Top 10 Windows 8 Features #2: The Microsoft Account

“Logging onto” Windows is something a great many users don’t do. Let’s face it, do we log onto our phones? If we’re okay with our phones pretending they’re us while they move around, why would we need to be protective about devices that mostly stay in one place? This is a point of view that Microsoft, over the course of the next year, may render as antiquated as the dial tone.

An operating system should know its user. This was not a concept Microsoft understood at first. When it formally introduced the “My Documents” folder in Windows 98, folks asked me whether “My” meant “me, the computer” or “me, the user.” Then Windows XP introduced the notion of a user profile. At last, multiple people had personal folders that pertained to them, and “my” meant yours and not anyone else’s. When you signed into XP, the file manager would show you your folders.

For many folks, though, that wasn’t much of a convenience. People tended to have XP bypass the whole accounts thing, and created their own folders anyway, with names like “DAD’S PRIVATE STUFF DO NOT TOUCH.” (There’s a really secure folder for you.)

Identity First

Meanwhile, since the turn of the century, Microsoft has had a dream of integrating users’ Windows identities (called security principals) with their Microsoft-brand email addresses, and in turn with a Microsoft-run identity system. As was the case with almost every security-related effort during the XP era, it was rolled out in an embryonic state, and researchers poked holes in it without even trying. Only after several years of wrestling with the consequences did Microsoft come to grips with researchers’ assessments: Tying access to one’s credit cards to a single-factor authentication system that shares the same password with every component in that system, is a manufactured security hole waiting to be exploited.

So here we are on the cusp of the Windows 8 era, and we’re faced again with Microsoft’s latest incarnation of shared identity. This time, it’s in front of our face, and it will be much more difficult to bypass. What was the Microsoft Passport, then Windows Live ID and now just the Microsoft Account is the default key for entering the operating system. While you can bypass it, the act of doing so will be much less obvious than for prior incarnations of Windows, and everyday users probably won’t take the time to find out how. As a result, in the first few days after Windows 8 ships, expect the Microsoft Account identity database to eclipse the size of some major countries.

Thus the pressing question becomes, does the latest Microsoft Account offer the Windows 8 user anything of genuine value? My answer: Quite possibly.

When you install Windows 8, or when you log on for the first time, you’ll be asked to create a Microsoft Account if you don’t already have one. This time, there are good reasons for doing so. Microsoft has now fully realized that users are independent of their computers – or, I should say, of their devices. So when someone is a subscriber to Windows, as a customer will come to be called, that subscription should enable her access to software and certain personal resources from any device she’s using at the time.

This is not exactly easy to accomplish, and the full implications of this promise will not yet be realized the day Windows 8 is generally released. But you’ll come to see more as time goes on. For now, the most obvious thing the user will notice is that, whenever she signs onto Windows 8 on any device (not necessarily one that belongs to her), she’ll see her basic preferences on the Start Screen and the basic style, such as her personal wallpaper, on her Desktop.

Everywhere You Roam

The way Microsoft is enabling this is through a much grander exploitation of a feature it introduced in Windows Vista called the roaming profile. Today with Windows 7 in home networks, a user creates his account on one PC. The hidden user folder of that PC stores profile data about such things as personal folder locations, in a subdirectory named Roaming. This way, when the same user creates an account on another PC in the same network, that other PC can pull pre-existing data from the roaming profile.

You may have just figured out, after reading that last sentence, why this feature wasn’t exploited more: You really shouldn’t have to create a separate account on every PC you own.

This is where the new incarnation of Microsoft Account on Windows 8 makes a great deal of sense. Now when you sign onto any device, the data normally stored to the Roaming subdirectory on that first PC, becomes available to the authenticated user wherever you are. Microsoft’s cloud service (the same servers that run Azure) store a snapshot of that subdirectory. Since Windows 8 uses the Roaming subdirectory to store data like wallpaper choices and application settings that can and should be portable, that data automatically becomes available to the cloud service. So any app running on any other device can call on the snapshot; and if the device is active, it can refresh the cloud server’s view of that subdirectory in the background.

Today, relatively few third-party software products make use of the Roaming subdirectory because, well, users couldn’t be counted on to care enough to actually roam. Windows 8 gives them the first really good reason to do so.

To get the best idea of why, imagine if you were an Office 365 subscriber. With the upcoming version of Office, your subscription uses the same Microsoft Account as does Windows 8. So you effectively have a profile for Office that’s bound to you, and that moves with you. And as I’ve noted in #3 of this series, SkyDrive is also tied to Microsoft Account. What’s more, it’s now the default storage system for Office, which you now have to bypass to get to your local hard drive storage. Recall that an Office 365 app can be run from the Web; it’s not the “Office Web Apps” that we’ve come to know and loathe, but the full products in all their glory.

So if your storage is in the cloud, your profile is in the cloud, and your applications are sourced from the Web, your full installation of Office will travel with you from device to device. This is the full promise of the new era of Windows (much more so than the silly Start Screen), and the enabling factor for that promise is the Microsoft Account.

Reconciliation

The grander implications are for a kind of virtualized workspace where every app you own, or have rights to use, is accessible under your account from any place. This is not, however, completely feasible. First of all, classic Desktop applications (those compatible with Windows 7 and earlier) must be installed on the devices which run them. Technically, any of these applications that use the Roaming subdirectory to store user data should instantly, without any re-architecture on the part of their developers, enable other devices on which those applications are installed to bring up a user’s preferences. (By “technically,” I mean that the stars should all be properly aligned, there’s no wind, the birds are all singing in the trees and you’re getting paid on time.) But nothing can be done about the fact that a Desktop application needs to be installed locally on a device to be run from that device.

The same holds true with WinRT apps, the new class of Windows 8 programs that are run from tiles you tap from the new Start Screen. What’s different in that case is that the Windows Store keeps track of those WinRT apps whose rights you’ve acquired or purchased at least once. So the Store app at least gives you a way to download and install those apps you own, even on a device you don’t own.

This could get hairy.

Imagine a situation where a guest using a hotel lobby PC downloads some WinRT game apps under his account. Remember, he wouldn’t be using the classic “Guest” account from Windows XP, but his personal Windows 8 setup accessed through his Microsoft Account. But once he logs off, checks out and jets to some foreign destination, how exactly can these apps be uninstalled?

This is the type of admin situation I’m happy we’re trying to solve now. I don’t believe Windows 8 will be installed to any great degree in hotel lobbies (where I still mostly find XP) until quandaries such as this are resolved; but now, at least, we’re at that level.

In my tests of Windows 8 RTM on a network with mixed Windows 8 and Windows 7 devices, including a Win8 tablet, use of the Microsoft Account as the account name, at last, improves small networks and homegroups. With Windows 7, it’s still possible for one user to create separate accounts on multiple PCs in the homegroup, the result being that PCs throughout that homegroup have difficulty resolving which Roaming subdirectory is the authentic one. You can see the side-effects of this anomaly in the Homegroup section of Windows 7’s file manager. There, a) individual user accounts are listed separately as though they were separate members, thus creating more homegroup members than there are PCs; b) the Media Devices section lists user accounts individually as well, even though playlists and libraries on those devices are all public and merged.

In Windows 8, any homegroup user who logs on using a Microsoft Account will be recognized as one and only one person, regardless of the device she’s logging on from. This is a tremendous improvement, and a very necessary one in the era of PCs and tablets. In my own network, my wife and I each have several PCs rather than just one, though we share a Windows 8 tablet. And yet here we are as individual users rather than split identities!

This way, when you need to restrict a person’s access or his permission to change things or delete files, your policies apply to that person wherever he is, as opposed to “John on the media PC” and “John on his laptop.” If he’s logging onto your homegroup from a Remote Desktop Connection, the policies still apply. (Where local accounts still exist (and in a hybrid network with Win7 devices, they will), those accounts will still show up in the new File Explorer under Computer.)

Schizophrenia Is Now More Difficult

Unavoidably and, from an architectural standpoint, unfortunately, this will cause some headaches for folks like me who insist on using dual-boot PCs with Windows 7. I have quite a bit invested in Win7 right now, and am not willing to disembark just yet. But this little problem may expedite that event: Because permissions for system folders and personal folders are handled through the NTFS file system that is rendered directly to those folders, whenever Windows 8 attributes policies to Microsoft Accounts, it overwrites whatever traditional, local account-oriented policies were already present.

As a result, whenever you boot back into Windows 7, suddenly none of your shared folders or libraries are shared anymore. And if you log on using a limited (non-administrator) account, as is generally wise for security purposes, you may find you don’t have access to your own Documents library until you grant yourself permission again. =It’s not difficult; it’s just a bother, like returning to your home only to find you’ve locked all the bedroom and bathroom doors on yourself. Changing your policies back for Windows 7 does not impact Windows 8 in the slightest.

Everyday users won’t be facing dual-boot scenarios in their everyday work, and the reasons why folks like me will keep using Win7 for a while longer are perhaps peculiar. But the fact that there’s no easy bridge for this problem illustrates the breadth of the gulf we’re jumping by adopting a cloud-based online identity to log onto our devices.

There will continue to be well-deserved skepticism over how well Microsoft will be able to manage an identity system that will undoubtedly be under continual attack. (This from the guy who still refuses to join Facebook.) It is a risk which individual Windows users will weigh for themselves. While they may opt to install local accounts for Windows 8, and to not use SkyDrive or any other cloud-based storage, the easiest way to ensure that option would be to stick with Windows 7 anyway. But I have a short list of features that could, potentially, be a bigger boon for me than the Start Screen is a bust for me. Universal sign-on is one of them.