Deploying Windows 10 1607

Following on from my post last year Building a Clean Windows 10 Reference Image - MDT 2013 U1 this entry will go rehash over some of the same steps that were discussed there as well as additional steps to deploy Windows 10 1607.

For this build i am using:

Windows 10 1607 - https://blogs.windows.com/windowsexperience/2016/08/02/how-to-get-the-windows-10-anniversary-update/

MDT 2013 Update 2 - https://blogs.technet.microsoft.com/msdeployment/2015/12/22/mdt-2013-update-2-now-available/

SCCM 1606 - https://blogs.technet.microsoft.com/enterprisemobility/2016/07/22/now-available-update-1606-for-system-center-configuration-manager/

ADK 1607 - https://blogs.technet.microsoft.com/ausoemteam/2016/08/03/windows-adk-for-windows-10-version-1607-available-for-download/

Reference Image:

From here i will assume you have all of the above running however you do not need to be on the latest SCCM version (1606) for these, you will however want to have the ADK and MDT up to date.

1. To build your reference image please follow the steps in this post. However do not update your deployment share (one of the last steps)
http://deploymentresearch.com/Research/Post/540/Building-a-Windows-10-v1607-reference-image-using-MDT-2013-Update-2

2. Watch this video from the 8:00 till 13:20 to learn how to tweak CMTrace.exe and SMSTS.ini to bolster your OSD experience. https://youtu.be/HtvDHs5NCPw?t=481 , once you have done this go back and update your deployment share and continue with Johans Post.

Boot Wim: 

1. Check out my post here  on how you can leverage DART for dynamic remote control for your OSD builds.

Prepare OSD Scripts and Logs:

Logs:

On your SCCM Site server create a share to store log files eg :\\configmgr\logs$ , insure your staff have access to this path. The final steps in your task sequence should be to copy logs if successful or not to this share (will outline how later). Within this logs folder make two folders named:

OSD_Success
OSD_NotSuccess

There is a reason i am not using a folder named "OSD_Failure" - each time CmTrace detects the word "fail" in your SMSTS.log file you will see an "error" which in this case is just the name of the step, so to make your logs nicer to read, avoid using the word "failure" wherever possible. 


Scripts:

The following scripts are used throughout my task sequence:

Scripts Share

UI++  (Nice UI to allow you to set variables to kick start your TS) - http://blog.configmgrftw.com/uiplusplus/

adcompdesc.vbs (Sets AD computer description during OSD ) - See scripts share

adgroup.vbs (Sets AD computer group membership during OSD ) - See scripts share

DefaultAppAssoc.xml (Sets defaults for application association - Acrobat in example is set ) - See scripts share

DumpVar.vbs (Dumps SMSTS variables to file for testing) - See scripts share

SetDefaultsW10.cmd (Sets various OSD settings, speech etc ) - See scripts share

StartLayout1607.xml (Sets start menu and taskbar layout  ) - See scripts share


Place these files (tweaked to your liking) in a share in SCCM sources folder and create a package (with no program) . This package will be called upon multiple times during your task sequence.

Create Unattended.XML

Log onto your SCCM box and open Windows System Image Manager.  From here you can modify your unattended as much as you like, here is mine.. with some info redacted.


Note:  <Logo>c:\windows\media\COMPANYLOGO.bmp</Logo> . This file is being copied to my WIM during my reference image creation.This will allow you to show your logo and in windows "system" page.

Create Task Sequence

Create a new TS (with MDT integration) and add the following steps.

(I will not go through every option just specific settings to improve OSD)

Set the following 3 Variables at the beginning of your TS. 

Name: SMSTSPostaction

Value: shutdown /r /t 5

Why: Forces the machine to reboot at the very end of the TS, this helps with post TS cleanup tasks and gpo application

Name: SMSTSRebootDelay

Value: 0

Why: Will force reboot instantly after each step to 0 seconds. Improves TS time. 

Name: SMSTSErrorDialogTimeout

Value: 86400

Why: Sets the error delay to 86400 seconds , which will let you know that there has been an error until you interact with it (default is too fast)

Follow these steps to reduce TS time even more: https://blogs.technet.microsoft.com/deploymentguys/2015/03/26/reducing-windows-deployment-time-using-power-management/

Add step for apply OS, use the Unattended.xml you created earlier. (This can be placed into your OSD scripts folder)

Add step to copy CMTrace: Add the following step AFTER apply OS step: 

Type: Run Command Line

Value: cmd /c xcopy x:\sms\bin\x64\CMTrace.exe %OSDTargetSystemDrive%\windows\system32 /E /H /C /I /Q /Y

Add step to for Set AD Group (see scripts folder)

Name: adgroup.vbs (run command line)

Value: wscript.exe adgroup.vbs "ADGROUP"

Add step to for Set AD Description (see scripts folder)

Name: adcompdesc.vbs  (run command line)

Value: cscript.exe adcompdesc.vbs "[%VALUE%] - [%VALUE%] - [%VALUE%]"

Add step to for Set W10 Defaults (see scripts folder)

Name: Apply W10 Settings (run command line)

Value: cmd /c SetDefaultsW10.cmd

Add step to Tattoo the registry

Name: Tattoo (run command line)

Value: cmd.exe /c reg add HKLM\SOFTWARE\COMPANY/v COMPANYOSD-Name /d "[%_SMSTSPackageName%]" & reg add HKLM\SOFTWARE\COMPANY/v COMPANYOSD-Time /d "[%date%]-[%time%]" /t REG_SZ  & reg add HKLM\SOFTWARE\COMPANY /v COMPANYOSD-ImagedBy /d "[%XAuthenticatedUser%]" /t REG_SZ

Add step to set Windows 10 Start Menu  (see scripts folder)

Name: Set Windows 10 Start Menu Layout (run command line)

Value: powershell.exe -executionpolicy bypass import-startlayout -layoutpath .\StartLayout1607.xml -mountpath C:\

Add step to Remove Windows 10 Apps  (see scripts folder)

Name: Remove Windows 10 Apps (run command line)

Value: %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy bypass -file .\RemoveApps2.ps1

Edit: Use this link for script : https://github.com/W4RH4WK/Debloat-Windows-10/blob/master/scripts/remove-default-apps.ps1 

Add step to block windows 10 apps installing 

Name: Block New W10 Apps (run command line)

Value: reg add HKLM\Software\Policies\Microsoft\Windows\CloudContent /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f

Add LOGS folder logic.

Here we will add logic to do a Try/Catch for any errors.

Copy these steps changing for your own folder names.

From here copy the same logic as the previous steps but change to Not_success

To be continued...