1. Real-world OS Deployment Samples
Jörgen Nilsson
Principal Consultant
Onevinn
@Ccmexec
Johan Arwidmark
CTO
Truesec
@Jarwidmark

2. Jörgen Nilsson Johan Arwidmark @ccmexec @Jarwidmark MVP MVP 2x A lot!
Liverpool FC, Beer, Meat
Steak

3. Session takeaway Common Challenges Windows 10 Challenges
Sample Task Sequence Walk-Through
Real World examples & Scenarios
And all the qeeky stuff you didn’t know you needed to know ;-)

4. Size matters!! Windows 10 Size Feature Update size
Cumulative Update Size

5. Common Challenges

6. Webservice! Why Webservice Stabile
Less ports open from clients to the Primary Site server, example Remove a computer from a collection script requires:
RPC High-Ports
WMI
Webservice requires only 443 (NOT 80)

7. Community Webservices
Web Service for OS Deployment
ConfigMgr WebService
Deployment Webservice (Maik Koster)

8. Updating definitions during OSD
Windows Defender, Endpoint Protection
Script to Schedule definition download and package update on a Server
Script to deploy during OSD
Remember different definitions for Endpoint and Defender

9. Microsoft Laps Great solution, if you don’t use it you should!!
However during OSD you must clear the ”ms-mcs-admPwdExpirationTime” or else!
… you will not now the password on the machine until the date there is passed

10. Pre start commands Boot Image
Set system time!
Delete any existing ”unknown” object
Kick off OSDBackground.exe
What is runsilent.exe?

11. Windows 10 Challenges

12. What is new under the surface in Windows 10 1607

13. Driver Signing

14. TPM Management changes in Windows 10 1607

15. TPM backup No Longer Possible?
In Windows / Server 2016 ADMX files are the options to take backup of TPM is removed.
MBAM the agent does not have access to the key by default in Windows anymore
Solution!! - TPMPassTheHash
_OSDOAF = Passwordhash
If you use pre-provisioning PowerShell Script that writes the variable to the registry and sets the OSManagedAuthLevel = "4"
And the last step that change it back to "2"

16. _OSDOAF

17. Language Support Managing Multiple languages during deployment
Deployment, Offline or Online
Windows 10 Servicing challenge

18. MBAM deployment
Regfiles to control encryption level otherwise = default in PE version that is used = No Control
MBAM TPM Pass the Hash
The normal script to enable MBAM and encryption

19. Using App-v and UE-V
Needs to be enabled now that it is builtin the operating system = Powershell
Enable Ue-v and to get it to sync on first logon requires:
Enable-Uev
Set-uevconfiguration -computer -EnableWaitforSyncOnApplicationStart –enablewaitforsynconlogon
We also need to register the UE-V templates we need.

20. Task Sequence walk through

21. Task Sequence groups Initilize section Format Disk, convert UEFI
Sets default values in the TS, example SMSTSErrorDialogTimeout
Format Disk, convert UEFI
Error Handling
Completion Section
Error Section

22. Completion Section Remove from Collection Report completion
Copy OSD Logs
Stop OSD Background Process

23. Error Section Save TS Error Code (so we can use it later)
OSDBackground Error
Set OSD Variables
Copy OSD Logs
Remove From OSD Collection
Disable computer account (a failed machine should never ever be used)
SetError Fail the TS with the actual error code that caused the failure

24. Customer TS example

25. Real World Samples