Imation IronKey Workspace W700 User manual

IRONKEY™ WORKSPACE W700
User Guide

Copyright 2014 Imation Corp. All rights reserved.
Imation and Imation logo, IronKey and IronKey logo, and “PC on a Stick” are trademarks of
Imation Corp. All other trademarks are the property of their respective owners.
Imation Enterprises Corp.
1 Imation Way
Oakdale, MN 55128-3414 USA
www.imation.com
5/14
NOTE: Imation is not liable for technical or editorial errors and/or omissions contained herein;
nor for incidental or consequential damages resulting from the furnishing or use of this material.
The information provided herein is subject to change without notice.
The information contained in this document represents the current view of Imation on the issue
discussed as of the date of publication. Imation cannot guarantee the accuracy of any
information presented after the date of publication. This document is for information purposes
only. Imation makes no warranties, expressed or implied, in this document.
FCC Information
This device complies with part 15 of the FCC Rules. Operation is subject to the following two
conditions: (1) This device may not cause harmful interference, and (2) this device must accept
any interference received, including interference that may cause undesired operation.
This equipment has been tested and found to comply with the limits for a Class B digital device,
pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference in a residential installation. This equipment generates, uses and can
radiate radio frequency energy and, if not installed and used in accordance with the
instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does
cause harmful interference to radio or television reception, which can be determined by turning
the equipment off and on, the user is encouraged to try to correct the interference by one or
more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is
connected.
• Consult the dealer or an experienced radio/ TV technician for help.
Note: Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
Industry Canada
This Class B digital apparatus complies with Canadian ICES-003.
Cet appareil numerique de la classe B est conforme à la norme NMB-003 du Canada.

3
CONTENTS
About my IronKey Workspace W700 device 4
Features and benefits 4
Host computer requirements 5
Device management 5
Device security 6
Device specifications 7
Recommended best practices 8
Other resources 8
About IronKey Control Panel 10
Starting IronKey Control Panel 11
Booting from a USB drive 14
Booting from a Windows computer 14
Booting from a Mac computer 18
Using my IronKey Workspace W700 device 20
Activating a managed device on first-time use 20
Personalizing an unmanaged device 22
Starting Windows 8.1 from the W700 device 23
Unplugging the device 24
Changing the device password 24
Updating device software 25
Changing the Unlock message 26
Viewing device information 27
Troubleshooting 28
Appendix 1: Imation support for Macintosh 30
IronKey Workspace applications 30
Level of support for Mac models 30
Moving between Mac models 32
Installing Boot Camp support drivers 32
Downloading Boot Camp Support Software 35
Appendix 2: Admin users 37
Activating a managed device on first-time use 37
Managing my online account (managed devices only) 39

IRONKEY™ WORKSPACE W700
User Guide

Copyright 2014 Imation Corp. All rights reserved.
Imation and Imation logo, IronKey and IronKey logo, and “PC on a Stick” are trademarks of
Imation Corp. All other trademarks are the property of their respective owners.
Imation Enterprises Corp.
1 Imation Way
Oakdale, MN 55128-3414 USA
www.imation.com
5/14
NOTE: Imation is not liable for technical or editorial errors and/or omissions contained herein;
nor for incidental or consequential damages resulting from the furnishing or use of this material.
The information provided herein is subject to change without notice.
The information contained in this document represents the current view of Imation on the issue
discussed as of the date of publication. Imation cannot guarantee the accuracy of any
information presented after the date of publication. This document is for information purposes
only. Imation makes no warranties, expressed or implied, in this document.
FCC Information
This device complies with part 15 of the FCC Rules. Operation is subject to the following two
conditions: (1) This device may not cause harmful interference, and (2) this device must accept
any interference received, including interference that may cause undesired operation.
This equipment has been tested and found to comply with the limits for a Class B digital device,
pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference in a residential installation. This equipment generates, uses and can
radiate radio frequency energy and, if not installed and used in accordance with the
instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does
cause harmful interference to radio or television reception, which can be determined by turning
the equipment off and on, the user is encouraged to try to correct the interference by one or
more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is
connected.
• Consult the dealer or an experienced radio/ TV technician for help.
Note: Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
Industry Canada
This Class B digital apparatus complies with Canadian ICES-003.
Cet appareil numerique de la classe B est conforme à la norme NMB-003 du Canada.

4
IronKey Workspace W700 User Guide
ABOUT MY IRONKEY WORKSPACE W700
DEVICE
IronKey Workspace W700 is a trusted, FIPS 140-2 Level 3 certified, secure USB flash drive that comes with
strong, built-in password protection capabilities and 256-bit AES hardware encryption. Certified by Microsoft
as a Windows To Go device, your W700 is a secure, personal workspace, capable of using all host system
resources on host computers that are certified to run Microsoft Windows®7.0 and higher, and qualified Mac
computers.
Figure 1: IronKey Workspace W700 device
Once you unlock your W700 device, you can safely boot a fully functional version of Microsoft Windows 8.1
Desktop. Use the Windows 8.1 workspace as you would any other Windows 8.1 computer. When your work is
finished, shut down the Windows 8.1 operating system and remove the device from the host computer. You’re
ready to bring your “PC on a Stick™” anywhere.
Use this guide to learn more about how to use your W700 device.
This chapter contains information about:
•Features and benefits
•Host computer requirements
•Device management
•Device security
•Device specifications
•Recommended best practices
•Other resources
FEATURES AND BENEFITS
FIPS 140-2 Level 3 certification—IronKey Workspace W700 FIPS certified so you can feel confident that
you’re complying with regulatory requirements. Section 508 compliant—W700 devices are fully compliant
with section 508 accessibility requirements.
Hardware Encryption—The IronKey Cryptochip protects your critical data, applications and networks by
keeping encryption key management on the device, where it’s safe and protected.

Host computer requirements
5
ABOUT MY IRONKEY WORKSPACE W700 DEVICE
IronKey Workspace W700 User Guide
Password-Protected—Only after the user logs in with an authorized password will the drive unlock the
workspace so you can boot into Windows To Go. Do not share your password with anyone. That way, even if
your device is lost or stolen, no one else can access your data.
Self-Destruct Sequence—If the Cryptochip detects physical tampering by a hacker, or if a specified number of
consecutive incorrect password attempts have been entered, it can initiate a permanent self-destruct
sequence that securely erases all onboard data—so remember your password.
Waterproof and Tamper-Resistant—Designed to survive the extremes, IronKey Workspace W700 has a
rugged metal encasing that is injected with an epoxy compound that makes it not only tamper-resistant, but
waterproof to military specifications (MIL-STD-810F).
Device Management—Your device has built-in software that lets you manage device settings. Your company
may also configure your device for centralized management with IronKey Enterprise Server. For more
information, see “Device management” on page 5.
HOST COMPUTER REQUIREMENTS
The host computer must allow you to boot from a USB device. Computers that are certified for use with
Windows 7 or higher can be configured to boot automatically from a USB device. Check with the hardware
manufacturer if you are not sure whether your computer can boot from a USB device. For more information,
see “Booting from a USB drive” on page 14.
• Windows computer that is certified for Microsoft Windows®7 or higher.
• Macintosh computer that supports Windows 8 or higher. Note: You r W700 device must also have
Boot Camp Support Software installed in Windows To Go. Your administrator may have included
this software when your device was provisioned. For more information, see “Booting from a Mac
computer” on page 18.
• USB 3.0 or USB 2.0 port for high-speed data transfer. USB 3.0 ports are typically marked blue or dis-
play the “SS” (Super Speed) symbol. A USB 1.1 port or powered hub will also work, but will be slower.
DEVICE MANAGEMENT
There are two kinds of device management: at the administrative level and at the user level. At the
administative level, your organization can implement IronKey Enterprise Server, a device management system,
to control the policy on your device and provide device updates as well as control access to the device.
Devices controlled by IronKey Enterprise Server are called “Managed devices”. Your administrator will tell you if
you have a managed device.
User management refers to the management options available to you, the user, to control your device. Each
device, whether managed by IronKey Enterprise Server or unmanaged, includes the IronKey Control Panel
application that lets you change device settings, such as your password.
Administrative management
IronKey Enterprise Server is an on-premise server solution that allows IT administrators to remotely manage
your IronKey Workspace W700 device. Devices that are provisioned for Enterprise management are called
“managed devices”. If you have a managed device, you must first activate it before you use Windows To Go.
Activation binds the device to your user account on IronKey Enterprise Server and applies a device policy.
Once activated, your device can receive policy and software updates, and administrators can reset a forgotten
password.

Device security
6
ABOUT MY IRONKEY WORKSPACE W700 DEVICE
IronKey Workspace W700 User Guide
Figure 2: Device managed by IronKey Enterprise Server
User management
Use IronKey Control Panel to manage your device password and device preferences. If your device is managed
by IronKey Enterprise Server, the IronKey Control Panel is the application that connects to the server. It allows
you to activate your device with IronKey Enterprise Server and download device software updates. For more
information, see “About IronKey Control Panel” on page 10.
Figure 3: IronKey Control Panel application
DEVICE SECURITY
IronKey Workspace W700 devices have been designed from the ground up with security in mind. The device
uses a combination of advanced security technologies to ensure that only you can access your data.
Additionally, it is a physically secure device, to prevent hardware-level attacks and tampering, as well as to
make the device rugged and long-lasting.
The IronKey Cryptochip is hardened against physical attacks such as power attacks and bus sniffing. It is
physically impossible to tamper with its protected data or reset the password counter. If the Cryptochip
detects a physical attack, it destroys the encryption keys, making the stored encrypted files inaccessible.
Users with
managed
devices
Administrator
manages devices
with IronKey
Enterprise Server

Device specifications
7
ABOUT MY IRONKEY WORKSPACE W700 DEVICE
IronKey Workspace W700 User Guide
We strive to be very open about the security architecture and technology that we use in designing and
building this product. We use established cryptographic algorithms, we develop threat models, and we
perform security analyses (internal and third party) of our systems all the way through design, development
and deployment.
Data Encryption Keys
• AES key generated by onboard Random Number Generator
• AES key is generated at initialization time and encrypted with hash of user password
• No back-doors: AES key cannot be decrypted without the user password
• AES key never leaves the hardware and is not stored in NAND flash or RAM
Data Protection
• Windows To Go partition is not accessible until password is verified in hardware
• Password try-counter implemented in tamper-resistant hardware
• Once password try-count is exceeded, all data is erased by hardware
• Sensitive data and settings are stored in hardware
Device Password Protection
• USB command channel encryption to protect device communications
• Password-in-memory protection to protect against cold-boot and other attacks
The device password is hashed using salted SHA-256 before being transmitted to the device firmware over a
secure USB channel. It is stored in an extremely inaccessible location in the protected Cryptochip hardware.
The hashed password is validated in hardware (there is no “getPassword” function that can retrieve the hashed
password), and only after the password is validated is the AES encryption key decrypted. The password try-
counter is also implemented in hardware to prevent memory rewind attacks. Typing your password incorrectly
too many times can initiate a permanent self-destruct sequence, which is run in hardware (not software), to
ensure the ultimate protection for your data. Optionally, the device can be reset instead of self-destructing.
Resetting puts the device back to its original factory state; all data is lost.
DEVICE SPECIFICATIONS
The following table provides details about your W700 device.
Tabl e 1: W700 device specifications
Specification Details
Capacity* 32GB, 64GB, 128GB
Dimensions 82mm X 21.1mm X 9.1mm
Weight 1.12 oz (32 grams)
Operating
Te m p e r a t u r e
0C, 70C
Operating Shock 16G rms
Certification FIPS-140-2 Level 3

Recommended best practices
8
ABOUT MY IRONKEY WORKSPACE W700 DEVICE
IronKey Workspace W700 User Guide
Designed and Assembled in the U.S.A.
* Some space is required for Windows To Go software. Windows 8.1 Enterprise is not included or preloaded on
the device.
RECOMMENDED BEST PRACTICES
The following list provides tips on how to use your device to maximize safety and security.
• Never unplug the device when the LED is on or while booted in Windows To Go. This can result in
loss of data or possibly cause irreparable damage to the operating system on the device.
• Never share your device password.
• If Windows To Go is in Hibernate mode, do not unplug the device and move it to another computer.
Windows To Go does not support roaming between computers using hibernate.
OTHER RESOURCES
IronKey devices
Windows To Go
http://www.ironkey.com/en-US/windows-to-go-drives/windows-to-go.html
Reference documentation from Apple
The following table provides links to documentation from Apple about Boot Camp 5.1 and Windows 8 and 8.1
support on Mac computers.
Hardware
Encryption
Data: 256-bit AES (CBC mode)
Hardware: 256-bit AES
Hashing: 256-bit SHA
Hardware • USB 3.0 (Super speed)
• Water-resistant MIL-STD-810F
•Dust-resistant
• Shock-resistant
• Ruggedized
Host computer
compatibility
PC certified to run Microsoft Windows 7 or higher operating systems
Mac computer that supports Windows 8.1
Accessibility The IronKey Control Panel application is Section 508 compliant. Users with disabilities
have keyboard navigation and screen reader support.
https://support.ironkey.com Support information, knowledge base and video tutorials
[e-mail] Product feedback and feature requests
https://www.ironkey.com General information
Tabl e 1: W700 device specifications
Specification Details

Other resources
9
ABOUT MY IRONKEY WORKSPACE W700 DEVICE
IronKey Workspace W700 User Guide
Tabl e 2: Reference information from Apple
Contact support
For support, please contact your Help desk or System Administrator.
To p i c Reference
Main Boot Camp Support page http://www.apple.com/support/bootcamp/
Boot Camp 5.1: Frequently Asked Questions http://support.apple.com/kb/HT5639
Boot Camp: Frequently Asked Questions
about Installing Windows 8
http://support.apple.com/kb/HT5628
Boot Camp: System requirements for
Microsoft Windows operating systems
http://support.apple.com/kb/HT5634
Boot Camp 5.1 download http://support.apple.com/downloads/#macoscomponents
Note: Make sure you download the version that supports the
Mac model that will be used to boot the device.
About Startup Manager http://support.apple.com/kb/HT1310

10
IronKey Workspace W700 User Guide
ABOUT IRONKEY CONTROL PANEL
The IronKey Control Panel is software that lets you manage your device. You can run the Control panel when
you are booted into the host operating system or when you boot into the Windows To Go operating system.
The Control Panel lets you change your device password, edit your device preferences, and view device
information, such as the software or firmware version. For managed devices, IronKey Control Panel also lets
you activate the device (on first-time use) and download and install device software updates. Users with
administrative privileges can also connect to the management console on the Server from their device with
IronKey Control Panel. If you are an Administrative User, see Appendix A for further information.
You can access the Control Panel when the host operating system is running (this is called non-boot mode) or
when you boot into Windows To Go (this is called Windows To Go mode). Some tasks can only be completed
when you run the Control Panel in non-boot mode, for example, activating a device or installing device
updates.
The following table outlines IronKey Control Panel operations available in non-boot and Windows To Go mode
for both managed and unmanaged devices.
Table 3: IronKey Control Panel operations
IronKey Control Panel operation Non-boot mode Windows To Go mode
Change device password Yes Ye s
Unlock/Lock the device Yes
Change unlock message Yes 1
(if enabled in
policy)
Yes
(if enabled in policy)
Auto-lock preferences Yes 1
(if enabled in
policy)
—
Activate the device (managed devices
only)
Yes —
Check for device updates (managed
devices only)
Yes Ye s
Download and install device updates
(managed devices only)2
Yes —
View device information Yes Ye s

Starting IronKey Control Panel
11
ABOUT IRONKEY CONTROL PANEL
IronKey Workspace W700 User Guide
STARTING IRONKEY CONTROL PANEL
For both managed and unmanaged devices, you can start IronKey Control Panel from the application partition
in non-boot mode or from the taskbar when booted in Windows To Go.
Non-boot mode
In non-boot mode, when the host operating system is running, IronKey Control Panel opens after you unlock
the device with the device password. Entering the wrong password a consecutive number of times will
permanently destroy the device and all your onboard data. As a security precaution, you must unplug and
reinsert the device after every three failed password attempts. You cannot start the Control Panel in non-boot
mode when running a Mac operating system.
You should always lock the device before you unplug it or if the device is not in use while working in non-boot
mode. You can manually lock the device or set the device to automatically lock after a period of inactivity. For
managed devices, auto-lock settings are available in IronKey Control Panel if enabled in the device policy. The
device policy is applied to the device during activation.
For a list of operations that are available with IronKey Control Panel in non-boot mode, see “IronKey Control
Panel operations” on page 10.
Note: If you have a managed device, the first time you start IronKey Control Panel in non-boot mode, you will
be required to activate the device. See “Activating a managed device on first-time use” on page 20.
To start IronKey Control Panel in non-boot mode
1. Make sure that the host computer is turned on and the host operating system is running.
2. Insert the W700 device into the USB port of the host computer.
Access online account (Admin users
only)
Yes Ye s
1 If enabled in policy
2Unmanaged devices can use IKRestore utility from the IronKey Support site.
Tabl e 3: IronKey Control Panel operations
IronKey Control Panel operation Non-boot mode Windows To Go mode

Starting IronKey Control Panel
12
ABOUT IRONKEY CONTROL PANEL
IronKey Workspace W700 User Guide
3. In a file manager, double-click the IronKey.exe file from the IronKey Workspace device drive.
4. Type your device password and click Unlock.
The IronKey Control Panel will open automatically.
Note: If the device loses power, for example if it is unplugged from a USB hub, it will lock.

Starting IronKey Control Panel
13
ABOUT IRONKEY CONTROL PANEL
IronKey Workspace W700 User Guide
To lock th e dev ice
•In IronKey Control Panel, click Lock from the bottom left corner of the application. You can also use the
keyboard shortcut: CTRL + L.
Caution: Once the device is locked, you can perform a safe removal operation to safely unplug it.
To set the device to automatically lock
1. In IronKey Control Panel, click the Settings button in the menu bar.
2. Click Preferences in the left sidebar.
3. Click the check box for auto-locking the device and set the time-out for either 5, 15, 30, 60, 120, or 180
minutes.
Note: For managed devices, if auto-lock preferences have been disabled by the administrator in the device,
you will not be able to modify this setting.
Windows To Go mode
In Windows To Go mode, IronKey Control Panel runs automatically when you boot Windows 8.1 from the
device. You do not have to unlock the device to start the application. The device unlocks when you
authenticate in the IronKey Workspace Preboot environment. Locking the device does not apply in Windows
To Go mode; instead, you must shutdown the Windows 8.1 operating system. For more information, see
“Unplugging the device” on page 24.
To start IronKey Control Panel in Windows To Go
•When booted in Windows 8.1, on the Windows taskbar, right-click the IronKey icon and choose IronKey
Control Panel.

14
IronKey Workspace W700 User Guide
BOOTING FROM A USB DRIVE
You can configure the host computer to always boot from a USB drive or you can manually boot from the USB
drive each time you start up Windows To Go (called a one-time boot procedure). You cannot configure Mac
computers to always boot from a USB drive. Mac computers must use the manual boot option.
This chapter contains information about:
•Booting from a Windows computer
•Booting from a Mac computer
BOOTING FROM A WINDOWS COMPUTER
It is recommended that you configure the host computer to always boot from a USB drive (if present). Use the
IronKey Workspace Startup Assistant to automatically configure a qualified host computer. If you don’t use the
Assistant, there are manual steps to configure your computer. Once configured, your computer will try to boot
any USB device connected to it on startup, including malicious devices. Do not insert a bootable USB device
unless you are sure the device is safe for use.
If you do not want to configure the host computer, you can do a one-time boot procedure to start Windows To
Go.
Note: Your administrator may have already configured these options for computers that will be used with
IronKey Workspace devices.
Using the IronKey Workspace Startup Assistant
The Startup Assistant automatically sets the boot order of qualified host computers so that it will boot first
from a USB drive if one is present. The Assistant only runs in Windows. Host computers must meet the
following configurations:
• UEFI firmware and Windows 8 or Windows 8.1 operating system
• BIOS firmware from DELL and Windows operating system
• BIOS firmware from HP and Windows operating system
• BIOS firmware from Lenovo and Windows operating system
Other configurations are not supported. You must run the Startup Assistant before you boot into Windows To
Go. The Startup Assistant is available through the IronKey Control Panel.
To configure your BIOS using the IronKey Workspace Startup Assistant
1. Make sure that the host computer is turned on and the host operating system is running.
2. Insert the device into the USB port of the host computer.
3. Start the IronKey Control Panel and click the Settings button.

Booting from a Windows computer
15
BOOTING FROM A USB DRIVE
IronKey Workspace W700 User Guide
4. From the left sidebar, click To o l s , and then click the Launch Startup Assistant button.
5. Click Continue.
6. The Startup Assistant will check the host computer’s registry to verify that the configuration is supported.
If the system does not meet the requirements, the Configure button will appear dimmed. For unsup-
ported host computers, see “Manually configuring the host computer” on page 16.
7. Click Configure to start the process.
Supported system
Unsupported system

Booting from a Windows computer
16
BOOTING FROM A USB DRIVE
IronKey Workspace W700 User Guide
8. When the configuration process has completed, click Exit.
Manually configuring the host computer
If the host computer is not supported by the IronKey Workspace Startup Assistant, you can manually
configure your system to boot from USB.
PCs running Windows 8 or Windows 8.1
If the host computer is running Windows 8, you set the option to boot from a USB device in the Windows To
Go Startup Options. Once set, the host computer will automatically boot from the device when you insert it
and turn on the host computer.
To change Windows To Go Startup Options (Windows 8 and Windows 8.1)
1. In the host operating system, press the Windows key + W.
2. In the Settings Search text box, type “Windows To Go startup options”. The topic will display in the list.
Press ENTER to select it.
3. In Windows To Go Startup Options dialog box, click Yes , and then click Save Changes.
PCs certified to run Windows 7 or higher
If the host computer is certified for Windows 7 or higher (and is not running Windows 8 or 8.1), you must
manually configure the BIOS settings so the computer will automatically boot from a USB device. The
following procedure describes the general steps required to change the BIOS settings. BIOS settings differ by
computer manufacturer. For more information about methods to configure BIOS settings by manufacturer, see
Tips for configuring your BIOS settings to work with Windows To Go.
To configure a computer to boot from a USB drive
1. Shut down the host computer if it is not already turned off.
2. Insert the W700 device into the USB port.
3. Turn on the computer and enter the BIOS Utility.
This is a very fast step. You have only a few seconds to press the correct key to access the BIOS (typically
when the manufacturer’s logo appears). You can press the key multiple times to increase the chances of
successfully entering the firmware/BIOS. Many manufacturers use “F2” but an on-screen message will
indicate the key sequence for the computer you are configuring, for example, “Press the F2 key”, or “Press
F1 to enter setup”.

Booting from a Windows computer
17
BOOTING FROM A USB DRIVE
IronKey Workspace W700 User Guide
4. In the BIOS, navigate to the setting that controls the boot order. The name of the option may vary, for
example, “Boot”, “System Configuration”, or “Storage”. navigate to the option that controls the boot order
(this may be under “Boot” or “System Configuration” or “Storage”).
5. In the Boot Priority, move the USB drive to the top of the list so that it is first in the boot order. The name
of the USB drive in the list may vary depending on the computer manufacturer.
6. Save the new BIOS settings and Exit.
Important: Use caution when modifying BIOS boot settings as incorrect changes can harm your computer. Do
not save BIOS changes if you think a setting has been incorrectly modified; exit the BIOS and restart the
procedure.
Tip: If you are having trouble changing your BIOS settings, see the documentation from the computer
manufacturer.
Performing a one-time boot operation
The Boot menu controls which device (for example, hard drive or USB drive) the operating system will load
from when the computer starts up. Each computer uses a specific “hotkey” that when pressed on startup, will
access the Boot menu. Hotkeys can vary by computer manufacturer. When you select the USB drive from the
Boot menu, the computer starts Windows To Go from the device for only this startup session. This is called a
one-time boot procedure.
To boot Windows To Go one-time only
1. Shut down the host computer if it is not already turned off.
2. Plug the IronKey Workspace device into USB port of the host computer.
3. Turn on the computer and press the hotkey to open the Boot menu.
This is a very fast step. You have only a few seconds to press the correct key. Typical hotkeys include Esc,
F10, or F12. An on-screen message will indicate the key sequence for the computer.
If the Boot menu does not appear and the operating system for the host computer starts, shut down the
computer and restart.
4. When the Boot menu appears, use the Arrow keys to select the USB drive (Imation IronKey) and press
ENTER.
If the menu has options for “USB drive” and “USB hard disk”, choose USB hard disk.
5. In the IronKey Workspace Preboot Environment, type the device password and click Unlock.
6. Click Reboot Now.
7. When the computer reboots, press the hotkey to open the Boot menu and select the USB drive (Imation
IronKey), and then press ENTER.
8. If prompted, type the Windows password to unlock the Windows To Go workspace.
Note 1: Some computers may force an automatic reboot process when you first start up Windows To Go.
Note 2: Some computers do not support choosing the drive from the Boot menu and will require that you
configure the computer to boot from a USB device. See “Booting from a Windows computer” on page 14.

Booting from a Mac computer
18
BOOTING FROM A USB DRIVE
IronKey Workspace W700 User Guide
BOOTING FROM A MAC COMPUTER
With the proper Boot Camp Support Software (from Apple Inc.), IronKey Workspace devices will boot
Windows To Go on many Mac computers that support Windows 8 or Windows 8.1. Boot Camp software
contains drivers that must be installed in Windows To Go to make sure that components, such as Wifi access,
will work in Windows To Go when booted on a Mac.
There are two Boot Camp support packages that support Windows 8.1. Each package supports a different set
of Mac models. Your administrator may have installed of these Boot Camp packages or included the setup files
so that you can install it in Windows To Go. For more information about installing Boot Camp “Installing Boot
Camp support drivers” on page 32. For a list of Mac models that have been tested with IronKey Workspace
devices running Windows To Go, see “Level of support for Mac models” on page 30.
Mac computers cannot be configured to automatically boot from a USB device. You must always use a one-
time boot procedure.
Some Mac computers do not recognize the IronKey Workspace device when it reboots from the Preboot
environment and require the use of the Alternate Reboot method to ensure that the USB device displays in the
Startup Manager when you reboot the computer. The alternate re-boot method refers to how the computer
reboots from the IronKey Workspace Preboot Environment. The following Mac models are known to require
this method: MacBook Pro Retina Mid 2012, MacBook Air 11-inch Mid 2012, and MacBook Air 13-inch Mid 2012.
To manually boot Windows To Go on a Mac
1Make sure that the Mac computer is turned off and that no other USB devices are currently plugged in.
2. Plug the IronKey Workspace W700 device into the USB port.
3. Turn on the computer and immediately hold the Option key (Alt key on a non-Mac keyboard) to open the
Startup Manager.
4. In the Startup Manager, select the USB Windows device option.
If there are two USB options, choose the option that says “Windows”. Otherwise, if only one USB option
displays, such as “EFI Boot” choose that one.