Windows 11 on gal.vin

Nvidia system tray icon is always visible

Mon, 05 Jan 2026 08:48:24 +0000

I found this fix on reddit, many thanks to user Valour-549 for this information.

Create a DWORD named “StartOnLogin” and set it to 0 at this location:

`1`	`HKEY_CURRENT_USER\SOFTWARE\NVIDIA Corporation\NvTray`

and also a this location, you may need to create the NvTray key:

`1`	`HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvlddmkm\NvTray`

Thanks
-Mike

A Powershell Replacement for wmic

Wed, 04 Jun 2025 11:39:52 +0100

If you’ve tried to use the wmic command in Windows 11 recently you’ll probably receive this error message:

“wmic: The term ‘wmic’ is not recognized as a name of a cmdlet, function, script file, or executable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.”

The wmic command is no longer part of Windows 11. I used to use wmic a lot to get model and manufacture information, primarily for drivers. Luckily this command has a PowerShell replacement.

`1`	`Get-WmiObject -Class Win32_Bios`

`1`	`Get-CimInstance -ClassName Win32_ComputerSystem`

Both of the above can be used to obtain manufacturer and model information for a system.

Thanks
-Mike

My Windows 11 24H2 Setup Process

Wed, 01 Jan 2025 18:10:07 +0000

With standard Windows 10 support ending this year I think it’s a good time to share what I do to a fresh Windows 11 24H2 installation to make it work for me and reduce annoyances. Windows used to be very useable out of the box, but since Windows 8 its been on a downward spiral with Microsoft making more and more bad decisions…in my opinion. Anyway, here’s how I fix Windows when I do a fresh install.

Please note that during testing some registry changes didn’t take immediate effect. It might have been that I needed to restart for some changes to take effect, but if you experience it too, it’s not just you. Because of this I’ve also included where some settings are in the GUI.

Turn Off Sticky Keys

Tap the Shift key 5 times and a dialogue box will pop up. (If it doesn’t Sticky Keys is already disabled most likely)
Click the text “Disable this keyboard shortcut…” the Windows Settings panel will open.
Click the > next to the Off/On switch on the Sticky Keys option.
Click the Off/On switch on the “Keyboard shortcut for Sticky keys” option.

`1`	`New-ItemProperty -Path "HKCU:\Control Panel\Accessibility\StickyKeys" -Name 'Flags' -Value 26 -PropertyType String -Force`

Remove Windows 11 Optional Features

Win + R appwiz.cpl > “Turn Windows Features on or off”

List all currently enabled optional features:

`1`	`Get-WindowsOptionalFeature -Online \| Where-Object {$_.state -eq "Enabled"}`

This is what I disable:

Disable-WindowsOptionalFeature -FeatureName "WorkFolders-Client" -Online
Disable-WindowsOptionalFeature -FeatureName "MediaPlayback" -Online
Disable-WindowsOptionalFeature -FeatureName "WindowsMediaPlayer" -Online
Disable-WindowsOptionalFeature -FeatureName "SmbDirect" -Online
Disable-WindowsOptionalFeature -FeatureName "MSRDC-Infrastructure" -Online
Disable-WindowsOptionalFeature -FeatureName "MicrosoftWindowsPowerShellV2Root" -Online
Disable-WindowsOptionalFeature -FeatureName "MicrosoftWindowsPowerShellV2" -Online
Disable-WindowsOptionalFeature -FeatureName "Printing-Foundation-InternetPrinting-Client" -Online

List all Installed Windows Capabilities

`1`	`Get-WindowsCapability -Online \| Where-Object {$_.state -eq "Installed"}`

This is what I remove:

1
2

Remove-WindowsCapability -Online -Name Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0
DISM /Online /Disable-Feature /FeatureName:Recall

Remove Built-in Apps

I use my own FOSS utility I created specially for this task: Remove-MS-Store-Apps Utility

`1`	`powershell -ep bypass "C:\scripts\Remove-MS-Store-Apps.ps1" -list "C:\scripts\apps.txt"`

Here is my apps to remove list:

Clipchamp.Clipchamp
Microsoft.BingNews
Microsoft.BingSearch
Microsoft.BingWeather
Microsoft.GamingApp
Microsoft.GetHelp
Microsoft.MicrosoftOfficeHub
Microsoft.MicrosoftSolitaireCollection
Microsoft.MicrosoftStickyNotes
Microsoft.OutlookForWindows
Microsoft.PowerAutomateDesktop
Microsoft.Todos
Microsoft.Windows.DevHome
Microsoft.Windows.Photos
Microsoft.WindowsAlarms
Microsoft.WindowsFeedbackHub
Microsoft.WindowsSoundRecorder
Microsoft.YourPhone
Microsoft.ZuneMusic
MicrosoftCorporationII.QuickAssist
MicrosoftWindows.CrossDevice
MSTeams

Installing apps via winget

winget is one of the few really useful tools to have come out of Microsoft in recent years.

To find an app to install:

`1`	`winget search "firefox"`

To install the app:

`1`	`winget install --id Mozilla.Firefox`

Remove Search from the Taskbar

Right-click taskbar > Taskbar settings > Search > Hide

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" -Name 'SearchboxTaskbarMode' -Value 0 -PropertyType DWord -Force`

Remove Task View Button on the Taskbar

Right-click taskbar > Taskbar settings > Task view > Off

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'ShowTaskViewButton' -Value 0 -PropertyType DWord -Force`

Windows Services to disable

I don’t do any printing, if you do change Spooler and PrintNotify to ‘Manual’.

1
2
3

Set-Service -Name DiagTrack -StartupType Disabled
Set-Service -Name Spooler -StartupType Disabled
Set-Service -Name PrintNotify -StartupType Disabled

Disable Hibernation and Fast Startup

`1`	`powercfg /h off`

Registry edit via PowerShell:

1
2

New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" -Name "InprocServer32" -Force
Set-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value " " -Force

Remove Gallery from File Explorer for all users

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum" -Name '{e88865ea-0e1c-4e20-9aa6-edcd0212c87c}' -Value 1 -PropertyType DWord -Force`

Setting File Explorer views to be consistent

I use this fantastic FOSS utility: WinSetView

Download the zip file, unzip and run WinSetView.exe.

File Explorer preferences

File Explorer > three dot menu > Options

Show recently used files: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowRecent' -Value 0 -PropertyType DWord -Force`

Show frequently used folders: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowFrequent' -Value 0 -PropertyType DWord -Force`

Show files from Office.com: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" -Name 'ShowCloudFilesInQuickAccess' -Value 0 -PropertyType DWord -Force`

Open File Explorer to: This PC

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'LaunchTo' -Value 1 -PropertyType DWord -Force`

Show hidden files, folders or drives: Enabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'Hidden' -Value 1 -PropertyType DWord -Force`

Hide empty drives: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'HideDrivesWithNoMedia' -Value 0 -PropertyType DWord -Force`

Hide extensions for known file types: Disabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'HideFileExt' -Value 0 -PropertyType DWord -Force`

Display the full path in the title bar: Enabled

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" -Name 'FullPath' -Value 1 -PropertyType DWord -Force`

Remove Widgets from the Taskbar

Right-click taskbar > Taskbar settings > Widgets > Off

Registry edit via PowerShell:

`1`	`New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name 'TaskbarDa' -Value 0 -PropertyType DWord -Force`

Remove Startup Programs

Right-click taskbar > Task Manager > Startup apps > disable desired programs/services

Uninstall One Drive

`1`	`& $env:systemroot\System32\OneDriveSetup.exe /uninstall`

Using Local Group Policy for Configuration

If you have Windows 11 Pro or above you can use the local Group Policy to configure a lot of your settings adn then back them up and restore them onto other PCs. To do this we can use a cool little Microsoft tool called LGPO.exe.

You can download it here: Microsoft Security Compliance Toolkit 1.0

The specific tool you want is: LGPO.zip

Unzip the zip file and copy LGPO.exe to a working directory.

Use /b to backup your current Local Group Policy to a folder.

`1`	`& C:\scripts\LGPO\lgpo.exe /b C:\scripts\My-GPO-Settings`

Use /g to restore a local group policy backup from the specified folder.

`1`	`& C:\scripts\LGPO\lgpo.exe /g C:\scripts\My-GPO-Settings`

My Local Group Policy

Open the local group policy editor with Win + R gpedit.msc

Here is my local group policy settings:

Administrative Templates > Control Panel

Allow Online Tips: Disabled

Network/QoS Packet Scheduler

Limit reservable bandwidth: Enabled
Bandwidth limit (%): 0

System/Internet Communication Management

Restrict Internet communication: Enabled

System/Internet Communication Management/Internet Communication settings

Turn off downloading of print drivers over HTTP: Enabled
Turn off Event Viewer “Events.asp” links: Enabled
Turn off Help and Support Center “Did you know?” content: Enabled
Turn off Help and Support Center Microsoft Knowledge Base search: Enabled
Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com: Enabled
Turn off Internet download for Web publishing and online ordering wizards: Enabled
Turn off Internet File Association service: Enabled
Turn off printing over HTTP: Enabled
Turn off Registration if URL connection is referring to Microsoft.com: Enabled
Turn off Search Companion content file updates: Enabled
Turn off the “Order Prints” picture task: Enabled
Turn off the “Publish to Web” task for files and folders: Enabled
Turn off the Windows Messenger Customer Experience Improvement Program: Enabled
Turn off Windows Customer Experience Improvement Program: Enabled
Turn off Windows Error Reporting: Enabled
Turn off Windows Network Connectivity Status Indicator active tests: Enabled
Turn off Windows Update device driver searching: Enabled

System/OS Policies

Allow Clipboard History: Disabled
Allow Clipboard synchronization across devices: Disabled
Allow publishing of User Activities: Disabled
Allow upload of User Activities: Disabled
Enables Activity Feed: Disabled

System/Remote Assistance

Configure Offer Remote Assistance: Disabled
Configure Solicited Remote Assistance: Disabled

System/User Profiles

Turn off the advertising ID: Enabled

Windows Components/AutoPlay Policies

Turn off Autoplay: Enabled
Turn off Autoplay on: All drives

Windows Components/Cloud Content

Do not show Windows tips: Enabled
Turn off cloud optimized content: Enabled
Turn off Microsoft consumer experiences: Enabled

Windows Components/Data Collection and Preview Builds

Allow commercial data pipeline: Disabled
Allow device name to be sent in Windows diagnostic data: Disabled
Allow Diagnostic Data: Enabled - Diagnostic data off (not recommended)
Allow Update Compliance Processing: Disabled
Allow WUfB Cloud Processing: Disabled
Configure collection of browsing data for Desktop Analytics: Disabled
Configure the Commercial ID: Disabled

Windows Components/Location and Sensors

Turn off location: Enabled
Turn off location scripting: Enabled
Turn off sensors: Enabled

Windows Components/Location and Sensors/Windows Location Provider

Turn off Windows Location Provider: Enabled

Windows Components/Microsoft Defender Antivirus/MAPS

Send file samples when further analysis is required: Enabled
Send file samples when further analysis is required: Never send

Windows Components/Search

Allow Cortana: Disabled
Do not allow web search: Enabled
Don’t search the web or display web results in Search: Enabled

Windows Components/Software Protection Platform

Control Device Reactivation for Retail devices: Enabled
Turn off KMS Client Online AVS Validation: Enabled

Windows Components/Sync your settings

Do not sync: Enabled
Allow users to turn syncing on: Disabled
Do not sync accessibility settings: Enabled
Allow users to turn “accessibility” syncing on: Disabled
Do not sync app settings: Enabled
Allow users to turn “app settings” syncing on: Disabled
Do not sync Apps: Enabled
Allow users to turn “AppSync” syncing on: Disabled
Do not sync browser settings: Enabled
Allow users to turn “browser” syncing on: Disabled
Do not sync desktop personalization: Enabled
Allow users to turn “desktop personalization” syncing on: Disabled
Do not sync language preferences settings: Enabled
Allow users to turn “language preferences” syncing on: Disabled
Do not sync on metered connections: Enabled
Do not sync other Windows settings: Enabled
Allow users to turn “other Windows settings” syncing on: Disabled
Do not sync passwords: Enabled
Allow users to turn “passwords” syncing on: Disabled
Do not sync personalize: Enabled
Allow users to turn “personalize” syncing on: Disabled
Do not sync start settings: Enabled
Allow users to turn “start layout” syncing on: Disabled

Windows Components/Windows Error Reporting

Disable Windows Error Reporting: Enabled

Windows Components/Windows Update/Manage end user experience

Configure Automatic Updates: Enabled
Configure automatic updating: 5 - Allow local admin to choose setting
Install during automatic maintenance: Disabled
Scheduled install day: 0 - Every day
Scheduled install time: 03:00
Every week: Enabled
First week of the month: Disabled
Second week of the month: Disabled
Third week of the month: Disabled
Fourth week of the month: Disabled
Install updates for other Microsoft products: Enabled
Specify active hours range for auto-restarts: Enabled
Specify the max active hours range - Max range: 18

Windows Components/Windows Update/Manage updates offered from Windows Update

Manage preview builds: Disabled
Select when Preview Builds and Feature Updates are received: Enabled
How many days after a Feature Update is released would you like to defer the update before it is offered to the device? - 365

Select when Quality Updates are received: Enabled
After a quality update is released, defer receiving it for this many days: 3

Hope this helps! If you have any questions or comments please leave them below.

Thanks
-Mike

Windows Terminal - quake mode

Sat, 07 Dec 2024 22:30:19 +0000

What is ‘quake mode’?

Quake mode is a Windows Terminal option which starts the program as a large borderless window which can be opened and closed via the keyboard shortcut: WIN + `.

Open Windows Terminal in ‘quake mode’

To start Windows Terminal in quake mode use the following command line switch:

`1`	`wt.exe --window "_quake"`

Open Windows Terminal at startup in ‘quake mode’

To open Windows Terminal in quake mode at start up, go to your startup folder by pressing WIN + R and then typing shell:startup.

A Windows explorer will open. Created a new shortcut .lnk file inside this folder by right-clicking inside the folder “New” > “Shortcut” and then enter the following command:

`1`	`wt.exe --window "_quake"`

When you restart or login next Windows Terminal will open in quake mode.

To open Windows Terminal in ‘quake mode’ minimized at startup, use this command:

For Windows Powershell 5

wt.exe --window "_quake" powershell -window minimized

For Powershell 7

wt.exe --window "_quake" pwsh -window minimized

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Clean Up the WinSxS folder

Wed, 18 Sep 2024 13:36:22 +0100

Windows Updates build up over time and take up a lot of space. These can be cleared out manually using the Disk Cleanup utility but you can also use DISM to script the clean up process.

NOTE: Cleaning up the previous update files prevents the ability to roll back, so make sure your Windows installation is functioning as expected before hand.

Running this command in an elevated PowerShell terminal will remove all the old Windows Update files.

`1`	`Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase`

There is more information available on this process here officially from Microsoft.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Disable IPv6 with PowerShell

Wed, 21 Aug 2024 13:05:47 +0100

Disable IPv6 on all network adaptors

Run the command below in an elevated PowerShell terminal to disable IPv6 on all network adaptors:

`1`	`Disable-NetAdapterBinding -Name * -ComponentID ms_tcpip6`

Disable IPv6 on a specified network adaptor

Run the command below in an elevated PowerShell terminal to list all network adaptors on the system and the enabled or disabled status of IPv6:

`1`	`Get-NetAdapterBinding -ComponentID ms_tcpip6`

Run this command in an elevated PowerShell terminal to disable IPv6 on the adaptor with the specified name:

`1`	`Disable-NetAdapterBinding -Name "ADAPTOR NAME" -ComponentID ms_tcpip6`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments please leave them below.

Thanks
-Mike

Getting Started with MDT Offline Media

Thu, 01 Aug 2024 14:43:39 +0100

Overview

MDT can generate “offline media” which is a way to install Windows, drivers, patches, and applications with no connection to a central server. It’s like creating your own custom Windows ISO but more!

In this guide I’m assuming you already have an MDT Deployment Share created and working as needed. This guide will build on that foundation to create an offline deployment solution.

Before you start here are some points to keep in mind:

Offline media is essentially a new, separate deployment share structure that is created and packed into an ISO file.
Offline media has a separate CustomSettings.ini and Bootstrap.ini file which can be customised the same as the online deployment share.
You can specify what content from the main deployment share is included into the offline media by using selection profiles.
Any content that exists outside of the online deployment share that you wish to be available offline, you can manually copy to the offline media file structure and then re-generate the offline media to have included.

If you have a current deployment share that you wish to continue using alongside offline media, then it’s worth going through it and deciding what content you need in the offline media. This can be applications, drivers, operating systems, packages, and task sequences. I’d recommend creating an “Offline” folder in each section and then copy & pasting the item into the “Offline” folder. This is so we can then create an “Offline Media” Selection Profile that only includes these Offline folders.

How Duplicating Items in MDT Works

Copy & pasting items in MDT duplicates the item and doesn’t create a new copy of the item. So, for example, if you duplicate a task sequence and then make changes to it you are changing that single task sequence. If you need a new “offline” task sequence, then you’ll need to create a new one from scratch. This goes for everything in MDT.

Creating New Applications In MDT For Use With Offline Media

If you plan on including applications with your offline media, you should check that the application item has a “Source directory” configured. If this field is blank, then the application will not be included in the offline media as MDT doesn’t know where to get the files from.

The “Source directory” is configured when you create a new application and the “Application with source files” radio button is selected.

Creating a Selection Profile

In the MDT Deployment Workbench, under “Advanced Configuration/Selection Profiles”:

Right-click on the “Selection Profiles” folder in the left-hand panel and select “New Selection Profile”.
Give the Selection Profile a name - we’ll call it “Offline Media” and click “Next”.
Here you’ll see a list of all the content in your MDT share. Note that you only see folders and not individual items.
Select the items you wish to include in your Offline Media and click “Next” and then Next again.
On the final screen the Process should have completed successfully, click “Finish”.

Creating Offline Media

In the MDT Deployment Workbench, under “Advanced Configuration/Media”:

Right-click on the “Media” folder in the left-hand panel and select “New Media”.
Select the path where the new Offline Media folder structure should be created - it should be outside of any deployment shares. e.g. E:\MDT-Offline
Under “Selection profile” choose the selection profile we created earlier and then click “Next”.
If you browse to the path that you chose in step 2 you should see a “Content” directory and inside that a “Deploy” directory which contains a structure a lot like a normal deployment share.
Under “Advanced Configuration/Media” you should have a new item called “MEDIA001”, right click and select “Properties”.
On the Properties page “General” tab you can configure the platforms (I recommend unchecking “x86” unless you specifically need it) and the name of the ISO file if desired.
On the “Rules” tab you can configure the CustomSettings.ini and the Bootstrap.ini for the Offline Media only. These function in the same way as the main deployment share.
On the “Windows PE” tab, once again this is the Offline Media’s configuration of its WinPE environment.
Once all is configured as needed, right click on the “MEDIA001” and select “Update Media Content” and MDT will build an ISO file with all the content specified from the selection profile chosen in step 3.
When the media creation has completed successfully you can use the ISO file with a VM to test or use a tool like Rufus to use it with a USB drive to image a computer.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

Thanks
-Mike

Thick v Thin Images (Microsoft Deployment Toolkit)

Tue, 15 Nov 2022 15:00:00 +0000

The question of “whether we should do “thick” or “thin” images” comes up a lot and so in this I’m going to go through my thought process when answering this question and hopefully, help you in making the right choice for your environment.

First, lets define the different image types and show the processes for each.

Thick Images

Thick images are an image which is created by an admin containing the Windows installation, Windows updates, applications, application updates and customisations such as - registry changes, Start menu layout and application configurations. Files and configuration changes that are “baked in” to your Windows installation.

The image creation process looks something like this:

Windows installed on VM.
Check for Windows updates and install.
Applications installed.
Applications updated.
Check for Windows updates and install.
Customise Windows and applications.
Capture image.

The image is then deployed to devices. That process is as follows:

Deploy image to device(s).
Drivers installed.
Join domain.
Check for Windows updates, yet again, just in case.
Install applications that need to be installed on final deployment or are subject to frequent updating - anti virus or remote management clients for example.
Any final tweaks that are subject to frequent updates.

Thin Images

Thin images are more of a process in which the Windows image provided from Microsoft is deployed and then updates, applications and any customisations are made as part of a task sequence, group policy or other management system.

The deployment process looks something like this:

Windows image deployed to device(s).
Drivers installed.
Join domain.
Check for Windows updates and install.
Applications installed.
Applications updated.
Check for Windows updates and install.
Customise Windows and applications.

Image Times For Thick/Thin

These times are taken from my image creation and deployment process in my lab. I’m using Hyper-V VMs for the server and client devices. These times are only intended as demonstration purposes.

OS: Windows 10 22H2
Customisations: Remove specific MS Store Apps, script to configure various Windows settings for all users.
Apps: Visual C++ 2017 Redist, .NET 3.1 Desktop Runtime, .NET 5 Desktop Runtime, .NET 6 Desktop Runtime, .NET Framework 3.5, .NET Framework 4.8, 7-zip, Firefox, Google Chrome, Notepad++, OBS Studio, Epic Games Launcher, Ubisoft Connect, Steam Client, Origin, VLC, Adobe Reader, Office 365 Business

Thick Image

Build - Apps, Windows updates from internet, Customisations: 56m 00s
Deploy - Windows updates from internet, Customisations - 9m 55s

Thin Image

Deploy - Apps, Windows updates from internet, Customisations - 1h 00m 17s

You can see for yourself from the times above, thick images put a lot of time into creating the image and deployment is fast, where as the thin image is a longer process to deploy but there is no creation phase making thin images more agile. But this isn’t so say that you can’t combine both methods.

When To Use Thick/Thin

Each of the image types is suited to different situations. For example, if you are deploying a large batch of computers all at once for a classroom, then it would be best to build a thick image on a virtual machine with everything installed and configured as needed and then deploy to the devices.

However, if you are deploying devices in smaller batches over a longer period of time, then the thin image makes more sense because the thick image will be out-of-date and the time needed to install Windows updates and application updates will make the process longer and any time savings that you made from creating a thick image in the first place will be negligible.

Why Not Both?

You can use a combination of both methods if needed. For example if you are using a older version of Adobe’s Creative Suite - a large install that doesn’t get updates these days, then rather than deploy a thin image and install this for each device you could create a Windows images with this and any other large applications that don’t get updates or the updates are quick to install further downstream.

Another way to use both is to have a thick image for large deployments and then a thin image for the devices that trickle in. The downside of this is that you have more to maintain, potentially a “Build” task sequence, “Deploy” task sequence and a “Deploy-Thin” task sequence and everything that comes with it.

Ultimately the choice is yours - you make the best decision you can for your environment, workflow and team. But at least you have choice.

If you have any questions or comments, please leave them below.

-Mike

Restore The Legacy Context Menu in Windows 11

Thu, 22 Sep 2022 17:20:28 +0100

Updated: 2024-08-08 This method still works.

Windows 11 introduces a new more cohesive UI design but one of the casualties is the right-click or context menu in File Explorer and on the Desktop. You can still access the legacy Windows 10 style menu by clicking on “Show more options” or by using the shortcut key Shift + F10, but if you just want the old menu back by default, you just need to create a new registry key.

Copy and paste one of the commands below into a command prompt or a powershell console and after a reboot the old menu will be the default after a restart.

These commands create a new default key at the path specified.

`1`	`reg add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve`

`1`	`New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" -Name 'InprocServer32' -Force`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 11 22H2 Reference Image

Wed, 21 Sep 2022 16:48:14 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
Even though there is no x86 version of Windows 11 we must still use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 11 works with this older ADK and WinPE.

In this guide we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 11 22H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Extract the files from the self-extracting archive and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files. If you have existing shares you will need to copy the files from the update to %DeployRoot%\Tools and overwrite the existing files in all shares. You will then need to update the deployment shares and recreate boot media.

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-22H2
Name it Deploy Windows 11 22H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below are a bare minimum configuration from my lab, and you may want to add more to overtime.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

The settings below deserve some explanation. The [Virtual Machine] section is regarding driver installs which we’ll cover more later in this post. The Join Domain section is important. Here I’ve put the mdt_admin account to use as the account to join the device being imaged to the domain contoso.com. If you are following this guide to the letter, the mdt_admin account would not have the appropriate permissions to join a device to a domain, and so you should either give it the permissions required or create a new account for that specific purpose.

The other settings are location preferences relevant to the UK and resolution settings which prevent the finished device from defaulting to a resolution of 1024 x 768, and instead use the recommended resolution Windows receives from the display.

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

To test everything, we need to copy the ISO file that we just generated. It is in the Boot folder in the Deployment Share. Go to the Server or PC that is hosting the deployment share and navigate to the boot folder. Inside there should be a file named LiteTouchPE_x64.iso. Copy this file to a location where a Hyper-V Virtual Machine will be able to access it. To prevent confusion with the ISO we generated from the Build deployment share, we’ll append -deploy to the name of this new ISO, so it will be LiteTouchPE_x64-deploy.iso. Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64-deploy.iso into the deployment environment, you will be presented with a login screen and here you should login with the Active Directory credentials that have access to the Deployment Share. Once logged in you will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next. You’ll be prompted to enter a name for the device, it will also be added to Active Directory under this name. Click Next and the task sequence will begin.

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 11 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 11 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 11 22H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

Now we’re going to configure how drivers are installed for the physical devices we’re going to deploy Windows 11 to. There are a few ways to do this, here I’ll show the ‘Total Control’ method I’ve been using more recently. Note: I’ve written a guide on how to use Snappy Driver Installer Origin with MDT. Using the guide you can run the tool as part of a deployment Task Sequence and it will obtain and install the drivers automatically provided you have internet access.

The first thing you’ll need is the manufacturer and model numbers for all the devices you want to roll out the image to. You can find this out by booting a device in to its current version of Windows or the WinPE deployment environment using the LiteTouch_x64.iso boot disc or PXE booting. Here’s a previous post I wrote on how to setup PXE booting for MDT if needed: PXE Booting for Microsoft Deployment Toolkit

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

The output of the commands is the manufacturer name and model number you’ll need. The next thing you’ll need is the drivers. Windows 11 is good at installing missing drivers from Windows Update, but it can take some time and it would be better for the device to be running with all the drivers it needs once deployment has completed.

Most large manufacturers (Dell, HP, Lenovo) do a decent job of providing drivers that can be used with MDT. Should you have difficulty with them you can use the Microsoft Update Catalog to search for and download the specific drivers that Windows Update installs and use them with MDT. Once you have the drivers you require, we need to add them to MDT.

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

If you have many different manufacturers and models then this process can be quite tedious. I’ve created a PowerShell script to automate the process, it’s on my GitHub here. It requires some documentation which I will provide in a separate post.

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 11 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 11 22H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 11 22H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 11 22H2 Reference Image

Wed, 21 Sep 2022 16:25:50 +0100

News and Updates

Microsoft Deployment Toolkit appears to be largely abandoned in favour of ConfigMgr and Auto Pilot - both of which are paid solutions. I intend to use MDT until it becomes unfeasible and then I have a few ideas of where to move to after that. There are some Open Source solutions that I’d like to look into and I plan to write about them.
Please check out my MDT-Setup script which will automatically install and configure MDT the same as using this guide. A major time saver if you don’t want to do it manually.
Even though there is no x86 version of Windows 11 we must still use the older Windows 10 2004 ADK and WinPE because MDT expects x86 support for WinPE. There are workarounds for this but currently deploying Windows 11 works with this older ADK and WinPE.

In this guide we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 11 22H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with.

Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 11 22H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 11 22H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 11 22H2 and complete the wizard
Go to the Operating Systems > Windows 11 22H2 node and rename the new entries added to Windows 11 22H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 11 22H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 11 22H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 11 22H2
On the Folders page, tick the Windows 11 22H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application. It is also possible to use a package manager to grab applications from the internet and silently install them. I’ve written a guide on how to use Chocolatey to do this. Using the guide you can install Chocolatey and then use it to install applications as part of a Task Sequence, provided you have internet access.

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

To add other software, you’ll need to repeat the steps above, with the relevant Command line to silently install them. Below are a few command lines for some software I frequently install silently, along with the links to the ‘offline’ installers.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-22H2
Name it Build Windows 11 22H2
Select Standard Client Task Sequence
Select the Operating System Windows 11 22H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 11 22H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Next, we need to configure the Bootstrap.ini and the CustomSettings.ini files to control certain aspects of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab or closed development environments.

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 11 22H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W11-22H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 11 22H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article: Deploy Windows 11 22H2 Reference Image.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.04.26

Mon, 25 Apr 2022 23:48:09 +0100

Version 22.04.26

Changes:

Added -PCApps switch to list all MS Store apps on the system.
Added -UserApps switch to list all MS Store apps installed for the user.
Added -Help to give usage instructions in the terminal. Also running the script with no options will also trigger the -help switch.
Streamlined config report so non configured options are not shown.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.04.22

Sat, 23 Apr 2022 00:15:12 +0100

Version 22.04.22

Changes:

If the -WimMountPath is not configured by the user then the default Windows temp folder will be used instead.
If the -WimMountPath is configured by the user but the path does not exist, it will be created.
Added a -LogRotate option to delete logs older than X number of days.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Remove MS Store Apps - Update 22.03.27

Sun, 27 Mar 2022 03:50:31 +0100

Version 22.03.27

Small update, the utility now ignores blanks lines in Apps list file.

Remove MS Store Apps Utility can also be downloaded from:

See the full documentation available here.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Better Windows Updates For Everyone

Tue, 14 Dec 2021 01:49:09 +0000

In this post I’m going to show how to quickly configure Windows Updates so that you only receive important security updates. We’ll cover Home and Pro/Enterprise users of both Windows 10 and Windows 11.

These are also the settings I use myself and recommend for most users.

These settings may also be helpful for IT admins.

Set Active Hours - Windows 10

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then Update & Security > Change active hours.

Turn off the setting Automatically adjust active hours... and click on Change next to Current active hours

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Set Active Hours - Windows 11

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then go to Windows Update > Advanced Options > Active Hours

Change the Adjust active hours setting from Automatically to Manually.

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Registry Settings - Windows 10 Home

If you are running Windows 10 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 10 Pro/Enterprise

With Windows 10 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows update for Business
Select Manage preview builds and set it to Enabled and change the drop down menu to Disable preview builds
Select Select when Preview Builds and Feature Updates are received and set it to Enabled
Change the drop down menu to Semi-Annual Channel and then for After a Preview Build or Feature Update is released, defer receiving it for this many days enter 365.
Select Select when Quality Updates are received and set it to Enabled
For After a Quality updates is released, defer receiving it for this many days enter 5.

Registry Settings - Windows 11 Home

If you are running Windows 11 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 11 Pro/Enterprise

With Windows 11 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update
Select Select when Preview Builds and Feature Updates are received and set it to Enabled and then for How many days after a Feature Update is released... enter 365.
Next, select Select when Quality Updates are received and set it to Enabled and then for After a quality update is released.. enter 5.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Deploy Windows 11 21H2 Reference Image

Mon, 22 Nov 2021 16:05:13 +0000

News and Updates

An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress

In this article as with my previous ones we will walk through configuring Microsoft Deployment Toolkit to deploy the reference image created in the previous article: Build and Capture Windows 11 21H2 Reference Image

Installing the MDT Update: MDT_KB4564442

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Deploy
Enter the Share name: Deploy$
Give the share a description
On the Options screen, accept the defaults as we can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this late

Add an Operating System

Go to Deployment Workbench > Operating Systems
Right click and select Import Operating System
In the wizard, select Custom image file and then navigate to the Captures folder of the Build Deployment Share as the Source file
When prompted to Specify operating system setup files, select Setup files are not needed
For the destination directory name enter a name that you want to use and complete the wizard
Go to the Operating Systems node and rename the reference image we just captured to something more readable

Create a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Deploy Windows 11 21H2
Select Standard Client Task Sequence
For the Operating System, select the custom image that we imported previously
Select Do not specify a product key at this time if you are using KMS
Enter an Organization name
Enter the local Administrator password
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Expand the Initialization folder in the left-hand pane
Go to the Gather local only item
In the Properties window select Gather local data and process rules
Enter the following in the Rules file: customsettings.ini
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
Select the Install Applications item and check the Disable this step tick box
Click Apply and close the Task Sequence

In the previous post we created a user called mdt_admin in Active Directory to be used as a service account. We must give that user access to the new deployment share we have created here.

Go to the server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share
You may also want to give similar permissions to users or groups that are going to be using the deployment share

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Deploy$
SkipBDDWelcome=YES

Configure CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Model, Default, SetOSD
Properties=OSDPrefix

[Virtual Machine]
OSDComputerName=%TaskSequenceID%

[Default]
_SMSTSORGNAME=Deploy
_SMSTSPackageName=%TaskSequenceName%

; MDT deployment settings
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES

; Locale and screen res
TimeZoneName=GMT Standard Time
KeyboardLocale=0809:00000809
UILanguage=en-GB
UserLocale=en-GB
KeyboardLocale=en-GB
BitsPerPel=32
VRefresh=60
XResolution=1
YResolution=1
HideShell=YES

; Join Domain
JoinDomain=contoso.com
DomainAdminDomain=contoso.com
DomainAdmin=mdt_admin
DomainAdminPassword=p@ssw0rd
MachineObjectOU=OU=PCs,DC=contoso,DC=com

; Other Settings
SkipUserData=YES
SkipDomainMembership=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipSummary=YES
SkipFinalSummary=YES
FinishAction=SHUTDOWN
WSUSServer=http://SERVER-NAME:8530
SLShare=\\SERVER-NAME\deploy$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing the Task Sequence

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64-deploy.iso from MDT
If using Hyper-V on Windows 10 1709 or above, make sure Use Automatic Checkpoints is disabled

When the task sequence completes the VM will be shutdown.

This completes the basic testing of the deployment task sequence. Now we’ll get into drivers and further configuration.

Setting the Default Application Associations

Here’s how to configure the default application associations in the deployment task sequence.

Using an existing Windows 10 install navigate to Settings > System > Default apps. Note: This is Windows 10 only, Windows 11 does not have this feature
Set the Default apps and any other file associations as required. Note: With Windows 11 you can’t set Default Apps, only change default file associations
Open Windows PowerShell (Admin) by right-clicking on the Windows/Start button or pressing Win + X
In the PowerShell window type the following and press enter: Dism /Online /Export-DefaultAppAssociations:C:\AppAssoc.xml
After a few seconds you should see The operation completed successfully in the PowerShell window
Navigate to C:\ and copy AppAssoc.xml to your MDT deployment share: \\SERVER-NAME\Deploy$\_custom
Open the Deployment Workbench and go to Deployment Share > Task Sequences
Right click on the Task Sequence Deploy Windows 11 21H2 and select Properties
Click on the Task Sequence tab and navigate to Postinstall > Configure
Click the Add button at the top of the Task Sequence actions view and go to General > Run Command Line
Enter Set Default App Associations in the Name field, and in the Command line field enter: Dism.exe /Image:%OSDisk% /Import-DefaultAppAssociations:%DEPLOYROOT%\Applications\_scripts\AppAssoc.xml
Click Apply to save the changes

Driver Management

When the device is booted into the deployment environment, press F8 to get a command prompt, and typing out the following commands:

1
2

wmic computersystem get manufacturer
wmic computersystem get model

Open the Deployment Workbench
Navigate to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, name the folder The output of the Manufacturer
Right click on the Manufacturer folder and select New Folder
Name the folder the model of device we’ll be importing drivers for
Right click on the folder you just created and create folders for each driver type you’ll be adding, e.g. Graphics, Chipset, Bluetooth. NOTE: This is just for tidiness and isn’t required for the drivers to be installed
Right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers for that driver type
Check the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 7-10 for each driver type required
Finally repeat the steps 3-11 for each manufacturer, and model required

We now need to edit the Deployment Task Sequence to configure the driver location.

Go to the Deployment Workbench and Task Sequences, select the Deploy Windows 11 Task Sequence
Go to the Task Sequence tab in the Properties window
Navigate to Preinstall and then select Enable Bitlocker (Offline), then go to the Add menu, General and select Set Task Sequence Variable
You should have a new blank Set Task Sequence Variable below Enable Bitlocker (Offline)
Rename the blank Set Task Sequence Variable to Set DriverGroup
In the Properties panel enter the following for Task Sequence Variable: DriverGroup001
In the Properties panel enter the following for Value: %Make%\%Model%
Now go down and select Inject Drivers
In the Properties panel change the Choose a selection profile dropdown to Nothing
Select the Install all drivers from the selection profile
Click on Apply to save the changes and OK to close the Task Sequence

The Task Sequence is now configured to install drivers for any device that has drivers in the correct folder structure under Out-of-Box Drivers.

Boot the physical device into the deployment environment and run the Deploy Windows 11 21H2. After it completes, check Device Manager and all devices should be successfully installed.

Adding Drivers to the MDT Boot Image

It may be necessary to add drivers to the MDT Boot Image for devices such as storage or network adaptors. To determine if drivers are required:

Boot the device in question into the deployment environment and press F8 to bring up a command prompt
Type ipconfig and if you have an IP address, you should not have to add network adaptor drivers
Type diskpart, and when diskpart has loaded, type list disk. If the local hard drive is listed, you should not need to add storage drivers

If you do need to add drivers to the boot image:

In the Deployment Workbench, go to Deployment Share > Out-of-Box Drivers
Right click and select New Folder, call the folder WinPE x64
Right click on the WinPE x64 folder and select New Folder
Name the folder a suitable name for the manufacturer of device you’ll be adding drivers for, and then create another folder inside for the model of the device
Right click on the model folder you just created and create folders for each driver type you’ll be adding, e.g. Storage, Network
To import the drivers, right click on a driver type folder and select Import Drivers
Enter the source directory of the drivers and tick the Import drivers even if they are duplicates of an existing driver check box
Click Next and complete the wizard. The wizard will copy all the files needed to the driver type folder
Repeat steps 6-8 for each driver type required
Now we must create a Selection Profile for WinPE x64
Go to Advanced Configuration then Selection Profiles
Right click on Selection Profiles and select New Selection Profile
Enter WinPE x64 as the Selection profile name
In the folders list navigate to DS001:\ > Out-of-Box Drivers > WinPE x64 and check the box next to the folder
Click Next > Next > Finish to complete the wizard
Right click on the Deployment Share and select Properties
Go to the Windows PE tab and change the Platform drop down menu to x64
Go to the Drivers and Patches tab and change the Selection profile drop down menu to WinPE x64
Make sure that Include only drivers of the following types is selected and both Include all network drivers in the selection profile and Include all mass storage drivers in the selection profile are checked
Click Apply to save the changes, click OK to close the Properties window
Right click the Deployment Share and select Update Deployment Share
Select Completely regenerate the boot images, and then Next. The boot images will be regenerated with the drivers included
Click Finish to complete the wizard

The MDT boot media should now have the network and/or storage drivers required. You now have a reference image for Windows 11 21H2 which is ready to deploy.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Installing Remote Server Administration Tools (RSAT) for Windows 10/Windows 11

Wed, 13 Oct 2021 17:56:52 +0100

In this guide we’ll go through how to quickly add all of them using PowerShell and where they are in the GUI.

Installing RSAT the quickest and easiest way using PowerShell

Run the following command in an elevated PowerShell session.

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Installing RSAT using the GUI in Windows 11

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then “Optional Features”.
On the “Add an optional feature” section, click “View features”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
In the new window click the “Install” button to install the tools you selected.
When installation is completed, the icons will be available in the Start Menu under “Windows Tools”.

Installing RSAT using the GUI in Windows 10

Go to the Windows 11 Settings using WIN + I or via the Start Menu.
On the left side select “Apps”, then the text link “Optional Features”.
On the new page click “Add a feature”.
In the new window, type “RSAT” in the text box select all the tools you want to install.
Click the “Install” button to install the tools you selected. You should see the tools you selected be installed under “Latest Actions”.
When installation is completed, the icons will be available in the Start Menu under “Windows Administrative Tools”.

Offline Installation

The above methods require an internet connection for Windows to download the files needed. To install the tools offline you will need to download the Windows 10/11 Features On Demand ISO which is available via the Volume Licensing Portal. I haven’t found a link to these ISO’s direct from Microsoft anywhere else. Once you have downloaded the ISO, extract the files to a location and run the following PowerShell command:

`1`	`Get-WindowsCapability -Name RSAT* -Online \| Add-WindowsCapability -Online -LimitAccess -Source "C:\FOD-ISO-Extracted\`

When installation is completed, the icons will be available in the Start Menu under “Windows Tools” in Windows 11 and under “Windows Administrative Tools” in Windows 10.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Build and Capture Windows 11 21H2 Reference Image

Sat, 25 Sep 2021 20:02:09 +0100

News and Updates

Update: 2021-11-12 After testing, a Build and Capture Task Sequence now appears to work and sysprep works as expected.
An important update for Microsoft Deployment Toolkit (MDT_KB4564442) has been released. This update fixes a boot loop issue. Download the update here
There is no x86 version of Windows 11.
This article is based on Windows 11 21H2 22000.258. I will update it in future as things progress.

In this article as with my previous ones we will walk through installing and configuring Microsoft Deployment Toolkit to build and capture a reference image of Windows 11 21H2 using a Hyper-V Virtual Machine. It’s assumed that you have a server or PC ready to install MDT and create a file share for MDT to build the image with. Here are the links to the software we’ll be using:

Installing Microsoft Deployment Toolkit and Dependencies

First, we’ll install the Windows 11 ADK. During setup additional files will need to be downloaded, so it may take some time depending on your internet connection
On the “Select the features you want to install” screen, select the following:
- Deployment Tools
- Imaging And Configuration Designer (ICD)
- Configuration Designer
- User State Migration Tool (USMT)
WinPE is a separate install. Install the WinPE add-on by running the adkwinpesetup.exe, there is no specific configuration during the install wizard
Now install MDT by running the setup file downloaded earlier. There is no specific configuration during the install wizard
Finally, extract the files from MDT_KB4564442, and copy them to %ProgramFiles%\Microsoft Deployment Toolkit\Templates\Distribution\Tools replacing the existing files

Open the Deployment Workbench from the Start Menu
Right click on Deployment Shares
Select New Deployment Share
Enter the path for the Deployment Share: E:\Build
Enter the Share name: Build$
Give the share a description
On the Options screen, accept the defaults as you can change them later
Complete the wizard to create the share
By default, the share permissions are set the local administrators group. We’ll revisit this later

Adding an Operating System

Mount the Windows 11 21H2 ISO in File Explorer
Go to Deployment Workbench > Operating Systems
Right click and select New Folder
Enter the name Windows 11 21H2 and click through the wizard to create the folder
Right click again and select Import Operating System
In the wizard, select Full set of source files and then enter the root of the mounted ISO as the Source directory
For the destination directory name enter Windows 11 21H2 and complete the wizard
Go to the Operating Systems > Windows 11 21H2 node and rename the new entries added to Windows 11 21H2 Edition for ease of use

Creating Package Folder for Future Updates

Go to Deployment Workbench > Packages
Create a folder named Windows 11 21H2

Now we’ll create a selection profile so that the Task Sequence only attempts to install updates for Windows 11 21H2 that we make available through MDT.

Creating A Selection Profile

Expand the Advanced Configuration node
Right click on Selection Profiles and select New Selection Profile
Name it Windows 11 21H2
On the Folders page, tick the Windows 11 21H2 folder under Packages and complete the wizard

Importing Applications

If you want to add some applications to be a part of your reference image, here I’ll cover how to add VLC as an example application.

Go to Deployment Workbench > Deployment Share > Applications
Right click on Applications and select New Application
In the New Application Wizard, choose Application with source files
Give the application the name: VLC
Enter the Source directory of the installation files
Enter the Destination directory: VLC
For the Command line enter anything, we’ll revisit this later
On the summary page, click Next and after the files are copied click Finish to complete the wizard

Configuring Applications

Right click on VLC, go to the Details tab
Enter the following for the Quiet install command: vlc-setup.exe /S

VLC is now set up to be installed silently by the Task Sequence.

Google Chrome - Enterprise Installer

msiexec /I googlechromestandaloneenterprise64.msi /qn

Adobe Reader - Enterprise Installer

AdobeReaderDC.exe /sAll

We now need to create a new Task Sequence to create a reference image.

Creating a Task Sequence

In Deployment Workbench, go to Task Sequences
Right click and select New Task Sequence
For the ID enter: W11-21H2
Name it Build Windows 11 21H2
Select Standard Client Task Sequence
Select the Operating System Windows 11 21H2
Select Do not specify a product key at this time
Enter an Organization name
Select Do not specify an Administrator password at this time
Complete the wizard

Now we’ll configure the Task Sequence.

Configuring the Task Sequence

Right click on the Task Sequence just created and select Properties
Go to the Task Sequence tab on the Properties window of the Task Sequence
Expand the Preinstall folder and select the Apply Patches item
Change the Selection Profile to Windows 11 21H2
Go to the State Restore folder and select Windows Update (Pre-Application Installation)
On the right side of the Properties window, go to the Options tab
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation)
If you skipped the Importing Applications section, please disable the Install Applications item and go to step 16, if not please continue
Go to the Install Applications item
In the right side of the Properties box, select the Install a single application option and click the Browse… button
Select Google Chrome and change the name Install Applications to Google Chrome
Install other Applications, copy and paste the Install Applications item and repeat steps 13 - 15 for the applications of your choice
Click Apply and close the Task Sequence

Next, we’ll create a domain user account for MDT for use as a service account.

Creating a service account for MDT in Active Directory

Go to Active Directory Users and Computers
Create a user called mdt_admin and give it a complex password
Go to the Server or PC where the Deployment Share is hosted
Give the user mdt_admin Full Control share permissions and Full Control permissions to all the files and folders in the Deployment Share

Configuring Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties
Select the Rules tab and click the Edit Bootstrap.ini button
Add the settings below to the Bootstrap.ini
Close and Save the Bootstrap.ini

[Settings]
Priority=Default
 
[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configuring CustomSettings.ini

On the Rules tab of the Deployment Share properties window, add the settings below.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim

; If you want to use a WSUS server for updates, use this line, remove or comment out for updates from the internet
WSUSServer=http://WSUS-SERVER-NAME:8530

FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

We now need to create the boot media to boot the VM into the deployment environment.

Creating the Boot Media

In Deployment Workbench, right click on the Deployment Share
Select Update Deployment Share
Select Completely regenerate the boot images
Complete the wizard. It will take some time to create the boot images

Testing and Capturing a Reference Image

Create a new VM in Hyper-V with the following configuration:

For Hyper-V Only: Generation 1, not 2. I’ve had issues reported with Gen2 VMs
At least 2x vCPUs
At least 4GB of RAM
Network Adaptor with access the local network
Virtual Hard Drive of at least 40GB, preferably on fast media
Boot from CD using the LiteTouchPE_x64.iso from MDT
Make sure Use Automatic Checkpoints is disabled

Start the VM and it will boot from the LiteTouchPE_x64.iso into the deployment environment. You will be presented with a screen with the name of the Task Sequence you created earlier. Select your Task Sequence and click Next and the task sequence will begin. The Task Sequence will install Windows 11 21H2, update from the internet/WSUS server, install the optional applications if you added them, and then run Windows Update from the internet/WSUS server again. It will then run SysPrep and attempt to reboot back into the deployment environment from the local disk and send the image to the MDT server.

When this process completes the VM will be shutdown and a file named W11-21H2_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in the Captures folder in the Deployment Share.

You now have a reference image for Windows 11 21H2 and a Microsoft Deployment Toolkit installation, with a deployment share specifically configured for building and capturing reference images. We’ll cover setting up a deployment share and focus on tasks to support deploying Windows to real hardware in this article.

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Customisation

Sat, 04 Sep 2021 17:09:28 +0100

Windows 11 is very similar to Windows 10 is terms of technology and core services, however with the new UI and Start Menu refresh there are some new elements that you may want to remove.

Microsoft now expects the Start menu layout to be managed by an MDM service, if you want to do it without that then the easiest method is to copy the start.bin files.

Use a existing Windows 11 install to setup the Start menu layout how you want it.
Copy the start.bin file from %LocalAppData%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState to a folder in the MDT Deployment Share - in my case, I’ll use “_custom”.
Within your deployment Task Sequence you’ll want to copy the start.bin file to C:\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState
For all new users they will now get the start menu layout you specified.

I use a PowerShell script to copy the start.bin to the correct location.

$src = "Z:\_custom"

New-Item -Type Directory -Path "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState"
Copy-Item -Path "$src\w11_StartLayout\start.bin" -Destination "$env:systemdrive\Users\Default\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState" -Force

Disable Search On The Taskbar

Currently I have not found the Group Policy settings for the new additions to the Taskbar, so here are the registry entries to disable/hide the extra icons.

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search"`

The key is a DWORD (32-bit) Value name SearchboxTaskbarMode and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Widgets On The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarDa and it has 2 states:

0 (Hide icon)
1 (Show icon)

Disable Chat In The Taskbar

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"`

The key is a DWORD (32-bit) Value name TaskbarMn and it has 2 states:

0 (Hide icon)
1 (Show icon)

Default App Associations

Importing a list of default app associations for Windows 11 is the same as Windows 10, but I think it’s worth mentioning that Windows 11 has done away with the “Default Apps” section of Settings and so now it can be a lot more work to set them all on a template system to export. You can however still import a default app associations file that was created on Windows 10 into Windows 11.

Exporting A Default App Association File

`1`	`Dism /Online /Export-DefaultAppAssociations:"C:\foo\w11_AppAssoc.xml"`

Importing A Default App Association File as part of an MDT Task Sequence

You will need to create a new “Run Command Line” item just under “Postinstall” - see the image below.

`1`	`Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%deployroot%\_custom\w11_appassoc\w11_AppAssoc.xml`

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Windows 11 Microsoft Store Apps

Sat, 04 Sep 2021 14:43:29 +0100

This post is a cut down version of this one and only focusses on Windows 11 for clarity.

Important note!

A “provisioned app” is an app that is a part of the Windows 11 installation and will be available for all users. Otherwise the app is only installed for the currently logged on user. To remove apps for all future users and the currently logged on user, you must remove both types of app.

Removing Specific Microsoft Store Apps

To remove a specific app from your Windows 11 installation, first you need to find the application package name.

Provisioned apps:

`1`	`Get-AppxProvisionedPackage -Online \| Select PackageName`

Current user apps:

`1`	`Get-AppxPackage \| Select PackageFullName`

Then run the following PowerShell command to remove the specific app

Provisioned app:

`1`	`Remove-AppxProvisionedPackage -PackageName [PackageName here] -Online`

Current user app:

`1`	`Remove-AppxPackage -Package [PackageFullName here]`

List Of Apps Included With Windows 11 21H2

Here are the provisioned apps included with Windows 11 21H2.

PowerShell Display Name	Readable App name
Microsoft.549981C3F5F10	Cortana
Microsoft.BingNews	Microsoft News
Microsoft.BingWeather	Weather
Microsoft.DesktopAppInstaller	None
Microsoft.GamingApp	Xbox
Microsoft.GetHelp	Get Help
Microsoft.Getstarted	Tips
Microsoft.HEIFImageExtension	None
Microsoft.MicrosoftEdge.Stable	Microsoft Edge
Microsoft.MicrosoftOfficeHub	Office
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection
Microsoft.MicrosoftStickyNotes	Sticky Notes
Microsoft.Paint	Paint
Microsoft.People	People
Microsoft.PowerAutomateDesktop	Power Automate
Microsoft.ScreenSketch	Snip & Sketch
Microsoft.SecHealthUI	None
Microsoft.StorePurchaseApp	None
Microsoft.Todos	Microsoft To Do
Microsoft.UI.Xaml.2.4	None
Microsoft.VCLibs.140.00	None
Microsoft.VP9VideoExtensions	None
Microsoft.WebMediaExtensions	None
Microsoft.WebpImageExtension	None
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”
Microsoft.WindowsAlarms	Alarms & Clock
Microsoft.WindowsCalculator	Calculator
Microsoft.WindowsCamera	Camera
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”
Microsoft.WindowsFeedbackHub	Feedback Hub
Microsoft.WindowsMaps	Maps
Microsoft.WindowsNotepad	Notepad
Microsoft.WindowsSoundRecorder	Voice Recorder
Microsoft.WindowsStore	Microsoft Store
Microsoft.WindowsTerminal	Terminal
Microsoft.Xbox.TCUI	None
Microsoft.XboxGameOverlay	None
Microsoft.XboxGamingOverlay	Xbox Game Bar
Microsoft.XboxIdentityProvider	None
Microsoft.XboxSpeechToTextOverlay	None
Microsoft.YourPhone	Your Phone
Microsoft.ZuneMusic	Groove Music
Microsoft.ZuneVideo	Films & TV
MicrosoftWindows.Client.WebExperience	None

Remove Specific MS Store Apps From An Online Windows 11 WIM Image

Download my PowerShell utility from GitHub.

The script removes the apps specified in a text file from the current logged on user and Windows 10/11. I use the script as a part of my Task Sequence for deploying Windows 10/11. The script is heavily based on work by Jörgen Nilsson - check out his post over on his site.

Remove Specified MS Store Apps From An Offline Windows 11 WIM Image

First, you will need to copy the contents of the Windows 11 ISO file to your hard drive.

Windows 11 includes many editions within it’s WIM file. You will need to specify the index ID of the image to operate on. You can obtain this by running the following PowerShell command:

`1`	`Get-WindowsImage -ImagePath "C:\foo\Windows 11\sources\install.wim" \| Format-Table -Property ImageIndex, ImageName`

The output of the command above should look similar to this:

ImageIndex ImageName
---------- ---------
1 Windows 11 Education
2 Windows 11 Education N
3 Windows 11 Enterprise
4 Windows 11 Enterprise N
5 Windows 11 Pro
6 Windows 11 Pro N
7 Windows 11 Pro Education
8 Windows 11 Pro Education N
9 Windows 11 Pro for Workstations
10 Windows 11 Pro N for Workstations

Now you can use the information above to configure the PowerShell utility to remove the specific apps from the Windows install image. This script will mount the image, remove the apps and then dismount it. The image can then be made into an ISO or used with MDT/SCCM to deploy Windows as normal.

Download my PowerShell utility from GitHub.

Remove All Included Microsoft Store Apps (Not Recommended)

Note: This process is destructive and non-reversible. Please ensure you have backups before proceeding. To quickly remove all the apps for the current user, run the following PowerShell command:

`1`	`Get-AppxPackage \| Remove-AppxPackage`

To remove all the provisioned apps, run the following PowerShell command:

Note: Provisioned apps are the apps that will be installed for all new users when they first log on.

`1`	`Get-AppxProvisionedPackage -Online \| Remove-AppxProvisionedPackage -Online`

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Disable Network Discovery in Windows 10/11

Tue, 20 Apr 2021 23:18:59 +0100

Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
Inside the Inbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-In)
- Network Discovery (NB-Datagram-In)
- Network Discovery (NB-Name-In)
- Network Discovery (Pub-WSD-In)
- Network Discovery (SSDP-In)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-In) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

Inside the Outbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to e.g. Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-Out)
- Network Discovery (NB-Datagram-Out)
- Network Discovery (NB-Name-Out)
- Network Discovery (Pub-WSD-Out)
- Network Discovery (SSDP-Out)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-Out) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Select the Function Discovery Provider Host service and go to it properties page.
Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
Repeat the above steps for the following services:

Function Discovery Resource Publication
Link-Layer Topology Discovery Mapper
SSDP Discovery
UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Internet Access Control Utility

Tue, 17 Mar 2020 15:09:05 +0000

Control Internet access with Windows Firewall

Internet Access Control Utility is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

Thanks
-Mike

Features and Requirements

It requires Windows Firewall to be active.
The utility requires at least PowerShell 5.0.
This utility has been tested on Windows 11 and Windows 10.

Configuration

Here’s a list of all the command line switches and example configurations.

Command Line Switch	Description	Example
-Disable	Block the internet. Create the firewall rule to block ports 80 and 443	N/A
-Enable	Allow the internet. Removes the firewall rule created, allowing the ports 80 and 443	N/A
-L	The path to output the log file to.	[path]
-LogRotate	Remove logs produced by the utility older than X days	[number]
-NoBanner	Use this option to hide the ASCII art title in the console.	N/A
-Help	Display usage information. No arguments also displays help.	N/A

Example

`1`	`[path\]Internet-Access-Control.ps1 -Disable`

This will create a Windows Firewall rule to block internet access using ports 80 and 443.

Change Log

2023-04-28: Version 23.04.28

Cleaned up the output.

2022-06-14: Version 22.05.30

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

2021-12-08: Version 21.12.08

Configured logs path now is created, if it does not exist.
Added OS version info.
Added Utility version info.
Added Hostname info.
Changed a variable to prevent conflicts with future PowerShell versions.

2020-03-18: Version 20.03.18 ‘Lock’

Improved feedback in the console and log.
Improved documentation.

2020-03-17: Version 20.03.17 ‘Lock’

Added logging.
Added config report.
Made available on PowerShell gallery.
Refactored code.

Remove MS Store Apps Utility

Wed, 04 Dec 2019 15:25:17 +0000

Customisable Windows 10/11 Microsoft Store App removal utility, previously known as Remove-Win10-Apps

Remove MS Store Apps Utility is available from:

Please consider supporting my work:

Support with a one-time donation using PayPal.

Please report any problems via the ‘issues’ tab on GitHub.

Thanks
-Mike

Features and Requirements

Remove specified apps for the current logged on user.
Remove specified apps from the system for all users.
Can be used for imaging and OS deployment, as well as individual user.
Can be used on an offline Windows image.
Requires a text file with a list of the apps to remove.
Tested on Windows 10 and Windows 11.

How to get a list of apps to remove

To create a text file with a list of the apps to remove, run the following and copy and paste the app names you wish to remove into a txt file and save it.

`1`	`Remove-MS-Store-Apps.ps1 -PCApps`

To get a list of apps that are installed for the current user, use this command:

`1`	`Remove-MS-Store-Apps.ps1 -UserApps`

How to find the index number of the image in the wim file

Run the following command to find out how many images are present in the wim file:

`1`	`Get-WindowsImage -ImagePath [path\]install.wim \| Format-Table -Property ImageIndex, ImageName`

App Names Table

Here is a table of app names in PowerShell and what they relate to in Windows.

Windows 11 Apps

PowerShell Display Name	App name	Notes
Clipchamp.Clipchamp	Clipchamp	New in 22H2
Microsoft.549981C3F5F10	Cortana	No change
Microsoft.BingNews	Microsoft News	No change
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GamingApp	Xbox	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.HEVCVideoExtension	None	New in 22H2
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	No change
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.Paint	Paint	No change
Microsoft.People	People	No change
Microsoft.PowerAutomateDesktop	Power Automate	No change
Microsoft.RawImageExtension	None	New in 22H2
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SecHealthUI	None	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.Todos	Microsoft To Do	No change
Microsoft.VCLibs.140.00	None	No change
Microsoft.VP9VideoExtensions	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsNotepad	Notepad	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.WindowsTerminal	Terminal	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Media Player	No change
Microsoft.ZuneVideo	Films & TV	No change
MicrosoftCorporationII.QuickAssist	Quick Assist	New in 22H2
MicrosoftTeams	Microsoft Teams	No change
MicrosoftWindows.Client.WebExperience	None	No change

Windows 10 Apps

PowerShell Display Name	App name	Notes
Microsoft.549981C3F5F10	Cortana	New in 2004
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.Messaging	Messaging	Removed in 2004
Microsoft.Microsoft3DViewer	3D Viewer	No change
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	New in 21H1
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.MixedReality.Portal	Mixed Reality Portal	No change
Microsoft.MSPaint	Paint 3D	No change
Microsoft.Office.OneNote	OneNote	No change
Microsoft.OneConnect	None	Removed in 2004
Microsoft.People	People	No change
Microsoft.Print3D	Print 3D	Removed in 2004
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SkypeApp	Skype	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.VCLibs.140.00	None	New in 2004
Microsoft.VP9VideoExtensions	None	No change
Microsoft.Wallet	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxApp	Xbox Console Companion	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Groove Music	No change
Microsoft.ZuneVideo	Films & TV	No change

Configuration

Here’s a list of all the command line switches and example configurations.

Command Line Switch	Description	Example
-List	The full path to the txt file listing the apps to remove.	[path]apps.txt
-Wim	The full path to the wim file to remove the apps from.	[path]install.wim
-WimIndex	The index number of the image to operate on.	[number]
-WimMountPath	The full path to a folder that the wim file should be mounted to. If you do not configure this temp dir will be used.	[path]
-PCApps	List apps that are currently installed on the system.	N/A
-UserApps	List apps that are currently installed for the user.	N/A
-L	The path to output the log file to.	[path]
-Uno	Changes the script to remove all apps NOT listed in the apps.txt file.	N/A
-PCOnly	Only remove provisioned apps, does not take any action on the current users apps.	N/A
-LogRotate	Remove logs produced by the utility older than X days	[number]
-NoBanner	Use this option to hide the ASCII art title in the console.	N/A
-Help	Display usage information. No arguments also displays help.	N/A

Example

`1`	`[path\]Remove-MS-Store-Apps.ps1 -List [path\]apps-to-remove.txt`

This will remove the apps in the txt file from your Windows installation for all users.

Change Log

2024-11-09: Version 24.11.09

Added new ‘-Uno’ option which removes ALL apps not in the specified text file. The text file becomes an “apps to keep” list, instead of an “apps to remove” list.
Added new ‘-PCOnly’ option which removes provisioned apps only. This will leave the apps for the current user untouched.

2023-04-28: Version 23.04.28

Minor improvement to update checker. If the internet is not reachable it silently errors out.

2023-04-24: Version 23.04.24

Added script update checker - shows if an update is available in the log and console.

2022-06-14: Version 22.05.30

Added checks and balances to help with configuration as I’m very aware that the initial configuration can be troublesome. Running the utility manually is a lot more friendly and step-by-step now.
Added -Help to give usage instructions in the terminal. Running the script with no options will also trigger the -help switch.
Cleaned user entered paths so that trailing slashes no longer break things or have otherwise unintended results.
Added -LogRotate [days] to removed old logs created by the utility.
Streamlined config report so non configured options are not shown.
Added donation link to the ASCII banner.
Cleaned up code, removed unneeded log noise.

2022-04-26: Version 22.04.26

Added -PCApps switch to list all MS Store apps on the system.
Added -UserApps switch to list all MS Store apps installed for the user.
Added -Help to give usage instructions in the terminal. Also running the script with no options will also trigger the -help switch.
Streamlined config report so non configured options are not shown.

2022-04-22: Version 22.04.22

If the -WimMountPath is not configured by the user then the default Windows temp folder will be used instead.
If the -WimMountPath is configured by the user but the path does not exist, it will be created.
Added a -LogRotate option to delete logs older than X number of days.

2022-03-27: Version 22.03.27

Utility now ignores blanks lines in Apps list file.

2021-12-08: Version 21.12.08

Configured logs path now is created, if it does not exist.
Added OS version info.
Added Utility version info.
Added Hostname info.
Changed a variable to prevent conflicts with future PowerShell versions.

2021-09-07: Version 07.09.21

Added ability to remove apps from offline images.

2020-03-13: Version 20.03.13 ‘Cool’

Refactored code.
Backwards compatible.
Added logging.
Added config report when ran.
Added ASCII banner art when run in the console.
Added option to disable the ASCII banner art.

2019-12-03 v2.0

First public release.

Removing Included Microsoft Store Apps from Windows 10 & Windows 11

Thu, 06 Apr 2017 18:11:44 +0000

When deploying Windows 10/11 you might want to remove some of the included Microsoft Store Apps to help speed up the login process, save storage space, bandwidth etc.

Important note!

A “provisioned app” is an app that is a part of the Windows 10/11 installation and will be available for all users. Otherwise the app is only installed for the currently logged on user. To remove apps for all future users and the currently logged on user, you must remove both types of app.

Removing Specific Microsoft Store Apps

To remove a specific app from your Windows 10/11 installation, first you need to find the application package name.

Provisioned apps:

`1`	`Get-AppxProvisionedPackage -Online \| Select PackageName`

Current user apps:

`1`	`Get-AppxPackage \| Select PackageFullName`

Then run the following PowerShell command to remove the specific app

Provisioned app:

`1`	`Remove-AppxProvisionedPackage -PackageName [PackageName here] -Online`

Current user app:

`1`	`Remove-AppxPackage -Package [PackageFullName here]`

App Names Table

Here is a table of app names in PowerShell and what they relate to in Windows.

Windows 11 Apps

PowerShell Display Name	App name	Notes
Clipchamp.Clipchamp	Clipchamp	New in 22H2
Microsoft.549981C3F5F10	Cortana	No change
Microsoft.BingNews	Microsoft News	No change
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GamingApp	Xbox	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.HEVCVideoExtension	None	New in 22H2
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	No change
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.Paint	Paint	No change
Microsoft.People	People	No change
Microsoft.PowerAutomateDesktop	Power Automate	No change
Microsoft.RawImageExtension	None	New in 22H2
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SecHealthUI	None	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.Todos	Microsoft To Do	No change
Microsoft.VCLibs.140.00	None	No change
Microsoft.VP9VideoExtensions	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsNotepad	Notepad	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.WindowsTerminal	Terminal	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Media Player	No change
Microsoft.ZuneVideo	Films & TV	No change
MicrosoftCorporationII.QuickAssist	Quick Assist	New in 22H2
MicrosoftTeams	Microsoft Teams	No change
MicrosoftWindows.Client.WebExperience	None	No change

Windows 10 Apps

PowerShell Display Name	App name	Notes
Microsoft.549981C3F5F10	Cortana	New in 2004
Microsoft.BingWeather	Weather	No change
Microsoft.DesktopAppInstaller	winget	No change
Microsoft.GetHelp	Get Help	No change
Microsoft.Getstarted	Tips	No change
Microsoft.HEIFImageExtension	None	No change
Microsoft.Messaging	Messaging	Removed in 2004
Microsoft.Microsoft3DViewer	3D Viewer	No change
Microsoft.MicrosoftEdge.Stable	Microsoft Edge	New in 21H1
Microsoft.MicrosoftOfficeHub	Office	No change
Microsoft.MicrosoftSolitaireCollection	Microsoft Solitaire Collection	No change
Microsoft.MicrosoftStickyNotes	Sticky Notes	No change
Microsoft.MixedReality.Portal	Mixed Reality Portal	No change
Microsoft.MSPaint	Paint 3D	No change
Microsoft.Office.OneNote	OneNote	No change
Microsoft.OneConnect	None	Removed in 2004
Microsoft.People	People	No change
Microsoft.Print3D	Print 3D	Removed in 2004
Microsoft.ScreenSketch	Snip & Sketch	No change
Microsoft.SkypeApp	Skype	No change
Microsoft.StorePurchaseApp	None	No change
Microsoft.VCLibs.140.00	None	New in 2004
Microsoft.VP9VideoExtensions	None	No change
Microsoft.Wallet	None	No change
Microsoft.WebMediaExtensions	None	No change
Microsoft.WebpImageExtension	None	No change
Microsoft.Windows.Photos	(2) “Photos” and “Video editor”	No change
Microsoft.WindowsAlarms	Alarms & Clock	No change
Microsoft.WindowsCalculator	Calculator	No change
Microsoft.WindowsCamera	Camera	No change
microsoft.windowscommunicationsapps	(2) “Calendar” and “Mail”	No change
Microsoft.WindowsFeedbackHub	Feedback Hub	No change
Microsoft.WindowsMaps	Maps	No change
Microsoft.WindowsSoundRecorder	Voice Recorder	No change
Microsoft.WindowsStore	Microsoft Store	No change
Microsoft.Xbox.TCUI	None	No change
Microsoft.XboxApp	Xbox Console Companion	No change
Microsoft.XboxGameOverlay	None	No change
Microsoft.XboxGamingOverlay	Xbox Game Bar	No change
Microsoft.XboxIdentityProvider	None	No change
Microsoft.XboxSpeechToTextOverlay	None	No change
Microsoft.YourPhone	Your Phone	No change
Microsoft.ZuneMusic	Groove Music	No change
Microsoft.ZuneVideo	Films & TV	No change

Remove Specific MS Store Apps From An Online Windows 10/11 WIM Image

Note: The Start Menu in Windows 10 for new users, will still have icons for the removed apps. They can be removed manually by the user, or you can configure the Start Menu (and Taskbar) using a few different options. I’ve written about administratively configuring the Start Menu previously, here and here.

Download my PowerShell utility from GitHub.

Remove Specified MS Store Apps From An Offline Windows 10/11 WIM Image

First, you will need to copy the contents of the Windows 10/11 ISO file to your hard drive.

Windows 10/11 includes many editions within it’s WIM file. You will need to specify the index ID of the image to operate on. You can obtain this by running the following PowerShell command:

`1`	`Get-WindowsImage -ImagePath "C:\foo\Windows 10\sources\install.wim" \| Format-Table -Property ImageIndex, ImageName`

The output of the command above should look similar to this:

ImageIndex ImageName
---------- ---------
1 Windows 10 Education
2 Windows 10 Education N
3 Windows 10 Enterprise
4 Windows 10 Enterprise N
5 Windows 10 Pro
6 Windows 10 Pro N
7 Windows 10 Pro Education
8 Windows 10 Pro Education N
9 Windows 10 Pro for Workstations
10 Windows 10 Pro N for Workstations

Download my PowerShell utility from GitHub.

Remove All Included Microsoft Store Apps (Not Recommended)

Note: This process is destructive and non-reversible. Please ensure you have backups before proceeding. To simply remove all the apps possible for the current user, run the following PowerShell command:

`1`	`Get-AppxPackage \| Remove-AppxPackage`

To remove all the provisioned apps, run the following PowerShell command:

Note: Provisioned apps are the apps that will be installed for all new users when they first log on.

`1`	`Get-AppxProvisionedPackage -Online \| Remove-AppxProvisionedPackage -Online`

Support My Work

Please consider supporting my work:

Support with a one-time donation using PayPal.

If you have any questions or comments, please leave them below.

-Mike

Page History

Update 2022-10-20

Added information relating to Windows 10 22H2.

Update 2022-09-21

Added information relating to Windows 11 22H2.

Update 2021-11-22

Added information relating to Windows 10 21H2.

Update 2021-09-03

Added information relating to Windows 11 21H2.

Update 2021-05-12

Added information relating to Windows 10 21H1 May 2021 Update.

Update 2020-11-02

Added information relating to Windows 10 20H2 October 2020 Update.

Update 2020-06-12

Added information relating to Windows 10 2004 May 2020 Update (20H1).

Update 2020-01-27

Removed information for old unsupported versions of Win 10 and added a table to show which app maps to the display names in PowerShell.

Update 2019-10-06

Updated to include Windows 10 1909 November 2019 Update (19H2) Enterprise edition.

Update 2019-05-23

Updated to reflect the apps included in Windows 10 1903, May 2019 Update (19H1) Enterprise edition.

Update 2018-10-06

An update to reflect some tests I’ve done with Windows 10 1809, October 2018 Update.

Update 2018-05-07

A minor update to reflect some quick tests I’ve done with Windows 10 1803, April 2018 Update.

Update 2018-03-30

Minor maintenance update. Reworked some sections to be more clear and instructive. Added some new information from my own testing and fact checking.

Update 2017-10-17

Updated post with the list of apps included in Windows 10 1709 (Fall Creators Update) by default.

Update 2017-08-03

I’ve re-written much of this post to answer some questions that have come up and to help clarify the process. Thanks to Jörgen Nilsson over at ccmexec.com, with his original post that inspired me to write this one.

Windows 11 on gal.vin

Nvidia system tray icon is always visible

A Powershell Replacement for wmic

My Windows 11 24H2 Setup Process

Turn Off Sticky Keys

Remove Windows 11 Optional Features

Remove Built-in Apps

Installing apps via winget

Remove Search from the Taskbar

Remove Task View Button on the Taskbar

Windows Services to disable

Disable Hibernation and Fast Startup

Disable the New Context Menu

Remove Gallery from File Explorer for all users

Setting File Explorer views to be consistent

File Explorer preferences

Remove Widgets from the Taskbar

Remove Startup Programs

Uninstall One Drive

Using Local Group Policy for Configuration

My Local Group Policy

Administrative Templates > Control Panel

Network/QoS Packet Scheduler

System/Internet Communication Management

System/Internet Communication Management/Internet Communication settings

System/OS Policies

System/Remote Assistance

System/User Profiles

Windows Components/AutoPlay Policies

Windows Components/Cloud Content

Windows Components/Data Collection and Preview Builds

Windows Components/Location and Sensors

Windows Components/Location and Sensors/Windows Location Provider

Windows Components/Microsoft Defender Antivirus/MAPS

Windows Components/Search

Windows Components/Software Protection Platform

Windows Components/Sync your settings

Windows Components/Windows Error Reporting

Windows Components/Windows Update/Manage end user experience

Windows Components/Windows Update/Manage updates offered from Windows Update

Windows Terminal - quake mode

What is ‘quake mode’?

Open Windows Terminal in ‘quake mode’

Open Windows Terminal at startup in ‘quake mode’

Support My Work

Clean Up the WinSxS folder

Support My Work

Disable IPv6 with PowerShell

Disable IPv6 on all network adaptors

Disable IPv6 on a specified network adaptor

Support My Work

Getting Started with MDT Offline Media

Overview

Prepare Your Main Deployment Share

How Duplicating Items in MDT Works

Creating New Applications In MDT For Use With Offline Media

Creating a Selection Profile

Creating Offline Media

Support My Work

Thick v Thin Images (Microsoft Deployment Toolkit)

Thick Images

Thin Images

Image Times For Thick/Thin

Thick Image

Thin Image

When To Use Thick/Thin

Why Not Both?

Restore The Legacy Context Menu in Windows 11

Support My Work

Deploy Windows 11 22H2 Reference Image

News and Updates

Installing the MDT Update: MDT_KB4564442

Creating the Deployment Share

Add an Operating System

Create a Task Sequence

Configuring the Task Sequence

Securing the Deployment Share

Configure Bootstrap.ini

Configure CustomSettings.ini

Creating the Boot Media