Windows 10: Deploying and Staying Up To Date Michael Niehaus WIN326

Required Reading Plan for Windows 10 Deployment https://technet.microsoft.com/en-us/library/mt574241(v=vs.85).aspx Introduction to Windows 10 Servicing https://technet.microsoft.com/en-us/library/mt598226(v=vs.85).aspx

Only 1526 days until the end of support for Windows 7 Windows 7 end of support date: January 14, 2020

Only 63 days until the end of support for IE8, 9, and 10 on Windows 7 You need to move to IE11 by January 12, 2016. https://support.microsoft.com/en-us/gp/microsoft-internet-explorer

Step 0 Get to Internet Explorer 11.

Enterprise Investments for Internet Explorer 11 4/26/2017 Enterprise Investments for Internet Explorer 11 Help with Compatibility Issues Enterprise Mode, offering improved Internet Explorer 8 compatibility and document type overrides Enterprise Site Discovery Toolkit, to better understand how users are browsing All capabilities will be carried forward to Windows 10 A Natural Stepping Stone to Windows 10 Migrate to Internet Explorer 11 on Windows 7 (before 2016) to prepare http://blogs.msdn.com/b/ie/archive/2014/08/07/stay-up-to-date-with-internet-explorer.aspx Legacy Web Apps © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Required Reading Internet Explorer 11 (IE11) - Deployment Guide for IT Pros https://technet.microsoft.com/en-us/library/dn338135.aspx Stay up-to-date with Internet Explorer http://blogs.msdn.com/b/ie/archive/2014/08/07/stay-up-to-date-with-internet-explorer.aspx

Step 1 Prepare for Windows 10.

ConfigMgr and MDT Support for Windows 10 Product Supports Windows 10 Management? Supports Windows 10 Deployment? System Center Configuration Manager 2007 with hotfix System Center 2012 Configuration Manager with SP2 System Center 2012 R2 Configuration Manager with SP1 System Center Configuration Manager v.Next Microsoft Deployment Toolkit 2013 with Update 1 Configuration Manager v.Next Enhancements Upgrade task sequence Windows 10 configuration support New Windows 10 servicing features Configuration Manager as a service, to support Windows 10 CB/CBB MDT 2013 Update 1 (re-release) Enhancements Upgrade task sequence Split WIM support DISM for applying and capturing images Bug fixes

Required Reading The Future of Configuration Manager http://blogs.technet.com/b/in_the_cloud/archive/2015/10/27/the-future-of-configuration-manager.aspx System Center Configuration Manager: Support for Windows 10 and Microsoft Intune http://blogs.technet.com/b/configmgrteam/archive/2015/10/27/system-center-configmgr-support-for-win-10-and-intune.aspx

Windows 10 Activation Windows update needed to support Windows 10 with existing KMS servers (Windows Server) https://support.microsoft.com/en-us/kb/3058168 adds support with Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2 https://support.microsoft.com/en-us/kb/3079821 adds support for Windows 7 and Windows Server 2008 R2 New KMS and MAK keys needed, available on VLSC Look for “Windows Srv 2012R2 Data Ctr/Std KMS for Windows 10” on VLSC under licenses, not under downloads and keys Continued support for Active Directory-based activation (re-configure with new KMS key)

Windows Server support for Windows 10 Windows Server 2008 R2 and above Previous versions are no longer supported, upgrade now Update KMS with a hotfix, as already discussed Any forest level, functional level, schema level (although some specific features may require higher) Consider upgrading to Windows Server 2012 or above WSUS support for deploying Windows 10 feature upgrades via hotfix http://support.microsoft.com/kb/3095113 Won’t be backported to Windows Server 2008 R2 (already in extended support) Be sure to select new products (for WSUS and ConfigMgr SUP) Keep an eye on Windows Server 2016

MDOP Support for Windows 10 MDOP 2015 (released in August) adds Windows 10 support, via service pack-style releases Product Required/Recommended Version AGPM AGPM 4.0 SP3 App-V App-V 5.1 DaRT DaRT 10 MBAM MBAM 2.5 SP1, 2.5 is OK UE-V UE-V 2.1 SP1

App-V 5.1 Enhancements App-V 5 Adoption Application Compatibility Manageability Improved Q:\ drive support for App-V 4 package conversion Added support for multiple scripts per trigger Added Windows 10 support Added Advanced Package Editor Abilities Expanded Copy-on-Write to support more file extensions Environment Variables are merged in Connection Groups Modernized the App-V Server User Interface Consolidated and simplified client logging Microsoft Cloud OS

UE-V 2.1 SP1 Enhancements Windows 10 Network Printers Others Added Windows 10 compatibility New Windows 10 desktop settings Network printers synchronized between devices Synchronized default printer setting Improved performance when deploying templates from a Template Catalog Fixed automatic population of AD Home Path for Setting Storage Path configuration Microsoft Cloud OS

MBAM 2.5 SP1 Enhancements Deployability Manageability Industry Compatibility Improve managing the enablement of BitLocker during Windows Imaging Import BitlLocker/TPM recovery information from AD to MBAM Backup Windows-created TPM OwnerAuth (not just MBAM-created) Improve MBAM server logging and diagnostic abilities TPM Auto-Unlock after BitLocker Recovery Customize the message in the BitLocker Recovery Screen (Win10) Full Windows 10 support Encrypted Hard Drive support International Domain Name support FIPS compliant recovery password support on Windows 7 (requires Windows hotfix: http://aka.ms/bitlockerfips) Microsoft Cloud OS

Step 2 Deploy Windows 10.

How to deploy Wipe-and-Load In-Place Provisioning 4/26/2017 How to deploy Wipe-and-Load Traditional process Capture data and settings Deploy (custom) OS image Inject drivers Install apps Restore data and settings Still an option for all scenarios In-Place Let Windows do the work Preserve all data, settings, apps, drivers Install (standard) OS image Restore everything Recommended for existing devices (Windows 7/8/8.1) Provisioning Configure new devices Transform into an Enterprise device Remove extra items, add organizational apps and config New capability for new devices © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Moving In-place Simplified process, builds on prior experience 4/26/2017 Moving In-place Preferred option for enterprises Simplified process, builds on prior experience Supported with Windows 7, Windows 8, and Windows 8.1 Consumers use Windows Update, but enterprises want more control Use System Center Configuration Manager or MDT for managing the process Uses the standard Windows 10 image Automatically preserves existing apps, settings, and drivers Fast and reliable, with automatic roll-back if issues are encountered Popular for Windows 8 to Windows 8.1 Piloted process with a customer to upgrade from Windows 7 to Windows 8.1, as a learning process Feedback integrated into Windows 10 to provide additional capabilities for automation, drivers, logging, etc. Working with ISVs for disk encryption © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Moving In-place MDT 2013 Update 1 ConfigMgr v.Next 4/26/2017 © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

When not to use in-place upgrade 4/26/2017 When not to use in-place upgrade Changing from Windows x86 to x64 Systems using Windows To Go, Boot from VHD Changing from legacy BIOS to UEFI Dual boot and multi-boot systems Image creation processes (can’t sysprep after upgrade) Using certain third-party disk encryption products Wholesale changes to the apps on existing PCs © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo In-Place Upgrade

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/26/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Provisioning, not reimaging 4/26/2017 Provisioning, not reimaging Take off-the-shelf hardware Device is ready for productive use Transform with little or no user interaction © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Provisioning, not reimaging 4/26/2017 Provisioning, not reimaging User-driven, from the cloud IT-driven, using new tools Company-owned devices: Azure AD join, either during OOBE or after from Settings BYOD devices: “Add a work account” for device registration Automatic MDM enrollment as part of both MDM policies pushed down: Change the Windows SKU Apply settings Install apps Create provisioning package using Windows Imaging and Configuration Designer with needed settings: Change Windows SKU Apply settings Install apps and updates Enroll a device for ongoing management (just enough to bootstrap) Deploy manually, add to images © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Provisioning

Traditional Deployment 4/26/2017 Traditional Deployment Enhancements to existing tools Minimal changes to existing deployment processes New Assessment and Deployment Kit includes support for Windows 10, while continuing to support down to Windows 7 Minor updates to System Center 2012 to add support Minor updates in Microsoft Deployment Toolkit 2013 Update 1 to add support Will feel “natural” to IT Pros used to deploying Windows 7 and Windows 8.1 Drop in a Windows 10 image, use it to create your new master image Capture a Windows 10 image, use it for wipe-and- load deployments © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

App & Device Compatibility 4/26/2017 App & Device Compatibility Hardware requirements are unchanged Strong desktop app compatibility Windows Store apps are compatible Internet Explorer enterprise investments © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Step 3 Keep Windows 10 up to date.

Market driven quality: external and internal 4/26/2017 Market driven quality: external and internal Customer Internal Ring I Customer Internal Ring II Customer Internal Ring III Customer Internal Ring IV Engineering builds Broad Microsoft internal validation Microsoft Insider Preview Branch Current Branch Current Branch for Business Hundreds of millions Several Million 10’s of thousands Users Time 4 to 6 months 4 months 8 months *Conceptual illustration only © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

Application Compatibility Testing 4/26/2017 Application Compatibility Testing Windows as a Service requires a new approach: Identify mission-critical applications and web sites Focus testing effort on just these apps Leverage internal flights for testing other applications and web sites From initial pilot groups to large populations of users Define groups to ensure broad hardware and software coverage prior to broad deployment React to issues reported, remediate issues before expanding Talk to your ISVs to determine how they plan to support Windows as a service © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Costs for deployment

Thinking through deployment strategy 4/26/2017 9:52 PM Thinking through deployment strategy Windows Insider Preview Branch Current Branch Current Branch for Business Long Term Servicing Branch Deploy to appropriate audiences Test and prepare for broad deployment Specific feature and performance feedback Application compatibility validation Information workers General population Specialized systems Early adopters, initial pilots, IT devices Deploy for mission critical systems Stage broad deployment Test machines, small pilots NUMBER OF DEVICES STAGE Release © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Configuring to receive feature upgrades via CBB 4/26/2017 9:52 PM Configuring to receive feature upgrades via CBB Settings-> Update and Security-> Windows Update -> Advanced Options Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update If you are using WSUS or ConfigMgr, the setting doesn’t really matter. Affects Windows Update. © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What to deploy Microsoft Windows 10 Enterprise (Current Branch, Current Branch for Business) Microsoft Windows 10 Enterprise 2015 LTSB

Windows Insider Preview Branch Current Branch For Business 4/26/2017 When to deploy Windows Insider Preview Branch Specific feature and performance feedback Application compatibility validation Stage broad deployment via WU for Business Current Branch For Business Deploy to appropriate audiences via WUB Test and prepare for broad deployment Current Branch Evaluate Pilot Deploy 4-8 months of active development 4 months (minimum) 8 months (minimum) 12 month deployment (minimum) © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

4/26/2017 When to deploy Evaluate Pilot Deploy Evaluate Pilot Deploy Evaluate Pilot Deploy There will be two supported CBB releases in the market at all times Be prepared to jump from one release to the next Don’t try to skip one, as it compresses the deployment timeline too much © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

Staying up to date with Windows 10 Windows Update Cloud Upgrades installed as they are released (subject to throttling) Delivery optimization for peer-to-peer distribution Only option for Windows 10 Home Windows Update for Business Upgrades can be deferred Uses Windows Update for content Windows Server Update Services On-Prem Upgrades are deployed when you approve them Content distributed from WSUS servers Requires KB3095113 System Center Configuration Manager Choice of task sequence-based upgrades or (with vNext) software update capabilities Content distributed from ConfigMgr DPs

Configuring Windows Update for Business 4/26/2017 9:52 PM Configuring Windows Update for Business Step 1. Point all computers to Windows Update directly (no WSUS or SUP) Step 2. Create policies (GPO) or settings (MDM) to specify how long groups of machines should defer. Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update Step 3. Target policies or settings to different groups of PCs. © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows 10 November update Enhancements to Azure AD Join Enhancements to Microsoft Passport Windows Store for Business Windows Update for Business MDM support for BYOD Enhancements to Telemetry Control User Experience Enhancements Seamless, secured, roaming of user settings across Windows 10 deices, via your Azure cloud. Utilize Microsoft Passport for your domain accounts on the corporate network. (AD/AAD Hybrid mode) Iris support (Beta) Centrally acquire, manage and distribute Windows Store apps in your organization. Create your own private store with your corporate LOB apps and curated free apps. Manage deployment to internal groups (rings) in your enterprise for controlled rollout of Current Branch for Business (CBB) updates. Manage updates to align with your business rhythm (maintenance “no-update” windows). MDM support for Windows 10 Home for most MDM settings. GP/ MDM Controls enabling enterprises to fully turn telemetry off. Enhancements to Cortana, Edge, Continuum, Support for Continuum for Phone on select Phone devices.

Complete your session evaluation on My Ignite for your chance to win one of many daily prizes.

Continue your Ignite learning path Microsoft Ignite 2015 4/26/2017 9:52 PM Continue your Ignite learning path Visit Microsoft Virtual Academy for free online training visit https://www.microsoftvirtualacademy.com Visit Channel 9 to access a wide range of Microsoft training and event recordings https://channel9.msdn.com/ Head to the TechNet Eval Centre to download trials of the latest Microsoft products http://Microsoft.com/en-us/evalcenter/ © 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.