hardware Wizards, and Resulting Internet Communication in Windows 7
 For a description of Windows Update, see the following section in this document:
2008 R2
105
Program Compatibility Features and
In this section
Benefits and purposes of program compatibility features
Overview: Using program compatibility features in a managed environment
How program compatibility features communicate with Internet sites
Controlling program compatibility feature information to the Internet
Procedure for controlling Internet communication related to program compatibility features
The following program compatibility features are described in this section:
 Compatibility tab in the property sheet
 Program Compatibility Assistant
 Program Compatibility Troubleshooter
In addition, at the end of the section, there is a brief description of the Application Compatibility
Toolkit, which you can use to locate and address compatibility problems.
The program compatibility features integrate with Windows Error Reporting (WER) and the
Problem Reports and Solutions feature in Windows® 7 and Windows Server® 2008 R2. This
makes it easier for you or a user to obtain updated, Web-based information about how to
overcome compatibility problems with a program you want to run. For more information, see
Windows Error Reporting and the Problem Reports and Solutions Feature in Windows 7 and
Windows Server 2008 R2 in this document.
Benefits and purposes of program compatibility

features
There are some programs that work on earlier versions of the Windows operating system that
might fail to function properly on Windows 7 and Windows Server 2008 R2. This can happen for
several reasons—a program may be tied to a specific version of Windows, may expect older
formats of Windows data, or may expect user information to be in specific locations or formats. In
addition, programs that were written exclusively for Microsoft® Windows 95, Windows 98, or
Windows Millennium Edition might use direct hardware access, which can greatly reduce
operating system stability. Windows 7 and Windows Server 2008 R2 require that hardware
access be handled through the correct channels.
To enable a better user experience, Windows 7 and Windows Server 2008 R2 include the
following program compatibility features:
106
 The Compatibility tab in the property sheet for a program. A user can right-click a
program icon or program file (for example, on the desktop or in Windows Explorer), click
Properties, click the Compatibility tab, and then change the compatibility settings for the
program. A report that lists the program, the compatibility settings, and other information is
generated and then handled by Windows Error Reporting (if it is enabled). For a description
of the information in the report, see Aspects of Internet communication that are similar for all
program compatibility features later in this section.
 The Program Compatibility Assistant. This feature runs in two ways, depending on if the
user attempts to start an incompatible program or an incompatible driver:
 Incompatible program: If the program is on the list of known incompatible programs that
is included in Windows 7 or Windows Server 2008 R2, the Program Compatibility
Assistant appears. If the program is known to cause a serious problem, it is blocked.
Otherwise, the Program Compatibility Assistant warns the user and offers the option of
running the program. In either case, the Program Compatibility Assistant offers the option
of checking online for information or solutions.
If a program fails and is determined to be incompatible, the Program Compatibility
Assistant offers the user the option of running the program again with recommended
compatibility settings. For example, an installer that requires a compatibility mode for
Windows XP can trigger the Program Compatibility Assistant. The Program Compatibility
Assistant generates a report that lists the program, the compatibility settings, and other
information. This report is handled by Windows Error Reporting. For a description of the
information in the report, see Aspects of Internet Communication that are Similar for All
Program Compatibility Features later in this section.
 Incompatible drivers: Known incompatible drivers are always blocked, and a balloon
notification appears. If the user clicks the notification, the Program Compatibility Assistant
appears and offers the option of checking online for information or solutions.
 The Program Compatibility Troubleshooter. A user can run this troubleshooter to choose
compatibility settings that can help an otherwise incompatible program run successfully. The
troubleshooter generates a Windows Error Report that lists the information about the
program, the compatibility settings that were attempted by the user, and a report on whether
the problem was fixed. The report is handled by Windows Error Reporting. For a description
of the information in the report, see Aspects of Internet Communication that are Similar for All
Program Compatibility Features later in this section.
The Program Compatibility Troubleshooter can be accessed in the following ways:
In Control Panel: Click Troubleshooting, and then click Run programs made for previous
versions of Windows.
From any .exe: Right-click the application .exe file, and then select the Troubleshoot
Compatibility menu option.
107
Overview: Using program compatibility features in
a managed environment
In a managed environment, the program compatibility features can be of significant value. The
Program Compatibility Assistant and Compatibility tab offer ways for a user to try compatibility
settings with a program. The Program Compatibility Assistant can prevent a user from running a
program that is known to cause serious problems.
However, you might decide to use Group Policy to control compatibility features. With Group
Policy, you can:
 Turn off one or more of the program compatibility features.
 Turn off Windows Error Reporting, so that reports generated by the program compatibility
features are not sent to Microsoft and solution information is not sent back.
 Configure Windows Error Reporting so that all reports (including reports from program
compatibility features) are sent to a server in your organization instead of being sent directly
to Microsoft.
For more information about Group Policy settings for program compatibility features, see
Controlling program compatibility feature information to the Internet later in this section. For more
information about Group Policy settings for Windows Error Reporting, see Windows Error
Reporting and the Problem Reports and Solutions Feature in Windows 7 and Windows Server
2008 R2 in this document.
How program compatibility features communicate

with Internet sites
The program compatibility features integrate with Windows Error Reporting and the Problem
Reports and Solutions Feature in Windows 7 and Windows Server 2008 R2. This makes it easier
for you or a user to obtain updated, Web-based information about how to overcome compatibility
problems with a program you want to run. For more information, see Windows Error Reporting
and the Problem Reports and Solutions Feature in Windows 7 and Windows Server 2008 R2 in
this document.
Aspects of Internet communication that are similar for all

program compatibility features
Some aspects of Internet communication are similar for all program compatibility features, as
described in the following list:
 Specific information sent: All program compatibility features create a similar type of report
for handling through Windows Error Reporting. The reports contain the following information.
 File name: This is the file name of the program executable.
108
 Program information: This information is stored in the program, and it can include the
product name, version, company name, and a description of the program. (Some
programs do not store all these types of information.)
 Feature and (in some cases) context from which the report was generated: This
information is coded as a number, and it tells whether the report came from the Program
Compatibility Wizard or the Compatibility tab.
 Default settings: By default, all program compatibility features are available in Windows 7
and Windows Server 2008 R2. However, information is sent to Microsoft only if the user
consents.
 Logging: When the Program Compatibility Assistant is triggered, it logs an event that
includes the incompatible program's path, file name, version, and product name, along with
information about what triggered the Program Compatibility Assistant and what compatibility
settings were applied.
You can also use tools in the Application Compatibility Toolkit to help you monitor application
compatibility. The Application Compatibility Toolkit is described in Additional references later
in this section.
Also, when program compatibility features obtain solution information through Windows Error
Reporting, that information can be viewed through the Problem Reports and Solutions feature
(like other solution information obtained through Windows Error Reporting).
 Encryption: The program compatibility features use the same approach to encryption that
Windows Error Reporting uses. Most of the information sent by the program compatibility
features (for example, program name and version) falls into the Windows Error Reporting
category of "parameters," and therefore, it is not encrypted. If any information beyond
parameters information is sent, it is encrypted.
 Access: The Microsoft product groups have access to the program compatibility data, and
they use the data to understand program the compatibility problems that customers are
experiencing and to provide better information about how to solve those problems. If a non-
Microsoft product is involved, Microsoft may send that compatibility information to the vendor
of the product. The vendor may provide this information to sub-vendors and partners. All
parties must abide by the terms of the privacy statement.
 Privacy: The privacy statement for Windows Error Reporting (which handles the reports
generated by program compatibility features) is available at:
Microsoft Online Crash Analysis.
 Transmission protocol and port: For unencrypted information, HTTP is used with port 80.
For encrypted information, HTTPS is used with port 443.
 Ability to disable: You can use Group Policy to disable program compatibility features, as
described in Controlling program compatibility feature information to the Internet later in this
section.
109
Triggers and user notifications for program compatibility
features
For each of the program compatibility features, a different trigger causes a report to be generated
and passed to Windows Error Reporting. The user notifications are also different for each
program compatibility feature. The following list provides details about the triggers and
notifications:
 Trigger and user notification for the Program Compatibility Troubleshooter: When the
user completes the troubleshooter, it generates a Windows Error Report. If the user selects
the option to check online for a solution from the Program Compatibility Troubleshooter, the
report is sent immediately. Otherwise Windows Error Reporting might save the report in a
queue and send it later.
 Trigger and user notification for the Compatibility tab in the property sheet for a
program: When the user changes settings on the Compatibility tab and then clicks OK, a
report is generated and passed to Windows Error Reporting. Windows Error Reporting might
save the report in a queue and send it later.
 Trigger and user notification for the Program Compatibility Assistant: The following
actions trigger the Program Compatibility Assistant:
 The user runs a program that is on a list of known incompatible programs that are
included in Windows 7 and Windows Server 2008 R2. After the Program Compatibility
Assistant displays a warning or blocks the program, it provides a link to additional online
information about the program. If the user responds, the Program Compatibility Assistant
generates a report and sends it through the Windows Error Reporting feature. The
resulting Web page has a URL that begins with
http://oca.microsoft.com/en/response.aspx?sid= and ends with a number that is assigned
to the page for that incompatible program. This Web page displays information or links
that might help solve the compatibility problem.
 The user runs a program that fails in a way that is typical of incompatible programs. The
Program Compatibility Assistant appears and offers the user the option of running the
program again with recommended compatibility settings. When the user responds
(regardless of what the response is), a report is generated and passed to Windows Error
Reporting.
How information is stored locally for the Program Compatibility Assistant

As described in the previous list, the Program Compatibility Assistant accesses lists of known
incompatible programs that are included in Windows 7 and Windows Server 2008 R2.
110
The lists are in the following set of database files:
File Name Type of File Information Stored
Sysmain.sdb Information about known incompatible

programs (.exe files)
Msimain.sdb Information about known incompatible

Windows installer packages (.msi files)
Drvmain.sdb Information about known incompatible drivers
Controlling program compatibility feature

information to the Internet
To control the way program compatibility features communicate across the Internet, you can use
Group Policy to accomplish one or more of the following:
 Turn off the Program Compatibility Assistant and Compatibility tab: You can turn off the
Program Compatibility Assistant, the Compatibility tab, or both.
For more information, see Procedure for controlling Internet communication related to
program compatibility features later in this section.
 Turn off Windows Error Reporting: If you turn off Windows Error Reporting, reports that are
generated by the program compatibility features are not sent. With this option, users will not
be able to view updated Web-based information about solutions to compatibility problems.
Feature in Windows 7 and Windows Server 2008 R2 in this document.
 Send Windows Error Reporting reports to a server in your organization: If you use this
approach, error reports like those that are generated by the Program Compatibility Assistant
are sent to a server in your organization instead of being sent directly to Microsoft. With this
option, users are not able to view updated Web-based information about solutions to
compatibility problems.
Feature in Windows 7 and Windows Server 2008 R2 in this document.
Note
There is a Group Policy setting for turning off the underlying functionality, which is called
the Application Compatibility Engine. In most situations we recommend that you do not
turn off this engine.
111
Procedure for controlling Internet communication
related to program compatibility features
The following procedure tells how to use Group Policy to turn off features of the Program
Compatibility Assistant, the Compatibility tab, or both.
To turn off Program Compatibility Assistant and Compatibility tab features by using
Group Policy
and Windows Server 2008 R2, and then edit an appropriate Group Policy object.
Templates, expand Windows Components, and then click Application Compatibility.
3. In the details pane, double-click the following labels to turn these features off:
 Prevent access to 16-bit applications.
 Remove Program Compatibility Property Page. (The Compatibility property page
is also known as the Compatibility tab in the property sheet for a program.
 Turn off Application Telemetry.
 Turn Off Program Compatibility Assistant.
 Turn off Program Inventory.
 Turn off Switchback Compatibility Engine.
 Turn off Problems Steps Recorder.
Important
Do not configure Turn Off Application Compatibility Engine unless you have reviewed
the Explain text for the setting. In most situations, we do not recommend that you turn off
this engine.
By using the Application Compatibility Toolkit, you can customize the way Windows 7 and
Windows Server 2008 R2 respond to programs that are known to compromise system integrity.
For example, you can use the Compatibility Administrator tool to create custom messages that
notify users about problems with an incompatible application and redirect users to your intranet
site. For more information, see the following Web sites:
 Microsoft Application Compatibility Toolkit 5.5
 Windows 7 and Windows Server 2008 R2 Application Quality Cookbook
 Application Compatibility
112
Remote Assistance and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Remote Assistance
Overview: Using Remote Assistance in a managed environment
How Remote Assistance communicates through the Internet
Controlling Remote Assistance to prevent the flow of information to and from the Internet
Procedures for controlling or disabling Remote Assistance
This section describes four ways that Remote Assistance can work:
 Remote Assistance through instant messaging. Because this is designed more for a home
scenario than an enterprise scenario, it is not described fully in this document, but there are
links to additional information in Additional references later in this section.
 Solicited Remote Assistance (a user sends an invitation, through e-mail or as a file, to a
person who can provide assistance).
 Offer Remote Assistance within a domain setting (a designated set of people, such as
support professionals, offer assistance to users).
 Easy Connect, which allows a Remote Assistance connection between two computers to be
initiated by using the Peer Name Resolution Protocol (PNRP).
Note
Additional network configuration steps are required to make the PNRP available
in enterprise environments.
Important
On a computer running Windows Server® 2008 R2, Remote Assistance is an optional
component that is not installed by default. You must install Remote Assistance by using
the Add Features Wizard in Server Manager before it can be used.
Benefits and purposes of Remote Assistance

With Remote Assistance, a support person or helper can offer assistance to users with computer
issues or questions. The support person might connect from a computer running Windows® 7 or
113
After the user and helper are connected and the Remote Assistance session begins, both can
view the user's computer screen, communicate in real time about what they see, and use the
mouse and keyboard to work on the user's computer.
Multiple protections are built into Remote Assistance:
 Remote Assistance sessions use the Remote Desktop Protocol (RDP) and end-to-end
encryption.
 The person who is being assisted must consent before the desktop can be viewed remotely,
regardless of how the Remote Assistance process begins (through instant messaging,
through an invitation sent through e-mail or delivered as a file, or through Offer Remote
Assistance).
 A person who is requesting assistance must send an automatically-generated 12-character
password that the helper must type before assistance can begin.
 The person being assisted can stop the Remote Assistance session at any time.
 Through Remote settings (Advanced button) in Control Panel\System, you can set the
maximum amount of time that a Remote Assistance invitation can remain open.
The following sections provide more detail, including information about the three types of Remote
Assistance: instant message–based Remote Assistance, Solicited Remote Assistance where the
invitation is sent as an e-mail or delivered as a file, and Offer Remote Assistance (used within a
domain).
Overview: Using Remote Assistance in a managed

environment
The Remote Assistance Wizard guides you through one of several processes:
 Creating an e-mail or file invitation for remote assistance, and then generating a password for
the session.
 Offering remote assistance to a specific computer (identified by name or IP address).
In a managed environment, a firewall on your organization's network will likely prevent helpers
outside your network from connecting directly to a computer on your network because the firewall
blocks inbound Remote Assistance connections. However, you can control Remote Assistance
by disabling all types of Remote Assistance or by allowing certain types. For example, by allowing
only Offer Remote Assistance within your domain, you could specify a list of support
professionals in your organization who can offer assistance. Only the people on that list can
assist users through Remote Assistance. (Offer Remote Assistance only works within a domain
environment.)
For a list of Group Policy settings that are relevant for controlling Remote Assistance in a
managed environment, see Using Group Policy to limit communication through Remote
Assistance later in this section.
Note
114
In addition, on a server running Windows Server 2008 R2, before users can access
Remote Assistance, they must install the Remote Assistance feature and then start the
Remote Assistance Wizard by clicking Start, All Programs, Maintenance, and then
Windows Remote Assistance.
The Remote Assistance invitation and the Remote Assistance session

There are two stages to the Remote Assistance process:
 Remote Assistance invitation. An invitation or "ticket" is sent from one computer to another
and the computers establish communication.
 Remote Assistance session. The helper views or changes the configuration on another
person's computer.
For more information about the communication in these processes, see How Remote Assistance
communicates through the Internet later in this section.
Types of assistance that are included in Remote Assistance

When choosing ways to control Remote Assistance, consider the types of assistance that are
included in Remote Assistance in Windows Server 2008 R2. The following list briefly describes
each type. Details about how to control these types of assistance are provided later in this
section.
Note
The types of Remote Assistance refer to how the Remote Assistance session is initiated.
For all types of Remote Assistance, the person receiving assistance must consent before
assistance can begin.
 Instant message–based Remote Assistance. Both the person seeking assistance and the
person who gives assistance must be using instant-messaging software based on the
Rendezvous API (for example, Windows Live Messenger 8.0). A person seeking assistance
can select a buddy from his or her list and ask that person to provide Remote Assistance. For
information about this approach, see Additional references later in this section.
 Solicited Remote Assistance where an invitation is sent by e-mail or delivered as a file.
A person sends an invitation, through e-mail or as a file, to a person who can provide
assistance.
 Solicit Remote Assistance through Easy Connect. The system generates a 12-digit
password, which the person requesting assistance must provide to a person who can provide
assistance.
 Offer Remote Assistance. For Offer Remote Assistance to work, a certain amount of
configuration is necessary, and the computers must be within a domain. This means that the
system administrator can determine who can offer remote assistance within the domain.
Note
115
A support professional who is working on a computer running Windows XP
cannot offer remote assistance to computers running Windows 7 or Windows
Server 2008 R2. The support professional must have a computer running
Windows Vista®, Windows 7, Windows Server 2008, or Windows
Server 2008 R2. (With any of these operating systems, the support professional
can also offer remote assistance to a computer running Windows XP).
For more information, see Controlling Remote Assistance to prevent the flow of information to
and from the Internet and Procedures for controlling or disabling Remote Assistance later in this
section.
Windows Firewall settings in relation to Remote Assistance

Windows Firewall includes a list of exceptions that you can chose, including an exception for
Remote Assistance. Enabling the Remote Assistance exception has different effects, depending
on which of the following network categories the computer is using at a given time:
 Private network. This category is intended for home or small office networks, and it is less
restrictive than the public network category. For a private network, network discovery is on by
default. Network discovery is the ability of a computer to recognize or be recognized by
computers and other devices on the network.
 Public network. This category is intended for networks in public places (such as coffee
shops or airports). The public network category is intended to be more restrictive to help keep
the computers secure. For a public network, network discovery is off by default.
 Domain network. This category is automatically applied when a computer is connected to a
domain. For a domain network, network discovery is on by default.
Note
In a domain, if you enable the Windows Firewall exception for Remote Assistance, Port
135 TCP is opened. If you do not want to open this port, you can use a Group Policy
setting to allow authenticated traffic that is protected by Internet Protocol security (IPsec)
to bypass Windows Firewall. For more information, see Additional references later in this
section.
116
The following table lists the network categories and describes how the Remote Assistance
exception in Windows Firewall works in each category:
Network Category Remote Assistance Exception in Windows

Firewall
Private  Remote Assistance exception is enabled by

default, which means:
 systemroot\System32\msra.exe can
communicate through the firewall.
 The computer can be reached through
Teredo (a tunneling technology that is
used with IPv6).
For links to information about IPv6, see
Internet Protocol Version 6, Teredo,
and Related Technologies in Windows
7 and Windows Server 2008 R2 in this
document.
UPnP protocols.
Public  Remote Assistance exception is disabled

by default.
 If the exception for Remote Assistance is
enabled:
 systemroot\System32\msra.exe can
Teredo (a tunneling technology that is
used with IPv6) to traverse routers with
network address translators (NATs).
For links to information about IPv6, see
Internet Protocol Version 6, Teredo,
and Related Technologies in Windows
7 and Windows Server 2008 R2 in this
document.
Domain  Remote Assistance exception is disabled

by default.
 If the exception for Remote Assistance is
enabled:
 Port 135 TCP is opened for Distributed
117
Network Category Remote Assistance Exception in Windows
Firewall
Component Object Model (DCOM) for
Offer Remote Assistance. For an
alternative approach, see the note that
precedes this table.
 systemroot\System32\msra.exe (for
both Offer Remote Assistance and
Solicited Remote Assistance) can
 systemroot\System32\raserver.exe
(for Offer Remote Assistance) can
How Remote Assistance communicates through

the Internet
The following list provides details about how Remote Assistance communicates through the
Internet:
 Specific information sent or received. Information that is transmitted in a Remote
Assistance ticket includes the user name, IP address, and computer name. Information that is
transmitted during a Remote Assistance session depends on the features that are being used
(for example, screen sharing), and it is sent in real time by using point-to-point connections.
Note
In Solicited Remote Assistance, when a user creates an e-mail invitation for
remote assistance, Remote Assistance uses the Simple MAPI (SMAPI) standard
to communicate with the e-mail client, which means that the invitation is attached
to the e-mail message.
 Default settings. By default, the Remote Assistance feature is not installed on a server
running Windows Server 2008 R2. The feature must be installed before a Remote Assistance
session (solicited or offered) can begin.
Default settings for Windows Firewall also have important effects on Remote Assistance as
described in Windows Firewall settings in relation to Remote Assistance earlier in this
section. However, the Remote Assistance Wizard allows you to begin selecting Remote
Assistance options. Then it may display a notification that Windows Firewall is blocking
Remote Assistance and provide you with information about how to configure Windows
Firewall to make an exception for Remote Assistance. With this notification, a support
professional can tell if Windows Firewall is blocking the attempted actions. However, if a
support professional tries to use Offer Remote Assistance for a computer on which Windows
118
Firewall is blocking the session, the session will not be established and no notification will
appear on either computer.
Regardless of any other settings, users can always prevent someone from connecting to their
computers by declining prompts to begin a Remote Assistance session.
 Triggers. With Solicited Remote Assistance, a user establishes contact with the helper by
sending an invitation through e-mail, by saving an invitation as a file and transferring it
manually (such as on a floppy disk), or through compatible instant-messaging software. To
be compatible, instant-messaging software must use the Rendezvous API (an example is
Windows Live Messenger 8.0).
With Offer Remote Assistance, you offer unsolicited assistance to a user (which the user can
decline). To do this, you must be an administrator on the user's computer or you must be on
an Offer Remote Assistance list that is configured for the user's computer.
 User notification. When you are at a computer running Windows 7 or Windows
Server 2008 R2, you are notified of an offer of assistance (solicited or unsolicited) from
another person. You must accept the invitation before the other person can see your
computer. Then, before the other person can take control of your computer, you are asked
whether to allow this. (Remote Assistance can also be configured to allow the other person to
view but not take control of your computer.)
 Logging. On the computer running Windows 7 or Windows Server 2008 R2, Remote
Assistance records events in the System log in Event Viewer, and in a log file in the path
\Users\user name\Documents\Remote Assistance Logs.
Events such as a person initiating a connection or a person accepting or rejecting an
invitation are recorded in the Remote Assistance logs, and the details include taking and
releasing control, sending and accepting files, and ticket creation and deletion. Remote
Assistance also records details such as whether assistance is solicited or unsolicited and
detailed user name and IP address information.
 Encryption. The Remote Desktop Protocol (RDP) encryption algorithm, RC4 128-bit, is
used.
Note
One item in the Remote Assistance invitation (for Solicited Remote Assistance)
that is not encrypted in some cases is a plain-text IP address. This plain-text IP
address is included by default, for compatibility with Windows XP and
Windows 2003. However, you can configure an option so that invitations will
include the user's IP address in the encrypted form only (the form used by
Windows Server 2008 R2 and Windows 7), without the address being
unencrypted as required for Windows XP, Windows Vista, and Windows
Server 2003. For more information, see Procedures for controlling or disabling
Remote Assistance later in this section.
 Access. No information is stored at Microsoft® facilities.
119
 Transmission protocol and port. The port is dynamically selected by Remote Assistance,
and the protocol is RDP. For Offer Remote Assistance, DCOM is also used.
 Ability to disable. Solicited Remote Assistance and Offer Remote Assistance can be
disabled by using Group Policy or through Control Panel. They can also be disabled by using
an unattended installation with an answer file. For more information, see Procedures for
controlling or disabling Remote Assistance later in this section.
Controlling Remote Assistance to prevent the flow

of information to and from the Internet
When choosing among ways of controlling Remote Assistance, consider the types of assistance
that are included in Remote Assistance in Windows 7 and Windows Server 2008 R2. The
following list provides suggestions for using or controlling each type in a managed environment:
 Controlling instant-message-based Remote Assistance: This is actually a form of
Solicited Remote Assistance, so when you turn off Solicited Remote Assistance, you also
turn off instant-message-based Remote Assistance. You can turn this off through Control
Panel, through Group Policy, or with an unattended installation by using an answer file.
As an alternative, you can exclude instant-messaging software from standard corporate
computer configurations, and make sure that users do not have administrative accounts, so
that they cannot install software on their computers. (This section does not provide details
about how to do this.)
 Controlling Solicited Remote Assistance where an invitation is sent by Easy Connect
or e-mail or delivered as a file: On a computer running Windows 7 or Windows
Server 2008 R2, you can avoid installing Remote Assistance, which turns off all forms of
Remote Assistance. If you install Remote Assistance, you can turn off Solicited Remote
Assistance through Group Policy or with an unattended installation by using an answer file.
(This also turns off instant-message-based Remote Assistance, which is a form of Solicited
Remote Assistance.)
As a way to limit but not turn off Solicited Remote Assistance, you can configure it so that the
IP address in the invitation is only in encrypted form. (This type of invitation does not work if it
is sent to someone on a computer running Windows XP or Windows 2003). Another
alternative is to allow Solicited Remote Assistance but allow the helper to view but not take
control of the user's computer.
 Controlling Offer Remote Assistance: On a computer running Windows Server 2008 R2,
you can avoid installing Remote Assistance, which turns off all forms of Remote Assistance.
If you install Remote Assistance, you can turn off Offer Remote Assistance through Group
Policy or with an unattended installation by using an answer file.
However, you might prefer to allow only Offer Remote Assistance and control the list of
support professionals who are allowed to offer assistance. For Windows 7, Windows
Server 2008 R2 (and several earlier operating systems), you can control this list on an
120
individual computer or through Group Policy. If you do this, you also need to use Group
Policy to enable the Remote Assistance exception in Windows Firewall.
If you allow Offer Remote Assistance, another alternative is to allow the helper to view but not
take control of the user's computer.
The following section provides information about using Group Policy. Later sections provide
information about all methods for controlling Remote Assistance.
Using Group Policy to limit communication through Remote

Assistance
There are multiple Group Policy settings that you can configure to control the use of Remote
Assistance, including settings for the following:
 Solicited Remote Assistance
 Offer Remote Assistance
 Allow only Windows Vista or later connections
These policy settings are located in Computer Configuration under Policies (if present), in
Administrative Templates\System\Remote Assistance. The configuration options for these
policy settings are described in the following list:
 Solicited Remote Assistance
 Solicited Remote Assistance (enabled): When this policy setting is enabled, a person
can create a Remote Assistance invitation that a helper at another computer can use to
connect to the computer of the person who is requesting assistance. If given permission,
the helper can view the screen, mouse, and keyboard activity in real time.
The following additional configuration options are available when you enable this policy
setting:
 Solicited Remote Assistance (disabled): If the status is set to Disabled, the person at
this computer cannot request Remote Assistance.
 Solicited Remote Assistance (not configured): If the status is set to Not Configured,
the configuration of solicited Remote Assistance is determined by the system settings.
 Offer Remote Assistance
 Offer Remote Assistance (enabled): When this policy setting is enabled, a remote user
or administrator can offer Remote Assistance to a computer. When you configure this
policy setting, you must also specify the list of users or user groups that will be allowed to
offer remote assistance. Administrators of a given computer can offer remote assistance
by default; they do not need to be added to the list.
Additional configuration options are available when you enable this policy setting.
 Offer Remote Assistance (disabled or not configured): If you disable or do not
configure this policy setting, a helper cannot offer unsolicited remote assistance to that
computer.
 Allow only Windows Vista or later connections
121
 Allow only Windows Vista or later connections (enabled): If you enable this policy
setting, when an invitation for Solicited Remote Assistance is sent from a computer
running Windows 7 or Windows Server 2008 R2, the invitation will include the user's IP
address in encrypted form, but not in clear text as required by Windows XP and Windows
Server 2003.
 Allow only Windows Vista or later connections (disabled or not configured): If you
disable or do not configure this policy setting, for Solicited Remote Assistance, invitations
will include the user's IP address in clear text (as required for compatibility with
Windows XP and Windows Server 2003), not only in the encrypted form that is used by
Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
For information about additional configuration options, including a setting called Customize
Warning Messages, see the Remote Assistance policy settings in Group Policy. To find more
information about editing Group Policy, see Appendix B: Resources for Learning About Group
Policy for Windows 7 and Windows Server 2008 R2.
Notes
You can also use Group Policy to specifically control how Remote Assistance interacts
with the User Account Control in Windows 7 or Windows Server 2008 R2 when the user
does not have administrative credentials but the support professional does. In this case
Remote Assistances presents a User Account Control prompt to the remote helper.
Otherwise, the desktop becomes a secure desktop and cannot be viewed remotely, so
the support professional is presented with a blank screen.
To prevent this from occurring, in Group Policy, in Computer Configuration under
Policies (if present), in Windows Settings\Security Settings\Local Policies\Security
Options, find the setting called User Account Control: Allow UI Access applications
to prompt for elevation without using the secure desktop.
Procedures for controlling or disabling Remote

Assistance
The procedures in this section are grouped according to the method by which you perform them:
 Controlling Remote Assistance on an individual computer running Windows 7 or Windows
Server 2008 R2
 Controlling Remote Assistance by using Group Policy
 Controlling Remote Assistance during an unattended installation by using an answer file
Controlling Remote Assistance on an individual computer

This subsection contains procedures for configuring Remote Assistance on an individual
computer running Windows 7 or Windows Server 2008 R2. The first two procedures apply only to
122
Windows Server 2008 R2. The remaining procedures apply both to Windows 7 and Windows
Server 2008 R2.
To install Remote Assistance on a computer running Windows Server 2008 R2

interface is displayed, under Customize This Server, click Add features. Then skip to
step 3.
Then, in Server Manager, under Features Summary, click Add Features.
3. In the Add Features Wizard, select the check box for Remote Assistance.
4. Follow the instructions in the wizard to complete the installation.
To uninstall Remote Assistance on a computer running Windows Server 2008 R2

click Server Manager. (If the User Account Control dialog box appears, confirm that
the action it displays is what you want, and then click Continue.)
2. In Server Manager, under Features Summary, click Remove Features.
3. In the Remove Features Wizard, clear the check box for Remote Assistance.
In this wizard, you remove a feature by clearing a check box (not by selecting a check
box).
Note
You can perform the following procedure only if Remote Assistance is installed. For
information about installing and uninstalling Remote Assistance, see the previous
procedures.
To use Control Panel to maximize the encryption in Remote Assistance invitations sent
from a computer running Windows 7 or Windows Server 2008 R2
1. Click Start, point to Settings, and then click Control Panel.
3. In the left pane, click Remote settings.
5. On the Remote tab, under Remote Assistance, click Advanced.
6. Select the check box labeled Create invitations that can only be used from
123
computers running Windows Vista or later.
Important
When this option is selected, Remote Assistance invitations that are sent
from this computer contain the IP address in encrypted form only, which
prevents the invitation from working if it is received on a computer running
Windows XP or Windows Server 2003.
For information about a Group Policy setting that overrides this Control Panel setting, see To use
Group Policy to maximize the encryption in Remote Assistance invitations that are sent later in
this section.
To use Control Panel to allow helpers to view but not take control of this computer
5. On the Remote tab, under Remote Assistance, click Advanced.
6. Clear the check box labeled Allow this computer to be controlled remotely.
Group Policy to allow helpers view but not take control of a user’s computer later in this section.
To use Control Panel to configure exclusive "Offer Remote Assistance"

5. On the Remote tab, under Remote Assistance, clear the check box labeled Allow
Remote Assistance connections to this computer. (Clearing this check box disables
Solicited Remote Assistance, but it does not disable Offer Remote Assistance.)
6. Click OK.
7. Click the Back button, and then double-click User Accounts.
8. Click Manage User Accounts.
10. Under Users for this computer, determine if the list includes the people who should be
able to offer Remote Assistance to this computer. If it does not, use the Add button to
124
add one or more user accounts to the list.
11. Click the account of a person who you want to allow to offer Remote Assistance to this
computer, click Properties, and make sure the Group Membership tab is selected. Click
Other, expand the list, and click Offer Remote Assistance Helpers. (If you click
Administrator instead of Other, the person will have full control on this computer, which
includes offering remote assistance.)
Group Policy to configure exclusive "Offer Remote Assistance" later in this section.
Controlling Remote Assistance by using Group Policy

This subsection contains procedures for controlling Remote Assistance by using Group Policy.
For information about an additional Group Policy setting, which affects the way Remote
Assistance interacts with User Account Control in cases where the user (the person receiving
assistance) does not have administrative credentials, see the note just before Procedures for
controlling or disabling Remote Assistance earlier in this section.
To use Group Policy to maximize the encryption in Remote Assistance invitations that
are sent
1. See Appendix B: Resources for Learning About Group Policy for Windows 7 and
Windows Server 2008 R2 for information about using Group Policy. Using an account
with domain administrative credentials, log on to a computer running Windows
Server 2008 R2 or Windows 7. Then open Group Policy Management Console (GPMC)
by running gpmc.msc and edit an appropriate Group Policy object (GPO).
Templates, expand System, and then click Remote Assistance.
3. In the details pane, double-click Allow only Windows Vista or later connections, and
then click Enabled. (You can also click the Explain tab to see details about how the
setting works.)
Important
When this setting is enabled, Remote Assistance invitations sent from
computers affected by this policy setting contain the IP address in encrypted
form only, which prevents the invitation from working if it is received on a
computer running Windows XP or Windows Server 2003.
To use Group Policy to allow helpers to view but not take control of a user’s computer
125
3. If you permit Solicited Remote Assistance, in the details pane, double-click Solicited
Remote Assistance, click Enabled, and under Permit remote control of this
computer, select Allow helpers to only view the computer, and then click OK.
4. If you permit Offer Remote Assistance, in the details pane, double-click Offer Remote
Assistance, click Enabled, and under Permit remote control of this computer, select
Allow helpers to only view the computer. (If you have not already clicked Show and
used the Add button to add the accounts of support professionals who you want to allow
to offer assistance, you must do so before you can click OK.)
To use Group Policy to configure exclusive "Offer Remote Assistance"

3. In the details pane, double-click Solicited Remote Assistance, click Disabled, and then
click Next Setting.
4. For the Offer Remote Assistance setting, click Enabled, click Show, and use the Add
button to add accounts of support professionals who you want to allow to offer
assistance.
To use Group Policy to disable all types of Remote Assistance

3. In the details pane, double-click Solicited Remote Assistance, click Disabled, and then
click Next Setting.
4. For the Offer Remote Assistance setting, click Disabled, and then click OK.
Controlling Remote Assistance during an unattended installation

by using an answer file
This subsection contains procedures for controlling Remote Assistance by using an answer file
with an unattended installation.
To use an answer file to control "Solicited Remote Assistance" to maximize the

encryption in invitations
1. Use the methods that you prefer to create an answer file for an unattended installation.
For more information about unattended and remote installation, see Appendix A:
Resources for Learning About Automated Installation and Deployment for
126
2. Confirm that your answer file includes the following line:
<CreateEncryptedOnlyTickets>true</CreateEncryptedOnlyTickets>
To use an answer file to disable solicited Remote Assistance

1. Use the methods that you prefer to create an answer file for an unattended installation or
remote installation. For more information about unattended and remote installation, see
Appendix A: Resources for Learning About Automated Installation and Deployment for
2. To disable Solicited Remote Assistance, confirm that your answer file includes the
following line:
<fAllowToGetHelp>false</fAllowToGetHelp>
 If you want to avoid opening port 135 in Windows Firewall for Offer Remote Assistance, you
can instead use Group Policy to allow authenticated traffic that is protected by IPSec to
bypass Windows Firewall. For more information, see How to Enable Authenticated Firewall
Bypass on the Microsoft Web site.
 For information about deploying and using Remote Assistance, see the following printed
reference:
Tulloch, M., et al. Windows 7 Resource Kit. Redmond, WA: Microsoft Press, 2009.
 If you want to allow users to use instant messaging to invite Remote Assistance (Solicited
Remote Assistance), you might want to read information about Windows Live Messenger, the
Rendezvous API, Windows Firewall, and Teredo (an IPv6 technology). Teredo is used for
communicating with computers where network address translation (NAT) is used. The
following links on the Microsoft Web site provide more information:
 Microsoft Windows Live Messenger Essentials
 Remote Assistance and Rendezvous API
 Windows Firewall
 Using IPv6 and Teredo
 For additional links to information about IPv6, see Internet Protocol Version 6, Teredo,
and Related Technologies in Windows 7 and Windows Server 2008 R2 in this document.
127
SmartScreen Filter and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of SmartScreen Filter in Internet Explorer 8
Overview: Using SmartScreen Filter in a managed environment
How SmartScreen Filter communicates with a site on the Internet
Controlling SmartScreen Filter to limit the flow of information to and from the Internet
This section explains how SmartScreen® Filter in Internet Explorer® 8 communicates across the
Internet, and it explains steps to take to limit, control, or prevent that communication in an
organization with many users.
For more information about Internet Explorer 8, see Internet Explorer 8 and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2 in this document.
Benefits and purposes of SmartScreen Filter in

Internet Explorer 8
Internet Explorer 8 includes Microsoft® SmartScreen Filter to help protect against malicious Web
sites that host phishing attacks and malware. SmartScreen Filter operates in the background
when the browser is running, and it provides an early warning system to notify users of suspicious
Web sites that could be engaging in phishing attacks or distributing malware through a socially
engineered attack.
Note
SmartScreen Filter is one of the multiple layers of defense in the antiphishing and
malware protection strategies developed by Microsoft. For more information, see What is
SmartScreen Filter? on the Microsoft Web site.
Important
SmartScreen Filter expands on the defenses that were provided by Phishing Filter
(introduced in Internet Explorer 7). It includes the following features, which are described
in this document: anti-malware support, prevention of cross-site scripting, new heuristics
and enhanced telemetry, an improved user interface, and improved support for Group
Policy settings.
The following list describes the enhancements that SmartScreen Filter provides compared to
Phishing Filter:
128
 Anti-malware support. The SmartScreen Filter helps block sites that are known to distribute
malicious software through socially engineered attacks. The anti-malware feature in
SmartScreen Filter is URL-reputation-based, which means that it evaluates the servers that
are hosting downloads to determine whether those servers are known to distribute host
unsafe content. The reputation-based analysis in SmartScreen Filter works with signature-
based anti-malware technologies, such as the Malicious Software Removal Tool, Microsoft
Security Essentials, and Windows® Defender to protect against malicious software.
 New heuristics and enhanced telemetry. New heuristics combined with enhanced
telemetry allow SmartScreen to identify and block malicious sites more quickly.
 Improved Group Policy support. Group Policy can be used to enable or disable the
SmartScreen Filter for Internet Explorer users across an entire Windows domain. A new
Group Policy option is available that allows domain administrators to prevent users from
overriding SmartScreen Filter block screens. When these Group Policy restrictions are
enabled, the option to ignore the SmartScreen warning is removed from the blocking pages
and the dialog box that appears for downloads. For more information, see To Control
SmartScreen Filter by Using Group Policy later in this document.
 Improved user interface. SmartScreen Filter is included as one of the options that users can
enable the first time they run Internet Explorer 8. After users begin to use Internet Explorer 8,
they can enable or disable SmartScreen Filter by selecting the SmartScreen Filter option on
the Safety drop-down menu on the default Command Bar. This menu includes many of the
security and privacy-related features that users can configure in Internet Explorer 8. Selecting
SmartScreen Filter also offers the following options: Check This Website and Report
Unsafe Website. When SmartScreen is enabled, if users navigate to a Web site that is
known or suspected to be unsafe, the blocking page provides a link to their home page so
that they can immediately return to a trusted Web site.
Overview: Using SmartScreen Filter in a managed

environment
In a managed environment, you can use Group Policy to control SmartScreen Filter in a variety of
ways, including the following:
 Turn on SmartScreen Filter so that it runs automatically on all computers that are running
Internet Explorer 8.
 Block users from overriding or clicking through SmartScreen Filter warnings.
 Turn off SmartScreen Filter.
For details about the preceding options, see Controlling SmartScreen Filter to Limit the Flow of
Information to and from the Internet later in this section.
129
How SmartScreen Filter communicates with a
Web service on the Internet
This subsection describes how SmartScreen Filter might communicate with a site on the Internet
as it evaluates a Web site URL that you are trying to reach.
 Default settings: By default, SmartScreen Filter is disabled unless the feature is enabled by
the user or through a Group Policy setting. Users can manually check the reputation for an
individual site using the Safety menu.
 Triggers: When the user visits an Internet Web site, the URL of the site is compared to an
―allowed sites‖ list that is built into SmartScreen Filter. If the URL matches a site on the list,
no further reputation checks occur.
If the URL does not match a site on the list, and SmartScreen Filter is enabled, SmartScreen
Filter sends an inquiry to the Microsoft URL Reputation Service. If the URL Reputation
Service detects that a URL is a known malicious site, the site is blocked, which helps prevent
the user from entering personal information or downloading malware.
 Specific information sent: The following information is sent over an encrypted (HTTPS)
connection to the URL Reputation Web Service:
 URL: The full request URL is included. However, if the Internet URL is listed as legitimate
on the ―allowed sites‖ list, SmartScreen Filter takes no action and nothing is sent.
 Detailed software version information: The browser version, the SmartScreen Filter
version, and the version of the ―allowed sites‖ list.
 Operating system version: The version of Windows that the browser is installed on.
 Language and locale setting for the browser: The language and locale for the browser
display, for example, English (United States).
 Anonymous statistics about how often SmartScreen Filter is triggered:
SmartScreen Filter tracks basic statistics, such as how often a warning is generated and
how often a query is made to the URL Reputation Service. This statistical information is
sent to Microsoft and used to analyze the performance and improve the quality of the
SmartScreen Filter.
For more information, see the Internet Explorer 8 Privacy Statement on the Microsoft
Web site.
 User notification: If SmartScreen Filter is enabled, you are not notified when SmartScreen
Filter performs a check, but you are notified if SmartScreen Filter detects a known or
suspicious phishing site.
 Logging: By default, SmartScreen Filter does not log events. However, if you use the
Application Compatibility Toolkit to enable logging for application compatibility events,
SmartScreen Filter logs an event when a Web site is blocked or has suspicious
characteristics.
For information, see Microsoft Application Compatibility Toolkit 5.0.
130
 Encryption: All information sent to the URL Reputation Service is encrypted using the
HTTPS protocol.
 Access: The teams that maintain SmartScreen Filter and the URL Reputation Service have
access to the data that is sent to the URL Reputation Service (including the anonymous
statistics described earlier in this list).
 Privacy: URLs that are collected may unintentionally contain personal information
(depending on the design of the Web site being visited). Like the other information that is sent
to Microsoft, this information is not used to identify, contact, or target advertising to users. In
addition, Microsoft filters address strings to remove personal information where possible. For
more information, see the Internet Explorer 8 Privacy Statement on the Microsoft Web site.
 Transmission protocol and port: The transmission protocol for any information that is
transmitted to the URL Reputation Service is HTTPS, and the port is 443.
 Ability to disable: SmartScreen Filter can be disabled through the Windows 7 or Windows
Server® 2008 R2 interface or through Group Policy. For more information, see Additional
references later in this section.
Controlling SmartScreen Filter to limit the flow of

This subsection provides information about how to control settings for SmartScreen Filter.
To control SmartScreen Filter on a computer running Windows Server 2008 R2

1. On the computer on which you want to control SmartScreen Filter, in Internet Explorer,
click Safety, point to SmartScreen Filter, and then click Turn on SmartScreen Filter or
Turn off SmartScreen Filter. A dialog box appears that restates these options with
additional text that explains the value of using Smart Screen Filter and the risks of not
using SmartScreen Filter.
2. Accept the selected option or a different option, and then click OK.
To control whether SmartScreen Filter is turned on for trusted sites in Internet

Explorer 8 on a computer running Windows 7 or Windows Server 2008 R2
1. On the computer on which you want to control SmartScreen Filter, in Internet Explorer,
click Tools, click Internet Options, and then click the Security tab.
2. Select Trusted sites.
3. Under Security level for this zone, click Custom Level, and then scroll down to Use
SmartScreen Filter (more than halfway down the list).
4. Choose the setting that you want to use for Trusted sites (Enable or Disable).
Note
Internet Explorer Enhanced Security Configuration is a feature in Windows
131
Server 2008 R2. If Internet Explorer Enhanced Security Configuration is
enabled on a server running Windows Server 2008 R2, SmartScreen Filter is
turned on for Trusted Sites. If you want to change this setting, you must first
turn off Internet Explorer Enhanced Security Configuration in the Security
Information section of Server Manager. For more information, see Internet
Explorer 8 and Resulting Internet Communication in Windows 7 and
To Control SmartScreen Filter by using Group Policy

1. Using an account with domain administrative credentials, log on to a computer running
Windows Server 2008 R2 (with the Group Policy Management feature installed) or
Windows 7. Then open the Group Policy Management Console (GPMC) by running
gpmc.msc, and edit an appropriate Group Policy object (GPO).
Note
You must perform this procedure by using GPMC on a computer running
Windows Server 2008 R2 or Windows 7. For information about using Group
Policy, see Appendix B: Resources for Learning About Group Policy for
Configuration.
3. Expand Policies (if present), expand Administrative Templates, expand Windows
Components, and then click Internet Explorer.
4. In the details pane, double-click Turn off Managing SmartScreen filter. Click Enabled,
which means that users cannot control SmartScreen Filter settings, and then choose a
setting for Select SmartScreen filter mode:
 On: Automatic SmartScreen Filter is always turned on in Security Zones for which the
feature is Enabled.
 Off: SmartScreen Filter does not automatically perform reputation checks. Users can
manually trigger a check by using the Safety menu.
Note
Disabling this Group Policy setting (Turn off Managing SmartScreen filter)
does not disable SmartScreen Filter. Users can control SmartScreen Filter
settings on a local computer that is running Windows Server 2008 R2.
 What is SmartScreen Filter?
132
 Internet Explorer 8 and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 (in this document)
 Windows 7: Security and Protection
 Secure Windows Server 2008 R2
 Internet Explorer 8 Privacy Statement
133
Windows Customer Experience Improvement
Program and Resulting Internet
Server 2008 R2
In this section
Purposes of the Windows Customer Experience Improvement Program
Overview: Using the Windows Customer Experience Improvement Program in a managed
environment
How the Windows Customer Experience Improvement Program Communicates with a site on the
Internet
Procedures for controlling the Windows Customer Experience Improvement Program
This section describes how the Windows® Customer Experience Improvement Program
communicates across the Internet, and it explains steps to take to limit, control, or prevent that
Purposes of the Windows Customer Experience

Improvement Program
The Windows Customer Experience Improvement Program (CEIP) in Windows 7 and Windows
Server® 2008 R2 is a voluntary program that collects information about how people use
Windows 7 and Windows Server 2008 R2. It collects details about the problems that people
encounter without interrupting the users in their tasks at the computer. The information that is
collected helps Microsoft® improve the features that are used most often in Windows 7 and
Windows Server 2008 R2 and create solutions to common problems.
Overview: Using the Windows Customer

Experience Improvement Program in a managed
environment
In a managed environment, the Windows Customer Experience Improvement Program runs only
if an administrator chooses to participate. You might decide to disable the program on all
computers running Windows 7 and Windows Server 2008 R2. You can do this by using Group
Policy or by using an answer file with an unattended installation. You can also use Group Policy
to redirect data from the Windows Customer Experience Improvement Program to a server on
your network running System Center Operations Manager 2007 or similar software that is
designed to collect data from the Windows Customer Experience Program. For more information,
134
see Procedures for controlling the Windows Customer Experience Improvement Program later in
this section.
Note
You can also view or change the setting for the Windows Customer Experience
Improvement Program on an individual computer running Windows 7 or Windows
Server 2008 R2.
How the Windows Customer Experience

Improvement Program communicates with a site
on the Internet
The Windows Customer Experience Improvement Program communicates with a site on the
Internet as follows:
 Specific information sent: The information that is sent includes details about the computer
hardware configuration (such as the number of processors and screen resolution),
performance and reliability (such as how quickly a program responds when you click a
button), and information about use of the system (such as how many folders a user typically
creates on the desktop). It also includes information about the use of features in Windows 7
and Windows Server 2008 R2 (such as Event Viewer and Remote Assistance). For additional
details, see the link to the privacy statement later in this list.
 Default setting: By default, the Windows Customer Experience Improvement Program is
turned off.
When Windows 7 and Windows Server 2008 R2 are installed and the computer is started for
the first time, the Initial Configuration Tasks interface appears, displaying a variety of tasks
including Enable automatic updating and feedback. In this task, you can choose to enable
the default level of automatic updating and feedback, or you can manually configure settings.
If you enable automatic updating and feedback, you turn on the Customer Experience
Improvement Program. If you manually configure settings, you can choose whether to turn on
the program. In Windows Server 2008 R2 you also have the option to provide information
about your organization, such as the approximate number of servers your organization has
worldwide.
Note
In Windows 7, accepting the default recommendations for Initial Configuration
Tasks also turns on the Customer Experience Improvement Program.
 Triggers: Data for the Windows Customer Experience Improvement Program is collected
over time and sent periodically. However, data is not collected or sent if the server is on
battery power, and no attempt to send data is made if the server is not connected to a
network.
135
 User notification: After an administrator chooses to participate in the program, there are no
notifications. You are not prompted or interrupted in any way when data is collected or sent.
 Logging: Events are logged in Event Viewer in Windows Logs\Application.
 Encryption: The data about software usage is encrypted during transmission by using
HTTPS (that is, Secure Sockets Layer (SSL) or Transport Layer Security (TLS) with HTTP).
 Access and privacy: Data from the Windows Customer Experience Improvement Program
is stored on servers in Microsoft-controlled facilities. Microsoft uses the data to identify trends
and usage patterns in Microsoft software and to improve Microsoft products and services. For
additional information, see the Privacy Statement for the Microsoft Customer Experience
Improvement Program.
 Transmission protocol and port: The transmission protocol is HTTPS and the port is 443.
 Ability to disable: You can disable the Windows Customer Experience Improvement
Program on an individual computer running Windows Server 2008 R2 by using Initial
Configuration Tasks or Server Manager. You can also disable it by using Group Policy, an
answer file with an unattended installation, and on an individual computer by using the
procedure described later in this section.
Procedures for controlling the Windows Customer

Experience Improvement Program
 View or change the Windows CEIP setting on an individual computer.
 Disable the Windows Customer Experience Improvement Program by using Group Policy.
 Disable the Windows Customer Experience Improvement Program by using an answer file
with unattended installation.
 Redirect data from the Windows Customer Experience Improvement Program to a server on
your network running System Center Operations Manager or similar software designed to
collect data from the Windows Customer Experience Program.
Note
To change Windows Customer Experience Improvement Program settings, you must be
logged on as an administrator.
To view or change the Windows CEIP setting on a computer running Windows 7

1. Click Start, select Control Panel, and click the Action Center.
2. In the left pane, click Change Action Center settings.
3. Under Related settings, click Customer Experience Improvement Program settings.
4. If you want to turn off the Windows CEIP, select No, I don't want to participate in the
program, and then click Save Changes.
136
Following are two procedures that you can use to view or change the Windows CEIP setting on a
computer running Windows Server 2008 R2:
 Use Initial Configuration Tasks. (Use this procedure if you recently installed Windows
Server 2008 R2, and the Initial Configuration Tasks interface is displayed.)
 Use Server Manager.
To view or change the Windows CEIP setting on a server running Windows

Server 2008 R2 by using Initial Configuration Tasks
1. Under Update This Server, click Enable automatic updating and feedback.
2. Click Manually configure settings.
3. Under Customer Experience Improvement Program, click Change Setting.
4. In the resulting dialog box, view or change the settings.
To view or change the Windows CEIP setting on a server running Windows

Server 2008 R2 by using Server Manager
2. In Server Manager, make sure Resources and Support is expanded.
3. Click Participate in CEIP or Configure CEIP—whichever is currently displayed.
Following are two procedures that you can use to disable the Windows Customer Experience
Improvement Program on a computer running Windows Server 2008 R2 (with the Group Policy
Management feature installed) or in Windows 7:
 Use Group Policy.
 Use an answer file with an unattended installation.
To disable the Windows Customer Experience Improvement Program by using Group

Policy
137
3. In the details pane, double-click Turn off Windows Customer Experience
Improvement Program, and then click Enabled.
When you enable this setting, all administrators and users to which the Group Policy
object applies are opted out of the Windows Customer Experience Improvement
Program.
the Restrict Internet communication policy setting, which is located in Computer
Configuration under Policies (if present), in Administrative
Templates\System\Internet Communication Management. For more information about
this Group Policy and the policies that it controls, see Appendix C: Group Policy Settings
Listed Under the Internet Communication Management Category in Windows 7 and
To disable the Windows Customer Experience Improvement Program by using an

answer file with an unattended installation
1. Using the methods you prefer for an unattended installation or a remote installation,
create an answer file. For more information about unattended and remote installations,
for Windows 7 and Windows Server 2008 R2.
2. Confirm that your answer file includes the following line:
<CEIPEnabled>0</CEIPEnabled>
To redirect data from the Windows Customer Experience Improvement Program to a

server on your network
1. Make sure that the server to which you want to redirect data is running System Center
Operations Manager 2007 or similar software that is designed to collect data from the
Windows Customer Experience Improvement Program. For information, see System
Center Operations Manager on the Microsoft Web site.
Note
You must perform this procedure by using GPMC on a computer running Windows
Server 2008 R2 or Windows 7.
Templates, expand Windows Components, and then click Windows Customer
138
4. In the details pane, double-click Allow Corporate redirection of Customer Experience
Improvement uploads, click Enabled, and then for Corporate SQM URL, specify the
URL of the server that the data should be redirected to.
139
Windows Defender and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Windows Defender and the online Microsoft SpyNet community
Overview: Using Windows Defender and information from the Microsoft SpyNet community in a
managed environment
How Windows Defender communicates with Internet sites (without Microsoft SpyNet
membership)
How Windows Defender communicates with Internet sites when combined with Microsoft SpyNet
Procedures for configuring Windows Defender
This section discusses how Windows® Defender in Windows 7 and Windows
Server® 2008 R2communicates across the Internet, and it explains steps to take to limit, control,
Benefits and purposes of Windows Defender and

the online Microsoft SpyNet community
Windows Defender
With Windows Defender, users can be alerted when spyware or potentially unwanted software
attempts to install or run on their computers. Windows Defender also alerts users when programs
attempt to change important Windows settings.
When Windows 7 is installed and the computer is started for the first time, prompts appear to help
the user enable various recommended features, including Windows Defender.
Note
On systems running Windows Server 2008 R2, Windows Defender is installed as part of
the Desktop Experience Feature set.
With Windows Defender, users can schedule scans on a regular basis, and they can be alerted to
harmful software that is detected or removed during the scan.
Windows Defender receives updates to respond to evolving malicious and unwanted software. It
is designed to be automatically updated by using the Windows Update service. It can also be
updated from a WSUS server in an environment with Windows Server Update Services (WSUS).
The following list briefly describes how Windows Defender obtains updates:
140
 If Windows Defender is enabled, by default it checks for software updates and updated
definitions (of spyware and other unwanted software) before each scheduled scan. It checks
for these updates on the Windows Update service (or in an environment with WSUS, it
checks a WSUS server). This check for updates helps ensure that Windows Defender uses
the latest available software and definitions when scanning.
Important
The first time that a user contacts a Windows Update Web server, the user
receives a message that prompts the Windows Genuine Advantage validation
process. The user is prompted to download an ActiveX® control that checks the
authenticity of the Windows software. If the validation is successful, a special
license file is stored on the computer for future verification. This ActiveX control is
downloaded the first time the software is validated and when a new version is
available from Microsoft®. The Windows Genuine Advantage validation process
does not collect any information that can be used by Microsoft to identify or
contact the user. If the computer fails the Windows Genuine Advantage
validation process, some updates (including Windows Defender updates) are not
downloaded or installed during the Windows Update process. Other security
updates are not part of Windows Genuine Advantage, and they are available for
download and installation even if this validation fails. For more information, see
Genuine Windows in the Enterprise on the Microsoft Web site.
Scheduled scans occur daily by default, so these checks for software updates also occur
daily by default.
 Through commands on the Help menu, the user can request that Windows Defender check
immediately for updated definitions. (Users can also view a Web-based privacy statement.)
For more details about how Windows Defender checks for software updates, see How Windows
Defender communicates with Internet sites (without Microsoft SpyNet Membership) later in this
section.
The online Microsoft SpyNet community

The online Microsoft® SpyNet community is designed to help Microsoft continually update and
improve definitions of spyware and other potentially unwanted software and to help Microsoft
improve Windows Defender and related technologies.
New types and versions of potentially unwanted software are emerging regularly, so SpyNet
ratings help Microsoft researchers discover new threats more rapidly and determine which
software to investigate. For example, if many people remove software that has not yet been
classified, Microsoft will analyze that software to see if it should be included in future definitions.
Joining the online Microsoft SpyNet community is optional but recommended. When the computer
is first started after installing Windows 7, or after installing the Desktop Experience features on
Windows Server 2008 R2, prompts appear that recommend steps that can help protect the
computer. These include joining the online Microsoft SpyNet community.
141
Overview: Using Windows Defender and
information from the Microsoft SpyNet community
in a managed environment
In a managed environment, Windows Defender can help prevent potentially unwanted software
from causing problems and help keep it off of users' computers. Membership in the online
Microsoft SpyNet community can provide additional information that might be useful when you
are making decisions about questionable software.
However, you might choose solutions other than Windows Defender for defending against
potentially unwanted software. There are a variety of ways to control Windows Defender,
including the following:
 Prevent users from running Windows Defender by using a Group Policy setting.
 Use Windows Defender and set up WSUS in your environment, which will cause Windows
Defender to check your WSUS servers for updates. To ensure that Windows Defender uses
the latest definitions when scanning, if the WSUS servers are unavailable, Windows
Defender checks the Windows Update Web site for updates.
For more information, see Windows Server Update Services.
 Limit access to resources such as the online Microsoft SpyNet community by allowing only
designated people to become members. You can prevent users from joining Microsoft
SpyNet by using a Group Policy setting.
How Windows Defender communicates with

Internet sites (without Microsoft SpyNet
membership)
The following list describes how Windows Defender communicates with sites on the Internet
when users do not have membership in the online Microsoft SpyNet community. (Communication
that results with Basic or Advanced membership in the online Microsoft SpyNet community is
described in the next section.)
When enabled by itself, Windows Defender communicates with sites on the Internet as follows:
 Specific information sent or received: The following list describes the information that is
received in specific situations:
 Each time Windows Defender performs a scheduled scan (if there is a connection to
the Internet). By default Windows Defender checks the Windows Update Web site for
software updates and updated definitions. This is the same process that is used to check
for updates for other operating system features, which means that the information sent
includes the version of the current set of definitions. If updates are available, they are
downloaded by Windows Defender.
142
For more information, see Windows Update and Resulting Internet Communication in
Windows 7 and Windows Server 2008 R2 in this document.
 When the user clicks Help options and then clicks Check for updates. Windows
Defender performs the same check described in the previous item.
 When the user clicks Help options and then clicks View Privacy Statement Online.
The following privacy statement is displayed:
Windows Defender Privacy Statement
 Default settings: If Windows Defender is enabled, by default it scans the computer daily.
(Prompts recommending that Windows Defender be enabled are displayed the first time the
computer is started after setup.)
 Triggers: When Windows Defender performs a scheduled scan, by default it also searches
the Windows Update Web servers for the latest definition file. To cause Windows Defender to
check immediately for updates or display the privacy statement online, the user must click the
Help options that are offered.
 User notification: When a scan is in progress and the Windows Defender interface is open,
status about the scan is displayed. Also when a scan is in progress, the user can click the
Windows Defender icon in the notification area to view status.
 Logging: Windows Defender logs the following types of information on the local computer:
 Events are logged in Event Viewer in the System log.
 Update failures are logged to systemroot\Temp\Mpsigstub.log.
 Actions taken to protect against spyware or potentially unwanted software are logged in
the same location as other events for that software.
 Encryption: Windows Defender uses the same encryption methods as Windows Update,
which means initial data is transferred using HTTPS, and updates are transferred using
HTTP.
 Access: The Microsoft staff maintains the functionality of the Windows Update Web servers,
and as part of maintaining the servers, they monitor the version information that Windows
Defender sends when it checks for updates.
 Privacy: To view the privacy statement, see Windows Defender Privacy Statement.
 Transmission protocol and port: Windows Defender uses the same transmission protocols
and ports as Windows Update: HTTP with port 80 and HTTPS with port 443.
 Ability to disable: You can disable Windows Defender through Control Panel or Group
Policy.
143
How Windows Defender communicates with
Internet sites when combined with Microsoft
SpyNet
The following list describes communication that results from using Windows Defender with
membership in the online Microsoft SpyNet community. When a user has joined the online
Microsoft SpyNet community, Windows Defender communicates with sites on the Internet as
follows:
 Specific information sent or received: The following list describes the information that is
sent with different levels of membership in Microsoft SpyNet. The information is sent
whenever Windows Defender detects software that has not been analyzed for risks:
 For Basic members: The report that is sent by Windows Defender to the Microsoft
SpyNet Web site includes the following information:
About the computer: A randomly generated, globally unique identifier (GUID) that is
used to uniquely identify the computers of Microsoft SpyNet members as they
communicate with the Microsoft SpyNet Web site. (Windows Defender creates the GUID
unless the operating system was upgraded from Windows XP, in which case the GUID
might have been created previously by the Microsoft Malicious Software Removal Tool
running on Windows XP.) This GUID does not contain any personal information.
Information collected also includes the operating system name and version (including any
service packs that have been applied), the Web browser software and version, and
identifiers for the country or region and locale. In addition, the report might contain
information related to the possible presence of spyware or other potentially unwanted
software—for example, information about registry key entries that control actions such as
automatically starting an application when the system starts.
About the software in question: This information includes file name, size, date stamps,
and where applicable, vendor and cryptographic hashes. In addition, full URLs can be
collected that indicate the origin of the file. Defender attempts to filter out personal
information in the URL and fil paths for basic members. The report can also include the
action that the user chose to take when the program was detected (Block or Allow).
Note
The user's membership in Microsoft SpyNet means that the user might
sometimes see a pop-up request for a Sample Submission report. This report
requests specific files that Microsoft suspects might be potentially unwanted
software on a computer, and they are used for further analysis. The report is
sent only if the user consents.
 For Advanced members: The report that is sent to the Microsoft SpyNet Web site
includes the information that is sent with a Basic membership, plus additional details
about the software in question including file paths and partial memory dumps (rarely).
These file paths and partial memory dumps might unintentionally contain personal
144
information. To the extent any personal information is included in a report, the information
is not used to identify a user or contact a user.
Note
The user's membership in Microsoft SpyNet means that the user might
sometimes see a pop-up request for a Sample Submission report. This report
requests specific files that Microsoft suspects might be potentially unwanted
software on a computer, and are used for further analysis. The report is sent
only if the user consents.
 Default settings: If a person opts-in to Microsoft SpyNet during the Windows Defender
configuration process, the membership is a Basic membership by default.
 Triggers: When Windows Defender detects software that has not been analyzed for risks
(software not previously categorized in the Windows Defender definition file) and the user is a
member of Microsoft SpyNet, Windows Defender sends a report about the software in
question.
 User notification: For Basic Microsoft SpyNet members, the user notification is the same as
for anyone using Windows Defender. For more information, see How Windows Defender
communicates with Internet sites (without Microsoft SpyNet Membership) earlier in this
section.
For Advanced Microsoft SpyNet members, if software is present that has not yet been
classified for risk, and it attempts to change computer settings, a prompt asks whether to
allow or block the change. (For users who are Basic Microsoft SpyNet members, such
software is not blocked.)
 Logging: Logging for Windows Defender does not change when the user is a Microsoft
SpyNet member. For more information, see How Windows Defender communicates with
Internet sites (without Microsoft SpyNet Membership) earlier in this section.
 Encryption: Windows Defender uses Secure Sockets Layer (SSL) to encrypt the information
that it sends to Microsoft SpyNet.
 Access: Microsoft SpyNet reports are used to improve Microsoft software and services. The
reports may also be used for statistical or other testing or analytical purposes, trending, and
signature generation. Only Microsoft employees, contractors, and vendors who have a
business need to use the reports are provided access to them.
 Privacy: To view the privacy statement, which covers Microsoft SpyNet, see Windows
Defender Privacy Statement.
 Transmission protocol and port: When Windows Defender sends information to Microsoft
SpyNet, it uses HTTPS with port 443.
 Ability to disable: A user can decline or end membership in Microsoft SpyNet from an
individual computer running Windows 7 or Windows Server 2008 R2, and an administrator
can prevent users from being members by using a Group Policy setting.
145
Procedures for configuring Windows Defender
This subsection provides procedures for:
 Viewing or changing Windows Defender settings, including Microsoft SpyNet settings, on a
computer running Windows 7 or Windows Server 2008 R2.
 Disabling Windows Defender by using Group Policy.
 Preventing Microsoft SpyNet membership by using Group Policy.
To view or change Windows Defender and Microsoft SpyNet settings on a computer

1. Click Start, then click Control Panel. In the Search text box, type Defender, then click
Windows Defender.
2. Click Tools, and then click Options.
3. View or change the settings, and then click Cancel or Save.
4. With the Tools and Settings interface still displayed, click Microsoft SpyNet.
5. View or change the settings, and then click Cancel or Save.
To disable Windows Defender by using Group Policy

with domain administrative credentials, log on to a computer running Windows 7 or
Windows Server 2008 R2, open Group Policy Management Console (GPMC) by running
gpmc.msc, and then edit an appropriate Group Policy object (GPO).
2. Expand Computer Configuration, expand Administrative Templates, expand
Windows Components, and then click Windows Defender.
3. In the details pane, double-click Turn off Windows Defender, and then click Enabled.
Note
If this Group Policy setting is enabled, the user can still click the command to
open Windows Defender. However, Windows Defender displays a pop-up
window that says it is turned off by Group Policy.
To prevent Windows SpyNet membership by using Group Policy

Windows Server 2008 R2, open Group Policy Management Console by running
gpmc.msc, and then edit an appropriate GPO.
Windows Components, and then click Windows Defender.
146
3. In the details pane, double-click Configure Microsoft SpyNet Reporting, click Enabled,
and then click No Membership.
Important
To prevent Microsoft SpyNet reporting, do not disable this setting. You can
only block SpyNet reporting by enabling this setting and then choosing No
Membership.
For more information, see the following Microsoft Web sites:
 Windows 7: Security and Protection
 Security and Protection for Windows Server 2008 R2
147
Windows Error Reporting and the Problem
Reports and Solutions Feature in Windows 7
In this section
Benefits and purposes of Windows Error Reporting and the Problem Reports and Solutions
feature
Overview: Using Windows Error Reporting and the Problem Reports and Solutions feature in a
managed environment
How Windows Error Reporting communicates with an Internet site
Controlling Windows Error Reporting to prevent the flow of information to and from the Internet
Procedures for configuring Windows Error Reporting
This section explains how the Windows® Error Reporting and the Problem Reports and Solutions
feature in Windows 7 and Windows Server® 2008 R2 communicate across the Internet, and it
explains steps to take to limit, control, or prevent that communication in an organization with
many users.
Note
The Problem Reports and Solutions feature in Action Center is an interface that displays
information from Windows Error Reporting and communicates with the Internet only
through Windows Error Reporting.
Benefits and purposes of Windows Error

Reporting and the Problem Reports and Solutions
feature
In Windows 7 and Windows Server 2008 R2, Windows Error Reporting and the Problem Reports
and Solutions feature work together to make it easy to find solutions online for computer
problems:
 Windows Error Reporting: Windows Error Reporting in Windows 7 and Windows
Server 2008 R2 is a feature that allows Microsoft® to track and address errors that are
relating to the operating system, Windows features, and applications. Windows Error
Reporting gives you, the administrator, the opportunity to send data about errors to Microsoft
and to receive information about solutions.
Solution information can include instructions for working around a problem, or a link to the
Windows Update Web site or another Web site for updated drivers, patches, or Microsoft
Knowledge Base articles. Microsoft developers can use Windows Error Reporting as a
148
problem-solving tool to address customer problems in a timely manner and to improve the
quality of Microsoft products.
 Problem Reports and Solutions: The Problem Reports and Solutions feature in Action
Center helps you track problem reports and solution information that you have received from
Microsoft. Action Center helps you store the solution information, which is displayed by using
a Web browser. However, all Internet communication that is related to the problem reports
and solutions is handled by Windows Error Reporting.
Consent levels in Windows Error Reporting

In Windows 7 and Windows Server 2008 R2, Windows Error Reporting has the following consent
levels to help you control how Windows Error Reporting prompts you before sending data:
 Automatically check for solutions (recommended). Windows Error Reporting sends the
minimum data required to check for an existing solution, for example, the application name
and version, module name and version, and exception code. After sending this data,
Windows Error Reporting prompts you for consent before sending any additional data that is
needed to solve the problem.
 Automatically check for solutions and send additional report data, if needed. Windows
Error Reporting automatically checks for solutions and sends additional information that is
needed to solve the problem (typically, the user is not prompted)
 Each time a problem occurs, ask me before checking for solutions. Windows Error
Reporting always prompts for consent before sending an error report.
 Never check for solutions (not recommended). This setting disables Windows Error
Reporting.
 Send all data (Group Policy setting only). This setting can only be configured through
Group Policy, not through the Initial Configuration Tasks interface, Server Manager, or
Control Panel. Any data requested by Microsoft will be sent without prompts.
Options for controlling Windows Error Reporting on a computer

running Windows Server 2008 R2
If a prompt appears for someone who is logged on as an administrator, the person can choose to
report application and operating system errors. If a prompt appears for someone who is not
logged on as an administrator, the person can choose to report application errors plus errors for
operating system software that does not require administrative credentials to run.
Error reporting can be controlled through the Initial Configuration Tasks interface or Server
Manager, as outlined in Consent levels in Windows Error Reporting earlier in this section. It can
also be controlled in Control Panel\Problem Reports and Solutions\Change
settings\Advanced settings. In Control Panel, an administrator can modify the settings as
follows:
 Enable or disable Windows Error Reporting for everyone using the computer or for a specific
person using the computer.
149
 Set the consent level (described earlier) for Windows Error Reporting for everyone using the
computer or for a specific person using the computer.
 Specify programs for which error reports should never be sent.
Overview: Using Windows Error Reporting and

the Problem Reports and Solutions feature in a
managed environment
In a managed environment, you can choose to disable Windows Error Reporting or control it as
follows:
 You can use Group Policy or an answer file for an unattended installation to control the
consent level (described earlier) to determine the amount of prompting that users or
administrators see before information about a software problem is sent to Microsoft. For
example, you can set the consent level so the person using the computer is always prompted
before information is sent.
 You can use Group Policy to disable Windows Error Reporting.
 You can redirect error reports to a server on your intranet by using the Group Policy setting,
Configure Corporate Windows Error Reporting.
To fully manage error reporting on a local server, you need to purchase software and software
services for analyzing the errors that you capture on your servers. Based on your policies and the
data in the error reports, you can filter the reports before they are sent to Microsoft. Such
software is also useful to determine the types of problems users and administrators are
experiencing most often.
For more information about Microsoft software designed for use with the Group Policy setting,
Configure Corporate Windows Error Reporting, see System Center Operations Manager on
the Microsoft Web site.
For more information about the underlying functionality that redirects error reports to a server on
your intranet, see WER Settings on the MSDN® Web site.
For more information about the answer-file entries or Group Policy settings described in this
subsection, see Controlling Windows Error Reporting to prevent the flow of information to and
from the Internet later in this section.
How Windows Error Reporting communicates

with an Internet site
The data that Microsoft collects through Windows Error Reporting is used strictly for the purpose
of tracking and solving problems that users and administrators are experiencing. This subsection
describes various aspects of the data that is sent to and from the Internet during error reporting,
and how the exchange of information takes place. The next subsection provides additional
details.
150
 Specific information sent or received: In most cases, the information that is collected for
an error report only includes software parameters, which include such information as the
application name and version, module name and version, and exception code. In unusual
cases, a more complete crash report might be collected. Rarely, some information that is
unique to the person who is using the computer might be collected unintentionally. This
information, if present, is not used to identify the person.
Microsoft may send solution information back to the user or administrator about a problem,
including links to Web sites.
 Default settings: By default, error reporting is enabled on computers running Windows 7 and
Windows Server 2008 R2. However, additional configuration steps are needed to configure
error reporting, and no reports are sent unless these steps are completed.
When Windows 7 and Windows Server 2008 R2 are installed and a computer is started for
the first time, the Initial Configuration Tasks interface appears, which displays a variety of
tasks including Enable automatic updating and feedback. In this task, you can choose to
enable a default level of automatic updating and feedback (which includes error reporting), or
you can manually configure settings. For details about consent levels, see Consent levels in
Windows Error Reporting earlier in this section.
 Triggers: The opportunity to send an error report is triggered by application or system errors.
 User notification: User notification depends on the consent level. See Consent levels in
Windows Error Reporting earlier in this section.
Windows 7 and Windows Server 2008 R2 provide reminders (in the form of balloon
notifications) to check for solutions to reports that have not been sent, for example, reports
that were generated in the background or while you were offline.
 Logging: Descriptions of system and application errors are recorded in the event log. In
addition, the Problem Reports and Solutions feature records information about problem
reports sent and solution information received on that computer, so that the user or
administrator can investigate solutions later (although new solutions might overwrite old
solutions if the number of stored solutions exceeds the allowed maximum).
 Encryption: All report data that could include personal information is encrypted during
transmission using HTTPS, that is, Secure Sockets Layer (SSL) or Transport Layer Security
(TLS) with HTTP. The software parameters information, which includes such information as
the application name and version, module name and version, and exception code, is not
encrypted.
 Access: Microsoft employees and contingent staff may access the error reports to maintain
Windows Error Reporting or improve Microsoft products. They may not use the reports for
other purposes.
If the error report indicates that one or more non-Microsoft products were involved in causing
the problem, Microsoft may send the report to the respective companies if the companies
agree to abide by the terms of the privacy statement. Software or hardware developers
(employed by Microsoft or one of its partners) may analyze the fault data and try to identify
and correct the problem.
151
 Privacy: For more information, see Privacy Statement for the Microsoft Error Reporting
Service .
Details related to privacy of data are presented in Types of data collected later in this section.
 Transmission protocol and port: The transmission protocols are HTTP through port 80 and
HTTPS through port 443.
 Ability to disable: The feature can be disabled through Group Policy or on an individual
computer running Windows 7 or Windows Server 2008 R2. You can also control the feature
in other ways, as described in Overview: Using Windows Error Reporting and the Problem
Reports and Solutions feature in a managed environment earlier in this section, and
Controlling Windows Error Reporting to prevent the flow of information to and from the
Internet later in this section.
Types of data collected

This section provides an overview of the data that Windows Error Reporting collects and
information about data that might be collected from four different sources:
 Application errors
 Handwriting recognition errors
 Japanese Input Method Editor errors
 Windows kernel failures
Overview of the data that Windows Error Reporting collects

Windows Error Reporting collects information about the computer configuration, what the
software was doing when the problem occurred, and other information directly related to the
problem. Windows Error Reporting does not intentionally collect anyone’s name, address, e-mail
address, or computer name. It is possible that such information may be captured in memory or in
the data collected from open files, but Microsoft does not use it to identify users. Windows Error
Reporting collects Internet Protocol (IP) addresses, but the addresses are not used to identify
users, and in many cases, they are the address of a network address translation (NAT) computer
or proxy server, not a specific client behind that NAT computer or proxy server.
IP address information is used in aggregate by the operators who maintain the servers that
receive error reports.
In rare cases, such as problems that are especially difficult to solve, Microsoft may request
additional data, including sections of memory (which may include memory shared by any or all
applications that were running at the time the problem occurred), some registry settings, and one
or more files from your computer. When additional data is requested, you can review the data and
choose whether to send the information.
152
Data collected from application errors
Any application can be written in a way that uses the Error Reporting functionality. If an
application error occurs for which Error Reporting is available and you choose to send the report,
the information included is as follows:
 The digital product ID, which can be used to identify your license.
 Information regarding the condition of the computer and the application at the time the error
occurred. This includes data that is stored in memory and stacks, information about files in
the application's directory, the operating system version, and the computer hardware in use.
This information is packaged into a ―minidump‖ file (a small memory dump). The minidump
file contains:
 Exception information: This is information regarding the problem that occurred. It tells
Microsoft what kind of instruction the application received that caused it to generate an
error.
 System information: This is data about the kind of CPU you have and what operating
system you are running.
 A list of all the modules that are currently loaded and their version information.
 A list of all the threads that are currently running. For each thread, the current context
and the whole stack are collected.
 Global data.
The minidump data is shown as a hexadecimal representation that you cannot read.
Note
For more information, see Minidump Files on the MSDN Web site.
In Windows 7 and Windows Server 2008 R2, you can use a registry setting to configure Windows
Error Reporting so that it collects full user-mode dumps and stores them locally after a user-mode
application crashes. This configuration option in Windows Error Reporting does not involve
communication across the Internet.
For more information, see Collecting User-Mode Dumps on the Microsoft Web site.
Data collected from handwriting recognition errors

If you use the Tablet PC Input Panel and encounter a handwriting recognition error, you can start
the error reporting tool and then select recently corrected handwriting samples to send in an error
report. The samples are handled according to the consent level setting, and in most cases, they
are sent only when you explicitly consent. No personal information is intentionally collected;
however, the samples that are chosen may include personal information. This information will not
be used to personally identify you.
You can disable the reporting of handwriting recognition errors by using a specific Group Policy
setting, as described in Setting to disable reporting handwriting recognition errors later in this
section.
153
Data collected from the Japanese Input Method Editor
In the Japanese versions of Windows 7 and Windows Server 2008 R2, you can generate a "word
registration report" through the Japanese Input Method Editor (IME) and then choose to send the
report to Microsoft. The reports are like error reports, but they record a word or word pair to
improve the selection of the ideograms that are displayed. Word registration reports can include
the information you provide in the Add Word dialog box about the words being reported, and the
software version number for IME. Each time such a report is generated, you are asked whether to
send the report to Microsoft. You can view the information that is contained in the report before
you choose to send it.
Microsoft uses the information to help improve IME. Personal information might unintentionally be
collected, but Microsoft does not use the information to identify you or contact you. Word
registration reports are sent to Microsoft using HTTPS, that is, Secure Sockets Layer (SSL) or
Transport Layer Security (TLS) with HTTP.
If you configure Windows Error Reporting as described in Procedures to configure Windows Error
Reporting later in this section, you can control word registration reports in the same way that you
control error reports.
Data collected from Windows kernel failures

When a kernel-mode (system) error occurs, Windows 7 and Windows Server 2008 R2 display a
Stop message and write diagnostic information to a memory dump file. When someone restarts
the computer by using normal mode or Microsoft Windows Safe Mode (with networking), and then
logs on to Windows Server 2008 R2 as an administrator, Windows Error Reporting responds. As
with other errors, Windows Error Reporting uses the consent level setting to determine when to
prompt you before sending a kernel fault report.
Windows kernel fault reports contain information about what the operating system was doing
when the problem occurred. These event reports contain the minimum information that can help
identify why the operating system stopped unexpectedly. If you choose to send the report, it
includes the following:
 Operating system name (for example, Windows Server 2008 R2)
 Operating system version
 Operating system language as represented by the locale identifier (LCID)—(for example, the
standard international numeric abbreviation, 1033, for United States English)
 Loaded and recently unloaded drivers. These identify the modules used by the kernel when
the Stop error occurred and the modules that were used recently
 List of drivers in the Drivers folder on the hard disk drive (systemroot\System32\Drivers)
 File size, date created, version, manufacturer, and full product name for each driver
 Number of available processors
 Amount of random access memory (RAM)
 Time stamp that indicates when the Stop error occurred
154
 Messages and parameters that describe the Stop error
 Processor context for the process that stopped. This includes the processor, hardware state,
performance counters, multiprocessor packet information, deferred procedure call
information, and interrupts (requests from software or devices for processor attention).
 Process information and kernel context for the halted process. This includes the offset
(location) of the directory table and the database that maintains the information about every
physical page (block of memory) in the operating system.
 Process information and kernel context for the thread that stopped. This information identifies
registers (data-storage blocks of memory in the processor) and interrupt-request levels, and it
includes pointers to data structures for operating system data.
 Kernel-mode call stack for the interrupted thread. This is a data structure that consists of a
series of memory locations and one or more pointers.
Controlling Windows Error Reporting to prevent

the flow of information to and from the Internet
To control the flow of information to and from the Internet when users or administrators report
errors, you can configure Windows Error Reporting by using an answer file with an unattended
installation or by using Group Policy. The following subsections provide more details.
Using an answer file with an unattended installation

You can control the consent level for Windows Error Reporting by using an answer file with an
unattended installation. To configure a consent level of Always ask before sending data,
confirm that your answer file includes the following line:
<DefaultConsent>1</DefaultConsent>
For more information, see To control the consent level for Windows Error Reporting by
using an answer file with an unattended installation later in this section.
Selected Group Policy settings for Windows Error Reporting

This section provides information about a small set of the Group Policy settings that are available
for Windows Error Reporting. For information about viewing these and other Group Policy
settings, see To locate Group Policy settings for configuring Windows Error Reporting later
in this section.
Setting to redirect Windows Error Reporting to a server on your intranet

This setting is located in Computer Configuration under Policies (if present), in Administrative
Templates\Windows Components\Windows Error Reporting\Advanced Error Reporting
Settings.
155
Important
To see the Group Policy settings for Windows Error Reporting in Windows 7 and
Windows Server 2008 R2: On the Extended tab, view the Requirements (operating
system requirements) listed for the setting. Some settings are supported on Windows 7
and Windows Server 2008 R2, and some are not.
 Configure Corporate Windows Error Reporting: Use this setting to specify a server in your
organization to which you want error reports to be sent (instead of being sent directly to
Microsoft). If you enable this setting, you can specify your server name and port, and choose
whether the reports should be sent by using Secure Sockets Layer (SSL), which provides
additional security for the connection. For more information about using this setting, see
Overview: Using Windows Error Reporting and the Problem Reports and Solutions feature in
a managed environment earlier in this section.
Two settings in the Advanced Error Reporting Settings refer to the "Report Queue" and the
"Report Archive." These both refer to information that is stored on the local computer running
Windows 7 or Windows Server 2008 R2. The Report Queue temporarily stores error reports that
are waiting to be sent. The Report Archive stores reports so that the Problem Reports and
Solutions interface can display them.
Setting to control the degree of prompting that occurs before data is sent
You can control the degree to which Windows Error Reporting prompts you for consent before
data is sent. This setting is located in Computer Configuration or in User Configuration, under
Policies (if present), in Administrative Templates\Windows Components\Windows Error
Reporting\Consent.
Important
To see Group Policy settings for Windows Error Reporting in Windows 7 and Windows
Server 2008 R2: on the Extended tab, view the Requirements (operating system
requirements) listed for the setting. Some settings are supported on Windows 7 and
Windows Server 2008 R2, and some are not.
 Configure Default consent: If you enable this setting, you can select one of the following
consent levels:
 Always ask before sending data: Windows Error Reporting always prompts for consent
before sending an error report.
 Send parameters: Windows Error Reporting sends the minimum data required to check
for an existing solution, for example, the application name and version, module name and
version, and exception code. After sending this data, Windows Error Reporting prompts
you for consent before sending any additional data requested by Microsoft.
 Send parameters and safe additional data: Windows Error Reporting sends the
minimum data required to check for an existing solution in addition to data that the
developer of the program has designated as being highly unlikely to contain personal
156
information. Windows Error Reporting then prompts you for consent before sending any
additional data requested by Microsoft.
 Send all data: Any data requested by Microsoft is sent, without prompts. (This setting
can only be configured through Group Policy, not through the Initial Configuration Tasks
interface, Server Manager, or Control Panel.)
Setting to disable reporting handwriting recognition errors

You can use a Group Policy setting to specifically disable reporting handwriting recognition
errors. This setting is located in Computer Configuration or in User Configuration under
Policies (if present), in Administrative Templates\System\Internet Communication
Management\Internet Communication settings.
 Turn off handwriting recognition error reporting: If you enable this setting, you cannot
start the error reporting tool for handwriting recognition errors, and corrected handwriting
samples will never be sent by Windows Error Reporting.
Setting for disabling Windows Error Reporting

This setting is located in Computer Configuration under Policies (if present), in Administrative
Templates\System\Internet Communication Management\Internet Communication settings.
 Turn off Windows Error Reporting: If you enable this setting, you can still view settings in
the Initial Configuration Tasks interface, Server Manager, or Control Panel, but the display
informs you that settings are being managed by a system administrator.
Important
You can also restrict Internet access for Windows Error Reporting and a number of other
features by applying the Restrict Internet communication Group Policy setting, which is
located in Computer Configuration under Policies (if present), in Administrative
this Group Policy and the policies that it controls, see Appendix C: Group Policy Settings
Listed Under the Internet Communication Management Category in Windows 7 and
Procedures to configure Windows Error Reporting

 Use the Initial Configuration Tasks interface or Server Manager to view or change settings for
Windows Error Reporting on a computer running Windows Server 2008 R2.
 Use Control Panel to view or change settings for Windows Error Reporting on a computer
running Windows 7 or Windows Server 2008 R2.
 Use the Configure Corporate Windows Error Reporting Group Policy setting so error
reports are sent to a server on your intranet instead of to Microsoft.
 Locate the Group Policy settings for configuring error reporting.
157
 Disable the reporting of handwriting recognition errors.
 Disable Windows Error Reporting by using Group Policy.
 Control the consent level for error reporting by using an answer file for an unattended
installation.
Following are two procedures that you can use to view or change the Windows CEIP setting on a
computer running Windows Server 2008 R2:
 Use Initial Configuration Tasks. (Use this procedure if you recently installed Windows
Server 2008 R2, and the Initial Configuration Tasks interface is displayed.)
 Use Server Manager.
To view or change settings for Windows Error Reporting on a computer running

Windows Server 2008 R2 by using Initial Configuration Tasks
1. Under Update This Server, click Enable automatic updating and feedback.
2. Click Manually configure settings.
3. Under Windows Error Reporting, click Change Setting.
The settings, including the setting for turning off Windows Error Reporting, are described
in Consent levels in Windows Error Reporting earlier in this section.
To view or change settings for Windows Error Reporting on a computer running

Windows Server 2008 R2 by using Server Manager
2. In Server Manager, make sure Resources and Support is expanded.
3. Click Configure Windows Error Reporting.
The settings, including the setting for turning off Windows Error Reporting, are described
in Consent levels in Windows Error Reporting earlier in this section.
To use Control Panel to view or change settings for Windows Error Reporting on a
computer running Windows 7 or Windows Server 2008 R2
1. Click Start, and then click Control Panel (or point to Settings, and then click Control
Panel).
2. Click Action Center, and then click Maintenance.
3. Under Check for solutions to problem reports, click Settings.
4. Under Choose when to check for solutions to problem reports, view or change the
158
basic error reporting settings as described earlier in this document.
You can configure additional error reporting options as follows:
 Click Change report settings for all users. These settings can be used to configure
error reporting for all users of the computer or to allow each user to choose their
settings (the default).
 Click Select programs to exclude from reporting: This setting allows you to
manage the list of programs for which Windows Error Reporting is enabled.
To redirect Windows Error Reporting to a server on your Intranet

Templates, expand Windows Components, expand Windows Error Reporting, and
then click Advanced Error Reporting Settings.
3. In the details pane, double-click Configure Corporate Windows Error Reporting, and
then click Enabled.
4. Specify the name and port of the server to which error reports should be sent, and
choose whether the reports should be sent using Secure Sockets Layer (SSL).
Important
When you configure this setting, be sure to open Advanced Error
Reporting Settings, and then use the Configure Corporate Windows
Error Reporting setting. Avoid using a similar setting that supports
Windows XP and is designed for use with older versions of the tool for
analyzing errors that you capture on your servers. This setting is in
Computer Configuration under Policies (if present), in Administrative
Templates\Windows Components\Windows Error Reporting\Configure
Error Reporting. (In this setting, you can specify the corporate upload file
path.)
For more information about using the Configure Corporate Windows Error Reporting
setting, see Overview: Using Windows Error Reporting and the Problem Reports and
Solutions feature in a managed environment earlier in this section.
To locate Group Policy settings for configuring Windows Error Reporting

159
2. If you are interested in policy settings that apply to all users of a computer and that come
into effect when the computer starts or when Group Policy is refreshed, expand
Computer Configuration. If you are interested in policy settings that apply to specific
users or administrators and that come into effect when a person logs on or when Group
Policy is refreshed, expand User Configuration.
3. Expand Policies (if present), expand Administrative Templates, and then expand
Windows Components.
4. Click Windows Error Reporting, and then view the settings that are available.
Important
When you look at Group Policy settings for Windows Error Reporting on
Windows 7 or Windows Server 2008 R2, on the Extended tab, view the
Requirements (operating system requirements) listed for the setting. Some
settings are supported on Windows 7 or Windows Server 2008 R2, and some
are not.
5. Click Advanced Error Reporting Settings, and then view the settings that are available.
(What you selected in step 2 affects what you see in Advanced Error Reporting
Settings. If you want to view Configure Corporate Windows Error Reporting, you
must select Computer Configuration in step 2.)
6. In the left pane, click Consent, and then view the settings that are available.
To disable reporting handwriting recognition errors

2. If you are interested in policy settings that apply to all users of a computer and that come
into effect when the computer starts or when Group Policy is refreshed, expand
Computer Configuration. If you are interested in policy settings that apply to specific
users or administrators and that come into effect when a person logs on or when Group
Policy is refreshed, expand User Configuration.
4. In the details pane, double-click Turn off handwriting recognition error reporting, and
then click Enabled.
160
Important
You can also restrict Internet access for Windows Error Reporting and a
number of other features by applying the Restrict Internet communication
Group Policy setting, which is located in Computer Configuration under
To disable Windows Error Reporting by using Group Policy

Templates, expand Windows Components, and then expand Windows Error
Reporting.
3. In the details pane, double-click Disable Windows Error Reporting, and then click
Enabled.
If you enable this setting, you can still view settings in the Initial Configuration Tasks
interface, Server Manager, and Control Panel, but the display informs you that settings
are being managed by a system administrator.
Important
You can also restrict Internet access for Windows Error Reporting and a
number of other features by applying the Restrict Internet communication
Group Policy setting, which is located in Computer Configuration under
Policy and the policies that it controls, see Appendix C: Group Policy Settings
Listed Under the Internet Communication Management Category in Windows
7 and Windows Server 2008 R2.
To control the consent level for Windows Error Reporting by using an answer file with
an unattended installation
1. Use the methods you prefer to create an answer file for an unattended installation. For
detailed information about entries to include in the answer file, see Unattend.chm in the
Windows Automated Installation Kit.
2. Confirm that your answer file includes one of the following lines:
 For a consent level of Always ask before sending data:
161
 For a consent level of Send parameters: <DefaultConsent>2</DefaultConsent>
 For a consent level of Send parameters and safe additional data:
 For a consent level of Send all data: <DefaultConsent>4</DefaultConsent>

For additional information about an unattended installation, see the resources listed in
Appendix A: Resources for Learning About Automated Installation and Deployment for
For more information about Windows Error Reporting, see the following resources on the
Microsoft Web site:
 Privacy Statement for the Microsoft Error Reporting Service
 Windows Error Reporting
 Application Recovery and Restart
 Windows Quality Online Services (This Web site is dedicated to software and hardware
vendors who are interested in ways to improve their products.)
162
Windows Media Player and Resulting
In this section
Benefits and purposes of Windows Media Player
Overview: Using Windows Media Player in a managed environment
How Windows Media Player communicates with Internet sites
Controlling Windows Media Player to limit the flow of information to and from the Internet
Procedures for configuring Windows Media Player
This section discusses how Windows Media® Player 12 communicates across the Internet, and it
explains steps to take to limit, control, or prevent that communication in an organization with
many users. Windows Media Player 12 is the version of Windows Media Player that is included
with Windows® 7 and Windows Server® 2008 R2 when you install the Desktop Experience
feature set. Other versions of Windows Media Player might differ from the version that is
described in this section.
It is beyond the scope of this document to describe all aspects of maintaining appropriate levels
of security in an organization where users connect to Internet sites or download items from the
Internet. This section, however, provides information about Windows Media Player that can help
you balance your organization’s requirements for communication across the Internet with your
organization’s requirements for protection of networked assets.
Benefits and purposes of Windows Media Player

Microsoft® Windows Media Player (also called the Player) enables users to play and organize
digital media files on their computers and on the Internet. Users can search for and organize
digital media files, and (with the necessary hardware) play CDs and DVDs, create custom CDs,
and copy files to a portable device.
With the Group Policy settings that are available in Windows 7 and Windows Server 2008 R2,
you can configure Windows Media Player to limit access to certain non-business features. The
management and deployment features enable you to bring customized media functionality to your
organization’s employees.
163
Overview: Using Windows Media Player in a
managed environment
Windows Media Player is an integral feature of Windows 7. Windows Media Player is not an
optional Windows feature, and it cannot be uninstalled. It is an optional feature on Windows
Server 2008 R2 when you install the Desktop Experience feature set. You can, however, specify
a different media player or hide entry points to the user interface for Windows Media Player by
using Programs and Features in Control Panel. You can also make certain aspects of the Player
available for limited use or unavailable to the user in accordance with policies in your
organization.
There are a variety of options available to you when you are considering how you want your
users to interact with Windows Media Player. To help you assess what level of control to apply to
your organization, the following table summarizes some of the configuration options.
164
Options for Controlling Communication with the Internet Through Windows Media Player
Options Degree of Control
Limit access to Windows Media Player: Possible restricted access to media content
Choose a default media player other than (and no access to the Internet through
Windows Media Player. For more information, Windows Media Player), but least flexible.
see Procedures for configuring Windows Media
Player later in this section.
Allow access only to specific Internet sites: Restricted access to the Internet, but requires
Allow users to use Windows Media Player, but knowledge of which external sites are
with access to only those Internet sites that are trustworthy.
approved for access by an organization’s
policies. Use an inclusion list (through the
firewall, proxy, or both).
Allow Internet access only to selected Access to Internet is only available to users
users: By restricting Internet access to who need it most. Implies that training is
selected users, you restrict communication provided to selected users.
between Windows Media Player and Internet
sites. For example, you can place most users
on a network with a firewall that blocks Internet
access.
Limit the Windows Media Player features Moderate control and moderate flexibility. With
that can be used: Allow users to use Windows this option, users have access to the Player,
Media Player, but with access only to certain but you maintain control over which options
features. Use Group Policy settings to they are able to use.
configure Windows Media Player on clients.
For more information, see the following
resources:
Controlling Windows Media Player to limit the
flow of information to and from the Internet later
in this section
Procedures for configuring Windows Media
Player later in this section
Appendix B: Resources for Learning About
Group Policy for Windows 7 and Windows
Server 2008 R2
Free access: Allow free access for all. Highest access to the Internet and media
content.
165
The following subsections describe how Windows Media Player 12 communicates with the
Internet and how to control the flow of information to and from the Internet.
How Windows Media Player communicates with

Internet sites
The Windows Media Player interface opens locally when the user navigates through
Start\Windows Media Player or double-clicks a local file type that is associated with Windows
Media Player. Windows Media Player communicates with sites on the Internet if the user plays
content on a site from a content provider. Windows Media Player also communicates with sites
on the Internet if the user downloads skins, visualizations, or plug-ins, or if certain Windows
Media Player options are enabled, such as metadata retrieval or automatic download of usage
rights.
Note
The first time that Windows Media Player is opened, it prompts the user to configure
settings such as whether to allow Windows Media Player to download CD and DVD
information from the Internet or whether to send Microsoft anonymous usage information
for the Windows Customer Experience Improvement Program. These settings can be
changed later in Windows Media Player or by using Group Policy. (For information about
using Group Policy to disable the Windows Customer Experience Improvement Program,
see Windows Customer Experience Improvement Program and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R2 in this document.)
Communication with the WindowsMedia.com site

When a connection is available to the Internet, and if the user consents, WindowsMedia.com
supports the following key features in Windows Media Player 12:
 Metadata retrieval
 Metadata submission
 Media Guide
WindowsMedia.com is a digital entertainment Web site that is operated by Microsoft and is
integrated into Windows Media Player. All of the CD audio data, DVD data, and information that is
displayed in the Now Playing feature come directly from WindowsMedia.com. The Media Guide is
a set of Web pages provided by WindowsMedia.com.
Note
WindowsMedia.com also provides the Media Guide and the WindowsMedia.com Radio
Tuner separately through a Web browser.
166
Communication with the Windows Media site on Microsoft.com
The Windows Media site on Microsoft.com supports the following key features in Windows Media
Player 12 (when a connection to the Internet is available):
 Downloadable skins
 Downloadable visualizations
 Downloadable plug-ins
 Web Help for errors that occur in the Player
The Windows Media site on Microsoft.com also provides information through links in Windows
Media Player 12, including the links in the following list. (If the menus mentioned in this list are not
visible, right-click the taskbar and select Show menu bar.)
 In the Help menu:
 Windows Media Player online (information about using Windows Media Player)
 Privacy statement online
 In Tools\Options:
Security tab: Read the security statement online
For more information, see the Windows Media Home page.
Communication with other sites

Windows Media Player communicates with a number of other Web sites including the following:
 Windows Media Player uses the Microsoft Web site to find information about online stores,
which are Web sites that offer digital media content by subscription or for purchase. If a user
decides to use an online store, the Player then communicates with that online store directly.
 To support the playback of secure content using digital rights management (DRM)
technology, Windows Media Player contacts:
 Non-Microsoft media usage rights (license) servers.
 Microsoft DRM upgrade service.
 Software updates for Windows Media Player are available through the Windows Update Web
site, which is described in Windows Update and Resulting Internet Communication in
Windows 7 and Windows Server 2008 R2 in this document.
 Windows Media Player is commonly used to play media on media servers that are run by
content providers.
Data exchanged during communication with the Internet

The following subsections describe various aspects of the data that is sent to and from the
Internet through Windows Media Player and how the exchange of information takes place:
 Information sent or received when specific features are used
 Default settings, triggers, and user notifications
167
 Logging, encryption, and privacy
 Transmission protocols and ports
 Enabling and disabling features
Important
Group Policy settings such as Prevent CD and DVD Media Information
Retrieval affect the way that Windows Media Player communicates with the
Internet. For more information, see Settings that can be controlled through Group
Policy later in this section.
Information sent or received when specific features are used

When a user uses one of the features of the Player that is listed in Communication with the
WindowsMedia.com site earlier in this section, information is sent to or from the Internet as
described in the following list.
Note
The Tools menu is only visible if the user enables it. One way to do this is to right-click
the taskbar and make sure that Show menu bar is selected.
 Non-Microsoft DRM usage rights servers. When users try to play content that is protected
with Microsoft DRM technology, the Player can be configured to automatically acquire media
usage rights for the content from a usage rights server. The process of acquiring usage
rights, previously known as licenses, might also cause an update to the user's DRM
revocation and exclusion lists. These lists are used to block compromised applications from
accessing secure content.
 Microsoft DRM upgrade service. The upgrade service provides users with the option to
upgrade their DRM components in case the secure content that they want to play requires an
upgraded component that supports the higher level of security.
 Media servers run by content providers. To provide streaming media, it is necessary for
Windows Media Player to communicate directly with a media server. These servers are
typically operated by non-Microsoft content providers, and they are not under Microsoft
control.
 Metadata retrieval. When a user requests metadata (see the bulleted item, "Triggers and
user notifications" in Default Settings, Triggers, and User Notifications later in this section), a
CD table of contents or DVD identification is sent from the user's computer, and then the
metadata is retrieved. The metadata can include album art, track names, lyrics, and artist's
biographical information. The metadata is stored in the Media Library for offline use.
 Metadata submission. This is a service that enables users to submit corrections to the
WindowsMedia.com metadata database. A cookie on the client is accessed by
WindowsMedia.com (unless the cookie is blocked). The CD table of contents or DVD
identification and the user's corrected metadata are sent to WindowsMedia.com.
168
 Media Guide. Media Guide is a set of Web pages that is hosted within the Windows Media
Player interface and focuses on streaming media. A cookie on the client is accessed by
WindowsMedia.com (unless the cookie is blocked) and WindowsMedia.com sends the Media
Guide Web page.
 Online Stores. An online store is a Web site that offers digital media content by subscription
or for purchase. When a user clicks the menu in the Player that is labeled Online Stores (or
with the name of a particular online store) and then clicks Browse all Online Stores,
Windows Media Player uses the Microsoft Web site to find information about online stores.
When a user clicks the name of an online store, the Player communicates with that online
store directly.
 Player update. This service is integrated with Windows Update, and it can enable a user to
learn about and acquire Windows Media Player updates. The process is similar to
downloading software updates for the operating system, but it is controlled separately
through the Windows Media Player interface. To acquire updates, a person logged on as an
administrator and running the Player can click the Help menu, and then click Check for
Updates. (If the Help menu is not visible, right-click the taskbar and select Show menu bar.)
Alternatively, a person who is logged on as an administrator can configure the Player to
automatically check for updates by clicking the Tools menu, and then clicking Options. The
person logged on as an administrator can accept or decline the updates.
For more information, see the following resources:
 Windows Update and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 in this document
 Update Services Privacy Statement
 Downloadable skins. A user can click Tools/Download/Skins to link to a Web page that
contains extra downloadable skins. A cookie on the client is accessed by the Microsoft Web
site (unless the cookie is blocked) and the Skins Web page is sent back to the Web browser.
Note
The Tools menu is only visible if the user enables it. One way to do this is to
right-click the taskbar and make sure that Show Classic Menus is selected.
 Downloadable visualizations. A user can click Tools/Download/Visualizations to link to a
Web page that contains extra downloadable visualizations. A cookie on the client is accessed
by the Microsoft Web site (unless the cookie is blocked) and the Downloadable Visualizations
Web page is sent back to the Web browser.
 Downloadable plug-ins. A user can click Tools/Download/Plug-ins to link to a Web page
that contains new features that can be added to Windows Media Player. A cookie on the
client is accessed by the Microsoft Web site (unless the cookie is blocked) and the Plug-ins
Web page is sent back in the Web browser.
 Media Library. Media Library lists the user’s collection of audio and video files and offers
links to sources for audio and video. This information can be accessed by other software on
the user’s computer and on the Internet.
169
 Enhanced Content Provider Services (unique Player ID). This option is available through
the More Options command (on several menus) on the Privacy tab. It specifies whether
Windows Media Player sends a content provider a unique Player ID or an anonymous Player
ID. The anonymous Player ID contains a well-known static value and a randomly generated
number that changes each time a user requests content from a streaming media server.
This option is available because some content providers may require the Player to send a
unique Player ID to access their content or services.
 Customer Experience Improvement Program. This option is available through the More
Options command (on several menus) on the Privacy tab. It specifies whether to send
Windows Media Player usage information to Microsoft. The information that is obtained from
the user is used to improve the Player and other Microsoft products and services.
 Cookies. Windows Media Player uses the Internet as a networking and information source.
When accessing the Internet, cookies may be downloaded to the user’s computer or
uploaded to a media service.
 Site logs. Servers that provide media content create two types of logs:
 Raw IIS log. A standard Internet Information Services (IIS) log records all requests to the
server. This log includes the IP address of the client and a cookie.
 Tracking log. A tracking log records all requests. It includes the IP address of the client
and a cookie.
The Player also generates a streaming media log and sends it to any media servers that exist
on your network. For more information, see Logging, Encryption, and Privacy later in this
section.
Default settings, triggers, and user notifications

The following list describes how settings are initially configured in Windows Media Player and
describes the triggers that might initiate communication between Windows Media Player and the
Internet.
Important
Group Policy settings such as Prevent CD and DVD Media Information Retrievalaffect
the way that Windows Media Player communicates with the Internet. For more
information, see Settings that can be controlled through Group Policy later in this section.
 Recommend and custom settings: The first time that Windows Media Player is opened, it
displays dialog boxes for configuring settings such as whether to allow Windows Media
Player to download CD and DVD information from the Internet, or whether to send Microsoft
anonymous usage information for the Windows Customer Experience Improvement Program.
The initial dialog box allows a user to select Recommended or Custom settings. The latter
option allows the user to configure a number of privacy-related options. You can prevent the
first-use dialog boxes from appearing, and instead control such settings through Group
Policy. For more information, see Settings that can be controlled through Group Policy later in
this section.
170
 Triggers and user notifications: The features that initiate communication with the Internet
are activated individually by various user interactions as listed below. With some features, the
user is presented with a Web page that is both a notification and a trigger, providing items for
the user to select to complete a download. With other features, the user may or may not be
notified at the time of the trigger, as described in the following list:
 Metadata retrieval
Trigger. When the user first inserts a CD or DVD or when the user requests detailed
information (for example, by right-clicking a file and then clicking an option to find
information about it), information is retrieved automatically from WindowsMedia.com.
Notification. The user is not notified, and the information is only retrieved automatically if
the user previously consented.
 Metadata submission
Trigger. When the user submits corrected metadata for files, CDs, and DVDs,
information is sent to WindowsMedia.com.
Notification. The user is notified.
 Media Guide
Trigger. The Media Guide is displayed if the user right-clicks the taskbar, enables Show
Classic menus, then clicks View\Online Stores\Media Guide. After that, the user can
click Media Guide in the taskbar.
Notification. The user is not notified.
 Browse all Online Stores
Trigger and notification. When a user clicks the menu in the Player that is labeled
Online Stores (or with the name of a particular online store) and then clicks Browse all
Online Stores, Windows Media Player uses the Microsoft Web site to find information
about online stores. When a user clicks the name of an online store, the Player
communicates with that online store directly.
 Player update
Trigger. At a set frequency (for example, weekly), if the user is online and is logged on
as an administrator, a check is made for updated Windows Media Player features. This
can be disabled through Group Policy.
Notification. The user is notified. The user is prompted to download the updates, but can
decline to do so.
 Downloadable skins
Trigger and notification. The user clicks Tools\Download\Skins, which launches the
Skins Web page. When a user selects a skin from this page, the user is prompted to
accept or reject the download. If the user accepts, the skin is downloaded.
Note
The Tools menu is only visible if the user enables it. One way to do this is to
right-click the taskbar and make sure that Show Classic Menus is selected.
171
 Downloadable visualizations
Trigger and notification. The user clicks Tools\Download\Visualizations, or clicks
Tools\Options\Plug-ins and then Look for visualizations on the Web. This launches
the Visualizations Web page. When the user selects a visualization from this page, the
user is prompted to accept or reject the download. If the user accepts, the visualization is
downloaded.
 Downloadable plug-ins
Trigger and notification. The user clicks View\Plug-ins\Find on the Web (or clicks
Tools\Options\Plug-ins, and then clicks Look for plug-ins on the Web). This launches
the Plug-ins Web page. When the user selects a plug-in from this page, the user is
prompted to accept or reject the download. If the user accepts, the plug-in is downloaded.
 Enhanced Content Provider Services (unique Player ID)
Trigger and notification. Sending a Player ID is triggered during initial communication
with a media server. At this time, the user is not notified about whether a unique Player
ID or an anonymous Player ID is being used (unless the content provider requires a
unique Player ID and notifies the user of this requirement).
 Customer Experience Improvement Program
Trigger and notification. Customers can enable participation in the Customer
Experience Improvement Program the first time they launch Windows Media Player—
either as a recommended setting or when they choose custom settings. Upon
subsequent use of Windows Media Player, they can modify this option by clicking More
Options (available on several menus), clicking the Privacy tab, and then selecting I
want to help make Microsoft software and services even better by sending Player
usage data to Microsoft. If the user accepts, Microsoft collects statistical information
about the hardware configuration and how the user uses the software and services, so
that Microsoft can identify trends and usage patterns. If the user accepts, there is no
notification at the time information is transferred.
 Media Library
Trigger and notification. The trigger occurs when the user adds purchased media to the
Media Library from WindowsMedia.com or another media vendor. The retrieval of
additional information about media files from the Internet can be controlled by clicking
More Options (available on several menus), and then clearing check boxes on the
Privacy tab.
 Cookies
Trigger. The trigger occurs automatically when a Web site is accessed.
Notification. The way that Windows Media Player handles cookies that are sent from a
Web site depends on privacy settings that affect your Web browser, Windows Media
Player, and any other programs that rely on these settings. These settings control
whether cookies are allowed, cookies are blocked, or the user is prompted before a
cookie is allowed. The settings are controlled through your Web browser, although you
172
can also configure these settings through the Player. To configure the settings in the
Player, click Tools\Options, click the Privacy tab, and then click Cookies.
Logging, encryption, and privacy

The following list describes the way the Player sends logging information to a streaming media
server, the encryption options that are available for the Player, and the privacy statements that
are related to the Player.
 Logging: Logging occurs when information is sent from the Player to a streaming media
server. Logging can also occur when information is sent from the Player to a program on a
Web server if the program is designed to create log entries.
For more information, see Logging Model for Windows Media Services.
Logging informs the server about various pieces of information so that services can be
improved. The information includes such details as connection time and the Internet protocol
(IP) address of the computer that is connected to the server—typically a network address
translation (NAT) or proxy server. This information also includes the version, identification
number (ID), date, and protocol of Windows Media Player. For more details, see the privacy
statements under "Privacy" later in this list.
 Encryption: Protected Media Path is a platform that enhances support for digital rights
management (DRM) in Windows 7 and Windows Server 2008 R2. Protected Media Path
helps maintain the security and protection of digital audio and video files that have been
encrypted using DRM technology.
The client can also progressively download content from a Web server by using HTTPS. A
client and server can also use Internet Protocol security (IPsec) to encrypt packets that
traverse the network.
For more information, see Protected Media Path.
 Privacy: The privacy statements for Windows Media Player and WindowsMedia.com are on
the following Microsoft Web sites:
 Windows Media Player 12 privacy statement
 Microsoft Online Privacy Notice Highlights
Transmission protocols and ports

The following list briefly describes the transmission protocols and ports that are used by the
Player.
 Transmission protocol: Windows Media Player 12 can communicate through Real-Time
Streaming Protocol (RTSP) with User Datagram Protocol (UDP) or TCP. It can also use
HTTP. It cannot use Microsoft Media Server (MMS) protocol.
If a media server tries to stream content by using MMS and receives failure messages, it
might use automatic protocol rollover, that is, it might attempt different protocols until a
particular protocol succeeds. It might also use automatic protocol rollover to try to optimize
the streaming experience and to work correctly with firewall settings in your environment.
173
With protocol rollover from MMS, you can configure Windows Media Player so that it accepts
only the protocols you choose.
For additional information, see Firewall Information for Windows Media Services 9 Series.
 Ports: For RTSP/TCP, you can specify the ports that will be used by Windows Media Player
to receive data.
For additional information, see Firewall Information for Windows Media Services 9 Series.
 Unicast and multicast streams: By default, Windows Media Player can accept unicast or
multicast streams. You can configure it to accept only unicast streams.
Enabling and disabling features

Many features in Windows Media Player can be enabled or disabled through the prompts that are
displayed the first time that Windows Media Player is opened. Features can be also disabled
through the user interface in Windows Media Player or through Group Policy settings.
Controlling Windows Media Player to limit the flow

of information to and from the Internet
You can specify the media player that you want to use on a computer running Windows 7 or
Windows Server 2008 R2 by using the Windows interface or through an unattended installation. If
you choose to use Windows Media Player, you can control individual features of the Player
through the user interface of the Player or through Group Policy settings.
Controlling Windows Media Player through the user interface

When users interact with Windows Media Player, they can limit the flow of information to and from
the Internet. The following table describes practices that users can follow to limit Internet
communication.
Note
The File menu and the View menu that are mentioned in the table below are only visible
if they are enabled. One way to enable these menus is to right-click the taskbar and
make sure that Show menu bar is selected.
Feature Practices to Limit Internet Communication
Metadata retrieval  From the File menu, make sure that Work
Offline is selected.
 Avoid inserting a CD or DVD.
 From the Tools menu, select Options,
click the Privacy tab, and clear the Display
media information from the Internet and
174
Update music files by retrieving media
info from the Internet check boxes. On
the Library tab, clear the Retrieve
additional information from the Internet
check box. Also on the Player tab, make
sure that the Connect to the Internet
(overrides other commands) check box is
cleared.
Metadata submission  From the File menu, make sure that Work
 Avoid submitting metadata.
Media Guide  From the File menu, make sure that Work
 Avoid clicking View\Online Stores\Media
Guide. If Media Guide is displayed in the
taskbar, do not click it.
Downloadable skins  Use a custom skin that does not display

downloadable skins.
Downloadable visualizations  Use a custom skin that does not display

downloadable visualizations.
Download plug-ins  Avoid selecting the Download Plug-ins

options from any of the trigger locations
mentioned previously.
Online Stores  From the File menu, make sure that Work
 Avoid clicking any command on the far right
menu, which can be labeled as Online
Stores or with the name of a particular
online store.
Unique Player ID  Avoid selecting this option.

As an administrator, you can use Group
Policy settings to prevent users from
selecting this option. Enable Hide Privacy
Tab to keep users from selecting the option
in that tab. Enable the Do Not Show First
Use Dialog Boxes Group Policy setting to
keep users from selecting the option in first-
175
use dialog boxes. For more information,
see Settings that can be controlled through
Group Policy later in this section.
Customer Experience Improvement  Avoid selecting this option.

Program As an administrator, you can use Group
Policy settings to prevent users from
selecting this option. Enable Hide Privacy
Tab to keep users from selecting the option
in that tab. Enable the Do Not Show First
Use Dialog Boxes Group Policy setting to
keep users from selecting the option in first-
use dialog boxes. For more information,
see Settings that can be controlled through
Group Policy later in this section.
Connect to the Internet  From the Tools menu, select Options,

click the Player tab, and then clear the
Connect to the Internet (overrides other
commands) check box.
Media usage rights  From the Tools menu, select Options, click
the Privacy tab, and then clear the
following two check boxes: Download
usage rights automatically when I play
or sync a file and Automatically check if
protected files need to be refreshed.
Note
There is also an option through
which Windows Media Player
sets the clock on media
devices automatically (for best
results when usage rights are
based on a date or time).
Setting the time involves
communication between the
computer and a time server on
the Internet. This option can be
turned off through
Options\Privacy\Set clock on
devices automatically.
176
Settings that can be controlled through Group Policy
A wide variety of configuration settings for Windows Media Player can be controlled through
Group Policy. This subsection lists a few examples of these settings.
Note
For information about individual Group Policy settings, navigate to a setting as described
in To locate Group Policy settings for configuring Windows Media Player later in this
section, then double-click the setting and read the explanatory text.
Some of the Group Policy settings that affect the way Windows Media Player communicates
through the Internet are located at User Configuration\Administrative Templates\Windows
Components\Windows Media Player or in the Group Policy categories that are listed there.
Examples of these policy settings include:
 Prevent CD and DVD Media Information Retrieval
 Prevent Music File Media Information Retrieval
 Prevent Codec Download (under Playback)
 Hide Privacy Tab (under User Interface)
You can use this option to prevent users from selecting options on the Privacy tab (such as
the Windows Customer Experience Improvement Program).
For information about using Group Policy to disable the Windows Customer Experience
Improvement Program, see Windows Customer Experience Improvement Program and
Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 in this
document.
 Set and Lock Skin (under User Interface)
You can use this option to specify a custom skin that displays only selected features.
Other Group Policy settings that affect the way Windows Media Player communicates through the
Internet are located at Computer Configuration\Administrative Templates\Windows
Components\Windows Media Player or in Group Policy categories under this location.
Examples of these policy settings are:
 Prevent Automatic Updates
 Do Not Show First Use Dialog Boxes
For more information about using Group Policy, see Appendix B: Resources for Learning About
Group Policy for Windows 7 and Windows Server 2008 R2.
Other ways to control Windows Media Player

You can control several aspects of Windows Media Player by using methods other than the user
interface or the Group Policy settings for Windows Media Player. Methods for controlling the
Player include:
 Use Set program access and computer defaults (available from Start\Default Programs
in Windows 7) to remove access to Windows Media Player. With this dialog box, the
177
administrator of a computer running Windows 7 can specify which media player is shown on
the Start menu, desktop, and other locations.
 Use AutoPlay in Control Panel to define or restrict what happens when a user clicks a
video, audio, or image file, or inserts a CD or DVD into a drive.
 Use the firewall or proxy or both to block access to Web sites such as the
WindowsMedia.com Web site.
 Create custom player skins that contain only those features that you want users to use. For
more information, see Windows Media Player 11 SDK Windows Media Player Skins.
Procedures for configuring Windows Media Player

Windows Media Player can be configured in several ways, as described previously. This
subsection provides procedures for:
 Locating Group Policy settings for configuring Windows Media Player.
 Accessing the Privacy tab in the user interface of Windows Media Player (to specify settings
related to privacy).
 Accessing the Network tab in the user interface of Windows Media Player (to specify
information about streaming media protocols).
 Specifying the media player on a computer running Windows 7.
 Removing visible entry points to Windows Media Player during an unattended installation of
Windows 7 by using an answer file.
 Specifying the media player during an unattended installation of Windows 7 or Windows
Server 2008 R2 by using an answer file.
Important
To prevent users from manually updating Windows Media Player, we
recommend that users are not given administrative credentials on their
computers.
To locate Group Policy settings for configuring Windows Media Player

Windows Server 2008 R2, open Group Policy Management Console (GPMC) by running
gpmc.msc, and then edit an appropriate Group Policy object (GPO).
2. In Group Policy, expand User Configuration, expand Administrative Templates,
expand Windows Components, and then click Windows Media Player.
Windows Components, and then click Windows Media Player.
4. View the Group Policy settings that are available.
178
To access the Privacy tab in the user interface of Windows Media Player
1. On the Tools menu, click Options, and then click Privacy.
2. Review the available options, including the following:
 Display media information from the Internet
 Update music files by retrieving media info from the Internet
 Download usage rights automatically when I play or sync a file
 Automatically check if protected files need to be refreshed
 Set clock on devices automatically
 Send unique Player ID to content providers
Other options are also available, including an option for the Windows Customer
Specifying information for streaming media protocols

There are two methods for specifying information for streaming media protocols:
 Use the Network tab to configure the protocols and proxy settings that you want Windows
Media Player to use when receiving streaming media files, and then hide the Network tab
through Group Policy settings in Windows Media Player.
 Use Group Policy settings to specify information for streaming media protocols.
For more information, see To locate Group Policy settings for configuring Windows Media Player
earlier in this section.
To access the Network tab in the user interface of Windows Media Player
1. On the Tools menu, click Options, and then click Network.
2. The following options are included on the Network tab:
 Protocols for MMS URLs. Specifies the protocols that Windows Media Player 12
can try to use when receiving an MMS URL (Windows Media Player 12 cannot use
MMS). Select one or more of the following:
RTSP/UDP
RTSP/TCP
RTSP/HTTP
By default, all protocols are selected, which means that the Player uses each
protocol until it finds one that succeeds. Because the Player can receive files by
using a variety of protocols, we recommend that you select all protocols.
 Use ports to receive data. Specifies a port range through which to receive
streaming content. This option is useful if you have established a specific port that
enables streaming content to pass through a firewall.
179
For additional information, see Firewall Information for Windows Media Services 9
Series.
 Multicast streams. Determines whether the Player can receive multicast streams.
 Streaming proxy settings. Select a protocol, and then click Configure. You can
configure proxy settings for the following protocols:
HTTP
RTSP
When you click the Configure button, you can choose among the following proxy
settings:
Autodetect proxy settings
Use proxy settings of the Web browser
Do not use a proxy server
Use the following proxy server (and Port)
With Use the following proxy server, you can also select Bypass proxy server for
local addresses, and you can choose not to use the proxy server for addresses that
begin with the strings that you specify.
To specify a media player by using the default programs interface in Windows 7

1. In Windows 7, click Start, click Default Programs, and then click Set program access
and computer defaults.
2. Click the Custom button.
Note
Alternatively, you can click the Non-Microsoft button, which removes access
to Windows Media Player, Internet Explorer®, and Windows Mail. If you do
this, skip the remaining steps of this procedure.
3. To disable access to Windows Media Player on this computer, to the right of Windows
Media Player, clear the Enable access to this program check box.
4. If you want a different default media player to be available to users of this computer,
select the media player from the options available.
Note
For the last step, if the program does not appear by name, contact the
vendor of that program for information about how to configure it as the
default. Also, for related information about registry entries that are used to
designate that a program is a browser, e-mail, media playback, or instant
messaging program, see Registering Programs with Client Types.
To remove visible entry points to Windows Media Player during an unattended

installation by using an answer file
180
<WindowsFeatures> section in your answer file, the "ShowWindowsMediaPlayer" line
should be included in the <WindowsFeatures> section rather than repeating the section.
<WindowsFeatures>
<ShowWindowsMediaPlayer>false</ShowWindowsMediaPlayer>
</WindowsFeatures>
Note
This procedure removes visible entry points to Windows Media Player, but it
does not prevent Windows Media Player from running.
To specify a media player during an unattended installation by using an answer file

1. Use the methods that you prefer for an unattended installation or remote installation to
<ClientApplications> section in your answer file, the "Media" line (the line containing the
path to your media player) should be included in the <ClientApplications> section rather
than repeating the section.
<ClientApplications>
<Media>path_to_media_player</Media>
</ClientApplications>
For path_to_media_player, specify the path to your media player.
 Windows Media Home page
 Downloads for Windows Media Player
 Windows Media Player 12 Privacy Statement
 Microsoft Online Privacy Notice Highlights
181
Windows Media Services and Resulting
2008 R2
In this section
Benefits and purposes of Windows Media Services
Examples of features that help you control communication to and from a server running Windows
Media Services
Firewall information for Windows Media Services
Installable features associated with Windows Media Services
Procedures for installing or removing Windows Media Services and associated features
This section provides information about how Microsoft® Windows Media® Services on servers
running Windows Server® 2008 R2 communicates across the Internet, and it explains steps to
take to limit, control, or prevent that communication in an organization with many users. It is
beyond the scope of this document to describe all aspects of maintaining appropriate levels of
security in an organization that is running servers that communicate across the Internet. This
section, however, provides overview information and suggestions for other sources of information
organization’s requirements for protection of networked assets.
Notes
This section describes Windows Media Services (the server feature), but it does not
describe Windows Media Player (the client feature) or Internet Information Services (IIS),
both of which can be involved in carrying out communication of multimedia content
across the Internet. For information about these features, see the following sections of
this document:
 Windows Media Player and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2
 Internet Information Services and Resulting Internet Communication in Windows 7 and
Benefits and purposes of Windows Media

Services
Windows Media Services is an optional feature in Windows Server 2008 R2. In addition to basic
on-demand and live streaming of Windows Media content, Windows Media Services delivers
advanced streaming functionality such as multicasting, support for wireless and mobile networks,
182
MP3 streaming, Internet authentication, customizable server plug-ins, built-in caching and
proxying, and an optional Web-based administration console. With Windows Media Services, you
can manage and deliver Windows Media content over an intranet or the Internet. The client
computers that receive the content can render it as it is received (that is, without downloading the
content first). Streaming greatly reduces the wait time and storage requirements for the client
computer. It also permits presentations of unlimited length and live broadcasts.
For servers from which you want to offer content that will be streamed to an intranet or the
Internet, the following types of information are provided in this document:
 Examples of features in Windows Media Services 2008 that help you control communication
to and from a server running Windows Media Services.
 Information about installing and removing Windows Media Services and associated features.
 References to more detailed information about Windows Media Services, including
information about ports and security-related topics.
For more information about the features in Windows Media Services, see the following
subsections of this document:
 Installable features associated with Windows Media Services
 Additional references
Note
Windows Media Services 2008, which is part of the server role called Streaming Media
Services, is not included in Windows Server 2008 R2. Windows Media Services is
available for download from the Microsoft® Web site. Also, the functionality that is
supported in Windows Media Services depends on the version of Windows
Server 2008 R2 that you are running.
Requirements for Windows Media Services

The Streaming Media Services role in Windows Server 2008 R2 is somewhat different from other
server roles. This subsection provides information about what is required when you install this
role.
The server role called Streaming Media Services uses Windows Media Services 2008, which is
not included in Windows Server 2008 R2. For more information, see Windows Media
Services 2008 for Windows Server 2008 R2 in the Microsoft Download Center
(http://go.microsoft.com/fwlink/?LinkId=160708).
For more information about requirements and installing Streaming Media Services on Windows
Server 2008 R2, see article 963697 in the Microsoft Knowledge Base
(http://go.microsoft.com/fwlink/?LinkID=160709).
183
Examples of features that help you control
communication to and from a server running
Windows Media Services
This subsection provides brief descriptions of some features in Windows Media Services 2008
that help you control communication to and from a server running Windows Media Services.
These features are integrated with two aspects of basic functionality built into the Windows
Server 2008 R2 operating system: Authentication and Authorization.
Authentication
Authentication is a fundamental aspect of security for a server running Windows Media Services.
It confirms the identity of any unicast client computer that is trying to access resources on your
server. Windows Media Services includes authentication plug-ins that you can enable to validate
user credentials for unicast client computers. Authentication plug-ins work together with
authorization plug-ins—after users are authenticated, authorization plug-ins control access to
unicast content.
Windows Media Services authentication plug-ins include the following categories:
 Anonymous authentication. These are plug-ins that do not exchange challenge and
response information between the server and a player, such as the WMS Anonymous User
Authentication plug-in.
 Network authentication. These are plug-ins that validate unicast client computers based on
user logon credentials, such as the WMS Negotiate Authentication plug-in.
When you make decisions about how authentication might affect users, consider the following:
 For multicast streaming with Windows Media Services 2008, client computers do not
establish a connection, and therefore authentication and authorization do not apply for
multicasting.
 If a player is connected through HTTP, the player disconnects from the server each time the
user stops, pauses, fast-forwards, or rewinds the content. If the user tries to continue
receiving the content, the authentication and authorization process occurs again.
For more information about authentication and about the specific authentication plug-ins that you
can enable for Windows Media Services, see Additional references later in this section.
Authorization
To control access to unicast content on your server running Windows Media Services, unless you
identify users only by IP address, you must enable one or more authentication plug-ins and one
or more authorization plug-ins. Authentication plug-ins verify the credentials of unicast client
computers that attempt to connect to the server. Authorization plug-ins verify that the unicast
client computer is allowed to connect to the server. Authorization occurs after authentication is
successful.
184
You can enable authorization plug-ins to control the access to content by authenticated users. If
you enable an authorization plug-in, with one exception, you must also enable an authentication
plug-in for unicast client computers to access your publishing points. The exception is the WMS
IP Address Authorization plug-in, which does not require an authentication plug-in to authenticate
a unicast client computer.
Note
For multicast streaming with Windows Media Services 2008, client computers do not
establish a connection, and therefore authentication and authorization do not apply for
multicasting.
During the authorization process, the server checks the user against the set of access
permissions for the resource to which the user is trying to connect.
For more information about authorization, see Additional references later in this section.
Firewall information for Windows Media Services

This subsection provides information about configuring firewalls or proxy servers for use with
Windows Media Services. For more information, see Using firewalls on the Microsoft Web site.
You can configure each control protocol plug-in (Real Time Streaming Protocol (RTSP) and
HTTP) to use a specific port to make firewall configuration easier. If opening ports on your firewall
is not possible, Windows Media Services can stream content by using the HTTP protocol over
port 80, which is typically open in most firewalls.
Note
Using HTTP to stream content is disabled by default.
Configuring firewalls for unicast streaming

To configure a firewall for unicast streaming, you must open the ports on the firewall that are
required for the connection protocols that are enabled on your server. If you are streaming
content by using the Real Time Streaming Protocol (RTSP), you need to support the User
Datagram Protocol (UDP) and Transmission Control Protocol (TCP).
To enable Windows Media Player and client computers to use the MMS, RTSP or HTTP
protocols to connect to a server running Windows Media Services that is behind a firewall, open
the ports described in the following table.
Note
Clients that connect to a server running Windows Media Services by using the MMS URL
moniker (for example, mms://) enable the server to use protocol rollover to stream the
content to the client. Automatic protocol rollover from RTSP/MMS to RTSP with UDP-
based or TCP-based transports (RTSPU or RTSPT), or HTTP (if the WMS HTTP Server
Control Protocol plug-in is enabled) can occur as the server tries to negotiate the best
protocol and provide an optimal streaming experience for the client.
185
Ports to open when client computers are connecting by using RTSP or HTTP protocols
Protocols and Ports Description
MMS over TCP (MMST) or MMS over UDP Port 1755 (In) accepts incoming MMS client
(MMSU):1755 (In) connections. The server uses protocol rollover
to deliver the data packets to clients using
RTSP or HTTP.
RTSP over TCP (RTSPT): Port 554 accepts incoming RTSP client
Port 554 (In/Out) connections and delivers data packets to client
computers that are streaming by using RTSPT.
RTSP over UDP (RTSPU): Port 5004 (Out) delivers data packets to client
Port 5004 (Out) and computers that are streaming by using RTSPU.
Port 5005 (In/Out) Port 5005 (In/Out) receives packet loss

information from client computers and provides
synchronization information to client computers
that are streaming by using RTSPU.
HTTP over TCP: Port 80 accepts incoming HTTP client

Port 80 (In/Out) connections and delivers data packets to client
computers that are streaming by using HTTP.
To enable a distribution server that is behind a firewall to use the HTTP or RTSP protocols to
stream content that originates from a server outside the firewall, open the ports described in the
following table.
186
Ports to open when a distribution server is behind a firewall and uses HTTP or RTSP to
stream content that originates from a server outside the firewall
Protocols and Ports Description
RTSP over TCP (RTSPT): Port 554 (Out) establishes an RTSP connection
Port 554 (Out) to the origin server.
RTSP over UDP (RTSPU): A port within the UDP In port range 1024-5000
Ports 1024-5000 (In) and receives data packets from the origin server.
Port 5005 (Out) UDP Out port 5005 sends correction-oriented

control messages to the origin server.
HTTP over TCP: Port 80 (Out) establishes an HTTP connection

Port 80 (Out) to the origin server.
Media Stream Broadcast A port within this UDP In port range receives
(MSB) over UDP: the multicast stream from the origin server. The
UDP In port number on the distribution server
Ports 1-65535 (In)
must match the UDP Out port number of the
origin server that is delivering the multicast.
For more information, see Additional references later in this section.
Configuring firewalls for multicast streaming

When you distribute content by using multicast streaming, network traffic is directed through one
of the class D IP addresses. Multicast IP addresses are class D addresses that fall within the
following ranges:
 IPv4: 224.0.0.0 to 239.255.255.255
 IPv6: FF00:0000:0000:0000:0000:0000:0000:0000 to
FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
For multicast streaming on an intranet, you must enable multicast forwarding on your network’s
routers. Windows Media Services supports the Internet Group Management Protocol (IGMP),
which ensures that multicast traffic passes through your network only when a player requests a
multicast connection, so that enabling multicasting on your routers does not exceed the capacity
of your network.
Important
Multicast streaming typically will not work over the Internet because forwarding of
multicast IP packets is not enabled on Internet routers.
To enable multicast streaming, you must allow packets that are sent to the standard multicast IP
address range to come through your firewall. This multicast IP address range must be enabled on
the player, the server, and every router in between.
187
For more information, see Delivering content as a multicast stream on the Microsoft TechNet
Web site.
For additional sources of information, including information about content sources (for example,
sourcing from an encoder), see Additional references later in this section.
Installable features associated with Windows

Media Services
The two main features in Windows Media Services are the service and the Windows Media
Services MMC snap-in. However, associated features can be installed on various servers in your
organization. The following table provides more information:
Feature Associated with Windows Media Description

Services
Windows Media Services service The service that enables you to stream digital
media content to client computers over an
intranet or the Internet.
Windows Media Services MMC snap-in The snap-in that you can use to configure and
manage Windows Media Services.
Windows Media Services Administrator for the A complete Web site that is hosted by Microsoft
Web Internet Information Services (IIS) on your
server running Windows Media Services. You
can access the Web site from any browser that
supports Active Server Pages (ASP).
For more information, see Installing Web-based
Administration.
Multicast and Advertisement Logging Agent An Internet Server Application Programming

Interface (ISAPI) logging application extension
that runs on a Web server.
For more information, see Installing Logging
Agent.
Test Stream utility A utility that can be used to test a publishing

point configuration and verify that it is working
as expected. The Test Stream utility requires
the Desktop Experience feature on Windows
Server 2008 R2.
For more information, see Install Desktop
Experience.
188
For more information about deploying Windows Media Services, see the following resources on
the Microsoft TechNet Web site:
 Streaming Media Services Role Overview
 Server Core Installation Option Getting Started Guide
 Windows Media Services Deployment Guide
Procedures for installing or removing Windows

Media Services and its associated features
 Add Windows Media Services on a server after setup is complete for Windows
Server 2008 R2.
 Remove Windows Media Services from a server on which it was previously installed.
For information about using the Server Core installation option for a server that will run Windows
Media Services, see Additional references later in this section.
To add Windows Media Services to an individual server after setup is complete for
1. Review hardware requirements and operating system requirements, review the choices
of installable features, and plan your installation.
2. Follow the instructions at the following Web site to download Windows Media Services:
Windows Media Services 2008 for Windows Server 2008 R2.
interface is displayed, under Customize This Server, click Add roles. Then skip to step
5.
want, and then click Continue.) In Server Manager, under Roles Summary, click Add
Roles.
5. In the Add Roles Wizard, if the Before You Begin page appears, click Next.
6. Select the Streaming Media Services role and follow the instructions in the wizard to
complete the installation process.
To remove Windows Media Services from an individual server

189
2. Under Roles Summary, click Remove Roles.
3. In the Remove Roles wizard, clear the check box for Streaming Media Services.
(In this wizard, you remove a role by clearing a check box (not by selecting a check box).
5. Click Start, and then click Control Panel.
6. Double-click Programs and Features.
7. Under Tasks, click View installed updates.
8. Under Uninstall an update, click Streaming Media Services update for Server
(KB963697), and then click Uninstall.
The following table of resources can help you as you plan or modify your implementation of
Windows Media Services and Windows Media Player in your organization.
Topic related to Windows Media Services Link
Downloading Windows Media Services 2008 for Windows

Server 2008 R2
Links to technical information Streaming Media Services
Installation information and Help Streaming Media Services Role Overview

(To view Help from the Windows Media
Services snap-in, press F1)
Server Core installation option Server Core Installation Option Getting Started
Guide
Deployment Windows Media Services Deployment Guide
Product information Windows Media Services 2008
Hardware requirements System requirements
Operating system choices Windows Media Services: Decide which version

of Windows Server is right for you
Firewalls Using firewalls
Multicasting Delivering content as a multicast stream
Content sources About content sources
Logs (sent from clients to servers) Privacy
190
Printed reference
Birney, B., Tricia Gill, and members of the Microsoft Windows Media Team. Microsoft Windows
Media Resource Kit. Redmond, WA: Microsoft Press, 2003.
191
Windows Time Service and Resulting
In this section
Benefits and purposes of Windows Time Service
Overview: Using Windows Time Service in a managed environment
How Windows Time Service communicates with Internet sites
Controlling Windows Time Service to limit the flow of information to and from the Internet
Configuration settings for Windows Time Service
Procedures for configuring Windows Time Service
Troubleshooting on a computer that is unable to synchronize with Windows Time Server
This section discusses how Windows Time Service in Windows® 7 and Windows
Benefits and purposes of Windows Time Service

Many features in Windows 7 and Windows Server 2008 R2 rely on accurate and synchronized
time to function correctly. For example, if clocks are not synchronized to the correct time on all
computers, the authentication process in Windows 7 and Windows Server 2008 R2 might falsely
interpret logon requests as intrusion attempts and deny access to the person logging on.
With time synchronization, you can correlate events on computers in an enterprise. When the
clocks on all of your computers are synchronized, you can correctly analyze events that happen
in a sequence on multiple computers. Windows Time Service automatically synchronizes a local
computer’s time with other computers on a network to improve security and performance in your
organization.
Overview: Using Windows Time Service in a

managed environment
Computers keep the time on their internal clocks, which allows them to perform any function that
requires the date or time. For scheduling purposes, however, the clocks must be set to the
correct date and time, and they must be synchronized with the other clocks in the network. If the
computers on the network do not have time synchronization, these clocks must be set manually.
192
With time synchronization, computers set their clocks automatically to match another computer's
clock. One computer maintains very accurate time, and then all other computers set their clocks
to match that computer. In this way, you can set accurate time on all computers.
Windows Time Service is installed by default on all computers running Windows 7 and Windows
Server 2008 R2. Windows Time Service uses Coordinated Universal Time (UTC), which is
independent of time zones. Time zone information is stored in each computer's registry, and it is
added to the system time before it is displayed to the user or administrator.
By default, Windows Time Service starts automatically on computers running Windows 7 and
Windows Server 2008 R2. In a domain, time synchronization takes place when Windows Time
Service turns on during system startup and periodically while the system is running. In the default
configuration, the Net Logon service looks for a domain controller that can authenticate and
synchronize time with the client. When a domain controller is found, the client sends a request for
time and waits for a reply from the domain controller. This communication is an exchange of
Network Time Protocol (NTP) packets, which calculate the time offset and round-trip delay
between the two computers.
How Windows Time Service communicates with

sites on the Internet
In Windows 7 and Windows Server 2008 R2, Windows Time Service automatically synchronizes
the local computer's time with other computers on the network. The time source for this
synchronization varies, depending on whether the computer is joined to a workgroup or to a
domain.
When a computer running Windows 7 or Windows

Server 2008 R2 is part of a workgroup
Within a workgroup, the default setting for the time synchronization frequency is set to "once per
week," and this default setting uses the time.windows.com site as the trusted time
synchronization source. This setting remains unless you manually set it otherwise. As an
alternative, you could choose one or more computers to be the locally reliable time source, and
configure Windows Time Service on those computers so that it uses a known accurate time
source (special hardware or a time source that is available on the Internet). All other computers in
the workgroup can be configured manually to synchronize their time with these local time
sources.
When a computer running Windows 7 or Windows

Server 2008 R2 is a member of a domain
Within a domain, Windows Time Service configures itself automatically by using the Windows
Time Service that is available on the domain controllers.
193
Windows Time Service on a domain controller can be configured as a reliable or an unreliable
time source. By default, Windows Time Service on computers running Windows 7 or Windows
Server 2008 R2 attempt to synchronize their time source with servers that are indicated as
reliable.
Communication between Windows Time Service and the Internet

The following list describes various aspects of Windows Time Service data that is sent to and
from the Internet and how the exchange of information takes place.
 Specific information sent or received: The service sends information in the form of a
Network Time Protocol (NTP) packet. For more information about Windows Time Service and
NTP packets, see the references listed in Additional references later in this section.
 Default settings: For a description of the default settings, see the following sections earlier in
this document:
 When a Computer Running Windows Windows 7 or Server 2008 R2 Is Part of a
Workgroup
 When a Computer Running Windows 7 or Windows Server 2008 R2 Is a Member of a
Domain
 Triggers and user notification: Windows Time Service is started when the computer starts.
Additionally, the service continues to synchronize time with the designated network time
source and adjust the computer time of the local computer when necessary. Notification is
not sent to the person using the computer.
 Logging: Information that is related to the service is stored in the Windows System event log.
This includes warning or error condition information in addition to the time and network
address of the time synchronization source.
 Encryption: Encryption is not used in the network time synchronization for domain peers.
(Authentication, however, is used.)
 Information storage: The service does not store information. All information that results from
the time synchronization process is lost when the time synchronization service request is
completed.
 Port: NTP uses User Datagram Protocol (UDP) port 123 on time servers. If this port is not
open to the Internet, you cannot synchronize your server to Internet NTP servers.
 Protocol: The service on Windows 7 and Windows Server 2008 R2 implements NTP to
communicate with other computers on the network.
 Ability to disable: Disabling the service is not recommended, because this might have
indirect effects on applications or other services. Applications and services that depend on
time synchronization, such as Kerberos V5 authentication protocol, may fail, or they may
yield undesirable results if there is a significant time discrepancy among computers. Because
most clocks on computers are imprecise, the time difference between computer clocks in a
network usually increases over time.
194
Controlling Windows Time Service to limit the
flow of information to and from the Internet
Group Policy can be used to control Windows Time Service for computers that are running
Windows 7 or Windows Server 2008 R2 to limit the flow of information to and from the Internet.
The synchronization type and NTP time-server information can be managed and controlled
through Group Policy. The Windows Time Service Group Policy object (GPO) contains
configuration settings that specify the synchronization type. When the synchronization type is set
to NT5DS, Windows Time Service synchronizes its time resource with a network domain
controller. Alternatively, setting the type attribute to NTP configures Windows Time Service to
synchronize with an NTP time server that is specified by a Domain Name System (DNS) name or
IP address.
Clients on a managed network can be configured to synchronize computer clock settings to an
NTP server on the network. This minimizes traffic to the Internet and ensures that the clients
synchronize to a single reliable time source. It is also possible (although not recommended) to
disable time synchronization for computers running Windows Server 2008 R2 by using Group
Policy. For more information, see Procedures for configuring Windows Time Service later in this
section.
How Windows Time Service can affect users and applications

Many Windows features and services depend on time synchronization. For example, the
Kerberos V5 authentication protocol on a Windows Server 2003 domain has a default time
synchronization threshold of five minutes. Computers in the domain that are more than five
minutes out of synchronization will fail to authenticate by using the Kerberos protocol. This time
value is also configurable, allowing for greater or lesser thresholds. Failure to authenticate using
the Kerberos protocol can prevent a user from logging on or accessing Web sites, shared
resources, printers, and other resources or services within a domain.
When the local clock offset is determined, the following adjustments are made to the time:
 If the local clock time of the client differs from the time on the server by more than the
threshold amount, Windows Time Service will change the local clock time immediately. The
threshold is five minutes if the computer is part of a domain. It is one second if the computer
is part of a workgroup. However, if a computer is part of a workgroup and the time differs
from the time source by more than 15 hours, the time is not synchronized, as described later
in this list.
 If the local clock time of the client differs from the server by less than the threshold amount,
the service will gradually synchronize the client with the correct time.
 In a workgroup, if the local clock time of the client differs from the time on a time source by
more than 15 hours, a workstation that is running Windows Time Service and using default
settings will not synchronize with the time source. Such occurrences are rare, and they are
often caused by configuration setting errors. For example, if a person sets the date on the
computer incorrectly, the time does not synchronize. Under these circumstances, most often
195
the time is off by a day or more. Be sure to check the calendar on the computer to ensure
that the correct date is set.
Configuration settings for Windows Time Service

You can set the global configuration settings for Windows Time Service by using Group Policy.
The settings that might be relevant for communication between Windows Time Service and the
Internet are described in this subsection.
In Computer Configuration under Policies (if present), in Administrative
Templates\System\Windows Time Service\Global Configuration Settings, there is only one
setting that might, in certain scenarios, affect the way that Windows Time Service communicates
when the computer is in a domain. This setting is AnnounceFlags, which controls whether this
computer is marked as a reliable time server. A computer is not marked as reliable unless it is
also marked as a time server. The settings are as follows:
 0 Not a time server
 1 Always a time server
 2 Automatic time server, meaning that the role is decided by Windows Time Service
 4 Always a reliable time server
 8 Automatic reliable time server, meaning that the role is decided by Windows Time Service
 10 The Windows Time Service decides the role. This is the default setting.
In the Group Policy settings located in Computer Configuration under Policies (if present), in
Administrative Templates\System\Windows Time Service\Time Providers\Configure
Windows NTP Client, there are a number of settings that might affect the way that Windows
Time Service communicates across the Internet. The following table describes some of these
policy settings.
Note
The table lists the settings that most directly affect the way Windows Time Service
communicates with time sources, but the table does not list all settings. For example, it
does not list the setting that specifies the location of the Windows Time Service DLL or
the setting that controls event logging for Windows Time Service.
196
Selected Group Policy settings for configuring the Windows Time Service NTP client for
computers running Windows Server 2008 R2
Setting Name and Effect Default Setting
NtpServer: time.windows.com, 0x1

Establishes a space-delimited list of peers from
which a computer obtains time stamps that
consist of one or more DNS names or IP
addresses per line. Computers that are
connected to a domain must synchronize with a
more reliable time source, such as the official
U.S. time clock. This setting is used only when
Type is set to NTP or AllSync.
 0x01 SpecialInterval
 0x02 UseAsFallbackOnly
 0x04 SymmetricActive
 0x08 NTP request in Client mode
Type: Workgroup: NTP

Indicates which peers to accept synchronization Domain: NT5DS
from as follows:
 NoSync Time service does not
synchronize with other sources.
 NTP Time service synchronizes from the
servers specified in the NtpServer registry
entry.
 NT5DS Time service synchronizes from
the domain hierarchy.
 AllSync Time service uses all the
available synchronization mechanisms.
CrossSiteSyncFlags: 2
Determines whether the service chooses
synchronization partners outside the domain of
the computer.
 None: 0
 PdcOnly: 1
 All: 2
This value is ignored if the NT5DS value is not
set.
197
Setting Name and Effect Default Setting
ResolvePeerBackoffMinutes: 15
Specifies the initial interval to wait, in minutes,
before attempting to locate a peer to
synchronize with. If the Windows Time Service
cannot successfully synchronize with a time
source, it will continue trying by using the
settings that are specified in
ResolvePeerBackoffMinutes and
ResolvePeerBackoffMaxTimes.
ResolvePeerBackoffMaxTimes: 7
Specifies the maximum number of times to
double the wait interval when repeated
attempts fail to locate a peer to synchronize
with. A value of zero means that the wait
interval is always the initial interval that is
selected in ResolvePeerBackoffMinutes.
SpecialPollInterval: Workgroup: 604800

Specifies the special poll interval in seconds for Domain: 3600
peers that have been configured manually.
When a special poll is enabled, Windows Time
Service uses this poll interval instead of a
dynamic one that is determined by the
synchronization algorithms built into Windows
Time Service.
For other sources of information about Group Policy, see Appendix B: Resources for Learning
About Group Policy for Windows 7 and Windows Server 2008 R2.
Procedures for configuring Windows Time Service

The following procedures explain how to set some of the Windows Time Service configuration
settings that are available in Group Policy. For details about other Group Policy settings for
Windows Time Service, see the table earlier in this section.
To set the Group Policy for Windows Time Service Global Configuration Settings
198
Templates, expand System, and then click Windows Time Service.
3. In the details pane, double-click Global Configuration Settings, and then click Enabled.
4. Configure the settings.
To Configure the Group Policy setting to prevent a computer running Windows 7 or

Windows Server 2008 R2 from synchronizing its computer clock with NTP servers
Templates, expand System, expand Windows Time Service, and then click Time
Providers.
3. In the details pane, double-click Enable Windows NTP Client, and then select
Disabled.
To configure the Group Policy setting to prevent a computer running Windows 7 or

Windows Server 2008 R2 from servicing time synchronization requests from other
computers on the network
Templates, expand System, expand Windows Time Service, and then click Time
Providers.
3. In the details pane, double-click Enable Windows NTP Server, and then select
Disabled.
Starting and stopping Windows Time Service

By default, Windows Time Service starts automatically at system startup. You can, however, start
or stop the service manually by accessing services in Administrative Tools or by using the net
command.
To manually start or stop Windows Time Service by using the graphical user interface
1. Click Start, and then click Control Panel.
2. Double-click Administrative Tools and then double-click Services.
4. Right-click Windows Time, and then click the action that you want to perform—Start or
Stop.
To manually start or stop Windows Time Service by using the net command
199
Programs, click Accessories, right-click Command Prompt, and click Run as
administrator.
3. At the command prompt, type the appropriate command, and then press ENTER.
 To start the service, type:
net start w32time
 To stop the service, type:
net stop w32time
Synchronizing computers with time sources

Use the following procedures to synchronize the internal time server with an external time source
and to synchronize the client time with a time server.
To view the complete syntax for W32tm, at a command prompt, type:
w32tm /?
To synchronize an internal time server with an external time source

administrator.
3. At the command prompt, type the following (where PeerList is a comma-separated list of
Domain Name System (DNS) names or Internet Protocol (IP) addresses of the desired
time sources):
w32tm /config /syncfromflags:manual /manualpeerlist:PeerList
and then press ENTER.
4. Type w32tm /config /update and then press ENTER.
Note
The most common use of this procedure is to synchronize the internal
network's authoritative time source with a precise external time source. This
procedure can be run on any computer that is running Windows 2000,
Windows XP, Windows Server 2003, Windows 7, or Windows
Server 2008 R2. If the computer cannot reach the servers, the procedure
fails and an entry is written to the Windows System event log.
The w32tm command-line tool is used for diagnosing problems that can occur with
Windows Time Service. If you are going to use the tool on a domain controller, it is
200
necessary to stop the service. Running the tool and Windows Time Service at the same
time on a domain controller generates an error because both are attempting to use the
same UDP port. When you finish using the w32tm command-line tool, you must restart
the service.
To synchronize the client time with a time server

administrator.
3. At the command prompt, type w32tm /resync, and then press ENTER.
Note
This procedure only works on computers that are joined to a domain.
Troubleshooting a computer that is unable to

synchronize with a time server
In many cases, problems with Windows Time Service can be attributed to network configuration.
If the network is not configured correctly, computers might not be able to send time samples back
and forth, and therefore will not be able to synchronize. Viewing the contents of NTP packets can
help you identify exactly where a packet is blocked on a network. You can also use the W32tm
command-line tool to assist you in troubleshooting this and other types of errors associated with
Windows Time Service.
By default, a standalone workstation running Windows Time Service will not synchronize with a
time source if the workstation’s time is more than 15 hours off. For information about scenarios in
which this can occur, see ―How Windows Time Service Can Affect Users and Applications,‖
earlier in this section.
To view the complete syntax for W32tm, at a command prompt, type:
w32tm /?
To resynchronize the time on a client computer with a time server

1. To open a Command Prompt window as an administrator, click Start, click All Programs,
click Accessories, right-click Command Prompt, and click Run as administrator.
2. If the User Account Control dialog box appears, confirm that the action it displays is what
you want, and then click Continue.
3. At the command prompt, type w32tm /resync /rediscover and then press ENTER.
Note
201
When you run the preceding command, it redetects the network configuration
and rediscovers network resources, causing resynchronization. This rediscovery
procedure only works on computers that are joined to a domain. You can then
view the event log for more information about why the time service does not
synchronize.
For more information, see following resources on the Microsoft® Web site:
 Configure the Windows Time Service
 Windows Time Service Technical Reference
202
Windows Update and Resulting Internet
Server 2008 R2
In this section
Benefits and purposes of Windows Update
Overview: Using Windows Update in a managed environment
How automatic updating communicates through the Internet
Controlling automatic updating and access to Windows Update to limit the flow of information to
and from the Internet
Procedures for controlling automatic updating and access to Windows Update
This section describes how the Windows® Update service in Windows 7 and Windows
Benefits and purposes of Windows Update

Windows Update is a service that can be used to support computers running Windows operating
systems, including Windows 7 and Windows Server 2008 R2. The service identifies items such
as drivers, critical updates, Windows Defender definition files, and other optional updates that can
enhance the use of Windows operating systems. If the user consents to turning it on, the
Windows Update service, which is built into Windows 7 and Windows Server 2008 R2, scans the
user’s computer, communicates with the Windows Update servers over the Internet, and then
creates a custom list of updates that apply only to the software and hardware on that specific
computer. New content is made available through the Windows Update service regularly, so
users have access to the most recent and secure updates and solutions.
Windows Update is not enabled when Windows 7 or Windows Server 2008 R2 are first installed.
After the installation of Windows 7 or Windows Server 2008 R2is complete and the first user logs
on, the Initial Configuration Tasks interface displays a variety of tasks including Enable
automatic updating and feedback. In this task, you can choose to enable automatic updating or
configure manual update settings. If you enable automatic updating, the operating system will
automatically install important and recommended updates to the computer when Microsoft®
releases them. When automatic updating is enabled, the user does not need to visit special Web
pages or remember to periodically check for updates. Even if automatic updates are enabled,
updates that are listed as optional are not downloaded or installed automatically.
203
Important
The first time that a user contacts a Windows Update Web server, users receive a
message requiring them to validate their copy of Windows. They are prompted to
download an ActiveX control which checks the authenticity of their Windows software
and, if successful in validating Windows, stores a special license file on the PC for future
verification. This ActiveX control is downloaded on the first validation and when a new
version is available from Microsoft. The Windows Genuine Advantage validation process
does not collect any information that can be used by Microsoft to identify or contact the
user. If the computer fails the Windows Genuine Advantage validation process, some
updates will not be downloaded or installed during the Windows Update process. Security
updates are not part of Windows Genuine Advantage and will be available for download
and installation even if this validation check fails. For more information, see Genuine
Windows in the Enterprise.
Windows Update options

If you do not perform the Enable automatic updating and feedback task through Initial
Configuration Tasks, automatic updating is not enabled. Instead, a reminder will appear
periodically with a choice between Have Windows install updates automatically and Let me
choose. You also have the choice to be reminded again later.
At any time, however, an administrator of a computer running Windows 7 or Windows
Server 2008 R2 can configure automatic updating through Control Panel. The available options
are:
 Install updates automatically: Windows 7 and Windows Server 2008 R2 download and
install updates automatically on a schedule that is specified by an administrator. Updates are
installed regardless of what type of account the user logs on with or whether a user is logged
on at the time the update occurs.
 Download updates but let me choose whether to install them: Windows 7 and Windows
Server 2008 R2 automatically start the download whenever they find updates available for
the computer. The updates are downloaded in the background, enabling the user to continue
working uninterrupted. After the download is complete, an icon in the notification area
prompts a person who is logged on as an administrator that the updates are ready to be
installed.
 Check for updates but let me choose whether to download and install them: Windows 7
and Windows Server 2008 R2 send a notification to which an administrator can respond by
downloading and installing the updates.
 Never check for updates: An administrator must occasionally run the Windows Update
service to check for and download updates.
204
Note
Even when the administrator selects one of the options that requires user or administrator
intervention, the Windows Update service checks for and automatically install updates for
the Windows Update service itself so that it can function properly.
An administrator can decline and optionally hide a specific update that has been automatically
downloaded. The administrator can download those hidden files later by opening Windows
Update and then clicking Restore hidden updates. If any of the declined updates can be applied
to the computer, those updates appear the next time that Windows 7 and Windows
Server 2008 R2 notify you about available updates.
For more information about configuring automatic updating on an individual computer running
Windows 7 or Windows Server 2008 R2, see Procedures for controlling automatic updating and
access to Windows Update later in this section.
Alternatives to automatic updating and the Windows Update

Web servers
For managed environments, the Windows Update Web servers offers the following alternatives to
using automatic updating:
 Systems management software that allows you to distribute software updates
Windows Server Update Services

Windows Server Update Services (WSUS) is a version of Windows Update that is designed for
installation inside the boundary defined by an organization's firewall. This feature is very useful
for organizations that:
 Do not want their systems or users connecting to an update server on an external Web site.
 Want to test software updates before deploying them throughout their organizations.
With WSUS, administrators can quickly and reliably deploy critical updates to computers running
Windows 7, Windows Server 2008 R2, and other Windows operating systems.
For more information, see the following Microsoft Web sites:
Systems management software

You can use systems management software such as Microsoft Systems Management Server to
distribute updates and manage multiple computers in an organization.
For more information, see Microsoft Systems Management Server.
205
Overview: Using Windows Update in a managed
environment
As an administrator, you can use Group Policy settings to block access to the Windows Update
server or to specify an internal server to use for automatic updating. You can also disable
automatic updating through the Windows interface or by using Group Policy settings. Details
about these methods and procedures for controlling these features are described later in this
section.
How automatic updating communicates through

the Internet
This subsection summarizes the communication process.
 Specific information sent or received: Windows Update collects basic information about
the computer to identify which updates the computer needs and to improve the updating
service. Drivers and replacement files (such as critical updates, definition files, and optional
components) can be downloaded to the user’s computer.
For more details, see Update Services Privacy Statement
 Triggers: The user controls whether to download updates by using Windows Update. If
automatic updating is enabled, it checks for updates on a defined basis (assuming that there
is an Internet connection).
 User notification:
 Windows Update: Users control whether to download files from Windows Update to their
computers.
 Automatic updating: The way that automatic updating notifies the user depends on how
automatic updating is configured. For more information, see Automatic updating earlier in
this section.
Note
For information about configuring automatic updating, see To disable or
configure automatic updating on a computer running Windows 7 or
Windows Server 2008 R2 later in this section.
 Logging: Automatic updating logs events to the event log and to Microsoft.
The Windows Update servers track the total number of unique computers that visit, whether
updates were needed, and which updates were applied. The success or failure of
downloading and installing updates is also recorded. This information is stored on servers
with limited access that are located in Microsoft-controlled facilities.
For more details, see Update Services Privacy Statement.
206
Warning
If you want to block the Windows Update service, you can apply Group Policy
settings to specify an internal server to download updates and store logging data.
For more information, see Procedures for controlling automatic updating and
access to Windows Update later in this section.
 Encryption: Initial data is transferred using HTTPS, that is, Secure Sockets Layer (SSL) or
Transport Layer Security (TLS) with HTTP, and updates are transferred using HTTP. The
data packages downloaded to the user’s system by Microsoft are digitally signed and
encrypted using SHA-1 hash functions.
 Privacy: Automatic updating is covered by the same privacy statement that covers Windows
Update. For more information, see Update Services Privacy Statement.
 Transmission protocols and ports: The transmission protocols and ports used are HTTP
80 and HTTPS 443.
 Ability to disable: You can use Group Policy settings to prevent updates to the operating
system through the Windows Update service and to prevent access to Windows Update
commands (on menus). You can use Group Policy settings to specify an internal server to
use for automatic updating. You can also disable automatic updating by using the Windows
interface or Group Policy. Procedures for these methods are explained at the end of this
section.
Controlling automatic updating and access to

Windows Update to limit the flow of information to
and from the Internet
The recommended methods for controlling automatic updating and access to Windows Update
are as follows:
 You can use Group Policy settings to selectively disable automatic updating.
To do this, disable Configure Automatic Updates. This policy setting is located in
Templates\Windows Components\Windows Update.
 You can use Group Policy settings to configure automatic updating so that instead of
searching Windows Update on external servers, automatic updating searches your internal
server for updates.
To do this, configure Specify intranet Microsoft update service location. This policy
setting is located in Computer Configuration under Policies (if present), in Administrative
Templates\Windows Components\Windows Update. The server that you specify in this
setting must be running Windows Server Update Services (WSUS).
207
 You can use Group Policy settings to disable automatic updates from the Windows Update
servers.
 To prevent the operating system from being updated through the Windows Update
service, configure Turn off access to all Windows Update features. This policy setting
is located in Computer Configuration under Policies (if present), in Administrative
Templates\System\Internet Communication Management\Internet Communication
settings.
 To prevent access to Windows Update commands (on menus), configure Remove links
and access to Windows Update. This policy setting is located in User Configuration
under Policies (if present), in Administrative Templates\Start Menu and Taskbar.
You can also configure automatic updating on an individual computer running Windows 7 or
Windows Server 2008 R2 by using the Windows interface. For a description of the options
available through the Windows interface, see Automatic updating earlier in this section.
How disabling automatic updating or preventing access to

Windows Update can affect users and applications
The following Group Policy settings affect automatic updating and access to Windows Update:
 Turn off access to all Windows Update features: This Group Policy setting is located in
Templates\System\Internet Communication Management\Internet Communication
settings.
When you enable this setting, the operating system cannot be updated through the Windows
Update servers. Users or administrators can still perform actions such as clicking the
Windows Update option on the Start menu. However, it is not possible to update the
operating system through the Windows Update servers, regardless of the type of account
being used to log on.
 Remove links and access to Windows Update: This Group Policy setting is located in
User Configuration under Policies (if present), in Administrative Templates\Start Menu
and Taskbar. When you enable this setting, users cannot access the Windows Update
servers when they click Check for updates in the Windows Update Control Panel.
The Windows Update tool can be reached in the following ways:
 In Microsoft Internet Explorer®:
Click Tools, and then click Windows Update.
 In Windows 7 and Windows Server 2008 R2:
 Click Start or click Start, then click All Programs. Then click Windows Update.
 Click Start, click Control Panel, and then click Windows Update.
Check for updates is on the left.
208
Enabling Remove links and access to Windows Update also disables automatic updating
notifications. The user will not be notified about or receive critical updates from the Windows
Update servicers.
Preventing all access to the Windows Update servers also prevents Device Manager from
automatically installing driver updates from the Windows Update servers. For more information
about controlling Device Manager, see the section of this document titled Device Manager,
Hardware Wizards, and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2.
Blocking automatic updating and access to the Windows Update Web site does not block
applications from running.
Procedures for controlling automatic updating

and access to Windows Update
This subsection provides procedures for the following tasks:
 Configuring or disabling automatic updating by using Group Policy.
 Preventing the operating system from being updated through Windows Update by using
Group Policy.
 Turning off access to Windows Update commands and to automatic updating by using Group
Policy.
 Specifying an internal server (instead of the Windows Update servers) for software updates
by using Group Policy.
 Disabling or configuring automatic updating on an individual computer that is running
Windows 7 or Windows Server 2008 R2.
To disable or configure automatic updating by using Group Policy

Templates, expand Windows Components, and then click Windows Update.
3. In the details pane, double-click Configure Automatic Updates.
4. To disable automatic updating, select Disabled.
Note
Disabling this setting disables automatic updating, but it does not block
access to Windows Update.
5. To configure automatic updating, select Enabled, and then select from the available
settings, which are equivalent to the Control Panel settings as shown in the following
table:
209
Setting in Control Panel Setting in Group Policy When Policy Is
Enabled
Any setting (except when automatic 5 - Allow local administrator to choose the
updating cannot be turned off) setting
Install updates automatically 4 - Automatically schedule and download

the update
Download updates but let me choose 3 - Automatically download the update

whether to install them and notify the user that the update is
ready to install
Check for updates but let me choose 2 - Notify for the user that the update is
whether to download and install them ready to download and then notify the
user that the update is ready to install
The Control Panel settings are described in more detail in Automatic updating earlier in
this section.
To use Group Policy to prevent the operating system from being updated through
Windows Update
3. In the details pane, double-click Turn off access to all Windows Update features, and
then click Enabled.
Important
This policy also disables automatic updating.
the Restrict Internet communication Group Policy setting, which is located in
this Group Policy setting and the policies that it controls, see Appendix C: Group Policy
Settings Listed Under the Internet Communication Management Category in Windows 7
and Windows Server 2008 R2.
To turn off access to Windows Update commands by using Group Policy

210
Templates, and then click Start Menu and Taskbar.
3. In the details pane, double-click Remove links and access to Windows Update, and
then click Enabled.
Important
This policy also disables automatic updating.
To specify an internal server for software updates by using Group Policy

Templates, expand Windows Components, and then click Windows Update.
3. In the details pane, double-click Specify intranet Microsoft update service location,
and then click Enabled.
4. Specify the name of the internal server to function as the update server, and specify the
name of the server to store upload statistics.
Important
You must specify an upgrade server and a server to store upload statistics,
but they can be the same server. The server that you specify as the upgrade
server must be one on which you are running Windows Server Update
Services (WSUS).
To disable or configure automatic updating on a computer running Windows 7 or

1. While logged on with an administrator account, click Start, click All Programs, and then
click Windows Update.
2. Click Change settings.
3. Choose from the available options (which are described in Automatic updating earlier in
this section).
211
Appendix A: Resources for Learning About
Automated Installation and Deployment for
In this appendix
Overview: Automated installation and deployment methods in a managed environment
Methods for automating the setup process
Overview: Automated installation and deployment

methods in a managed environment
In a managed environment where one of the goals might be to limit communication with the
Internet (as described in other sections of this document), it is often not cost-effective to install
Windows® 7 and Windows Server® 2008 R2 by using the standard interactive setup on each
computer. To greatly lower the total cost of ownership and ensure configuration uniformity, you
can perform an automated installation of Windows 7 and Windows Server 2008 R2 on multiple
computers. By using an automated installation method, you can ensure that certain features and
applications are not available on your organization’s servers, or that certain features and
applications are preconfigured in a way that helps prevent unwanted communication over the
Internet.
Methods for automating the setup process

There are multiple options for automating the setup process. If you are working to configure your
organization's computers to appropriately limit communication over the Internet, the following
tools might be useful:
 Unattended setup using Setup.exe
An unattended setup enables you to simplify the process of setting up the operating system
on multiple computers. To run an unattended setup, you can create and use an answer file
(an answer file is a customized script that answers setup questions automatically). Then run
Setup.exe from the command line with the appropriate options for invoking an unattended
setup. For information about Windows System Image Manager (SIM), a tool that makes it
easier to create and validate answer files, see Using Windows System Image Manager to
create answer files later in this section.
By using Setup.exe, you can upgrade your previous version of the operating system by using
all user settings from the previous installation, or you can perform a fresh installation using an
answer file to provide Setup with your custom settings. The latter method is the best option to
212
limit the way features communicate over the Internet, provided you use an appropriate
answer file. Other sections of this document include answer file entries that are relevant to
the features that are described.
 Windows Deployment Services
Windows Deployment Services is the updated and redesigned version of Remote Installation
Services (RIS). With Windows Deployment Services, you can install operating system images
(.wim files) over the network. You can install the operating system by itself, or you can install
a complete computer configuration, including desktop settings and applications. Windows
Deployment Services applies images that are created by the Windows Deployment Services
Capture Wizard or by ImageX, which is included in the Windows Automated Installation Kit
(AIK).
For more information, see Windows Deployment Services on the Microsoft® Web site.
 Image-based installation using the System Preparation (Sysprep) tool

An image-based installation is a good choice if you need to install an identical configuration
on multiple computers. You can use the Sysprep tool in conjunction with a disk-imaging tool
to create the images to be deployed.
For an image-based installation, you install a master computer with the operating system and
any applications that you want installed on all of the target computers. Then you run Sysprep
to prepare the computer for imaging, and then run a disk imaging utility to capture the image.
Sysprep prepares the hard disk on the master computer so that the disk imaging utility can
create a generic image of the hard disk to be deployed to other computers.
You can customize the images so that only the files that are required for a specific
configuration appear on the image, such as additional Plug and Play drivers that might be
needed on various systems. The image can also be copied to a CD or DVD and distributed to
remote sites that have slow Internet connections.
 System management software, such as Microsoft Systems Management Server (SMS)
This type of software assists with the many tasks that are involved when you apply
automated procedures to multiple servers and client computers throughout your organization.
These tasks include:
 Selecting computers that have the hardware that is necessary for a given operating
system and that you are ready to support.
 Distributing the operating system source files to all sites, including remote sites and sites
without technical support staff.
 Monitoring the distribution to all sites.
 Providing the appropriate user rights for the upgrade.
 Automatically initiating the installation of software packages, with the possibility of having
the person who uses the computer control the timing.
 Resolving problems that are related to the distributions or installations.
213
 Reporting the rate and success of deployment.
Using system management software helps ensure that all the computers within your organization
receive the standardized operating system configuration that helps prevent unwanted
communication over the Internet.
Using Windows System Image Manager to create answer files

Windows SIM provides a graphical user interface with which you can create and validate answer
files for an unattended setup. Instead of typing information into an answer file, you can use the
graphical user interface to create an initial version of an answer file (based on a Windows image),
and then modify the answer file. For example, you could select components or specify driver
paths.
For more information, see Windows Automated Installation Kit (Windows AIK) User's Guide.
Using scripts for configuring computers

In addition to the automated installation methods described here, another common method of
controlling the configuration of computers in a domain is to use scripts. For more information
about scripts, see the links in the following Additional references.
You can find additional information about the topics described in this appendix on the following
Microsoft Web sites:
 Windows Automated Installation Kit (Windows AIK) User's Guide
 Windows Deployment Services
 Script Center
 Windows Script Host
 Appendix B: Resources for Learning About Group Policy for Windows 7 and Windows Server
2008 R2
214
Appendix B: Resources for Learning About
Group Policy for Windows 7 and Windows
Server 2008 R2
In this appendix
Installing the Group Policy Management Console on a computer running Windows 7
Installing the Group Policy Management Console on a computer running Windows
Server 2008 R2
Using the Group Policy Management Console to view or change settings
The Group Policy Management Console (GPMC) unifies the management of all aspects of Group
Policy. By using the GPMC, you can manage Group Policy objects (GPOs), Windows
Management Instrumentation (WMI) filters, and permissions on your network.
Installing the Group Policy Management Console

on a computer running Windows 7
The following procedure explains how to install the GPMC on Windows® 7.
To install the GPMC on a computer running Windows 7

1. Download the Administrative Tools package from the following Microsoft® Web site to a
location on your computer:
Remote Server Administration Tools for Windows 7
2. Open the folder where the package downloaded, double-click the package name, and
then click Remote Server Administration Tools for Windows 7 Setup Wizard.
Note
You must accept the License Terms and Limited Warranty to install the
Administration Tools package.
4. Click Start, click Control Panel, and then click Programs and Features.
5. Click Turn Windows features on or off.
7. In the Windows Features dialog box, expand Remote Server Administration Tools,
and then expand Feature Administration Tools.
215
8. Select Group Policy Management Tools check box, and then click OK.
Installing the Group Policy Management Console

on a server running Windows Server 2008 R2
The following procedure explains how to install the GPMC on Windows Server® 2008 R2.
To install the GPMC on a server running Windows Server 2008 R2

step 3.
3. In Server Manager, under Features Summary, click Add Features.
4. In the Add Features Wizard, select the Group Policy Management check box.
Using the Group Policy Management Console to

view or change Group Policy settings
Some settings in Group Policy were added in Windows 7 and Windows Server 2008 R2, some
existed previously and continue to work for Windows 7 and Windows Server 2008 R2, and some
settings that you see in Group Policy in Windows Server 2008 R2 have an effect on previous
operating systems, but they do not affect Windows 7 and Windows Server 2008 R2.
To change settings that were added in Windows 7 and Windows Server 2008 R2, use the
following procedure.
To view or change Group Policy settings

1. Using an account with membership in Domain Admins, Enterprise Admins, or an
equivalent group, log on to a computer on which either of the following operating systems
is installed:
 Windows Server 2008 R2 and the GPMC.
 Windows 7 and the GPMC that is included in Remote Server Administration Tools.
After you install the Remote Server Administration Tools, you must turn on the GPMC
as follows: Open Control Panel, click Programs, and then click Turn Windows
features on or off. In the resulting dialog box, expand the list for Remote Server
Administration Tools, expand the list for Feature Tools, and then select Group
216
Policy Management Tools.
2. Open the GPMC by using one of the following methods:
 In Windows Server 2008 R2, click Start, point to Administrative Tools, and then
click Group Policy Management.
 In Windows 7, click Start, click Control Panel, click System and Maintenance, click
Administrative Tools, and then double-click Group Policy Management.
 In either operating system, click Start, and in the Search box type: gpmc.msc
4. In the GPMC, double-click Group Policy Objects in the forest and domain containing the
Group Policy object (GPO) that you want to edit.
5. Edit the appropriate GPO, or create and link a new GPO and then edit it.
For information about how to work with Group Policy objects, in Group Policy
Management, press F1, and then search Help for an appropriate topic, such as Link a
Group Policy Object or Edit a Group Policy Object.
6. In the Group Policy Management Editor (which opens when you edit a GPO), view or
change settings as appropriate.
Note
We recommend that when you view an individual setting, you click the
Extended tab and view the Requirements (operating system requirements)
that are listed for the setting.
For more information about Group Policy and the GPMC, see the following resources on the
Microsoft® Web site:
 Group Policy Management Console
 Windows Server Group Policy Web site
 Group Policy Settings Reference for Windows Server 2008 and Windows Vista SP1
 Use Windows PowerShell to Manage Group Policy
Also refer to the following section in this document:
 Appendix C: Group Policy Settings Listed Under the Internet Communication Management
Category in Windows 7 and Windows Server 2008 R2
217
Appendix C: Group Policy Settings Listed
Under the Internet Communication
Management Category in Windows 7 and
In this appendix
Overview of Group Policy settings listed under the Internet Communication Management
category
Controlling multiple Group Policy settings through the Restrict Internet Communications setting
Group Policy settings that affect computer configuration
Group Policy settings that affect user configuration
Overview of Group Policy settings listed under

the Internet Communication Management
category
Windows® 7 and Windows Server® 2008 R2 contain a variety of Group Policy settings that can
help you control the way that operating system features communicate across the Internet. This
appendix describes the Group Policy settings that are presented under the Internet
Communication Management category. It also describes how the Restrict Internet
communication setting controls multiple other policy settings.
Important
The Restrict Internet communication policy setting controls the policy settings under
Internet Communication Management only. In this document, when there is a
procedure about a policy setting that is controlled by Restrict Internet communication,
a note after the procedure describes the control relationship.
You can find Internet Communication Management in the following two locations in the Group
Policy Management Console:
 In Computer Configuration under Policies (if present), in Administrative
Templates\System.
 In User Configuration, under Policies (if present), in Administrative Templates\System.
For information about using the Group Policy Management Console (GPMC), see Appendix B:
Resources for Learning About Group Policy for Windows 7 and Windows Server 2008 R2.
218
Controlling multiple Group Policy settings
through the Restrict Internet Communications
setting
There are multiple ways to configure the Group Policy settings under Internet Communication
Management in Windows 7 and Windows Server 2008 R2. You can configure policy settings
individually, which means you could configure, for example, Turn off Event Viewer
"Events.asp" links differently from Turn off Windows Error Reporting. Alternatively, the policy
setting called Restrict Internet communication allows you to enable or disable the entire
collection of policy settings at one time.
If you want to enable or disable Restrict Internet communication and then create exceptions to
this master policy setting by configuring individual policy settings in Internet Communication
Management, you must use two Group Policy objects (GPOs).
Before you begin, ensure that you understand how processing and precedence works for multiple
GPOs (for more information, see Help in the Group Policy Management Console (GPMC).
Choose or create a GPO with a lower precedence than another GPO. In the GPO with lower
precedence, enable or disable Restrict Internet communication. Then, in the GPO that has
precedence, apply the individual policy settings that are exceptions to the master policy setting.
If you do not use two GPOs when you set Restrict Internet communication and the individual
policy settings that are exceptions to the master policy setting, the policy settings might not work
as expected. To check the effect of multiple Group Policy settings, you can view Group Policy
Results in the GPMC.
For more information, see Group Policy processing and precedence on the Microsoft® Web site.
Group Policy settings that affect computer

configuration
This subsection describes the Group policy settings that are under Computer Configuration in
Internet Communication Management. (The policy settings under User Configuration are
described later in this appendix.) These policy settings apply to all users of an affected computer,
and they come into effect when the computer starts or when Group Policy is refreshed.
These policy settings are located in Computer Configuration under Policies (if present), in
All of the policy settings can be enabled or disabled in one step by enabling or disabling the
master policy setting that controls them, Restrict Internet communication. This policy setting is
located in Computer Configuration under Policies (if present), in Administrative
Templates\System\Internet Communication Management, and it is described in Controlling
multiple Group Policy settings through the Restrict Internet Communications setting earlier in this
section.
219
Note
This appendix describes only the policy settings that are available under Internet
Communication Management. For information about all the Group Policy settings that
are available in Windows 7 and Windows Server 2008 R2, see the Group Policy Settings
Reference on the Microsoft Web site.
Individual Group Policy settings that affect computer

configuration for Windows Server 2008 R2
Note
The Restrict Internet communication policy setting interacts with all of the policy
settings in the following list.
The following list describes the Computer configuration policy settings. More details about each
policy setting are available in the Explain text for the policy setting. To view Explain text, select
the policy setting in Group Policy and click the Extended tab, or open the policy setting and click
the Explain tab.
 Turn off access to all Windows Update features: Specifies whether Windows Update can
be used to update the operating system on this computer.
This policy setting is described in the Windows Update and Resulting Internet
Communication in Windows 7 and Windows Server 2008 R28 section in this document.
 Turn off Automatic Root Certificates Update: Specifies whether to automatically update
root certificates by using the list of trusted certification authorities that Microsoft maintains on
the Windows Update Web site. If you enable this policy setting, when a user is presented with
a certificate that is issued by an untrusted root authority, the user's computer will not contact
the Windows Update Web site.
 Turn off downloading of print drivers over HTTP: Specifies whether to allow this computer
to download print drivers over HTTP when needed.
This policy setting and other policy settings related to Internet printing are described in the
Internet Printing and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 section in this document.
 Turn off Event Viewer "Events.asp" links: Specifies whether the Internet links that are
shown within events in Event Viewer are activated. When such a link is activated and the
user clicks it, information that identifies the event is sent to a Microsoft Web site so that
explanatory text, if available, can be sent back to the user.
This policy setting and the information that is sent and received when an Event Viewer link is
clicked are described in the Event Viewer and Resulting Internet Communication in Windows
7 and Windows Server 2008 R2 section in this document.
 Turn off handwriting personalization data sharing: Turns off data sharing from the
handwriting recognition personalization tool. The handwriting recognition personalization tool
enables Tablet PC users to adapt handwriting recognition to their own writing style by
220
providing writing samples. The tool can optionally share user writing samples with Microsoft
to improve handwriting recognition in future versions of Windows. The tool generates reports
and transmits them to Microsoft over a secure connection.
If you enable this policy, Tablet PC users cannot choose to share writing samples from the
handwriting recognition personalization tool with Microsoft. If you disable this policy, Tablet
PC user writing samples from the handwriting recognition personalization tool will
automatically be shared with Microsoft. If you do not configure this policy, Tablet PC users
can choose whether or not they want to share their writing samples from the handwriting
recognition personalization tool with Microsoft.
 Turn off handwriting recognition error reporting: Specifies whether users can report
errors that they encounter in the Tablet PC Input Panel. This policy setting is related to the
policy setting Turn off Windows Error Reporting. If you turn off Windows Error Reporting,
you are also turning off error reporting for handwriting recognition.
This policy setting is also described in Windows Error Reporting and the Problem Reports
and Solutions Feature in Windows 7 and Windows Server 2008 R2 in this document.
 Turn off Help and Support Center "Did you know?" content: This policy setting does not
affect Windows 7 and Windows Server 2008 R2. For a similar policy setting that affects
Windows 7 and Windows Server 2008 R2, see Turn off Windows Online in Group Policy
settings that affect user configuration later in this section.
 Turn off Help and Support Center Microsoft Knowledge Base search: This policy setting
does not affect Windows 7 and Windows Server 2008 R2. For a similar policy setting that
affects Windows 7 and Windows Server 2008 R2, see Turn off Windows Online in Group
Policy settings that affect user configuration later in this section.
 Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com:
This policy setting does not affect Windows 7 and Windows Server 2008 R2.
 Turn off Internet download for Web publishing and online ordering wizards: Specifies
whether Windows should download a list of providers for the Order Prints Wizard. By default,
Windows displays providers that are downloaded from a Windows Web site in addition to
providers that are specified in the registry.
If you enable this policy setting, Windows will not download providers and only the service
providers that are stored in the local registry are displayed. When Windows 7 is installed but
the Order Prints Wizard has not been used, no service providers are stored in the local
registry. If this Group Policy setting is applied at that time, the wizard will not display links to
service providers.
This policy has an effect in Windows Server 2008 R2 only if the Desktop Experience is
installed. This policy setting is also described in Appendix J: Wizards in Windows 7 and
Windows Server 2008 R2 Related to Connecting to the Internet in this document.
 Turn off Internet File Association service: Specifies whether to use the Web-based File
Association service or whether to use only locally stored information about file name
extensions and file types. It also specifies the applications or features to use when opening a
221
particular file type. The file association Web service is used only when a user tries to open a
file and there is no locally stored information about the file name extension.
This policy setting is also described in the File Association Web Service and Resulting
Internet Communication in Windows 7 and Windows Server 2008 R2 section in this
document.
 Turn off printing over HTTP: Specifies whether to allow printing over HTTP from this
computer. Note that this policy setting does not control whether the computer can act as an
Internet print server.
This policy setting and other policy settings related to Internet printing are described in the
Internet Printing and Resulting Internet Communication in Windows 7 and Windows Server
2008 R2 section in this document.
 Turn off Registration if URL connection is referring to Microsoft.com: This policy setting
does not affect Windows 7 and Windows Server 2008 R2.
 Turn off Search Companion content file updates: This policy setting does not affect
 Turn off the "Order Prints" picture task: Specifies whether the Order Prints Wizard can be
run from Windows Photo Gallery.
This policy has an effect in Windows Server 2008 R2 only if the Desktop Experience is
 Turn off the "Publish to Web" task for files and folders: This policy setting does not affect
 Turn off the Windows Messenger Customer Experience Improvement Program: This
policy setting does not affect Windows 7 and Windows Server 2008 R2.
 Turn off Windows Customer Experience Improvement Program: Specifies whether to opt
users out of Windows Customer Experience Improvement Program. If you enable this policy
setting, all users are opted out of Windows Customer Experience Improvement Program.
This policy setting is also described in the Windows Customer Experience Improvement
Program and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2
section in this document.
 This policy setting and root certificate updates are described in the Certificate Support and
Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 section in this
document.
 Turn off Windows Error Reporting: Specifies whether error reports from a system or
application that has stopped responding are sent to Microsoft. Error reports are used to
improve the quality of the product. This policy setting overrides any user setting that is made
from the Control Panel for error reporting.
This policy setting and other ways of controlling error reporting through Group Policy are
described in the Windows Error Reporting and the Problem Reports and Solutions Feature in
Windows 7 and Windows Server 2008 R2 section in this document.
222
 Turn off Windows Network Connectivity Status Indicator active tests: Prevents Network
Connectivity Status Indicator (NCSI) from performing a network connectivity test that involves
attempting to make a connection across the Internet. For more information about NCSI, see
Appendix H: Network Connectivity Status Indicator and Resulting Internet Communication in
 Turn off Windows Update device driver searching: Specifies whether Windows searches
Windows Update for device drivers when no local drivers for a device are present.
This policy setting is described in the Device Manager, Hardware Wizards, and Resulting
document.
 Turn off Windows Movie Maker automatic codec downloads: This policy setting does not
affect Windows 7 and Windows Server 2008 R2.
Group Policy settings that affect user

configuration
This subsection describes the policy settings under User Configuration in Internet
Communication Management. These policy settings apply to the individual user, and they come
into effect when the user logs on or when Group Policy is refreshed.
These policy settings are located in User Configuration under Policies (if present), in
All of the policy settings can be enabled or disabled in one step by enabling or disabling the
master policy setting that controls them, Restrict Internet communication. This policy setting is
located in User Configuration under Policies (if present), in Administrative
Templates\System\Internet Communication Management, and it is described in Controlling
multiple Group Policy settings through the Restrict Internet Communications setting earlier in this
section.
Note
This appendix describes only the policy settings available under Internet
Communication Management. For information about all the Group Policy settings that
are available in Windows 7 and Windows Server 2008 R2, see the Group Policy Settings
Reference on the Microsoft Web site.
Group Policy settings that affect user configuration in

Note
The Restrict Internet communication policy setting interacts with all of the policy
settings in the following list.
223
The following list represents the user configuration policy settings under Internet
Communication Management that affect Windows 7 and Windows Server 2008 R2. You can
also select the policy setting in Group Policy and click the Extended tab, or open the policy
setting and click the Explain tab.
 Turn off downloading of print drivers over HTTP: Specifies whether to allow this computer
to download print drivers over HTTP when needed.
This policy setting and other policy settings that are related to Internet printing are described
in the Internet Printing and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 section in this document.
 Turn off handwriting personalization data sharing: Turns off data sharing from the
handwriting recognition personalization tool. The handwriting recognition personalization tool
enables Tablet PC users to adapt handwriting recognition to their own writing style by
providing writing samples. The tool can optionally share user writing samples with Microsoft
to improve handwriting recognition in future versions of Windows. The tool generates reports
and transmits them to Microsoft over a secure connection.
If you enable this policy, Tablet PC users cannot choose to share writing samples from the
handwriting recognition personalization tool with Microsoft. If you disable this policy, Tablet
PC user writing samples from the handwriting recognition personalization tool will
automatically be shared with Microsoft. If you do not configure this policy, Tablet PC users
can choose whether or not they want to share their writing samples from the handwriting
recognition personalization tool with Microsoft.
 Turn off handwriting recognition error reporting: Specifies whether users can report
errors that they encounter in the Tablet PC Input Panel. This policy setting is related to Turn
off Windows Error Reporting, which is described in Individual Group Policy settings that
affect computer configuration for Windows Server 2008 R2 earlier in this appendix. If you turn
off Windows Error Reporting, you are also turning off error reporting for handwriting
recognition.
This policy setting is also described in the Windows Error Reporting and the Problem Reports
and Solutions Feature in Windows 7 and Windows Server 2008 R2 section in this document.
 Turn off Help Experience Improvement Program: Specifies whether users can participate
in the Help Experience Improvement program. The Help Experience Improvement program
collects information about how customers use Windows Help so that Microsoft can improve it.
If this setting is enabled, this policy prevents users from participating in the Help Experience
Improvement program. If this setting is disabled or not configured, users will be able to turn
on the Help Experience Improvement program feature from the Help and Support settings
page.
 Turn off Help Ratings: Specifies whether, when Online Help is turned on, a user can enter
feedback into a form at the bottom of a Help topic, and then send that feedback back to
Microsoft.
This policy setting is also described in Help and Support Features that Communicate
Through the Internet in Windows 7 and Windows Server 2008 R2 in this document.
224
 Turn off Internet download for Web publishing and online ordering wizards: Specifies
whether Windows should download a list of providers for the Order Prints Wizard. By default,
Windows displays providers that are downloaded from a Windows Web site in addition to
providers that are specified in the registry.
If you enable this policy setting, Windows will not download providers and only the service
providers that are stored in the local registry are displayed. When Windows 7 is installed but
the Order Prints Wizard has not been used, no service providers are stored in the local
registry. If this Group Policy setting is applied at that time, the wizard will not display links to
service providers.
This setting affects users on Windows Server 2008 R2 only if the Desktop Experience is
 Turn off Internet File Association service: Specifies whether to use the Web-based File
Association service or whether to use only locally stored information about file name
extensions and file types. It also specifies the applications or features to use when opening a
particular file type. The file association Web service is used only when a user tries to open a
file and there is no locally stored information about the file name extension.
This policy setting is also described in the File Association Web Service and Resulting
document.
 Turn off printing over HTTP: Specifies whether to allow printing over HTTP for this user.
This policy setting does not control whether the computer can act as an Internet print server.
This policy setting and other policy settings that are related to Internet printing are described
in the Internet Printing and Resulting Internet Communication in Windows 7 and Windows
Server 2008 R2 section in this document.
 Turn off the "Order Prints" picture task: Specifies whether the Order Prints Wizard can be
run from Windows Photo Gallery.
This setting affects users on Windows Server 2008 R2 only if the Desktop Experience is
 Turn off the “Publish to Web” task for files and folders: Specifies whether the tasks
"Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items
to the Web," are available from File and Folder Tasks in Windows folders. The Web
Publishing Wizard is used to download a list of providers and allow users to publish content
to the Web. If you enable this setting, these tasks are removed from the File and Folder tasks
in Windows folders. If you disable or do not configure this setting, the tasks will be shown.
 Turn off the Windows Messenger Customer Experience Improvement Program:
Specifies whether Windows Messenger collects statistical information about how Windows
Messenger software and service is used. With the Customer Experience Improvement
program, users can allow Microsoft to collect information about how the product is used. This
information is used to improve the product in future releases.
225
If you enable this setting, Windows Messenger will not collect usage information and the user
settings to enable the collection of usage information will not be shown. If you disable this
setting, Windows Messenger will collect usage information and the setting will not be shown.
If you do not configure this setting, users will have the choice to opt-in and allow information
to be collected.
Windows Messenger is not included in Windows 7 and Windows Server 2008 R2.
 Turn off Windows Online: Specifies whether users can see updated Help topics that
Microsoft makes available across the Internet. If you turn off Windows Online, you also turn
off Help Ratings and the Windows Customer Experience Improvement Program (which are
dependent on the Windows Online policy setting).
This policy setting is also described in Help and Support Features that Communicate
Through the Internet in Windows 7 and Windows Server 2008 R2 in this document.
226
Appendix D: Search, Games, and Resulting
In this appendix
Start menu Search and Internet communication
Games Explorer and Internet communication
Start menu Search and Internet communication

The Search box on the Start menu in Windows® 7 and Windows Server® 2008 R2 integrates
multiple types of searches, making it easy for users to search for such items as files, programs,
recently visited Web pages, and Web pages that they added to their Favorites lists. By using
Group Policy, you can exclude recently visited Web pages and Web pages added to the
Favorites list from searches.
The Group Policy setting is \User Configuration\Administrative Templates\Start Menu and
Taskbar\Do not search Internet. If you enable this policy setting, the Search box on the Start
menu does not search for recently visited Web pages or favorites.
If you enable an additional Group Policy setting (\User Configuration\Administrative
Templates\Start Menu and Taskbar\Add Internet search link to Start Menu), a "Search the
Internet" link is visible when the user performs a search in the Start menu search box. This button
launches the default browser with the search terms. If you disable this policy, there will not be a
"Search the Internet" link when the user performs a search in the Start menu search box.
Games Explorer and Internet communication

Games Explorer in Windows 7 (located in Start\All Programs\Games) is an interface that makes
it easy to access games. Games Explorer displays games that are located in the built-in Games
folder. Game installers provide games in this folder by default, and users can move games to this
folder.
Some games have game information (including game box art and ratings) that can be
downloaded from a Web site that is maintained by Microsoft®. To prevent downloading
information about installed games, you can use the Windows interface or Group Policy.
To prevent downloading information about installed games by using the Windows

interface
1. Click Start, click All Programs or Programs, click Games, and then click Games
Explorer.
227
2. Click Options.
3. In Set up game updates and options, clear Download art and information about
installed games.
Notes
Set up games updates and options also contains a link to Windows 7
Privacy Highlights.
To prevent downloading information about installed games by using Group Policy

Server 2008 R2 or Windows 7 with the Group Policy Management Console (GPMC)
console installed.
2. Click Start, type gpmc.msc, press ENTER, and then select an appropriate Group Policy
object (GPO).
Windows Components, and then click Game Explorer.
4. In the details pane, double-click Turn off downloading of game information, and then
click Enabled.
228
Appendix E: Telnet Client and Telnet Server
in Windows 7 and Windows Server 2008 R2
This appendix provides a brief description of the Telnet client and Telnet server features that can
be turned on in Windows® 7 and Windows Server® 2008 R2.
For more information about Telnet, search Help and Support in Windows 7 or Windows
Server 2008 R2, or search the following Web sites:
 Windows Help and How-to
 Telnet Operations Guide
 Internet Engineering Task Force
How to turn on Telnet and Telnet features

In Windows 7 and Windows Server 2008 R2, both Telnet client and Telnet server features are
available, although they are not turned on by default. These features can be turned on by an
administrator (or a user with an administrator account) through Control
Panel\Programs\Programs and Features\Turn Windows features on or off. Instructions for
turning on the Telnet client are also provided in Help in Windows 7 and Windows Server 2008 R2.
To prevent users from turning on the Telnet client or Telnet server, you can ensure that they do
not have administrator accounts. As an additional step, you can use a script to check if
Telnet.exe is present on a computer that is running Windows 7 or Windows Server 2008 R2.
229
Appendix F: Internet Connection Sharing,
Network Bridge, and HomeGroup in
In this appendix
Overview: Internet Connection Sharing and Network Bridge
Using ICS and Network Bridge in a managed environment
Controlling the use of ICS and Network Bridge
Overview: Internet Connection Sharing, Network

Bridge, and HomeGroup
Internet Connection Sharing (ICS), Network Bridge, and HomeGroup are features that are
designed for home and small office networks. These features are included in Windows® 7 and
Windows Server® 2008 R2.
Internet Connection Sharing, Network Bridge, and HomeGroup provide the following functionality:
 Internet Connection Sharing: With ICS, users can share a public Internet connection with a
private home or small business network. In an ICS network, a single computer is chosen to
be the ICS host. The ICS host has at least two network adapters: one connected to the
Internet and one or more connected to the private network. All Internet traffic flows through
the ICS host. ICS uses Dynamic Host Configuration Protocol (DHCP) to assign private IP
addresses on the network, and it uses Network Address Translation (NAT) to allow multiple
computers on the private network to connect to the public network through the ICS host.
Only the ICS host is visible from the Internet. The private network is "hidden." Also, NAT
blocks any network traffic that did not originate from the private network or that is a response
to traffic originating from the private network.
In addition, ICS provides name resolution to the home network through a DNS proxy.
Note
You should not use Internet Connection Sharing in an existing network with
Domain Name System (DNS) servers, gateways, Dynamic Host Configuration
Protocol (DHCP) servers, or systems configured for static IP addresses.
 Network Bridge: Network Bridge removes the need for routing and bridging hardware in a
home or small office network that consists of multiple LAN segments. Network Bridge
forwards traffic among the multiple LAN segments, making them appear to be a single IP
subnet.
230
Caution
If Windows Firewall or ICS are not enabled on your network, do not set up a
network bridge between the public Internet connection and the private network
connection. Setting up a network bridge between the public Internet connection
and the private network connection creates an unprotected link between your
network and the Internet, leaving your network vulnerable to external attacks.
When Windows Firewall or ICS is enabled, this risk is mitigated.
 HomeGroup: HomeGroup is a feature in Windows 7 that allows you to connect two or more
computers that are running Windows 7. This enables you to share your Music, Pictures,
Video, and Document libraries, in addition to printers, with others in your home. HomeGroup
automatically sets up sharing so that all media that is shared with the homegroup is
accessible from Windows Media Player, Windows Media Center, and other compatible media
devices in the home.
Using ICS, Network Bridge, and HomeGroup in a

managed environment
ICS, Network Bridge, and HomeGroup are not enabled by default. However, it is important to be
aware of all the methods that are available to users and administrators to connect to networked
assets, and to review whether your security measures provide in-depth defense (as contrasted
with a single layer of defense, which is more easily breached).
ICS is available only on computers that have two or more network connections. An administrator
or user with administrative credentials can use Control Panel to open Network Connections,
through which ICS settings can be viewed or changed as described in Viewing ICS Settings on a
Computer Running Windows 7 or Windows Server 2008 R2 later in this appendix. ICS lets
administrators configure a computer as an Internet gateway for a small network, and it provides
network services such as name resolution through DNS. It also provides addressing through
DHCP to the local private network.
The Network Bridge menu command Bridge Connections is available only when two or more
network adapters are present. By default, Network Bridge is disabled, but administrators can use
Bridge Connections to enable Network Bridge.
HomeGroup is available in all editions of Windows 7 and Windows Server 2008 R2. However, a
homegroup can only be created from a computer that is not joined to a domain. A domain-joined
computer can join a homegroup to access data from other homegroup members, but data on a
domain-joined computer cannot be accessed from other computers joined to the homegroup.
Domain and local administrators can configure additional homegroup restrictions on a domain-
joined computer.
231
Controlling the use of ICS, Network Bridge, and
HomeGroup
This subsection provides information about:
 Viewing ICS settings on a computer running Windows 7.
 Disabling ICS and Network Bridge by using an answer file for unattended or remote
installation.
 Disabling ICS and Network Bridge by using Group Policy.
 Managing HomeGroup settings for domain-joined computers.
Viewing ICS settings on a computer running Windows 7 or

The following procedure describes how to view the settings for ICS in Windows 7 and Windows
Server 2008 R2.
To view ICS settings

1. Click Start, click Control Panel, click Network and Internet, click Network and Sharing
Center, and then click Change adapter settings.
2. Right-click a connection, and then click Properties.
4. In Local Area Connection Properties, click the Sharing tab and view the settings for
ICS.
Note
The Sharing tab will not appear unless the computer has at least two
network adapters.
Disabling ICS and Network Bridge by using an answer file for

unattended or remote installation
If the answer files that you use for unattended or remote installation exclude all lines that would
enable ICS or Network Bridge, then ICS and Network Bridge are disabled (this is the default).
Make sure that your answer file has no lines that contain the strings EnableICS or Bridge.
For more information about unattended installation, see the references listed in Appendix A:
232
Disabling ICS and Network Bridge by using Group Policy
You can use the following Group Policy settings to disable small office networking features in
your domain environment.
Note
For more details about any of the Group Policy settings, use a Group Policy interface to
navigate to the setting, and then click the Extended tab, or open the setting, and then
click the Explain tab. For other sources of information about Group Policy, see Appendix
B: Resources for Learning About Group Policy for Windows 7 and Windows Server 2008
R2.
 Prohibit use of Internet Connection Sharing on your DNS domain network located in
Computer Configuration\Administrative Templates\Network\Network Connections.
If you enable this policy setting, ICS cannot be enabled or configured by administrators, and
the ICS service cannot run on the computer.
 Prohibit installation and configuration of Network Bridge on your DNS domain network
located in Computer Configuration\Administrative Templates\Network\Network
Connections.
When you enable this policy setting, administrators cannot create a Network Bridge. Enabling
this policy setting does not remove an existing Network Bridge from a computer.
Important
Group Policy settings that have "DNS" in the name of the setting are dependent
on the network context of the computer. They apply only when a computer is
connected to the same DNS domain network that it was connected to when the
policy setting was refreshed on that computer. If a computer is connected to a
DNS domain network other than the one it was connected to when the policy
setting was refreshed, the policy setting does not apply.
For more information about home and small office networking features, see the Help and Support
topics in Windows 7.
You can also search Help topics for Windows 7 on the following Microsoft® Web site: Windows 7
Help and How-to.
Managing HomeGroup settings for domain-joined computers

There are a number of configuration settings that you can use to manage how a domain-joined
computer can be used in a homegroup. These settings include the following:
 For a computer to participate in a homegroup, certain firewall ports must be open. If you use
Windows Firewall, the required ports are opened by default when a user selects the network
location. If a non-Microsoft firewall is deployed or customized settings are used, additional
ports must be opened for the user’s home network. For more information, see Appendix G:
Windows Firewall in Windows 7 and Windows Server 2008 R2 in this document.
233
 For proper HomeGroup functionality, organizations with IPsec deployments should use
domain-based Group Policy settings to deliver IPsec policies. You should include a rule that
allows hosts without IPsec from the 192.168.x.x range to contact the computer on TCP 3587
(Peer-to-Peer Grouping) and UDP 3540 (PNRP).
Depending on the specifics of the employees’ home network configuration (specifically, if
addresses are delivered through DHCP), IT administrators might need to add additional
addresses to the allowed list for these ports. If this rule is not deployed, the work computer
will cause problems for other computers that attempt to join the homegroup. Specifically,
when a new computer attempts to join a homegroup that is advertised by a computer from
work, the connection will time out. For more information, see Internet Protocol Version 6,
Teredo, and Related Technologies in Windows 7 and Windows Server 2008 R2 in this
document.
 There are three Group Policy settings in the Group Policy Management Console that IT
administrators can use to control computers that are members of a domain at work and are
joining a homegroup:
 Require domain users to elevate when setting a network’s location. To join a
Homegroup, a user must be able to modify network location settings. By default in
Windows 7 and Windows Server 2008 R2, a standard user can modify network location
settings. However, a network administrator can restrict this permission by configuring and
applying the Require domain users to elevate when setting a network’s location
Group Policy setting.
Note
The full path of this node in the Group Policy Management Console is
Computer Configuration\Administrative Templates\Network\Network
Connections.
 Prevent the computer from joining a homegroup. This policy setting allows you to
control the ability of users to join a homegroup. If you enable this policy setting, users
cannot detect or join a homegroup. If you disable or do not configure (default setting) this
policy setting, users can detect and join a homegroup.
Note
Computer Configuration\Administrative Templates\Windows
Components\HomeGroup.
 Point and Print Restrictions. This policy setting allows you to control the installation of
printer drivers from the homegroup. If you enable this policy setting, computers that are
members of a homegroup can install only printer drivers from a remote computer in the
same homegroup if the driver is already installed on the local computer. If you disable or
do not configure (default setting) this policy setting, computers that are members of a
homegroup will automatically discover and install printer drivers from other computers in
the same homegroup.
234
Note
Computer Configuration\Administrative Templates\Printers.
For more information about configuring these options, see Settings to Allow Computers that are
Members of a Domain to Join a Homegroup.
 Network and Sharing Group Policy Settings
 Configuring Network and Sharing Center Features in a Managed Network
 HomeGroup Overview
 Windows 7 HomeGroup: Frequently Asked Questions
235
Appendix G: Windows Firewall in Windows 7
In this appendix
Overview: Windows Firewall
Group Policy setting for disabling Windows Firewall
Overview: Windows Firewall

Windows® Firewall helps protect against network attacks for computers on which it is enabled.
Windows Firewall does this by checking all communications that cross the connection and
selectively blocking communications, according to the configuration settings you specify.
Windows Firewall is considered a "stateful" firewall; that is, it monitors all aspects of the
communications that cross its path and inspects the source and destination address of each
message that it handles.
In Windows 7 and Windows Server® 2008 R2, Windows Firewall includes a variety of
enhancements, which are described in Additional references later in this section. Windows
Firewall is enabled by default in Windows 7 and Windows Server 2008 R2, and after setup
completes, Windows Firewall blocks all inbound traffic until the computer has the latest security
updates installed.
Windows 7 and Windows Server 2008 R2 are designed to make it relatively easy to configure
Windows Firewall. For example, a variety of features in Windows 7 and Windows Server 2008 R2
are listed in the Exceptions list in Windows Firewall, so that the person configuring the exception
does not need to know technical details, only the name of the feature to be used. As another
example, the Remote Assistance Wizard can detect whether Windows Firewall is blocking the
associated feature, and if so, provide the user with information about unblocking the feature.
You can use Windows Firewall with your organization's firewall to enhance the protection of client
computers and servers. You can also use Windows Firewall to protect a small network or single
computer that is connected to the Internet.
Another security-related feature in Windows 7 is the Security Center in Control Panel. The
Security Center monitors the status of firewalls including Windows Firewall, and the status of
automatic updating, virus protection, malware protection, and other security settings. The Security
Center notifies the user when the computer might be at risk by providing an icon and balloon
message in the notification area.
When the computer running Windows 7 is part of a domain (the usual scenario for a managed
environment), by default these notifications are not displayed. For more information, see the
explanatory text in the Group Policy setting, Turn on Security Center (domain PCs only). This
236
setting is located in Computer Configuration\Administrative Templates\Windows
Components\Security Center.
In Windows Server 2008 R2, you can use a single tool, the Windows Firewall with Advanced
Security snap-in, to configure both Windows Firewall and Internet Protocol security (IPsec). The
snap-in includes a variety of enhancements, which are described in Additional references later in
this section.
In addition, Windows Server 2008 R2 includes a Server Manager console, which features a
Security Information area under Server Summary. The information that is displayed under
Security Information tells you if Windows Firewall and other security-related features are turned
on. From the Security Information area you can also run interfaces such as the Windows
Firewall with Advanced Security snap-in.
Group Policy setting for disabling Windows

Firewall
This section describes a Group Policy setting with which you can disable Windows Firewall. A
variety of other Group Policy settings are available for controlling Windows Firewall. The settings
are located in Computer Configuration under Policies (if present), in Administrative
Templates\Network\Network Connections\Windows Firewall. For more information, see the
settings or see Additional references later in this section.
Important
Because the Windows Firewall service applies service hardening rules to standard
Windows networking services, do not disable the firewall by stopping the Windows
Firewall service. Instead, use the Windows Firewall Group Policy setting. Stopping the
Windows Firewall service is not supported by Microsoft®.
The Group Policy setting to disable Windows Firewall in a domain environment is located in
Templates\Network\Network Connections\Windows Firewall\Domain Profile. The setting is
called Windows Firewall: Protect all network connections. If you disable this policy setting,
Windows Firewall does not filter or block any network traffic.
We recommend that you do not disable Windows Firewall unless you replace it with a
non-Microsoft firewall that provides equivalent functionality. Disabling the firewall can
expose your computer to malicious traffic from the Internet.
In Computer Configuration under Policies (if present), in Administrative
Templates\Network\Network Connections, the setting called Prohibit use of Internet
Connection Firewall on your DNS domain network still exists. This setting has no effect if
Windows Firewall: Protect all network connections is enabled or disabled. However, if
Windows Firewall: Protect all network connections is set to Not Configured, you can still
prevent Windows Firewall from running by enabling Prohibit use of Internet Connection
237
Firewall on your DNS domain network. (Internet Connection Firewall is the former name for
Windows Firewall.)
 Cable Guy Web site (search for information about Windows Firewall)
The following resources related to Windows 7 and Windows Server 2008 R2 are on the Microsoft
Web site:
 Windows Firewall
 What's New in Windows Firewall with Advanced Security
 Windows Firewall with Advanced Security and IPsec
 Networking
 Security and Protection
238
Appendix H: Network Connectivity Status
Indicator and Resulting Internet
Server 2008 R2
In this appendix
Benefits and purposes of the Network Connectivity Status Indicator
Overview: Using NCSI in a managed environment
How NCSI communicates with an Internet site
Controlling communication between NCSI and an Internet site
Procedures for controlling communication between NCSI and an Internet site
Benefits and purposes of the Network

Connectivity Status Indicator
Windows® 7 and Windows Server® 2008 R2 include a feature called Network Connectivity
Status Indicator (NCSI), which is part of a broader feature called Network Awareness. Network
Awareness collects network connectivity information and makes it available through an
application programming interface (API) to services and applications on a computer running
Windows 7 or Windows Server 2008 R2. With this information, services and applications can filter
networks (based on attributes and signatures) and choose the networks that are best suited to
their tasks. Network Awareness notifies services and applications about changes in the network
environment, thus enabling applications to dynamically update network connections.
Network Awareness collects network connectivity information such as the Domain Name System
(DNS) suffix of the computer and the forest name and gateway address of networks that the
computer connects to. When called on by Network Awareness, NCSI can add information about
the following capabilities for a given network:
 Connectivity to an intranet
 Connectivity to the Internet (possibly including the ability to send a DNS query and obtain the
correct resolution of a DNS name)
NCSI is designed to be responsive to network conditions, so it examines the connectivity of a
network in a variety of ways. For example, NCSI tests connectivity by trying to connect to
http://www.msftncsi.com, a simple Web site that exists only to support the functionality of NCSI.
239
Overview: Using NCSI in a managed environment
In a managed environment, you might choose to use NCSI because of the way it supports
services and applications that require network connectivity. However, you can disable NCSI
through Group Policy.
How NCSI communicates with an Internet site

The following list describes how NCSI might communicate with a Web site to determine whether
a network has Internet connectivity:
 Specific information sent or received:
Type of Request that NCSI Sends What NCSI Expects to Receive if Connectivity
Exists
A request for A page called ncsi.txt, which contains the

http://www.msftncsi.com/ncsi.txt following line of text with no terminating new
line or other non-printing characters:
Microsoft NCSI
(Page headers disable caching.)
A request for DNS name resolution of The resolution of the DNS name to:
dns.msftncsi.com 131.107.255.255
 Default setting and ability to disable: By default, Network Awareness (which includes
NCSI) is enabled. NCSI can be disabled by using Group Policy.
 Triggers: Network Awareness and its features gather information flexibly—that is, by using
complex algorithms that respond to changing network conditions. This means that triggers
can vary, but the following are examples of typical triggers that can cause NCSI to
communicate across the Internet:
 Someone first logs on after the computer has been restarted.
 The computer connects to a different network.
 The computer is brought into a hot spot (public wireless access area) that requires a
sign-in.
 User notification: NCSI does not notify the user before attempting to collect information. It
does notify the user or the application when there are changes in connectivity (for example,
loss of Internet connectivity). An application that uses NCSI can be written to include user
notifications if appropriate to the design and function of the application.
 Logging: NCSI does not log events in Event Viewer.
 Privacy, encryption and storage: NCSI does not use encryption (the requests it sends and
the responses it receives are standardized, as shown in the table earlier in this subsection).
240
Internet Information System (IIS) logs are stored on a server at www.msftncsi.com. These
logs contain the time of each access and the IP address that is recorded for that access.
These IP addresses are not used to identify users, and in many cases, they are the address
of a network address translation (NAT) computer or proxy server, not a specific client behind
that NAT computer or proxy server.
 Transmission protocol and port: NCSI uses HTTP over port 80. For DNS requests, NCSI
uses the DNS port, which by default is port 53.
Controlling communication between NCSI and an

Internet site
You can use a Group Policy setting to prevent NCSI from connecting to http://www.msftncsi.com.
If you use Group Policy to prevent NCSI from connecting to http://www.msftncsi.com, applications
that perform checks for the existence of Internet connectivity might work more slowly. Also, if a
computer running Windows 7 or Windows Server 2008 R2 is brought into a hot spot that requires
a sign-in, the computer might not detect the hot spot. The following procedure explains how to
control this behavior.
Procedures for controlling communication

between NCSI and an Internet site
The following procedure describes how to use Group Policy to prevent NCSI from communicating
To use a Group Policy setting to prevent NCSI from communicating across the Internet
with domain administrative credentials, log on to a computer that is running Windows
Server 2008 R2 with the Group Policy Management feature installed or a computer that is
running Windows 7 and contains the Group Policy Management Console (GPMC) that is
included in Remote Server Administration Tools for Windows Server 2008 R2.
2. Click Start, type gpmc.msc, and then press ENTER. Select an appropriate Group Policy
object (GPO).
3. Expand Computer Configuration, expand Administrative Templates, expand System,
4. In the details pane, double-click Turn off Windows Network Connectivity Status
Indicator active tests, and then click Enabled.
Important
241
setting is located in Computer Configuration or User Configuration, in
\Administrative Templates\System\Internet Communication
Management.
For more information about this Group Policy and the policies that it controls,
see Appendix C: Group Policy Settings Listed Under the Internet
Communication Management Category in Windows 7 and Windows Server
2008 R2.
For more information see Network Awareness on Windows Vista on the Microsoft® Web site.
242
Appendix I: Message Queuing and Internet
Communication in Windows Server 2008 R2
In this appendix
Purposes of Message Queuing 5.0
Overview: Using Message Queuing in a managed environment
Examples of security-related features in Message Queuing
Procedures for installing, uninstalling, and viewing Help for Message Queuing
Purposes of Message Queuing 5.0

Message Queuing (MSMQ) 5.0 is one of the optional features in Windows Server® 2008 R2.
Message Queuing enables applications on different systems to communicate with each other
across the Internet and other heterogeneous networks. It also enables communication with
computers that might be temporarily offline. For a more complete description, see Message
Queuing (MSMQ) on the Microsoft® Web site.
about balancing your organization’s requirements for running Internet applications with your
organization’s requirements for protection of networked assets. However, it is beyond the scope
of this document to describe all aspects of maintaining appropriate levels of security and privacy
in an organization running applications that communicate across the Internet.
Overview: Using Message Queuing in a managed

environment
Applications can use Message Queuing to send messages and to continue running regardless of
whether the receiving application is running or reachable over the network. Applications use
Message Queuing application programming interface (API) calls to send or receive messages.
When messages are in transit between senders and receivers, Message Queuing keeps them in
holding areas called queues. These queues protect messages from being lost in transit and
provide a place to retrieve messages when the receivers are ready to receive them.
Message Queuing 5.0 provides support for sending messages over the Internet. In addition to
support included with previous versions of Message Queuing, Message Queuing 5.0 offers
support for subqueues, the handling of poison messages, and transactional remove receive.
For more information, see What's New in Message Queuing 5.0 on the Microsoft Web site. Also
see Additional references later in this section.
243
Examples of security-related features in Message
Queuing
In any application involving Message Queuing, security is an important consideration. Message
Queuing has multiple security features that are relevant from the administrative perspective and
the application design perspective. The following list provides some examples:
 More secure authentication algorithm: Message Queuing 5.0 supports Secure Hash
Algorithm 2.0 (SHA2) and all advanced hash algorithms that are supported in this version of
Windows. The default is SHA-2 with 512-bit digest length. Support for algorithms such as
SHA1, Message Digest version 2 (MD2), MD4, MD5, and Message Authentication Code
(MAC) have been disabled by default in Message Queuing 5.0 because these algorithms are
considered less secure. You can, however, enable support for weaker algorithms.
For more information, see What's New in Message Queuing 5.0.
 Message authentication: Message authentication provides a way to ensure message
integrity and a way to verify who sent the message. Authenticating for message integrity
ensures that no one has tampered with the message or changed its content.
 Security descriptors: Security descriptors provide a way to regulate access to queues by
using the access control model that governs access to all securable objects in Windows.
 Encryption services: Encryption services provides a secured channel for sending private,
40-bit or 128-bit encrypted messages throughout your enterprise. When private messages
are sent, Message Queuing ensures that the messages stay encrypted from the moment they
leave the source queue manager to the moment they reach their destination queue manager.
 Auditing services: Auditing services provides a way to audit access operations for the
queues in your Message Queuing enterprise. The operations that you can audit include
creating a queue, opening a queue, setting or retrieving queue properties, and deleting a
queue.
 Hardened mode: Hardened mode enhances the Internet security of computers that are
running Message Queuing 3.0 by supporting scenarios that employ only HTTP (SRMP)
messages.
For more information, see Message Queuing Security Services on the Microsoft Web site.
Procedures for installing, uninstalling, and

viewing Help for Message Queuing
Message Queuing is not installed by default. If your organization has determined that Message
Queuing is an essential part of the business process, it can be installed as described in this
subsection. Message Queuing is highly configurable, and it is beyond the scope of this document
to describe all the configuration options that are available to you.
For more detailed information about Message Queuing, see the Additional references section
later in this section.
244
To install Message Queuing
step 3.
3. In Server Manager, under Features Summary, click Add Features.
4. In the Add Features Wizard, expand MSMQ, expand MSMQ Services, and then select
the check boxes for the Message Queuing features that you want to install.
5. Click Next, and then click Install.
6. If you are prompted to restart the computer, click OK to complete the installation.
To uninstall Message Queuing

click Server Manager. (If the User Account Control dialog box appears, confirm that
the action it displays is what you want, and then click Continue.)
2. In Server Manager, under Features Summary, click Remove Features.
3. In the Remove Features Wizard, expand MSMQ, expand MSMQ Services, and then
clear the check boxes for the Message Queuing features that you want to uninstall.
In this wizard, you remove a feature by clearing a check box (not by selecting a check
box).
4. Click Next, and then click Remove.
5. When prompted, click OK to restart the computer.
Viewing the operating system Help documentation for Message

Queuing
The operating system has Help documentation that describes the use of Message Queuing. You
can view this documentation from any computer that has Internet access (regardless of the
operating system running on that computer), or from any server running Windows
Server 2008 R2.
For more information, see Message Queuing in the Windows Server TechCenter.
To view Help documentation for Message Queuing

1. On a server running Windows Server 2008 R2, with Message Queuing already installed,
click Start, point to Programs, point to Administrative Tools, and then click Computer
245
Management.
2. Press F1.
3. Make sure that in Help, the Contents tab is selected. In Contents, expand Message
Queuing.
For more information about Message Queuing, see the following resources on the Microsoft Web
site:
 Message Queuing (MSMQ)
 What's New in Message Queuing 5.0
 Message Queuing Security Services (From this topic, you can click links for information about
message authentication, security descriptors, and other security-related features.)
 Motley Queue: Queuing at Microsoft blog
 Encryption and MSMQ4
 Authentication and MSMQ4
246
Appendix J: Wizards in Windows 7 and
Windows Server 2008 R2 Related to
Connecting to the Internet
In this appendix
Connect to the Internet Wizard
Add Network Location Wizard
Connect to the Internet Wizard

The Connect to the Internet Wizard simplifies the process of connecting an individual computer
running Windows® 7 or Windows Server® 2008 R2 to the Internet. Through the Connect to the
Internet Wizard, you can specify the name of an Internet service provider (ISP) along with
information that the ISP provides, such as a telephone number, user name, and password.
There are a variety of ways to start the Connect to the Internet Wizard, including the following:
 In the Welcome Center that appears after Windows 7 is installed, double-click Connect to
the Internet.
 Start any program that requires an Internet connection when no Internet connection has yet
been configured. An example of such a program is Internet Explorer®.
 Open Network and Sharing Center, click Set up a new connection or network, click
Connect to the Internet, and then click Next. (The Network and Sharing Center can be
opened in a variety of ways, including through Control Panel.)
 Open Internet Options, and on the Connections tab, click the Setup button. (Internet
Options can be opened in a variety of ways, including through Internet Explorer (in the Tools
menu) and through Control Panel\Network and Internet\Internet Options.
Making the Setup button in Internet Options unavailable

If you want to prevent users from adding Internet connections, you can make the Setup button
(on the Connections tab in Internet Options) unavailable. To make the Setup button
unavailable, you can use the Group Policy setting Disable Internet Connection Wizard. You
can find this setting in the Group Policy snap-in in User Configuration under Policies (if
present), in Administrative Templates\Windows Components\Internet Explorer. From there
you can locate and configure the setting Disable Internet Connection Wizard setting.
Note
This Group Policy setting makes the Setup button unavailable, but it does not prevent the
Connect to the Internet Wizard from running.
247
Add Network Location Wizard
With the Add Network Location Wizard, you can sign up for a service that offers online storage
space. You can use this space to store, organize, and share documents and pictures by using a
Web browser and Internet connection. You can also create shortcuts to a Web site, an FTP site,
or other network location.
Note
For a Web-based shortcut to be created through the Add Network Location Wizard, the
Web server specified in the shortcut must support the Web Distributed Authoring and
Versioning (WebDAV) protocol and Internet Information Services (IIS). Applications on
the computer, for example, word processing or spreadsheet software, can provide
support for network places. In this case, the Web server specified in the shortcut will work
if it supports the Web Extender Client (WEC) protocol and Microsoft® FrontPage® Server
Extensions. You must also have read and write access to the Web server.
For more information, see About Web Folder Behaviors on the Microsoft Web site.
There are multiple ways to start the Add Network Location Wizard. One way is to open Windows
Explorer, right-click Network, click Map Network Drive, and then click Connect to a Web site
that you can use to store your documents and pictures.
Using Group Policy to control the Add Network Location Wizard

If you want to prevent users from adding a network location, you can block access to the Add
Network Location Wizard. From the Map Network Drive command, you can configure the
Remove "Map Network Drive" and "Disconnect Network Drive" Group Policy setting. This
setting is located in User Configuration under Policies (if present), in Administrative
Templates\Windows Components\Windows Explorer.
If you enable this Group Policy setting, the system removes access to the Map Network Drive
and Disconnect Network Drive commands that were available, for example, by opening
Windows Explorer and right-clicking Network. However, this policy setting does not prevent you
from starting the Add Network Location Wizard by opening Windows Explorer, right-clicking
Computer, and then clicking Add a Network Location. The policy setting also does not prevent
you from connecting to another computer by typing the name of a shared folder in Windows
Explorer or your Web browser.
248

Using Windows 7 and Windows Server 2008 R2 - Controlling Communication With The Internet

Uploaded by

Copyright:

Available Formats

Using Windows 7 and Windows Server 2008 R2 - Controlling Communication With The Internet

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Using Windows 7 and Windows Server 2008 R2 - Controlling Communication With The Internet

Uploaded by

Copyright:

Available Formats

Using Windows 7 and Windows Server 2008

R2: Controlling Communication with the

© 2009 Microsoft Corporation. All rights reserved.

Active Directory-Related Services and Resulting Internet Communication in Windows Server

Program Compatibility Features and Resulting Internet Communication in Windows 7 and

Windows Customer Experience Improvement Program and Resulting Internet Communication in

Appendix H: Network Connectivity Status Indicator and Resulting Internet Communication in

Standard computer information sent by Internet-enabled

Types of features covered in this document

Types of features not covered in this document

Security basics that are beyond the scope of this document

Resources about security basics

Benefits and purposes of AD FS and AD RMS

Overview of AD FS, federated applications and

Port configurations for AD FS

Additional references for AD FS and federated

Additional references for AD RMS

Benefits and purposes of Remote Desktop

Procedure for viewing or changing Group Policy

Purpose of Remote Desktop Licensing

Overview: Using Remote Desktop Licensing in a

How Remote Desktop Licensing communicates

Controlling Remote Desktop Licensing to limit the

Benefits and purposes of Remote Desktop Web

Default port and authentication settings with

Additional ports required for Remote Desktop

Purposes of activation for Windows

 Ensures that the software is supported by Microsoft and its partners.

Overview: Activation in the context of a managed

Activation options with volume licensing

How a computer communicates with sites on the

Benefits and purposes of certificate functionality

The Update Root Certificates feature in Windows 7 and Windows

Overview: Using AD CS features in a managed

How Update Root Certificates communicates with

Controlling the Update Root Certificates feature to

How turning off Update Root Certificates on a computer can

For more information, see AD CS: Policy Settings.

Benefits and purposes of Device Manager and

Overview: Using Device Manager in a managed

How hardware wizards communicate with Internet

Controlling hardware wizards to limit the flow of

Procedures for controlling communication

Benefits and purposes of Dynamic Update

How Dynamic Update communicates with sites on

Controlling Dynamic Update to limit the flow of

For more information, see the following Web sites:

Benefits and purposes of Event Viewer

Forwarding and collecting events

Overview: Using Event Viewer in a managed

Controlling Event Viewer to prevent the flow of

Procedures for preventing the flow of information

Benefits and purposes of the file association Web

Overview: Using the file association Web service

How the file association Web service

Procedures for limiting Internet communication

To disable the file association Web service by using Group Policy

Specifying associations between file name extensions and

To associate a file name extension with a program