Windows 10 Deployment Explained Dan Lezoche Dlezoche@BucksIU.org 215-348-2940 x1628 @DLezoche

© Bucks County Intermediate Unit - All Rights Reserved Steal This Content This deck https://bucksiu- my.sharepoint.com/:p:/g/personal/dlezoche_bucksiu_org/EYTjmkSRBeBNt9 FZeOpZ9yoBvHAbUNPnJlUlhhEovPZsyA?e=U4mgFA Simplified: https://bit.ly/2FP1aHI Handout https://bucksiu- my.sharepoint.com/:w:/g/personal/dlezoche_bucksiu_org/ES3FXma2uGJAu k-mNdwmnyABLGABa5rOBIIuJM7aY1G2xw?e=zhXp4z Simplified: https://bit.ly/2FQXo0f November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved Foundation Problem Statement Windows 7 and 8.1 mainstream support has ended, we need to move to Windows 10 somehow Migrate to x64 and EUFI now What hardware? Intel i5, 8GB, SSD, TPM 1.2, VT BIOS Client Lifecycle November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved The Old Way Common platforms Ghost/WDS/FoG/OEM/SnapDeploy/etc. OEM installations right to client Manual application installation/setup/configuration “Fat” images right to hardware Custom capture of “golden system” with all drivers/apps/etc Downsides Inflexible deployment Labor intensive Platform specific – large image libraries Hard to update/revise November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved The New Way Common platforms MDT, SCCM, KASE, LanDesk, Altiris, ZenWorks “Thin” imaging to disparate hardware Task sequences for customization during deployment Very flexible; dynamic rule-based installation Downsides More complicated backend setup Drivers and application installations need to be automated Some are $licensed November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved The New-New Way Emerging platforms Intune Auto Pilot Login to new workstation with AD creds; AAD join automatically Pull Intune apps/policies/etc. Provisioning OEM/Clean image USB key configuration from OOBE Downsides Departure from traditional nuke/pave and client lifecycle management November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved But Wait, There’s More! Common alternatives Ship gold image to manufacturer 3rd party mass deployments $Vendor images machine Often unboxes, delivers, coordinates Less district staff involvement needed for imaging Downsides Need appropriate lead time for purchase/deployment/delivery Cost can increase dramatically per-device May need to extend infrastructure to vendor for AD join, imaging, etc. November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved Windows 10 Version Soup Releases 1507, 1511, 1607, 1703, 1709, 1803 Editions (simplified) Home, Professional, Enterprise*, Education*, Enterprise LTSB* Architectures X86/32-bit X64/64-bit November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

Deployment in a Nutshell (MDT/SCCM) Build and capture 'golden' image (VM; snapshot) Import into MDT/SCCM Create basic task sequence (test) Add drivers/applications (test) Add customizations (test) BIOS/EUFI, desktop tweeks, etc. Firmware updates (test) BitLocker / security (test) User State (for refresh) Increase performance with powercfg.exe (TechNet) November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved Building your Plan Handout Pre-planning Testing Demo hardware Virtual machines Alpha/power user trial Process validation Staff training Beta deployment Full deployment November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved Servicing Application management Chocolatey ($free or paid) - https://chocolatey.org PDQ Deploy ($500 /admin) - https://www.pdq.com/pdq-deploy/ Ninite - ($per device) https://ninite.com/pro SCCM\MDT PSAppDeploy - https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases Windows/Microsoft Updates WUFB - https://blogs.technet.microsoft.com/windowsitpro/2017/05/10/what- is-windows-update-for-business/ WSUS SCCM Integration November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved Pro-Tips Standardize on HW Migrate to EUFI and 64-bit OS Use whatever you want to deploy/manage Plan for application deployment/updates Design Windows update strategy Plan for firmware/driver updates Try to leverage the vast security options BitLocker (GPO to write recovery to AD) Credential Guard (Requires VT enabled) Use USMT for user state! (test thoroughly) November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved

© Bucks County Intermediate Unit - All Rights Reserved More Learning TTL '18 Deploying and Using Intune for Education – Dave Light – 5/8 9:00AM Package and Deploy Software with SCCM – AJ Malloy – 5/8 11:30AM Configuration Manager OSD – Glen Drager – 5/9 1:00PM Bucks IU GitHub – https://github.com/bciu22 Michael Nystrom - https://deploymentbunny.com/ Johan Arwidmark – https://deploymentresearch.com Windows Noob – https://www.windows-noob.com/forums/ November 9, 2018 © Bucks County Intermediate Unit - All Rights Reserved