Windows 11 21H2 on gal.vin

Restore The Legacy Context Menu in Windows 11

Thu, 22 Sep 2022 17:20:28 +0100

Updated: 2024-08-08 This method still works.

Windows 11 introduces a new more cohesive UI design but one of the casualties is the right-click or context menu in File Explorer and on the Desktop. You can still access the legacy Windows 10 style menu by clicking on “Show more options” or by using the shortcut key Shift + F10, but if you just want the old menu back by default, you just need to create a new registry key.

Copy and paste one of the commands below into a command prompt or a powershell console and after a reboot the old menu will be the default after a restart.

These commands create a new default key at the path specified.

`1`	`reg add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve`

`1`	`New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" -Name 'InprocServer32' -Force`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Better Windows Updates For Everyone

Tue, 14 Dec 2021 01:49:09 +0000

In this post I’m going to show how to quickly configure Windows Updates so that you only receive important security updates. We’ll cover Home and Pro/Enterprise users of both Windows 10 and Windows 11.

These are also the settings I use myself and recommend for most users.

These settings may also be helpful for IT admins.

Set Active Hours - Windows 10

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then Update & Security > Change active hours.

Turn off the setting Automatically adjust active hours... and click on Change next to Current active hours

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Set Active Hours - Windows 11

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then go to Windows Update > Advanced Options > Active Hours

Change the Adjust active hours setting from Automatically to Manually.

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Registry Settings - Windows 10 Home

If you are running Windows 10 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 10 Pro/Enterprise

With Windows 10 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows update for Business
Select Manage preview builds and set it to Enabled and change the drop down menu to Disable preview builds
Select Select when Preview Builds and Feature Updates are received and set it to Enabled
Change the drop down menu to Semi-Annual Channel and then for After a Preview Build or Feature Update is released, defer receiving it for this many days enter 365.
Select Select when Quality Updates are received and set it to Enabled
For After a Quality updates is released, defer receiving it for this many days enter 5.

Registry Settings - Windows 11 Home

If you are running Windows 11 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 11 Pro/Enterprise

With Windows 11 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update
Select Select when Preview Builds and Feature Updates are received and set it to Enabled and then for How many days after a Feature Update is released... enter 365.
Next, select Select when Quality Updates are received and set it to Enabled and then for After a quality update is released.. enter 5.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 11 21H2 Reference Image

Mon, 22 Nov 2021 16:05:13 +0000

News and Updates

An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress

In this article as with my previous ones we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 11 21H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Extract the files from the self-extracting archive and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files. If you have existing shares you will need to copy the files from the update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Deploy Windows 11 21H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below are a bare minimum configuration from my lab, and you may want to add more to overtime.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

The settings below deserve some explanation. The [Virtual Machine] section is regarding driver installs which we’ll cover more later in this post. The Join Domain section is important. Here I’ve put the mdt_admin account to use as the account to join the device being imaged to the domain contoso.com. If you are following this guide to the letter, the mdt_admin account would not have the appropriate permissions to join a device to a domain, and so you should either give it the permissions required or create a new account for that specific purpose.

The other settings are location preferences relevant to the UK and resolution settings which prevent the finished device from defaulting to a resolution of 1024 x 768, and instead use the recommended resolution Windows receives from the display.

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO, so it will be LiteTouchPE_x64-deploy.iso. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64-deploy.iso into the deployment environment, you will be presented with a login screen and here you should login with the Active Directory credentials that have access to the Deployment Share. Once logged in you will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next. You’ll be prompted to enter a name for the device, it will also be added to Active Directory under this name. Click Next and the task sequence will begin.

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 11 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 11 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 11 21H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

Now we’re going to configure how drivers are installed for the physical devices we’re going to deploy Windows 11 to. There are a few ways to do this, here I’ll show the ‘Total Control’ method I’ve been using more recently.

The first thing you’ll need is the manufacturer and model numbers for all the devices you want to roll out the image to. You can find this out by booting a device in to its current version of Windows or the WinPE deployment environment using the LiteTouch_x64.iso boot disc or PXE booting. Here’s a previous post I wrote on how to setup PXE booting for MDT if needed: PXE Booting for Microsoft Deployment Toolkit

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

The output of the commands is the manufacturer name and model number you’ll need. The next thing you’ll need is the drivers. Windows 11 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Most large manufacturers (Dell, HP, Lenovo) do a decent job of providing drivers that can be used with MDT. Should you have difficulty with them you can use the Microsoft Update Catalog to search for and download the specific drivers that Windows Update installs and use them with MDT. Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

If you have many different manufacturers and models then this process can be quite tedious. I’ve created a PowerShell script to automate the process, it’s on my GitHub here. It requires some documentation which I will provide in a separate post.

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 11 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 11 21H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 11 21H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Installing Remote Server Administration Tools (RSAT) for Windows 10/Windows 11

Wed, 13 Oct 2021 17:56:52 +0100

In this guide we’ll go through how to quickly add all of them using PowerShell and where they are in the GUI.

Installing RSAT the quickest and easiest way using PowerShell

Run the following command in an elevated PowerShell session.

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Installing RSAT using the GUI in Windows 11

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then “Optional Features”.
On the “Add an optional feature” section, click “View features”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
In the new window click the “Install” button to install the tools you selected.
When installation is completed, the icons will be available in the Start Menu under “Windows Tools”.

Installing RSAT using the GUI in Windows 10

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then the text link “Optional Features”.
On the new page click “Add a feature”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
Click the “Install” button to install the tools you selected. You should see the tools you selected be installed under “Latest Actions”.
When installation is completed, the icons will be available in the Start Menu under “Windows Administrative Tools”.

Offline Installation

The above methods require an internet connection for Windows to download the files needed. To install the tools offline you will need to download the Windows 10/11 Features On Demand ISO which is available via the Volume Licensing Portal. I haven’t found a link to these ISO’s direct from Microsoft anywhere else. Once you have downloaded the ISO, extract the files to a location and run the following PowerShell command:

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online -LimitAccess -Source "C:\FOD-ISO-Extracted\`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 11 21H2 Reference Image

Sat, 25 Sep 2021 20:02:09 +0100

News and Updates

Update: 2021-11-12 After testing, a Build and Capture Task Sequence now appears to work and sysprep works as expected.
An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11.
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 11 21H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with. Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 11 21H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 11 21H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 11 21H2 and complete the wizard
Go to the Operating Systems > Windows 11 21H2 node and rename the new entries added to Windows 11 21H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 11 21H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 11 21H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 11 21H2
On the Folders page, tick the Windows 11 21H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application.

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

To add other software, you’ll need to repeat the steps above, with the relevant Command line to silently install them. Below are a few command lines for some software I frequently install silently, along with the links to the ‘offline’ installers.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Build Windows 11 21H2
Select Standard Client Task Sequence
Select the Operating System Windows 11 21H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 11 21H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab or closed development environments.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 11 21H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W11-21H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 11 21H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Customisation

Sat, 04 Sep 2021 17:09:28 +0100

Windows 11 is very similar to Windows 10 is terms of technology and core services, however with the new UI and Start Menu refresh there are some new elements that you may want to remove.

Microsoft now expects the Start menu layout to be managed by an MDM service, if you want to do it without that then the easiest method is to copy the start.bin files.

Use a existing Windows 11 install to setup the Start menu layout how you want it.
Copy the start.bin file from %LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState to a folder in the MDT Deployment Share - in my case, I’ll use “_custom”.
Within your deployment Task Sequence you’ll want to copy the start.bin file to C:\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState
For all new users they will now get the start menu layout you specified.

I use a PowerShell script to copy the start.bin to the correct location.

$src = "Z:\_custom"

New-Item -Type Directory -Path "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState"
Copy-Item -Path "$src\w11_StartLayout\start.bin" -Destination "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState" -Force

Disable Search On The Taskbar

Currently I have not found the Group Policy settings for the new additions to the Taskbar, so here are the registry entries to disable/hide the extra icons.

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search"`

The key is a DWORD (32-bit) Value name SearchboxTaskbarMode and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Widgets On The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarDa and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Chat In The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarMn and it has 2 states:

0 (Hide icon)
1 (Show icon)

Default App Associations

Importing a list of default app associations for Windows 11 is the same as Windows 10, but I think it’s worth mentioning that Windows 11 has done away with the “Default Apps” section of Settings and so now it can be a lot more work to set them all on a template system to export. You can however still import a default app associations file that was created on Windows 10 into Windows 11.

Exporting A Default App Association File

`1`	`Dism /Online /Export-DefaultAppAssociations:"C:\foo\w11_AppAssoc.xml"`

Importing A Default App Association File as part of an MDT Task Sequence

You will need to create a new “Run Command Line” item just under “Postinstall” - see the image below.

`1`	`Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%deployroot%\_custom\w11_appassoc\w11_AppAssoc.xml`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Microsoft Store Apps

Sat, 04 Sep 2021 14:43:29 +0100

This post is a cut down version of this one and only focusses on Windows 11 for clarity.

Important note!

A “provisioned app” is an app that is a part of the Windows 11 installation and will be available for all users. Otherwise the app is only installed for the currently logged on user. To remove apps for all future users and the currently logged on user, you must remove both types of app.

Removing Specific Microsoft Store Apps

To remove a specific app from your Windows 11 installation, first you need to find the application package name.

Provisioned apps:

`1`	`Get-AppxProvisionedPackage -Online \| Select PackageName`

Current user apps:

`1`	`Get-AppxPackage \| Select PackageFullName`

Then run the following PowerShell command to remove the specific app

Provisioned app:

`1`	`Remove-AppxProvisionedPackage -PackageName [PackageName here] -Online`

Current user app:

`1`	`Remove-AppxPackage -Package [PackageFullName here]`

List Of Apps Included With Windows 11 21H2

Here are the provisioned apps included with Windows 11 21H2.

PowerShell Display Name	Readable App name
Microsoft.549981C3F5F10	Cortana
Microsoft.BingNews	Microsoft News
Microsoft.BingWeather	Weather
Microsoft.DesktopAppInstaller	None
Microsoft.GamingApp	Xbox
Microsoft.GetHelp	Get Help
Microsoft.Getstarted	Tips
Microsoft.HEIFImageExtension	None
Microsoft.MicrosoftEdge.Stable	Microsoft Edge
Microsoft.MicrosoftOfficeHub	Office
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection
Microsoft.MicrosoftStickyNotes	Sticky Notes
Microsoft.Paint	Paint
Microsoft.People	People
Microsoft.PowerAutomateDesktop	Power Automate
Microsoft.ScreenSketch	Snip & Sketch
Microsoft.SecHealthUI	None
Microsoft.StorePurchaseApp	None
Microsoft.Todos	Microsoft To Do
Microsoft.UI.Xaml.2.4	None
Microsoft.VCLibs.140.00	None
Microsoft.VP9VideoExtensions	None
Microsoft.WebMediaExtensions	None
Microsoft.WebpImageExtension	None
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”
Microsoft.WindowsAlarms	Alarms & Clock
Microsoft.WindowsCalculator	Calculator
Microsoft.WindowsCamera	Camera
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”
Microsoft.WindowsFeedbackHub	Feedback Hub
Microsoft.WindowsMaps	Maps
Microsoft.WindowsNotepad	Notepad
Microsoft.WindowsSoundRecorder	Voice Recorder
Microsoft.WindowsStore	Microsoft Store
Microsoft.WindowsTerminal	Terminal
Microsoft.Xbox.TCUI	None
Microsoft.XboxGameOverlay	None
Microsoft.XboxGamingOverlay	Xbox Game Bar
Microsoft.XboxIdentityProvider	None
Microsoft.XboxSpeechToTextOverlay	None
Microsoft.YourPhone	Your Phone
Microsoft.ZuneMusic	Groove Music
Microsoft.ZuneVideo	Films & TV
MicrosoftWindows.Client.WebExperience	None

Remove Specific MS Store Apps From An Online Windows 11 WIM Image

Download my PowerShell utility from GitHub.

The script removes the apps specified in a text file from the current logged on user and Windows 10/11. I use the script as a part of my Task Sequence for deploying Windows 10/11. The script is heavily based on work by Jörgen Nilsson - check out his post over on his site.

Remove Specified MS Store Apps From An Offline Windows 11 WIM Image

First, you will need to copy the contents of the Windows 11 ISO file to your hard drive.

Windows 11 includes many editions within it’s WIM file. You will need to specify the index ID of the image to operate on. You can obtain this by running the following PowerShell command:

`1`	`Get-WindowsImage -ImagePath "C:\foo\Windows 11\sources\install.wim" \| Format-Table -Property ImageIndex, ImageName`

The output of the command above should look similar to this:

ImageIndex ImageName
---------- ---------
1 Windows 11 Education
2 Windows 11 Education N
3 Windows 11 Enterprise
4 Windows 11 Enterprise N
5 Windows 11 Pro
6 Windows 11 Pro N
7 Windows 11 Pro Education
8 Windows 11 Pro Education N
9 Windows 11 Pro for Workstations
10 Windows 11 Pro N for Workstations

Now you can use the information above to configure the PowerShell utility to remove the specific apps from the Windows install image. This script will mount the image, remove the apps and then dismount it. The image can then be made into an ISO or used with MDT/SCCM to deploy Windows as normal.

Download my PowerShell utility from GitHub.

Remove All Included Microsoft Store Apps (Not Recommended)

Note: This process is destructive and non-reversible. Please ensure you have backups before proceeding. To quickly remove all the apps for the current user, run the following PowerShell command:

`1`	`Get-AppxPackage \| Remove-AppxPackage`

To remove all the provisioned apps, run the following PowerShell command:

Note: Provisioned apps are the apps that will be installed for all new users when they first log on.

`1`	`Get-AppxProvisionedPackage -Online \| Remove-AppxProvisionedPackage -Online`

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Disable Network Discovery in Windows 10/11

Tue, 20 Apr 2021 23:18:59 +0100

Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
Inside the Inbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-In)
- Network Discovery (NB-Datagram-In)
- Network Discovery (NB-Name-In)
- Network Discovery (Pub-WSD-In)
- Network Discovery (SSDP-In)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-In) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

Inside the Outbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to e.g. Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-Out)
- Network Discovery (NB-Datagram-Out)
- Network Discovery (NB-Name-Out)
- Network Discovery (Pub-WSD-Out)
- Network Discovery (SSDP-Out)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-Out) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Select the Function Discovery Provider Host service and go to it properties page.
Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
Repeat the above steps for the following services:

Function Discovery Resource Publication
Link-Layer Topology Discovery Mapper
SSDP Discovery
UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 21H2 on gal.vin

Restore The Legacy Context Menu in Windows 11

Support My Work

Better Windows Updates For Everyone

Set Active Hours - Windows 10

Set Active Hours - Windows 11

Registry Settings - Windows 10 Home

Group Policy Settings - Windows 10 Pro/Enterprise

Registry Settings - Windows 11 Home

Group Policy Settings - Windows 11 Pro/Enterprise

Support My Work

Deploy Windows 11 21H2 Reference Image

News and Updates

Installing the MDT Update: MDT_KB4564442

Creating the Deployment Share

Add an Operating System

Create a Task Sequence

Configuring the Task Sequence

Securing the Deployment Share

Configure Bootstrap.ini

Configure CustomSettings.ini

Creating the Boot Media

Testing the Task Sequence

Setting the Default Application Associations

Driver Management

Adding Drivers to the MDT Boot Image

Support My Work

Installing Remote Server Administration Tools (RSAT) for Windows 10/Windows 11

Installing RSAT the quickest and easiest way using PowerShell

Installing RSAT using the GUI in Windows 11

Installing RSAT using the GUI in Windows 10

Offline Installation

Support My Work

Build and Capture Windows 11 21H2 Reference Image

News and Updates

Installing Microsoft Deployment Toolkit and Dependencies

Creating the Deployment Share

Adding an Operating System

Creating Package Folder for Future Updates

Creating A Selection Profile

Importing Applications

Configuring Applications

Creating a Task Sequence

Configuring the Task Sequence

Creating a service account for MDT in Active Directory

Configuring Bootstrap.ini

Configuring CustomSettings.ini

Creating the Boot Media

Testing and Capturing a Reference Image

Support My Work

Windows 11 Customisation

Start Menu Layout

Disable Search On The Taskbar

Disable Widgets On The Taskbar

Disable Chat In The Taskbar

Default App Associations

Exporting A Default App Association File

Importing A Default App Association File as part of an MDT Task Sequence

Support My Work

Windows 11 Microsoft Store Apps

Removing Specific Microsoft Store Apps

List Of Apps Included With Windows 11 21H2

Remove Specific MS Store Apps From An Online Windows 11 WIM Image

Remove Specified MS Store Apps From An Offline Windows 11 WIM Image

Remove All Included Microsoft Store Apps (Not Recommended)

Support My Work

Disable Network Discovery in Windows 10/11

Fully disabling Network Discovery in Windows 10 using Group Policy

Firewall Rules

System Services

Support My Work