Create a Widows 10 BYOL OS only master image (Using Virtual Box) THIS IS A DRAFT!! GPL: 11-14-2019: Doc created for 1903 GPL: 02-24-2020: Updated for 1909 Prerequisites: 1. Must have an PC where Virtual Box can be installed and run. • It also must have at least 65GB free space to create the VHD file. 2. Have a source Windows 10 OS .iso available for use NOTE: A combination of v1903 and v1909 were used in compiling this guide. 3. The PC must be connected to the Internet (for OS patching purposes) Download and Install Oracle Virtual Box Download the virtual box software from: https://www.virtualbox.org/wiki/Downloads Install Virtual Box on your PC: (I used all default prompts) Configure Windows Virtual Box VM Instance to install Windows 10 OS only instance From the VirtualBox Manager menu, click New to create a new Virtual Machine Enter a Name for the new VM and select Version of Windows 10 (64-bit), then click Next Set your memory to at least 2 GB (4GB if you can spare it) I set mine to 4GB Then Click Next The Create Hard disk window appears: Select the Create a virtual hard disk now option and then click Create. Select .vhd from the list, then click Next Select Fixed Size from the list, Then click Next Change the size from the default of 50GB to 60 GB: Then click Create. The virtual disk creates: Which will leave you back at the VM Virtual Machine manger homepage: You need to disable the Floppy Drive and mount a Windows 10 .iso. To begin, click Settings: And then the System Icon: In the Boot Order box, Uncheck the Floppy drive: And click OK. Now click the Storage Icon: Click on the CD-Rom Icon listed as Empty under the Storage Devices to select it: Now click the CD-ROM icon listed under the Attributes box: The Dropdown list appears: Select the “Choose Virtual Optical Disk File…” option A file explorer window opens: Navigate to the Windows 10.iso file of your choice, then click the file to select it. Once selected, click Open The CD-ROM drive in the Storage Devices box now shows the Windows 10_.iso. The CD-ROM drive in the Storage Devices box now shows the Windows 10_x.iso. Click OK. Once again, you’ll be back at the Virtual Box console window: Install and patch the Windows 10 OS from your .iso Click Start to boot the VM: Install Windows 10 (v1903) The VM boots using the Windows 10.iso media file: Leave the defaults and click Next: When Prompted: Click the Install now button. Setup starts: And will prompt for the OS to install: Select the Windows 10 version of your choice. (Enterprise, Pro or Education): I chose Enterprise, then click Next. You’re prompted to Accept the License Terms: Click the I accept the License terms check box: then click Next. Windows Setup asks which type of installation you want: Click Custom: Install Windows Only. Windows Setup then asks where you want to install Windows. Leave the Drive 0 option selected and click Next. Setup then starts installing Windows: This takes some time. Come back to the machine after grabbing some coffee….. The VM will restart a few times…. And will “get ready”: Which evnentually leads to the Location Prompt: Select United States from the list and then Click Yes For Keyboard, leave US and Click YES When asked about a second keyboard: Click Skip Setup will then continue for a bit…. Until it stops at this screen: The image you are creating will be used in a domain joined scenario. Therefore, click “Domain Join instead” at the bottom left. After a few moments: A “Who’s going to use this PC?” window appears: The username entered will be a local administrator. Therefore, this is the perfect time to create the required WorkSpaces_BYOL user. So in the Name box, enter workSpaces_byol: NOTE: Case doesn’t matter….all lower is fine. Then click Next You’ll be prompted to create a Password: Enter a password for the WorkSpaces_BYOL user and then hit Next: Re-enter the same password to confirm it, and then hit Next. NOTE: Be sure to record this password as you’ll need to include it in the files to upload to the AWS WorkSpaces service team so they can integrate this image into the WorkSpaces service. You will be able to disable the ID and/or change the password after the integration is complete and as you create a custom WorkSpaces image later on. You will now be asked to create and answer 3 security questions: You can pick any of the questions listed and answer them accordingly. NOTE: You do NOT need to supply these Questions and Answers to AWS. However, you do want to remember these for your own reference purposes should you need them for any administrative purposes in the future. Select a First Question: And Answer accordingly. (I did use “xxxx”) Select a second question: And Answer accordingly. (I did use “yyyy”) Select a Third question And answer accordingly. (I did use “zzzz”) Click Next. You be asked if you want to add activity History across devices: Click NO You’ll be asked if you want help from Cortana the window digital assistant: Leave the “Let Cortana respond to “Hey Cortana” Unchecked and click Decline. You will then be asked to choose privacy settings: Scroll down the page and move all of the sliders to say NO. And then click Accept. Windows Setup then continues for a while: And is very helpful: And informative along the way: Until Windows 10 ultimately presents a desktop: Click Yes to make it discoverable. (Again, you can change this later on via a custom WorkSpaces instance and/or GPO) Manually Patch the Windows 10 OS only instance You must manually patch the image with the latest Microsoft Windows Updates. NOTE: The only EXCEPTION to this rule is do NOT bring a Windows 10 (1511 release) via patching to a version 1607. If Anniversary edition (1607) is the intended version, Anniversary edition media should be used. (This applies to ALL windows 10 releases ie 1803 to 1809, etc) To do so, run the Windows Updates wizard by clicking the Start menu, followed by the gear/settings icon to the left: Once the Windows Settings window appears, Scroll down and choose Update & Security: and then Windows Update. Check for new Windows 10 updates by choosing Check for updates. Click Check for Updates. It most likely will come back with a recommended list of updates that are needed. If any are indeed found to be needed, they will start downloading and installing themselves: When you see a number of the updates sitting in a Pending Install state (and none are being installed): From the Start Menu, select Restart OR, if you are prompted: Click Restart Now. The machine will shutdown: Reboot: (It may reboot a few times during this process, depending upon the updates installed) Will continue to update: Until complete: The OS GUI updates itself: Reboots: (again depending upon the updates applied) And Boots up update again: Another helpful message And the GUI then updates itself further: Until it ultimately will leave you at: The login screen. Click on it to expose the login window: With the WorkSpaces_Byol user populated. Enter the password you created earlier to log in. Now run the Windows Updates wizard and check for updates again (install…reboot…repeat until there are not any more updates to run) Open Windows Update to run it again. From the Start menu, select Settings: Windows Settings opens: Scroll down the page to find and click Update and Security. Reboot VM when complete Click Restart now if/when prompted to shutdown and restart the Windows 10 virtual machine after each attempt to ensure its fully patched. Repeat the previous reboot, login, run the windows update wizard until it tells you that the machine is up to date: Run the AWSEUC_WIN10_BYOL_config.PS1 and BYOL checker script 1. Log into the machine using the Workspaces_BYOL ID using the password that was previously noted. 2. Open File Explorer and manually create a C:\Temp folder 3. Open Internet Explorer and go to: 4. Open the following URL to download the AWSEUC_WIN10_BYOL_config.ZIP AND the BYOLChecker.zip files: http://bit.ly/WS_BYOL_PREP NOTE: This is temporary….working on a permanent “host” location for these files 5. Download/Save the AWSEUC_WIN10_BYOL_config.txt file to c:\temp saving it as a .ps1 NOTE: You will have to append quotes in the File name box to rename it while saving. 6. Download/Save the BYOLChecker.zip file to c:\temp NOTE: The BYOLChecker link on the page is simply a link to the production URL found here: https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows- images.html#windows_images_run_byol_checker_script 7. At the Save as dialog box, navigate to the c:\temp location 8. To run the AWSEUC_WIN10_BYOL_config.PS1 script, an ADMINISTRATIVE context must be used in PowerShell ISE. Right-click Windows PowerShell ISE, NOTE: I use PowerShell ISE….a straight PowerShell window can also be used in an Administrative context. Choose Run as administrator. 9. Click Yes to the UAC prompt: 10. In the PowerShell ISE window, change path to “c:\temp” 11. Set the session’s Execution policy by entering: “Set-ExecutionPolicy Unrestricted” 12. Hit “A” for all when prompted 13. Start the AWSEUC_WIN10_BYOL_config.PS1 script by entering “.\AWSEUC_WIN10_BYOL_config.PS1” If a security notification appears: Press the R key to run once.