Licensing the Windows To Go Feature of Windows 8

Posted: 
August 20, 2012
Report by: 

A new Windows 8 feature called Windows To Go (WTG) allows users to boot a computer from a Windows 8 image on a USB drive. WTG is attractive to organizations because users who need to connect to the organization's network from an unmanaged computer can do so using a corporate-sanctioned instance of Windows 8 Enterprise edition. However, use of WTG generally requires devices to have Software Assurance (SA) on Windows, an Intune subscription, or a Virtual Device Access (VDA) subscription, and customers must be careful to properly license both the creation and use of the WTG image on USB drives.

The WTG Experience

To use WTG, a user inserts the WTG USB drive into the computer's USB port and restarts the computer. The computer will then boot from the Windows 8 Enterprise edition image on the USB drive, and the user can then authenticate as required to access the corporate network. While a computer is running a WTG image, the user has access to almost all of the hardware inside the computer, including the computer's processor, RAM, graphics processor, network cards, and wireless modems, and any other attached peripherals, such as a keyboard, a mouse, and a monitor, but by default the user cannot access any data on the computer's internal hard drive or leave any data behind on the hard drive when finished. When the user has finished working, the user shuts down the computer, removes the USB drive, and takes it along to the next computer.

Before a user can use WTG to boot a computer, an administrator has to use a tool, such as System Center Configuration Manager or the Create a Windows To Go Workspace wizard included with Windows 8 Enterprise edition, to create a customized corporate image. These tools allow an administrator to build a bootable image that contains all the necessary Windows 8 Enterprise edition components, as well as any utilities, such as antimalware and virtual private network clients, and applications, including custom line-of-business applications, that the user will need. The WTG USB drive can also be encrypted to protect the information on the drive if it is lost or stolen.

The main attraction of WTG is improved security: Users can employ home computers or other computers that an organization does not control, using a Windows image that the organization does control and maintain. WTG can also be useful in other situations, such as shift workers or contractors who need to employ personal configurations on computers shared with other users.

Two Distinct Rights Needed to Use WTG

Using Windows 8's new WTG feature requires two distinct use rights:

  • The right to create and place a Windows 8 Enterprise edition image on USB drives
  • The right to use such drives to boot computers with the Windows 8 Enterprise edition image.

Creating and Storing WTG Images

Three device-based Windows subscription options include the right to create and store an instance of Windows 8 Enterprise edition on USB drives:

  • A Windows client OS license covered by SA, a subscription add-on to licenses that offers version-upgrade rights and other benefits
  • A Windows Intune subscription, an offering for computers licensed with the Windows client OS that provides Microsoft-hosted management infrastructure and malware protection
  • A VDA subscription, which allows access to Windows client OS instances running on a Virtual Desktop Infrastructure (VDI) by devices that are not licensed for the OS (such as an Apple iPad) or by devices that are licensed for the OS, but do not have active Windows SA or Intune.

To determine how many WTG USB devices can be created, an organization must count the total number of active Windows SA, Intune, and VDA device subscriptions they have. The organization can then create up to two times this number of WTG imaged drives, which can then be used to boot the devices with SA, Intune, or VDA subscription coverage, or with the roaming rights detailed below.

For example, consider an organization that has 500 information workers, each with their own computers. The organization has an additional 1,200 shift workers, who share 600 physical computers (on two different shifts). If all 1,100 computers have a Windows Professional license with a current SA subscription, the organization may create 2,200 USB drives with Windows 8 Enterprise edition images for WTG. This would be sufficient to cover the information workers using WTG as well as the shift workers, who could boot the shared computers with their own WTG images. As a practical matter, an organization that acquires the Windows OS under an Enterprise Agreement, which includes SA, is unlikely to run short of WTG USB drive creation rights.

Booting a WTG Image

The same three subscription types entitle a user to boot a licensed computer covered with the subscription using a WTG USB drive. (For an illustration of this right, see "May I Use a WTG Drive?".)

Furthermore, each of the three subscription options also confers special, albeit limited, WTG roaming use rights to the single primary user of a licensed device, where Microsoft defines a single primary user as the user who uses the licensed device more than 50% of the time in any 90-day period. Whenever the single primary user is off the organization's premises (such as at home or in a hotel), the user has the right to use a WTG USB drive to boot any "qualified third-party device," defined as a device not covered by either of the three subscription types and not "controlled" by the user's employer (with "controlled" generally understood to be a proxy for device ownership or management). These rules are the same as the rules for roaming access to the Windows client OS in a VDI.

However, although shift workers have the right to boot a computer at work (on work premises) from a WTG USB drive image, the "more than 50% of the time" clause in the single primary user definition appears to preclude WTG roaming rights for shift workers. In addition, under certain Bring Your Own Device scenarios, a worker bringing a laptop to work might need a Companion Subscription License (CSL, originally called Companion Device License) to have the right to boot the laptop on premises from a WTG USB image.

License Compliance

Despite the potential benefits of WTG, use of the technology may create license compliance issues related to tracking the number of WTG USB drives configured and in use, as well as monitoring that only appropriately licensed devices are booted with WTG USB drives. Furthermore, other software installed in the Windows 8 WTG image—whether published by Microsoft or another vendor—will have to be properly licensed.

Because both the right to create and the right to use a WTG image are derived from licenses sold by subscription, the WTG right is nonperpetual; administrators may not create and users may not access or use WTG after the Windows SA, Windows Intune, or VDA subscription expires.

Resources

For more technical background on Windows To Go, see "Using the Windows To Go Feature of Windows 8".

Windows To Go licensing rules are documented in Microsoft's Product Use Rights (PUR) document, published quarterly at www.microsoft.com/licensing/about-licensing/product-licensing.aspx. The August 2012 edition is the first to include mention of Windows To Go rights.

The Companion Device License is introduced in "Windows 8 Virtual Desktop Infrastructure Licensing" on page 18 of the June 2012 Update.

VDI licensing rules are outlined in "Licensing the Windows Client OS on VDI Today" on page 15 of the June 2012 Update and "Windows 8 Virtual Desktop Infrastructure Licensing" on page 18 of the June 2012 Update. Although there are significant differences, licensing Windows To Go is substantially similar to licensing Windows for VDI.

I Am A... I Am A...