1. Windows Desktop Deployment Service (DDS) 1.1 at LANL Mark Wingard Departmental Computing Services Los Alamos LA-UR 09-03038 DCS-1 Departmental Computing Services

2. Agenda DCS-1 Departmental Computing Services Purpose of DDS DDS background Image configuration Challenges Future

3. Purpose of DDS DCS-1 Departmental Computing Services Automate Windows installations Ensure desktop meets security compliance requirements Provide a consistent Windows desktop configuration on the unclassified network Meet the needs of field support techs

4. Microsoft Deployment DCS-1 Departmental Computing Services Microsoft Deployment Toolkit  Free download from Microsoft  Customizable  Scripts and best practices  Network based ‒ Images, scripts, drivers, applications  Windows Automated Installation Kit ‒ WinPE, Sysprep, ImageX  Lite Touch boots from CD  Zero Touch integrated with SMS/SCCM ‒ DDS uses Lite Touch

5. DDS History DCS-1 Departmental Computing Services Fall 2007 – Beta 1 using BDD 2007  Only static IP addresses supported  No ability to add additional applications  New ISO/CD required when any changes were made  Support for handful of Dell workstations NLIT 2008 - Beta 2 using MDT 2008  DHCP via firewall/routers  Support for additional applications  Support for “Refresh” option  More Dell workstations added

6. DDS History Cont’ DCS-1 Departmental Computing Services Fall 2008 - Production version 1.0  XP SP2 configured to NIST 800-68  Up to 16 applications available  More Dell workstations and VMWare added Spring 2009 – Version 1.1  XP SP3  Office 2007 replaces Office 2003 on OS w/ Apps  Added support for laptops and some HP models  Application versions upgraded

7. Development Process DCS-1 Departmental Computing Services ½ FTE during Beta development  1 ¼ FTEs currently Change Control Board  Official mechanism for changes to central services  Each field team gets one vote - DDS configurations vetted Information Architecture Team  Sets standards for applications and configurations  Initially voluntarily, slowly becoming mandatory  Working on Default Configuration E-mail list for DDS questions & requests  Field techs can make requests  Questions guide changes Rigorous Testing  Development server  Performance, functionality and compatibility tests

8. Images DCS-1 Departmental Computing Services 2 Flavors of XP SP3  Plain OS  OS with Applications Universal Settings:  STOW-XP - NIST 800-68 settings minus LANL specific changes  Administrator autologon w/ blank password  Latest patches  Pre-installed utilities: ‒ SMS 2003 client and Toolkit ‒ Windows Defender 1.1.1593.0 ‒ Windows Media Player 11 ‒ Cisco IPTV 3.5.1.5 ‒ Adobe Flash Player 10.0.22.87 ‒ Internet Explorer 7 ‒ ESD Net Installer 2.0

9. Images Cont’ DCS-1 Departmental Computing Services Folder on Administrator’s desktop with installers  Tivoli client (backups)  Cisco VPN client  QWS 3270  WS-FTP  BC Wipe  VB script to rename and disable the built-in Administrator and Guest accounts

10. Images Cont’ DCS-1 Departmental Computing Services OS with Applications image  Universal Settings plus: ‒ Microsoft Office 2007 w/ SP1 ‒ Adobe Acrobat Standard 9.1 ‒ Citrix ICA client 10.1.5 Symantec AntiVirus Client 10.1.6 set to install automatically on either image  Soon to be replaced w/ Symantec Endpoint Protection

11. Optional Applications DCS-1 Departmental Computing Services Adobe Acrobat Standard 9.1 (pre-installed on OS w/ Applications) MS Office 2007 Pro w/ SP1 (pre-installed on OS w/ Applications) Citrix ICA Viewer 10.1.5 (pre-installed on OS w/ Applications) MS Office 2003 Pro w/ SP3 and the Office 2007 Compatibility Pack Firefox 3.0.10 Thunderbird 2.0.0.16 HyperSnap 6.31.01 MeetingMaker 8.6.2 Oracle JInitiator 1.3.1.25 WinZip 11.0

12. Task Sequences DCS-1 Departmental Computing Services New Computer  Wipes computer clean and installs XP o Formats and partitions hard drive via Diskpart Existing Computer  Used to replace Windows on an existing computer while retaining the user’s settings and data  Does not format or partition hard drive

13. System Requirements DCS-1 Departmental Computing Services Memory - 512 MB minimum Hard disk - no size limitations  New Computer: ‒ Partitioned into a single, C: partition with NTFS Supported Dell Models  OptiPlex 745, 755, 760, GX260, GX270, GX280, GX620  Precision WorkStation 360, 380, 650, 670, T5400  Latitude laptops D600, D610, D800, D810, D830, E6500, E4200 Supported HP Models  Workstations XW4300 and DC7900  NW8440 Laptop Other makes/models may also work, but not yet tested New models added as drivers are acquired

14. DDS Challenges DCS-1 Departmental Computing Services Education  Techs confused ‒ Installing same applications from menu on top of OS w/ Applications image ‒ Not using Refresh option  Hands-on Training Class in development  Visits to field teams for QA sessions  Web site w/ step-by-step instructions ‒ (Requires reading)

15. DDS Challenges Cont’ DCS-1 Departmental Computing Services Competition  Standalone BartPE image developed by field support ‒ Not tested ‒ Not secured to FDCC standards ‒ Takes twice as long to deploy as DDS ‒ Loaded w/ extra applications ‒ Patches not current ‒ 2000+ installations to date vs. 700+ for DDS o Management has not mandated DDS

16. DDS Technical Challenges DCS-1 Departmental Computing Services Drivers  Manufacturers constantly changing hardware  Driver packages inconsistent  New models released without notification Applications  Some are not network/automation-friendly  Constant upgrades  MDT Lite Touch menus not very flexible USMT (User State Migration Tool)  Techs don’t understand options  No standards for where users store data  Can be slow depending on amount of data Testing on New Models  No budget for continually buying the latest hardware  New purchasing restrictions may help limit models

17. Future Challenges DCS-1 Departmental Computing Services Integrating with SCCM  Lite Touch fits LANL’s decentralized support model  Still need to upgrade to SCCM PXE Boot capability  No DHCP in place at LANL Getting Management Support  Multiple installation methodologies promote desktop chaos  Central deployment solution meets accreditation requirements What will the next OS be?  Vista still in Information Architecture “do not use” category  Will Windows 7 come soon enough? Resource limitations  Hiring freeze  Constant stream of ‘crises du jour’

18. Questions DCS-1 Departmental Computing Services