Friday, 26 February 2016

Exam MB5-705 Managing Microsoft Dynamics Implementations

Published: September 21, 2013
Languages: English, Chinese (Simplified), French, German, Italian, Japanese, Portuguese (Brazil), Russian, Spanish
Audiences: IT professionals
Technology: Microsoft Dynamics Sure Step
Credit toward certification: MCP, Microsoft Dynamics Certified Technology Specialist

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

Explain projects and project management (10-15%)
Define a project
Define project characteristics, describe a project definition, differentiate project versus operational work, explain triple constraint
Explain project life-cycle planning and pitfalls
Explain the project management diamond, recognize recurring project challenges, describe project life-cycle planning
Define project management
Identify the definition of project management, explain project management disciplines, identify project management processes
Describe agile and waterfall models
Explain the differences between agile and waterfall development, describe the different agile methodologies, explain the scrum methodology

Define Microsoft Dynamics Sure Step (10-15%)
Describe Sure Step tools and templates
Define the purpose and value of Microsoft Dynamics Sure Step, describe the functionality of the Microsoft Dynamics Sure Step client, identify the available project types and phases, identify the components of Sure Step, explain how to use the documents view, explain how to use the reference view, identify components of activity and task pages, identify features of Microsoft Dynamics Sure Step Online
Create a project repository
Explain how to create, clone, export, import, and delete Sure Step projects

Initiate a project and prepare for the diagnostic phase (10-15%)
Use solution envisioning and describe the diagnostics phase
Describe solution envisioning, identify deliverables for the diagnostic phase, describe the purpose and objectives of the diagnostic phase, describe the activity flow within the diagnostic phase, describe diagnostic phase preparation, explain diagnostic phase planning
Explain the use of Decision Accelerators
Identify the steps within a Decision Accelerator Offering, use the delivery guides to describe Decision Accelerator best practices, identify activities and deliverables for Decision Accelerators, select the appropriate Decision Accelerator Offering, identify components that are involved in a proposal generation, select an appropriate project type based on an engagement

Deliver Decision Accelerators (10-15%)
Complete a requirements and process review
Identify roles involved, describe the purpose of a requirements and process review, identify activities in a requirements and process review, identify pre-conditions of a requirements and process review
Complete a fit gap and solution blueprint
Identify roles involved, describe the purpose of a fit gap and solution blueprint, identify activities in a fit gap and solution blueprint, identify pre-conditions of a fit gap and solution blueprint

Generate a proposal and final licensing and services agreements (10-15%)
Describe the proposal generation process
Identify activities in final licensing and service agreements, identify deliverables associated with the proposal generation process, describe differences in project types, identify recommendation criteria for project types, define roles and responsibilities by using a RACI matrix, identify components of a project charter
Describe the steps after proposal generation
Describe the purpose of proposal management, select the appropriate step that follows proposal generation, describe the steps that follow proposal delivery

Describe project management disciplines (10-15%)
Manage risk
Describe risk management, identify activities included in risk management, identify the purpose of risk management, identify the pre-conditions of risk management, identify activities and classify by project management process
Manage quality
Describe quality management, identify activities included in quality management, identify the purpose of quality management, identify the pre-conditions of quality management, identify activities and classify them by project management process
Manage communication
Describe communication management, identify activities included in communication management, identify the purpose of communication management, identify the pre-conditions of communication management, identify activities and classify them by project management process
Manage scope
Describe scope management, identify activities included in scope management, identify the purpose of scope management, identify the pre-conditions of scope management, identify activities and classify them by project management process
Manage resources
Describe resource management, identify activities included in resource management, identify the purpose of resource management, identify the pre-conditions of resource management, identify activities and classify them by project management process

Use waterfall delivery (10-15%)
Manage the analysis phase
Describe the analysis phase, identify key objectives of the analysis phase, identify activities and deliverables in the analysis phase, describe the purpose of kickoff activities, describe solutions overview training, describe the detailed business process analysis process, identify the purpose of a functional requirements document
Manage the design phase
Describe the design phase, identify key objectives of the design phase, identify activities and deliverables in the design phase, identify and describe cross-phase processes, describe the solution design process, identify and describe solution design deliverables
Manage the development phase
Describe the development phase, identify key objectives of the development phase, identify activities and deliverables in the development phase, identify activities included in solution testing

Use agile delivery (10-15%)
Prepare for agile delivery
Describe the agile project type in Sure Step, explain the criteria for the agile project type, identify activities in the agile project type, identify recommendation criteria for the agile project type, describe the flow of activities in agile preparation, describe activities in agile preparation
Run an agile project
Describe the flow of activities in an agile project type, describe activities in an agile project type, describe components of a sprint cycle

Manage the deployment and operations phases (10-15%)
Manage deployment activities
Describe the deployment phase, identify key objectives of the deployment phase, identify activities and deliverables in the deployment phase, describe training activities in the deployment phase
Perform testing
Describe testing activities in the deployment phase, identify components of a production audit, identify data migration activities in the deployment phase
Go-live with the project
Describe the go-live activity, identify components of the go-live cutover plan
Manage operation activities
Describe the operation phase, identify key objectives of the operation phase, identify activities and deliverables in the operation phase, identify the purpose of quality management in the operation phase
Close the project
Describe the purpose of project closure, describe activities associated with project closure

QUESTION 1
You are a project manager, and you use Microsoft Dynamics Sure Step for implementations of Microsoft Dynamics products for your customers.
Your customer's major stakeholders identify significant changes that will increase the scope of a project.
Which two risk response strategies for the project definition update should you use? (Each correct answer presents part of the solution, Choose two.)

A. Exploit
B. Avoid
C. Enhance
D. Transfer
E. share

Answer: B,D


QUESTION 2
Which document should you use to manage project deliverables?

A. project scope statement
B. project objectives
C. technical requirements
D. functional requirements

Answer: A


QUESTION 3
You are a project manager.
You find that the personnel in the Human Resources department are new and not experienced in project work. You need to manage the project resources to accommodate the lack of project experience in the project. What should you do?

A. Add more time for the project activities.
B. Release the project team.
C. Document the problem and the impact on the scope of the project to the major stakeholders.
D. Document the impact of the lack of experience on the legal requirements.

Answer: A


QUESTION 4
You are a project manager, and you use Microsoft Dynamics Sure Step Methodology to manage projects. You need to ensure that quality assurance is part of a project that you are managing. Which item should you include as part of the project?

A. a comprehensive review with the project stakeholders at the end of the project
B. a review process done at the beginning and checked off at the end of the project with the project stakeholders
C. quality assurance reviews with stakeholders, scheduled early and often across all project phases
D. a comprehensive review process performed if problems occur during the project or at a stakeholder's request

Answer: C


QUESTION 5
As a project manager, you need to incorporate a change request into the project.
Which two tasks must be completed to correctly handle this request when you use the Microsoft Dynamics Sure Step Methodology? (Each correct answer presents part of the solution. Choose two.)

A. Complete a customer review and approval.
B. Complete a plan-do-check-act cycle.
C. Complete a change request form.
D. Complete a work breakdown structure.
E. Complete a risk identification.

Answer: A,C

Explanation: http://technet.microsoft.com/en-us/library/hh227544.aspx


Friday, 19 February 2016

Exam MB2-707 Microsoft Dynamics CRM Customization and Configuration

Published: January 22, 2015
Languages: English, Chinese (Simplified), Japanese
Audiences: IT professionals
Technology: Microsoft Dynamics CRM
Credit toward certification: Specialist

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

If you have other questions or feedback about Microsoft Certification exams or about the certification program, registration, or promotions, please contact your Regional Service Center.

Manage solutions (10–15%)
Plan for customization
Define xRM; differentiate configuration, customization, extending, and development; design appropriate customizations; identify documents in the Microsoft Dynamics CRM implementation guide
Manage solutions
Understand business requirements, understand the benefits of solutions, create solutions, export managed and unmanaged solutions, import solutions, describe default solution, specify a publisher, work with multiple solutions, describe solution components
Manage customizations
Describe component dependencies; describe customization concepts for entities, fields, forms, views, and charts; publish customizations

Manage security (10–15%)
Understand security concepts
Describe business units, describe Microsoft Dynamics CRM security features, identify privileges and access levels for security roles, describe security role interaction with business units
Manage access
Create and maintain users, create owner teams, describe owner teams and sharing, manage security roles for users and teams, differentiate owner teams and access teams, create access team templates, add access team subgrids to forms
Work with field-level security
Identify entities for which field-level security is available, create field security profiles, define field permissions, add field permissions, assign field security profiles to users and teams
Manage auditing
Enable entity-level auditing, enable field-level auditing

Customize entities (10–15%)
Create custom entities
Describe entity customization concepts; create custom entities; configure display names, plural names, and schema names; configure entity ownership; create custom activity entities; set primary fields
Manage custom entities
Configure entity properties including display areas, communication and collaboration options, fixed properties, data services options, Microsoft Outlook options, mobile options; modify custom entities; delete custom entities; identify dependencies

Customize fields (10–15%)
Create and maintain fields
Describe field customization concepts, create fields, describe ways new fields can be created, delete custom fields
Configure field properties
Identify field data types; identify field display formats; configure the requirement level field property; configure searchable, audit, and field security field properties; identify properties that can be changed for existing fields
Manage special fields
Configure local and global option sets, configure status and status reason fields, describe dependencies, create calculated fields, describe the purpose of rollup fields, create rollup fields

Manage relationships (10–15%)
Describe entity relationships
Identify different relationship types; describe one-to-many, many-to-many, and manual many-to-many relationships; describe special many-to-many relationships such as marketing list members, queue items, and follows; identify supported and unsupported relationships; identify cascading behaviors such as Assign, Share, Unshare, Re-Parent, Delete
Manage entity relationships
Create entity relationships, map fields, manage connections and connection roles, work with relationship hierarchy visualization

Customize forms (10–15%)
Understand form customizations
Describe tab and section structure; add form fields; add subgrids; add social, activity, and notes controls; add other components and controls; preview form customizations
Create and edit forms
Copy existing forms or create new forms, configure quick create forms, create nested quick create forms, create quick view forms
Manage multiple forms
Identify scenarios where multiple forms are useful, specify form order, assign roles to forms
Manage mobile forms
Describe mobile forms for Microsoft Dynamics CRM for tablets, describe how forms are displayed to the user in the Microsoft Dynamics CRM for tablets app, describe considerations when designing mobile forms

Customize views (10–15%)
Work with system views
Differentiate between system, public, and personal views; describe view columns and view filtering; configure multi-entity search; differentiate between multi-entity, advanced find, and quick find search; identify associated views; configure lookup views; configure quick find views
Create and configure custom views
Copy existing views, create custom views, build queries, add fields to views, arrange fields, configure field properties, sort fields, set the default public view, share views, disable views, delete views
Manage custom views
Set the default public view, share views, identify entities for which hierarchical views are available, create hierarchical views

Customize charts and dashboards (5–10%)
Understand chart concepts
Identify design considerations for charts, differentiate between personal and system charts, identify limitations of the chart designer tools in the user interface
Create and configure charts
Create system charts and personal charts, describe chart types and options, add series and categories, choose chart views for chart preview, identify fields available for use in charts, include fields from parent entities in charts
Reuse charts
Export and import charts, identify steps to update chart XML, convert personal charts to system charts, convert system charts to personal charts
Create, configure, and manage dashboards
Differentiate between personal and system dashboards, configure dashboard components, create lists (views), display charts on dashboards, manage security roles for dashboards

Configure business process flows and business rules (10–15%)
Understand business process flow concepts
Describe the purpose of business process flows; differentiate between different types of processes; identify business process flow components including steps and stages, built-in business processes, custom business processes, entities that participate in business processes, and spanning entities
Create and manage business process flows
Create business process flows, define stages and steps, describe role-based business processes, describe branching logic for guided processes, describe use cases for the client API for business process flows
Create and manage business rules
Identify use cases for business rules; differentiate between client-side and server-side logic; create business rules; configure business rule conditions; apply AND/OR, IF…ELSE, IF….THEN logic in business rules; identify business rule actions; enable business rules for forms

QUESTION 1
On the Account record in Microsoft Dynamics CRM, you create business rules that update the Credit Limit based on the Relationship Type option set.
After which two user actions do these business rules apply? Each correct answer presents a complete solution. Choose two.

A. Saving an Account
B. Changing a Relationship Type on an existing Account
C. Adding a Relationship Type to a new Account
D. Deleting an Account

Answer: B,C

Explanation: Ref:https://technet.microsoft.com/en-us/library/dn531086.aspx


QUESTION 2
You need a component that can combine form controls together with the possibility to expand and collapse them.
Which component should you choose?

A. sub-grid
B. section
C. Quick View form
D. tab

Answer: D


QUESTION 3
You create two entities, Event and Booking, in Microsoft Dynamics CRM.
The Booking entity references the Event entity with an Event lookup attribute in the
Booking entity. This Event lookup attribute is used on the Booking form as lookup control.
You want to delete the Event entity.
What should you do first?

A. Delete the Event entity; all references are deleted automatically.
B. Remove the lookup attribute in the Booking entity.
C. Remove the lookup control on the Booking form.
D. Remove the relationship between Event and Booking.

Answer: C

Explanation: Ref:https://msdn.microsoft.com/en-us/library/gg309749.aspx


QUESTION 4
You want to show values from a related entity in a form in Microsoft Dynamics CRM.
Which two components can you use to display values in a sub-grid? Each correct answer presents a complete solution. Choose two.

A. dashboard
B. list
C. chart
D. report

Answer: B,C


QUESTION 5
You want to reduce the amount of data stored in auditing in Microsoft Dynamics CRM.
Your Dynamics CRM environment has multiple audit logs. You need to delete at least one audit log.
What should you do?

A. Select the most recent audit log, and click delete.
B. Create a bulk delete job, and select the audit entity.
C. Select the oldest audit log, and click delete.
D. Select multiple audit logs, and click delete.

Answer: C

Explanation:
Ref:https://technet.microsoft.com/en-us/library/dn683569.aspx#BKMK_Method10

Saturday, 13 February 2016

Q&A: Mobile app security should not be an afterthought

As enterprises struggle to keep up with their internal demand for mobile apps, more are turning to rapid development workflows. What does this mean for security?

As enterprises struggle to keep up with their internal demand for mobile apps, more are turning to more speedy development workflows, such as the Minimum Viable Product (MVP) , which essentially calls for mobile development teams to focus on the highest return on effort when compared to risk when choosing apps to develop, and features to build within them. That is: focus on apps and capabilities that users are actually going to use and skip those apps and features they won’t.

Sounds simple, but what does that mean when it comes to security? We know application security is one of the most important aspects of data security, but if software teams are moving more quickly than ever to push apps out, security and quality assurance needs to be along for the process.
MORE ON CSO:Mobile Security Survival Guide

The flip side is minimum apps and features could mean less attack surface. To get some answers on the state of mobile app security and securing the MVP, we reached out to Isaac Potoczny-Jones research lead, computer security with a computer security research and development firm Galois.

Potoczny-Jones has been a project lead with Galois since 2004, is an active open source developer in cryptography and programming languages. Isaac has led many successful security and identity management projects for government organizations including (Navy, DOD), (DHS), federated identity for the Open Science Grid (DOE), and mobile password-free authentication (DARPA), and authentication for anti- forgery in hardware devices (DARPA).
ted talk
Four mindblowing Ted Talks for techies

TED talks make that possible to do in a single sitting. Here are four talks that in just over an hour
Read Now

Please tell us a little about Galois and your role there in security.

Galois is a computer security research and development firm out here in Portland, Ore. We do a lot of work with the US federal government, been around since 1999 and I've been here for 11 years now. I think a lot about this topic, I really appreciate and employ myself the lean methodologies for product development, and I love the lean startup approach. I also do security analysis for companies, so I've gone into a number of start-ups too and looked at their security profile for their products or their infrastructure, and help them to develop a security program. I've definitely seen both sides of the issue as far as where MVP thinking leads you.

What are you seeing out within organizations today when it comes to mobile security?

There's definitely a lot more development in mobile happening. The best practices in mobile aren't as well developed as best practices for the web. That's getting a little bit better.Consider HTTPS. What we saw for quite some time was something that on the Web is relatively straightforward, which HTTPS is. People were doing it wrong on mobile for years before anyone really noticed. There's a lot you can get wrong with HTTPS, and they were getting it all wrong. As people move over to mobile they are definitely having to relearn some of the lessons we learned over the years.
"A lot of things are easy to add at the end with security, but sometimes you run into systems that are just kind of broken from the foundation. As with any of these things, the later you catch it, the costlier it's going to be be."

Password security is another one of those. People began to make passwords on websites a lot more robust. You can't just have a four or five letter password anymore on most websites. But because mobile devices are so difficult to type password into, a lot of sites have relaxed those password rules. In reality, the threat is just the same as it always has been.

What impact do you see the minimum viable product, or minimum viable app, trend?

On the MVP front, there's a very fascinating challenge with security because security is a non-functional requirement. I tend to like the lean scrum methodology. I don't know if you're familiar with that one, but I can use that one as an example. They're all kind of similar in some ways. They emphasize features, they emphasize things the users can see. They emphasize testing out ideas, and getting them into the market. Testing them, gathering metrics about how effective they are, and using that as feedback into the product. That's a really good idea about how to develop a product. But because even just the terminology, minimum viable product, it is really emphasizing minimizing.

It emphasizes getting rid of what you don't need. Those things together, minimizing things and really having an emphasis on what the user can do and see, that makes it so that non-functional requirements are kind of an afterthought. You have to squint to figure out how to apply non-functional requirements like security to a lot of these processes like scrum.

I would imagine with an MVP teams want to move the app out as quickly as possible, so they don’t want to spend a lot of time threat modeling and going through a lot of additional process, because that’s all adding to more development time. So there seems to be a natural friction between the goals of MVP and good security.

It's absolutely a friction. It's challenging because securing is mostly invisible. That means good security and bad security look exactly the same, until something goes wrong. Security is really visible when something is broken or somebody gets hacked and then you make the news. Then it kind of blows up in your face. We've seen this a few times, I don't know how many start-ups it's killed, it's probably killed a few, but it's definitely cost a lot of start ups when their first major news coverage is that they were hacked.

What are some ways organizations can ease that tension when it exists? Is there a way to bring security in so it's not too obtrusive? Is there a way to separate out apps by data type? And possibly greenlight MVP apps that don’t touch more sensitive data, and give a closer look at those apps that do?

I think that's a good approach. As you point out, one way is to say, let's see if we can do an MVP with data that's not as sensitive so you won't have to focus as strongly on security. Nowadays, it's a little more challenging. Even the minimum things you do you will need security. It kind of doesn't matter what your data is, you will get targeted, you will get attacked, and even if it's just with these automated bots that run around the Internet attacking everything. They'll use your infrastructure for sending spam at the very least, if that's all they can do. To me, the approach is you have to implement some of the industry best practices as far as the OWASP Top 10. You have to believe that security is an important part of a minimum viable product to start to even begin to get these user stories in there.

What I like to tell people is think about user stories, even negative user stories or things like that are, as a user, I don't want to see my personal information leaked on the internet because I've shared something sensitive in your app or your website, I've stored something sensitive in your website. I don't want to see that in the hands of people who will use my private information against me.

That sounds like something a security team could put a guide together, or put in place a checkpoint on whether an app can go through. For instance, if the app has certain conditions that are true, or one of these conditions that are true, the app has to go through a security review. If not, it’s OK for a security light approach within certain guidelines.

That'd be perfect. Typically these lean approaches have at least some kind of testing methodology built in, or acceptance testing. Or, as some of them call say, "What's your definition of 'done'?" The first step is just saying, "We're going to include security in these definitions of done," and once you've at least penetrated that level, which I don't think a lot of people have, but once they get that, then they’re going to at least do the right things. You're either going to start to build it either into the user stories or the acceptance testing.

But you can’t leave it to just be at the end of the process. If you leave security acceptance testing toward the end, and naturally your schedule is going to slip. Then you'll get to the security testing and find there's a lot more work to do. Then you'll be in this unfortunate decision of either having to fix things and let your schedule slip, or choose to let something go out the door that's not secure.

The real tragedy is when a system is kind of inherently insecure, it was built in a really insecure way that requires major rework, because you didn't think about security at the beginning. A lot of things are easy to add at the end with security, but sometimes you run into systems that are just kind of broken from the foundation. As with any of these things, the later you catch it, the costlier it's going to be be.

If you're looking at your to-do list, whatever that to-do list is, whether it's a list of stories or a big list of tasks and action items, you should be recognizing some security issues in there, as you go. You'll get to a point, you're developing something and one of your developers hopefully will say, "Well, look, our system is vulnerable to whatever cross site request forgery, cross site scripting attack. Which any system that's not designed to protect against it, is going to be.

If you look at your bug list, you should see that pop up there at some point. Some of these security issues will come up during development, because nothing will be perfect. That'll be an early indicator.

If you don't have anything, if you look at your bug list and you don't see anything, if your developers aren't actively talking about security or saying, "We're going to have to add some tasks for security," you're going to say, "Well, I want to add that feature for you but that's going to have an impact on security." If you're not hearing it as part of the conversation, then there's going to be a problem.

Friday, 5 February 2016

Google Fiber to be free for select affordable housing residents

First free gigabit Internet service will be offered to West Bluff housing community in Kansas City

Google Fiber on Wednesday announced free gigabit Internet service to residents of selected public housing projects connected to its fiber optic service in U.S. cities.

The program was launched at West Bluff, an affordable housing community in Kansas City, Mo., where 100 homes have been connected to Google Fiber. Across the Kansas City area, Google is now working with affordable housing providers to connect as many as nine properties that could reach more than 1,300 local families.

Google described the program as an extension of its work with ConnectHome, an initiative of the U.S. Department of Housing and Urban Development (HUD) and the Obama administration.

HUD Secretary Julian Castro said in a conference call that under the ConnectHome program, up to 200,000 children in affordable housing in 28 different U.S. cities are expected to be connected to fast Internet. Google Fiber is expected to be a part of those connections in Atlanta, Durham, N.C., Nashville and San Antonio, he said.

There will be no cost to local housing authorities, their residents or HUD. Google will absorb the costs of the free service and there will be no fees or contract.

The Kansas City area was the first Google Fiber location in the nation, starting in 2012. Today, the service is available in two other cities -- Austin, Texas and Provo, Utah -- with work under way in six others. Normally, residents in Kansas City pay $70 a month for Google Fiber fast Internet service.

In addition to free Internet, eligible residents will work with ConnectHome partners like Connecting for Good and Surplus Exchange to be able to purchase discounted computers and learn new computer skills, Google said.

In Austin, Google plans to complement free Internet service for some families with investments in computers labs and digital literacy classes. Plans for other cities were not announced.

"We plan to bring gigabit Internet to select affordable housing in all of our Fiber cities," Dennis Kish, vice president of Google Fiber, wrote in a blog. "The U.S. has some of the most expensive broadband in the world, while lagging far behind other countries in Internet speeds," he added. "And for families in affordable housing, cost can be one of the biggest barriers to getting online."

Early in its rollout of Google Fiber in Kansas City, there was concern that not enough low-income residents were buying into the service. Meanwhile, government officials in both Kansas City, Mo., and Kansas City, Kans., hailed Google Fiber's arrival as a boost to business interest in the area, even as they have worked to reduce the digital divide.

Microsoft pushes Windows 10 upgrade using tactic it once called 'a mistake'


Maker of 'GWX Control Panel' tool reports that Windows 7 and 8.1 PCs receiving upgrade as pre-selected 'Optional' item in Windows Update

Microsoft has begun to deliver the Windows 10 upgrade to eligible Windows 7 and Windows 8.1 PCs through Windows Update, making good on an October announcement.

A company spokeswoman confirmed that the Windows 10 upgrade is reaching customers' systems.

More than three months ago, Terry Myerson, the executive who leads the operating system and devices group, said that the Windows 10 upgrade would be pushed to users via Windows Update, the primary maintenance service for its OSes.

At the time, Myerson said that the upgrade would first appear under the "Optional" section in Windows Update, then later transit to "Recommended." The difference is more than labeling: In Windows Update, "Optional" is supposed to be just that; customers must explicitly check the box for an item for it to automatically download and install. "Recommended" items, on the other hand, will be retrieved and installed unless the user has changed the default settings of Windows Update.

In the past, Microsoft has issued updates and upgrades in that two-step process under which bits first appeared under Optional, then after a month or more -- a span Microsoft used to digest diagnostic data from affected PCs to ensure things worked as expected -- the same update shifted to Recommended, and reached the majority of users.

It's unclear whether Microsoft is following the plan it laid out in October: While several prominent bloggers who focus on Microsoft -- including Paul Thurrott and ZDNet's Mary Jo Foley -- said that the Windows 10 upgrade had been deployed as Recommended in Windows Update, there was no explicit evidence that that had, in fact, begun.

But the Windows 10 upgrade has appeared under Windows Update's Optional list, according to Josh Mayfield, the creator of GWX Control Panel. The free utility made Microsoft's Get Windows 10 (hence "GWX") upgrade reservation app go away, purged the system of upgrade files, and blocked the automatic upgrade.

Mayfield maintains a multiple-PC pool of test machines to monitor how Microsoft promotes Windows 10. Yesterday, he confirmed that the upgrade showed up under Optional on both Windows 7 and Windows 8.1 PCs.

"As we saw over the summer, it's listed as an 'Optional' update but automatically selected to install, unlike other updates in that category," said Mayfield in an email reply to questions Tuesday.

Mayfield was referring to events that began in mid-September at the latest, when users noticed "Upgrade to Windows 10 Home" or "Upgrade to Windows 10 Pro," in Windows Update. Those items appeared in the Optional section of Windows Update's listing of available patches and fixes. Normally, updates pegged as Optional will not download to a PC -- whether automatically or in a manual check -- until the user has ticked a box.

But according to users' reports at the time, Windows Update itself checked the "Upgrade to Windows 10" optional update as eligible for download and installation. Users with Windows Update set to automatically retrieve and install updates -- the norm, and the setting recommended by Microsoft -- or who did not examine the optional update list, were then served with the Windows 10 upgrade, whether they wanted it or not.

Microsoft quickly issued a statement saying that the checking of the upgrade's Optional item "was a mistake."

Mayfield contended that Microsoft has done the same this week by automatically checking the Windows 10 upgrade box. Under those conditions, it mattered not a whit whether the upgrade was listed under Recommended or Optional: The result would be the same. For the vast majority of users, the upgrade would download -- if it wasn't already on the PC, having been pre-loaded under a long-running campaign to place the bits on customers' devices -- and the installation process would begin.

Microsoft has said that users could decline the Windows 10 upgrade once installation began, but has declined to say whether the upgrade starts in all cases, detail how the user authorization process is to play out, and whether -- after a customer declines the upgrade -- it presents itself again later.

The company has been little help when asked to clarify exactly what began this week for the Windows 10 upgrade on Windows 7 and 8.1 devices.

"We are committed to making it easy for our Windows 7 and Windows 8.1 customers to upgrade to Windows 10," Microsoft said in a statement forwarded by the firm's spokeswoman. "We updated the upgrade experience today to help our customers, who previously reserved their upgrade, schedule[d] a time for their upgrade to take place."

In a follow-up email, the spokeswoman did not directly answer questions Computerworld posed, including whether the Windows 10 upgrade was being placed in Recommended, Optional or both. "This is rolling out in a phased approach which is why you are seeing different reports," she said.

Mayfield noted that as far as he can tell, Microsoft has honored the registry settings it had earlier said would block the appearance of the Windows 10 upgrade on PCs powered by Windows 7 and 8.1. Those registry tweaks -- made by crafting a Group Policy that could be distributed to large numbers of machines -- were spelled out in a support document revised last month.

That means Mayfield's GWX Control Panel will stymie attempts to place the Windows 10 upgrade in Windows Update, as the tool was designed to do. Previously, Mayfield had warned that might not be the case if Microsoft again changed the rules, an increasingly common practice for the company, which, for example, repeatedly issued a Windows 10 reservation app to users who had managed to uninstall it.

"If GWX Control Panel reports 'No' for 'Are Windows 10 Upgrades allowed?', then the Windows 10 upgrade doesn't even appear as an option in the Windows Update control panel," Mayfield reported. Those who download and install GWX Control Panel can block the Windows 10 upgrade from appearing by clicking "Disable Get Windows 10 app," and then clicking "Prevent Windows 10 Upgrades."

Earlier this month, Microsoft said that it would expand Windows 10 upgrade distribution to include all systems running Windows 10 Home and Windows 10 Pro -- even domain-joined Windows 10 Pro machines in businesses -- that receive their security patches directly from Windows Update. It was also unclear today whether Microsoft is serving the upgrade to domain-joined PCs, which were originally exempt from the push, or only to consumers and commercial systems not connected to a network in which administrators use Active Directory to set access rights.

GWX Control Panel can be downloaded from Mayfield's website free of charge, although he accepts donations from appreciative users.

Microsoft is placing the Windows 10 upgrade on Windows 7 and Windows 8.1 PCs, but pre-selects the download, even though it's listed as an 'Optional" update/upgrade. That's contrary to how Windows Update's Optional items usually work, and was called a "mistake" by Microsoft when it did the same last year.