Welcome to the ITFreeTraining video on configuring and setting up Work Folders. This video will
perform a quick setup of Work Folders to demonstrate how it works and what features are available.
This setup is recommend for a lab environment. For a production environment you will need
to add a few more steps to configure certificates and publish settings to the user, to be used
with Work Folders. I will now change to my Windows Server 2012 R2 computer to have a
look at how to configure the server side of Work Folders.
Before I start installing Work Folders, I will first create a folder to store the data
for users using Work Folders. To do this, I will open Windows Explorer and navigate
to the d drive. On the d drive I will create a folder called Work Folders. This folder
will be used to store the data from the users who use Work Folders.
The next step is to install Work Folders. To do this, I will open Server Manager and
then, from the welcome screen, select the option ”Add roles and features”. From
the wizard, I will accept the default for the first few screens, as I will be installing
the role on the local server.
When I get to the ”select server roles” screen, I will navigate down to ”File and
Storage Services”, expand it, and then expand ”File and ISCSI services” and tick the
option ”Work folders”. When this option is ticked I will be prompted to add the feature
”IIS Hostable Web Core.” Work Folders uses the HTTP web protocol, however, does
not require the IIS role in order to operate.
Once I press add features, for the rest of the options I can accept the defaults, so
I will keep pressing next until I reach the end of the wizard and I press install to start
the install. The install takes a minute or so to complete, so I will pause the video
and return once it has completed.
Now that the install is complete, the next step is to configure it. To do this, I will
go back to Server Manager and, on the left hand side, I will select the option ”File
and Storage Services”. Once selected, a new menu will appear in which I will select
the option ”Work Folders”.
To start using Work Folders I need to create what is referred to as a Sync Share. To do
this, I will select ”Tasks” at the top right hand corner and then select the option
”New Sync Share” to start the wizard.
Once I am past the welcome screen, on the next screen, I need to select an existing
share or select a folder to store the Work Folder files in. Any existing shares on the
server will be shown and these can be selected; however, in this case, I will leave it on
the default option of ”enter a local path” and press the browse button. Next I will browse
to the folder WorkFolders that I created earlier and select it.
With the local path entered in, I will press the next button to move onto the next screen
of the wizard. On the next screen, I need to decide the structure that the data from
the users will be in. The top option ”user alias” uses the user name for the folder
name.
If I show an example for the folder structure, the 3 folders shown, administrator, BloggsJ
and DoeJ are all named after the user. This is the same system that is used with user
profiles and other systems in Windows. This gives you the most compatibility; however,
if you have multiple domains, this can cause naming conflicts.
The second option, alias@domain, eliminates the chance of conflicts; however, the naming
convention is different to other Windows systems. If I show an example of this folder structure,
you can see that the folders for administrators and DoeJ are followed by @ ITFreeTraining.
The user BloggsJ is followed by HighCostTraining. This prevents the chance of a conflict if
you have multiple domains and you have two users with the same name. For example, you
have two users in different domains with the same name John Doe.
The next option down, ”Sync only the following subfolder” allows the administrator to choose
a particular sub folder to sync. If this option is chosen, only this sub folder will be synchronized.
If I now move onto the next screen, this screen gives you the option to enter in a name and
description. This helps the user determine what the purpose of the Work Folder may be.
In this case, I will accept the defaults and move on.
On the next screen, I need to decide which users will be able to use the Work Folder.
In this case, I will press the add button and then I will enter in the group ”Domain
Users”. This will allow anyone in the domain users group to access this Work Folder sync
share.
Notice at the bottom there is the tick box ”Disable inherited permissions and grant
users exclusive access to their files”. If this option is ticked, the only person
that will be able to access the files via the Work Folder is that user. This includes
administrators. If you want additional security you should leave this option on.
If I move onto the next screen, there are two options that can be selected. The top
option, ”Encrypt Work Folders” will encrypt the files on the user’s workstation using
EFS. This will help protect the files in case the computer or device holding the files is
lost. If you do decide to use this option, you should also consider setting up a disaster
recovery agent to recover the files if you need to.
The next option ”Automatically lock screen, and require a password”will lock the device
and ask the user for a username and password, if it is left unattended. A word of warning
with these options, if the device that you are using Work Folders with does not support
these options and they are ticked, Work Folders will not be available on that device.
If I now move onto the next screen, this is the last screen and all I need to do is press
”create” and the sync share will be created. Once it has been created, I will close the
wizard.
That’s if for the configuration of Work Folders on the Server. The next step is to
set up the client. To do this, I will change to my client computer that is running Windows
8.1.
As this is just a basic demonstration of Work Folders, I will perform a quick setup in order
to get it up and running. In order to install Work Folders on a corporate network, there
are more steps involved including setting up certificates and publishing Work Folders.
The setup I am using here will show the features of Work Folders; however, it is not very secure
and should only be used in a test network.
The first step that I will do is open RegEdit. RegEdit can be used to configure additional
options in Work Folders that cannot be configured in the interface. In this case, I will use
RegEdit to allow unsecured connections. This makes Work Folders easy to set up, as certificates
will no longer be required. It is generally not recommended to do this in a production
environment. The only exception to this is if your company has a need to inspect data
travelling over the network and thus cannot be encrypted. Usually when this is done a
reverse proxy is used, so at least some of the transmission path is encrypted.
To add the required key, I will expand down through HKey Local Machine, Software, Microsoft
and then scroll down to Windows and then expand current version. There may not be a key for
Work Folders created already. To create one, I will right click on current version and
select �new key� and name the key �Work Folders� with no spaces. This will be used
to store the additional settings for Work Folders that cannot be configured in the interface.
To create a new value, I will right click on the white space and then select the option
new �DWORD 32bit Value�. For the name of the value I will use AllowUnsecureConnection.
I will then open the value and set the value to 1.
Once this is done, I can close RegEdit and then right click on the start menu and select
the option for control panel. From the search option in control panel I will enter in �work�
and then select the option �Manage Work Folders� when the option appears.
The next step is to configure a Work Folder. To do this, I will select the option �Set
up Work Folders�. The next step is to enter in an e-mail address. There is more configuration
required in order for Work Folders to accept e-mail addresses. For this demonstration I
have not performed that configuration and instead just performed a basic install so
we can look at the basic features of Work Folders. Instead of entering in an e-mail
address I will select the option below this ”Enter a Work Folder URL instead”.
For the URL I will enter in the fully qualified domain name of NYDC1 and move onto the next
screen. The next screen asks where you want to store Work Folders. The default option
will create a ”Work Folders” folder in the user’s profile. You can change this
if you wish or change it later on if required. In this case, I will accept the default and
move on.
On the next screen, the policies of the Work Folders need to be accepted. If you recall
when I created the Work Folder, the two options were to ”Encrypt Work Folders” and ”Automatically
lock screen, and require a password”. The user must accept these policies in order to
start using Work Folders. To do this, I will tick the option and press ”Set Up Work Folders
to continue”.
This will complete the wizard, once I press ”close”, the Work Folders setup will be
complete. Notice that the Work Folders folder will automatically be opened.
In the folder, I will create a folder and a text document. This will allow the basic
features of Work Folders for synchronization to be demonstrated.
Once the folder and the text document have been created, you will notice something interesting
about them. Notice that for both of them the filenames have turned green. If I now open
the properties for the text document and then press the advanced button. Notice that the
option ”Encrypt contents to secure data” has been ticked. Essentially what has happened
is that when you configure Work Folders to encrypt data it will use EFS to encrypt the
data. Windows Explorer shows files and folders that are encrypted with EFS in green.
I will now close all these Windows and go back to the control panel. Work Folders will
automatically synchronize with the server. You will notice, in the middle of the screen,
the date and time when the last sync was performed. Below this, notice ”No file errors”. If
there is a synchronize error, it will be listed here. Work Folders uses a last write wins
for synchronizing. If there is a conflict the last device to write to the file is considered
the most current. The conflicting file will be renamed to have the device name after the
filename allowing the user to access this version if it is the version you wanted. If
you want to force a synchronization to happen, you can select the option on the left ”Sync
Now”.
That completes the setup for Work Folders on the client. Before I finish the video I
will change back to my Windows Server to have a look at the file structure used by Work
Folders.
If I open Windows Explorer, I will next open the folder WorkFolders that I created and
configured the Work Folders sync folder to use. You will notice a directory called Administrator.
The user that I used in the demonstration was the domain administrator and thus this
is why this folder was created. This folder structure was used because of the ”User
alias” settings I chose during the setup wizard. If I had selected ”User alias@domain”
the folder would have @ ITFreeTraining on the end.
If I open the administrator folder, notice the folder and the document that I created.
Also notice that they have not been encrypted. This essentially means that if the user lost
access to their files due to not being able to access their decryption key, the decrypted
files will still be available here. The user could download the files again and encrypt
them again. It is still a good idea to have a disaster recovery agent to prevent any changes
that have not been synchronized to the server from being lost when the decryption key is
lost. With EFS, without a disaster recovery agent, all it takes is for the user to forget
their password and access to these files is lost.
That covers it for the basic features and a basic set up for Work Folders. I hope you
have liked this video and found it informative. For more free videos please see our YouTube
channel or web site. Until the next video, thanks for watching.