Windows 10 1703 Creators Update on gal.vin

Upgrading to Windows 10 1703 (Creators Update) with Windows Server Update Services (WSUS)

Wed, 23 Aug 2017 22:34:51 +0000

As Windows is now delivered ‘as-a-service’ with major updates being released biannually, you may want to push out these major updates using WSUS. In previous posts I’ve covered deploying Windows 10 1703 (Creators Update) as a clean install with Microsoft Deployment Toolkit and also how to perform an upgrade to Windows 10 1703 using MDT. In this post, I’ll walk through the process of pushing out the upgrade to Windows 10 1703 using WSUS. I’m going to assume that you already have Windows Server Update Services set up. If you don’t, don’t worry here’s a walkthrough I made previously.

Prerequisites

I have created a Computer Group in WSUS called Upgrades and assigned computers to it using Group Policy. The Windows Updates settings in Group Policy are set to automatically install any updates I approve in WSUS at a specific time, everyday. For this walkthrough I’ll be upgrading two Windows versions: a Windows 7 install and a Windows 10 1511 install, just to show the differences. Both installs are Hyper-V VM’s and are fully patched. The upgrade to Windows 10 1703 will be deployed from the WSUS server running on a fully patched Windows Server 2016 Hyper-V VM. Both the Windows 7 and Windows 10 1511 VMs have a local profile for a domain user account, with lots of data stored locally on the PC and several pieces of software installed such as Flash, Google Chrome, Office 2016, Adobe Reader and VLC.

Upgrading Windows 7 to Windows 10 1703 with WSUS

Let’s upgrade the Windows 7 install first. This update requires user interaction on the Windows 7 install, so I wouldn’t personally recommend this method to upgrade all of your old Windows 7 devices to Windows 10, but for devices that need to have software and data persevered it may be preferable to a clean install.

Finding and Approving the Update for Windows 7

We need to find the relevant update in WSUS. For my Windows 7 VM, it is listed as Windows 7 and 8.1 upgrade to Windows 10 Enterprise, version 1703, en-us, your language and edition may vary though.

Expand the server node in the WSUS console.
Right-click on Updates, and select Search in the menu.
In the Search box, under the Updates tab enter the name of the update that is appropriate for you. Please note the edition and language may be different from my example above.
When the search completes, you should have a few results.
Right-click on each of the updates and select Revision History.
You’ll want the most recent Revision Number. For my example above, it’s 201.
Right-click on the update you wish to approve, and select Approve.
Choose the Computer Group you wish to Approve the update for and click OK. Please note: depending on your configuration this will download and push out the upgrade to Windows 10 on all devices in the group.
Close the Search box, and WSUS should be downloading the update to Windows 10 1703. It is approximately 5GB in size.

Once the update has downloaded, it will be available to the devices it has been approved for.

Performing the Upgrade on Windows 7

On my Windows 7 VM, I logged in as my domain user and checked for updates. It moved to the Upgrades Computer Group I had created for it in WSUS, but the Windows 10 1703 update wasn’t downloading. In Windows Update it reported as failed with the error code: 0x80240020, and in WSUS the computer was reporting the update installation as failed with the same error code also. After waiting for 24 hours and trying a few tricks (like resetting Windows Update), I had to edit the registry to get the Update to work.

Go to the following registry key:

`1`	`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade`

Create a new DWORD (32-bit) Value with Name: AllowOSUpgrade and set the Value: 0x00000001. After creating this registry key, I went to Windows Update and it reported that it was ready to install the upgrade to Windows 10. I selected to to perform the upgrade and after downloading I was presented with a few screens asking if I wanted to proceed with the upgrade. The familiar Windows Update install screen appeared on shutting down Windows 7 and upon reboot the now even more familiar Windows 10 update install screen was displayed.

After several reboots and a screen asking about Privacy Settings, I was presented with the Windows 10 1703 log in screen. I logged in as my domain user which had a local profile on the VM and all my data and programs were there. When I logged in I was greeted by the “first run” screens that all new users receive when they log in to Windows 10 for the first time. Some of the personal customisations where there, such as the taskbar icons, but they were merged with the default Windows 10 taskbar icons. Sometime later when the VM checked for Windows Updates again, the latest updates for Windows Defender and the most recent Cumulative Update was installed, bringing Windows 10 1703 right up to date.

Upgrading Windows 10 1511 to Windows 10 1703 with WSUS

The update for existing versions of Windows 10 doesn’t require user interaction, it installs like all other Windows 10 updates preserving user data, profile customisation and installed software.

Finding and Approving the Update for Windows 10 1511

In WSUS the update for my Windows 10 1511 VM is listed as Feature update to Windows 10 Pro, version 1703, en-gb your language and edition may vary though.

Expand the server node in the WSUS console.
Right-click on Updates, and select Search in the menu.
In the Search box, under the Updates tab enter the name of the update that is appropriate for you. Please note the edition and language may be different from my example above.
When the search completes, you should have a few results.
Right-click on each of the updates and select Revision History.
You’ll want to select the update with the most recent date under the Revised heading. For me it was 27/07/2017.
Right-click on the update you wish to approve, and select Approve.
Choose the Computer Group you wish to Approve the update for and click OK. Please note: depending on your configuration this will download and push out the upgrade to Windows 10 on all devices in the group.
Close the Search box, and WSUS should be downloading the update to Windows 10 1703. It is approximately 5GB in size.

Once the update has downloaded, it will be available to the devices it has been approved for.

Performing the upgrade on Windows 10 1511

I booted up the Windows 10 1511 VM and left it on the log in screen. The VM contacted the WSUS server and moved it’s computer object to the Upgrades Computer Group. Sometime later the VM rebooted from the log in screen and began the upgrade process.

After several reboots during the upgrade, the VM booted to the Windows 10 log in screen. I logged in with my domain user which already had a local profile on the VM, and was greeted with the “first run” screens that new users receive when they log in to Windows 10 for the first time. Despite these screens appearing the data and software had been migrated and the customisation I had done as the user of the Start Menu and Taskbar had been preserved, with the exception of the Store and Edge icons had been re-pinned to the Taskbar. Sometime later when the VM checked for Windows Updates again, the latest updates for Windows Defender and the most recent Cumulative Update was installed, bringing Windows 10 1703 right up to date.

If you have any questions or comments, please leave them below.

-Mike

Upgrading to Windows 10 1703 (Creators Update) with Microsoft Deployment Toolkit

Thu, 27 Jul 2017 21:15:32 +0000

If you’re looking to deploy the latest version of Windows 10 1703 (better known as the Creators Update) as a fresh install, please check out this post. This post is designed to walk through installing and configuring Microsoft Deployment Toolkit and to create a Task Sequence to upgrade to Windows 10 1703 from a previous version of Windows. The Windows upgrade process has come along way in recent years, so in certain circumstances it may be worth while running an upgrade, rather than a wipe-and-load. Additionally with Windows 10’s frequent updates being the case now, rather than doing upgrades via WSUS which may not be preferable depending on your environment, it may be better to do upgrades in a more controlled way.

Installing & Configuring Microsoft Deployment Toolkit and Dependencies

We’ll be using Microsoft Deployment Toolkit (MDT) version 8443, which at the time of writing is the most recent release and fully supports Windows 10 1703. Here’s the links to download the software we’ll be installing:

Windows 10 1703 Assessment and Deployment Kit (ADK)
Microsoft Deployment Toolkit (8443)
Windows 10 1703 x64 .iso (Volume Licensing Service Center

First, we’ll install the Windows 10 1703 ADK. The setup will need to download additional files so it may take some time depending on your internet connection.

IMPORTANT NOTE: If you have SecureBoot enabled, you’ll get a “Program Compatibility Assistant” dialog displayed and after installation, WIMs will fail to mount and unmount. This is a known issue and there is a workaround.

On the Select the features you want to install screen select:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
Imaging And Configuration Designer (ICD)
Configuration Designer
User State Migration Tool (USMT)

Now install MDT by running the setup file downloaded earlier, there is no specific configuration during the install wizard. After it’s installed we need to create the Deployment Share.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\DeploymentShare
Enter the Share name: DeploymentShare$
Give the share a descriptive name.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.

We now need to add an Operating System to work with.

Add an Operating System

Mount the Windows 10 1703 .iso in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted .iso as the Source directory.
For the destination directory name enter Windows 10 Enterprise 1703 x64 and complete the wizard.
Go to the Operating Systems node again and rename the OS you just added to Windows 10 Enterprise 1703 x64.

Note: The upgrade process will not work with custom images, so you cannot build a reference image like in my previous post and use that to upgrade a computer to the latest version of Windows with all updates and applications. However, you can configure the MDT Task Sequence to install applications and run Windows Update.

Importing Applications (Optional)

You may want to add some applications to install, here I’ll cover how to add Microsoft Office. MDT recognises Microsoft Office and provides automated/silent install options.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Microsoft Office.
Enter the Source directory of the installation files.
Enter the Destination directory: Microsoft Office.
For the Command line enter anything - we’ll revisit this soon.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configure the Application - Microsoft Office

Right click on Microsoft Office, go to the Office Products Tab.
Choose the desired Office Product to Install from the drop down menu.
Check the desired Office language.
Enter a product key, unless you will be activating Office via KMS in which case leave the Product Key option unchecked.
Check the Customer name option and enter the desired information.
Check the Display level option and select None in the drop down menu.
Check the Accept EULA option.
Check the Always suppress reboot option.
Click Apply.
Go to the Details tab and the Quiet install command should now read:

`1`	`setup.exe /config proplus.ww\config.xml`

Microsoft Office is now set up to be installed silently by a Task Sequence. Please note that this will install Microsoft Office along side any previous versions. If you wish to customise the installation to a greater degree and remove older versions, the Office Customization Tool can be launched from the Office Products tab. This process can also be done for Microsoft Visio and Project applications. We need to now create the Task Sequence that will upgrade the currently installed version of Windows to Windows 10 1703.

Create a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-1703-UP.
Name it Upgrade Windows 10 1703.
Select Standard Client Upgrade Task Sequence.
Select the Operating System Windows 10 1703 x64.
Do not specify a product key at this time.
Enter an Organization name.
Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configure the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Go to the Post-Processing folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 10, if not please continue.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Microsoft Office and change the name Install Applications to Microsoft Office.
Click Apply and close the Task Sequence.

Next we’ll create a domain user account for MDT.

Create an Active Directory User for MDT

Go to Active Directory Users and Computers.
Create a user called mdt_admin
On the server where the deployment share is hosted, give mdt_admin Full Control share permissions and Full Control permissions to all the files and folders under the deployment share.

Now we’ll configure the Bootstrap.ini and the Rules.ini files to control certain aspect of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab/closed environments.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVERNAME\BuildShare$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configure Rules.ini

On the Rules tab of the Deployment Share properties window, add the settings below. A lot of the settings are specific to my lab environment such as my location in the world.

The [Virtual Machine] section near the top is one example of how to manage drivers and auto fill computer names.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDComputerName=%TaskSequenceID%
 
[Default]
 
_SMSTSORGNAME=Deploy Share
_SMSTSPackageName=%TaskSequenceName%
 
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
 
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
 
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://wsus01:8530
SLShare=\\mdt01\deploymentshare$\Logs
EventService=http://admin01:9800

Run the Upgrade Task Sequence

Now it’s time to run our Upgrade Task Sequence. For my demo here, I’ll be using a “lived-in” Hyper-V virtual machine running Windows 10 Professional 1511 x64 - OS Build 10586.164. It has Office 2016, Adobe Reader, Google Chrome, Adobe Flash, and Firefox installed, it’s connected to a domain and has local user profiles from domain users on it with customised settings and personal data. It’s also localised to the UK. The VM is configured as such:

2x vCPUs
4GB of RAM
NIC with access the the local network and domain, MDT and WSUS server.
Virtual Hard Drive of at least 80GB, on an SSD.

With the VM running Windows normally, log in as a user with access to the MDT Deployment Share.
Navigate to \\SERVERNAME\DeploymentShare$\Scripts and run the LiteTouch.vbs script.
After a short delay you will be presented with the Windows Deployment Wizard and a list with the Task Sequence you created earlier.
Select Upgrade Windows 10 1703 and click Next.

The Task Sequence will now run, upgrade to Windows 10 1703 x64, update from the WSUS server, install Microsoft Office applications (if you added them), run Windows Update from the WSUS server once again, and then shutdown. When the device is logged into, all user data, settings and programs should be migrated and available as before. The full Windows version should be Windows 10 1703 x64 OS Build 15063.483 - the current version with all Windows Updates as of 27th July 2017. You may also want to add other application installs to your Task Sequence, such as these common applications, depending on your environment.

Google Chrome - Enterprise Installer

`1`	`msiexec /I googlechromestandaloneenterprise64.msi /qn`

Adobe Reader - Enterprise Installer

`1`	`AdobeReaderDC.exe /sAll`

You now have a functioning Microsoft Deployment Toolkit server, with a Deployment Share configured to upgrade to Windows 10 1703 x64.

If you have any questions or comments, please leave them below.

-Mike

Building a Windows 10 1703 (Creators Update) Reference Image with Microsoft Deployment Toolkit

Mon, 10 Jul 2017 21:09:02 +0000

Following on from a previous post which covers some queries and issues I had when first deploying Windows 10 1703 (better known as the Creators Update) this post is designed to walk through installing and configuring Microsoft Deployment Toolkit to build a reference image of Windows 10 1703 using a Hyper-V Virtual Machine.

Installing & Configuring Microsoft Deployment Toolkit and Dependencies

Windows 10 1703 Assessment and Deployment Kit (ADK)
Microsoft Deployment Toolkit (8443)
Windows 10 1703 x64 .iso (Volume Licensing Service Center
The latest Cumulative update for Windows 10 1703 x64 - as of 11/10/2017 this is KB4041676, released October 11th 2017. More information is available here. Please note: Do not download the Delta Update!

First we’ll install the Windows 10 1703 ADK. The setup will need to download additional files so it may take some time depending on your internet connection.

On the Select the features you want to install screen select:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
Imaging And Configuration Designer (ICD)
Configuration Designer
User State Migration Tool (USMT)

Now install MDT by running the setup file downloaded earlier, there is no specific configuration during the install wizard. After it’s installed we need to create the Deployment Share.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\BuildShare.
Enter the Share name: BuildShare$.
Give the share a descriptive name.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.

We now need to add an Operating System to work with.

Add an Operating System

Mount the Windows 10 1703 .iso in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted .iso as the Source directory.
For the destination directory name enter Windows 10 Enterprise 1703 x64 and complete the wizard.
Go to the Operating Systems node again and rename the OS you just added to Windows 10 Enterprise 1703 x64.

Next we’ll be adding the Cumulative Update for Windows 10 Version 1703 downloaded earlier, to do this we’ll be adding it to the Packages section of MDT. The reason we do this is so the CU will be installed with the Operating System, rather than relying on WSUS or Windows Updates to download and install it. The advantage of doing it this way is the entire Task Sequence will be faster and Windows will be up to date when it is installed. Many bug fixes are part of the CU, including the auto logon bug.

Importing Packages

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 1703 x64.
Right click on the folder and select Import OS Packages and go through the wizard to add the package. The downloaded update .msu file must be in a folder by itself.

Now we create a selection profile so that the Task Sequence only attempts to install the update for Windows 10 1703 x64.

Creating A Selection Profile

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 1703 x64.
On the Folders page, tick the Windows 10 1703 x64 folder under Packages and complete the wizard.

Importing Applications (Optional)

You may want to add some applications to be a part of your reference image, here I’ll cover how to add Microsoft Office. MDT recognises Microsoft Office and provides automated/silent install options.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Microsoft Office.
Enter the Source directory of the installation files.
Enter the Destination directory: Microsoft Office.
For the Command line enter anything - we’ll revisit this soon.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configure the Application - Microsoft Office

Right click on Microsoft Office, go to the Office Products Tab.
Choose the desired Office Product to Install from the drop down menu.
Check the desired Office language.
Enter a product key, unless you will be activating Office via KMS in which case leave the Product Key option unchecked.
Check the Customer name option and enter the desired information.
Check the Display level option and select None in the drop down menu.
Check the Accept EULA option.
Check the Always suppress reboot option.
Click Apply.
Go to the Details tab and the Quiet install command should now read: setup.exe /config proplus.ww\config.xml

Microsoft Office is now set up to be installed silently by a Task Sequence. If you wish to customise the installation to a greater degree, the Office Customization Tool can be launched from the Office Products tab. This process can also be done for Microsoft Visio and Project applications. We need to now create the Task Sequence that will create our reference image of Windows 10 1703.

Create a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: W10-1703.
Name it Build Windows 10 1703.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 1703 x64.
Do not specify a product key at this time.
Enter an Organization name.
Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configure the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the OS Info tab and click Edit Unattend.xml. It will take sometime to generate the catalog.
When the Unattend.xml opens, go to 7 oobesystem > amd64_Microsoft-Windows-Shell-Setup__neutral > OOBE.
Change the ProtectYourPC setting to 3. This will prevent the image from randomly checking for updates whilst it is being built.
Save the Unattend.xml, you can safely ignore an warnings.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder, and select the Apply Patches item.
Change the Selection Profile to Windows 10 1703 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue.
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Microsoft Office and change the name Install Applications to Microsoft Office.
Click Apply and close the Task Sequence.

Next we’ll create a domain user account for MDT.

Create an Active Directory User for MDT

Go to Active Directory Users and Computers.
Create a user called mdt_admin.
On WDS01 (where the deployment share is hosted), give mdt_admin Full Control share permissions and Full Control permissions to all the files and folders under the deployment share.

Now we’ll configure the Bootstrap.ini and the Rules.ini files to control certain aspects of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab/closed environments.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVERNAME\BuildShare$
UserDomain=contoso.com
UserID=mdt\_admin
UserPassword=p@ssw0rd

SkipBDDWelcome=YES

Configure Rules.ini

On the Rules tab of the Deployment Share properties window, add the settings below. A lot of the settings are specific to my demo environment such as my location in the world.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVERNAME\BuildShare$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim
WSUSServer=http://SERVERNAME:8530
FinishAction=SHUTDOWN
SLShare=\\SERVERNAME\BuildShare$\Logs
EventService=http://SERVERNAME:9800

Now it’s time to create the boot media to boot into the deployment environment.

Creating The Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing The Boot Media

To test the boot media, copy the LiteTouchPE_x64.iso from \\SERVERNAME\BuildShare$\Boot to a location where a Hyper-V Virtual Machine will be able to access it. Create a new VM in Hyper-V and configure it as such:

2x vCPUs
4GB of RAM
NIC with access the MDT server and WSUS server.
Virtual Hard Drive of at least 80GB, preferably on an SSD.
Boot from DVD Drive using the LiteTouchPE_x64.iso from MDT.

Start the VM and it should boot from the LiteTouchPE_x64.iso into the deployment environment. You should be presented with a wizard and the name of the Task Sequence you created earlier. Select it and click Next. The Task Sequence will now run, install Windows 10 1703 with the Cumulative Update included, update from the WSUS server, install Microsoft Office applications (if you added them) and then run Windows Update from the WSUS server again to update the Office apps, run SysPrep and the reboot back into the MDT environment and capture the image.

When this process completes the VM will be shutdown and a file named W10-1703_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in \\SERVERNAME\BuildShare$\Captures.

You may also want to add scripts and tweaks to your Task Sequence, such as this PowerShell script to uninstall any UWP apps which aren’t needed or these common applications, depending on your environment.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

You now have a functioning Microsoft Deployment Toolkit server, with a Deployment Share specifically configured for building reference images, and a Task Sequence to build and capture a Windows 10 1703 reference image.

If you have any questions or comments, please leave them below.

-Mike

Some Notes On Building a Windows 10 1703 (Creators Update) Reference Image with Microsoft Deployment Toolkit

Tue, 02 May 2017 20:58:08 +0000

With the release of Windows 10 1703 (Creators Update) ISO on the Volume Licensing Service Center, I’ve recently been looking into using the “final” code with Microsoft Deployment Toolkit (MDT) to build reference images and discover what issues are present. This post is a round up of differences and issues I’ve found with building and deploying Windows 10 1703 thus far, and some resolutions. For a full walk through on installing MDT and creating a Windows 10 1703 (Creators Update) reference image, check out this post.

My lab setup is the same as with my previous Windows 10 1607 guide, although I’ve reinstalled my main PC (which I use an admin PC) with a fresh copy of Windows 10 1703. The MDT, WDS and WSUS servers are Windows Server 2016, as before. For more detailed information on how to setup a lab like this, please see my previous post. To start building images with Windows 10 1703, you will need the following:

Upgrade/Install the new Windows 10 1703 ADK. PLEASE NOTE that if you have SecureBoot enabled, it will fail to install. This is a known issue and there is a workaround.
Upgrade/Install MDT Build 8443 - there has been no update for Windows 10 1703.
After upgrading/installing, update the deployment shares and regenerate the boot images by Right Clicking the deployment share > Update Deployment Share > Completely regenerate the boot images.
Download the Windows 10 1703 ISO from the VLSC site, mount it in Windows Explorer and Import it as an Operating System in MDT.

Here’s the differences I’ve found with Windows 10 1703:

There’s No RSAT for Windows 10 1703

Previously there were Remote Server Administration Tools (RSAT) for each big update to Windows 10. This is no longer the case! I encountered no issues installing the RSAT tools for Windows 10 1607 on my 1703 PC. If you’ve upgrade from 1607 to 1703, you may have to reinstall or re-enable them which you can do by pressing Win Key + X > Apps and Features > Programs and Features (under Related settings, see image) > Turn Windows features on or off.

Programs and Features

The Control Panel > Settings migration is happening, slowly but surely.

Auto Logon No Longer Works With MDT and Windows 10 1703

Update 29/06/2017: KB4022716 and the following Cumulative Updates for Windows 1703 fixes (KB4025342 onwards on this page) this issue. You can add the update to MDT Packages and have it installed with the deployment. I have tested this and can confirm it fixes the issue. Thanks to Michael Niehaus (@mniehaus) for tweeting about this.

Update 03/05/2017: After a Twitter conversation with Michael Niehaus (@mniehaus) this has been confirmed to be a bug, although it only effects the second logon. I first noticed this during testing the Insider builds with MDT and thought it might be fixed for the final version, but unfortunately it doesn’t appear to be. My workaround is to never set an Administrator password in the Task Sequence. This is not necessarily a problem for building the image, but for the deploying Task Sequence it can be worked around by setting the administrator’s account password near the end of the Task Sequence, either as a Command Line action:

`1`	`net user administrator P@ssw0rd`

Or with a short PowerShell script:

`1`	`$Password = convertto-securestring "P@ssw0rd" -asplaintext -force $user = "Administrator" Set-LocalUser $user -Password $Password`

Removing UWP Apps From Windows 10 1703

As I wrote about recently here, you can, if you so choose, remove the built-in UWP apps from Windows 10 1703 during the MDT Task Sequence with a PowerShell script. If you’ve been doing this with Windows 10 1607, you will need to check which apps to keep and remove with Windows 10 1703 as there are some new ones included.

WSUS Updates Getting “stuck”

I wrote about how to resolve this issue with Windows 10 1607/Windows Server 2016 here. This issue is not present in Windows 10 1703, so you do not need to add the Cumulative Update to the Packages folder in MDT for 1703, but remember that Windows Server 2016 still requires it. Please Note: I did have an issue with WSUS updates hanging on one of my builds. I used a Hyper-V Virtual Machine and mistakenly only assigned 1 vCPU. When increasing the vCPUs to 2, the issue was resolved.

I wrote about this issue and how to resolve it for Windows 10 1607 here. This issue still occurs with Windows 10 1703. The OS is trying to determine what internet connectivity is available. The registry change in my post still works with 1703 to prevent the browser opening on logon but it also prevents Microsoft Office Clipart from functioning properly, so a much better solution is to whitelist http://www.msftconnecttest.com/redirect in your firewall/proxy devices. This allows Windows to determine that it has open internet access and the browser does not open at login. The site above this site redirects to your regional msn.com.

If you have any questions or comments, please leave them below.

-Mike

Windows 10 1607/1703 Start Menu Customisation - Update

Thu, 30 Mar 2017 20:37:58 +0000

Here’s a quick update on an option I missed in my previous post about how to customise the Start Menu and Taskbar for new Windows 10 1607/1703 installs.

Update 2017-05-02: This also works with Windows 10 1703 (Creators Update) The method that I used in my previous post would not be suitable for other environments where you would still want users to have some control over apps that were pinned to the Start Menu. Although I don’t believe that the perfect solution, which would be to set a default Start Menu on login but then let users change it currently exists without some hacks, I have found an option that’s better than a full lockdown - partial lockdown.

Microsoft have a post all about it on TechNet here: https://docs.microsoft.com/en-gb/archive/blogs/deploymentguys/windows-10-start-layout-customization

To deploy a Partial Lockdown Start Menu, you would configure and export the Start Menu.xml configuration file you would want as normal with the Export-StartMenu cmdlet.

`1`	`Export-StartLayout C:\StartMenu.xml`

You will then need to open the XML file and find <DefaultLayoutOverride> near the top of the file and change it to:

`1`	`<DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">`

Here’s an example partial lockdown XML file with both StartMenu and Taskbar customisation:

<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1">
  <LayoutOptions StartTileGroupCellWidth="6" StartTileGroupsColumnCount="1" />
  <DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
    <StartLayoutCollection>
      <defaultlayout:StartLayout GroupCellWidth="6" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout">
        <start:Group Name="Browsers" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
          <start:Tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk" />
        </start:Group>
        <start:Group Name="Somethings" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk" />
        </start:Group>
        <start:Group Name="Comms" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout">
          <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
          <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk" />
        </start:Group>
      </defaultlayout:StartLayout>
    </StartLayoutCollection>
  </DefaultLayoutOverride>
    <CustomTaskbarLayoutCollection PinListPlacement="Replace">
      <defaultlayout:TaskbarLayout>
        <taskbar:TaskbarPinList>
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
          <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk" />
        </taskbar:TaskbarPinList>
      </defaultlayout:TaskbarLayout>
    </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>

A small caveat with this method is that the default apps and groups that are part of the default Windows 10 install will still be there, although the user can remove them and they will be below the apps and groups that you specify, which will also be locked and the user will not be able to change them.

I take great care to test my ideas and make sure my articles are accurate before posting, however mistakes do slip through sometimes. If you have any questions or comments, please leave them below.

I hope this article helps you out. Thank you.

-Mike

Windows 10 Insider Preview (Creators Update) - New OOBE

Sat, 18 Mar 2017 21:07:13 +0000

As we hurtle towards the release of the Creators Update, I decided to take a look at the new OOBE (Out Of Box Experience) that users will see when installing the update. The new OOBE has been a part of the Insider preview builds for some time now. It’s main feature is Cortana support, so you can use speech to go through setup which appears to be as much as a cool and useful feature as it is about accessibility. Along with Cortana setup seems more friendly and more straight forward , which I guess as these updates are only going to keep coming, and the OOBE is what most people see when updating, making it an easier and less stressful process makes sense. As for IT Pro’s and the like, I’m sure MDT will be updated to support the Creators Update and I’ll never see the OOBE more than three or four times.

I take great care to test my ideas and make sure my articles are accurate before posting, however mistakes do slip through sometimes.

If you have any questions or comments, please leave them below.

-Mike

Feature Spotlight: Night light

Mon, 20 Feb 2017 17:18:28 +0000

A feature that I’m very happy to see coming in the Creators Update for Windows 10 is Night light. It’s not exactly a headline feature, but I’m happy to see it and wanted to draw attention to it. What Night light does is change the colour temperature of the display as the sun sets, reducing the blue light and enabling your eyes to relax as you work into the night which, I personally do a lot. I already use f.lux to provide this feature and I’ve found it really makes a difference for me.

I used to be quite sceptical of these type of features and the utilities that provide them, but after trying f.lux it really helped me switch off at night. Although f.lux does change the colour temperature of your display, it’s easily disabled for doing colour sensitive work or watching movies, playing games, although I’ve found I leave it on for playing some games, such as Civilization VI.

In the current Windows Insider build, Night light can be enabled in Settings > Display

I’m a big fan of f.lux, but I’m looking forward to having this feature without having to install extra utilities. If you need to quickly turn off Night light for colour work, movie or games, you can do so via the action center.

Please note that having Night light turned on didn’t colour my screenshots, it’s working as an overlay on top of the normal image, not actually changing the colour of the pixels being displayed. Here’s a photo of Night light enabled on my Insider build machine. The white balance/screen viewing angle still doesn’t quite convey the effect, but it’s subtle and I find it pleasing.

You can always give it a go yourself when the update is released or by becoming a Windows Insider. To get started, check out the Insider website: https://insider.windows.com.

This is a small feature but I was pleasantly surprised to find it in the latest Insider build. Big headline features are great, but sometimes it’s the smaller features that I find myself looking forward to more.

If you have any questions or comments, please leave them below.

-Mike

Building a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Fri, 20 Jan 2017 22:38:01 +0000

Following on from my previous post (Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607), I’ll be continuing my series of deploying Windows 10 with Microsoft Deployment Toolkit.

Update 2017-05-02: Please note that this post is also relevant to Windows 10 1703 (Creators Update) with a few minor changes, which I’ve posted about here.

In this post I’ll be building a task sequence to create a reference image that would be suitable for a real world deployment on new devices or performing a ‘wipe and load’ on existing devices. I’ll also touch on how to silently install common Microsoft and non-Microsoft products and customising installs.

Prerequisites

In this series of posts, here’s what I’ll be using on my demo network:

Active Directory Domain Controller running on Windows Server 2016 Standard - DC01.
An installation of Microsoft Deployment Toolkit 8443 configured as per my previous post, running on Windows Server 2016 Standard - WDS01.
A WSUS server (my previous post: Installing WSUS from scratch!) running on Windows Server 2016 Standard - WSUS01.
A Hyper-V virtual machine or equivalent - VM01.
Office 2010, 2013 or 2016 installation files. For this demo I’ll be using Office 2016, but the method is the same for both 2010 and 2013.
Adobe Reader DC offline/full installation files.
VLC media player installer.
Google Chrome offline installer.

If you’ve followed my previous post, your Microsoft Deployment Toolkit installation should have Windows 10 1607 imported as an Operating System, KB3193494 imported as a Package, and a Selection Profile for Windows 10 1607 x64 packages created.

Importing Applications - Microsoft Office 2016

Microsoft Office integrates into MDT very well, let’s take a look:

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Microsoft Office 2016.
Enter the Source directory of the installation files.
Enter the Destination directory: Microsoft Office 2016.
For the Command line enter anything - we’ll revisit this soon.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Configure the Application - Microsoft Office 2016

Right click on Microsoft Office 2016, go to the Office Products Tab.
Choose the desired Office Product to Install from the drop down menu.
Check the desired Office language.
To activate Office via KMS leave the Product Key option unchecked.
Check the Customer name option and enter the desired information.
Check the Display level option and select None in the drop down menu.
Check the Accept EULA option.
Check the Always suppress reboot option.
Click Apply.
Go to the Details tab and the Quiet install command should now read: setup.exe /config proplus.ww\config.xml

Microsoft Office is now set up to be installed in an automated fashion by a Task Sequence. If you wish to customise the installation to a greater degree, the Office Customization Tool can be launched from the Office Products tab and you can also add extra Office applications and language packs via the Add button on the same tab.

Importing Applications - Adobe Reader DC

As this is a “real world” demo on creating a reference image, I want to walk through adding common non-Microsoft products. Here we’ll import Adobe Reader DC, VLC media player and Google Chrome.

Go to Deployment Workbench > Deployment Share > Applications.
Right click on Applications and select New Application.
In the New Application Wizard, choose Application with source files.
Give the application the name: Adobe Reader DC.
Enter the Source directory of the Adobe Reader installer file. MDT will copy all files and folders from the specified directory.
Enter the Destination directory: Adobe Reader DC.
For the Command line enter: [adobe reader installer name].exe /sAll.
On the summary page, click Next and after the files are copied click Finish to complete the wizard.

Repeat these steps for other products that you require. The quiet install command that you’ll need can be found in the command line help for the installer or online. Following the same steps for Adobe Reader DC we’ll add VLC media player. The command line will be: vlc-2.2.4-win32.exe /S

Now we’ll add Google Chrome, the command line will be: msiexec /I googlechromestandaloneenterprise64.msi /qn

If you need to customise the Adobe Reader DC installation to a greater degree then you may want to download the Adobe Customisation Wizard, which will enable you to create a transform file which you can call using the command line: [adobe reader installer name\.exe /msi TRANSFORMS="%DEPLOYROOT%\Applications\Adobe Reader DC\TRANSFORM-FILE.mst" /qn

Create the Task Sequence

These steps will create a Task Sequence that will:

Format the hard disk.
Install Windows 10 1607 with KB3193494 included.
Check for and install updates from the WSUS server.
Install Adobe Reader DC, Office 2016, VLC Media Player and Google Chrome.
Check for and install updates from WSUS once again.
Suspend the Task Sequence for user profile customisation.
Capture the image and copy to the Deployment Share.

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Task Sequences and select New task sequence.
Enter the ID for the Task Sequence: REF-W101607.
Enter the name for the Task Sequence: Build - Reference W101607.
Select the Standard Client Task Sequence template.
Select Windows 10 Enterprise 1607 x64 as the Operating System.
Select Do not specify a product key at this time.
Enter an Organization name.
Select Do not specify an Administrator password at this time.
Click Next > Next > Finish to complete the wizard.

Configure the Task Sequence

Go to Deployment Workbench > Deployment Share > Task Sequences.
Right click on Build - Reference W101607 and select Properties.
On the Task Sequence tab navigate to Preinstall > Apply Patches.
On the Properties tab of the Apply Patches action, change the Selection profile to Windows 10 1607 x64.
Navigate to State Restore > Windows Update (Pre-Application Installation).
On the Options tab of the Windows Update (Pre-Application Installation) action, uncheck Disable this step.
Repeat step 6 for the Windows Update (Post-Application Installation) action below the Install Applications action.
Select the Install Applications action.
In the Properties tab select Install a single application, then click the Browse button and select Microsoft Office 2016 from the list.
Rename the Install Applications action to Install - Microsoft Office 2016.
Copy and Paste the Install - Microsoft Office 2016 action with either CTRL + C then CTRL + P or by right clicking and selecting copy and then paste.
Select the top copy of the Install - Microsoft Office 2016 action.
In the Properties tab of the copied action, click the Browse button and select Adobe Reader DC from the list.
Rename the copied action to Install - Adobe Reader DC.
Repeat steps 11 - 14 for VLC and Google Chrome.
Select the Custom Tasks group under the Windows Update (Post-Application Installation) action.
In the Properties tab, change the name to Suspend for profile.
Click on the Add button at the top of the Task Sequence actions view and go to General > Restart computer, click to add the action.
Click on Add once again and go to General > Run Command Line.
On the Properties tab of the action just created, in the Command line field enter: cscript.exe "%SCRIPTROOT%\LTISuspend.wsf
In the Name field enter Suspend.
Make a copy of the previous Restart computer action and using the Up and Down buttons at the top of the Task Sequence actions view, move it below the Suspend action.
Click Apply.
Go to the OS Info tab of the main Task Sequence window and click Edit Unattend.xml - this will create a catalogue file and may take some time.
When the catalogue has been created, the Windows System Image Manager will open.
Navigate to 7 oobeSystem > Shell Setup_neutral > OOBE.
Select ProtectyourPC in the OOBE Properties window and change 1 to 3.
Save the Unattend.xml by clicking the Save 💾 icon. You may get a prompt about validation errors, these are safe to ignore - click Yes.
Close the Windows System Image Manager and click OK to close the Task Sequence Properties window.

Testing the Task Sequence

Now we’re going to test the Task Sequence using a Virtual Machine. Open Hyper-V or your virtual machine software and create a VM with the following specifications:

2x vCPUs
4GB RAM
40GB minimum Hard Disk
Network Adaptor with access to the MDT and WSUS server.
The LiteTouch_x64.iso from the \\WDS01\DeploymentShare$\Boot folder added as a boot device.

Start the Virtual Machine and boot into the deployment environment from the LiteTouch_x64.iso.
Select the Build - Reference W101607 task sequence.
Enter VM-REF1 as a Computer name.
In the Capture image section, select Capture an image of this reference computer. The location and file name should be set automatically from the Rules.ini file in the deployment share, which should be configured as in my previous post.
Click Next to start the Task Sequence.
The task sequence should stop when it reaches the Suspend action. This is when you should do profile customisation, such as Start Menu layout and initial application setup.
When you’re ready to continue the task sequence, double click the Resume Task Sequence icon on the desktop.
The VM will boot into the deployment environment and capture the image to \\WDS01\DeploymentShare$\Captures.
When the VM shuts down, the Task Sequence is complete.

Importing the Reference Image

If the Task Sequence has run successfully you should now have a reference image. We will now import it into the Deployment Share as an Operating System in order to deploy it.

Go to Deployment Workbench > Deployment Share > Operating Systems.
Right click on Operating Systems and select Import Operating System.
Select Custom image file.
Browse to \\WDS01\DeploymentShare$\Captures and select the Reference Image to import.
Select Setup files are not needed.
Enter the Destination directory name: REF-W101607.
Click Next > Finish to import the image and complete the wizard.
You’ll notice that the image you just imported has a long unwieldy name. Right click on the image, select Rename and enter: REF-W101607.

The reference image is now ready to be deployed on to physical devices, which I cover in the next post (Deploying a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443) along with driver management, domain joining and other post-imaging tasks. If you have any questions or comments, please leave them below.

-Mike

Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607/1703

Sat, 26 Nov 2016 19:05:25 +0000

For this post the demo network consists of an Active Directory Domain Controller (DC01), a WSUS server (WSUS01) - here’s a previous post on installing WSUS, a server that will have Microsoft Deployment Toolkit installed (WDS01) and a blank Hyper-V Virtual Machine for creating the reference image.

Update 2017-05-02: Please note that this post is also relevant to building Windows 10 1703 (Creators Update) images. I’ve posted about the differences here.

The WDS01 server is a Hyper-V VM configured like so:

2 vCPUs
4GB RAM
C:\ for Windows
E:\ for MDT

We’ll be using Microsoft Deployment Toolkit (MDT) version 8443, which at the time of writing is a recent release, after a long time of being at version 2013 Update 2. Microsoft explain in this blog post about removal of the year/update naming scheme and development going forward - essentially, it’s not going away, they will still keep developing it. Software we’ll be using:

Windows 10 1607 Assessment and Deployment Kit (ADK)
Microsoft Deployment Toolkit (8443)
Windows 10 1607 x64 install files
Cumulative update for Windows 10 Version 1607: September 20, 2016 - If using a WSUS server
VLC Media Player (for software install demo)

Install

First we’ll install the Windows 10 1607 ADK. The setup will need to download additional files so it may take some time depending on your internet connection. On the Select the features you want to install screen select:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
Imaging And Configuration Designer (ICD)
Configuration Designer
User State Migration Tool (USMT)

Now install MDT by running the setup file downloaded earlier, there is no specific configuration during the install wizard.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\DeploymentShare.
Enter the Share name: DeploymentShare$.
Give the share a descriptive name.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.

Now we’re going to add Windows 10 1607 as an Operating System to deploy.

Mount the Windows 10 1607 .iso in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted .iso as the Source directory.
For the destination directory name enter Windows 10 Enterprise 1607 x64 and complete the wizard.
Go to the Operating Systems node again and rename the OS you just added to Windows 10 Enterprise 1607 x64.

Importing Packages & Creating Selection Profiles

We will now import the Cumulative Update for Windows 10 Version 1607 (KB3193494) into MDT, so that it can be installed with the OS.

Go to Deployment Workbench > Packages.
Create a folder named Windows 10 1607 x64.
Right click on the folder and select Import OS Packages and go through the wizard to add the package. The package must be in a folder by itself.

Now we will create a selection profile so that the package is only installed for Windows 10 1607 x64.

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows 10 1607 x64.
On the Folders page, tick the Windows 10 1607 x64 folder under Packages and complete the wizard.

Importing Applications

We’ll now import VLC Media Player, so it can be installed as part of the reference image.

In Deployment Workbench right click on Applications and select New Application.
Select Application with source files, then on the Details page, enter VLC Player as the Application Name.
On the Source page, enter the location of the VLC executable, it will need to be in a folder by itself as the wizard will copy all files in the location specified.
Enter the name: VLC for the directory.
On the Command Details page enter the name of the VLC executable with the /S option - this will install VLC silently without user interaction.
Complete the wizard.
In the Applications node, rename the VLC app to Install - VLC.

Create a Task Sequence

We’ll now create a Task Sequence to build a fully updated Windows 10 1607 x64 reference image, with VLC installed.

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: B-W10-1607.
Name it Build Windows 10 1607.
Select Standard Client Task Sequence.
Select the Operating System Windows 10 1607 x64.
Do not specify a product key at this time.
Enter an Organization name.
Do not specify an Administrator password at this time.
Complete the wizard.

Configure the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the OS Info tab and click Edit Unattend.xml. It will take sometime to generate the catalog.
When the Unattend.xml opens, go to 7 oobesystem > amd64_Microsoft-Windows-Shell-Setup__neutral > OOBE.
Change the ProtectYourPC setting to 3. This will prevent the image from randomly checking for updates whilst it is being built.
Save the Unattend.xml, you can safely ignore an warnings.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder, and select the Apply Patches item.
Change the Selection Profile to Windows 10 1607 x64.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
In the right side of the Properties box, select the Install a single application option and click the Browse… button.
Select Install - VLC and change the name Install Applications to Install - VLC.
Click Apply and close the Task Sequence.

Configure Deployment Rules

Before we create the boot media we must configure several settings that will effect how the boot media will connect to the deployment environment.

In Deployment Workbench, right click the deployment share and select Properties.
On the Windows PE tab, select the Drivers and Patches sub-tab.
Under the Selection Profile drop down menu, change it to All Drivers.
Select the Platform drop down menu and select x64 and again change the Selection Profile to All Drivers.

Now we must create an Active Directory account for MDT to use and give it permissions to the Deployment Share.

Go to Active Directory Users and Computers.
Create a user called mdt_admin.
On WDS01 (where the deployment share is hosted), give mdt_admin Full Control share permissions and Full Control permissions to all the files and folders under the deployment share.

We will now configure the Rules and Bootstrap.ini. The settings below enable auto log in and skip the welcome screen.

In Deployment Workbench, right click the deployment share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\WDS01\DeploymentShare$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

On the Rules tab of the Deployment Share properties window, add the settings below. A lot of the settings are specific to my demo environment such as my location in the world. The [Virtual Machine] section near the top is one example of how to manage drivers and auto fill computer names for when deploying images based on the model reported by Windows. I’ll cover this in more detail a future post.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix
 
[Virtual Machine]
DriverGroup001=Virtual Machine
DriverSelectionProfile=nothing
OSDPrefix=VM
 
[Default]
_SMSTSORGNAME=Mike Galvin | OSD Solutions
_SMSTSPackageName=%TaskSequenceName%
UserDataLocation=NONE
ComputerBackupLocation=\\WDS01\DeploymentShare$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date)#.wim
OSInstall=Y
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
WSUSServer=http://wsus01:8530
SkipAdminPassword=YES
SkipCapture=NO
SkipRoles=YES
SkipProductKey=YES
SkipUserData=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
OSDComputerName=%OSDPrefix%-%SerialNumber%

Creating Boot Media

Now we’ll create the boot media.

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing Boot Media

To test the boot media, copy the LiteTouchPE_x64.iso from \\WDS01\DeploymentShare$\Boot to a location where the new Hyper-V VM will be able to access it. Set the configuration of the VM as such:

2 vCPUs
4GB RAM
NIC

Add the LiteTouchPE_x64.iso as a boot device. Start the VM and it should boot from the iso into the MDT environment, which is using Windows PE. You should be presented with a wizard and the Task Sequence you created earlier. Select it and click Next. The Computer Name should be already filled in with something like VM-1234-1234…etc. Replace it with vm-ref-w10. Select Capture an image of this reference computer. The Task Sequence should now run, install Windows 10, update from the WSUS server, install VLC and then capture the image. When this process completes the VM will be shutdown and a file named B-W10-1607_YEAR_MONTH_DAY.wim will be in \\WDS01\DeploymentShare$\Captures. You now have a functioning MDT server and a Task Sequence to build and capture a reference image with Windows 10 1607. I will post in future on how to deploy the captured image, manage drivers, and deploy common application like Microsoft Office 2016. Hopefully for now, this post has given you what you need to get started with MDT and deploying Windows 10.

If you have any questions or comments, please leave them below.

-Mike

Paint 3D Preview with a Hyper-V Virtual Machine

Wed, 26 Oct 2016 20:19:49 +0000

If you’ve seen the news from the latest Microsoft Event, you’ll know that the next Windows 10 update, dubbed the “Creator Update” will be out early next year. One of the new tools shown was Paint 3D which looks to make the creation of 3D content more accessible. You can check it out right now, if you are a member of the Windows Insider Preview Program - which anyone can join. You’ll need Build 14800 or greater to install the app, and you’ll find it in the Windows Store as “Paint 3D Preview”.

If, like me, you have your Insider install of Windows 10 on a Hyper-V VM, performance of Paint 3D may not be as good as it could be. You can greatly increase graphics performance of your VM by enabling RemoteFX - if your graphics card supports it. To enable Hyper-V to use the graphics card with RemoteFX: Hyper-V Manager > Hyper-V Settings > Physical GPUs > Select the GPU and then tick Use this GPU with RemoteFX.

Next, in the Settings of the Virtual Machine, go to Add Hardware > RemoteFX 3D Video Adaptor > Add. You will now have a dedicated graphics card available to your VM. You can configure it further if you’d like by selecting the RemoteFX 3D Video Adapter in the Hardware list.

Now, when you boot the VM and load Paint 3D, performance should be closer to what you would expect running it natively.

If you have any questions or comments, please leave them below.

-Mike

Windows 10 1703 Creators Update on gal.vin

Upgrading to Windows 10 1703 (Creators Update) with Windows Server Update Services (WSUS)

Prerequisites

Upgrading Windows 7 to Windows 10 1703 with WSUS

Finding and Approving the Update for Windows 7

Performing the Upgrade on Windows 7

Upgrading Windows 10 1511 to Windows 10 1703 with WSUS

Finding and Approving the Update for Windows 10 1511

Performing the upgrade on Windows 10 1511

Upgrading to Windows 10 1703 (Creators Update) with Microsoft Deployment Toolkit

Installing & Configuring Microsoft Deployment Toolkit and Dependencies

Create the Deployment Share

Add an Operating System

Importing Applications (Optional)

Configure the Application - Microsoft Office

Create a Task Sequence

Configure the Task Sequence

Create an Active Directory User for MDT

Configure Bootstrap.ini

Configure Rules.ini

Run the Upgrade Task Sequence

Building a Windows 10 1703 (Creators Update) Reference Image with Microsoft Deployment Toolkit

Installing & Configuring Microsoft Deployment Toolkit and Dependencies

Create the Deployment Share

Add an Operating System

Importing Packages

Creating A Selection Profile

Importing Applications (Optional)

Configure the Application - Microsoft Office

Create a Task Sequence

Configure the Task Sequence

Create an Active Directory User for MDT

Configure Bootstrap.ini

Configure Rules.ini

Creating The Boot Media

Testing The Boot Media

Some Notes On Building a Windows 10 1703 (Creators Update) Reference Image with Microsoft Deployment Toolkit

There’s No RSAT for Windows 10 1703

Auto Logon No Longer Works With MDT and Windows 10 1703

Removing UWP Apps From Windows 10 1703

WSUS Updates Getting “stuck”

Windows 10 Opens The Default Browser To MSN.com On Every Login

Windows 10 1607/1703 Start Menu Customisation - Update

Windows 10 Insider Preview (Creators Update) - New OOBE

Feature Spotlight: Night light

Building a Windows 10 1607 Reference Image with Microsoft Deployment Toolkit 8443

Prerequisites

Importing Applications - Microsoft Office 2016

Configure the Application - Microsoft Office 2016

Importing Applications - Adobe Reader DC

Create the Task Sequence

Configure the Task Sequence

Testing the Task Sequence

Importing the Reference Image

Getting Started With Microsoft Deployment Toolkit 8443 and Windows 10 1607/1703

Install

Create the Deployment Share and an Import Operating System

Importing Packages & Creating Selection Profiles

Importing Applications

Create a Task Sequence

Configure the Task Sequence

Configure Deployment Rules

Creating Boot Media

Testing Boot Media

Paint 3D Preview with a Hyper-V Virtual Machine