2. Windows 10: Deploying and Staying Up To Date
Michael Niehaus
WIN326

3. Required Reading Plan for Windows 10 Deployment
Introduction to Windows 10 Servicing

4. Only 1526 days until the end of support for Windows 7
Windows 7 end of support date: January 14, 2020

5. Only 63 days until the end of support for IE8, 9, and 10 on Windows 7
You need to move to IE11 by January 12,

6. Step 0 Get to Internet Explorer 11.

7. Enterprise Investments for Internet Explorer 11
4/26/2017
Enterprise Investments for Internet Explorer 11
Help with Compatibility Issues
Enterprise Mode, offering improved Internet Explorer 8 compatibility and document type overrides
Enterprise Site Discovery Toolkit, to better understand how users are browsing
All capabilities will be carried forward to Windows 10
A Natural Stepping Stone to Windows 10
Migrate to Internet Explorer 11 on Windows 7 (before 2016) to prepare
Legacy Web Apps
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Required Reading
Internet Explorer 11 (IE11) - Deployment Guide for IT Pros
Stay up-to-date with Internet Explorer

9. Step 1 Prepare for Windows 10.

10. ConfigMgr and MDT Support for Windows 10
Product
Supports Windows 10 Management?
Supports Windows 10 Deployment?
System Center Configuration Manager 2007
with hotfix
System Center 2012 Configuration Manager
with SP2
System Center 2012 R2 Configuration Manager
with SP1
System Center Configuration Manager v.Next
Microsoft Deployment Toolkit 2013
with Update 1
Configuration Manager v.Next Enhancements
Upgrade task sequence
Windows 10 configuration support
New Windows 10 servicing features
Configuration Manager as a service, to support Windows 10 CB/CBB
MDT 2013 Update 1 (re-release) Enhancements
Upgrade task sequence
Split WIM support
DISM for applying and capturing images
Bug fixes

11. Required Reading The Future of Configuration Manager
System Center Configuration Manager: Support for Windows 10 and Microsoft Intune

12. Windows 10 Activation
Windows update needed to support Windows 10 with existing KMS servers (Windows Server)
adds support with Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2
adds support for Windows 7 and Windows Server 2008 R2
New KMS and MAK keys needed, available on VLSC
Look for “Windows Srv 2012R2 Data Ctr/Std KMS for Windows 10” on VLSC under licenses, not under downloads and keys
Continued support for Active Directory-based activation (re-configure with new KMS key)

13. Windows Server support for Windows 10
Windows Server 2008 R2 and above
Previous versions are no longer supported, upgrade now
Update KMS with a hotfix, as already discussed
Any forest level, functional level, schema level (although some specific features may require higher)
Consider upgrading to Windows Server 2012 or above
WSUS support for deploying Windows 10 feature upgrades via hotfix
Won’t be backported to Windows Server 2008 R2 (already in extended support)
Be sure to select new products (for WSUS and ConfigMgr SUP)
Keep an eye on Windows Server 2016

14. MDOP Support for Windows 10
MDOP 2015 (released in August) adds Windows 10 support, via service pack-style releases
Product
Required/Recommended Version
AGPM
AGPM 4.0 SP3
App-V
App-V 5.1
DaRT
DaRT 10
MBAM
MBAM 2.5 SP1, 2.5 is OK
UE-V
UE-V 2.1 SP1

15. App-V 5.1 Enhancements App-V 5 Adoption Application Compatibility
Manageability
Improved Q:\ drive support for App-V 4 package conversion
Added support for multiple scripts per trigger
Added Windows 10 support
Added Advanced Package Editor Abilities
Expanded Copy-on-Write to support more file extensions
Environment Variables are merged in Connection Groups
Modernized the App-V Server User Interface
Consolidated and simplified client logging
Microsoft Cloud OS

16. UE-V 2.1 SP1 Enhancements Windows 10 Network Printers Others
Added Windows 10 compatibility
New Windows 10 desktop settings
Network printers synchronized between devices
Synchronized default printer setting
Improved performance when deploying templates from a Template Catalog
Fixed automatic population of AD Home Path for Setting Storage Path configuration
Microsoft Cloud OS

17. MBAM 2.5 SP1 Enhancements Deployability Manageability
Industry Compatibility
Improve managing the enablement of BitLocker during Windows Imaging
Import BitlLocker/TPM recovery information from AD to MBAM
Backup Windows-created TPM OwnerAuth (not just MBAM-created)
Improve MBAM server logging and diagnostic abilities
TPM Auto-Unlock after BitLocker Recovery
Customize the message in the BitLocker Recovery Screen (Win10)
Full Windows 10 support
Encrypted Hard Drive support
International Domain Name support
FIPS compliant recovery password support on Windows 7 (requires Windows hotfix:
Microsoft Cloud OS

18. Step 2 Deploy Windows 10.

19. How to deploy Wipe-and-Load In-Place Provisioning
4/26/2017
How to deploy
Wipe-and-Load
Traditional process
Capture data and settings
Deploy (custom) OS image
Inject drivers
Install apps
Restore data and settings
Still an option for all scenarios
In-Place
Let Windows do the work
Preserve all data, settings, apps, drivers
Install (standard) OS image
Restore everything
Recommended for existing devices (Windows 7/8/8.1)
Provisioning
Configure new devices
Transform into an Enterprise device
Remove extra items, add organizational apps and config
New capability for new devices
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Moving In-place Simplified process, builds on prior experience
4/26/2017
Moving In-place
Preferred option for enterprises
Simplified process, builds on prior experience
Supported with Windows 7, Windows 8, and Windows 8.1
Consumers use Windows Update, but enterprises want more control
Use System Center Configuration Manager or MDT for managing the process
Uses the standard Windows 10 image
Automatically preserves existing apps, settings, and drivers
Fast and reliable, with automatic roll-back if issues are encountered
Popular for Windows 8 to Windows 8.1
Piloted process with a customer to upgrade from Windows 7 to Windows 8.1, as a learning process
Feedback integrated into Windows 10 to provide additional capabilities for automation, drivers, logging, etc.
Working with ISVs for disk encryption
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Moving In-place MDT 2013 Update 1 ConfigMgr v.Next 4/26/2017
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. When not to use in-place upgrade
4/26/2017
When not to use in-place upgrade
Changing from Windows x86 to x64
Systems using Windows To Go, Boot from VHD
Changing from legacy BIOS to UEFI
Dual boot and multi-boot systems
Image creation processes (can’t sysprep after upgrade)
Using certain third-party disk encryption products
Wholesale changes to the apps on existing PCs
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Demo In-Place Upgrade

24. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

31. 4/26/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

32. Provisioning, not reimaging
4/26/2017
Provisioning, not reimaging
Take off-the-shelf hardware
Device is ready for productive use
Transform with little or no user interaction
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. Provisioning, not reimaging
4/26/2017
Provisioning, not reimaging
User-driven, from the cloud
IT-driven, using new tools
Company-owned devices: Azure AD join, either during OOBE or after from Settings
BYOD devices: “Add a work account” for device registration
Automatic MDM enrollment as part of both
MDM policies pushed down:
Change the Windows SKU
Apply settings
Install apps
Create provisioning package using Windows Imaging and Configuration Designer with needed settings:
Change Windows SKU
Apply settings
Install apps and updates
Enroll a device for ongoing management (just enough to bootstrap)
Deploy manually, add to images
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

34. Demo Provisioning

35. Traditional Deployment
4/26/2017
Traditional Deployment
Enhancements to existing tools
Minimal changes to existing deployment processes
New Assessment and Deployment Kit includes support for Windows 10, while continuing to support down to Windows 7
Minor updates to System Center 2012 to add support
Minor updates in Microsoft Deployment Toolkit Update 1 to add support
Will feel “natural” to IT Pros used to deploying Windows 7 and Windows 8.1
Drop in a Windows 10 image, use it to create your new master image
Capture a Windows 10 image, use it for wipe-and- load deployments
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. App & Device Compatibility
4/26/2017
App & Device Compatibility
Hardware requirements are unchanged
Strong desktop app compatibility
Windows Store apps are compatible
Internet Explorer enterprise investments
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

37. Step 3 Keep Windows 10 up to date.

38. Market driven quality: external and internal
4/26/2017
Market driven quality: external and internal
Customer Internal Ring I
Customer Internal Ring II
Customer Internal Ring III
Customer Internal Ring IV
Engineering builds
Broad Microsoft internal validation
Microsoft
Insider Preview Branch
Current Branch
Current Branch for Business
Hundreds
of millions
Several Million
10’s of
thousands
Users
Time
4 to 6 months
4 months
8 months
*Conceptual illustration only
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

39. Application Compatibility Testing
4/26/2017
Application Compatibility Testing
Windows as a Service requires a new approach:
Identify mission-critical applications and web sites
Focus testing effort on just these apps
Leverage internal flights for testing other applications and web sites
From initial pilot groups to large populations of users
Define groups to ensure broad hardware and software coverage prior to broad deployment
React to issues reported, remediate issues before expanding
Talk to your ISVs to determine how they plan to support Windows as a service
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

40. Costs for deployment

41. Thinking through deployment strategy
4/26/2017 9:52 PM
Thinking through deployment strategy
Windows Insider Preview Branch
Current Branch
Current Branch for Business
Long Term Servicing Branch
Deploy to appropriate audiences
Test and prepare for broad deployment
Specific feature and performance feedback
Application compatibility validation
Information workers
General population
Specialized systems
Early adopters, initial pilots, IT devices
Deploy for mission critical systems
Stage broad deployment
Test machines, small pilots
NUMBER OF DEVICES
STAGE
Release
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

42. Configuring to receive feature upgrades via CBB
4/26/2017 9:52 PM
Configuring to receive feature upgrades via CBB
Settings-> Update and Security-> Windows Update -> Advanced Options
Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update
If you are using WSUS or ConfigMgr, the setting doesn’t really matter. Affects Windows Update.
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

43. What to deploy Microsoft Windows 10 Enterprise
(Current Branch, Current Branch for Business)
Microsoft Windows 10 Enterprise 2015 LTSB

44. Windows Insider Preview Branch Current Branch For Business
4/26/2017
When to deploy
Windows Insider Preview Branch
Specific feature and performance feedback
Application compatibility validation
Stage broad deployment via WU for Business
Current Branch For Business
Deploy to appropriate audiences via WUB
Test and prepare for broad deployment
Current Branch
Evaluate
Pilot
Deploy
4-8 months of active development
4 months (minimum)
8 months (minimum)
12 month deployment (minimum)
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

45. 4/26/2017
When to deploy
Evaluate
Pilot
Deploy
Evaluate
Pilot
Deploy
Evaluate
Pilot
Deploy
There will be two supported CBB releases in the market at all times
Be prepared to jump from one release to the next
Don’t try to skip one, as it compresses the deployment timeline too much
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION

46. Staying up to date with Windows 10
Windows Update
Cloud
Upgrades installed as they are released (subject to throttling)
Delivery optimization for peer-to-peer distribution
Only option for Windows 10 Home
Windows Update for Business
Upgrades can be deferred
Uses Windows Update for content
Windows Server Update Services
On-Prem
Upgrades are deployed when you approve them
Content distributed from WSUS servers
Requires KB
System Center Configuration Manager
Choice of task sequence-based upgrades or (with vNext) software update capabilities
Content distributed from ConfigMgr DPs

47. Configuring Windows Update for Business
4/26/2017 9:52 PM
Configuring Windows Update for Business
Step 1. Point all computers to Windows Update directly (no WSUS or SUP)
Step 2. Create policies (GPO) or settings (MDM) to specify how long groups of machines should defer.
Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update
Step 3. Target policies or settings to different groups of PCs.
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

48. Windows 10 November update
Enhancements to Azure AD Join
Enhancements to Microsoft Passport
Windows Store for Business
Windows Update for Business
MDM support for BYOD
Enhancements to Telemetry Control
User Experience Enhancements
Seamless, secured, roaming of user settings across Windows 10 deices, via your Azure cloud.
Utilize Microsoft Passport for your domain accounts on the corporate network.
(AD/AAD Hybrid mode)
Iris support (Beta)
Centrally acquire, manage and distribute Windows Store apps in your organization.
Create your own private store with your corporate LOB apps and curated free apps.
Manage deployment to internal groups (rings) in your enterprise for controlled rollout of Current Branch for Business (CBB) updates.
Manage updates to align with your business rhythm (maintenance “no-update” windows).
MDM support for Windows 10 Home for most MDM settings.
GP/ MDM Controls enabling enterprises to fully turn telemetry off.
Enhancements to Cortana, Edge, Continuum, Support for Continuum for Phone on select Phone devices.

49. Complete your session evaluation on My Ignite for your chance to win one of many daily prizes.

50. Continue your Ignite learning path
Microsoft Ignite 2015
4/26/2017 9:52 PM
Continue your Ignite learning path
Visit Microsoft Virtual Academy for free online training visit
Visit Channel 9 to access a wide range of Microsoft training and event recordings
Head to the TechNet Eval Centre to download trials of the latest Microsoft products
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.