Table of Contents
Total Page:16
File Type:pdf, Size:1020Kb
Table Of Contents Windows 10 Manageability Tips & Tricks Deploying Windows 10: Part 1 . page 2 Deploying Windows 10: Part 2 . page 8 Upgrade to Windows 10: ConfigMgr Task Sequence. page 12 ConfigMgr 1511 – Windows 10 Improvements . page 13 Windows 10: Security Enhancements . page 15 Windows as a Service: Keep Windows 10 Up-to-Date . page 17 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 1 Deploying Windows 10: Part 1 This next series of posts will deal with deploying Windows 10 from ConfigMgr and MDT. I will be using the latest versions of all software: Windows 10 v1511, ConfigMgr 1511 and MDT 2013 Update 1. Part one will focus on creating your reference image, part two will focus on capturing and deploying your image with ConfigMgr 1511. Creating your reference image is not that much different from Windows 8.1. You can configure a default profile, install any applications that you need, and configure the OS using many of the same methods. This series will simply serve as a guide to doing all of this, and will include some best practices as well as my recommendations. I will be using Windows 10 Enterprise 64-bit for my reference image. Installing Windows 10 I always recommend creating reference images on a virtual machine platform that can do snapshots or checkpoints. I come from the VMware world, so I will refer to them as snapshots throughout this series, but the terms are interchangeable. You can use snapshots throughout the process of creating your reference image if you make a mistake. Most importantly for me, however, is being able to take a snapshot before capturing the image. This allows me to revert back after sysprep, which is helpful for running future updates, because I do not have to build the reference from scratch. Default Profile Configuration In order to configure a default profile, you must boot your installation into audit mode before completing the out-of-box experience (OOBE). 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 2 Deploying Windows 10: Part 1 To do this, press CRTL+SHIFT+F3 on this screen: The machine reboots and logs into the built-in administrator account. After log in, the sysprep tool will automatically launch. You can click cancel. You can make any changes here to configure your default profile. I do not recommend installing any applications or updates while in audit mode. You can, however, change the desktop background, arrange the Start Menu, etc. during this time. You should also add/change this registry key: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\ WindowsUpdate /v AutoDownload /t REG_DWORD /d 2 /f This will disable Windows Store updates. We want to disable Windows Store app updates because if they update, you will not be able to sysprep your machine. Be sure to include the reverse of this in your imaging task sequence, as you will want Windows Store app updates enabled. To re-enable, simply change the “2” to a “4”: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\ WindowsUpdate /v AutoDownload /t REG_DWORD /d 4 /f Once your default profile is configured, create an XML file with this content: 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 3 Deploying Windows 10: Part 1 <?xml version=”1.0” encoding=”utf-8”?> <unattend xmlns=”urn:schemas-microsoft-com:unattend”> <settings pass=”specialize”> <component name=”Microsoft-Windows-Shell-Setup” processorArchitecture=”amd64” publicKeyToken=”31bf3856ad364e35” language=”neutral” versionScope=”nonSxS” xmlns:wcm=”http://schemas. microsoft.com/WMIConfig/2002/State” xmlns:xsi=”http://www.w3.org/2001/ XMLSchema-instance”> <CopyProfile>true</CopyProfile> </component> </settings> <settings pass=”oobeSystem”> <component name=”Microsoft-Windows-Shell-Setup” processorArchitecture=”amd64” publicKeyToken=”31bf3856ad364e35” language=”neutral” versionScope=”nonSxS” xmlns:wcm=”http://schemas. microsoft.com/WMIConfig/2002/State” xmlns:xsi=”http://www.w3.org/2001/ XMLSchema-instance”> <OOBE> <HideLocalAccountScreen>true</HideLocalAccountScreen> </OOBE> <AutoLogon> <Username>Administrator</Username> <Enabled>true</Enabled> </AutoLogon> </component> </settings> </unattend> 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 4 Deploying Windows 10: Part 1 If you’re capturing a 32-bit image, change the processor Architecture to x86. This answer file will copy the default profile and enable the local built-in administrator account, which we will use to finish our customizations. Name this file unattend.xml and save it to the root of your C: drive. It also puts an entry in Quick Access, which you will want to remove. Launch File Explorer, right-click the file, and select “Remove from Quick Access”. Also, you will want to remove “Desktop” from Quick Access, as it does not work through the CopyProfile process. Now, launch a command prompt and execute this command: %windir%\system32\sysprep\sysprep.exe /generalize /oobe /reboot / unattend:C:\unattend.xml The machine will now reboot and you can go through OOBE. Customize the Reference Image Once the machine restarts back into OOBE, select your regional settings. Then, I would recommend clicking “Customize settings” and changing ALL of the options after install to No. This will strengthen the privacy setting for Windows 10. 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 5 Deploying Windows 10: Part 1 After the Customize settings screens, your VM will probably restart. It should come back up and log in as the built-in administrator. Windows Features I recommend a few changes to the installed Windows Features. To modify these, right-click on the Start Menu and select Control Panel. Click “Programs” and then select “Turn Windows features on or off”. First, I recommend enabling “.NET Framework 3.5 (includes .NET 2.0 and 3.0)”. This will install .NET 3.5, which a lot of software still requires. Microsoft still supports and patches .NET 3.5, so there’s not a big security risk here. 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 6 Deploying Windows 10: Part 1 Modifying the rest of the features is up to you, but I would suggest looking at Simple TCPIP services and TelNet Client. Other Recommendations I would recommend putting the CMTrace tool somewhere in the image, especially if you using SCCM. This tool is vital when reading ConfigMgr logs. Where you put it is up to you, though I create a folder in Program Files (x86) for it. Next, I would go ahead and enable Previous Versions and set it to 10% of the hard drive. You can set this according to your organization, especially if you have network storage. To enable this, right-click on the Start Menu and select System. Click “Advanced System Settings” in the left panel and go to the “System Protection” tab. Now, click the Configure button. Enable system protection, and configure the usage using the slider. When you are done, make sure to run all Windows Updates. In Part 2, we will capture this for ConfigMgr deployment. 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 7 Deploying Windows 10: Part 2 This is part two of a series about deploying Windows 10. In this part, we will capture and deploy our base Windows 10 image for ConfigMgr 1511. As I stated in Part 1, I recommend doing this entire process in a VM. With a VM, we can take a snapshot just before capture that we can revert to if there are any issues, as well as in the future when we need to patch or change our base image. Image Cleanup Before cleanup, take your pre-sysprep snapshot. We cleanup the image after the snapshot has been taken. Before capture, you should clean up your base image. If you’re running VMware, or another virtualization product that installs any tools to help with integration, uninstall these first. If you are using VMware, ensure that this registry key gets set back to this before capturing, and after you have uninstalled VMware tools: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3] “REGDBVersion”=hex:01,00,00 If you do not reset this key, you will not be able to execute any VB scripts after the image has been installed . Next, go ahead and empty the Recycle Bin and run Disk Cleanup. If I am capturing a base, I always like to run all of the options in Disk Cleanup, as well as going to the “More Options” tab and cleaning up system restore points and shadow copies. 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 8 Deploying Windows 10: Part 2 You can also utilize tools like CCleaner to remove stale files and registry keys. The point is to get the image as clean as possible. Capture The Image After you have cleaned up your base, you can use the ConfigMgr capture media to run sysprep and capture the base. You can build a capture media ISO from the “Create Task Sequence Media” option under the Task Sequences node of your ConfigMgr Console. Just feed the capture wizard the required information. Note that you will have to specify the destination as a UNC share, so you must have network connectivity. 19614 80th Avenue W. Unit B • Edmonds, WA 98026 • 206.778.4432 • windowsmanagementexperts.com 9 Deploying Windows 10: Part 2 Building a Task Sequence Importing the WIM into ConfigMgr is exactly the same as it has been for previous versions of Windows. Be sure to check the data access box if you access content over the network for task sequences instead of download and install. There’s no real difference between a Windows 10 task sequence and a Windows 7 task sequence.