Windows 8.1 is the latest release of the Windows operating system for client computers. Windows 8.1 natively supports image-based installation and deployment. Windows 8.1, Windows 8.1 Pro, and Windows 8.1 Enterprise support 32-bit x86 and 64-bit x64 processors for PCs and tablets. Windows 8.1 RT supports ARM processors. For many advanced features, including BitLocker, Encrypting File System, Domain Join, Group Policy, and the Remote Desktop host, computers will need Windows 8.1 Pro or Windows 8.1 Enterprise.

Windows 8.1 has many enhancements to improve security, including memory randomization and other improvements to prevent malware from inserting itself into startup and running processes. Windows 8.1 uses address space layout randomization (ASLR) to randomly determine how and where important data is stored in memory, which makes it much more difficult for malware to find the specific locations in memory to attack.

Windows 8.1 has enhanced support for devices that use Trusted Platform Module (TPM). Although always-on devices require TPM 2.0, all other devices require at least TPM 1.2. Firmware can use TPM to store hashes, which verify that important operating system files haven’t been changed, and keys, which verify that digital signatures are valid.

Windows 8.1 requires a processor that includes hardware-based Data Execution Prevention (DEP) support. DEP uses the Never eXecute (NX) bit to mark blocks of memory as data that should never be run as code. DEP has two specific benefits. It reduces the range of memory that malicious code can use and prevents malware from running any code in memory addresses marked as Never eXecute.

If your organization doesn’t use an enterprise malware solution, you’ll also be interested to know that Windows Defender for Windows 8.1 has been upgraded to a more fully featured program. Windows Defender now protects against viruses, spyware, rootkit, and other types of malware. Rootkit detection helps to safeguard PCs and tablets from malware that inserts itself into non-Microsoft drivers. If Windows Defender detects that a non-Microsoft driver has been infected, it prevents the driver from starting. It’s important to point out that other features, such as Secure Boot, Trusted Boot, and Measured Boot, protect Microsoft drivers and other critical operating system files.

Separate distribution media is provided for 32-bit and 64-bit editions of Windows 8.1. To install the 32-bit edition of Windows 8.1 on an x86-based computer, you need to use the 32-bit distribution media. To install the 64-bit edition of Windows 8.1 on an x64-based computer, you need to use the 64-bit distribution media. Generally, if you are running a 32-bit operating system and want to install a 64-bit operating system (on hardware that supports both), you need to restart the computer and boot from the installation media. The same is generally true if you want to install a 32-bit operating system on a computer running a 64-bit operating system.

Windows 8.1 uses modularization for language independence and disk imaging for hardware independence. Each component of the operating system is designed as an independent module that you can easily add or remove. This functionality provides the basis for the configuration architecture in Windows 8.1. Microsoft distributes Windows 8.1 on media with disk images that use compression and single-instance storage to dramatically reduce the size of image files. The format for disk images is the Windows Imaging (WIM) format.

The Windows Preinstallation Environment (Windows PE) replaces MS-DOS as the preinstallation environment and provides a bootable startup environment for installation, deployment, recovery, and troubleshooting. The Windows Preboot Environment provides a startup environment with a boot manager that lets you choose which boot application to run to load the operating system. On systems with multiple operating systems, you access operating systems prior to Windows 7 in the boot environment by using the legacy operating system entry.

User Account Control (UAC) enhances computer security by ensuring true separation of standard user and administrator user accounts. Through UAC, all applications are run by using either standard user or administrator user privileges, and you get a security prompt by default whenever you run an application that requires administrator privileges. The way the security prompt works depends on Group Policy settings. Additionally, if you log on by using the built-in Administrator account, you typically do not get elevation prompts.

Windows 8.1 has several key UI elements, including the following:

The Start screen replaces the traditional Start menu. Start is a window, not a menu. Programs can have tiles on the Start window. Tapping or clicking a tile runs the program. When you press and hold or right-click a tile, an options panel rather than a shortcut menu normally is displayed.

From Start, one way to quickly open a program is by simply typing the file name of the program and then pressing Enter. This shortcut works as long as the Everywhere Search box is in focus (which it typically is by default).

Pressing the Windows key switches between the Start screen and the desktop or the current app you are working with (or, if you are working with PC Settings, between Start and PC Settings). On the Start screen, there’s a Desktop tile that you can tap or click to display the desktop. You also can display the desktop by pressing Windows key + D or, to peek at the desktop, press and hold Windows key + , (that’s the Windows key plus the comma key).

The Charm bar is an options panel for Start, Desktop, and PC Settings. With touch UI, you can display the Charm bar by sliding in from the right side of the screen. With a mouse and keyboard, you can display the Charm bar by moving the pointer over the hidden button in the upper-right or lower-right corner of the Start, Desktop, or PC Settings screen; or by pressing Windows key + C.

The Charm bar has the following five charms:

You also can display the Settings panel by pressing Windows key + I. From the settings panels, you can:

Start Settings, Desktop Settings, and PC Settings have nearly—but not exactly—identical Settings panels. The Start Settings panel has a Tiles option that you can tap or click to display an option for adding or removing tiles for the administrative tools to the Start screen and an option for clearing personal information from tiles. The Desktop Settings panel has several quick links, including:

Thus, when you are working with the desktop, one way to quickly open Control Panel is by pressing Windows key + I, and then clicking Control Panel on the Settings panel.

File Explorer is pinned to the desktop taskbar by default, which means you can also access Control Panel by following these steps:

Another technique you’ll want to quickly master is getting to the Apps screen, which lists installed apps alphabetically within app categories. Apps are listed first in the results whenever you perform an Everywhere search. On the Start screen, you’ll find a button with an arrow pointing down; tapping or clicking this button displays the Apps screen. On the Apps screen, you’ll find lists of all installed programs, organized by category. Apps listed in the Windows System category are ones you’ll often use for administration, including Command Prompt, Control Panel, Task Manager, File Explorer, This PC, and Windows PowerShell. Administrative tools are only displayed on the Apps screen if you previously selected the Tiles option on the Start Settings panel and then selected Show Administrative Tools.

With Windows 8.1, you might want to use Windows PowerShell as your go-to prompt for entering both standard Windows commands and Windows PowerShell commands. Although anything you can enter at a command prompt can be entered at the Windows PowerShell prompt, it’s important to remember that this is possible because Windows PowerShell looks for external commands and utilities as part of its normal processing. As long as the external command or utility is found in a directory specified by the PATH environment variable, the command or utility is run as appropriate. However, keep in mind that Windows PowerShell execution order could affect whether a command runs as expected. For Windows PowerShell, the execution order is (1) alternate built-in or profile-defined aliases; (2) built-in or profile-defined functions; (3) cmdlets or language keywords; (4) scripts with the .ps1 extension; and (5) external commands, utilities, and files. Thus, if any element in 1 to 4 of the execution order has the same name as a command, that element will run instead of the expected command.

Windows 8.1 ships with Windows PowerShell. When you’ve configured Windows PowerShell for remote access, you can execute commands on remote computers in a variety of ways. One technique is to establish a remote session with the computers with which you want to work. The following example and partial output shows how you can check the Windows edition on remote computers:

$s = new-pssession -computername engpc15, hrpc32, cserpc28 invoke-command
-session $s {dism.exe /online /get-currentedition}

The following is the resulting partial output:

Deployment Image Servicing and Management tool Version: 6.1.7600.16385

Image Version: 6.1.7600.16385

Current Edition : Ultimate
The operation completed successfully.

The internal version number for Windows 7 is 6.1, whereas the internal versions for Windows 8 and Windows 8.1 are 6.2 and 6.3 respectively. Thus, based on this output, you know the computer is running Windows 7 Ultimate edition (and hasn’t been upgraded to Windows 8.1 yet).

Since it was introduced for Windows operating systems, 64-bit computing has changed substantially. Not only do computers running 64-bit versions of Windows perform better and run faster than their 32-bit counterparts, they are also more scalable because they can process more data per clock cycle, address more memory, and perform numeric calculations faster.

Windows 8.1 PCs and tablets support x64 architecture. This architecture is based on 64-bit extensions to the x86 instruction set, which is implemented in AMD Opteron (AMD64) processors, Intel Xeon processors with 64-bit extension technology, and other processors. This architecture offers native 32-bit processing and 64-bit extension processing, allowing simultaneous 32-bit and 64-bit computing.

In general, 64-bit computing is designed for performing operations that are memory intensive and that require extensive numeric calculations. With 64-bit processing, applications can load large data sets entirely into physical memory (that is, RAM), which reduces the need to page to disk and increases performance substantially.

Currently, the prevalent firmware interfaces are:

Computers based on x86 use BIOS and the master boot record (MBR) disk type for boot and system volumes. Computers based on x64 use UEFI wrapped around BIOS or EFI. UEFI and EFI support the GUID partition table (GPT) disk type for boot and system volumes. This means that there can be differences in the way you manage computers with these architectures, particularly when it comes to setup and disk configuration. However, with the increasing acceptance and use of UEFI and the ability of Windows 8.1 to use both MBR and GPT disks regardless of firmware type, the underlying chip architecture won’t necessarily determine what firmware type and disk type a computer uses. This decision is in the hands of the hardware manufacturer.

In most cases, 64-bit hardware is compatible with 32-bit applications; however, 32-bit applications perform better on 32-bit hardware. Windows 64-bit editions support both 64-bit and 32-bit applications by using the Windows on Windows 64 (WOW64) x86 emulation layer. The WOW64 subsystem isolates 32-bit applications from 64-bit applications. This prevents file system and registry problems. The operating system provides interoperability across the 32-bit/64-bit boundary for the Component Object Model (COM) and for basic operations such as cutting, copying, and pasting using the Clipboard. However, 32-bit processes cannot load 64-bit dynamic-link libraries (DLLs), and 64-bit processes cannot load 32-bit DLLs.

In the shift to 64-bit computing, you might want to track which computers in the enterprise support 64-bit operating systems, which computers are already running 64-bit operating systems, or both.

With Windows PowerShell, you can:

Here, the first sample output tells you the computer is running a 32-bit version of Windows. The second sample output tells you the computer has an x64 processor. As a result, you know the computer can be upgraded to a 64-bit version of Windows 8.1. Rather than check each computer individually, you could create a script to do the work for you.

Although Windows 8.1 continues to support 16-bit applications, it’s important to point out that Windows 8.1 might restrict access to the 16-bit MS-DOS subsystem (ntvdm.exe). If so, the MS-DOS subsystem is prevented from running, and this in turn prevents 16-bit applications from running.

In Group Policy for Active Directory Domain Services or local policy for the computer, the Prevent Access To 16-bit Applications setting under Computer ConfigurationWindows ComponentsApplication Compatibility controls whether 16-bit applications can run. As with previous versions of Windows, when this setting is enabled, Windows 8.1 blocks access to 16-bit applications and prevents them from running.

In an important change, if the setting is not configured in policy, Windows 8.1 runs the 16-bit application control panel, which might require elevated administrator privileges to run the 16-bit application. Therefore, if you want to allow 16-bit applications to run without requiring elevated administrator privileges, you must set Prevent Access To 16-bit Applications to Disabled.

With Windows 8.1, you can deploy custom builds to computers through manual and automated processes. To deploy Windows by using manual processes, you need to create the required boot and installation images and optionally create recovery images. To automate the deployment process, you need to install Windows Deployment Services. Whether you use a completely manual process, a completely automated process, or some combination of the two, you’ll perform similar administrative tasks. These tasks require you to understand and use the Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1 and Windows Deployment Services.

The Windows Assessment and Deployment Kit for Windows 8.1 is available from the Microsoft Download Center (download.microsoft.com) and contains the tools for deploying Windows images, including the following:

You can use Windows Deployment Services to deploy Windows 8.1 over a network. You can add the Windows Deployment Services role to any server running Windows Server 2012 RTM or R2.

Windows 8.1 and Windows Server 2012 RTM or R2 use Windows PE. Windows PE is a bootable startup environment that provides operating system features for the following:

Windows PE is modular and extensible, and it provides full access to partitions formatted by using the FAT or NTFS file system. Because Windows PE is built from a subset of Windows components, you can run many Windows applications, work with hardware devices, and communicate across IP networks. Several command-line tools are available in Windows PE, including:

Copype and Makewinpemedia are new tools that allow you to more easily create bootable Windows PE media. You use Copype to set up the Windows PE build environment. After you optimize the build as necessary, you can use Makewinpemedia to create the bootable media, which can be a CD, DVD, USB flash drive, or external USB hard drive.

dism /online /get-targeteditions

dism /online /get-features

dism /online /enable-feature /featurename:Microsoft-hyper-v /all

get-wmiobject win32_networkadapter | format-list guid

dism /mount-wim /wimfile:Path /index:Index /mountdir:MountPath

dism /mount-wim /wimfile:c:winpe_x86isosourcesoot.wim /index:1 /
mountdir:C:Win8

dism /commit-wim /mountdir:C:Win8

dism /unmount-wim /mountdir:C:Win8

Windows 8.1 Pro and Enterprise are the main editions intended for use in Active Directory domains. When you install Windows 8.1 on a computer with an existing operating system, you can perform a clean installation or an upgrade. The major differences between a clean installation and an upgrade are the following:

The way an upgrade works depends on the operating system being upgraded. When you are upgrading from Windows 7, Windows Setup performs an in-place upgrade that ensures the upgrade works as described previously. With Windows Vista and Windows XP, an in-place upgrade works differently. With Windows Vista, you can retain user accounts, user files, and user settings, as well as basic system configuration, but Windows Setup will not retain applications and their settings. With Windows XP, you can retain user accounts, user files, and user settings, but Windows Setup will not retain applications and their settings or basic system configuration.

When the operating system starts after installation, you can log on and access the desktop. By default, Windows 8.1 stores user profile data under %SystemDrive% Users\%UserName%. Within the user profile folder, each user who logs on to the system has a personal folder, and that personal folder contains additional folders. These folders are the default locations for storing specific types of data and files:

Windows 8.1 uses personal folders and personal libraries. Personal folders are listed in the left pane of File Explorer and displayed in the main pane when you select the This PC node. Libraries are displayed in File Explorer only when you select the Libraries node.

Libraries work differently than they do in Windows 8 and earlier versions of Windows. Although libraries are still collections of files and folders that are grouped together and presented through a common view, the data they collect is different.

In earlier versions of Windows, libraries collected a user’s personal data and a computer’s public data. In Windows 8.1, libraries collect locally stored personal data and cloud-stored personal data. Thus, if a user has a connected local or connected domain account, locally stored data is collected with data stored on SkyDrive. For example, the Documents library collects the data from a user’s locally stored Documents folder and a user’s cloud-stored Documents folder.

When you are working with the Libraries node in File Explorer, you can create new libraries to act as views to various collections of data by pressing and holding or right-clicking an open area of the main pane, pointing to New, and then selecting Library.

Windows 8.1 provides themes that allow you to easily customize the appearance of menus, windows, and the desktop. In Control Panel, tap or click the Change The Theme link under Appearance And Personalization, and then choose the theme you want to use. Windows Default themes such as Earth or Flowers add improved visual design and enhanced dynamic effects to the interface. If you want to use fewer advanced features, choose the Windows theme. Additional themes are available online as well.

It is important to point out, however, that the interface enhancements that can be used on a computer depend on which Windows 8.1 edition is installed and on the computer’s hardware.

Using Action Center and activating Windows

By default, when you log on, the operating system displays an Action Center summary icon in the desktop notification area. This icon has a white flag on it. Action Center is a program that monitors the status of important security and maintenance areas. If the status of a monitored item changes, Action Center updates the notification icon as appropriate for the severity of the alert. If you tap or click this icon, Windows displays a dialog box with a summary listing of each alert or action item that needs your attention. Tap or click an action item link to run the related solution. Tap or click the Open Action Center link to display the Action Center.

If you’ve disabled Action Center notifications on the taskbar, you can start Action Center by following these steps:

1. In Control Panel, tap or click the System And Security category heading link.

2. Tap or click Action Center.

Action Center, shown in Figure 1-1, provides an overview of the computer’s status and lists any issues that need to be resolved. After you have installed Windows 8.1, action alerts in Action Center might let you know that device drivers are available and need to be installed. Simply tap or click the action item to begin the driver installation process. For detailed information on working with Action Center, see the Using automated Help and support section in Chapter 8.

Figure 1-1. The Action Center window shows issues that need user attention.

Windows 8.1 Pro and Enterprise editions support volume licensing. Although volume-licensed versions of Windows 8.1 might not require activation or product keys, retail versions of Windows 8.1 require both activation and product keys. You can determine whether Windows 8.1 has been activated in Control Panel by tapping or clicking System And Security, and then tapping or clicking System. On the System page, read the Windows Activation entry. This entry specifies whether you have activated the operating system. If Windows 8.1 has not been activated and you are connected to the Internet, select View Details In Windows Activation, and then tap or click Activate.

Running Windows 8.1 in groups and domains

Computers running Windows 8.1 can be members of a homegroup, a workgroup, a workplace, or a domain. A homegroup is a loose association of computers on a home network. Computers in a homegroup share data that can be accessed by using a password common to the users in the homegroup. You set the homegroup password when you set up the homegroup and can modify the password as necessary at any time.

A workgroup is a loose association of computers in which each computer is managed separately. A workplace is a loose association of computers that grants access to certain internal network resources and business apps. A domain is a collection of computers that you can manage collectively by means of domain controllers, which are servers running Windows that manage access to the network, to the directory database, and to shared resources.

Real World

Workplaces are new in Windows 8.1 and so are Work Folders. Don’t confuse these two features. Workplaces are a middle ground between traditional workgroups and domains. Computers that are members of a workplace can access internal network resources, such as internal websites and business applications. Work Folders allow users to synchronize their corporate data to their devices and vice versa. Those devices can be joined to the corporate domain or a workplace. To deploy Work Folders, an administrator adds the File And Storage Services > Work Folders role to a server, and then configures Work Folders by using Server Manager. Because Work Folders make use of the IIS hostable web core, the folders are accessed via a remote web gateway running on IIS.

Homegroups are available when a computer running Windows 8.1 is connected to a home network. Workgroups, workplaces, and domains are available when a computer running Windows 8.1 is connected to a work network.

Some aspects of Windows 8.1 vary depending on whether a computer is a member of a homegroup, workgroup, workplace, or domain. The sections that follow discuss these differences as they pertain to UAC, logon, fast user switching, and password management.

Understanding UAC in Windows 8.1

In a homegroup, workgroup, or workplace, a computer running Windows 8.1 has only local machine accounts. In a domain, a computer running Windows 8.1 has both local machine accounts and domain accounts. Windows 8.1 has two primary types of local user accounts:

• Standard. Standard user accounts can use most software and can change system settings that do not affect other users or the security of the computer.

• Administrator. Administrator user accounts have complete access to the computer and can make any necessary changes.

Windows 8.1 has a special type of local user account called a Microsoft account. Microsoft accounts can be thought of as synchronized local accounts and are discussed in detail in the Understanding user and group accounts section in Chapter 5.

Windows 8.1 includes UAC as a way to enhance computer security by ensuring true separation of standard user and administrator user accounts. Because of the UAC feature in Windows 8.1, all applications run by using either standard user or administrator user privileges. Whether you log on as a standard user or as an administrator user, you get a security prompt by default whenever you run an application that requires administrator privileges. The way the security prompt works depends on Group Policy settings (as discussed in the Optimizing UAC and Admin Approval Mode section in Chapter 5) and whether you are logged on with a standard user account or an administrator user account.

When you are logged on with a standard user account, you are asked to provide a password for an administrator account, as shown in Figure 1-2. In a homegroup, workgroup, or workplace, each local computer administrator account is listed by name. To proceed, you must tap or click an account, enter the account’s password, and then tap or click Yes.

Figure 1-2. This User Account Control dialog box prompts for administrator credentials.

In a domain, the User Account Control dialog box does not list any administrator accounts, so you must know the user name and password of an administrator account in the default (logon) domain or a trusted domain to continue. When Windows prompts you, enter the account name and password, and then tap or click Yes. If the account is in the default domain, you don’t have to specify the domain name. If the account is in another domain, you must specify the domain and the account name by using the format domainusername, such as cpandlwilliams.

When you are logged on with an administrator user account, you are asked to confirm that you want to continue, as shown in Figure 1-3. You can tap or click Yes to allow the task to be performed, or tap or click No to stop the task from being performed. Tapping or clicking Show Details shows the full path to the program being executed.

Figure 1-3. This User Account Control dialog box prompts for confirmation to continue.

Elevation of privileges allows a standard user application to run with administrator privileges. You can run applications with elevated privileges by following these steps:

1. Press and hold or right-click the application’s tile or shortcut, and then tap or click Run As Administrator.

2. When the User Account Control prompt appears, proceed as you normally would to allow the application to run with administrator privileges.

Note

You must run the command prompt with elevated privileges to perform administration at the command line. If you do not do this, you will get an error when you try to run an administrator utility or perform a task that requires administrator privileges.

Logging on to, shutting down, and restarting Windows 8.1

Windows 8.1 displays a Lock screen at startup. When you click the Lock screen, you get the Welcome screen. The behavior of the Welcome screen depends on Group Policy settings and the computer’s homegroup, workgroup, or domain membership.

Keep the following in mind:

• In a homegroup, workgroup, or workplace, the Welcome screen shows a list of accounts on the computer. To log on with one of these accounts, tap or click the account and enter a password if required.

• In a domain, the name of the last user to log on is displayed by default on the Welcome screen. You can log on with this account by entering the required password. You can log on as another user as well by clicking the Switch User button, selecting one of the alternative accounts listed, and then providing the password for that account or clicking Other User to enter the user name and password for the account to use. Note that the Switch User button has a left-pointing arrow in a circle and is to the left of the account picture.

By default, the last account to log on to the computer is listed in computerusername or domainusername format. To log on to this account, you enter the account password, and then tap or click the Submit button. The Submit button is part of the Password box, and shows a right-pointing arrow. To log on to a different account, tap or click Switch User, press Ctrl+Alt+Del, and then tap or click Other User. The logon information that you must provide depends on what type of account you are using:

• If the account is in the current/default domain, enter the user name and password, and then tap or click the arrow button.

• If the account is in another domain, you must specify the domain and the account name by using the format domainusername, such as cpandlwilliams.

• If you want to log on to the local machine, enter .username, where username is the name of the local account, such as .williams.

When you are logged on, you can display the Windows Logon screen by pressing Ctrl+Alt+Del. This screen allows you to lock the computer, switch users, sign out, change a password, or start Task Manager. The Power button is in the lower-right corner of the screen. Tapping or clicking the Power button displays Sleep, Shut Down, and Restart options.

Because Shut down and Restart are options of the Power settings, you also can shut down or restart a computer by following these steps:

1. Slide in from the right side of the screen or press Windows key + C.

2. Tap or click Settings, and then tap or click Power.

3. Tap or click Shut Down or Restart as appropriate.

Note

Windows 8.1 supports fast user switching in domain, homegroup, and workgroup configurations. When a user is logged on to a computer running Windows 8.1, you can use fast user switching to allow another user to log on without requiring the current user to log off. To switch users, press Ctrl+Alt+Del, and then tap or click Switch User.

Managing user account passwords with Windows 8.1

Windows 8.1 provides fast and easy ways to manage user account passwords. You can easily perform the following tasks:

• Change the current user’s password.

• Change the password for another domain or local computer account.

• Create a password reset disk.

• Reset a user’s password.

These tasks are discussed in the sections that follow.

Changing the Current User’s Password

You can change the current user’s password by completing the following steps:

1. Press Ctrl+Alt+Del, and then tap or click the Change A Password option.

   Note

   In a domain, the current user’s domain account name is listed in domainusername format. In a homegroup, workgroup, or workplace, the current user’s local account name is listed.

2. Enter the current password for the account in the Old Password text box.

3. Enter and confirm the new password for the account in the New Password and the Confirm Password text boxes.

4. Tap or click the arrow button to confirm the change.

Changing Other Account Passwords

You can change the password for a domain or a local account other than the current user’s account by completing these steps:

1. Press Ctrl+Alt+Del, and then tap or click the Change A Password option.

2. Tap or click in the User Name text box, and then enter the name of the account.

   Note

   For a domain account, specify the domain and the account name by using the format domainusername, such as cpandlwilliams. For a local computer account, enter .username, where username is the name of the local account, such as .williams.

3. Enter the current password for the account in the Old Password text box.

4. Enter and confirm the new password for the account in the New Password and the Confirm Password text boxes.

5. Tap or click the arrow button to confirm the change.

Creating and Using a Password Reset Disk

Passwords for domain users and local users are managed in different ways. In domains, passwords for domain user accounts are managed by administrators. Administrators can reset forgotten passwords by using the Active Directory Users And Computers console.

In homegroups and workgroups, passwords for local machine accounts can be stored in a secure, encrypted file on a password reset disk, which is a USB flash drive that contains the information needed to reset your password. You can create a password reset disk for the current user by completing these steps:

1. Press Ctrl+Alt+Del, and then tap or click the Change A Password option.

2. Tap or click Create A Password Reset Disk to start the Forgotten Password Wizard.

3. In the Forgotten Password Wizard, read the introductory message. Insert the USB flash drive you want to use, and then tap or click Next.

4. Select the USB flash drive you want to use in the drive list. Tap or click Next.

5. Enter the current password for the logged on user in the text box provided, and then tap or click Next.

6. After the wizard creates the password reset disk, tap or click Next, remove the disk, and then tap or click Finish.

Be sure to store the password reset disk in a secure location because anyone with access to the disk can use it to gain access to the user’s data. If a user is unable to log on because he or she has forgotten the password, you can use the password reset disk to create a new password and log on to the account by using this password.

Real World

You can use BitLocker To Go to protect and encrypt USB flash devices and other removable media drives. When a user is logged on, protected media can be unlocked by using a password or a smart card with a smart card PIN. However, when a user isn’t logged on, the protected drive cannot be accessed. Because of this, you shouldn’t protect password reset disks with BitLocker To Go.

Resetting a User’s Password

Administrators can reset forgotten passwords by using the Active Directory Users And Computers console. In homegroups and workgroups, you can reset a password by following these steps:

1. On the Log On screen, tap or click the arrow button without entering a password, and then tap or click OK. The Reset Password option should be displayed. If the user has already entered the wrong password, the Reset Password option might already be displayed.

2. Insert the disk or USB flash device containing the password recovery file, and then tap or click Reset Password to start the Reset Password Wizard.

3. In the Reset Password Wizard, read the introductory message, and then tap or click Next.

4. Select the device you want to use in the drive list, and then tap or click Next.

5. On the Reset The User Account Password page, enter and confirm a new password for the user.

6. Enter a password hint, and then tap or click Next. Tap or click Finish.

Power plans, sleep modes, and shutdown

Normally, computers running Windows 8.1 use the Balanced power plan, and this power plan turns off the display and puts the computer in sleep mode automatically after a specified period of time passes with no user activity.

When entering the sleep state, the operating system automatically saves all work, turns off the display, and puts the computer in sleep mode. Sleep mode is a low-power consumption mode in which the state of the computer is maintained in the computer’s memory, and the computer’s fans and hard disks are turned off.

Windows 8.1 saves the computer state before entering sleep mode, and you don’t need to exit programs before you do this. Because the computer uses very little energy in the sleep state, you don’t have to worry about wasting energy.

Tip

Sleep mode works in slightly different ways depending on the type of computing device. Often you can turn off and turn on mobile computers by closing or opening the lid. When you close the lid, the laptop enters the sleep state. When you open the lid, the laptop wakes up from the sleep state. If the laptop is in the sleep state for an extended amount of time, or the laptop’s battery runs low on power, the state of the computer is saved to the hard disk and then the computer shuts down completely. This final state is similar to the hibernate state used in early versions of Windows.

To view or modify the default power options, open Control Panel. In Control Panel, tap or click System And Security, and then, under Power Options, tap or click Change When The Computer Sleeps. The options available depend on the type of computing device. With mobile computers and tablets, as shown in Figure 1-4, you might be able to set On Battery and Plugged In options for turning off the display, putting the computer to sleep, and adjusting the display brightness. With desktop computers, you can only specify when the display is turned off and when the computer goes to sleep. Tap or click Save Changes to save your changes.

You can cause most computers to enter the sleep state by tapping or clicking the Settings charm button, tapping or clicking Power, and then tapping or clicking Sleep. To wake the computer from the sleep state, you can press and hold somewhere on the touch screen, move the mouse, or press any key on the keyboard. Note that some computers have separate power and sleep buttons on their case. The way these buttons work can be set through the power plan options.

Figure 1-4. Configure power options to optimize power management for the computer.

There are instances in which a computer can’t use the sleep state. The system hardware, state, and configuration can affect the way the power and sleep buttons work. Some computer hardware doesn’t support the sleep state. In this case, the computer can’t use the sleep state. This is also the case when the computer has updates installed that require a restart or when you’ve installed programs that require a restart. Additionally, if an administrator has reconfigured the power options on the computer and set the power button, the sleep button, or both to alternative actions, the computer will use those actions instead of the default shutdown and sleep actions.

Caution

When working with computers in the sleep state, keep in mind that the computer is still drawing power. You should never install hardware inside the computer when it is in the sleep state. To avoid possible confusion regarding the sleep state and the power off state, be sure to unplug desktop computers running Windows 8.1 before installing internal devices. External devices are exceptions. You can connect USB, FireWire, and eSATA devices without shutting down the computer.

To change the default setting for the power button, open Control Panel. In Control Panel, tap or click System And Security, and then, under Power Options, tap or click Choose What The Power Buttons Do. As before, the options available depend on the type of computing device. With mobile computers, as shown in Figure 1-5, you might be able to set On Battery and Plugged In options that specify what happens when you press the power button, what happens when you press the sleep button, and what happens when you close the lid. Optionally, you can tap or click Change Settings That Are Currently Unavailable, and then do any of the following:

• Choose Require A Password to require a password to log on after waking the computer from sleep.

• Choose Turn On Fast Startup to save system information to a file on the system disk when you shut down the computer. This file is then read during startup to enable faster startup. When you restart a computer, Fast Startup is not used.

• Choose the Power options you want displayed when you click Power.

Save your changes by tapping or clicking Save Changes.

Figure 1-5. Configure power button options.

If you want to truly know how Windows 8.1 works and what makes it tick, you need to dig under the hood. Windows 8.1 doesn’t start from an initialization file. Instead, the operating system uses the Windows Boot Manager to initialize and start the operating system.

The boot environment dramatically changes the way the operating system starts. The boot environment was created by Microsoft to resolve several prickly problems related to boot integrity, operating system integrity, and firmware abstraction. The boot environment is loaded prior to the operating system, making it a pre–operating system environment. As such, the boot environment can be used to validate the integrity of the startup process and the operating system itself before actually starting the operating system.

The boot environment is an extensible abstraction layer that allows the operating system to work with multiple types of firmware interfaces without requiring the operating system to be specifically written to work with these firmware interfaces. Rather than updating the operating system each time a new firmware interface is developed, firmware interface developers can use the standard programming interfaces of the boot environment to allow the operating system to communicate as necessary through the firmware interfaces.

Firmware interface abstraction is the first secret ingredient that makes it possible for Windows 8.1 to work with BIOS-based and EFI-based computers in exactly the same way, and this is one of the primary reasons Windows 8.1 achieves hardware independence.

The next ingredient for hardware independence is Windows Imaging (WIM) format. Microsoft distributes Windows 8.1 on media by using WIM disk images. WIM uses compression and single-instance storage to dramatically reduce the size of image files. Using compression reduces the size of the image in much the same way that zip compression reduces the size of files. Using single-instance storage reduces the size of the image because only one physical copy of a file is stored for each instance of that file in the disk image.

The final ingredient for hardware independence is modularization. Windows 8.1 uses modular component design so that each component of the operating system is defined as a separate, independent unit or module. Because modules can contain other modules, various major features of the operating system can be grouped together and described independently of other major features. Because modules are independent from each other, modules can be swapped in or out to customize the operating system environment.

Windows 8.1 includes extensive support architecture. At the heart of this architecture is built-in diagnostics and troubleshooting. Microsoft designed built-in diagnostics and troubleshooting to be self-correcting and self-diagnosing or, failing that, to provide guidance while you are diagnosing problems.

Windows 8.1 includes network awareness and network discovery features. Network awareness tracks changes in network configuration and connectivity. Network discovery controls a computer’s ability to detect other computers and devices on a network.

Network awareness allows Windows 8.1 to detect the current network configuration and connectivity status, which is important because many networking and security settings depend on the type of network to which a computer running Windows 8.1 is connected. Windows 8.1 has separate network configurations for domain networks, private networks, and public networks and is able to detect the following:

Windows Firewall in Windows 8.1 supports connectivity to multiple networks simultaneously and multiple active firewall profiles. Because of this, the active firewall profile for a connection depends on the type of connection.

If you disconnect a computer from one network switch or hub and plug it into a new network switch or hub, you might inadvertently cause the computer to think it is on a different network, and depending on Group Policy configuration, this could cause the computer to enter a lockdown state in which additional network security settings are applied. As shown in Figure 1-6, you can view the network connection status in the Network And Sharing Center. In Control Panel, under Network And Internet, tap or click View Network Status And Tasks to access this management console.

Figure 1-6. Determine the network state.

Windows 8.1 tracks the identification status of all networks to which the computer has been connected. When Windows 8.1 is in the process of identifying a network, the Network And Sharing Center shows the Identifying Networks state. This is a temporary state for a network that is being identified. After Windows 8.1 identifies a network, the network becomes an Identified Network and is listed by its network or domain name in the Network And Sharing Center.

If Windows 8.1 is unable to identify the network, the network is listed with the Unidentified Network status in the Network And Sharing Center. In Group Policy, you can set default location types and user permissions for each network state, as well as for all networks, by using the policies for Computer Configuration under Windows SettingsSecurity SettingsNetwork List Manager Policies.

When you are working with the Network And Sharing Center, you can attempt to diagnose a warning status by using Windows Network Diagnostics—another key component of the diagnostics and troubleshooting framework. To start diagnostics, tap or click Troubleshoot Problems, tap or click Internet Connections, and then tap or click Next. Windows Network Diagnostics then attempts to identify the network problem and provide a possible solution.

The Windows diagnostics and troubleshooting infrastructure offers improved diagnostics guidance, additional error reporting details, expanded event logging, and extensive recovery policies. Although early versions of Windows include some help and diagnostics features, those features are, for the most part, not self-correcting or self-diagnosing. Windows now can detect many types of hardware, memory, and performance issues and resolve them automatically or help users through the process of resolving them. For more information, see the Working with the automated Help and support system section in Chapter 8.

Error detection for devices and failure detection for disk drives also are automated. If a device is having problems, hardware diagnostics can detect error conditions and either repair the problem automatically or guide the user through a recovery process. With disk drives, hardware diagnostics can use fault reports provided by disk drives to detect potential failure and alert you before this happens. Hardware diagnostics can also help guide you through the backup process after alerting you that a disk might be failing.

Windows 8.1 can automatically detect performance issues, which include slow application startup, slow boot, slow standby/resume, and slow shutdown. If a computer is experiencing degraded performance, Windows diagnostics can detect the problem and provide possible solutions. For advanced performance issues, you can track related performance and reliability data in the Performance Monitor console, which is an administrative tool.

Windows 8.1 can also detect issues related to memory leaks and failing memory. If you suspect that a computer has a memory problem that is not being automatically detected, you can run Windows Memory Diagnostic manually by completing the following steps:

If a computer crashes because of failing memory and Memory Diagnostic detects this, you are prompted to schedule a memory test the next time the computer is started.