# Separate Work Folders client lab assumptions from deployment settings

> Which assumptions in the Work Folders client setup example must be checked before reuse?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-100-separate-work-folders-client-lab-assumptions-from-deployment-settings/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:15:31+00:00
- Modified: 2026-09-08T18:20:23+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Which assumptions in the Work Folders client setup example must be checked before reuse?

## Potentially affected

Administrators testing Work Folders clients in an AD FS and Web Application Proxy deployment.

## DSE recommendation

Document which example assumptions match the pilot and which will be replaced by approved production settings.

## Article

## Source facts

Microsoft’s procedure sets up both domain-member and non-domain Windows clients to test synchronization between their Work Folders. The example installs previously created AD FS and Work Folders certificates in the domain client’s computer certificate store. For the non-domain test client, it changes the hosts file because the example did not create public DNS records. That instruction is explicitly a test-environment assumption. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/storage/work-folders/deploy-work-folders-adfs-step5).

## Applicability

Identify the client join state, actual service names, certificate chain, and name-resolution arrangement. Review the preceding deployment steps before treating this final client step as a complete service installation.

## DSE recommendation

Document which example assumptions match the pilot and which will be replaced by approved production settings. Have the identity and network owners confirm the service names and certificate trust path. Keep sample addresses and test-only hosts entries out of the general client rollout instructions.

## Verification

Configure representative clients through the approved route, then synchronize a controlled file in each direction. Record the service name contacted, certificate result, and observed file state on both clients. Repeat from the intended network locations, and investigate a DNS or trust exception before calling the client setup complete.

## Official references

[Microsoft Learn: Deploy Work Folders with AD FS and Web Application Proxy – Step 5, Set Up Clients](https://learn.microsoft.com/en-us/windows-server/storage/work-folders/deploy-work-folders-adfs-step5). Source reviewed September 8, 2026.

## Primary reference

- Name: Deploy Work Folders with AD FS and Web Application Proxy - Step 5, Set Up Clients
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/storage/work-folders/deploy-work-folders-adfs-step5
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Work Folders client lab assumptions from deployment settings,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-100-separate-work-folders-client-lab-assumptions-from-deployment-settings/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.