1. Prepare for Windows 10 and UEFI
Microsoft Ignite 2016
11/7/2017 9:19 PM
BRK2304
Prepare for Windows 10 and UEFI
Mike Terrill
@miketerrill
Technology Architect, 1E
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. UEFI Overview

3. What is UEFI? Unified Extensible Firmware Interface
Microsoft Ignite 2016
11/7/2017 9:19 PM
What is UEFI?
Unified Extensible Firmware Interface
Replaces Basic Input/Output System (BIOS)
Feature
BIOS
UEFI
Supports disks > 2TB No
Yes
Supported processor mode
16-bit
32/64 bit
Addressable memory
1MB
All available
Support Secure Boot
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Windows Version UEFI/Platform Windows 8 Windows 8.1
Windows Vista SP1
Windows Server 2008
Windows Server 2008 R2
UEFI 2.0 or later on 64-bit systems
Windows 8
Windows 8.1
Native UEFI 2.0 or later on 32-bit /64-bit/ARM
Windows Server 2012
Windows Server 2012 R2
Native UEFI 2.0 or later on 64-bit systems
Windows 10
Native UEFI 2.0 or later*
*UEFI Errata C or higher is required for Secure Boot

5. Benefits of running Windows 10 in UEFI Mode
Secure Boot
Device Guard
Credential Guard
Early Launch Antimalware (ELAM)
Device health attestation through Measured Boot
Msinfo32 (System Information)

6. Preparing for Windows 10 with Configuration Manager

7. Getting to Windows 10 & UEFI
Hardware Refresh
Break/Fix
In-place Upgrade (fast, but no UEFI on BIOS systems)
Wipe & Load
Still deploying Windows 7 x64?

8. Inventory UEFI & Secure Boot State
Edit Configuration.mof
Extend ConfigMgr Hardware Inventory (Console)

9. Inventory Vendor Specific Info with Configuration Manager

10. Important BIOS/UEFI Settings
BIOS Version/Release date
Boot Mode
Secure Boot (capable)
UEFI PXE
Virtualization Settings
TPM
WOL
Device Boot Order

11. Other Important Inventory Items
Data Execution Prevention (Available)
OS Architecture
Free Disk Space
TPM
Is Activated
Is Enabled
Is Owned
Version

12. Dell Deploy Dell Command | Monitor Extend ConfigMgr Hardware Inventory
Namespace
root\dcim\sysman
Class
DCIM_BIOSEnumeration
Properties
AttributeName
CurrentValue
IsReadOnly
PossibleValues
PossibleValuesDescription
DCIM_BootSourceSetting
BIOSBootString
ElementName
StructuredBootString

13. Hewlett-Packard Extend ConfigMgr Hardware Inventory Namespace
root\HP\InstrumentedBIOS
Class
HPBIOS_BIOSEnumeration
Properties
Current Value
Display in UI
Is Read Only
Name
Possible Values
Value
HPBIOS_BIOSOrderedList

14. Lenovo Extend ConfigMgr Hardware Inventory Namespace root\wmi Class
Lenovo_BiosSetting
Properties
InstanceName
Active
CurrentSetting

15. Demo

16. Booting UEFI

17. Getting to UEFI – Disk Partitions
FIRMWARE
DISK
BIOS MBR
SYSTEM
RESERVED
WINDOWS PARTITION
WINDOWS TOOLS PARTITION
UEFI GPT
GUID PARTION TABLE (GPT) DISK
WINDOWS TOOLS PARTITION
EFI SYSTEM PARTITION
MSR
WINDOWS PARTITION

18. Booting UEFI Only boot platform architecture
Task Sequences and Boot Images – 1:1
UEFI Network Stack – Client Architecture Type (DHCP Option 93)
Common Types
Architecture Name
x86 Boot Image
x64 Boot Image
Intel x86PC 6
EFI IA32 7
EFI BC 9
EFI x86-64

19. PXE Boot Network Capture

20. Booting UEFI with Configuration Manager
BIOS Configuration
Boot List Option
CSM
_SMSTSBOOTUEFI
Client Architecture
BIOS
Legacy
Enabled
FALSE
Intel x86PC
UEFI Hybrid
or UEFI or
TRUE
Intel x86PC or
EFI BC
UEFI Native
UEFI
Disabled

21. Format Steps in Configuration Manager

22. Upgrading the BIOS/UEFI

23. Why upgrade? Windows 10 Support Firmware Fixes UEFI Security Fixes
Vendor tools/utilities

24. Tips, Tricks & Pitfalls Go by release date
Some newer releases prevent back flashing
Use a Configuration Manager Task Sequence
Suspend BitLocker – or else!
Dell current only has a 32-bit flash utility
For HPQ Flash, add WinPE-HTA
BIOS & Hard Disk Passwords
Test the process and test again
Baseline and document your standards

25. Enabling UEFI

26. Demo

27. Vendor Tools – Dell Command | Configure
Get BIOS mode:
Cctk bootorder --activebootlist
Enable UEFI:
Cctk bootorder --activebootlist=uefi
Get Legacy ROM setting (aka CSM):
Cctk --legacyorom
Disable Legacy ROMs:
Cctk --legacyorom=disable
Enable Secure Boot:
Cctk --secureboot=enable

28. Vendor Tools – HP BIOS Configuration Utility
Get BIOS mode:
BiosConfigUtility(64).exe
Enable UEFI:
BiosConfigUtility(64).exe /setvalue:"Boot Mode","UEFI Native (Without CSM)"
Enable Secure Boot:
BiosConfigUtility(64).exe /setvalue:"SecureBoot","Enable"

29. Vendor Tools – Lenovo (script or WMI methods)
Get current settings:
Cscript ListAll.vbs
Enable UEFI & Secure Boot:
Cscript SetConfig.vbs SecureBoot Enable

30. Windows 10 – Where to Begin?

31. Determine Supported Models
What models are in your environment?
Which ones will run Windows 10?
Which are supported by the vendor for Windows 10? (Works <> Supported)
Are the models in a ready state?
Are they configured correctly?
*Also need to consider Infrastructure, Applications and User Data

32. Hardware Readiness

33. Start Installing Windows 7 x64 in UEFI Mode
Requires UEFI Hybrid with CSM
CSM & Secure Boot do not mix
Enables Windows 10 In-place Upgrade
No need to re-install applications
No need to backup and restore user data
After upgrade, turn off CSM and turn on Secure Boot
Start converting now
100% Supported

34. “If the goal is to ever move to Windows 10 and enable Secure Boot, then you should definitely deploy Windows 7 x64 using UEFI, with all modern hardware (Windows 8 logo certified or later) that support UEFI or higher.
The “don’t bother” approach is what’s causing lots of customers pain these days as part of their Windows 10 deployments where they want to enable this security feature but can’t easily do it (without reconfiguring the firmware, moving the data off the box, repartitioning the disk, installing a new OS, and bringing all the data back down – compared to just doing an in-place upgrade).”
-Michael Niehaus, Microsoft 4/5/2016

35. Summary

36. Challenges
Converting from BIOS to UEFI in a single Configuration Manager Task Sequence (it can be done but is tricky)
Switching BIOS settings to UEFI needs to be done in order on some settings. Also, settings are not consistent
BIOS to UEFI = MBR to GPT which is a destructive process. Applications need to be re-installed and User Data needs to be restored
Windows x86 to x64 will also require a wipe and load

37. Resources UEFI Firmware What’s New in Windows 10 Security
Hard Drives and Partitions Overview
Inventory Secure Boot State and UEFI with ConfigMgr
1E On-demand Windows 10 Webinars

38. Resources
How to Inventory Dell BIOS and UEFI Settings with ConfigMgr Part 1 How to Inventory Dell BIOS and UEFI Settings with ConfigMgr Part 2
How to Inventory HP BIOS and UEFI Settings with ConfigMgr
How to Inventory Lenovo BIOS and UEFI Settings with ConfigMgr
Getting Ready For Windows 10 Using ConfigMgr Inv
How to create a Dell Command-Configure Package in ConfigMgr
How to create a HP BiosConfiguration Utility Package in ConfigMgr
Automating Dell BIOS-UEFI Standards for Windows 10

39. Please evaluate this session
11/7/2017 9:19 PM
Please evaluate this session
Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

40. 11/7/2017 9:19 PM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.