gal.vin

Nvidia system tray icon is always visible

Mon, 05 Jan 2026 08:48:24 +0000

I found this fix on reddit, many thanks to user Valour-549 for this information.

Create a DWORD named “StartOnLogin” and set it to 0 at this location:

`1`	`HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\NvTray`

and also a this location, you may need to create the NvTray key:

`1`	`HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvlddmkm\NvTray`

Thanks
-Mike

A Powershell Replacement for wmic

Wed, 04 Jun 2025 11:39:52 +0100

If you’ve tried to use the wmic command in Windows 11 recently you’ll probably receive this error message:

“wmic: The term ‘wmic’ is not recognized as a name of a cmdlet, function, script file, or executable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.”

The wmic command is no longer part of Windows 11. I used to use wmic a lot to get model and manufacture information, primarily for drivers. Luckily this command has a PowerShell replacement.

`1`	`Get-WmiObject -Class Win32_Bios`

`1`	`Get-CimInstance -ClassName Win32_ComputerSystem`

Both of the above can be used to obtain manufacturer and model information for a system.

Thanks
-Mike

My Windows 11 24H2 Setup Process

Wed, 01 Jan 2025 18:10:07 +0000

With standard Windows 10 support ending this year I think it’s a good time to share what I do to a fresh Windows 11 24H2 installation to make it work for me and reduce annoyances. Windows used to be very useable out of the box, but since Windows 8 its been on a downward spiral with Microsoft making more and more bad decisions…in my opinion. Anyway, here’s how I fix Windows when I do a fresh install.

Please note that during testing some registry changes didn’t take immediate effect. It might have been that I needed to restart for some changes to take effect, but if you experience it too, it’s not just you. Because of this I’ve also included where some settings are in the GUI.

Turn Off Sticky Keys

Tap the Shift key 5 times and a dialogue box will pop up. (If it doesn’t Sticky Keys is already disabled most likely)
Click the text “Disable this keyboard shortcut…” the Windows Settings panel will open.
Click the > next to the Off/On switch on the Sticky Keys option.
Click the Off/On switch on the “Keyboard shortcut for Sticky keys” option.

`1`	`New-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name 'Flags' -Value 26 -PropertyType String -Force`

Remove Windows 11 Optional Features

Win + R appwiz.cpl > “Turn Windows Features on or off”

List all currently enabled optional features:

`1`	`Get-WindowsOptionalFeature -Online \| Where-Object {$_.state -eq "Enabled"}`

This is what I disable:

Disable-WindowsOptionalFeature -FeatureName "WorkFolders-Client" -Online
Disable-WindowsOptionalFeature -FeatureName "MediaPlayback" -Online
Disable-WindowsOptionalFeature -FeatureName "WindowsMediaPlayer" -Online
Disable-WindowsOptionalFeature -FeatureName "SmbDirect" -Online
Disable-WindowsOptionalFeature -FeatureName "MSRDC-Infrastructure" -Online
Disable-WindowsOptionalFeature -FeatureName "MicrosoftWindowsPowerShellV2Root" -Online
Disable-WindowsOptionalFeature -FeatureName "MicrosoftWindowsPowerShellV2" -Online
Disable-WindowsOptionalFeature -FeatureName "Printing-Foundation-InternetPrinting-Client" -Online

List all Installed Windows Capabilities

`1`	`Get-WindowsCapability -Online \| Where-Object {$_.state -eq "Installed"}`

This is what I remove:

1
2

Remove-WindowsCapability -Online -Name Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0
DISM /Online /Disable-Feature /FeatureName:Recall

Remove Built-in Apps

I use my own FOSS utility I created specially for this task: Remove-MS-Store-Apps Utility

`1`	`powershell -ep bypass "C:\scripts\Remove-MS-Store-Apps.ps1" -list "C:\scripts\apps.txt"`

Here is my apps to remove list:

Clipchamp.Clipchamp
Microsoft.BingNews
Microsoft.BingSearch
Microsoft.BingWeather
Microsoft.GamingApp
Microsoft.GetHelp
Microsoft.MicrosoftOfficeHub
Microsoft.MicrosoftSolitaireCollection
Microsoft.MicrosoftStickyNotes
Microsoft.OutlookForWindows
Microsoft.PowerAutomateDesktop
Microsoft.Todos
Microsoft.Windows.DevHome
Microsoft.Windows.Photos
Microsoft.WindowsAlarms
Microsoft.WindowsFeedbackHub
Microsoft.WindowsSoundRecorder
Microsoft.YourPhone
Microsoft.ZuneMusic
MicrosoftCorporationII.QuickAssist
MicrosoftWindows.CrossDevice
MSTeams

Installing apps via winget

winget is one of the few really useful tools to have come out of Microsoft in recent years.

To find an app to install:

`1`	`winget search "firefox"`

To install the app:

`1`	`winget install --id Mozilla.Firefox`

Remove Search from the Taskbar

Right-click taskbar > Taskbar settings > Search > Hide

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" -Name 'SearchboxTaskbarMode' -Value 0 -PropertyType DWord -Force`

Remove Task View Button on the Taskbar

Right-click taskbar > Taskbar settings > Task view > Off

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'ShowTaskViewButton' -Value 0 -PropertyType DWord -Force`

Windows Services to disable

I don’t do any printing, if you do change Spooler and PrintNotify to ‘Manual’.

1
2
3

Set-Service -Name DiagTrack -StartupType Disabled
Set-Service -Name Spooler -StartupType Disabled
Set-Service -Name PrintNotify -StartupType Disabled

Disable Hibernation and Fast Startup

`1`	`powercfg /h off`

Registry edit via PowerShell:

1
2

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" -Name "InprocServer32" -Force
Set-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value " " -Force

Remove Gallery from File Explorer for all users

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum" -Name '{e88865ea-0e1c-4e20-9aa6-edcd0212c87c}' -Value 1 -PropertyType DWord -Force`

Setting File Explorer views to be consistent

I use this fantastic FOSS utility: WinSetView

Download the zip file, unzip and run WinSetView.exe.

File Explorer preferences

File Explorer > three dot menu > Options

Show recently used files: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowRecent' -Value 0 -PropertyType DWord -Force`

Show frequently used folders: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowFrequent' -Value 0 -PropertyType DWord -Force`

Show files from Office.com: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowCloudFilesInQuickAccess' -Value 0 -PropertyType DWord -Force`

Open File Explorer to: This PC

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'LaunchTo' -Value 1 -PropertyType DWord -Force`

Show hidden files, folders or drives: Enabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'Hidden' -Value 1 -PropertyType DWord -Force`

Hide empty drives: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'HideDrivesWithNoMedia' -Value 0 -PropertyType DWord -Force`

Hide extensions for known file types: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'HideFileExt' -Value 0 -PropertyType DWord -Force`

Display the full path in the title bar: Enabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" -Name 'FullPath' -Value 1 -PropertyType DWord -Force`

Remove Widgets from the Taskbar

Right-click taskbar > Taskbar settings > Widgets > Off

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'TaskbarDa' -Value 0 -PropertyType DWord -Force`

Remove Startup Programs

Right-click taskbar > Task Manager > Startup apps > disable desired programs/services

Uninstall One Drive

`1`	`& $env:systemroot\System32\OneDriveSetup.exe /uninstall`

Using Local Group Policy for Configuration

If you have Windows 11 Pro or above you can use the local Group Policy to configure a lot of your settings adn then back them up and restore them onto other PCs. To do this we can use a cool little Microsoft tool called LGPO.exe.

You can download it here: Microsoft Security Compliance Toolkit 1.0

The specific tool you want is: LGPO.zip

Unzip the zip file and copy LGPO.exe to a working directory.

Use /b to backup your current Local Group Policy to a folder.

`1`	`& C:\scripts\LGPO\lgpo.exe /b C:\scripts\My-GPO-Settings`

Use /g to restore a local group policy backup from the specified folder.

`1`	`& C:\scripts\LGPO\lgpo.exe /g C:\scripts\My-GPO-Settings`

My Local Group Policy

Open the local group policy editor with Win + R gpedit.msc

Here is my local group policy settings:

Administrative Templates > Control Panel

Allow Online Tips: Disabled

Network/QoS Packet Scheduler

Limit reservable bandwidth: Enabled
Bandwidth limit (%): 0

System/Internet Communication Management

Restrict Internet communication: Enabled

System/Internet Communication Management/Internet Communication settings

Turn off downloading of print drivers over HTTP: Enabled
Turn off Event Viewer “Events.asp” links: Enabled
Turn off Help and Support Center “Did you know?” content: Enabled
Turn off Help and Support Center Microsoft Knowledge Base search: Enabled
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com: Enabled
Turn off Internet download for Web publishing and online ordering wizards: Enabled
Turn off Internet File Association service: Enabled
Turn off printing over HTTP: Enabled
Turn off Registration if URL connection is referring to Microsoft.com: Enabled
Turn off Search Companion content file updates: Enabled
Turn off the “Order Prints” picture task: Enabled
Turn off the “Publish to Web” task for files and folders: Enabled
Turn off the Windows Messenger Customer Experience Improvement Program: Enabled
Turn off Windows Customer Experience Improvement Program: Enabled
Turn off Windows Error Reporting: Enabled
Turn off Windows Network Connectivity Status Indicator active tests: Enabled
Turn off Windows Update device driver searching: Enabled

System/OS Policies

Allow Clipboard History: Disabled
Allow Clipboard synchronization across devices: Disabled
Allow publishing of User Activities: Disabled
Allow upload of User Activities: Disabled
Enables Activity Feed: Disabled

System/Remote Assistance

Configure Offer Remote Assistance: Disabled
Configure Solicited Remote Assistance: Disabled

System/User Profiles

Turn off the advertising ID: Enabled

Windows Components/AutoPlay Policies

Turn off Autoplay: Enabled
Turn off Autoplay on: All drives

Windows Components/Cloud Content

Do not show Windows tips: Enabled
Turn off cloud optimized content: Enabled
Turn off Microsoft consumer experiences: Enabled

Windows Components/Data Collection and Preview Builds

Allow commercial data pipeline: Disabled
Allow device name to be sent in Windows diagnostic data: Disabled
Allow Diagnostic Data: Enabled - Diagnostic data off (not recommended)
Allow Update Compliance Processing: Disabled
Allow WUfB Cloud Processing: Disabled
Configure collection of browsing data for Desktop Analytics: Disabled
Configure the Commercial ID: Disabled

Windows Components/Location and Sensors

Turn off location: Enabled
Turn off location scripting: Enabled
Turn off sensors: Enabled

Windows Components/Location and Sensors/Windows Location Provider

Turn off Windows Location Provider: Enabled

Windows Components/Microsoft Defender Antivirus/MAPS

Send file samples when further analysis is required: Enabled
Send file samples when further analysis is required: Never send

Windows Components/Search

Allow Cortana: Disabled
Do not allow web search: Enabled
Don’t search the web or display web results in Search: Enabled

Windows Components/Software Protection Platform

Control Device Reactivation for Retail devices: Enabled
Turn off KMS Client Online AVS Validation: Enabled

Windows Components/Sync your settings

Do not sync: Enabled
Allow users to turn syncing on: Disabled
Do not sync accessibility settings: Enabled
Allow users to turn “accessibility” syncing on: Disabled
Do not sync app settings: Enabled
Allow users to turn “app settings” syncing on: Disabled
Do not sync Apps: Enabled
Allow users to turn “AppSync” syncing on: Disabled
Do not sync browser settings: Enabled
Allow users to turn “browser” syncing on: Disabled
Do not sync desktop personalization: Enabled
Allow users to turn “desktop personalization” syncing on: Disabled
Do not sync language preferences settings: Enabled
Allow users to turn “language preferences” syncing on: Disabled
Do not sync on metered connections: Enabled
Do not sync other Windows settings: Enabled
Allow users to turn “other Windows settings” syncing on: Disabled
Do not sync passwords: Enabled
Allow users to turn “passwords” syncing on: Disabled
Do not sync personalize: Enabled
Allow users to turn “personalize” syncing on: Disabled
Do not sync start settings: Enabled
Allow users to turn “start layout” syncing on: Disabled

Windows Components/Windows Error Reporting

Disable Windows Error Reporting: Enabled

Windows Components/Windows Update/Manage end user experience

Configure Automatic Updates: Enabled
Configure automatic updating: 5 - Allow local admin to choose setting
Install during automatic maintenance: Disabled
Scheduled install day: 0 - Every day
Scheduled install time: 03:00
Every week: Enabled
First week of the month: Disabled
Second week of the month: Disabled
Third week of the month: Disabled
Fourth week of the month: Disabled
Install updates for other Microsoft products: Enabled
Specify active hours range for auto-restarts: Enabled
Specify the max active hours range - Max range: 18

Windows Components/Windows Update/Manage updates offered from Windows Update

Manage preview builds: Disabled
Select when Preview Builds and Feature Updates are received: Enabled
How many days after a Feature Update is released would you like to defer the update before it is offered to the device? - 365

Select when Quality Updates are received: Enabled
After a quality update is released, defer receiving it for this many days: 3

Hope this helps! If you have any questions or comments please leave them below.

Thanks
-Mike

Windows Terminal - quake mode

Sat, 07 Dec 2024 22:30:19 +0000

What is ‘quake mode’?

Quake mode is a Windows Terminal option which starts the program as a large borderless window which can be opened and closed via the keyboard shortcut: WIN + `.

Open Windows Terminal in ‘quake mode’

To start Windows Terminal in quake mode use the following command line switch:

`1`	`wt.exe --window "_quake"`

Open Windows Terminal at startup in ‘quake mode’

To open Windows Terminal in quake mode at start up, go to your startup folder by pressing WIN + R and then typing shell:startup.

A Windows explorer will open. Created a new shortcut .lnk file inside this folder by right-clicking inside the folder “New” > “Shortcut” and then enter the following command:

`1`	`wt.exe --window "_quake"`

When you restart or login next Windows Terminal will open in quake mode.

To open Windows Terminal in ‘quake mode’ minimized at startup, use this command:

For Windows Powershell 5

wt.exe --window "_quake" powershell -window minimized

For Powershell 7

wt.exe --window "_quake" pwsh -window minimized

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Remove MS Store Apps Utility - Update 24.11.09

Sat, 09 Nov 2024 16:43:47 +0000

It’s been a while since I did any work on this utility but I have a couple of small improvements requested from users.

I’ve added a new -Uno option which is remove all apps NOT in the user specified apps.txt file. This could be a good way of removing the extra apps that microsoft push down on Windows users over time.

Secondly I added a -PCOnly option which means the utility will only remove provisioned apps and not remove any apps from the currently logged user account. This can be helpful because the current user on a Windows 10/11 system has many more apps - which are mostly dependencies.

2024-11-09: Version 24.11.09

Added new ‘-Uno’ option which removes ALL apps not in the specified text file. The text file becomes an “apps to keep” list, instead of an “apps to remove” list.
Added new ‘-PCOnly’ option which removes provisioned apps only. This will leave the apps for the current user untouched.

Remove MS Store Apps Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the links below.

If you have any questions or comments please leave them below.

Thanks
-Mike

Clean Up the WinSxS folder

Wed, 18 Sep 2024 13:36:22 +0100

Windows Updates build up over time and take up a lot of space. These can be cleared out manually using the Disk Cleanup utility but you can also use DISM to script the clean up process.

NOTE: Cleaning up the previous update files prevents the ability to roll back, so make sure your Windows installation is functioning as expected before hand.

Running this command in an elevated PowerShell terminal will remove all the old Windows Update files.

`1`	`Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase`

There is more information available on this process here officially from Microsoft.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Hyper-V Backup Utility - Update 24.08.29

Thu, 29 Aug 2024 14:54:04 +0100

Many thanks to user Digheads for PR 37.

With work from myself and PR 37 linked above, SMB authentication has been added. I’ve improved the documentation to help with the explanation of SMB support for backups - it’s a complicated situation when dealing with Hyper-V exports and non-domain joined servers.

PR 37 also added a Prefix option to backup all VMs with a certain prefix.

I’ve also added a long overdue -AllVms option to backup all VMs, regardless of their running status mentioned in issue 23.

Finally, I’ve added a -MakeCreds option which will generate a credential file for use with SMTP authentication.

2024-08-29: Version 24.08.29

Added Sponsorship information to the projects Github.
Added SMB Authentication, based on work from PR 37
Added -MakeCreds option to help in creation of SMTP authentication file.
Added -AllVms option to specify the backing up of all VMs on a Hyper-V server without the need for a list file.
Added -Prefix option to backup all VMs beginning with the string specified.
Added more information about Hyper-V’s export limitations to the documentation and in app help.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please donate via paypal.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Disable IPv6 with PowerShell

Wed, 21 Aug 2024 13:05:47 +0100

Disable IPv6 on all network adaptors

Run the command below in an elevated PowerShell terminal to disable IPv6 on all network adaptors:

`1`	`Disable-NetAdapterBinding -Name * -ComponentID ms_tcpip6`

Disable IPv6 on a specified network adaptor

Run the command below in an elevated PowerShell terminal to list all network adaptors on the system and the enabled or disabled status of IPv6:

`1`	`Get-NetAdapterBinding -ComponentID ms_tcpip6`

Run this command in an elevated PowerShell terminal to disable IPv6 on the adaptor with the specified name:

`1`	`Disable-NetAdapterBinding -Name "ADAPTOR NAME" -ComponentID ms_tcpip6`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Getting Started with MDT Offline Media

Thu, 01 Aug 2024 14:43:39 +0100

Overview

MDT can generate “offline media” which is a way to install Windows, drivers, patches, and applications with no connection to a central server. It’s like creating your own custom Windows ISO but more!

In this guide I’m assuming you already have an MDT Deployment Share created and working as needed. This guide will build on that foundation to create an offline deployment solution.

Before you start here are some points to keep in mind:

Offline media is essentially a new, separate deployment share structure that is created and packed into an ISO file.
Offline media has a separate CustomSettings.ini and Bootstrap.ini file which can be customised the same as the online deployment share.
You can specify what content from the main deployment share is included into the offline media by using selection profiles.
Any content that exists outside of the online deployment share that you wish to be available offline, you can manually copy to the offline media file structure and then re-generate the offline media to have included.

If you have a current deployment share that you wish to continue using alongside offline media, then it’s worth going through it and deciding what content you need in the offline media. This can be applications, drivers, operating systems, packages, and task sequences. I’d recommend creating an “Offline” folder in each section and then copy & pasting the item into the “Offline” folder. This is so we can then create an “Offline Media” Selection Profile that only includes these Offline folders.

How Duplicating Items in MDT Works

Copy & pasting items in MDT duplicates the item and doesn’t create a new copy of the item. So, for example, if you duplicate a task sequence and then make changes to it you are changing that single task sequence. If you need a new “offline” task sequence, then you’ll need to create a new one from scratch. This goes for everything in MDT.

Creating New Applications In MDT For Use With Offline Media

If you plan on including applications with your offline media, you should check that the application item has a “Source directory” configured. If this field is blank, then the application will not be included in the offline media as MDT doesn’t know where to get the files from.

The “Source directory” is configured when you create a new application and the “Application with source files” radio button is selected.

Creating a Selection Profile

In the MDT Deployment Workbench, under “Advanced Configuration/Selection Profiles”:

Right-click on the “Selection Profiles” folder in the left-hand panel and select “New Selection Profile”.
Give the Selection Profile a name - we’ll call it “Offline Media” and click “Next”.
Here you’ll see a list of all the content in your MDT share. Note that you only see folders and not individual items.
Select the items you wish to include in your Offline Media and click “Next” and then Next again.
On the final screen the Process should have completed successfully, click “Finish”.

Creating Offline Media

In the MDT Deployment Workbench, under “Advanced Configuration/Media”:

Right-click on the “Media” folder in the left-hand panel and select “New Media”.
Select the path where the new Offline Media folder structure should be created - it should be outside of any deployment shares. e.g. E:\MDT-Offline
Under “Selection profile” choose the selection profile we created earlier and then click “Next”.
If you browse to the path that you chose in step 2 you should see a “Content” directory and inside that a “Deploy” directory which contains a structure a lot like a normal deployment share.
Under “Advanced Configuration/Media” you should have a new item called “MEDIA001”, right click and select “Properties”.
On the Properties page “General” tab you can configure the platforms (I recommend unchecking “x86” unless you specifically need it) and the name of the ISO file if desired.
On the “Rules” tab you can configure the CustomSettings.ini and the Bootstrap.ini for the Offline Media only. These function in the same way as the main deployment share.
On the “Windows PE” tab, once again this is the Offline Media’s configuration of its WinPE environment.
Once all is configured as needed, right click on the “MEDIA001” and select “Update Media Content” and MDT will build an ISO file with all the content specified from the selection profile chosen in step 3.
When the media creation has completed successfully you can use the ISO file with a VM to test or use a tool like Rufus to use it with a USB drive to image a computer.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Hyper-V Backup Utility - Update 24.05.11

Sat, 11 May 2024 14:51:18 +0000

This is a quick update to fix an issue where backup success would be reported when using a working directory and the final destination directory didn’t have enough disk space. This happened because the backup to the working directory succeeded and the backup state flag wouldn’t get set to “failed” when the move to the final destination failed.

Huge thanks to ecomstation, Charles-Isaac and furicle for reporting this issue. Apologies that it took to some to get a fix in.

Many thanks to everyone who continues to support the further development of these scripts.

2024-05-11: Version 24.05.11

Fixed an issue where backup success would be reported when using a working directory and the final destination directory for the backup didn’t have enough disk space. From Issue 27

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please donate via paypal.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Hyper-V Backup Utility - Update 24.03.21

Thu, 21 Mar 2024 14:51:36 +0000

In this release I’ve added a new option to specify how the Export-VM function should capture the state of the VM, which should help with any VM freezes or lagging during export.

Many thanks to bacardischmal who brought this to my attention via GitHub Issue 34.

2024-03-21: Version 24.03.21

Added -CaptureState option for the user to specify the method that Export-VM uses to capture the state of the VM whilst running. From Issue 34

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please donate via paypal.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Hyper-V Backup Utility - Update 24.03.18

Mon, 18 Mar 2024 15:23:02 +0000

Update Summary

This is a follow-up release with an important fix for users who password protect their 7-Zip archives. A user brought this is my attention on GitHub and contributed code via Issue 33.

My sincerest apologies for not catching this issue in the previous release. Many thanks to jlaraby for submitting the issue.

2024-03-18: Version 24.03.18

Added fix for verifying password protected 7-Zip archives from Issue 33

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please donate via paypal.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Hyper-V Backup Utility - Update 24.03.08

Mon, 11 Mar 2024 17:35:37 +0000

Update Summary

This is a big update with many changes specifically around the creation and verification of 7-Zip archives and the handling of split 7-Zip archives when short dates are used. There were previously some issues around the script flagging failed backups as failed and successful at the same time.

My sincerest apologies for not releasing an update before now, finding time to focus on coding as well as finding work has been difficult. Many thanks to everyone who has supported me and logged issues and suggestions for improvements. Your continued feedback is greatly appreciated!

2024-03-08: Version 24.03.08

Fixed 7-Zip split files getting renamed and not keeping file extensions when short dates are used.
Added a verify operation for 7-Zip created archives as per Issue 33
Fixed an issue where failed backups where also listed as successful.
Overhauled the backup success/fail checks. They now work a lot more reliably.
Added check for the work dir/backup dir to exist before trying to remove as this caused a script error.
Cleaned up console and log file output.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please donate via paypal.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Poor Network Performance With FreeBSD Based Operating Systems On Hyper-V

Thu, 21 Sep 2023 10:26:32 +0100

The Problem

When using FreeBSD based distro’s like TrueNAS-Core or pfSense on Hyper-V network performance is very poor.

The Solution

Receive Segment Coalescing (RSC) is enabled by default on all virtual NICs with Hyper-V and it should be disabled if you are experiencing poor network performance. You can do this with a quick PowerShell command.

Find out if Software RSC is enabled on your virtual NICs:

`1`	`Get-VMSwitch -Name * \| Select name, RSC`

Disable Software RSC on a specific virtual NIC:

`1`	`Set-VMSwitch -Name "virtual NIC name" -EnableSoftwareRsc $false`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Installing and Configuring LibreNMS (and SNMP on Windows Server)

Sat, 08 Jul 2023 15:00:00 +0100

Original Post Date: 2022-10-18

Updated: 2023-07-08

Before you start

This walkthrough is very similar to the excellent official LibreNMS documentation available here. The intention with this guide is to walk through the installation of LibreNMS on a fresh install of Ubuntu Server 22.04, running the NGINX web server stepping through the entire process and explaining some of the things that caught me out. Additionally, this will also cover how to install and set up SNMP on Windows servers so LibreNMS can monitor your Windows servers too.

Please note that like the official docs I will not be covering HTTPS setup, so your LibreNMS install will not be secure. Don’t expose it to the Internet unless you have configured HTTPS and taken appropriate web server hardening steps.

Installing Ubuntu Server 22.04

Installing Ubuntu Server 22.04 is pretty straight forward, however setting a static IP is different from Windows in that setup expects the subnet to be in CIDR format, for example: 192.168.0.0/24

For the user profile setup in the tutorial we’ll use the following information.

your name: LibreNMS
servers name: librenms-host
username: librenms
password: [your-password]

During the install you will be asked if you want to Install OpenSSH server. To allow much easier remote management you should enable this. It will make following this tutorial much easier as you will be able to copy and paste into the SSH window.

VM Quirks

Once the install procedure has completed it may look like it’s frozen. Just press enter and it will continue. Once the VM boots it may look like it’s frozen again and might not display a login prompt. Again just press enter and you will see a login prompt appear.

SSH is enabled, so from here on we’ll use that. In a cmd/PowerShell or Terminal prompt use the following commands to login:

1
2

ssh librenms@ServerIPaddress
[your-password]

We must become the root user to install the required packages:

sudo -i

Install Packages

Enter the following commands to install the pre-requisits LibreNMS requires:

apt install acl curl fping git graphviz imagemagick mariadb-client mariadb-server mtr-tiny nginx-full nmap php-cli php-curl php-fpm php-gd php-gmp php-json php-mbstring php-mysql php-snmp php-xml php-zip rrdtool snmp snmpd whois unzip python3-pymysql python3-dotenv python3-redis python3-setuptools python3-systemd python3-pip

Add The LibreNMS User

This user should already exist if you’ve been following this walkthrough from the top.

Enter the command:

`1`	`useradd librenms -d /opt/librenms -M -r -s "$(which bash)"`

Download LibreNMS From GitHub

Run these commands to change directory to the /opt directory and then clone the librenms repository from GitHub:

1
2

cd /opt
git clone https://github.com/librenms/librenms.git

Setting Permissions

Now we’ll change the owner and file permissions on the downloaded files:

chown -R librenms:librenms /opt/librenms
chmod 771 /opt/librenms
setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
setfacl -R -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/

Install PHP Dependencies

With the next command we’ll switch user to the librenms user from the root user we’ve been using up to this point:

`1`	`su - librenms`

You will now be in the librenms user home directory, so we must change directory to the librenms directory in /opt that was cloned from GitHub:

`1`	`cd /opt/librenms`

Now we need to run the following script:

1
2

./scripts/composer_wrapper.php install --no-dev
exit

The exit will switch us back to the root user we were running as before. The reason for this switch to librenms and then back to root is that the script must run as the librenms user, but now we need the root priviledges again.

Set The Time Zone

Now we need to set the time zone in the PHP config and to do that we must edit some config files, we’ll use the “nano” text editor. See here for a list of supported time zones.
Some valid examples are: “America/New_York”, “Australia/Brisbane”, “Etc/UTC”, “Europe/London”.

`1`	`nano /etc/php/8.1/fpm/php.ini`

Scroll down to this section:

[Date]
; Defines the default timezone used by the date functions
; http://php.net/date.timezone
;date.timezone =

Change: ;date.timezone = to date.timezone = Europe/London using the time zone “Europe/London” as an example.

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Now run this command and edit the file the same way as above.

`1`	`nano /etc/php/8.1/cli/php.ini`

We now need to set the system time zone using the command below with “Europe/London” as an example:

`1`	`timedatectl set-timezone Europe/London`

Configure MariaDB

In this section you’ll see a lot of “mysql” commands even though we’re using MariaDB. In short MariaDB is a fork of MySQL - meaning it’s based off of MySQL. The commands are “mysql” probably for compatibility I would think.

Once again we’re going to be editing a config file using nano:

`1`	`nano /etc/mysql/mariadb.conf.d/50-server.cnf`

Add the following inside the [mysqld] section:

1
2

innodb_file_per_table=1
lower_case_table_names=0

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Run these commands to enable MariaDB and start the service:

1
2

systemctl enable mariadb
systemctl restart mariadb

Now we’re going to login to MariaDB and create the database. The 'your-password' should be set to a secure password:

mysql -u root

CREATE DATABASE librenms CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'librenms'@'localhost' IDENTIFIED BY 'your-password';
GRANT ALL PRIVILEGES ON librenms.* TO 'librenms'@'localhost';
exit

Configure PHP-FPM

Next we’ll copy a template config file and edit it for librenms:

1
2

cp /etc/php/8.1/fpm/pool.d/www.conf /etc/php/8.1/fpm/pool.d/librenms.conf
nano /etc/php/8.1/fpm/pool.d/librenms.conf

Change [www] to [librenms]

Change “user and group” from:

1
2

user = www-data
group = www-data

to:

1
2

user = librenms
group = librenms

Change listen = to:

`1`	`listen = /run/php-fpm-librenms.sock`

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Configure NGINX Web Server

Here we’re going to create a new config file:

`1`	`nano /etc/nginx/conf.d/librenms.conf`

Copy and paste the text below remembering to change your-server-ipaddress to your servers IP address.

server {
 listen      80;
 server_name your-server-ipaddress;
 root        /opt/librenms/html;
 index       index.php;

 charset utf-8;
 gzip on;
 gzip_types text/css application/javascript text/javascript application/x-javascript image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon;
 location / {
  try_files $uri $uri/ /index.php?$query_string;
 }
 location ~ [^/]\.php(/|$) {
  fastcgi_pass unix:/run/php-fpm-librenms.sock;
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  include fastcgi.conf;
 }
 location ~ /\.(?!well-known).* {
  deny all;
 }
}

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Next we’re going to delete the default site, and restart the web server and php services:

1
2
3

rm /etc/nginx/sites-enabled/default
systemctl restart nginx
systemctl restart php8.1-fpm

Enable lnms Command Completion

This feature grants you the opportunity to use tab for completion on lnms commands as you would for normal linux commands.

1
2

ln -s /opt/librenms/lnms /usr/bin/lnms
cp /opt/librenms/misc/lnms-completion.bash /etc/bash_completion.d/

Configure snmpd

Now we’re going to copy the example SNMP config file from the LibreNMS directory and edit it:

1
2

cp /opt/librenms/snmpd.conf.example /etc/snmp/snmpd.conf
nano /etc/snmp/snmpd.conf

You’ll need to change the following line to whatever you decide to use as your SNMP community string, by default most devices use “public”:

`1`	`com2sec readonly default RANDOMSTRINGGOESHERE`

It should look like this when you’re done:

`1`	`com2sec readonly default public`

Also it may be worth changing the following lines to the appropriate information:

1
2

syslocation Rack, Room, Building, City, Country [Lat, Lon]
syscontact Your Name <your@e-mail.address>

When you’re done it should look similar to this:

1
2

syslocation [The loction information you want to appear in LibreNMS]
syscontact [The name and e-mail address you want to appear in LibreNMS]

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Finally, we can run the commands below (optionally) to make the LibreNMS host server appear as the specific linux device it is and not a generic one.

curl -o /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
chmod +x /usr/bin/distro
systemctl enable snmpd
systemctl restart snmpd

Setting Up The Cron Job

Use this command to copy the cron job from the LibreNMS files to the system:

`1`	`cp /opt/librenms/dist/librenms.cron /etc/cron.d/librenms`

Enable The Scheduler

Run this command to copy the scheduler service from the LibreNMS files to the system, and then start the scheduler for librenms.

1
2
3

cp /opt/librenms/dist/librenms-scheduler.service /opt/librenms/dist/librenms-scheduler.timer /etc/systemd/system/
systemctl enable librenms-scheduler.timer
systemctl start librenms-scheduler.timer

Copy logrotate Config

LibreNMS keeps logs in /opt/librenms/logs. Over time these can become large and be rotated out. To rotate out the old logs you can use the provided logrotate config file:

`1`	`cp /opt/librenms/misc/librenms.logrotate /etc/logrotate.d/librenms`

Final Setup

We need to do some final setup tasks. It’s time to go to a web browser: http://you-server-ip-address

Click on the blue circles to move the setup process along.
For “Configure Database”, fill in the password you set during the MariaDB setup section.
Click “Check Credentials”
Then click “Build Database”
Wait for it to complete.
When it’s done, the scrolling text will disappear and you should click on the next blue circle.
Now we’ll create an admin user - the e-mail can be left blank.
Click on the next blue circle.
Finish Install - Click on “Validate your install”

You will likely see some warnings - luckily in this new version of LibreNMS there’s an “automatically fix” button for database issues.

Once you’re run the fixes refresh the validate page http://ip-address/validate, and the database warnings should be gone.

Adding Your First Device

To add the first device:

Click on the LibreNMS logo to go to the home page.
Hover over Devices on the top bar, then click on Add device.
On the Add Device page, enter the IP of the LibreNMS server and the community string and then click on “Add Device”. If all goes well it should be added successfully.

Configure a Dashboard

The default dashboard is blank, here’s how to add some useful widgets to it.

Click on the edit icon.
In the drop down menu “Select Widget” select “Eventlog”.
The widgets can be resized as needed.
To save the dashboard changes, click on “Update”.
To hide the “Edit Dashboard Bar” hover over “Overview” then “Dashboard” then click on “Hide Dashboard Editor”.

Configure Alerts

There are many ways that LibreNMS can send alerts, but here I’m just going to focus on setting up e-mail alerts.

First we must create the default alert rules.

Hover over “Alerts” on the top bar.
Then click on “Alert Rules”.
Then click on the big green button to set up the default alert rules.

Now we must configure the alert transports.

Hover over “Alerts” on the top bar
Then click on “Alert Transports”.
Click on “Create alert transport” and name it “mail”.
Set “Transport type” to mail.
Set “Default alert” to ON.
Enter the e-mail address that the alerts should be send to.

Next we must configure a transport group.

Still on the Alert Transports page, click on the “Create transport group” button.
Enter the group name “mail group”.
Click on “Group Members” and the “mail” transport we created above will show.
Click on it again, then select “Save Transport Group”.

Finally, we must configure how the e-mails are going to be sent.

Hover over the cog icon in the top right hand corner and click on “Global Settings”.
Then click on the “Alerting” tab, and e-mail options.
Here you can enter the details for the SMTP server to use to sent the e-mails from. It supports Office 365, G-Suite and on-premise Microsoft Exchange servers.

Installing and Configuring SNMP on Windows Servers

Open an elevated PowerShell console and run the following command:

`1`	`Install-WindowsFeature SNMP-Service`

Once SNMP is installed, the community and permitted managers will need to be configured. There are a multitude of ways to do this but for a group of domian joined servers the best way is by using group policy.

Group Policy

Either create or edit an existing Group Policy Object and navigate to

Computer Configuration/Administrative Templates/Network/SNMP

To specify the community string, use the “Specify communities” policy.
Set it to “Enabled”.
Click the “Show” button in the options to set one or more community strings.
Use the “Specify permitted managers” policy to set which servers should have access to SNMP.
Set it to “Enabled”.
Click the “Show” button in the options and enter the IP address of the LibreNMS server.

Attach the GPO to the OU containing the servers you want to have SNMP configured and once group policy refreshes you should be able to add your Windows Servers as devices to monitor in the same way you did for the LibreNMS server.

Registry Edits

Navigate to or create the following path in regedit:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities

Create a new “String Value” and name it “1” and then enter the name of the community string.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\SNMP\Parameters\PermittedManagers

Create a new “String Value” and name it “1” and enter the IP address of the LibreNMS server.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

MDT Setup Script Update

Sun, 02 Jul 2023 19:04:58 +0100

I’ve updated MDT Setup to support the latest Windows ADK and WinPE Add-on. The fixes are provided from metisit.com who has done a phenomenal amount of work digging into all the changes that the recent version of the Windows ADK brings. Please note that my script only makes changes to MDT and not WDS or Windows server.

For the full change log and more information, visit the home page for MDT Setup.

MDT-Setup is available from:

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Installing and Configuring Domain Controllers with Windows Server Core

Mon, 20 Mar 2023 17:00:00 +0000

Windows Server Core is an ideal choice for Active Directory Domain Controllers due to it’s low resource usage and greatly reduced attack surface. In this post I’ll go through the initial steps on how to deploy a new Active Directory forest and add an additional Domain Controller to the domain, and finally I’ll run some basic checks on the health of the domain after installation. This guide is also suitable for regular GUI Windows Server installations.

Installing Windows Server Core

Boot the server from the Windows Server media and on the “Select the Operating System you want to install” screen, select the option “Windows Server Standard” or “Datacenter” edition. The other options with “Desktop Experience” in brackets are the options for the other server editions with a GUI also installed.

Please note: You can no longer add and remove the GUI (Desktop Experience) with Windows Server 2016 as you could with Windows Server 2012 & 2012 R2. This is due to numerous problems with keeping the installation and removal process consistent with updates. With Windows Server 2016, the only way to add or remove the GUI is to re-install and select one of the server editions with the “Desktop Experience” option.

Initial Configuration

Once the install process has completed, you will be prompted with a command line window, and asked to set the Administrator password.

Set the Administrator password.
Type sconfig to get the Server Configuration menu. It’s pretty straight forward. In the Server Configuration menu, you can configure all the basics required for the server.
For the first Domain Controller in the new forest, you’ll need to configure at least the Network Settings - IP address, subnet mask, gateway, and DNS.
You may also want to configure the computer name. Configuring the computer name will require a restart.
After the restart, log in to the server with the Administrator password you set in step 1.

Tip: “sconfig” is also present in the GUI version of Windows Server, making initial configuration of new servers easier.

Additional Storage Configuration

You may want to configure additional locally attached disks or iSCSI/MPIO storage. Creating new volumes that are locally attached can be done via the diskpart command line tool. Here’s the series of commands to create a new, NTFS formatted volume, with the drive letter of E:\ and the name “Data”, from a second disk in the server using the diskpart tool. First, run diskpart from the command line, then use the following commands:

list disk
select disk 1
online disk
attributes disk clear readonly
clean
convert mbr -or gpt
create partition primary
select part 1
active
format fs=ntfs label=Data quick
assign letter E:
list volume

iSCSI storage can be configured using the same GUI tools you would use in the GUI version of Windows Server. The MPIO feature must be installed before the tool is available. You can do this via PowerShell:

`1`	`Install-WindowsFeature -Name 'Multipath-IO'`

When MPIO is installed you can load the MPIO utility using mpiocpl. For the iSCSI utility you can use iscsicpl. iSCSI is installed as part of the base Windows Server feature set.

Install Active Directory Domain Services

Now we’ll install Active Directory Domain Services, and create the first Domain Controller for a new forest.

The following PowerShell command will install the Active Directory Domain Services binaries, but will not make the server a Domain Controller:

`1`	`Install-WindowsFeature AD-Domain-Services -IncludeManagementTools`

Once the binaries have been installed, now the forest can be created and the server can become a Domain Controller:

`1`	`Install-ADDSForest -DomainName contoso.com`

If you’d like to configure the path of where the AD database, AD logs, and the SYSVOL are stored, then run the following command:

`1`	`Install-ADDSForest -DomainName contoso.com -DatabasePath "E:\AD\DB" -LogPath "E:\AD\Log" -SysvolPath "E:\AD\SYSVOL"`

As part of the install process you’ll be asked to set the “safe mode administrator password” - this is also known as the “Directory Services Restore Mode (DSRM) password”.

Once the install process completes, you’ll be prompted for a restart, and after restarting you’ll have the first Domain Controller for a new forest.

Adding an Additional Domain Controller To An Existing Domain

To add an additional Domain Controller to a domain, first install Windows Server Core as detailed above, configure the network settings and any extra storage you require.

Add the server to the existing domain that you want to create an additional Domain Controller for and log in as a user with domain admin privileges for that domain.

Install the Active Directory Domain Services binaries by running the following command in PowerShell:

`1`	`Install-WindowsFeature AD-Domain-Services -IncludeManagementTools`

To promote the server to a Domain Controller, run the following command:

`1`	`Install-ADDSDomainController -DomainName "contoso.com"`

If you’d like to configure the path of where the AD database, AD logs, and the SYSVOL are stored, then run the following command:

`1`	`Install-ADDSDomainController -DomainName "contoso.com" -DatabasePath "E:\AD\DB" -LogPath "E:\AD\Log" -SysvolPath "E:\AD\SYSVOL"`

As part of the install process you’ll be asked to set the “safe mode administrator password” - this is also known as the “Directory Services Restore Mode (DSRM) password”.

Once the install process completes, you’ll be prompted for a restart, and after restarting you’ll have another Domain Controller for the domain.

Post Install Health Check

To check the health of the Domain Controller, you can use the dcdiag tool. To direct the output to a TXT file and read it with notepad run the following from the command line:

1
2

dcdiag >C:\dctest.txt
notepad C:\dctest.txt

You may have a problem with the first Domain Controller for a forest not advertising itself as a time server. If you experience this issue, try the following commands to fix the issue:

net stop w32time
w32tm /unregister
w32tm /register
net start w32time

Run dcdiag once again and the problem should be resolved. One potential problem to look out for with Active Directory is DNS. You can configure dcdiag to run a DNS specific test:

`1`	`dcdiag /test:dns`

Final Tasks

You may want to revisit the Server Configuration tool “sconfig” and do some final configuration tasks like enable Remote Desktop or configure Windows Updates. To administer Active Directory using the GUI management consoles, add a PC or VM with a recent version of Windows 10 to the domain, and install the Remote Server Administration Tools (RSAT) for Windows 10.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Installing and Configuring Windows Server Update Services (WSUS) with Windows Server Core

Mon, 20 Mar 2023 17:00:00 +0000

Windows Server Update Services (WSUS) can use a lot of resources, so why not use Windows Server Core and make the most of the resources you have. In this post I’ll go through the initial steps on how to deploy and configure a WSUS server using command line and PowerShell. This guide is also suitable for regular GUI Windows Server installations.

Installing Windows Server Core

Initial Configuration

Once the install process has completed, you will be prompted with a command line window, and asked to set the Administrator password.

Set the Administrator password.
Type sconfig to get the Server Configuration menu. It’s pretty straight forward. In the Server Configuration menu, you can configure all the basics required for the server.
For the first Domain Controller in the new forest, you’ll need to configure at least the Network Settings - IP address, subnet mask, gateway, and DNS.
You may also want to configure the computer name. Configuring the computer name will require a restart.
After the restart, log in to the server with the Administrator password you set in step 1.

Tip: “sconfig” is also present in the GUI version of Windows Server, making initial configuration of new servers easier.

Additional Storage Configuration

list disk
select disk 1
online disk
attributes disk clear readonly
clean
convert mbr -or gpt
create partition primary
select part 1
active
format fs=ntfs label=Data quick
assign letter E:
list volume

`1`	`Install-WindowsFeature -Name 'Multipath-IO'`

When MPIO is installed you can load the MPIO utility using mpiocpl. For the iSCSI utility you can use iscsicpl. iSCSI is installed as part of the base Windows Server feature set.

Install Windows Server Update Services (WSUS)

The following PowerShell command will install the WSUS feature:

`1`	`Install-WindowsFeature -Name UpdateServices -IncludeManagementTools`

Now we need to run some post install tasks. We’ll create a directory for the WSUS content on the E:\ drive.

`1`	`MD E:\WSUS_Content`

To configure WSUS to use the directory we just created and the Windows Internal Database (WID is based on SQL Express), run the following command:

1
2

CD "C:\Program Files\Update Services\Tools"
.\wsusutil.exe postinstall CONTENT_DIR=E:\WSUS_Content

Alternatively you might want to use an external SQL server for the WSUS database, if so run the following command instead:

1
2

CD "C:\Program Files\Update Services\Tools"
.\wsusutil.exe postinstall SQL_INSTANCE_NAME="SQLSERVER\SQLINSTANCE" CONTENT_DIR=E:\WSUS_Content

WSUS is now running and able to be configured further. This is possible with PowerShell, but not as straightforward as the installation above so we’ll be using the WSUS MMC on a remote computer or on the server itself if you installed Windows Server with the Desktop Experience.

To obtain the WSUS MMC on a remote computer we’ll need to install the Remote Server Administration tools (RSAT), run the following command in an elevated PowerShell session:

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online`

To view WSUS reports you’ll also need to download and install the following:

Microsoft Report Viewer 2012 Runtime redistributable
Microsoft System CLR Types for Microsoft SQL Server 2012: x64 version, x86 version

In case the links to Microsoft System CLR Types fail in future, here is the main download page link. This page links to components from the Microsoft SQL Server 2012 Feature Pack, you need to go to the Install Instructions section and download the specific component you need.

Configuring Windows Server Update Services

Once you have downloaded and installed all the software listed above on our admin PC, you can continue with the configuration.

Open the Windows Service Update Services Microsoft Management Console (WSUS MMC).
You should see a “Before You Begin” wizard. Click Next.
Join the Microsoft Update Improvement Program if you wish.
Choose Upstream server, as this is the first WSUS server we’ll choose “Synchronize from Microsoft Update”.
Specify the Proxy Server settings if needed.
Click “Start Connecting”.
Select the applicable languages for our environment.
Select the applicable Products. I recommend selecting all products as we’ll only be downloading updates that we actually need.
Select the Classifications. I recommend selecting all except Drivers and Driver Sets. Drivers in WSUS increase the size of the database immensely.
Configure the Sync Schedule. I recommend leaving this on manual until setup and synchronisation has been completed.
Check the Begin initial synchronization box. This may also take a while.
Click Finish.

Once the initial configuration is complete, now we can start to configure WSUS for every day operation.

In the WSUS MMC go to the Options node.
Setup a Synchronization Schedule. I recommend once or twice a day, out of regular hours. Click OK.
Go to Automatic Approvals.
There’s a built-in rule to automatically approve Critical and Security updates, meaning that they will be downloaded and distributed via WSUS without any admin interaction. I recommend enabling this, but don’t run the rule.
You may also want to add a rule for Definition Updates from Exchange, Office, and Windows Defender if applicable to you. Click OK.
Now go to Computers.
Set the option here to Use Group Policy or registry settings on computers and click OK.
Go to E-Mail notifications and enable them if you want status reports and Emails about the new updates that have been synchronised. Click OK.
In the WSUS MMC, go to the Computers node.
Create the computer groups that you require here. I recommend a ‘pilot’ group and a ‘regular’ group both for client devices and servers.

Configuring Group Policy

To enable our clients to get updates from WSUS using the settings above, you’ll need to configure the group policy for them.

Open the Group Policy Management MMC and go to the Group Policy Objects node.
Right click on the node and select New to create a new GPO for WSUS. Give it a name and click OK.
Right click on the new GPO and click Edit to open it.
Navigate to Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Manage updates offered from Windows Server Update Service
Go to the setting “Specify intranet Microsoft update service location”.
We’ll configure both “Set the intranet update service for detecting updates” and “Set the intranet statistics server” to http://wsus-server-name.contoso.com:8530
Go to “Enable client-side targeting” and enter the name of a group that you created in WSUS.
For multiple groups, repeat steps 2 - 7 for each group.
You can use Active Directory Security Groups to control which client devices have read access to the GPO with the desired WSUS group configuration.

There are lots of other settings in GPO to configure Windows Update that I recommend taking a look, specifically “Configure Automatic Updates” located in Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Manage end user experience which controls when client devices install updates.

Managing Updates

After some time (approximately 24 hours) our client devices should have contacted the WSUS server and be in the correct group. Now we need to approve the updates required for our environment.

On the overview of our WSUS server, click on “Updates needed by computers”.
Change the drop down menu “Approval” to “Unapproved” and click “Refresh”.
Right-click on the Title bar and enable the “Supersedence” column.
Click on the very tiny “Supersedence” column to sort the updates by Supersedence.
Approve the top critical, security and any other updates you want to be installed on our devices.
Once the devices have downloaded, installed, and reported back to the WSUS server, we’ll have a better idea if any more updates are required.

Maintenance and Troubleshooting

Keeping WSUS running over time requires some maintenance. I created a custom PowerShell script that runs every day to perform the maintenance on the database. More specifically it declines and deletes old updates, and old computers. It can also send a notification over e-mail or a webhook with information about it’s clean up run. I’ve posted about it here.

You can also clean up the WSUS database manually using the “Server Cleanup Wizard” found in Options. You can also run this via PowerShell:

1
2

Get-WsusServer -Name Wsus-Server-Name -PortNumber 8530
Get-WsusServer | Invoke-WsusServerCleanup –CleanupObsoleteUpdates -CleanupUnneededContentFiles -CompressUpdates -DeclineExpiredUpdates -DeclineSupersededUpdates

You may encounter an error when trying to connect to the WSUS server using the MMC - Error: Unexpected Error, appears as Event ID 7053 in Event Viewer.

I’ve known this error to occur frequently. One fix is to navigate to %appdata%\Microsoft\MMC and delete the wsus file and then try connecting again.

IIS Configuration

I highly recommend configuring these IIS AppPool settings relating to WSUS. In an elevated PowerShell session run the following commands:

Import-Module WebAdministration
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name queueLength -Value 25000
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name cpu.resetInterval -Value "00.00:15:00"
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name processModel.idleTimeout -Value "00.00:00:00"
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name failure.loadBalancerCapabilities -Value "TcpLevel"
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name recycling.periodicRestart.privateMemory -Value 0
Set-ItemProperty -Path IIS:\AppPools\WsusPool -Name recycling.periodicRestart.time -Value "00.00:00:00"

In the IIS Manager these PowerShell commands change the following values:

WSUS -> Application Pools -> WsusPool -> Advanced Settings

General:
Queue Length: 25000

CPU:
Limit Interval (minutes): 15

Process Model:
Idle Time-out (minutes): 0

Rapid-Fail Protection:
“Service Unavailable” Response: TcpLevel

Recycling:
Private Memory Limit (KB): 0
Regular Time Interval (minutes): 0

Finally, you can also try the following command, if needed:

1
2

CD "C:\Program Files\Update Services\Tools"
.\wsusutil.exe postinstall /servicing

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Open NAT for Gaming with pfSense

Tue, 31 Jan 2023 23:00:00 +0000

If you use pfSense as your router and you’ve open the ports for certain games or gaming services and you still get “closed network” errors - even if only sporadically, then this may be the solution for you (it worked for me).

The problem seems to be due to pfSense randomizing ports, so you get the “closed network” error. In the case of some games (e.g. Warframe) you’ll have open NAT sometimes and other times, you won’t.

The Quick Fix:

I’m assuming that you’ve already created Port Forwarding Rules for the games and services you want to use in pfSense. If not, you’ll still need to do that.

In the pfSense web GUI go to: Firewall / NAT / Outbound

Set the Outbound NAT Mode to: Hybrid NAT Rule Generation

Under Mappings on the same page, create mappings for the gaming devices, consoles/PCs that you want to use.

Interface: WAN
Protocol: Any
Source: Network - device IP, leave port blank.
Destination: Any, leave all blank.

Translation Section
Address: Interface Address

Port or Range: blank - Make sure Static Port is ticked - this is key.

That’s it, you should now get consistent “Open NAT” for your games.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Setting a Static IP Address on Ubuntu Server 24.04/22.04 LTS

Thu, 26 Jan 2023 17:00:00 +0000

Ubuntu Server 24.04/22.04 LTS uses a utility called ‘netplan’ for networking. To set a static IP we need to edit the config file.

In the terminal, go to the netplan config file location:

`1`	`cd /etc/netplan/`

The file should be called 00-installer-config.yaml if it doesn’t exist then the following will create it. We need to run a text editor, in this case, nano as root so we can make changes to it.

`1`	`sudo nano /etc/netplan/00-installer-config.yaml`

The static IP config should look similar to this:

network:
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - 192.168.10.5/24
      nameservers:
        addresses: [1.1.1.1,8.8.8.8]
      routes:
        - to: default
          via: 192.168.1.253
  version: 2

eth0: is the name of my network interface - yours may differ.
Under addresses: is the static IP to set, you’ll need to use CIDR notation, so /24 is 255.255.255.0.
DNS servers are configured under nameservers: multiple servers should be command separated.
The default gateway is set under routes: and - to: default.

Save the file with CTRL + O and press enter to overwrite the existing file.
Exit with CTRL + X

Run the following command to set the permissions for the config file:

`1`	`sudo chmod 0600 /etc/netplan/00-installer-config.yaml`

To apply the changes run the following command:

`1`	`sudo netplan apply`

To confirm the settings, run the following to see the current IP:

`1`	`ip addr show eth0`

Run the following to see the default gateway:

`1`	`ip route show`

Run the following command to see the DNS servers being used:

`1`	`resolvectl status`

And now you know, and knowing is half the battle.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 23.01.09

Sun, 08 Jan 2023 21:07:32 +0000

Flexible Hyper-V Backup Utility

Many thanks to everyone who has donated, sent me messages about bugs and suggestions for improvements. Your continued feedback is greatly appreciated!

This is a big update with many substantial changes to the code. I have tested it extensively but if a bug has slipped through please do not hesitate to contact me or open an issue on github.

Update Summary

The code has been refactored in many places and now uses functions for a lot of core operations which help greatly in maintaining it.
Several improvements have been made. Some small, some large.
Several new features have been added including a “low disk space” mode. In this mode previous backups are removed before new ones are made. There is more risk of data loss involved with this but this is now a choice you can make for yourself.

Please see the complete release notes down below for all the details.

2023-01-09: Version 23.01.09

Added script update checker - shows if an update is available in the log and console.
Added VM restore instructions to readme.md.
Added “low disk space” mode. -LowDisk switch deletes previous backup files and folders before backup for systems with low disk space. Default behaviour only removes backups after a successful backup has occurred.
Added webhook option to send log file to. For Teams, Slack, Discord integration.
Lot’s of refactored code using functions. Simpler, easier to manage. Long overdue.
Fixed bug that started VMs that were shutdown.
Changed “VM not running” from an error state to an informational state.
Changed “Backup Success” to a success state (green text in console).
Changed -NoPerms so that VMs are now saved instead of shutdown (safer, faster, does not require Hyper-V integrations)

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Thick v Thin Images (Microsoft Deployment Toolkit)

Tue, 15 Nov 2022 15:00:00 +0000

The question of “whether we should do “thick” or “thin” images” comes up a lot and so in this I’m going to go through my thought process when answering this question and hopefully, help you in making the right choice for your environment.

First, lets define the different image types and show the processes for each.

Thick Images

Thick images are an image which is created by an admin containing the Windows installation, Windows updates, applications, application updates and customisations such as - registry changes, Start menu layout and application configurations. Files and configuration changes that are “baked in” to your Windows installation.

The image creation process looks something like this:

Windows installed on VM.
Check for Windows updates and install.
Applications installed.
Applications updated.
Check for Windows updates and install.
Customise Windows and applications.
Capture image.

The image is then deployed to devices. That process is as follows:

Deploy image to device(s).
Drivers installed.
Join domain.
Check for Windows updates, yet again, just in case.
Install applications that need to be installed on final deployment or are subject to frequent updating - anti virus or remote management clients for example.
Any final tweaks that are subject to frequent updates.

Thin Images

Thin images are more of a process in which the Windows image provided from Microsoft is deployed and then updates, applications and any customisations are made as part of a task sequence, group policy or other management system.

The deployment process looks something like this:

Windows image deployed to device(s).
Drivers installed.
Join domain.
Check for Windows updates and install.
Applications installed.
Applications updated.
Check for Windows updates and install.
Customise Windows and applications.

Image Times For Thick/Thin

These times are taken from my image creation and deployment process in my lab. I’m using Hyper-V VMs for the server and client devices. These times are only intended as demonstration purposes.

OS: Windows 10 22H2
Customisations: Remove specific MS Store Apps, script to configure various Windows settings for all users.
Apps: Visual C++ 2017 Redist, .NET 3.1 Desktop Runtime, .NET 5 Desktop Runtime, .NET 6 Desktop Runtime, .NET Framework 3.5, .NET Framework 4.8, 7-zip, Firefox, Google Chrome, Notepad++, OBS Studio, Epic Games Launcher, Ubisoft Connect, Steam Client, Origin, VLC, Adobe Reader, Office 365 Business

Thick Image

Build - Apps, Windows updates from internet, Customisations: 56m 00s
Deploy - Windows updates from internet, Customisations - 9m 55s

Thin Image

Deploy - Apps, Windows updates from internet, Customisations - 1h 00m 17s

You can see for yourself from the times above, thick images put a lot of time into creating the image and deployment is fast, where as the thin image is a longer process to deploy but there is no creation phase making thin images more agile. But this isn’t so say that you can’t combine both methods.

When To Use Thick/Thin

Each of the image types is suited to different situations. For example, if you are deploying a large batch of computers all at once for a classroom, then it would be best to build a thick image on a virtual machine with everything installed and configured as needed and then deploy to the devices.

However, if you are deploying devices in smaller batches over a longer period of time, then the thin image makes more sense because the thick image will be out-of-date and the time needed to install Windows updates and application updates will make the process longer and any time savings that you made from creating a thick image in the first place will be negligible.

Why Not Both?

You can use a combination of both methods if needed. For example if you are using a older version of Adobe’s Creative Suite - a large install that doesn’t get updates these days, then rather than deploy a thin image and install this for each device you could create a Windows images with this and any other large applications that don’t get updates or the updates are quick to install further downstream.

Another way to use both is to have a thick image for large deployments and then a thin image for the devices that trickle in. The downside of this is that you have more to maintain, potentially a “Build” task sequence, “Deploy” task sequence and a “Deploy-Thin” task sequence and everything that comes with it.

Ultimately the choice is yours - you make the best decision you can for your environment, workflow and team. But at least you have choice.

If you have any questions or comments, please leave them below.

-Mike

Using Winget and Chocolatey with MDT

Sun, 23 Oct 2022 08:00:00 +0100

Windows Package Managers

Microsoft has created winget and Chocolatey is a third-party package manager for Windows. I like both for a variety of reasons and have been testing them out as a way to modernize the install software whilst still using Microsoft Deployment Toolkit (MDT).

Using a package manager during initial deployment or image creation can be useful for deploying applications that are updated frequently like Adobe Reader or Google Chrome. It’s also easier for you as the image admin. Instead of downloading the offline installer, finding the silent install command and then going through the steps of adding it to MDT, you can use a package manager to retrieve the application, install it and you’re done. You could also set up a scheduled task to run regularly to keep third-party software up-to-date when the PC is deployed out in the field.

Winget

Winget is Microsoft’s package manager for Windows 10 and 11. It is not a functional part of Windows 10 or 11 version 21H2 or 22H2 after the initial OS install - the Microsoft Store app updater needs to run and make it available for use. Even if you download the winget package from github and install it via PowerShell, the Microsoft Store will still need to run and sync for it to work - take it from me I have spent this past week testing this out thoroughly.

Winget is good and I’d recommend it but some bugs when installing certain packages still remain - for example at the time of writing the Ubisoft.Connect package won’t install even though it did a few weeks ago when I last installed it. Weird. That said, for most common packages that you’d install in a business environment it works well.

Installing and Using winget

In order to use winget as part of a Task Sequence I’ve made a small PowerShell script to trigger the Microsoft Store updater and wait until winget is the correct version before exiting. Then the Task Sequence can continue and use winget to install any applications that you want with the additional benefit that the Microsoft Store apps are also now up to date.

Please note: because we must run the Microsoft Store sysprep will be impossible. Because of this I do not recommend using winget if you are building a “golden” or “thick” image. If you intend on running sysprep you should use Chocolatey instead.

## Run the MS Store update and wait until winget is installed

$OSVBui = [environment]::OSVersion.Version | Select-Object -expand build
$wmiObj = Get-WmiObject -Namespace "root\cimv2\mdm\dmmap" -Class "MDM_EnterpriseModernAppManagement_AppManagement01"

## Windows 10 22H2
If ($OSVBui -eq "19045")
{
    Do {
        $updateTrigger = $wmiObj.UpdateScanMethod()
        start-sleep -S 60
    } until (Get-appxprovisionedpackage -online | where-object {$_.packagename -like 'Microsoft.DesktopAppInstaller*'} | where-object {$_.version -notlike "2019.125.2243.0"})
}

## Windows 11 22H2
If ($OSVBui -eq "22621")
{
    Do {
        $updateTrigger = $wmiObj.UpdateScanMethod()
        start-sleep -S 60
    } until (Get-appxprovisionedpackage -online | where-object {$_.packagename -like 'Microsoft.DesktopAppInstaller*'} | where-object {$_.version -notlike "2022.310.2333.0"})
}

To run the PowerShell script above as part of a Task Sequence and have it wait until it completes (in my extensive testing MDT doesn’t wait for the “do until” block to complete) we must create a small batch file containing the command below and then add this to the Task Sequence.

`1`	`start /wait powershell -ep bypass -WindowStyle hidden Z:\_custom\winget\update-store.ps1`

Once winget is installed and usable, we can use winget’s import function to install a list of applications. Below is the command that I use to install all my applications which is are in JSON file that I exported from winget on another system.

`1`	`winget import %DEPLOYROOT%\_custom\winget\apps-winget.json --accept-package-agreements --accept-source-agreements`

You can also make a batch or PowerShell script that contains a list of winget install commands for each application.

winget install -e --id Microsoft.VCRedist.2015+.x64 --accept-package-agreements --accept-source-agreements
winget install -e --id Microsoft.DotNet.DesktopRuntime.6 --accept-package-agreements --accept-source-agreements
winget install -e --id 7zip.7zip --accept-package-agreements --accept-source-agreements
winget install -e --id VideoLAN.VLC --accept-package-agreements --accept-source-agreements
winget install -e --id Adobe.Acrobat.Reader.64-bit --accept-package-agreements --accept-source-agreements
winget install -e --id Notepad++.Notepad++ --accept-package-agreements --accept-source-agreements
winget install -e --id Google.Chrome --accept-package-agreements --accept-source-agreements
winget install -e --id Mozilla.Firefox --accept-package-agreements --accept-source-agreements

To see if winget has an application in it’s repository you can use the search command

`1`	`winget search "firefox"`

For more information on winget commands please see Microsoft’s documentation pages.

Updating with Winget

Winget can be scheduled to update installed software using a Scheduled Task. Due to how winget works you should check first on a test system to see what it will update just in case you have an app installed that you don’t want updated for whatever reason.

You can check to see what will be updated with the following command:

`1`	`winget upgrade`

The command below will update all the software it supports. The --silent switch in this context means that the UI will in some cases still show but it is just progress and the upgrades are automated.

`1`	`winget upgrade --all --silent`

Chocolatey

Chocolatey is a third-party Windows package manger and can be easily installed. Chocolatey is free but has a Business/Pro version that syncs with the “Programs and Features” list in Windows. The free version can be used to install and update software that was installed by Chocolatey but it will not touch software that it didn’t install.

Installing and Using Chocolatey

As per the instructions on the website Chocolatey can be installed using a PowerShell one liner:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

Here is the PowerShell script that I use to install Chocolatey and also the list of software I require.

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
choco feature enable -n allowGlobalConfirmation
choco install vcredist140
choco install dotnet-6.0-desktopruntime
choco install 7zip
choco install vlc
choco install adobereader
choco install notepadplusplus
choco install googlechrome
choco install firefox

To find out if Chocolatey has an application in it’s repository and the command to install it, please see the Chocolatey Package site.

Updating with Chocolatey

Chocolatey can be scheduled to update installed software using a Scheduled Task. Like with winget you should check first on a test system to see what it will update just in case you have an app installed that you don’t want updated.

You can check to see what will be updated with the following command:

`1`	`choco outdated`

The command below will update all the software it supports silently.

`1`	`choco upgrade all`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 10 22H2 Reference Image

Thu, 20 Oct 2022 00:10:28 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
We must use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 10 works with this older ADK and WinPE.

In this guide we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 10 22H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Extract the files from the self-extracting archive and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files. If you have existing shares you will need to copy the files from the update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W10-22H2
Name it Deploy Windows 10 22H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below are a bare minimum configuration from my lab, and you may want to add more to overtime.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

The settings below deserve some explanation. The [Virtual Machine] section is regarding driver installs which we’ll cover more later in this post. The Join Domain section is important. Here I’ve put the mdt_admin account to use as the account to join the device being imaged to the domain contoso.com. If you are following this guide to the letter, the mdt_admin account would not have the appropriate permissions to join a device to a domain, and so you should either give it the permissions required or create a new account for that specific purpose.

The other settings are location preferences relevant to the UK and resolution settings which prevent the finished device from defaulting to a resolution of 1024 x 768, and instead use the recommended resolution Windows receives from the display.

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO, so it will be LiteTouchPE_x64-deploy.iso. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64-deploy.iso into the deployment environment, you will be presented with a login screen and here you should login with the Active Directory credentials that have access to the Deployment Share. Once logged in you will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next. You’ll be prompted to enter a name for the device, it will also be added to Active Directory under this name. Click Next and the task sequence will begin.

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 10 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 10 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 10 22H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

Now we’re going to configure how drivers are installed for the physical devices we’re going to deploy Windows 10 to. There are a few ways to do this, here I’ll show the ‘Total Control’ method I’ve been using more recently. Note: I’ve written a guide on how to use Snappy Driver Installer Origin with MDT. Using the guide you can run the tool as part of a deployment Task Sequence and it will obtain and install the drivers automatically provided you have internet access.

The first thing you’ll need is the manufacturer and model numbers for all the devices you want to roll out the image to. You can find this out by booting a device in to its current version of Windows or the WinPE deployment environment using the LiteTouch_x64.iso boot disc or PXE booting. Here’s a previous post I wrote on how to setup PXE booting for MDT if needed: PXE Booting for Microsoft Deployment Toolkit

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

The output of the commands is the manufacturer name and model number you’ll need. The next thing you’ll need is the drivers. Windows 10 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Most large manufacturers (Dell, HP, Lenovo) do a decent job of providing drivers that can be used with MDT. Should you have difficulty with them you can use the Microsoft Update Catalog to search for and download the specific drivers that Windows Update installs and use them with MDT. Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

If you have many different manufacturers and models then this process can be quite tedious. I’ve created a PowerShell script to automate the process, it’s on my GitHub here. It requires some documentation which I will provide in a separate post.

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 10 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 10 22H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 10 22H2 which is ready to deploy.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 10 22H2 Reference Image

Thu, 20 Oct 2022 00:10:12 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
We must use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 10 works with this older ADK and WinPE.

In this guide we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 10 22H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with.

Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 10 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 10 22H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 10 22H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 10 22H2 and complete the wizard
Go to the Operating Systems > Windows 10 22H2 node and rename the new entries added to Windows 10 22H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 10 22H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 10 22H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 10 22H2
On the Folders page, tick the Windows 10 22H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application. It is also possible to use a package manager to grab applications from the internet and silently install them. I’ve written a guide on how to use Chocolatey to do this. Using the guide you can install Chocolatey and then use it to install applications as part of a Task Sequence, provided you have internet access.

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

To add other software, you’ll need to repeat the steps above, with the relevant Command line to silently install them. Below are a few command lines for some software I frequently install silently, along with the links to the ‘offline’ installers.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W10-22H2
Name it Build Windows 10 22H2
Select Standard Client Task Sequence
Select the Operating System Windows 10 22H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 10 22H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab or closed development environments.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 10 22H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W10-22H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 10 22H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article: Deploy Windows 10 22H2 Reference Image.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

MDT Setup - A script to make MDT deployment easy

Tue, 18 Oct 2022 22:01:00 +0100

User configurable MDT setup script

MDT-Setup is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

-Mike

Features and Requirements

Designed to be run on Windows Server 2016+
The script must be run as an administrator.
Tested with Windows PowerShell 5 (The version of PowerShell included with Windows Server 2016+) and PowerShell 7.
Tested on Windows Server 2022.

Usage Information

This script will install and configure Microsoft Deployment Toolkit and its prerequisites on a Windows computer with an internet connection. It has been tested on a basic Windows Server 2022 Standard edition virtual machine.

Here is what the script will do:

Download the installers for Microsoft Deployment Toolkit, the latest MDT patch, the latest ADK and WinPE for ADK.
Silently install all the above.
Create an MDT deployment share(s) and the folder structure.
Download Windows 10/11 from the Media Creation Tool (this requires some user input).
Convert the Windows 10/11 install ESD to a WIM file for MDT and import it.
Create Package folders and Selection Profiles for Windows 10/11.
Import Task Sequence templates.
Set the configuration of CustomSettings.ini for the share(s).
Generate the boot media.
Create Package and Driver folders and Selection Profiles.

When complete the server will be configured to be able to deploy a Windows 10/11 image. There is an option to create a “Build and Capture” environment to create a gold image for Windows 10/11. Once captured the image can then be imported into the Deployment share and create a Task Sequence using the template included.

Some user interaction is still required. For example: importing drivers, adding applications and other things specific to the images you want to deploy.

User Preferences

When you run the script it will ask you a series of questions to customise your installation.

Windows version and update code (e.g. W10-22H2)
Download and convert Windows ESD, edition, language
Optional Build share path (e.g. C:\BuildShare)
Optional Build share name (e.g. BuildShare$)
Deploy share path (e.g. C:\DeployShare)
Deploy share name (e.g. DeployShare$)
Time zone name for the deployed image (e.g. GMT Standard Time)
Keyboard locale code for the deployed image (e.g. 0809:00000809) Please see Microsoft Docs for all the input locales
Keyboard locale name for the deployed image (e.g. en-GB)
Windows UI language for the deployed image (e.g. en-GB)
Windows user language for the deployed image (e.g. en-GB)
Domain group for MDT Admins (e.g. mdt-admins)
Domain user for domain join (e.g. djoin)
Domain password for above user (e.g. p@ssw0rD)
Domain name for above user (e.g. contoso.com)
OU for new PC account (e.g. OU=PCs,DC=contoso,DC=com)
WSUS server name and port (e.g. WSUS-Srv:8530)

How to use

Create a folder on a local disk and put the script inside it.

Run From PowerShell:

`1`	`[path to script]\MDT-Setup.ps1`

This will run the script, user interaction is required to continue.

Change Log

2023-12-04: Version 23.12.04

Added option to create a single deployment share for those who do not want to build a gold image.
Updated Windows 11 Media Creation Tool link to get version 23H2.

2023-08-04: Version 23.08.04

Fixed an issue with the device path of a mounted ISO file being hardcoded. It is now dynamic.

2023-07-02: Version 23.07.02

The latest version of the Windows ADK and Win PE ADK add-on are now installed. Please note that x86 boot media is now not available due to the new ADK not supporting the architecture.
Added fixes for the latest version of Windows ADK from: metisit.com

2023-06-23: Version 23.06.23

Fixed an issue where the Windows ISO file name was hard coded.
Reordered the process so all the user interaction is done up front. When user interaction is complete, you will be told to go make coffee.
Cleaned up the output to be more readable.

2022-12-02: Version 22.12.02

Added text notification when there is no update available.

2022-11-29: Version 22.11.29

Added option to check for updates to the script.
Fixed permissions not being set on the build and deployment shares.
Script now asks for a domain group to be used for MDT Administrators.

2022-10-18: Version 22.10.18

Added support for Windows 10 22H2

2022-09-20: Version 22.09.20

Removed option to enter a key to download Windows as it isn’t really needed. The provided generic key works just fine.
Removed option to choose the edition of Windows as it will become the version that the user is licensed for when activation occurs.

2022-08-16: Version 22.08.16

Added support for Windows 11
Streamlined some locale options so the user isn’t prompted so much for the same information.

2022-07-26: Version 22.07.26

Initial release

Restore The Legacy Context Menu in Windows 11

Thu, 22 Sep 2022 17:20:28 +0100

Updated: 2024-08-08 This method still works.

Windows 11 introduces a new more cohesive UI design but one of the casualties is the right-click or context menu in File Explorer and on the Desktop. You can still access the legacy Windows 10 style menu by clicking on “Show more options” or by using the shortcut key Shift + F10, but if you just want the old menu back by default, you just need to create a new registry key.

Copy and paste one of the commands below into a command prompt or a powershell console and after a reboot the old menu will be the default after a restart.

These commands create a new default key at the path specified.

`1`	`reg add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve`

`1`	`New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" -Name 'InprocServer32' -Force`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 11 22H2 Reference Image

Wed, 21 Sep 2022 16:48:14 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
Even though there is no x86 version of Windows 11 we must still use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 11 works with this older ADK and WinPE.

In this guide we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 11 22H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-22H2
Name it Deploy Windows 11 22H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 11 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 11 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 11 22H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

Now we’re going to configure how drivers are installed for the physical devices we’re going to deploy Windows 11 to. There are a few ways to do this, here I’ll show the ‘Total Control’ method I’ve been using more recently. Note: I’ve written a guide on how to use Snappy Driver Installer Origin with MDT. Using the guide you can run the tool as part of a deployment Task Sequence and it will obtain and install the drivers automatically provided you have internet access.

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

The output of the commands is the manufacturer name and model number you’ll need. The next thing you’ll need is the drivers. Windows 11 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 11 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 11 22H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 11 22H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 11 22H2 Reference Image

Wed, 21 Sep 2022 16:25:50 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
Even though there is no x86 version of Windows 11 we must still use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 11 works with this older ADK and WinPE.

In this guide we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 11 22H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with.

Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 11 22H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 11 22H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 11 22H2 and complete the wizard
Go to the Operating Systems > Windows 11 22H2 node and rename the new entries added to Windows 11 22H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 11 22H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 11 22H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 11 22H2
On the Folders page, tick the Windows 11 22H2 folder under Packages and complete the wizard

Importing Applications

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-22H2
Name it Build Windows 11 22H2
Select Standard Client Task Sequence
Select the Operating System Windows 11 22H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 11 22H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 11 22H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W11-22H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 11 22H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article: Deploy Windows 11 22H2 Reference Image.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Installing Microsoft Store Apps

Tue, 09 Aug 2022 14:19:16 +0100

Getting Started

We’re going to install “HEVC Video Extensions from Device Manufacturer” (yes, that’s the name of it) and “HEIF Image Extensions”. Both these apps are free and useful to add to a Windows deployment as they will allow newer image and video formats to be viewed.

Obtain the AppX Packages

Google both the “HEVC Video Extensions from Device Manufacturer” and “HEIF Image Extensions” and copy the URLs from the web version of the Microsoft Store.

We’re going to use a third party site to download the required files, go to https://store.rg-adguard.net and enter the URL for one of the apps.

Download the .appx and .blockmap files for the app. There is no need to download all versions or the .eappx files, just the .appx and the .blockmap files.

Repeat the process for the other app.

Installing An AppX

Run this Powershell command to install the app for all users:

`1`	`Add-ProvisionedAppxPackage -Online -PackagePath "$PathToFiles\AppX-ToAdd\Name-Of-The-App.Appx" -SkipLicense`

The app will now be installed for all users.

Final Thoughts

The -SkipLicense option is used because these are free apps with no license xml file. I presume (but haven’t tested yet) that for paid apps if you can obtain the appx file and extract the license file from an existing installation and then run the Add-ProvisionedAppxPackage command and specify the license file.

For MDT users who want to deploy AppX’s as part of a Task Sequence, I’d recommend putting this near the end of a Task Sequence and having the App files in a folder on the MDT server like any other application.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Using Snappy Driver Installer Origin with MDT

Fri, 05 Aug 2022 00:24:28 +0100

Snappy Driver Installer Origin

Snappy Driver Installer Origin is a great utility for finding and installing or updating drivers. You can find out more about Snappy Driver Installer Origin and download it here.

Why SDIO and not Windows Update

Snappy Driver Installer Origin (SDIO) supports automation and running scripts and so I thought it would be perfect for use with MDT when deploying lots of different types of devices with various drivers. If you have large fleets of the same types of PC/Laptop then using MDT to deploy those drivers from a central store is still best in my opinion.

Windows Update is “fine” at getting most drivers but still misses some or gets very old versions, SDIO gets up to date and in a lot of cases better drivers than Windows update.

Requirements

To use SDIO with MDT using my script, SDIO must be present on the MDT server somewhere (e.g. Applications) and then copied to the local disk of the device (e.g. C:\scripts) before running SDIO-Auto-Install.ps1.

The device must have internet access to get the required drivers and also the storage and network drivers which is a requirement of deploying an OS across the network with MDT.

SDIO-Auto-Install - PowerShell Script To Run SDIO

Below is my script for running SDIO. The script file itself is copied to the local disk along with SDIO and then the Task Sequence runs the script after OS deployment.

A Windows Firewall rule is created to allow SDIO to connect to the internet, SDIO itself is run to update the indexes and then after a 10 second wait period it is run again to install the drivers. There’s probably a better way to do this but this works for now. The firewall rule is then removed

New-NetFirewallRule -DisplayName "SDIO-Drivers" -Enabled True -Direction Outbound -Profile Any -Action Allow -Program "C:\scripts\SDIO\SDIO_x64_R746.exe" | Out-Null

cd C:\scripts\SDIO
.\SDIO_x64_R746.exe /script:C:\scripts\SDIO\update-install.txt
Start-Sleep -Seconds 10
.\SDIO_x64_R746.exe /script:C:\scripts\SDIO\update-install.txt

Get-NetFirewallRule -DisplayName "SDIO-Drivers" | Remove-NetFirewallRule

SDIO Script To Get Drivers

Below is my script for SDIO to run. I’m still very new to it so I’ve copied one of the example scripts and made it work for me. The verbose option prints a lot of information (which MDT will output to a log) which can be useful for troubleshooting. The script is pretty self explanatory.

verbose 384
enableinstall on
keeptempfiles off
init

checkupdates
onerror goto :end
get indexes
select missing newer better
install
onerror goto :end
:end
end

Finishing up

I’ve tested this on a few random devices that I currently have access to and it runs well, it will likely require some customisation for other environments.

I’ve put the script files above on my general MDT Files GitHub

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Office Update Utility - Update 22.07.30

Sun, 31 Jul 2022 16:06:07 +0100

Version 22.07.30

Changes:

Changed how the removal of old update files is done. Old versions will be removed regardless, -Days option has been removed.

Office Update Utility is available from:

For full change log and more information, visit my site.

Support My Work

PayPal

If you have any questions or comments, please leave them below.

-Mike

PowerShell Utilities Update

Tue, 14 Jun 2022 22:07:39 +0100

The following Utilities have all received major updates:

Hyper-V Backup Utility

Image Factory Utility

Internet Access Control Utility

Log Manager Utility

Logon Audit Utility

Office Update Utility

On-Prem AD User Creator Utility

Remove MS Store Apps Utility

WSUS Maintenance Utility

Changes

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

Specific changes and fixes are listed on the specific page for the Utility.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.04.26

Mon, 25 Apr 2022 23:48:09 +0100

Version 22.04.26

Changes:

Added -PCApps switch to list all MS Store apps on the system.
Added -UserApps switch to list all MS Store apps installed for the user.
Added -Help to give usage instructions in the terminal. Also running the script with no options will also trigger the -help switch.
Streamlined config report so non configured options are not shown.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.04.22

Sat, 23 Apr 2022 00:15:12 +0100

Version 22.04.22

Changes:

If the -WimMountPath is not configured by the user then the default Windows temp folder will be used instead.
If the -WimMountPath is configured by the user but the path does not exist, it will be created.
Added a -LogRotate option to delete logs older than X number of days.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.03.27

Sun, 27 Mar 2022 03:50:31 +0100

Version 22.03.27

Small update, the utility now ignores blanks lines in Apps list file.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 22.03.26

Sun, 27 Mar 2022 03:13:28 +0100

Version 22.03.26

Made a small fix to the ‘NoPerms’ function: The VM will be left in the state it was found. For example, when a VM is found in an offline state, the script will not start the VM once the backup is complete. In the previous version the VM would be started regardless of what state it was in previously.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploying Microsoft Office with MDT

Fri, 25 Mar 2022 00:53:53 +0000

Before You Start

The modern Microsoft Office suite is now only available as a ‘Click-to-Run’ installation, which changes how the installation package is obtained, configured and deployed.

These are the resources we’ll be using in this guide.

Creating a Config File

Configuration of the Office suite is now done via an XML file. You can generate one by using the Microsoft 365 Apps admin center. Simply go to the site and click on the “Create a new configuration” button.

Under “Products and releases” choose what architecture and Office Suite you require, how often you want Office to update - I recommend the “Monthly Enterprise Channel”, and which apps to include or exclude.
For “Language” either choose specific languages or “Match Operating System”.
Under “Installation options” you should choose “Local source” and enter the “Source path” of: Z:\Applications\[Your-Office-Install] as this will be where the files are stored in MDT. Z:\ is automatically mapped to %deployroot% during an MDT Task Sequence.
For the “Update and upgrade” options this will depend on whether you plan on Office updating from the internet on the systems once it is deployed, or if you want to have a central Office update on the local network (maybe using my Office Update Utility), or if you are using Config Manager.
For the Upgrade options, these can be disabled as we will be installing office as part of a clean build of Windows.
Under “Licensing and activation” you will need to set “Automatically accept the EULA” to enabled, set any product keys if required and choose what type of activation you need.
For “General” provide your Company name and a description for this config file. I tend to use a brief list of the config choices for future reference.
Under “Application preferences” you can set any specific preferences that you require.
When you are happy with your config file, click “Export” and you will be prompted to choose the “Default File Format”. I generally choose the “Office Open XML formats”.
Finally, accept the terms in the license agreement, enter a file name and download the file.

Downloading the Office installation files

First download and extract the Office Deploy Tool (ODT) from Microsoft to a new folder. The included example XML files can be deleted.
Put your XML config file in the same folder as the Office Deploy Tool.
Make a copy of your XML config file and edit one of them.
Edit the “SourcePath” near the top of the file to point to a location on your local drive, for example: SourcePath="C:\Users\sysadmin\Downloads\ODT" and then save it.
Open a command prompt and change directory to the folder that contains the Office Deploy Tool and your config XML file.
Run the following command to download the Office files: setup.exe /download [your-edited-config.xml]
A new folder called “Office” will be created and the installation files will be stored there.

Importing the Office installation files into MDT

Copy the entire folder containing the Office Deploy Tool, your config files and the Office folder to your MDT Applications folder.
Rename the folder so it matches what you entered for the Source path when you created the config file on the Microsoft 365 Apps admin center website.
Go to the MDT Deployment Workbench and open “Applications”.
Right-click on “Applications” and click “New Application”.
Choose “Application without source files or elsewhere on the network” and click Next.
Enter an Application name and click Next.
For the “Command line:” enter the following: setup.exe /configure [your-config.xml]
For the “Working directory:” enter the following: .\Applications\[Your-Office-Install] and then click Next.
Finally on the summary screen click Next and then Finish.

After importing the installation files you will now be able to install Office as part of a Windows deployment Task Sequence like any other application.

Group Policy ADMX Files for Office

The ADMX files for Office are backwards compatible with previous versions of Office back to Office 2016 and they can be downloaded here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

MDT User Permissions

Wed, 09 Mar 2022 05:28:45 +0000

Before You Start

In my previous MDT guides I’ve always assumed that the users doing the imaging are also admins of the MDT server, or even domain admins. In this brief guide I’ll outline the permissions needed for a regular, non-admin user to deploy a computer using MDT.

First we’ll need to create a group for the users who will be doing deployments. We’ll call the group “MDT-Users”.

We’ll now add the group to the ACL for the MDT Deployment share permissions. The group will need full access but we’ll lock down the permissions on the files and folders ACL.

Right-click on the Deployment share folder and select “Properties”
Click on the “Sharing” tab
Click on “Advanced Sharing”
Tick the box “Share this folder”
Click on the “Permissions” button
Click on the “Add” button and type in “MDT-Users” and click on “OK”
Check the “Allow” tick box for “Full Control” in the Permissions list
Click OK on all the permissions windows that are open for the changes to be made.

Setting the File Permissions

Next we’ll set the following permissions in the root of the Deployment share folder.

Right-click on the Deployment share folder and select “Properties”
Click on the “Security” tab
Click on the “Advanced” button
Add “MDT-Users” and ensure that the group only has “Read & execute” permissions.
Click OK on all the permissions windows that are open for the changes to be made.

Setting File Permissions for Deployment Logs

If you have logs configured, you’ll need to set the following permissions on the “Logs” folder.

Right-click on the Logs folder and select “Properties”
Click on the “Security” tab
Click on the “Advanced” button
Click on “Disable inheritance” and then click on “Convert inherited permissions into explicit permissions on the object”
Add or ensure that “MDT-Users” has “Modify” permissions.
Click OK on all the permissions windows that are open for the changes to be made.

Setting Permissions for Domain Join

To add the deployed computer to Active Directory, a user account with the appropriate permissions can be configured in the CustomSettings.ini.

Here is an example.

; Join Domain Account
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

To give the “mdt_admin” user the required permissions, I’d recommended creating a group also called “MDT-Admins” and then giving that group the following permissions in Active Directory.

In Active Directory Users and Computers, click on the “View” Menu and then click on the “Advanced Features” option.
Now go to the OU where the PC accounts are created and right-click on the OU and select “Properties”.
In the new windows, click on the “Security” tab, then the “Advanced” button and then click the “Add” button.
Next click on the “Select a principal” text and type the “MDT-Admins” group and then click OK.
In the “Permissions:” section check “Create Computer Object” and “Delete Computer Object” and then click on OK.
Once again, click on the “Add” button and then on the “Select a principal” text and type the “MDT-Admins” group and then click OK.
Now click on the “Applies to” menu and change it to “Descendant Computer Objects”.
In the “Permissions:” section check the following:
- Read All Properties
- Write All Properties
- Read Permissions
- Modify Permissions
- Change Password
- Reset Password
- Validate Write to DNS hostname
- Validate Write to Service Principal Name
Finally, click OK on all the permissions windows that are open for the changes to be made.

With these permissions any member of the “MDT-Admins” group will be able to join a computer to Active Directory and create a computer account in the OU that these permissions are made to.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 22.02.08

Wed, 09 Feb 2022 00:30:30 +0000

Version 22.02.08

Added fix for potential BSOD on Windows Server 2016 Hyper-V host when exporting VMs using VSS. The change to the registry will only happen if Windows Server 2016 is detected as the Hyper-V host and only if the registry value is in the default state. If it has been configured previously no change will be made. Issue #17 on GitHub

Thanks to the person who opened the issue on GitHub.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 22.01.19

Thu, 20 Jan 2022 13:27:36 +0000

Flexible Hyper-V Backup Utility

This update has substantial under-the-hood changes which may extend the length of time required to backup if you are using the -NoPerms. This is due to the addition of a check for the VM to be in a desired state of ‘off’ and with a status of ‘Operating normally’. In short if a VM is merging disks after a shutdown the script will now wait until that is complete before continuing. This is due to ‘merging disks’ being a ‘status’ flag and not a ‘state’ flag in Hyper-V.

Additional checks have been put in place to ensure that a backup has succeeded before continuing with any removal of old files. If an error is encountered the utility will move on to the next VM.

Finally, when using a VMs list file if there were empty lines the utility would attempted to backup a VM with nothing as the name. This could also lead to entire directories being deleted in error. The list file is now “cleaned” of empty lines on load. With this change and the above changes data loss should be less likely now. This utility is supposed to save data not remove it. :)

Many thanks to people who opened issues in GitHub and helped me make this tool more robust.

2022-01-20: Version 22.01.19

Added additional checks for success or failure in the backup, copy/compression process. If it fails none of the previous backups should be removed.
When using -NoPerms the utility now waits for disk merging to complete before backing up.
Utility now ignores blank lines in VM list file.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

File Admin Permissions

Mon, 10 Jan 2022 12:41:46 +0000

Problem

When browsing files and folders on your file servers as an admin, you receive “You don’t currently have permission to access this folder. Click Continue to permanently get access to this folder.”, even though you should have access and are a member of the “Administrators” or “Domain Admins” group. When clicking “Continue” you are given access, but your user account is added to the permissions list. With many accounts this can make a mess of permissions.

Solution

The best thing I’ve found is to make a group for “File Server Admins”, add the required user accounts and then add the group to the permissions list for the required folders/files and give it the required permissions.

You could also launch Windows Explorer as administrator if you just need a quick and dirty work around.

Why this happens

The problem is related to User Account Control (UAC), explorer.exe and using built-in groups such as “Administrators” or “Domain Admins”. Microsoft has a good write up on the problem, here.

This still comes up from time to time and I always have to go looking through my notes. Hopefully this quick post helps you out. :)

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

User Home Permissions

Fri, 07 Jan 2022 15:51:12 +0000

Before You Start

By default, Windows Server does a decent job these days of setting up secure permissions for user home directories but only if you use the various wizards that are built-in to the server manager. Sometimes you just want to create some directories and shares and have them good to go. I mean how hard can it be right?

First things first, create a folder that will be the User Home root, we’ll set the permissions and share permissions on this folder. For the purposes of this article, we’ll be using “X:\User-Homes” as the root.

Right-click on the User-Homes folder and select “Properties”
Click on the “Sharing” tab
Click on “Advanced Sharing”
Tick the box “Share this folder”
Click on the “Permissions” button
Remove “Everyone” from the list of Group or usernames
Click on the “Add” button and type in “Domain Users” and click on “OK”
Check the “Allow” tick box for “Full Control” in the Permissions list
Click OK on all the permissions windows that are open for the changes to be made.

Share permissions are not as granular as file permissions, so it’s best to set “Full Control” for all “Domain Users” to minimize future problems and help with troubleshooting. Using “Everyone” is too open as the share is essentially wide open to unauthenticated users.

Setting the File Permissions

Right-click on the User-Homes folder and select “Properties”
Click on the “Security” tab
Click on the “Advanced” button
Click on “Disable inheritance” and then click on “Convert inherited permissions into explicit permissions on the object”
Add or ensure that “CREATOR OWNER” has “Full Control” and “Subfolders and files only” is in the “Applies to” column
Add “Domain Users” and set the “Applies to:” drop down to “This folder only”
Click on “Show advanced permissions” and tick the box “Create folders / append data”
Click OK on all the permissions windows that are open for the changes to be made.

This will set the permissions on the folder so that a user will be able to create their own home folder. If you use Folder Redirection in Group Policy, the users home folder will be automatically created when the user first logs on. Manually setting the home directory and drive letter in Active Directory will also create a home folder and set the permissions automatically.

Administration Access

If you follow the steps above no-one except the owner will be able to access each user’s home folder, not even admins. It is often desirable for admins to be able to access user data on a file server. Follow the steps below to add a given user or group full access to user homes.

Right-click on the User-Homes folder and select “Properties”
Click on the “Security” tab
Click on the “Advanced” button
Click the “Change” text next to the “Owner:” information
Add the user or group you wish to give full access to and click on OK
Tick the box “Replace owner on sub containers and objects” and then click on Apply
A dialogue box will pop up saying “If you have just taken ownership of this object, you will need to close and reopen this object’s properties before you can view or change permissions.” Click “OK” on it and all open permission windows.
Go back to the “Advanced” permission window using steps 1 - 3
Click on “Add” and then “Select a principal” and enter the user or group you wish to give Full Access
Ensure that the “Applies to:” drop down is set to “This folder subfolders and files”
Tick the “Full control” box under “Basic permissions:” and then click on OK
Click on “Apply” to apply to permissions and the user or group you specified will have complete access to.

Fixing Permissions with Existing User Homes

All the above is great if you’re creating a new user home share, but what if you have an existing one with hundreds/thousands of users and you want to reset the permissions? Well, that’s where a script can come in handy.

You can download my script from GitHub. You’ll need to configure the location of your user homes; I’m also assuming that the user home folders are named after the sam account name of the user. The script will go through each folder it finds in the root of the user home location and take ownership of the files, reset the permissions to the inherited permissions from the root folder and then give the user full access to the folder.

The script is not guaranteed to be perfect for everyone’s environment so I would recommend taking a look and seeing if it fits your needs.

Also, one last thing, although the script is a PowerShell script you’ll noticed that I’m still using the old takeown.exe and icacls.exe utility. This is simply because they are easy to use and the built in PowerShell commands Get-ACL and Set-ACL aren’t as easy to use as these old utilities. There are other third-party modules out there but the old utilities work and this shouldn’t be something you need to do a lot.

I hope this helps and thanks for reading.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Better Windows Updates For Everyone

Tue, 14 Dec 2021 01:49:09 +0000

In this post I’m going to show how to quickly configure Windows Updates so that you only receive important security updates. We’ll cover Home and Pro/Enterprise users of both Windows 10 and Windows 11.

These are also the settings I use myself and recommend for most users.

These settings may also be helpful for IT admins.

Set Active Hours - Windows 10

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then Update & Security > Change active hours.

Turn off the setting Automatically adjust active hours... and click on Change next to Current active hours

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Set Active Hours - Windows 11

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then go to Windows Update > Advanced Options > Active Hours

Change the Adjust active hours setting from Automatically to Manually.

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Registry Settings - Windows 10 Home

If you are running Windows 10 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 10 Pro/Enterprise

With Windows 10 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows update for Business
Select Manage preview builds and set it to Enabled and change the drop down menu to Disable preview builds
Select Select when Preview Builds and Feature Updates are received and set it to Enabled
Change the drop down menu to Semi-Annual Channel and then for After a Preview Build or Feature Update is released, defer receiving it for this many days enter 365.
Select Select when Quality Updates are received and set it to Enabled
For After a Quality updates is released, defer receiving it for this many days enter 5.

Registry Settings - Windows 11 Home

If you are running Windows 11 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 11 Pro/Enterprise

With Windows 11 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update
Select Select when Preview Builds and Feature Updates are received and set it to Enabled and then for How many days after a Feature Update is released... enter 365.
Next, select Select when Quality Updates are received and set it to Enabled and then for After a quality update is released.. enter 5.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Image Factory Utility - Update 21.12.02

Thu, 02 Dec 2021 16:17:17 +0000

Automate Creation of WIM Files

This is the initial release of a new version of my Image Factory Utility with support for Oracle Virtual Box. I’ve tested it myself, but there may be issues on other setups, so I’d be interested in hearing if anyone has problems when using Virtual Box.

2021-12-02: Version 21.12.01

Added option to use Oracle Virtual Box instead of Hyper-V.
Configured logs path now is created, if it does not exist.
Added OS version info.
Added an option to specify the Port for SMTP communication.

Image Factory Utility can be downloaded from:

See the full documentation available here.

Support My Work

Please consider supporting my work:

Support with a one-time payment using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 10 21H2 Reference Image

Mon, 22 Nov 2021 17:31:00 +0000

News and Updates

An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here.

In this article as with my previous ones we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 10 21H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W10-21H2
Name it Deploy Windows 10 21H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE\_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps
Set the Default apps and any other file associations as required
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 10 21H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\_custom\AppAssoc.xml
Click Apply to save the changes

Driver Management

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 10 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 10 21h2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 10 21H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 10 21H2 Reference Image

Mon, 22 Nov 2021 17:30:53 +0000

News and Updates

An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 10 21H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with. Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 10 21H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 10 21H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 10 21H2 and complete the wizard
Go to the Operating Systems > Windows 10 21H2 node and rename the new entries added to Windows 10 21H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 10 21H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 10 21H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 10 21H2
On the Folders page, tick the Windows 10 21H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W10-21H2
Name it Build Windows 10 21H2
Select Standard Client Task Sequence
Select the Operating System Windows 10 21H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 10 21H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs.
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 10 21H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W10-21H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 10 21H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 11 21H2 Reference Image

Mon, 22 Nov 2021 16:05:13 +0000

News and Updates

An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress

Installing the MDT Update: MDT_KB4564442

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Deploy Windows 11 21H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 11 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 11 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 11 21H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 11 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 11 21H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 11 21H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Installing Remote Server Administration Tools (RSAT) for Windows 10/Windows 11

Wed, 13 Oct 2021 17:56:52 +0100

In this guide we’ll go through how to quickly add all of them using PowerShell and where they are in the GUI.

Installing RSAT the quickest and easiest way using PowerShell

Run the following command in an elevated PowerShell session.

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Installing RSAT using the GUI in Windows 11

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then “Optional Features”.
On the “Add an optional feature” section, click “View features”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
In the new window click the “Install” button to install the tools you selected.
When installation is completed, the icons will be available in the Start Menu under “Windows Tools”.

Installing RSAT using the GUI in Windows 10

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then the text link “Optional Features”.
On the new page click “Add a feature”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
Click the “Install” button to install the tools you selected. You should see the tools you selected be installed under “Latest Actions”.
When installation is completed, the icons will be available in the Start Menu under “Windows Administrative Tools”.

Offline Installation

The above methods require an internet connection for Windows to download the files needed. To install the tools offline you will need to download the Windows 10/11 Features On Demand ISO which is available via the Volume Licensing Portal. I haven’t found a link to these ISO’s direct from Microsoft anywhere else. Once you have downloaded the ISO, extract the files to a location and run the following PowerShell command:

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online -LimitAccess -Source "C:\FOD-ISO-Extracted\`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 11 21H2 Reference Image

Sat, 25 Sep 2021 20:02:09 +0100

News and Updates

Update: 2021-11-12 After testing, a Build and Capture Task Sequence now appears to work and sysprep works as expected.
An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11.
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 11 21H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with. Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 11 21H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 11 21H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 11 21H2 and complete the wizard
Go to the Operating Systems > Windows 11 21H2 node and rename the new entries added to Windows 11 21H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 11 21H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 11 21H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 11 21H2
On the Folders page, tick the Windows 11 21H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application.

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Build Windows 11 21H2
Select Standard Client Task Sequence
Select the Operating System Windows 11 21H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 11 21H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 11 21H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W11-21H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 11 21H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

On-Prem AD User Creator Utility - Update 21.09.20

Tue, 21 Sep 2021 02:13:45 +0100

Configurable Script for Creating On-Prem Active Directory User Accounts

I’ve completely re-written this utility to make it easier and simpler to use. You can now configure multiple groups for the users to be added to on creation and the sam account names are generated randomly from the names list CSV file.
The utility is intended to create a lot of users very quickly. By default usernames are first name and a three digit number and passwords are also generated randomly by the script. If your environment has different requirements, edits will be needed to the code.

Change Log

2021-09-20: Version 21.09.20

Added code to make sure sam account name will never be more than 19 characters, due to the default sam account name length being 20 characters.

2021-09-15: Version 21.09.15

Completely rewritten to streamline the user creation process.
User passwords are now randomly generated.
Added option to add users to multiple groups.
Utility will find groups based on the AD name. No more having to specify the whole DN.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.
Added an option to specify the Port for SMTP communication.

Download

On-Prem AD User Creator Utility can be downloaded from:

GitHub

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Customisation

Sat, 04 Sep 2021 17:09:28 +0100

Windows 11 is very similar to Windows 10 is terms of technology and core services, however with the new UI and Start Menu refresh there are some new elements that you may want to remove.

Microsoft now expects the Start menu layout to be managed by an MDM service, if you want to do it without that then the easiest method is to copy the start.bin files.

Use a existing Windows 11 install to setup the Start menu layout how you want it.
Copy the start.bin file from %LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState to a folder in the MDT Deployment Share - in my case, I’ll use “_custom”.
Within your deployment Task Sequence you’ll want to copy the start.bin file to C:\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState
For all new users they will now get the start menu layout you specified.

I use a PowerShell script to copy the start.bin to the correct location.

$src = "Z:\_custom"

New-Item -Type Directory -Path "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState"
Copy-Item -Path "$src\w11_StartLayout\start.bin" -Destination "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState" -Force

Disable Search On The Taskbar

Currently I have not found the Group Policy settings for the new additions to the Taskbar, so here are the registry entries to disable/hide the extra icons.

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search"`

The key is a DWORD (32-bit) Value name SearchboxTaskbarMode and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Widgets On The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarDa and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Chat In The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarMn and it has 2 states:

0 (Hide icon)
1 (Show icon)

Default App Associations

Importing a list of default app associations for Windows 11 is the same as Windows 10, but I think it’s worth mentioning that Windows 11 has done away with the “Default Apps” section of Settings and so now it can be a lot more work to set them all on a template system to export. You can however still import a default app associations file that was created on Windows 10 into Windows 11.

Exporting A Default App Association File

`1`	`Dism /Online /Export-DefaultAppAssociations:"C:\foo\w11_AppAssoc.xml"`

Importing A Default App Association File as part of an MDT Task Sequence

You will need to create a new “Run Command Line” item just under “Postinstall” - see the image below.

`1`	`Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%deployroot%\_custom\w11_appassoc\w11_AppAssoc.xml`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Microsoft Store Apps

Sat, 04 Sep 2021 14:43:29 +0100

This post is a cut down version of this one and only focusses on Windows 11 for clarity.

Important note!

A “provisioned app” is an app that is a part of the Windows 11 installation and will be available for all users. Otherwise the app is only installed for the currently logged on user. To remove apps for all future users and the currently logged on user, you must remove both types of app.

Removing Specific Microsoft Store Apps

To remove a specific app from your Windows 11 installation, first you need to find the application package name.

Provisioned apps:

`1`	`Get-AppxProvisionedPackage -Online \| Select PackageName`

Current user apps:

`1`	`Get-AppxPackage \| Select PackageFullName`

Then run the following PowerShell command to remove the specific app

Provisioned app:

`1`	`Remove-AppxProvisionedPackage -PackageName [PackageName here] -Online`

Current user app:

`1`	`Remove-AppxPackage -Package [PackageFullName here]`

List Of Apps Included With Windows 11 21H2

Here are the provisioned apps included with Windows 11 21H2.

PowerShell Display Name	Readable App name
Microsoft.549981C3F5F10	Cortana
Microsoft.BingNews	Microsoft News
Microsoft.BingWeather	Weather
Microsoft.DesktopAppInstaller	None
Microsoft.GamingApp	Xbox
Microsoft.GetHelp	Get Help
Microsoft.Getstarted	Tips
Microsoft.HEIFImageExtension	None
Microsoft.MicrosoftEdge.Stable	Microsoft Edge
Microsoft.MicrosoftOfficeHub	Office
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection
Microsoft.MicrosoftStickyNotes	Sticky Notes
Microsoft.Paint	Paint
Microsoft.People	People
Microsoft.PowerAutomateDesktop	Power Automate
Microsoft.ScreenSketch	Snip & Sketch
Microsoft.SecHealthUI	None
Microsoft.StorePurchaseApp	None
Microsoft.Todos	Microsoft To Do
Microsoft.UI.Xaml.2.4	None
Microsoft.VCLibs.140.00	None
Microsoft.VP9VideoExtensions	None
Microsoft.WebMediaExtensions	None
Microsoft.WebpImageExtension	None
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”
Microsoft.WindowsAlarms	Alarms & Clock
Microsoft.WindowsCalculator	Calculator
Microsoft.WindowsCamera	Camera
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”
Microsoft.WindowsFeedbackHub	Feedback Hub
Microsoft.WindowsMaps	Maps
Microsoft.WindowsNotepad	Notepad
Microsoft.WindowsSoundRecorder	Voice Recorder
Microsoft.WindowsStore	Microsoft Store
Microsoft.WindowsTerminal	Terminal
Microsoft.Xbox.TCUI	None
Microsoft.XboxGameOverlay	None
Microsoft.XboxGamingOverlay	Xbox Game Bar
Microsoft.XboxIdentityProvider	None
Microsoft.XboxSpeechToTextOverlay	None
Microsoft.YourPhone	Your Phone
Microsoft.ZuneMusic	Groove Music
Microsoft.ZuneVideo	Films & TV
MicrosoftWindows.Client.WebExperience	None

Remove Specific MS Store Apps From An Online Windows 11 WIM Image

Download my PowerShell utility from GitHub.

The script removes the apps specified in a text file from the current logged on user and Windows 10/11. I use the script as a part of my Task Sequence for deploying Windows 10/11. The script is heavily based on work by Jörgen Nilsson - check out his post over on his site.

Remove Specified MS Store Apps From An Offline Windows 11 WIM Image

First, you will need to copy the contents of the Windows 11 ISO file to your hard drive.

Windows 11 includes many editions within it’s WIM file. You will need to specify the index ID of the image to operate on. You can obtain this by running the following PowerShell command:

`1`	`Get-WindowsImage -ImagePath "C:\foo\Windows 11\sources\install.wim" \| Format-Table -Property ImageIndex, ImageName`

The output of the command above should look similar to this:

ImageIndex ImageName
---------- ---------
1 Windows 11 Education
2 Windows 11 Education N
3 Windows 11 Enterprise
4 Windows 11 Enterprise N
5 Windows 11 Pro
6 Windows 11 Pro N
7 Windows 11 Pro Education
8 Windows 11 Pro Education N
9 Windows 11 Pro for Workstations
10 Windows 11 Pro N for Workstations

Now you can use the information above to configure the PowerShell utility to remove the specific apps from the Windows install image. This script will mount the image, remove the apps and then dismount it. The image can then be made into an ISO or used with MDT/SCCM to deploy Windows as normal.

Download my PowerShell utility from GitHub.

Remove All Included Microsoft Store Apps (Not Recommended)

Note: This process is destructive and non-reversible. Please ensure you have backups before proceeding. To quickly remove all the apps for the current user, run the following PowerShell command:

`1`	`Get-AppxPackage \| Remove-AppxPackage`

To remove all the provisioned apps, run the following PowerShell command:

Note: Provisioned apps are the apps that will be installed for all new users when they first log on.

`1`	`Get-AppxProvisionedPackage -Online \| Remove-AppxProvisionedPackage -Online`

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 21.08.10

Tue, 10 Aug 2021 16:13:11 +0100

Flexible Hyper-V Backup Utility

I’ve (finally) added the option to specify the port for the SMTP server. If not configured it will use the default of port 25.

2021-08-10: Version 21.08.10

Added an option to specify the Port for SMTP communication.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 21.07.02

Sat, 03 Jul 2021 10:30:26 +0100

Flexible Hyper-V Backup Utility

Since implementing support for 7-Zip it has added a whole load of additional possibilities to test for. This has created some difficulties for me, however I have been hard at work and have believe I’ve tackled the problem by introducing a formal testing process (and mostly automated it) in order to test some popular possible configs. You should be able to use any option that 7-zip supports, although currently the only options I’ve tested fully are ‘-t’ archive type, ‘-p’ password and ‘-v’ split files.

As always if you encounter any problems, please reach out to me at the links below and I’ll provide support.

2021-07-02: Version 21.07.02

Fixed many bugs introduced with implementing more 7-zip options. 7-zip options I’ve tested fully are ‘-t’ archive type, ‘-p’ password and ‘-v’ split files.
Implemented and automated a formal testing process.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Image Factory Utility - Update 21.06.22

Tue, 22 Jun 2021 23:01:05 +0100

Automate Creation of WIM Files

Just a small update to this utility. Some tidying up of code and added a progression bar so you can see at a glance how far through the list of TS ID’s the script is.

2021-06-22: Version 21.06.22

Added a progression bar display.
Changed a variable to prevent conflicts with future PowerShell versions.

Image Factory Utility can be downloaded from:

See the full documentation available here.

Support My Work

Please consider supporting my work:

Support with a one-time payment using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 21.06.14

Mon, 14 Jun 2021 22:28:51 +0100

Flexible Hyper-V Backup Utility

Just a small update to add the ability to use any 7-zip command line option with the utility.

2021-06-14: Version 21.06.14

Replaced -Sz* specific options with -SzOptions which will support any option that 7-zip supports.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable The News and Interests Bar in Windows 10

Thu, 10 Jun 2021 15:26:20 +0100

The New News and Interests Bar for Windows 10

In the June updates for Windows 10 the News and interests bar has been rolled out to Windows 10 and is enabled by default. If you want to disable it as a user, it’s easily done by right-clicking on the Taskbar > News and Interests > Turn off. Job done. 👍

Registry

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds`

The key is a DWORD (32-bit) Value name ShellFeedsTaskbarViewMode and it has 3 states:

0 (Show icon and text)
1 (Show only icon)
2 (Hide everything)

Group Policy

To disable this feature for all users using Group Policy, the setting can be found here:

`1`	`Computer Configuration > Administrative Templates > Windows Components > News and interests`

Enable news and interests on the taskbar

Set this item to Disabled to remove it for all users on the PC by default.

Central Store

You may not see this setting in your Group Policy if you have created a Central Store for your Group Policy Objects. You’ll need to update the Central Store with the following files from a Windows 10 system with the June update:

1
2

C:\Windows\PolicyDefinitions\Feeds.admx
C:\Windows\PolicyDefinitions\en-US [or your language]\Feeds.adml

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 21.06.02

Wed, 02 Jun 2021 12:35:58 +0100

Flexible Hyper-V Backup Utility

A bug fix update. When using archive types other than zip, the backup files were not being moved from the working directory to the final backup location. Thanks to @gabfot1 on Twitter for the bug report.

2021-06-02: Version 21.06.02

Fixed an error where file types which are not .zip were not being moved from the working directory to the final backup location.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 21.05.30

Sun, 30 May 2021 18:59:30 +0100

Flexible Hyper-V Backup Utility

Another substantial update. I’ve added the ability to support 7-Zip’s split file function and due to wanting to support for 7-Zip’s other file formats I’ve had to make the difficult decision to alter how the configuration switches are handled. This means that this updated script may not be a simple drop in replacement if you are using a previous version with 7-Zip features.

The biggest change is that when using 7-Zip features you will need to add an additional hyphen ‘-’ to the configuration. For example, to configure the number of threads that 7-Zip uses for compression you will now need to enter -SzThreads -mmt4 otherwise the script will throw an error.

2021-07-13: Version 21.05.30

Added additional 7-Zip options. -SzSplit to split archives into configuration volumes.
Changed existing switches for 7-Zip options. Users must now add an additional hyphen ‘-’ for 7-Zip options. This has been done to better support features that 7-Zip supports.
Changed how old files are removed. Users should take extra care if they are storing non back-up files in the backup location. This has been done so that 7-Zip’s split function can be supported.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 10 21H1 Reference Image

Sun, 09 May 2021 00:51:50 +0100

News and Updates

An update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released: This update fixes a boot loop issue. Details on how to install it are on Michael Niehaus' blog post here and you can download the fix here. Installation instructions will also be in the walkthrough below. NOTE: If you have existing shares you will need to copy the files from the extracted update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Lifecycle Support Notes from Microsoft: If you are using Enterprise or Education editions of Windows 10, from 1809 onwards the YY09 (YYH2) versions of Windows 10 will get 30 months of support and the YY03 versions will only get 18 months. So you may want to consider if you deploy the YY03 versions at all and focus on YY09 releases. Here’s the official information from Microsoft here

This article is based on current information as of 2021-09-25. I will update it in future as things progress.

Installing the MDT Update: MDT_KB4564442

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W10-21H1
Name it Deploy Windows 10 version 21H1
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps
Set the Default apps and any other file associations as required
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 10 21H1 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

Now we’re going to configure how drivers are installed for the physical devices we’re going to deploy Windows 10 to. There are a few ways to do this, here I’ll show the method I’ve been using which has worked very well for a variety of manufactures and models of devices.

The first thing you’ll need is the model numbers for all the devices you want to roll out the image to. You can find this out by booting the device in to its current version of Windows or the deployment environment using the LiteTouch_x64.iso boot disc or PXE booting, which I haven’t covered in this post but here’s a previous post I wrote on how to setup PXE booting for MDT: PXE Booting for Microsoft Deployment Toolkit.

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following command: wmic computersystem get model The output of the command is the model number you’ll need. The next thing you’ll need is the drivers. I’ve found Windows 10 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Windows 10 tends to have some drivers built right in and I’ve found they are usually very usable, so generally I only add drivers to MDT that Windows 10 cannot find. Deploy the reference image to each type of device you have and use Device Manager to see what’s missing.

If you are missing drivers, go to Settings > Windows Update and use Check online for updates from Microsoft Update which should find and install the relevant drivers. Then using the Update History and see what you need to find and import into MDT.

Note: I recommend avoiding using WSUS to download and install drivers as it inflates the WSUS database, slowing WSUS down and making it difficult to manage.

To import drivers into MDT you’ll need the INF files. Most large manufacturers do a decent job of providing drivers that can be used with MDT. Should you have difficulty with them you can use the Microsoft Update Catalog to search for and download the specific drivers that Windows Update installs and use them with MDT. Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder Windows 10 x64
Right click on the Windows 10 x64 folder and select New Folder
Name the folder a human readable name for the model of device you’ll be adding drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required

We now need to edit the CustomSettings.ini to configure the driver location for each model.

Go to the Deployment Workbench and right click on the Deployment Share, select Properties
Go to the Rules tab in the Properties window
Enter the following text under the [Settings] section but after the Properties
Once you’ve added in all the models required, click Apply to save the changes

[MODEL-NUMBER]
DriverGroup001=Windows 10 x64\Human-Readable-Model-Number
DriverSelectionProfile=nothing
OSDPrefix=PC

You’ll need to enter the above text for each model. Below is an example of my CustomSettings.ini for reference.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[HP 250 G5 Notebook PC]
DriverGroup001=Windows 10 x64\HP 250 G3
DriverSelectionProfile=nothing
OSDPrefix=HP
 
[80J2]
DriverGroup001=Windows 10 x64\Lenovo E50
DriverSelectionProfile=nothing
OSDPrefix=LEN
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM
 
[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\SERVER-NAME\Deploy$\Captures
OSDComputerName=%OSDPrefix%-%SerialNumber%
...

The Deploy deployment share is now configured to install drivers for the models specified.

Boot the physical device into the deployment environment and run the Deploy Windows 10 21H1. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the model of device you’ll be adding drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration > Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 10 21H1 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 10 21H1 Reference Image

Sun, 09 May 2021 00:13:32 +0100

News and Updates

This article is based on current information as of 2021-09-25. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 10 version 21H1 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with, and finally we’ll be focusing on the 64-bit Enterprise edition of Windows 10. Here are the links to the software we’ll be using:

Additional software which may be useful:

Rufus
Remote Server Administration Tools for Windows 10 - Double check that you download the version of RSAT for the version of server you want to administer.

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 10 version 2004 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection.
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard.
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard.
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files.

Open the “Deployment Workbench” from the Start Menu
Right click on “Deployment Shares”
Select “New Deployment Share”
Enter the path for the Deployment Share: E:\Build
Enter the share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 10 version 21H1 ISO in File Explorer
Go to “Deployment Workbench” > “Operating Systems”
Right click and select “New Folder”
Enter the name “Windows 10 version 21H1 x64” and click through the wizard to create the folder
Right click again and select “Import Operating System”
In the wizard, select “Full set of source files” and then enter the root of the mounted ISO as the “Source directory”
For the destination directory name enter “Windows 10 version 21H1 x64” and complete the wizard
Go to the “Operating Systems” > “Windows 10 version 21H1 x64” node and rename the new entries added to “Windows 10 version 21H1 Edition x64” for ease of use.

Creating Package Folder for Future Updates

Go to “Deployment Workbench” > “Packages”
Create a folder named “Windows 10 version 21H1 x64”

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 10 version 21H1 x64 that we make available through MDT.

Creating A Selection Profile

Expand the “Advanced Configuration” node
Right click on “Selection Profiles” and select “New Selection Profile”
Name it “Windows 10 version 21H1 x64”
On the “Folders” page, tick the “Windows 10 version 21H1 x64” folder under “Packages” and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application.

Go to “Deployment Workbench” > “Deployment Share” > “Applications”
Right click on “Applications” and select “New Application”
In the New Application Wizard, choose “Application with source files”
Give the application the name: VLC
Enter the “Source” directory of the installation files
Enter the “Destination” directory: VLC
For the “Command line” enter anything, we’ll revisit this later
On the summary page, click “Next” and after the files are copied click “Finish” to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the “Quiet install command”: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In “Deployment Workbench”, go to “Task Sequences”
Right click and select “New Task Sequence”
For the ID enter: “W10-21H1”
Name it “Build Windows 10 21H1”
Select “Standard Client Task Sequence”
Select the Operating System “Windows 10 21H1 x64”
Select “Do not specify a product key at this time”
Enter an “Organization” name
Select “Do not specify an Administrator password at this time”
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the “Task Sequence” just created and select “Properties”
Go to the “Task Sequence” tab on the “Properties” window of the Task Sequence
Expand the “Preinstall” folder and select the “Apply Patches” item
Change the “Selection Profile” to “Windows 10 21H1 x64”
Go to the “State Restore” folder and select “Windows Update (Pre-Application Installation)”
On the right side of the “Properties” window, go to the “Options” tab
Uncheck the “Disable this step” tick box and do the same with “Windows Update (Post-Application Installation)”
If you skipped the “Importing Applications” section, please disable the Install Applications item and go to step 16, if not please continue
Go to the “Install Applications” item
In the right side of the “Properties” box, select the “Install a single application” option and click the “Browse…” button
Select “Google Chrome” and change the name Install Applications to “Google Chrome”
Install other Applications, copy and paste the “Install Applications” item and repeat steps 13 - 15 for the applications of your choice
Click “Apply” and close the Task Sequence

Blocking Internet Access to prevent Microsoft Store App Updates

To block internet access to the VM whilst the image is building, we’ll use my Internet Access Control Utility.

Running the script with the -disable switch will create a firewall rule that will block internet traffic on ports 80 and 443.

First download Internet Access Control Utility from GitHub and copy it to \\mdt-server\build-share\_custom
In the “Task Sequence” created above, we’ll add the items required to run the PowerShell script
Go to the “Task Sequence” tab on the “Properties” window of the Task Sequence
Go to “State Restore” and click on the “Add” button
Go to “General” > “Run PowerShell Script”
Name the new item “PS Script - Disable Internet Access”
Enter Z:\_custom\Internet-Access-Control.ps1
Add -Disable to the Parameters section
Scroll down the Task Sequence to just above the “Imaging” folder
Once again, add a new “Run PowerShell Script” item
Name it “PS Script - Enable Internet Access”
Again, enter Z:\_custom\Internet-Access-Control.ps1
Add -Enable to the Parameters section
Click “Apply” and OK to close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to “Active Directory Users and Computers”
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the “Deployment Share” is hosted
Give the user mdt_admin “Full Control” share permissions and “Full Control” file permissions to all the files and folders in the “Deployment Share”

Next, we need to configure the “Bootstrap.ini” and the “CustomSettings.ini” files to control certain aspects of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab or closed development environments.

Configuring Bootstrap.ini

In “Deployment Workbench”, right click the “Deployment Share” and select “Properties”
Select the “Rules” tab and click the “Edit Bootstrap.ini” button
Add the settings below to the “Bootstrap.ini”
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the “Rules” tab of the “Deployment Share” properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty
 
[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES
 
_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim
WSUSServer=http://WSUS-SERVER-NAME:8530
FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In “Deployment Workbench”, right click on the “Deployment Share”
Select “Update Deployment Share”
Select “Completely regenerate the boot images”
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

To test everything, we need to copy the ISO file that we just generated. It is in the “Boot” folder in the “Deployment Share”. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it.

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Use Generation 1, not 2 VMs. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure “Use Automatic Checkpoints” is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the “Task Sequence” you created earlier. Select your Task Sequence, click Next and the process will begin. The Task Sequence will install Windows 10 version 21H1, update from the WSUS server, install the optional applications if you added them, and then run Windows Update from the WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W10-21H1_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 10 version 21H1 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable Network Discovery in Windows 10/11

Tue, 20 Apr 2021 23:18:59 +0100

Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
Inside the Inbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-In)
- Network Discovery (NB-Datagram-In)
- Network Discovery (NB-Name-In)
- Network Discovery (Pub-WSD-In)
- Network Discovery (SSDP-In)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-In) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

Inside the Outbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to e.g. Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-Out)
- Network Discovery (NB-Datagram-Out)
- Network Discovery (NB-Name-Out)
- Network Discovery (Pub-WSD-Out)
- Network Discovery (SSDP-Out)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-Out) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Select the Function Discovery Provider Host service and go to it properties page.
Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
Repeat the above steps for the following services:

Function Discovery Resource Publication
Link-Layer Topology Discovery Mapper
SSDP Discovery
UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Moving the Site - Update 2021-02-16

Wed, 27 Jan 2021 17:22:02 +0000

Update 2021-02-16

Theme changed to add site search.
New theme is also more configurable, which I’m happy about. :)
Will continue to tweak the site and layout of certain pages that have got garbled in the migration.

Update 2021-02-14

Links to old popular articles now have aliases so old links will work.
Still working on site-wide search, I may just change the Hugo theme.

I’m currently moving the site from WordPress to Hugo with comments provided by Disqus.

A couple of notes:

Links to old articles won’t work (different file structure) but all the articles are still here on the site.
Comments are not being migrated over
Site search will return soon.

Thanks for your patience!

-Mike

Start Menu and Taskbar Customisation

Sun, 03 Jan 2021 01:13:20 +0000

For Windows 11 please check out this post

It’s been a long while since I last posted about how to customise the Windows 10 Start Menu and Taskbar for new users when deploying images, so it’s time to fix that!

The first thing we need to do is setup what we want our Start Menu to look like and export it.

Log on to a Windows 10 machine that has all of the software you want to be pinned on the Start Menu layout and customise the Start Menu as you want it.

Once you have it how you want, run the following command in an elevated PowerShell session:

`1`	`Export-StartLayout -UseDesktopApplicationID -Path C:\StartMenuLayout.xml`

Here is an example StartMenuLayout.xml for reference:

<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1">
  <LayoutOptions StartTileGroupCellWidth="6" StartTileGroupsColumnCount="1" />
  <DefaultLayoutOverride>
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
        <start:Group Name="Web Browsers" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
          <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
        </start:Group>
        <start:Group Name="Microsoft Office" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Publisher.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Access.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
</LayoutModificationTemplate>

If all you wish to do is have a custom default Start Menu in place for all users of a computer, then you can run the following PowerShell command to set the layout as the default:

`1`	`Import-StartLayout -LayoutPath "C:\StartMenuLayout.xml" -MountPath $env:SystemDrive\`

However if you want to add a custom taskbar to it as well, then you must edit the XML file and add some additional code below the line

`1`	`</DefaultLayoutOverride>`

`1`	`</LayoutModificationTemplate>`

Below is an example Taskbar customisation XML snippet.

<CustomTaskbarLayoutCollection PinListPlacement="Replace">
  <defaultlayout:TaskbarLayout>
    <taskbar:TaskbarPinList>
      <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
      <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
    </taskbar:TaskbarPinList>
  </defaultlayout:TaskbarLayout>
</CustomTaskbarLayoutCollection>

Please note: It is essential that the syntax of the XML file is correct, and that everything is formatted correctly. I have put my example StartMenuLayout file on my GitHub, please feel free to copy it should you experience any problems.

Another important note: When pinning items to the Start Menu or Taskbar the icon must be in a location accessible to all users, so keep in mind that you may need to copy icons to somewhere inside "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs" so the icons are on the custom Start Menu and/or Taskbar. Once you’ve added the Taskbar configuration, you can import the XML file as above and the default Start Menu and Taskbar for all users of a computer will be as configured.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Prevent Teams From Starting Automatically With No User Login

Fri, 01 Jan 2021 20:13:36 +0000

If you are deploying Microsoft Teams but don’t want it to start on login, or force users to login to disable the auto start then you can do it after installation of Teams simply by editing a file. The file is located in the install location of the Teams installer, by default is it here:

`1`	`%programfiles% (x86)\Teams Installer\setup.json`

The contents of the file should be as follows:

`1`	`{"noAutoStart":true}`

Once this is done, Teams will no longer start up on login of any user by default.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 10 20H2 Reference Image

Tue, 27 Oct 2020 21:42:24 +0000

News and Updates

An update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released: This update fixes a boot loop issue. Details on how to install it are on Michael Niehaus' blog post here. and you can download the fix here. Installation instructions will also be in the walkthrough below. NOTE: If you have existing shares you will need to copy the files from the extracted update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

This article is based on current information as of 2020-10-26. I will update it in future as things progress.

Installing the MDT Update: MDT_KB4564442

Extract the files from the self-extracting archive and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files. If you have existing shares you will need to copy the files from the update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\Deploy.
Enter the Share name: Deploy$.
Give the share a description.
On the Options screen, accept the defaults as we can change them later.
Complete the wizard to create the share.
By default, the share permissions are set the local administrators group. We’ll revisit this later.

Add an Operating System

Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file.
When prompted to Specify operating system setup files, select Setup files are not needed.
For the destination directory name enter a name that you want to use and complete the wizard.
Go to the Operating Systems node and rename the reference image we just captured to something more readable.

Create a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-20H2
Name it Deploy Windows 10 version 20H2.
Select Standard Client Task Sequence.
For the Operating System, select the custom image that we imported previously.
Select Do not specify a product key at this time if you are using KMS.
Enter an Organization name.
Enter the local Administrator password.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Expand the Initialization folder in the left-hand pane.
Go to the Gather local only item.
In the Properties window select Gather local data and process rules.
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Select the Install Applications item and check the Disable this step tick box.
Click Apply and close the Task Sequence.

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted.
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share.
You may also want to give similar permissions to users or groups that are going to be using the deployment share.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

The settings below deserve some explanation. The [Virtual Machine] section is regarding driver installs which we’ll cover more later in this post. The Join Domain section is important. Here I’ve put the mdt_admin account to use as the account to join the device being imaged to the domain contoso.com. If you are following this guide to the letter, the mdt_admin account would not have the appropriate permissions to join a device to a domain, and so you should either give it the permissions required or create a new account for that specific purpose.

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDComputerName=%TaskSequenceID%
 
[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
 
; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
 
; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES
 
; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com
 
; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network.
Virtual Hard Drive of at least 40GB, preferably on fast media.
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT.
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled.

Start the VM and it will boot from the LiteTouchPE_x64-deploy.iso into the deployment environment, you will be presented with a login screen and here you should login with the Active Directory credentials that have access to the Deployment Share. Once logged in you will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next. You’ll be prompted to enter a name for the device, it will also be added to Active Directory under this name. Click Next and the task sequence will begin.

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps.
Set the Default apps and any other file associations as required.
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X.
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window.
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom.
Open the Deployment Workbench and go to Deployment Share > Task Sequences.
Right click on the Task Sequence Deploy Windows 10 20H2 and select Properties.
Click on the Task Sequence tab and navigate to Postinstall > Configure.
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line.
Enter Set Default App Associations in the Name field, and in the Command line field enter: [code language=“text”]Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml[/code]
Click Apply to save the changes.

Driver Management

The first thing you’ll need is the model numbers for all the devices you want to roll out the image to. You can find this out by booting the device in to its current version of Windows or the deployment environment using the LiteTouch_x64.iso boot disc or PXE booting, which I haven’t covered in this post but here’s a previous post I wrote on how to setup PXE booting for MDT: PXE Booting for Microsoft Deployment Toolkit.

Note: I recommend avoiding using WSUS to download and install drivers as it inflates the WSUS database, slowing WSUS down and making it difficult to manage.

Open the Deployment Workbench.
Navigate to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder Windows 10 x64.
Right click on the Windows 10 x64 folder and select New Folder.
Name the folder a human readable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth.
Right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers for that driver type.
Check the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 7-10 for each driver type required.

We now need to edit the CustomSettings.ini to configure the driver location for each model.

Go to the Deployment Workbench and right click on the Deployment Share, select Properties.
Go to the Rules tab in the Properties window.
Enter the following text under the [Settings] section but after the Properties.
Once you’ve added in all the models required, click Apply to save the changes.

[MODEL-NUMBER]
DriverGroup001=Windows 10 x64\Human-Readable-Model-Number
DriverSelectionProfile=nothing
OSDPrefix=PC

You’ll need to enter the above text for each model. Below is an example of my CustomSettings.ini for reference.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[HP 250 G5 Notebook PC]
DriverGroup001=Windows 10 x64\HP 250 G3
DriverSelectionProfile=nothing
OSDPrefix=HP
 
[80J2]
DriverGroup001=Windows 10 x64\Lenovo E50
DriverSelectionProfile=nothing
OSDPrefix=LEN
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM
 
[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\SERVER-NAME\Deploy$\Captures
OSDComputerName=%OSDPrefix%-%SerialNumber%
...

The Deploy deployment share is now configured to install drivers for the models specified.

Boot the physical device into the deployment environment and run the Deploy Windows 10 20H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt.
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers.

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder WinPE x64.
Right click on the WinPE x64 folder and select New Folder.
Name the folder a suitable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network.
To import the drivers, right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 6-8 for each driver type required.
Now we must create a Selection Profile for WinPE x64.
Go to Advanced Configuration > Selection Profiles.
Right click on Selection Profiles and select New Selection Profile.
Enter WinPE x64 as the Selection profile name.
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder.
Click Next > Next > Finish to complete the wizard.
Right click on the Deployment Share and select Properties.
Go to the Windows PE tab and change the Platform drop down menu to x64.
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64.
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked.
Click Apply to save the changes, click OK to close the Properties window.
Right click the Deployment Share and select Update Deployment Share.
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included.
Click Finish to complete the wizard.

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 10 20H2 which is ready to deploy.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 10 20H2 Reference Image

Tue, 27 Oct 2020 21:42:04 +0000

News and Updates

An update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released: This update fixes a boot loop issue. Details on how to install it are on Michael Niehaus' blog post here. and you can download the fix here. Installation instructions will also be in the walkthrough below. NOTE: If you have existing shares you will need to copy the files from the extracted update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

This article is based on current information as of 2020-10-26. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 10 version 20H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with, and finally we’ll be focusing on the 64-bit Enterprise edition of Windows 10. Here are the links to the software we’ll be using:

Additional software which may be useful:

Rufus
Remote Server Administration Tools for Windows 10 - Double check that you download the version of RSAT for the version of server you want to administer.

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 10 version 2004 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection.
On the Select the features you want to install screen select:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard.
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard.
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\Build.
Enter the Share name: Build$.
Give the share a description.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.
By default, the share permissions are set the local administrators group. We’ll revisit this later.

Adding an Operating System

Mount the Windows 10 version 20H2 ISO in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select New Folder.
Enter the name Windows 10 version 20H2 x64 and click through the wizard to create the folder.
Right click again and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory.
For the destination directory name enter Windows 10 version 20H2 x64 and complete the wizard.
Go to the Operating Systems/Windows 10 version 20H2 x64 node and rename the new entries added to Windows 10 version 20H2 Edition x64 for ease of use.

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 version 20H2 x64.

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 10 version 20H2 x64 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 version 20H2 x64.
On the Folders page, tick the Windows 10 version 20H2 x64 folder under Packages and complete the wizard.

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: VLC.
Enter the Source directory of the installation files.
Enter the Destination directory: VLC.
For the Command line enter anything, we’ll revisit this later.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configuring Applications

Right click on VLC, go to the Details tab.
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

The New Microsoft Edge - Business Download

msiexec /i MicrosoftEdgeEnterpriseX64.msi /qn

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-20H2.
Name it Build Windows 10 20H2.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 20H2 x64.
Select Do not specify a product key at this time.
Enter an Organization name.
Select Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder and select the Apply Patches item.
Change the Selection Profile to Windows 10 20H2 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue.
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Microsoft Edge and change the name Install Applications to Microsoft Edge.
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice.
Click Apply and close the Task Sequence.

Blocking Internet Access to prevent Microsoft Store App Updates

To block internet access to the VM whilst the image is building, we’ll use my Internet Access Control Utility.

Running the script with the -disable switch will create a firewall rule that will block internet traffic on ports 80 and 443.

First download Internet Access Control Utility from GitHub and copy it to \\mdt-server\build-share\_custom.
In the Task Sequence created above, we’ll add the items required to run the PowerShell script.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Go to State Restore and click on the Add button.
Go to General > Run PowerShell Script.
Name the new item PS Script - Disable Internet Access.
Enter Z:\_custom\Internet-Access-Control.ps1.
Add -Disable to the Parameters section.
Scroll down the Task Sequence to just above the Imaging folder.
Once again, add a new Run PowerShell Script item.
Name it PS Script - Enable Internet Access.
Again, enter Z:\_custom\Internet-Access-Control.ps1.
Add -Enable to the Parameters section.
Click Apply and OK to close the Task Sequence.

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers.
Create a user called mdt_admin and give it a complex password.
Go to the Server or PC where the Deployment Share is hosted.
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty
 
[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES
 
_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim
WSUSServer=http://WSUS-SERVER-NAME:8530
FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs.
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network.
Virtual Hard Drive of at least 40GB, preferably on fast media.
Boot from CD using the LiteTouchPE_x64.iso from MDT.
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled.

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 10 version 20H2, update from the WSUS server, install the optional applications if you added them, and then run Windows Update from the WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server. However currently I have experienced issues when booting into WinPE from the disk. I have worked around this by booting from a LiteTouchPE_x64.iso to get into WinPE. The capture then runs as normal. Hopefully this will be fixed in a future update.

When this process completes the VM will be shutdown and a file named W10-20H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 10 version 20H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article. If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Log Manager Utility - Update 20.07.27

Thu, 30 Jul 2020 17:59:52 +0000

Flexible clean up and backup of log files

Just a small update to add the improved error capturing and reporting that I’ve also put in the Hyper-V Backup Utility.

2020-07-30: Version 20.07.27

Added improved error handling and reporting.

Log Manager Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 20.07.13

Mon, 13 Jul 2020 17:30:05 +0000

Flexible Hyper-V Backup Utility

A substantial update in terms of changes made under the hood, but I’ve also added a few new options requested by users. The biggest change is that errors are now handled properly and reported to the user in a reliable manner. All the changes are summarized below.

Version 20.07.13

Added -ShortDate option. This will create backups with only the Year, Month, Day as the file name.
Added pass through for 7-Zip options - CPU threads to use and compression level.
Added proper error handling so errors are properly reported in the console, log and email.
Bug fixes to create folders when paths are configured without the folders existing.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

3D Maze Remix - Update v1.4

Fri, 19 Jun 2020 14:19:15 +0000

Update v1.4

Download from Itch.io, available for Windows, macOS, and Linux

Once again, I’ve updated 3D Maze Remix with some new features that I’ve wanted to put in the game since I started developing it. I don’t consider this project “finished” just yet, as I’d like to improve the AI in the “demo” mode and make it more true to the original 3D Maze screensaver, which has been my aim throughout the entire project. So why am I releasing this if it’s not finished and needs refining? As I’m learning Unity and C#, I want to show the progress of my work at self-imposed milestones. 3D Maze Remix v1.1 is still available on the Microsoft Store and provides an interesting look back to the original version of the game.

v1.4 Change Log

Added autonomous movement to the “rat” character.
Added “demo” mode. Allowing the player character to move autonomously like the original screensaver.
Added display resolution options.
General clean up and optimisations.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

3D Maze Remix Dev Diary #1

Tue, 14 Apr 2020 19:10:36 +0000

I’ve started work on 3D Maze Remix to add some features I’ve been wanting to figure out for a while. As I’m still learning C# and Unity the pretty simple sounding additions take longer than I initially thought. Here’s what I’ve been working on.

Adding autonomous movement to the rat entity

Making the rat move and not clip through the walls, floor or ceiling meant adding collision to the rat but allowing the player and rat to pass through each other. So, I learned about and used Layer-based collision detection. https://docs.unity3d.com/Manual/LayerBasedCollision.html

Fixing various visual bugs

Spotted what appeared to be a weird visual bug when pausing or reaching the finish screen and attempted to fix. It turned out that it was due to me having the gismos enabled in the game view of Unity and it was the edge of the canvas. A few images appear to have additional partially transparent pixels in the backgrounds, but they do not appear in photoshop, only in the Unity editor. I’ll investigate further.

Add autonomous movement for the player

I want to add an option to have autonomous movement for the player character so the game can run without user interaction like the original screen saver. I am currently using the same script as with the rat and it works however movement is not ideal and when the player interacts with a pickup object and the camera rotates the “view” disconnects. This is probably due to a work around I introduced in an earlier version. I will work on finding a better workaround and fixing this issue.

General clean up

I removed the point light from the player character as it didn’t serve much purpose except the add additional light to the pickup objects.

The current version of 3D Maze Remix is available on my itch.io page.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 10 2004 (20H1) Reference Image

Tue, 07 Apr 2020 14:41:32 +0000

News and Updates

An essential update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released: This update fixes two issues around booting. Details on how to install it are on Michael Niehaus' blog post here. and you can download the fix here. I will add installation instructions in the walkthrough below. NOTE: If you have existing shares you will need to copy the files from the extracted update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and regenerate the boot media.

Lifecycle Support Notes from Microsoft: The Windows 10 Enterprise and Education 1709 support window has been extended six months to October 13th 2020 due to the COVID-19 pandemic. If you are using Enterprise or Education editions of Windows 10, from 1809 onwards the YY09 (YYH2) versions of Windows 10 will get 30 months of support and the YY03 versions will only get 18 months. So you may want to consider if you deploy the YY03 versions at all and focus on YY09 releases. Here’s the official information from Microsoft here.

This article is based on current information as of 2020-06-04. I will update it in future as things progress. In this article as with my previous ones we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 10 2004 (20H1) Reference Image.

Installing the MDT Update: MDT_KB4564442

Extract the files from the self-extracting archive, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files. If you have existing shares you will need to copy the files from the update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\Deploy.
Enter the Share name: Deploy$.
Give the share a description.
On the Options screen, accept the defaults as we can change them later.
Complete the wizard to create the share.
By default, the share permissions are set the local administrators group. We’ll revisit this later.

Add an Operating System

Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file.
When prompted to Specify operating system setup files, select Setup files are not needed.
For the destination directory name enter a name that you want to use and complete the wizard.
Go to the Operating Systems node and rename the reference image we just captured to something more readable.

Create a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-2004.
Name it Deploy Windows 10 2004.
Select Standard Client Task Sequence.
For the Operating System, select the custom image that we imported previously.
Select Do not specify a product key at this time if you are using KMS.
Enter an Organization name.
Enter the local Administrator password.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Expand the Initialization folder in the left-hand pane.
Go to the Gather local only item.
In the Properties window select Gather local data and process rules.
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Select the Install Applications item and check the Disable this step tick box.
Click Apply and close the Task Sequence.

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted.
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share.
You may also want to give similar permissions to users or groups that are going to be using the deployment share.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

If you are following this guide to the letter, the mdt_admin account would not have the appropriate permissions to join a device to a domain, and so you should either give it the permissions required or create a new account for that specific purpose. The other settings are location preferences relevant to the UK and resolution settings which prevent the finished device from defaulting to a resolution of 1024 x 768, and instead use the recommended resolution Windows receives from the display.

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO.

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network.
Virtual Hard Drive of at least 40GB, preferably on fast media.
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT.
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps.
Set the Default apps and any other file associations as required.
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X.
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window.
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom.
Open the Deployment Workbench and go to Deployment Share > Task Sequences.
Right click on the Task Sequence Deploy Windows 10 2004 and select Properties.
Click on the Task Sequence tab and navigate to Postinstall > Configure.
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line.
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes.

Driver Management

The first thing you’ll need is the model numbers for all the devices you want to roll out the image to. You can find this out by booting the device in to its current version of Windows or the deployment environment using the LiteTouch_x64.iso boot disc or PXE booting, which I haven’t covered in this post but here’s a previous post I wrote on how to setup PXE booting for MDT: PXE Booting for Microsoft Deployment Toolkit.

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following command: wmic computersystem get model

The output of the command is the model number you’ll need. The next thing you’ll need is the drivers. I’ve found Windows 10 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Note: I recommend avoiding using WSUS to download and install drivers as it inflates the WSUS database, slowing WSUS down and making it difficult to manage.

Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench.
Navigate to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder Windows 10 x64.
Right click on the Windows 10 x64 folder and select New Folder.
Name the folder a human readable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth.
Right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers for that driver type.
Check the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 7-10 for each driver type required.

We now need to edit the CustomSettings.ini to configure the driver location for each model.

Go to the Deployment Workbench and right click on the Deployment Share, select Properties.
Go to the Rules tab in the Properties window.
Enter the following text under the [Settings] section but after the Properties.
Once you’ve added in all the models required, click Apply to save the changes.

[MODEL-NUMBER]
DriverGroup001=Windows 10 x64\Human-Readable-Model-Number
DriverSelectionProfile=nothing
OSDPrefix=PC

You’ll need to enter the above text for each model. Below is an example of my CustomSettings.ini for reference.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[HP 250 G5 Notebook PC]
DriverGroup001=Windows 10 x64\HP 250 G3
DriverSelectionProfile=nothing
OSDPrefix=HP

[80J2]
DriverGroup001=Windows 10 x64\Lenovo E50
DriverSelectionProfile=nothing
OSDPrefix=LEN

[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\SERVER-NAME\Deploy$\Captures
OSDComputerName=%OSDPrefix%-%SerialNumber%
...

The Deploy deployment share is now configured to install drivers for the models specified. Boot the physical device into the deployment environment and run the Deploy Windows 10 2004. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt.
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers.

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder WinPE x64.
Right click on the WinPE x64 folder and select New Folder.
Name the folder a suitable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network.
To import the drivers, right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 6-8 for each driver type required.
Now we must create a Selection Profile for WinPE x64.
Go to Advanced Configuration > Selection Profiles.
Right click on Selection Profiles and select New Selection Profile.
Enter WinPE x64 as the Selection profile name.
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder.
Click Next > Next > Finish to complete the wizard.
Right click on the Deployment Share and select Properties.
Go to the Windows PE tab and change the Platform drop down menu to x64.
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64.
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked.
Click Apply to save the changes, click OK to close the Properties window.
Right click the Deployment Share and select Update Deployment Share.
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included.
Click Finish to complete the wizard.

The MDT boot media should now have the network and/or storage drivers required.

You now have a reference image for Windows 10 2004 which is ready to deploy.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 10 2004 (20H1) Reference Image

Wed, 25 Mar 2020 13:01:12 +0000

News and Updates

This article is based on current information as of 2020-06-04. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 10 2004 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with, and finally we’ll be focusing on the 64-bit Enterprise edition of Windows 10. Here are the links to the software we’ll be using:

Additional software which may be useful:

Rufus
Remote Server Administration Tools for Windows 10 - Double check that you download the version of RSAT for the version of server you want to administer.

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 10 2004 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection.
On the Select the features you want to install screen select:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard.
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard.
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\Build.
Enter the Share name: Build$.
Give the share a description.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.
By default, the share permissions are set the local administrators group. We’ll revisit this later.

Adding an Operating System

Mount the Windows 10 2004 ISO in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select New Folder.
Enter the name Windows 10 2004 x64 and click through the wizard to create the folder.
Right click again and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory.
For the destination directory name enter Windows 10 2004 x64 and complete the wizard.
Go to the Operating Systems/Windows 10 2004 x64 node and rename the new entries added to Windows 10 2004 Edition x64 for ease of use.

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 2004 x64.

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 10 2004 x64 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 2004 x64.
On the Folders page, tick the Windows 10 2004 x64 folder under Packages and complete the wizard.

Importing Applications

In my previous articles I’ve covered how to add Microsoft Office 2016, in this one I’m going to omit the information as it is probably time to move to Office 2019/365 and they both install very differently from Office 2016. I have a separate article and YouTube video walk through on how to deploy Office 2019/365. Below are the silent installation commands for a few common applications that you may want to deploy with the image.

The New Microsoft Edge - Business Download

msiexec /i MicrosoftEdgeEnterpriseX64.msi /qn

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-2004.
Name it Build Windows 10 2004.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 2004 x64.
Select Do not specify a product key at this time.
Enter an Organization name.
Select Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder and select the Apply Patches item.
Change the Selection Profile to Windows 10 2004 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue.
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Microsoft Edge and change the name Install Applications to Microsoft Edge.
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice.
Click Apply and close the Task Sequence.

Blocking Internet Access to prevent Microsoft Store App Updates

To block internet access to the VM whilst the image is building, we’ll use my Internet Access Control Utility. Running the script with the -disable switch will create a firewall rule that will block internet traffic on ports 80 and 443.

First download Internet Access Control Utility from GitHub and copy it to \\mdt-server\build-share\_custom.
In the Task Sequence created above, we’ll add the items required to run the PowerShell script.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Go to State Restore and click on the Add button.
Go to General > Run PowerShell Script.
Name the new item PS Script - Disable Internet Access.
Enter Z:\_custom\Internet-Access-Control.ps1.
Add -Disable to the Parameters section.
Scroll down the Task Sequence to just above the Imaging folder.
Once again, add a new Run PowerShell Script item.
Name it PS Script - Enable Internet Access.
Again, enter Z:\_custom\Internet-Access-Control.ps1.
Add -Enable to the Parameters section.
Click Apply and OK to close the Task Sequence.

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers.
Create a user called mdt_admin and give it a complex password.
Go to the Server or PC where the Deployment Share is hosted.
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim
WSUSServer=http://WSUS-SERVER-NAME:8530
FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs.
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network.
Virtual Hard Drive of at least 40GB, preferably on fast media.
Boot from CD using the LiteTouchPE_x64.iso from MDT.
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled.

When this process completes the VM will be shutdown and a file named W10-2004_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 10 2004 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Log Manager Utility - Update 20.03.23

Mon, 23 Mar 2020 11:33:38 +0000

Flexible clean up and backup of log files

A user reported an issue where wildcards would not work with the -LogsPath switch. This was due to me adding incorrect validation to that option. To fix this I have removed the validation and should now accept wildcards as before. Please accept my apologies for this error, it should have been caught during testing but I missed it. I’ll take steps in future to prevent this type of problem from occurring in future. Thanks to commenter Daniel who raised this issue.

2020-03-23: Version 20.03.23

Fixed a user reported issue: wildcards in the -LogsPath switch no longer worked. They will now work.

Log Manager Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

WSUS Maintenance Utility - Update 20.03.20

Fri, 20 Mar 2020 17:41:38 +0000

Clean up your WSUS

I’ve overhauled WSUS Maintenance Utility and have added some new features which were long overdue. It also includes all the same improvements that the other refactored utilities have.

2020-03-20: Version 20.03.20

Added code contribution from ideas@habs.homelinux.net.
Individual clean-up jobs now run separately.
Improved reporting.
Made slight improvements to documentation.

WSUS Maintenance Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

TechNet Gallery is being retired

Fri, 20 Mar 2020 14:42:31 +0000

Microsoft is finally retired the old TechNet Gallery - one of the websites where I’ve made my utilities available in the past. So, this is just a heads up that if you get my scripts from there, they will no longer be available in the near future. They will still be available on the Microsoft PowerShell Gallery and on my own GitHub. I’ve been expecting this as over the past few years some functionality of the site has been broken for months on end. I’ve been keeping my tools up to date on the site but not made any new ones available.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Tech Tips for These Tumultuous Times

Thu, 19 Mar 2020 14:52:18 +0000

Hi all, In these interesting times I thought I’d create a round-up of some tips and recommendations for those of you who are looking to improve your technology - whatever your situation. It’s a grab bag of various items I’ve been collecting for a while but I hope some of these suggestions are useful to you. I usually write posts geared towards IT professionals but this post is aimed at people from all walks of life working from home with little IT assistance. If you have any suggestions for other software or tips, please put them in the comments below. ☺

Improving Your Internet Connection

When it comes to networking, bandwidth isn’t everything. Reliability and latency are also required for it to be useful. It can sometimes be preferable to have less bandwidth available but achieve low latency and be reliable. There’s little point to having a 1Gbps that has a huge latency or hardly ever works. You can use the website SpeedTest to test your internet connection bandwidth and latency. Here are some more points that you should consider: Wi-Fi is one of the biggest variables that can affect your connection. Wi-Fi is greatly affected by walls, ceilings, and other Wi-Fi signals and interference generated by electronic devices. The age and quality of the equipment used in your network can also affect the quality of your Wi-Fi signal and network in general. Connecting via an Ethernet cable will provide the most reliable connection; however, you should consider swapping out older cables for new ones as damage can occur over time and this will affect the quality of the connection. When troubleshooting network issues, it’s important to check every part of the connection. In some rare cases the network hardware itself on a device could have developed a fault and in the past, I’ve had the networking stack on Windows get corrupted. 😬 When experience internet issues, it’s important to investigate and find out if you are having networking issues in general within your home or whether it’s an external issue. An external issue will be something you need your ISP to investigate, internal network issues are something that you can do something about. 👍

Improving Your DNS Service

DNS is one of the most important parts of networking. There’s a reason it’s a tech meme. You can control which DNS service provider you use either by changing it on your device (if you are on a network, I wouldn’t recommend this) or on your router or modem. If you change the DNS on your router it will affect all devices connected to it. Here are some DNS services that I can recommended. Both written and video Instruction for changing DNS settings are available on the sites below. A note about IPv6 - If you don’t know you need it you probably don’t, so don’t worry about it! 👍

Google DNS

IP addresses: 8.8.8.8 and 8.8.4.4

Google provide their own fast DNS service that is extremely popular. Just a quick reminder that before you use Google DNS, remember they are an advertising company and there are other very good alternatives.

Quad9

Quad9 is focused on security and blocking threats at the DNS level. It’s also the best DNS service to say out loud in the mirror to yourself, in my opinion.

IP addresses: 9.9.9.9 and 149.112.112.112

IPv6 addresses: 2620:fe::fe and 2620:fe::9

CloudFlare DNS also known as 1.1.1.1

CloudFlare DNS is geared towards being as fast as possible.

IP addresses: 1.1.1.1 and 1.0.0.1

IPv6 addresses: 2606:4700:4700::1111 and 2606:4700:4700::1001

AdGuard DNS

As the name suggests AdGuard is focused on DNS level ad blocking and has the option to block adult sites. AdGuard provides a good level of ad blocking but it will not block ads from streaming services as those ads are provided by the same servers as the content you want to watch. To block those ads later in this article I cover ad blocking web browser extensions.

For “Default” servers (basic ad blocking):

IP addresses: 176.103.130.130 and 176.103.130.131

IPv6 addresses: 2a00:5a60::ad1:0ff and 2a00:5a60::ad2:0ff

For “Family protection” servers (basic adult site blocking):

IP addresses: 176.103.130.132 and 176.103.130.134

IPv6 addresses: 2a00:5a60::bad1:0ff and 2a00:5a60::bad2:0ff

For “Non-filtering”:

IP addresses: 176.103.130.136 and 176.103.130.137

IPv6 addresses: 2a00:5a60::01:ff and 2a00:5a60::02:ff

Online Services Monitor

Down Detector is a great centralised resource for tracking every online service in existence and whether they are experiencing issues. A good way to know whether ‘it’s just you’ or not. Please bare in mind that online services are provided worldwide via various regional data centres so a service could be reported as being down in the US but be up in the UK or it could be down in the UK but due to the time-zone difference and a smaller population, it might not have been reported.

Remote Access Software

AnyDesk AnyDesk is easy to setup and use, it doesn’t even need to be installed. It’s a lot like Team Viewer except with less popups and can be set up to provide secure, unattended access to a computer. Unattended access does require it to be installed, however.

Team Viewer Team Viewer is well known for many reasons (both good and bad), but much like AnyDesk it is easy to use and can provide unattended access to a computer.

Ad Blocking Browser Extensions

If you use a modern browser, it’s very likely it supports extensions. Here are some that will block ads, malware, and other dodgy software that can be loaded via the browser. Even if you keep your anti-virus software up to date, it’s still worth using an ad blocking extension. Layers of security are a good thing! You can easily disable it for specific pages if it blocks a web page element you require. These extensions will also block YouTube ads and other types of streaming media ads. Please consider using these extensions responsibly and allowing ads for specific sites and creators.

Both AdBlock Plus and uBlock Origin are very good.

uBlock Origin

Mozilla Firefox Extension

The New Microsoft Edge Extension

Google Chrome Extension

AdBlock Plus Mozilla Firefox Extension

The New Microsoft Edge Extension
Google Chrome Extension

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Internet Access Control Utility

Tue, 17 Mar 2020 15:09:05 +0000

Control Internet access with Windows Firewall

Internet Access Control Utility is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

Thanks
-Mike

Features and Requirements

It requires Windows Firewall to be active.
The utility requires at least PowerShell 5.0.
This utility has been tested on Windows 11 and Windows 10.

Configuration

Here’s a list of all the command line switches and example configurations.

Command Line Switch	Description	Example
-Disable	Block the internet. Create the firewall rule to block ports 80 and 443	N/A
-Enable	Allow the internet. Removes the firewall rule created, allowing the ports 80 and 443	N/A
-L	The path to output the log file to.	[path]
-LogRotate	Remove logs produced by the utility older than X days	[number]
-NoBanner	Use this option to hide the ASCII art title in the console.	N/A
-Help	Display usage information. No arguments also displays help.	N/A

Example

`1`	`[path\]Internet-Access-Control.ps1 -Disable`

This will create a Windows Firewall rule to block internet access using ports 80 and 443.

Change Log

2023-04-28: Version 23.04.28

Cleaned up the output.

2022-06-14: Version 22.05.30

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

2021-12-08: Version 21.12.08

Configured logs path now is created, if it does not exist.
Added OS version info.
Added Utility version info.
Added Hostname info.
Changed a variable to prevent conflicts with future PowerShell versions.

2020-03-18: Version 20.03.18 ‘Lock’

Improved feedback in the console and log.
Improved documentation.

2020-03-17: Version 20.03.17 ‘Lock’

Added logging.
Added config report.
Made available on PowerShell gallery.
Refactored code.

Remove Win10 Apps Utility - Update 20.03.13

Fri, 13 Mar 2020 19:59:28 +0000

Customisable Windows 10 app removal utility

I’ve refactored my old Remove UWP script and renamed it to bring it in line with my recent utility updates.

Version 20.03.13 ‘Cool’

Refactored code.
Backwards compatible.
Added logging.
Added config report when ran.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.

Remove Win10 Apps Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Logon Audit Utility

Thu, 12 Mar 2020 16:05:25 +0000

Really simple log on/off auditing utility

Logon Audit Utility is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

Thanks
-Mike

Features and Requirements

The utility should be run on a client machine.
It is ideally triggered as a logon/logoff script by Group Policy.
Any files that the script needs to access should be accessible from a client device.
It can be used to log to a file, send to a webhook or both.
The utility requires at least PowerShell 5.0.
Tested on Windows 11, Windows 10, Windows Server 2022, Windows Server 2019, Windows Server 2016 and Windows Server 2012 R2.

Configuration

Here’s a list of all the command line switches and example configurations.

Command Line Switch	Description	Example
-Logon	Use this option to log a log on event.	N/A
-Logoff	Use this option to log a log off event.	N/A
-Webhook	The txt file containing the URI for a webhook to send the log file to.	[path]webhook.txt
-L	The path to output the log file to.	[path\logs]
-Help	Display usage information. No arguments also displays help.	N/A

Example

`1`	`[path\]Logon-Audit.ps1 -Logon -L [path]`

The above command will record a logon event for the currently logged on user to the log file and also to Teams.

Change Log

2023-04-28: Version 23.04.28

Changed the -Teams switch to -Webhook to better represent it’s function.

2022-06-14: Version 22.05.30

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

2021-12-08: Version 21.12.08

Configured logs path now is created, if it does not exist.
Added OS version info.
Added Utility version info.
Added Hostname info.
Changed a variable to prevent conflicts with future PowerShell versions.

2020-03-12: Version 20.03.12 ‘Chick’

Added option to send an event to Microsoft Teams.
Refactored code.
Fully backwards compatible.

2019-09-28 v1.0

Initial public release.

Log Manager Utility - Update 20.03.11

Wed, 11 Mar 2020 12:43:18 +0000

Flexible clean up and backup of log files

This is a minor update to my Log Manager Utility - there was a switch alias which was conflicting with a variable and preventing the utility from running correctly. The previous command line switch of -LogPath is now -LogsPath.

Version 20.03.11 ‘Cow’

The previous command line switch of -LogPath is now -LogsPath. This fixes an issue with a duplicate variable and switch alias preventing utility from running currently.

Log Manager Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Log Manager Utility - Update 20.03.06

Mon, 09 Mar 2020 14:13:07 +0000

Flexible clean up and backup of log files

I’ve completed a lengthy and much needed overhaul of Log Manager Utility. I’ve added a few new features including one suggested from a user. Please be aware that this new version is not backwards compatible with the previous versions and you will need to reconfigure it before use.

2020-03-09: Version 20.03.06 ‘Fish’

Added custom name for zip file based on user feedback.
Added option to use 7-zip for zip file backup.
Added time to keep backups for.
Added config report.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.
Refactored code.

Log Manager Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

WSUS Maintenance Utility - Update 20.03.03

Thu, 05 Mar 2020 18:48:44 +0000

Clean up your WSUS

I’ve overhauled WSUS Maintenance Utility and have added some new features which were long overdue. It also includes all the same improvements that the other refactored utilities have.

2020-03-05: Version 20.03.03 ‘Burger’

Added SSL option for connecting to the WSUS server.
Made the -Port switch optional. If it is not specified the default port is used. If -WsusSsl is specified, the default port for SSL is used.
Added config report.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.
Refactored code.
Fully backwards compatible.

WSUS Maintenance Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Office Update Utility - Update 20.03.01

Tue, 03 Mar 2020 15:19:21 +0000

Office Update Manager for 365/2019

I’ve overhauled Office Update Utility and have improved the reporting. It also includes all the same improvements that the other refactored utilities have.

2020-03-03: Version 20.03.01 ‘Crosshair’

New features:

Refactored code.
Fully backwards compatible.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.
Config report matches design of Image Factory Utility.

Office Update Utility can be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Quick update: Windows 10 2004 (20H1)

Sun, 01 Mar 2020 00:14:31 +0000

Update 2020-06-13: An update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes the boot loop issue and replaces Johan’s workaround with an officially supported fix. Details on how to install it are on Michael Niehaus' blog post here. and you can download the fix here. I will add installation instructions to the walkthrough here.

Hi all, So far I’ve had no success with building and capturing a Windows 10 2004 image with MDT and the 1903 ADK (including WinPE) or the pre-release ADK and WinPE. Currently what happens is the image installs Windows without issue and run sysprep, but when booting into MDT’s WinPE to do the capture, it never gets to WinPE. It just boot cycles and then the VM turns off. Very strange. 🤔 If you have a similar experience or if you have been able to get Win 10 2004 to build and capture (and I’m just missing something), I’d very much like to hear from you. - please leave a comment. Thanks!

-Mike

Hyper-V Backup Utility - Update 20.02.28

Fri, 28 Feb 2020 15:10:25 +0000

Flexible Hyper-V Backup Utility

Just a minor update to fix a non-critical issue with the previous version and to bring it in line with the recent update of the Image Factory Utility.

2020-02-28: Version 20.02.28 ‘Artifact’

Fixed e-mail report extra line breaks in Outlook 365, Version 2001.
Config report matches design of Image Factory Utility.
Improved and simplified code.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Image Factory Utility - Update 20.02.24

Thu, 27 Feb 2020 18:31:05 +0000

Automate Creation of WIM Files

I’ve just completed testing the new Image Factory Utility. It’s been completely overhauled and has some small new features added.

2020-02-27: Version 20.02.24 ‘Robot’

New features:

Refactored code.
Fully backwards compatible.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.

Image Factory Utility can also be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Hyper-V Backup Utility - Update 20.02.14

Tue, 18 Feb 2020 10:32:44 +0000

Flexible Hyper-V Backup Utility

I’ve spent the past week away from home, and so I’ve been working on refactoring my Hyper-V Backup Utility and adding new features requested by users.

Version 20.02.14 ‘Valentine’ Current known issues:

The e-mail report has extra line breaks in Outlook 365, Version 2001.

New features:

Refactored code.
Fully backwards compatible.
Added option to use a working directory to stage backups before moving them to final backup location.
Added option to use 7-Zip for backup compression.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.

Hyper-V Backup Utility can be downloaded from:

See the full documentation available here.

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 10: 5 Years Later

Mon, 27 Jan 2020 13:43:25 +0000

Windows 10 is five years old this year. In ‘old world’ terms, it would be about time for a brand-new release around summer/autumn time but alas, this is no longer the case with the software-as-a-service model. With this year being such a milestone for Windows 10 and with the end of life of Windows 7 – Microsoft’s most popular OS in recent times, I thought it would be good to take a look back and review Windows 10’s progress these past few years. I’m going to be a bit critical about a few things, but my criticisms are intended in the spirit of providing feedback and are only my opinion. My experiences and opinions won’t match others.

I’m a long-time user and fan of Windows, as a consumer, enthusiast, and professional. During Windows 10’s lifetime there have been changes that no doubt have affected how the sausage and egg McMuffin that is Windows 10 is made (sorry, I’m really hungry). Not to mention all the feedback that MSFT are attempting to respond to, as well as developing Windows as a product in the direction that they want to as a corporation. Let’s start with the positives!

Two releases, every year.

A positive of this release schedule is that Windows is updated, and new features are added quickly. In the old days, when a new standard or feature became common place in the tech world, sometimes it could be added with a service pack, but often it was added to the next major release of Windows and you either had to make do without it, or use software from a third party which wasn’t always integrated into the system well, if at all.

The 2019 updates.

After 2018 being a bit of a mess when it comes to the feature updates, I was glad to see that 2019 turned out much better. 1903 (19H1) introduced new features and 1909 (19H2) brought bug fixes and was otherwise a small and problem-free. There were no major bugs (like 1809’s file deletion bug) and if Microsoft can stay on this path, I’ll be happy as a consumer and an admin. I felt Microsoft had lost a lot of good will with Windows 10 updates in the past, but I think 2019 made up some ground. I hope it continues with the 2020 updates.

A more transparent development process.

With the Feedback app integrated into Windows 10, it’s easy to send feedback to Microsoft on any aspect of Windows and often see a response from the engineers. This is a huge change from old days where it was near impossible for normal users to send feedback to Microsoft. Also, with the Windows Insiders program it’s now easy to get work-in-progress builds of future releases and provide feedback on changes and new features that are being considered.

Modernisation.

Windows 10 has been a huge step in updating Windows and keeping it relevant to the world today. Over the years new icons and new UI designs (have been created, and the daunting task of migrating the old control panel to a new, more modern settings area was started. I can’t fault them for trying new things and taking a few risks. A few examples of modern features that I use every day is the emoji keyboard, of all things! Along with other typing and keyboard improvements. This is another good example. Are these critical to the function of Windows? No, but it’s great to have them introduced. Another example is the development of the Your Phone app and linking your mobile phone to your Windows device. I love seeing this type of new feature, even though some I never use myself I can see how others would benefit. There are more new features than I’m giving credit for, so here’s a blog post from MSFT on some feedback-driven changes.

IT Pro resources.

There’s been a huge improvement in providing tools and documentation for IT pros in the last few years. Microsoft have been quietly working on building their docs pages, building new tools and supporting existing tools. Although Microsoft are focussed on the cloud, they’re at least still working to support hybrid and on premises configurations. “But for how long!?” I hear you say. True, but at least they’re not pulling an Apple and just saying “no”.

Now on to my less positive points.

Inconsistent UI.

During the lifetime of Windows 10 there have been a lot of work on updating and consolidating the Windows UI to a specific look and standard, but it has resulted in different areas of Windows and its in-box apps all looking different, almost stuck in various time capsules of this initiative as the UI design has been tweaked and changed along with the development of Windows, but independently. Windows has always had this problem to some extent, but with the increased speed of releases of Windows 10 it’s even more noticeable.

The Control Panel to Settings migration.

After five years this appears to still be in progress. Not much seems to have happened with the migration in the past year or so - perhaps there’s a problem blocking them from moving forward with it, but nevertheless there are still many control panel applets that haven’t been moved over and it only adds to the impression that the core of Windows 10 is unfinished. This is perhaps the second most common criticism. I would imagine that maintaining compatibility is something which affects this, but it’s also been five years. It’s another big factor in the impression that the modernisation is only skin deep; only updating the aspects that the common user sees.

Where in the world did Start Menu search performance go?

As of v1903 searching for programs using the Start Menu has returned to the same level of user experience as Windows 7 & 8.1. This is an extremely welcome change; however, it shouldn’t have taken this long to be fixed as the feedback on this problem has been around for years, and with Windows now being software as a service, it should have been fixed sooner. Arguably the problem shouldn’t have existed in the first place. My theory is that integrating Cortana into Windows 10 initially caused the problem and it’s only now been fixed because Cortana is being “refocused” and has been separated from the system search. If this is true, I think this is a negative effect of not being afraid to try new things; drastic changes are made to a perfectly functional feature of the operating system because a new product is being pushed. I would give credit for going all in and making a serious attempt to make Cortana successful, but it shouldn’t have made a core feature worse.

Power Toys.

The new Power Toys are great, they add some very useful functionality, but these are the type of new features that should be added to Windows. According to Microsoft the Power Toys are for power users - which is great, but virtual desktops were added, and I would class this as a power user feature as well. So why are some power user features integrated into Windows and others only available via a separate download? Also, recently there’s been news that a future release of the Power Toys will have a new program launcher - Power Launcher, which again looks great. This type of new feature should be in a future Windows build though, also this would have been even better news if start menu search hadn’t just been fixed in 1903.

In-box apps.

Over the years Windows 10 has introduced and improved on many apps included with it. Some intended to replace old apps and add new functionality and some entirely new apps. I’ve a few examples I want to examine. Groove Music was an excellent new app that had a lot of development, a passionate community and the app improved with every new version. It supported Microsoft’s streaming music service, allowed you to play your own music from OneDrive cloud storage and was focussed and performant. Then Microsoft killed off its music service and stopped development, and with a final update removed the functionality to play music from OneDrive and added an advert for Spotify. You hate to see it. This seems like a huge waste of time and effort. What a shame. On the flip side of the coin, Microsoft Photos is an app that I’m less positive about. In many ways it’s a great demo app to show off the then new features of UWP and demonstrate impressive animation and design, but fails as an everyday image viewing app, in the performance area. The performance when simply opening and displaying an image is not as good as the old Windows Photo Viewer or many third-party image viewers. The apps feature set appears to have been made to emulate Google’s long-dead Picasa photos application and although it has some good basic photo editing and video creation features, it seems like it should be an optional download or part of a “Windows 10 Plus Pack”, not the default image viewer for the OS. One entirely new app was Paint 3D. It was and still is a decent application, but it’s relevance to the Windows ecosystem is unclear. At the point it was released Microsoft was promoting its Windows Mixed Reality devices and software. Since then Mixed Reality appears to have quietly disappeared, or perhaps it’s been merged with HoloLens? In any case it’s a good app, but I’m not sure why it exists. Many of these new apps have obviously been created to modernise Windows and to replace old and out of date applications like Windows Photo Viewer and Windows Media Player. Quick side note, both these specific applications still work and can be enabled, but they’re a bit buggy and unsupported. I fully expect them to be entirely removed at some point.

App updates attached to OS updates.

The old Edge browser had its updates tied to the release of a new Windows version. Even with the accelerated update cadence of Windows 10, it makes no sense to create a new modern browser and tie its updates to the operating system updates. One of the advertised features of the new Chromium based Edge browser is that it is being updated separately from Windows. I’m glad we got there eventually. A second example comes from Paul Thurrott who recently wrote about an update to the Calculator app that was released via an entire new Windows build in the Fast ring. The new feature was graphing, which is a welcome new feature for sure, but why is this update to the calculator application tied to an Insider build, shouldn’t it be pushed out through the store? The new Terminal isn’t tied to Windows releases and that’s a brand-new command line interface. If anything were to be tied to the OS, I would think that would be, not the calculator app. I understand that apps should be tested before being made generally available, but it is possible to push app updates out via the store only to specific rings and insider builds, because it’s been done before with the preview version of the Microsoft Photos app.

Wrapping it up.

My impression of Windows 10 as a project is that it feels directionless. It appears like different teams responding to feedback and corporate mandate, but with constantly changing goals, like weekly. New features are added to builds that are pushed to millions, only for the features to be abandoned soon afterwards and never developed or spoken of again. I do think Windows 10 is a good operating system, every version has been an improvement over the previous one. Going back to Windows 7 now feels like going back in time in many ways. Professionally I didn’t consider Windows 10 good enough to begin broadly deploying until version 1607 and that was only because of the level of familiarity I had with the OS itself, the environment I worked in, and the users I worked with. My hope for 2020 is that Windows 10 development finds some kind of focus, maybe the 2019 updates where the beginning of it. In the future I’d like to see there be a focus on shipping features of higher quality initially, rather than taking months to make them usable. The in-box apps and non-system additional utilities such as Calculator can be updated and delivered via the store, or their own update mechanisms in the case of Chromium Edge. It’d be great to see a leader focus on a direction to take Windows in future. I look at the Xbox division under Phil Spencer (I hate to single out one person, but he has turned it around in many ways since he’s been in the role) and I’d like to think that Windows and the ecosystem can be hugely improved if it had that kind of leadership. I look forward to seeing what Windows has in store for 2020 and beyond, there’s lots of good work being done all over Microsoft and it would be good to see it all come together.

I hope you found this useful, please consider supporting my work with PayPal.me. If you have any questions or comments, please leave them below.

-Mike

An explanation and changes ahead for the coming year.

Wed, 22 Jan 2020 00:17:52 +0000

Hi all,

You might have noticed some changes in the last few months to the site and the content - specifically that some posts go up with passwords on them initially and I want to explain why this is. I’ve decided to start a Patreon and also accept donations from anyone who is willing to “toss a coin to your Tech-Witcher”. One of the rewards to anyone who becomes a patron (at any level) is early access to articles on the site and videos on my new tech focussed YouTube channel.

I’m facilitating this by temporarily password protecting new posts for a few days. If you aren’t aware of Patreon, it’s a membership site where you can become a patron of creators and support them financially for the work that they do. My Patreon page currently has two tiers - the lowest one is $2/month and for that you will receive early access to content, exclusive posts, along with your name in the credits of my videos and on the site. The reason for this change is not that I’ve simply gotten greedy. I used to have a full-time sys admin job that I was very proud of and it paid well enough for my desired standard of living. Unfortunately, I no longer have that job and additionally I had some mental health problems. If you take nothing else away from this post, I’d like you to take away that IT workers need to take care of themselves just as much as anyone else. We have a weird job and it isn’t appreciated by most. A lot is expected of us and burn out or “crunch” (as the video game industry calls it) is very real - self-inflicted or otherwise. Even well-meaning managers and co-workers sometimes, inadvertently put impossible expectations on you. You owe it to yourself and the people who care about you as a person, to take care of yourself. I think it’s also important not to tie your career to your own sense of self-worth.

In short, last year wasn’t a good one for me. I lost a lot of good stuff and have had to give myself a hard reset. I care about the work I’ve done on this site for the past 4 years and I want to continue to do it. To pull the curtain back a little, I’m fortunate that this site gets a lot of traffic. On a bad day I get hundreds of unique visitors, and this is based on last year’s statistics which was my “worst” year yet. It’s an unrealistic comparison but if I somehow got paid £1 per unique visitor last year, I’d have been paid a lot more than I did for my full-time job.

Looking ahead, I already have a road map laid out for future content. I’ll be writing more articles along with making videos for the YouTube channel. Future videos will have higher production values than the ones released in 2019. Additionally, I’m effectively a freelance worker now. If you’d like my services or want me to work with you on a project, please get in touch, I’d love to hear from you.

Thanks so much for reading. As always if you have any questions, please leave a comment. Cheers.

-Mike

Team Viewer Silent Install and Configuration

Tue, 21 Jan 2020 13:33:58 +0000

In order to make a recent Bash Bunny payload, I needed to investigate how to install and configure Team Viewer without user interaction. This post will go through how I achieved that.

My TeamViewer configuration was focussed around setting a personal password (a static password that can be used to access the computer) and installing TeamViewer as a service so the computer can be remotely controlled without a user being active. Team Viewer version: free edition 15.1.3937 Windows version: 64-bit 1909 OS Build 18363.592 I’ve uploaded some example files to my GitHub. These are aimed at the BashBunny payload, but the example-setting.reg file and PowerShell script may be of use to you.

Capturing Desired Configuration

In order to capture your desired configuration, you’ll need to manually install TeamViewer and configure it on a test system. You’ll then need to export the settings to a .reg file. Important note: you must do this through the program itself. If you wish to set a personal password, don’t do it in TeamViewer as it will not import correctly.

However, you’ll be able to set the password in the Export Options.

Open TeamViewer
Extras Menu > Options > Advanced >Show advanced options
Scroll to the bottom > TeamViewer options
Export options to a *.reg file
Set location and name of reg file
Select the sections to export. Important Note: I recommend selecting all sections, along with Export user specific settings as default for all users.
Set the personal password you wish to use here.
Export the settings.

Editing Captured Configuration For Silent Import

In my testing, I could not get the settings to take effect if I simply imported the reg file via command line, PowerShell, or even just double clicking the reg file and importing via Windows. It would only work using the Import settings feature in TeamViewer. However, I discovered a way around this. We must add some additional settings to the reg file so it can be imported via script. If using 64-bit Windows, you must add WOW6432Node to all the registry paths in the reg file. For example, any path matching this:

[HKEY_LOCAL_MACHINE\SOFTWARE\TeamViewer]

and this:

[HKEY_CURRENT_USER\SOFTWARE\TeamViewer]

Will need to be changed to:

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TeamViewer]

and

[HKEY_CURRENT_USER\SOFTWARE\WOW6432Node\TeamViewer]

Secondly, you’ll need to add this line to the end of the reg file:

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TeamViewer\DefaultSettings]

“Autostart_GUI”=dword:00000001

Save the reg file.

Deploying and Configuring TeamViewer Silently

Now we’ll create the script to install TeamViewer and import the settings. Below is a PowerShell script I created. Here’s what the script does:

Install TeamViewer silently and wait for the install to finish before continuing.
Stop the TeamViewer service.
Import the .reg file containing our edits.
Start the TeamViewer service.
Get the TeamViewer ID needed for connection and save it to a location. Name the file after the computer name.
Remove the TeamViewer icon from the desktop.

PowerShell Script:

# Vars
$DestFile = "$env:COMPUTERNAME-TV-ID.txt"
$ToolPath = "\\netlogon\software\TeamViewerSetup"
$DestPath = "\\server\share$\TeamViewerIDs"
$Dest = "$DestPath\$DestFile"
 
# Install Team Viewer
Start-Process -wait $ToolPath\TeamViewer_Setup.exe /S
Start-Sleep -Seconds 2
net stop teamviewer
Start-Sleep -Seconds 2
reg import $ToolPath\tv-settings.reg
Start-Sleep -Seconds 2
net start teamviewer
Start-Sleep -Seconds 2
(Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\TeamViewer' -Name ClientID).ClientID > $dest
Remove-Item "$env:public\desktop\TeamViewer.lnk"

I hope you found this useful, please consider supporting my work with PayPal.me.

If you have any questions or comments, please leave them below.

-Mike

Get Started with Windows Update for Business (WUfB)

Tue, 24 Dec 2019 01:48:36 +0000

You may have seen the option to use Windows Update for Business and wondering what it brings to the table when compared to WSUS and SCCM. Windows Update for Business (WUfB) is a good way of simplifying and automating the deployment of Windows Updates without using any on-premises infrastructure. The downside is that you do loose some control, but the benefits outweigh the drawbacks. As I always say, it does depend on your infrastructure and environment though. The biggest aspect of control that you lose is the ability to completely block an update. In WSUS you can just decline it and it will never deploy, but with Windows Update for Business you can only defer (delay) updates. The benefits of using Windows Update for Business are:

No need to manage the approval of individual updates.
You don’t need to dedicate infrastructure to running Windows Server Update Services (WSUS).
You can receive driver and other updates, without dedicating infrastructure to it – managing driver updates with WSUS is difficult and usually not recommended.
It simplifies configuration of client devices receiving updates.

Creating a Group Policy Object

To get started using Windows Update for Business, we’re going to create a Group Policy to test it out and use an Active Directory group to limit the devices we move over to WUfB.

Create a new GPO called: WUfB_Test Below I’ll list the settings to configure in the GPO and what effect they have.

Computer Configuration/Policies/Administrative Templates/Windows Components/Delivery Optimization

Download Mode - Enabled

Download Mode: LAN (1)

Explanation: This will enable your clients to provide updates to other clients on the local area network. This will help prevent all client devices from going to the internet to retrieve updates and saving on bandwidth usage.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update

Configure Automatic Updates - Enabled

Configure automatic updating: 4 - Auto download and schedule the install

Install during automatic maintenance: Un-checked

Scheduled install day: 0 - Every day

Scheduled install time: 03:00

Every week: Checked

Install updates for other Microsoft products: Un-checked

Turn off auto-restart for updates during active hours - Enabled

Active Hours Start: 8am Active Hours End: 5pm

Explanation: With the settings above Windows will download and install updates automatically without user intervention. If an update requires a restart Windows will not do so during the active hours set.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Windows Update for Business

Manage preview builds - Enabled

Set the behaviour for receiving preview builds: Disable preview builds

Explanation: These settings prevent the preview builds of Windows 10 from installing.

If you do want a collection of devices that install the Insider preview builds of Windows 10 for testing in your organisation, then you should create another GPO for that.

Select when Preview Builds and Feature Updates are received - Enabled

Select the Windows readiness level for the updates you want to receive: Semi-Annual Channel

After a Preview Build or Feature Update is released, defer receiving it for this many days: 365

Pause Preview Builds or Feature Updates starting: leave blank

Explanation: This is where you select the update channel, which at this point in time only really matters if you are deploying preview Insider builds of Windows 10. There does appear to be a bug in the Group Policy Management console where it reports the channel as always being ‘Semi-Annual Channel (Targeted) for 1809 and below (Deprecated)’. The settings above will prevent Windows 10 from downloading and installing any of the major feature updates for one year. For example, when running Windows 10 v1903, it will not download the update to Windows 10 v1909 for one year (365 days).

Select when Quality Updates are received - Enabled

After a quality update is released, defer receiving it for this many days: 7

Pause Quality Updates starting: leave blank

Explanation: These settings control when the quality updates can be installed. The quality updates are the monthly updates released for Windows 10. You may want to defer these for a week or two just in case there are any issues with them.

Now we’re going to use an Active Directory group ensure that this GPO only applies to the clients we want it to.

Create a group in Active Directory called: WUfB_Test.
Add in the computer accounts you want to use to test Windows Update for Business.
Using Group Policy Management, go to Group Policy Objects > WUfB_Test.
Click on the GPO and select the Scope tab in the larger right-hand pane
Under the Security Filtering section, remove the Authenticated Users group and add the WUfB_Test group.

All we need to do now is link the GPO to an OU that contains the devices we want to test WUfB with.

Final Thoughts and Recommendations

Something I haven’t covered in this post is how to get telemetry on the status of updates across the devices in your organisation and that’s because to be honest, I haven’t been able to get it working yet. According to Microsoft’s documentation, it is available via a free service in Azure, but I haven’t been able to find it yet let alone enable it. I’ll keep you posted. There are two Group Policy settings that don’t appear to have any effect on Windows 10 or Windows Server 2016+ devices. If your experience if different, please let me and others know in the comments.

Install updates for other Microsoft products - This used to effect Windows 7 and possibly Windows 8, but these days it doesn’t appear to do anything. It may take some effect on older or slightly obscure pieces of software, however.

Install during automatic maintenance - This setting only appears to take effect on Windows Server 2012 R2 devices. As I mentioned earlier in the post, I would suggest that depending on your environment you might want to set up a couple of different GPOs so you could have a testing group and then a production group for updates. You could also configure a GPO to enable the deployment of Windows Insider builds within your organisation to test software as well as deployment. You could also use WUfB for servers as well. WSUS was first released during the Windows XP and Windows Server 2003 timeframe and back then it was a godsend. Over the years as Windows has changed, WSUS has had more and more added to it and these days it feels very much like part of the legacy and on-prem suite of products that aren’t going to get any updates in future. We can debate on whether this is a good thing or not in the comments section and on Twitter, but hopefully this post helps bring awareness to Windows Update for Business and how you might be able to use it.

I hope you found this post useful in some way, please consider supporting my future work by checking out my PayPal. If you are unable or prefer not to use either of those methods, no problem - sharing my work and following me on social media is a huge help. Thanks!

If you have any questions or comments, please leave them below.

-Mike

App Spotlight: Directory Opus

Sat, 21 Dec 2019 21:27:20 +0000

Directory Opus is a file manager – remember those? I haven’t thought about them for years. DOpus (as it’s known for short) has a long history starting on the Commodore Amiga where in later versions it was available as a Workbench (the Amiga’s operating system) replacement. I only used Directory Opus version 4 on the Amiga, but it was a great file manager and was a great tool to have back then.

Directory Opus became available on Windows in the early 2000’s and is now up to version 12. I’ve been using it non-stop over the last few weeks to do a lot of file management where it’s really helped provide more features over standard Windows file explorer. DOpus is incredibly configurable. Almost everything about the program can be customised, even the visual aspects of the program, down to the icons. There is an active community around the program providing user created themes as well as advice and support. Support is also available from the developers. DOpus can be used as a separate program or as a complete Windows explorer replacement, much like the old Amiga versions of the program could be used to fully replace the OS. Even though there are plenty of free Windows file managers, Directory Opus is fully featured and, in my opinion, worth the $90 Australian. That is a one-time payment for the current version and all updates to the next major version. Looking back at the release history, major versions come out every few years and upgrade prices are discounted. You can run the program in evaluation mode for up to 60 days and see if it suits your needs. I highly recommend Directory Opus. It handles millions of files, complex operations and can help make heavy file management tasks much more manageable. You can check out Directory Opus at GPSoft’s website here: https://www.gpsoft.com.au

Please note: This post is not sponsored content. I purchased Directory Opus with my own funds.

If you would like to support me with a one-time donation then please use PayPal. If you are unable to or prefer not to support me monetarily, no problem! Sharing my work and following me on social media would be a huge help. Thanks!

If you have any questions or comments, please leave them below.

-Mike

The New Microsoft Edge - The Microsoft Alternative To Chrome

Sun, 15 Dec 2019 16:00:35 +0000

Microsoft have been developing an all new version of their web browser Edge and will release it in early 2020. If you are familiar with the existing Edge browser, it’s the same in name only - the new Microsoft Edge is vastly improved in many ways. The new Edge is now based on Chromium, the same project that Google’s Chrome browser is based on. So, this new version of Edge will share all the compatibility that Chromium based browsers have. The new Edge shares a lot of features with Google Chrome; however, Microsoft have ported across the unique features from old Edge, with more to come. Both Google Chrome and the new Microsoft Edge are based on the open source Chromium project and Microsoft are making contributions back to the project, rather than developing their own browser in parallel. This new version of Edge is cross compatible with macOS, Windows 7, 8, 8.1, and 10 as well as server versions 2008 R2, 2012 R2, 2016, 2019 and above. The new Edge is independent of the Windows and is updated through its own update process, like Google Chrome. The browser is currently available to test in three channels:

Beta - updates every 6 weeks
Dev - weekly updates
Canary - daily updates

You can find out more and download it for yourself here: https://www.microsoftedgeinsider.com

You can download offline deployment packages and group policy templates here: https://www.microsoftedgeinsider.com/enterprise

Please consider supporting me with PayPal. If you are unable to or prefer not to support me monetarily, no problem! Sharing my work and following me on social media would be a huge help. Thanks!

If you have any questions or comments, please leave them below.

-Mike

Microsoft Deployment Toolkit for the Enthusiast, Home or Small Business

Thu, 05 Dec 2019 17:49:42 +0000

This article is directed towards enthusiasts, IT professional’s for small businesses, or anyone who wants to create custom images and doesn’t have volume licensing, an Active Directory domain, or a lot of server infrastructure. I hope this article is useful to you, if it is please consider supporting my work with PayPal. In this walkthrough we’re going to cover:

Installing Microsoft Deployment Toolkit and its dependencies on Windows 10 Home/Pro Edition.
Creating a Task Sequence to create a custom Windows 10 Home/Pro Edition image.
Creating a bootable USB drive containing the custom Windows 10 image.

What you’ll need:

A PC running at least Windows 10 Home Edition.
A Virtual Machine to create the custom image.

Here are the links to the software we’ll be using:

Windows 10 1903 Assessment and Deployment Kit (ADK)
Windows System Image Manager (WSIM) 1903 update
Windows PE add-on for the ADK
Microsoft Deployment Toolkit (Build 8456)
Windows 10 1909 x64 ISO from the Media Creation Tool
Some of my customised MDT files to help you get started.

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 10 1903 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection.
On the Select the features you want to install screen select:
- Deployment Tools
- Imaging and Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
Install WinPE by running the adkwinpesetup.exe. There is no specific configuration during the install wizard.
Install MDT by running the MicrosoftDeploymentToolkit_x64.msi. There is no specific configuration during the install wizard.

Install the Windows System Image Manager Update

Unzip the archive containing the WSIM 1903 fix.
Copy the two files: ImageCat.exe and ImgMgr.exe to the location the ADK is installed to. The default location is: C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\WSIM.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Under Deployment share path enter the path: C:\DeploymentShare
Under Share name, you can leave it as DeploymentShare, just remove the ‘$’ on the end so the share is not hidden.
Enter a description in the Deployment share description text field.
On the Options screen, accept the defaults as we’ll change them later.
Complete the wizard to create the share.
Browse to C:\DeploymentShare and right-click on the folder and go to Properties > Sharing > Advanced Sharing > Permissions.
Add the Administrators and Users groups and check Allow Full Control permissions.

Obtaining the Windows 10 ISO

Run the Media Creation Tool that we downloaded earlier.
After accepting the EULA, choose the Create installation media for another PC option.
Choose the language, edition and architecture of Windows to download.
On the Choose with media to use screen, choose ISO.
Browse to the location where you wish to save the ISO. Give it a descriptive name.
The ISO will download.

Converting the ESD to a WIM

Mount the Windows 10 ISO in File Explorer.
Create a folder on the root of the C:\ drive called w10-src and copy all the files from the ISO to it.
Open up an elevated command prompt.
Change directory to the sources directory of the Windows 10 files: cd C:\w10-src\sources
Now we’re going to convert the install.esd file to a WIM file as ESD files are not compatible with MDT.
But first we need to know which index to export. To do this run the following command in the elevated command prompt: dism /Get-WimInfo /WimFile:install.esd
A list of Windows 10 editions will be displayed, each with their own index number. Choose which one you want and make a note of the index number.
Now we’re going to convert the ESD to a WIM. Run the following command, but substitute the index number for the edition you wish to install: dism /export-image /SourceImageFile:install.esd /SourceIndex:[x] /DestinationImageFile:install.wim /Compress:max /CheckIntegrity
We now have a WIM file for MDT to work with.

Adding an Operating System to MDT

Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the folder that we copied the Windows 10 files to from the ISO - in this case it was: C:\w10-src\ as the Source directory.
For the destination directory name enter Windows 10 and complete the wizard.

Importing Applications

If you want to add some applications to be a part of your custom image, here I’ll cover how to add them into MDT.

Download or copy the files needed for installation. For an example, let’s use VLC.
Using File Explorer browse to C:\DeploymentShare\Applications.
Create a folder called VLC and copy the installation file to it.
Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application without source files.
Give the application the name: VLC.
For the Command line enter the exact name including the extension of the VLC installation file, and then add a /S for a silent install. Make sure it is a capital S. For example: vlc-3.0.8-win64.exe /S
In the Working directory text box, enter: .\Applications\VLC
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

This will create an application entry for VLC, which will silently install VLC using the command line that we entered. You will need to do this for each application you want to install. Different applications have different ‘silent’ or ‘quiet’ install methods. They can be found online. Here’s are some command lines for other software:

Google Chrome - Enterprise Installer

`1`	`msiexec /I googlechromestandaloneenterprise64.msi /qn`

Adobe Reader - Enterprise Installer

`1`	`AdobeReaderDC.exe /sAll`

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter an ID such as: W10-1909-H.
Name it Build Windows 10 1909 x64 Edition.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 1909 x64 Edition.
Select Do not specify a product key at this time.
Enter a Name and Organization.
Select Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the task sequence and add applications.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select an application from the list and change the name Install Applications to something more descriptive.
To install other Applications, copy and paste the Install Applications item and repeat the previous steps.
Click Apply and close the task sequence.

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. You can get my example files I made for the YouTube video from my GitHub.

Configuring Bootstrap.ini

This configuration will setup the WinPE deployment environment to automatically login. For the UserID and UserPassword you should use a user on the PC that is hosting the deployment share. You’ll also need to change the DeployRoot and UserDomain based on your PC name.

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\PC-NAME\DeploymentShare
UserDomain=PC-NAME
UserID=user1
UserPassword=pass1
SkipBDDWelcome=YES

Configuring CustomSettings.ini

The settings below automate MDT to build an image for capture. This enables you to use the resulting image as a custom install. On the Rules tab of the Deployment Share properties window, add the settings below. You’ll need to change some settings based on your PC name.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Image
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\PC-NAME\DeploymentShare\Captures
BackupFile=Captured-Image.wim
FinishAction=SHUTDOWN
SLShare=\\PC-NAME\DeploymentShare\Logs

We now need to create the boot media in order to boot the Virtual Machine into WinPE for deployment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is located in the Boot folder in the Deployment Share. Copy the LiteTouchPE_x64.iso file to a location where the virtual machine will be able to access it. Create a new virtual machine with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs.
2x vCPUs
4GB of RAM
Network Adapter with access the local network.
Virtual Hard Drive of at least 40GB, preferably on an SSD.
Boot from CD using the LiteTouchPE_x64.iso from MDT.

Start the VM and it will boot from the LiteTouchPE_x64.iso into WinPE.
You will be presented with a screen with the name of the task sequence we created earlier. Select the Task Sequence and click Next.
Click Next and the task sequence will begin.

The task sequence will install Windows 10, run Windows Update and install the applications we put in the task sequence. When this process completes the image will be captured and the VM will shut down. Once we have a final WIM file, we need to create an ISO from it.

Creating an ISO From A Captured WIM

Create a new copy of the win10-src files that we created at the beginning of this walkthrough. For example, I’ll create a new copy in a folder called win10-src-new.
Navigate to C:\DeploymentShare\Captures and copy the WIM file to the root of the C:\ drive.
Rename the WIM file to install.wim and move it to C:\win10-src-new\sources. Overwrite any old install.wim files.
You can safely delete the old install.esd if it is still in the source folder.
To create the ISO, we must first run a BAT file. In an elevated command line, run the following command, including the quotes: “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\DandISetEnv.bat”
Now run the following command, please be aware that you must change some of the paths to reflect your own file system:

`1`	`oscdimg.exe -m -o -u2 -udfver102 -bootdata:2#p0,e,bC:\Win10-src-new\boot\etfsboot.com#pEF,e,bC:\Win10-src-new\efi\microsoft\boot\efisys.bin C:\Win10-src-new\ C:\win10-custom.iso`

When this command completes, you should have a new ISO file in the root of your C:\ drive called win10-custom.iso. You can now use a tool such as the Windows USB/DVD tool to make a bootable USB drive from the ISO and install your own custom Windows 10 image.

If you have any questions or comments, please leave them below. I hope this article is useful to you, as I said at the beginning of the article, please consider supporting my work with PayPal.

-Mike

Remove MS Store Apps Utility

Wed, 04 Dec 2019 15:25:17 +0000

Customisable Windows 10/11 Microsoft Store App removal utility, previously known as Remove-Win10-Apps

Remove MS Store Apps Utility is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

Thanks
-Mike

Features and Requirements

Remove specified apps for the current logged on user.
Remove specified apps from the system for all users.
Can be used for imaging and OS deployment, as well as individual user.
Can be used on an offline Windows image.
Requires a text file with a list of the apps to remove.
Tested on Windows 10 and Windows 11.

How to get a list of apps to remove

To create a text file with a list of the apps to remove, run the following and copy and paste the app names you wish to remove into a txt file and save it.

`1`	`Remove-MS-Store-Apps.ps1 -PCApps`

To get a list of apps that are installed for the current user, use this command:

`1`	`Remove-MS-Store-Apps.ps1 -UserApps`

How to find the index number of the image in the wim file

Run the following command to find out how many images are present in the wim file:

`1`	`Get-WindowsImage -ImagePath [path\]install.wim \| Format-Table -Property ImageIndex, ImageName`

App Names Table

Here is a table of app names in PowerShell and what they relate to in Windows.

Windows 11 Apps

PowerShell Display Name	App name	Notes
Clipchamp.Clipchamp	Clipchamp	New in 22H2
Microsoft.549981C3F5F10	Cortana	No change
Microsoft.BingNews	Microsoft News	No change
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GamingApp	Xbox	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.HEVCVideoExtension	None	New in 22H2
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	No change
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.Paint	Paint	No change
Microsoft.People	People	No change
Microsoft.PowerAutomateDesktop	Power Automate	No change
Microsoft.RawImageExtension	None	New in 22H2
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SecHealthUI	None	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.Todos	Microsoft To Do	No change
Microsoft.VCLibs.140.00	None	No change
Microsoft.VP9VideoExtensions	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsNotepad	Notepad	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.WindowsTerminal	Terminal	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Media Player	No change
Microsoft.ZuneVideo	Films & TV	No change
MicrosoftCorporationII.QuickAssist	Quick Assist	New in 22H2
MicrosoftTeams	Microsoft Teams	No change
MicrosoftWindows.Client.WebExperience	None	No change

Windows 10 Apps

PowerShell Display Name	App name	Notes
Microsoft.549981C3F5F10	Cortana	New in 2004
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.Messaging	Messaging	Removed in 2004
Microsoft.Microsoft3DViewer	3D Viewer	No change
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	New in 21H1
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.MixedReality.Portal	Mixed Reality Portal	No change
Microsoft.MSPaint	Paint 3D	No change
Microsoft.Office.OneNote	OneNote	No change
Microsoft.OneConnect	None	Removed in 2004
Microsoft.People	People	No change
Microsoft.Print3D	Print 3D	Removed in 2004
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SkypeApp	Skype	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.VCLibs.140.00	None	New in 2004
Microsoft.VP9VideoExtensions	None	No change
Microsoft.Wallet	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxApp	Xbox Console Companion	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Groove Music	No change
Microsoft.ZuneVideo	Films & TV	No change

Configuration

Here’s a list of all the command line switches and example configurations.

Command Line Switch	Description	Example
-List	The full path to the txt file listing the apps to remove.	[path]apps.txt
-Wim	The full path to the wim file to remove the apps from.	[path]install.wim
-WimIndex	The index number of the image to operate on.	[number]
-WimMountPath	The full path to a folder that the wim file should be mounted to. If you do not configure this temp dir will be used.	[path]
-PCApps	List apps that are currently installed on the system.	N/A
-UserApps	List apps that are currently installed for the user.	N/A
-L	The path to output the log file to.	[path]
-Uno	Changes the script to remove all apps NOT listed in the apps.txt file.	N/A
-PCOnly	Only remove provisioned apps, does not take any action on the current users apps.	N/A
-LogRotate	Remove logs produced by the utility older than X days	[number]
-NoBanner	Use this option to hide the ASCII art title in the console.	N/A
-Help	Display usage information. No arguments also displays help.	N/A

Example

`1`	`[path\]Remove-MS-Store-Apps.ps1 -List [path\]apps-to-remove.txt`

This will remove the apps in the txt file from your Windows installation for all users.

Change Log

2024-11-09: Version 24.11.09

Added new ‘-Uno’ option which removes ALL apps not in the specified text file. The text file becomes an “apps to keep” list, instead of an “apps to remove” list.
Added new ‘-PCOnly’ option which removes provisioned apps only. This will leave the apps for the current user untouched.

2023-04-28: Version 23.04.28

Minor improvement to update checker. If the internet is not reachable it silently errors out.

2023-04-24: Version 23.04.24

Added script update checker - shows if an update is available in the log and console.

2022-06-14: Version 22.05.30

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

2022-04-26: Version 22.04.26

Added -PCApps switch to list all MS Store apps on the system.
Added -UserApps switch to list all MS Store apps installed for the user.
Added -Help to give usage instructions in the terminal. Also running the script with no options will also trigger the -help switch.
Streamlined config report so non configured options are not shown.

2022-04-22: Version 22.04.22

If the -WimMountPath is not configured by the user then the default Windows temp folder will be used instead.
If the -WimMountPath is configured by the user but the path does not exist, it will be created.
Added a -LogRotate option to delete logs older than X number of days.

2022-03-27: Version 22.03.27

Utility now ignores blanks lines in Apps list file.

2021-12-08: Version 21.12.08

Configured logs path now is created, if it does not exist.
Added OS version info.
Added Utility version info.
Added Hostname info.
Changed a variable to prevent conflicts with future PowerShell versions.

2021-09-07: Version 07.09.21

Added ability to remove apps from offline images.

2020-03-13: Version 20.03.13 ‘Cool’

Refactored code.
Backwards compatible.
Added logging.
Added config report when ran.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.

2019-12-03 v2.0

First public release.

The Tale of the Fail of Google Stadia

Wed, 27 Nov 2019 12:12:38 +0000

Disclaimer: This isn’t my personal experience with Stadia as I’ve haven’t tried it myself, either during it’s beta phase or in its current state.

xCloud and Stadia comparisons: xCloud currently only streams to phones and tablets running Android and is in a preview phase. Stadia has had a preview phase, which was available as an invite-only beta, using Google Chrome and playing Ubisoft’s Assassin’s Creed Odyssey, and is now a released product and service. In summary the problem with Stadia is that:

Google charged money.
Over promised and under delivered.

When I watched the Google Stadia announcement I have to admit I was sceptical but hopeful. As with most technology press conferences it was extremely well polished, clean and full of promise. What was announced didn’t necessarily seem out of reach in the near future to those with enough bandwidth, but it did seem unclear who exactly the service was for in the here and now. To me, it felt like Google setting themselves up for the future. They certainly understand infrastructure (and advertising, for that matter) but they aren’t generally associated with the video game industry. The launch of Stadia looked from the outside to be muddled and unclear. The initial list of games available at launch was small, but it appears that at the last minute a few more to the list.

The early backers of the service weren’t getting their emails with codes or controllers on the day of launch despite pre-ordering, and then others who ordered more recently were getting theirs. Google were quite boastful about the capabilities of Stadia at launch, but since then a lot of features have been pushed back to ‘shortly after launch’ or 2020 and the current games don’t appear to be performing as well or looking as good as Google said they would.

Recently Google released a statement commenting on this and putting the responsibility of this on the developers, which seems like a bit of a backstab to the devs who are supporting the platform at launch. The free version of Stadia is going to be available later in 2020. I feel Google are using this time as a beta phase, and charging people for the opportunity to be testers. I think Stadia might well be worth waiting for and trying out for free, although that only means no monthly subscription, you’ll still have to buy games individually and separately, unless they make some changes. Google are not a small start-up (remember OnLive?) and haven’t been for well over a decade now, and yet they (and other large corporations worth billions of dollars) still behave and launch products like they are ‘a scrappy start-up’ and ‘still figuring things out’. Game streaming tech is new and I fully believe they are still figuring it out, and that’s fine in itself. The only comparison between xCloud and Stadia that I’m going to make here is that xCloud didn’t go and boast about how amazing and revolutionary it is and charge money for the privilege of helping them figure it out and test it.

Hopefully Stadia does become something great and introduce new people to gaming, but Google’s track record on supporting products isn’t great.

-Mike

Installing Microsoft Deployment Toolkit and Deploying Windows 10 - From Scratch!

Mon, 25 Nov 2019 20:46:34 +0000

If you’ve read my other posts you’ll know that usually I make a post focusing on building a reference image and then another post on deploying that image.

This post is very similar but I’m going to streamline things by just covering the installation of MDT, and deploying Windows 10 1909. I have also recently published a video walkthrough covering this.

What you’ll need:

A server to host the MDT share.
A client PC, or the MDT server above to install the tools.
A VM to test the install task sequence.

This walkthrough will cover installing the tools on a client PC and then the MDT deployment share will be hosted on a server. Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First we’ll install the Windows 10 1903 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection.
On the Select the features you want to install screen select:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
Install WinPE by running the adkwinpesetup.exe. There is no specific configuration during the install wizard.
Install MDT by running the MicrosoftDeploymentToolkit_x64.msi. There is no specific configuration during the install wizard.

Install the Windows System Image Manager Update

Unzip the archive containing the WSIM 1903 fix.
Copy the two files: ImageCat.exe and ImgMgr.exe to the location the ADK is installed to. The default location is: C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\WSIM.
After installation you will still not be able to access WSIM through MDT. You will need to load WSIM from the Start Menu then open the XML file for the Operating System you wish to change. The XML answer file will be located in \\server\deploymentshare$\Control\Task-Sequence-ID\Unattend.xml.

Go to the server that will host the deployment share.
Create a folder called DeploymentShare.
Share the folder by right-clicking on the folder and go to Properties > Sharing > Advanced Sharing.
Tick the Share this folder check box.
Enter DeploymentShare$ as the Share name. We do this so the share is hidden.
Go to Permissions, remove Everyone.
Add Domain Users and leave the permissions as Allow Read. Add Domain Admins and check Allow Full Control permissions.
Go back on the client PC where the MDT tools installed.
Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Under Deployment share path enter the UNC path: \\server\DeploymentShare$
Enter a description in the Deployment share description text field.
On the Options screen, accept the defaults as we’ll change them later.
Complete the wizard to create the share.

Adding an Operating System

Mount the Windows 10 1909 ISO in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select New Folder.
Enter the name Windows 10 1909 x64 and click through the wizard to create the folder.
Right click again and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory.
For the destination directory name enter Windows 10 1909 x64 and complete the wizard.

Adding Packages

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 1909 x64.
Go to the website catalog.update.microsoft.com
Search for Windows 10 version 1909.
Download the latest Cumulative Update for Windows 10 1909 x64.
Download the latest Servicing Stack Update for Windows 10 x64.
Create a folder and put both update files in the folder.
Go to Deployment Workbench > Packages.
Right-click on the folder Windows 10 1909 x64.
Select Import Packages.
In the Package source directory enter the path to the new folder we created containing the updates.
Click Next and complete the wizard.

Now we’ll create a selection profile so that the task sequence only installs updates for Windows 10 1909 x64.

Creating A Selection Profile

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 1909 x64.
On the Folders page, tick the Windows 10 1909 x64 folder under Packages and complete the wizard.

Importing Applications

Here I’m going to cover how to add Microsoft Office 2016, but the method is the same for all applications.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Microsoft Office 2016.
Enter the Source directory of the installation files.
Enter the Destination directory: Microsoft Office 2016.
For the Command line enter anything, we’ll revisit this later.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configuring Microsoft Office 2016 in MDT

Right click on Microsoft Office 2016, go to the Office Products Tab.
Choose the desired Office Product to Install from the drop down menu.
Check the desired Office language.
Enter a product key, unless you will be activating Office via KMS in which case leave the Product Key option unchecked.
Check the Customer name option and enter the desired information.
Check the Display level option and select None in the drop down menu.
Check the Accept EULA option.
Check the Always suppress reboot option.
Click Apply.
Go to the Details tab and the Quiet install command should now read:

`1`	`setup.exe /config proplus.ww\config.xml`

Microsoft Office is now set up to be installed silently by a task sequence. This process can also be done for Microsoft Visio and Project 2016. If you wish to customise the installation to a greater degree, the Office Customization Tool can be launched from the Office Products tab. This only works with the Office 2016 family of products. Office 365 and 2019 do not support this method and should be installed like a regular application. To customise Office 365 and 2019, check out my post: Deploying Office 2019 or Office 365.

Adding Third-party Applications

To add other popular third party software, you’ll need to repeat the steps above with the relevant Command line to execute a silent install. You’ll also need to fill in the Working directory: .\Applications\App-name

Google Chrome - Enterprise Installer

msiexec /i googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

VLC Player

VLC.exe /S

7-Zip

msiexec.exe /i 7zip.msi /qn

We now need to create a new task sequence to deploy Windows 10 along with the applications.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-1909-A.
Name it Deploy Windows 10 1909 x64 Edition.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 1909 x64 Edition.
Select Do not specify a product key at this time if you are using KMS.
Enter an Organization name.
Enter the local Administrator password.
Complete the wizard.

Now we’ll configure the task sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Initialization folder in the left hand pane.
Go to the Gather local only item.
In the Properties window select Gather local data and process rules.
Enter the following in the Rules file: customsettings.ini
Expand the Preinstall folder, and select the Apply Patches item.
Change the Selection Profile to Windows 10 1909 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Microsoft Office 2016 and change the name Install Applications to Microsoft Office 2016.
To install other Applications, copy and paste the Install Applications item and repeat the previous steps.
Click Apply and close the task sequence.

Next we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below enable auto login and skip the welcome screen, so these should only be used for lab or closed development environments.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\DeploymentShare$
SkipBDDWelcome=YES

Configuring CustomSettings.ini

The settings below need some explanation. The [Virtual Machine] section is regarding driver installs which we’ll cover later in this post.

The JoinDomain= section is important. Here I’ve put the account sysadmin to use as the account to join the device being imaged to the domain contoso.com. The account entered here must have the relevant permissions to join a device to the domain.

The other settings are location preferences relevant to the UK and resolution settings which prevent the finished device from defaulting to a resolution of 1024 x 768, and instead using the recommended resolution Windows receives from the display. On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDComputerName=%TaskSequenceID%
 
[Default]
_SMSTSORGNAME=Deployment Share
_SMSTSPackageName=%TaskSequenceName%
 
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
 
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES
 
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=sysadmin
DomainAdminPassword=lamepassword
MachineObjectOU=OU=PCs,DC=contoso,DC=com
 
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\DeploymentShare$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media in order to boot the VM into WinPE for deployment.

Creating The Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing The Task Sequence

To test everything we need to copy the ISO file that we just generated. It is located in the Boot folder in the Deployment Share. Go to the server that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a virtual machine will be able to access it. Create a new VM with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs.
2x vCPUs
4GB of RAM
Network Adapter with access the local network.
Virtual Hard Drive of at least 40GB, preferably on an SSD.
Boot from CD using the LiteTouchPE_x64.iso from MDT.

Start the VM and it will boot from the LiteTouchPE_x64.iso into WinPE.
You will be presented with a login screen. Here you should login with Active Directory credentials that have access to the deployment share.
Once logged in you will be presented with a screen with the name of the task sequence you created earlier. Select your Task Sequence and click Next.
You’ll be prompted to enter a Computer Name.
Click Next and the task sequence will begin.

The task sequence will install Windows 10 1909. Windows Update will run and install updates from the WSUS server and the VM will be added to the Active Directory domain. When this process completes the VM will shut down. Boot up the VM and check to see if it has successfully joined the domain and has all the applications installed.

Driver Management

In this section we’re going to configure how drivers are managed during deployment. There are a few ways to do this, here I’ll show the method I’ve been using which has worked very well for a variety of manufactures and models of devices.

The first thing you’ll need is the model numbers for all the devices you want to deploy to. You can find this out by booting the device in to its current version of Windows or the deployment environment using the LiteTouch_x64.iso boot disc or PXE booting. I haven’t covered PXE booting in this post but here’s a previous post I wrote on how to setup PXE booting for MDT: PXE Booting for Microsoft Deployment Toolkit.

When the device is booted into WinPE, press F8 to get a command prompt, and type out the following command:

`1`	`wmic computersystem get model`

The output of the command is the model number you’ll need.

The next thing you’ll need is the drivers. I’ve found Windows 10 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Windows 10 tends to have some drivers built right in and I’ve found they are usually very stable, so I only add drivers to MDT that Windows 10 cannot find. Deploy the image to each type of device you have and use Device Manager to see what’s missing.

If you’re missing drivers, go to Settings > Windows Update and use Check online for updates from Microsoft Update which should find and install the relevant drivers. Then using the Update History and see what you need to find and import into MDT.

Note: I recommend to avoid using WSUS to download and install drivers as it inflates the WSUS database, slowing WSUS down and making it difficult to manage.

To import drivers into MDT you’ll need the INF files. Most large manufacturers do a decent job of providing drivers that can be used with MDT. Should you have difficulty with them you can use the Microsoft Update Catalog to search for and download the specific drivers that Windows Update installs and use them with MDT. I use this method myself and although it can be time consuming, the results are worth it.

Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench.
Navigate to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder Windows 10 x64.
Right click on the Windows 10 x64 folder and select New Folder.
Name the folder a human readable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth.
Right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers for that driver type.
Check the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 7-10 for each driver type required.

We now need to edit the CustomSettings.ini to configure the driver location for each model.

Go to the Deployment Workbench and right click on the Deployment Share, select Properties.
Go to the Rules tab in the Properties window.
Enter the text below under the [Settings] section but after the Properties.
Once you’ve added in all the models required, click Apply to save the changes.

[MODEL-NUMBER]
DriverGroup001=Windows 10 x64\Human-Readable-Model-Number
DriverSelectionProfile=nothing
OSDPrefix=PC

You’ll need to enter the above text for each model. Below is an example of my CustomSettings.ini for reference.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[HP 250 G5 Notebook PC]
DriverGroup001=Windows 10 x64\HP 250 G3
DriverSelectionProfile=nothing
OSDPrefix=HP
 
[80J2]
DriverGroup001=Windows 10 x64\Lenovo E50
DriverSelectionProfile=nothing
OSDPrefix=LEN
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM
 
[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\SERVER-NAME\Deploy$\Captures
OSDComputerName=%OSDPrefix%-%SerialNumber%
...

The deployment share is now configured to install drivers for the models specified.

Boot the physical device into WinPE and run the task sequence. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the WinPE Boot Media

It may be necessary to add drivers to the WinPE boot media for devices such as storage or network adaptors.

To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt.
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers.

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers.
Right click and select New Folder, call the folder WinPE x64.
Right click on the WinPE x64 folder and select New Folder.
Name the folder a suitable name for the model of device you’ll be adding drivers for.
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network.
To import the drivers, right click on a driver type folder and select Import Drivers.
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box.
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder.
Repeat steps 6-8 for each driver type required.
Now we must create a Selection Profile for WinPE x64.
Go to Advanced Configuration > Selection Profiles.
Right click on Selection Profiles and select New Selection Profile.
Enter WinPE x64 as the Selection profile name.
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder.
Click Next > Next > Finish to complete the wizard.
Right click on the Deployment Share and select Properties.
Go to the Windows PE tab and change the Platform drop down menu to x64.
Go to the Drivers and Patches tab, and change the Selection profile drop down menu to WinPE x64.
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked.
Click Apply to save the changes, click OK to close the Properties window.
Right click the Deployment Share and select Update Deployment Share.
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included.
Click Finish to complete the wizard.

The WinPE boot media should now have the network and/or storage drivers required.

I take great care to test my ideas and make sure my articles are accurate before posting, however mistakes do slip through sometimes. If you have any questions or comments, please leave them below.

I hope this article is useful to you. Please consider supporting my work with paypal.

-Mike

First Impressions with Project xCloud Preview

Sun, 24 Nov 2019 15:10:52 +0000

For the last couple of days I’ve been trying out Microsoft’s Project xCloud game streaming service which is currently in preview. You can sign up to try it out yourself here. To get straight to it, the service has worked well for me. There have been some audio glitches, and in some situations - like scrolling around a world map, compression artifacts are very visible, but none of these issues have persisted. Input lag is almost invisible but I felt it whilst playing. I would say it felt like playing on a TV with game mode disabled. I had more trouble playing games due to the small screen of my phone (compared to the TV I usually play on) than due to the input lag. Here’s some background on the environment I’ve been testing with:

Internet connection: consumer Virgin Media fibre. 200 Mbps down, 20 Mbps up.
Router: Netgear XR500.
Wi-Fi connection: 5GHz with WPA2 encryption.
Device: Samsung Galaxy S10+
During testing streamed a 720p 60fps video from YouTube on another device.
Some Wi-Fi interference around me.

To set up xCloud as an existing Xbox user it was very straight forward. I downloaded the Xbox Game Streaming Preview app from the Google Play store and paired my bluetooth Xbox One controller to my phone. I opened the app, signed in with my account and opened Hitman (2016) from the provided library of games. It took about 30 seconds to start the stream, the game then loaded, my saves synced and I was continuing my progress in the game. Really cool and straightforward. Here’s video of my second session playing Forza Horizon 4.

Some background on me and my gaming preferences - I really don’t like input lag and so I prefer framerate over resolution or visual fidelity. I play on PC and Xbox One X. On the console I always set the game settings to performance over resolution when possible. I also have ‘game mode’ enabled on my TV to reduce the input lag. For my initial tests I played Hitman (2016) and Forza Horizon 4. FH4 I’ve only played on Xbox One X at high frame rate, and Hitman (2016) I’ve been playing through again recently on Xbox One X, again at high frame rate settings. Both of these games ran well and were very playable. As I mentioned above I did feel some minor input lag but it was consistent. I haven’t tested using 4G yet, but I will update this article when I have.

If you have any questions or comments, please leave them below.

-Mike

gal.vin

Nvidia system tray icon is always visible

A Powershell Replacement for wmic

My Windows 11 24H2 Setup Process

Turn Off Sticky Keys

Remove Windows 11 Optional Features

Remove Built-in Apps

Installing apps via winget

Remove Search from the Taskbar

Remove Task View Button on the Taskbar

Windows Services to disable

Disable Hibernation and Fast Startup

Disable the New Context Menu

Remove Gallery from File Explorer for all users

Setting File Explorer views to be consistent

File Explorer preferences

Remove Widgets from the Taskbar

Remove Startup Programs

Uninstall One Drive

Using Local Group Policy for Configuration

My Local Group Policy

Administrative Templates > Control Panel

Network/QoS Packet Scheduler

System/Internet Communication Management

System/Internet Communication Management/Internet Communication settings

System/OS Policies

System/Remote Assistance

System/User Profiles

Windows Components/AutoPlay Policies

Windows Components/Cloud Content

Windows Components/Data Collection and Preview Builds

Windows Components/Location and Sensors

Windows Components/Location and Sensors/Windows Location Provider

Windows Components/Microsoft Defender Antivirus/MAPS

Windows Components/Search

Windows Components/Software Protection Platform

Windows Components/Sync your settings

Windows Components/Windows Error Reporting

Windows Components/Windows Update/Manage end user experience

Windows Components/Windows Update/Manage updates offered from Windows Update

Windows Terminal - quake mode

What is ‘quake mode’?

Open Windows Terminal in ‘quake mode’

Open Windows Terminal at startup in ‘quake mode’

Support My Work

Remove MS Store Apps Utility - Update 24.11.09

2024-11-09: Version 24.11.09

Support My Work

Clean Up the WinSxS folder

Support My Work

Hyper-V Backup Utility - Update 24.08.29

2024-08-29: Version 24.08.29

Support My Work

Disable IPv6 with PowerShell

Disable IPv6 on all network adaptors

Disable IPv6 on a specified network adaptor

Support My Work

Getting Started with MDT Offline Media

Overview

Prepare Your Main Deployment Share

How Duplicating Items in MDT Works

Creating New Applications In MDT For Use With Offline Media

Creating a Selection Profile

Creating Offline Media

Support My Work

Hyper-V Backup Utility - Update 24.05.11

2024-05-11: Version 24.05.11

Support My Work

Hyper-V Backup Utility - Update 24.03.21

2024-03-21: Version 24.03.21

Support My Work

Hyper-V Backup Utility - Update 24.03.18

Update Summary

2024-03-18: Version 24.03.18

Support My Work

Hyper-V Backup Utility - Update 24.03.08

Update Summary

2024-03-08: Version 24.03.08

Support My Work

Poor Network Performance With FreeBSD Based Operating Systems On Hyper-V