JEZVfutS

1WINDOWS TROUBLESHOOTING SERIES
2Windows
3Installation and
4Update
5Troubleshooting
6—
7Chris Rhodes, MVP
8Andrew Bettany, MVPWindows
9Troubleshooting
10Series
11Mike Halsey, MVP
12Series EditorWindows
13Installation and
14Update
15Troubleshooting
16Chris Rhodes, MVP
17Andrew Bettany, MVPWindows Installation and Update Troubleshooting
18Chris Rhodes
19Huddersfield, United Kingdom Andrew Bettany
20York, North Yorkshire, United Kingdom
21ISBN-13 (pbk): 978-1-4842-1826-6
22DOI 10.1007/978-1-4842-1827-3 ISBN-13 (electronic): 978-1-4842-1827-3
23Library of Congress Control Number: 2016955433
24Copyright © 2016 by Chris Rhodes and Andrew Bettany
25This work is subject to copyright. All rights are reserved by the Publisher, whether the whole
26or part of the material is concerned, specifically the rights of translation, reprinting, reuse of
27illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical
28way, and transmission or information storage and retrieval, electronic adaptation, computer
29software, or by similar or dissimilar methodology now known or hereafter developed.
30Trademarked names, logos, and images may appear in this book. Rather than use a trademark
31symbol with every occurrence of a trademarked name, logo, or image we use the names, logos,
32and images only in an editorial fashion and to the benefit of the trademark owner, with no
33intention of infringement of the trademark.
34The use in this publication of trade names, trademarks, service marks, and similar terms, even
35if they are not identified as such, is not to be taken as an expression of opinion as to whether or
36not they are subject to proprietary rights.
37While the advice and information in this book are believed to be true and accurate at the
38date of publication, neither the authors nor the editors nor the publisher can accept any legal
39responsibility for any errors or omissions that may be made. The publisher makes no warranty,
40express or implied, with respect to the material contained herein.
41Managing Director: Welmoed Spahr
42Lead Editor: Gwenan Spearing
43Technical Reviewers: Dustin Harper and Zeshan Sattar
44Editorial Board: Steve Anglin, Pramila Balan, Laura Berendson, Aaron Black,
45Louise Corrigan, Jonathan Gennick, Robert Hutchinson, Celestin Suresh John,
46Nikhil Karkal, James Markham, Susan McDermott, Matthew Moodie, Natalie Pao,
47Gwenan Spearing
48Coordinating Editor: Mark Powers
49Copy Editor: April Rondeau
50Compositor: SPi Global
51Indexer: SPi Global
52Artist: SPi Global
53Distributed to the book trade worldwide by Springer Science+Business Media New York,
54233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505,
55e-mail orders-ny@springer-sbm.com , or visit www.springeronline.com . Apress Media, LLC is a
56California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc
57(SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.
58For information on translations, please e-mail rights@apress.com , or visit www.apress.com .
59Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional
60use. eBook versions and licenses are also available for most titles. For more information,
61reference our Special Bulk Sales–eBook Licensing web page at www.apress.com/bulk-sales .
62Any source code or other supplementary materials referenced by the author in this text are
63available to readers at www.apress.com/9781484218266 . For detailed information about how to
64locate your book’s source code, go to www.apress.com/source-code/ . Readers can also access
65source code at SpringerLink in the Supplementary Material section for each chapter.
66Printed on acid-free paperContents at a Glance
67About the Authors ........................................................................... xiii
68About the Technical Reviewers ....................................................... xv
69Windows Troubleshooting Series .................................................. xvii
70Introduction .................................................................................... xix
71â–  Chapter 1: An Introduction to Windows Installation
72Methodologies and Tools ................................................................ 1
73â– Chapter 2: Installing Windows Locally ......................................... 29
74â– Chapter 3: Upgrading the Windows Client Operating System ...... 67
75â– Chapter 4: Automating Windows Deployment with Lite Touch ..... 89
76â– Chapter 5: Automating Windows Deployment with Zero Touch ....119
77â– Chapter 6: Updating and Maintaining Windows ......................... 139
78â– Chapter 7: Managing Windows Updates with Intune .................. 167
79Index .............................................................................................. 185
80vContents
81About the Authors ........................................................................... xiii
82About the Technical Reviewers ....................................................... xv
83Windows Troubleshooting Series .................................................. xvii
84Introduction .................................................................................... xix
85â–  Chapter 1: An Introduction to Windows Installation
86Methodologies and Tools ................................................................ 1
87From Floppy Disks to Cloud Installation .................................................. 1
88Understanding the Windows Boot Process .............................................. 2
89Understanding the Hardware Abstraction Layer ....................................................... 6
90Introduction to Windows Deployment Tools ............................................ 6
91Cabinet Files ............................................................................................................. 7
92Windows Imaging Format ......................................................................................... 7
93Windows Setup ......................................................................................................... 8
94Sysprep ................................................................................................................... 10
95ImageX .................................................................................................................... 12
96DiskPart .................................................................................................................. 12
97PowerShell.............................................................................................................. 13
98The Windows Assessment and Deployment Kit ...................................................... 13
99Windows System Image Manager .......................................................................... 14
100Windows Preinstallation Environment .................................................................... 17
101Deployment Image Servicing and Management ..................................................... 18
102Windows Imaging and Confi guration Designer ....................................................... 19
103viiâ–  CONTENTS
104Windows Assessment Toolkit.................................................................................. 23
105Windows Performance Toolkit ................................................................................ 25
106Summary ............................................................................................... 27
107â– Chapter 2: Installing Windows Locally ......................................... 29
108Creating Windows Installation Media (DVDs, USB, etc.) ........................ 29
109Performing a Clean Installation of Windows ......................................... 34
110Migrating to a New Version of Windows (USMT, Easy Transfer) .............................. 39
111Managing the Windows Boot Partitions and Files .................................................. 42
112Multi-Booting Windows .......................................................................................... 45
113Installing a Non-Windows OS, Such as Linux/MAC ................................................. 51
114VHD Boot ................................................................................................................. 53
115Installing Windows in Hyper-V ................................................................................ 56
116Windows Activation Options (Retail, MAC, KMS, AD BA) ........................ 60
117Troubleshooting Activation Issues .......................................................................... 65
118Summary ............................................................................................... 66
119â– Chapter 3: Upgrading the Windows Client Operating System ...... 67
120Upgrade vs. Clean Installation ............................................................... 67
121Upgrading and Downgrading Windows ................................................. 68
122Upgrading the Windows OS from DVD or USB ....................................... 71
123Upgrading the Windows OS with Windows Update ............................... 77
124Upgrading the Windows OS from PC Settings ....................................... 81
125Troubleshooting Upgrade Issues ........................................................... 85
126Operating System Stability ..................................................................................... 85
127Troubleshooting Windows 10 Upgrade Error Codes ................................................ 86
128Block Upgrading to Windows 10 ............................................................................. 87
129Upgrading a System with BitLocker Drive Encryption ............................................ 87
130Summary ............................................................................................... 88
131viiiâ–  CONTENTS
132â– Chapter 4: Automating Windows Deployment with Lite Touch ..... 89
133Creating a Reference Machine (Sysprep) .............................................. 90
134Creating Unattended Installations (Windows SIM) ................................ 94
135Confi gure and Troubleshoot WDS .......................................................... 97
136Installing a WDS Server .......................................................................................... 98
137Getting to Know WDS ............................................................................................ 100
138Boot Images .......................................................................................................... 102
139Install Images ....................................................................................................... 102
140Troubleshooting WDS ............................................................................................ 105
141Confi gure and Troubleshoot MDT ........................................................ 107
142Task Sequences .................................................................................................... 108
143Adding Applications .............................................................................................. 112
144Packages .............................................................................................................. 112
145Updating the Deployment Share ........................................................................... 112
146Troubleshooting MDT ............................................................................................ 113
147Deployment Hints, Tips, and Shortcuts (Including Activation Issues) ..... 114
148Activation .............................................................................................................. 114
149Drivers .................................................................................................................. 115
150Sysprep ................................................................................................................. 116
151WDS ...................................................................................................................... 116
152The Iceberg of MDT .............................................................................................. 116
153Testing, Testing, Testing ........................................................................................ 117
154Dream Chasing ..................................................................................................... 117
155Summary ............................................................................................. 117
156ixâ–  CONTENTS
157â– Chapter 5: Automating Windows Deployment with Zero Touch ....119
158Overview of System Center Confi guration Manager ........................... 119
159Sites ...................................................................................................................... 121
160Site System Servers ............................................................................................. 121
161Clients ................................................................................................................... 122
162Confi guring OSD in System Center ...................................................... 123
163What Is OSD? ........................................................................................................ 123
164Confi guring SCCM for OSD ................................................................................... 125
165Integrating MDT with System Center .................................................. 127
166Monitoring and Troubleshooting Zero Touch ....................................... 134
167Distribution Points ................................................................................................ 134
168Logs ...................................................................................................................... 135
169Monitoring ............................................................................................................ 135
170Task Sequences .................................................................................................... 136
171Clients ................................................................................................................... 136
172Summary ............................................................................................. 137
173â– Chapter 6: Updating and Maintaining Windows ......................... 139
174Updates vs. Upgrades ......................................................................... 139
175Confi guring Windows Update .............................................................. 141
176Services ................................................................................................................ 146
177Windows 10 ......................................................................................... 146
178Setting Up and Managing WSUS ......................................................... 151
179Installing and Confi guring WSUS .......................................................................... 153
180Troubleshooting and Repairing Windows Update Issues ..................... 161
181Source Confi guration ............................................................................................ 161
182Detection .............................................................................................................. 161
183Metered Connections ............................................................................................ 162
184Services ................................................................................................................ 163
185xâ–  CONTENTS
186Targeting ............................................................................................................... 163
187Reporting .............................................................................................................. 165
188Other Network-Related Issues .............................................................................. 165
189Summary ............................................................................................. 166
190â– Chapter 7: Managing Windows Updates with Intune .................. 167
191Overview of Microsoft Intune .............................................................. 167
192Integrating Intune ................................................................................................. 168
193Creating a Microsoft Intune Subscription ............................................ 169
194Supported Clients ................................................................................................. 169
195Subscriptions ........................................................................................................ 170
196Enrolling Clients .................................................................................................... 173
197Confi guring Microsoft Intune Updates ................................................. 174
198Third-Party Updates .............................................................................................. 176
199Approving Updates ............................................................................................... 176
200Reports ................................................................................................................. 179
201Agent Settings ...................................................................................................... 179
202Troubleshooting Microsoft Intune Updates .......................................... 181
203Patience! ............................................................................................................... 183
204Summary ............................................................................................. 183
205Index .............................................................................................. 185
206xiAbout the Authors
207Chris Rhodes is a Microsoft MVP (Most Valuable
208Professional) awardee and technical expert. Over nearly two
209decades as a Microsoft Certified Trainer, he has taught
210Windows technologies to thousands of students, taking them
211to certification level and beyond. Outside of the classroom,
212Chris has been involved with numerous projects, including consulting for a variety of
213customers, and also as a subject matter expert for Microsoft on several projects. In his
214spare time, Chris can often be found attending and speaking at conferences, such as
215TechEd and MCT and MVP events. Chris is also a founding member of the Windows User
216Group in the United Kingdom, where he regularly presents with a passion on topics
217around Windows.
218Andrew Bettany is a Microsoft Most Valuable Professional
219(MVP), recognized for his Windows expertise, and author
220of several publications including Windows exam
221certification prep and Microsoft official training materials.
222Managed the IT Academy at the University of
223York, UK for 8 years, and now focuses his time training
224and writing. As a Microsoft Certified Trainer, Andrew
225delivers learning and consultancy to businesses on
226a number of technical areas including Windows
227deployment and troubleshooting.
228He has created and manages the IT Masterclasses series of short intensive technical
229courses, found at www.itmasterclasses.com and run through his own training company,
230Deliver IT Training Ltd.
231Passionate about learning and helping others, he frequently donates his time to work
232with Microsoft. He is a frequent speaker and proctor at TechEd conferences worldwide.
233In 2011 he delivered a “train the trainer” class in earthquake-hit Haiti to help the
234community rebuild their technology skills, and he returned in November 2013 to deliver a
235second bootcamp.
236Andrew is very active on social media and can be found on LinkedIn, Facebook, and
237Twitter. He lives in a village just outside of the beautiful city of York in Yorkshire, UK.
238xiiiAbout the Technical
239Reviewers
240Dustin Harper is an IT professional for a large winery
241in the United States. He volunteers his time and
242knowledge among various Microsoft technologies, both
243in person and online. He was first awarded the
244Microsoft Most Valuable Professional (MVP) award in
2452014. He is active on his website ( MSTechpages.com ),
246Microsoft Answers, and other tech forums. He also has
247several industry certifications, including Microsoft
248Certified Professional (MCP).
249Zeshan Sattar is Head of Curriculum Development at
250Agilisys Arch, an Apprenticeships Training Provider in
251the United Kingdom. He is responsible for devising the
252training and certification curriculum for apprentices
253between 16 and 24 years old. This includes a diverse
254range of topics across the infrastructure and
255development tracks. He has delivered training to
256audiences across the world, both in person and via
257online platforms. Zeshan has also worked and spoken
258at a number of Microsoft events, including Microsoft
259Ignite and TechEd.
260xvWindows Troubleshooting
261Series
262When something goes wrong with technology, it can seem impossible to diagnose and
263repair the problem, and harder still to prevent a recurrence. In this series of books, we’ll
264take you inside the workings of your devices and software and teach you how to find and
265fix problems using a simple step-by-step approach that helps you understand the cause,
266the solution, and the tools required.
267Series Editor
268Mike Halsey, MVP
269Mike Halsey is a Microsoft MVP (Most Valuable Professional) awardee since 2011,
270the author of more than ten books on Microsoft Windows, and a teacher of many years.
271He understands the need to convey subjects that can sometimes be complex in clear and
272non-intimidating ways.
273The Windows Troubleshooting Series is, he feels, a great example of how quality
274help, support, and tutorials can be delivered to individuals of all technical abilities. He
275hopes you enjoy reading this and many other books in this series, both now and for years
276to come.
277xviiIntroduction
278Nearly all PCs purchased contain a version of Microsoft Windows that has been pre-
279installed by the vendor or manufacturer. The vast majority of Windows users will use
280the original operating system for the lifetime of the device. Microsoft has always allowed
281you to change and modify the PC configuration, adding or removing components and
282allowing users to re-install or change the version of Windows to another version that you
283may have. This flexibility is one of the reasons that the PC and Windows became very
284popular to business customers and PC enthusiasts.
285Virtualization tools such as Hyper-V allow you to test, evaluate, and use multiple
286instances of the same or different Windows installation on a single device. For machines
287that do not support virtualization, or when a user wants the option to choose the version
288of Windows they want to use as the host, a user can also create multi-boot scenarios
289where the device has multiple operating systems installed and the user is required to
290choose the host operating system at boot time.
291With Windows XP no longer being supported by Microsoft (since April 8, 2014),
292this book will focus on the technologies available for the installation, upgrading, and
293deployment of Windows post–Windows XP. Some tools and concepts used during
294installation and upgrading have remained relatively static since Windows Vista, such
295as the WAIK, Sysprep, and the WIM format, but many have been improved upon and
296expanded. There are plenty of new tools that have been introduced recently including the
297Windows Assessment and Deployment Kit (ADK), Windows Imaging and Configuration
298Designer (Windows ICD), Refresh, and Reset, which offer a variety of options when
299considering an in-place upgrade or new installation of Windows.
300If you are upgrading from one version of Windows to a newer version, or upgrading
301the edition of the same Windows version, the process has become easier and can be fully
302automated, with all your files and settings optionally being preserved during the upgrade.
303Within corporate environments, you are able to use a variety of deployment tools,
304such as Windows Pre-installation Environment (Windows PE), Deployment Image
305Servicing and Management (DISM), Windows System Image Manager (Windows SIM),
306Microsoft Deployment Toolkit (MDT), Windows Deployment Services (Windows DS), and
307System Center 2012 Configuration Manager (SCCM). New and updated methodologies,
308including Refresh, Provisioning, and Migration, allow deployments to be quicker, more
309efficient, and more cost effective.
310The threat of malware attacks continues to increase, aiming to disrupt or exploit
311security vulnerabilities and access your business or personal data and your bank account.
312You must ensure that your systems remain fully patched and updated. We will discuss
313Windows Update and review troubleshooting scenarios where a bad update needs to be
314blocked. Windows Server Update Services (WSUS) offers enterprises the ability to control
315and scale the approval of updates, and the new peer sharing of updates within Windows
31610 allows updates to be rapidly deployed across the network to clients.
317xixâ–  INTRODUCTION
318More devices are connected to the Internet than ever before, and working
319anywhere, using either company-owned devices or BYOD, is increasingly popular.
320The cloud-based Microsoft Intune dashboard offers IT administrators a desktop and
321mobile-device management solution that helps organizations manage and maintain
322devices, both those that are decentralized and those based within the office. Intune is
323included as part of Microsoft’s Enterprise Mobility Suite.
324xxCHAPTER 1
325An Introduction to Windows
326Installation Methodologies
327and Tools
328With the release of Windows Vista in January 2007, Microsoft introduced a number of new
329technologies that can be used for deployment; each subsequent version of Windows has
330improved many of these tools and introduced some new ones.
331If you are familiar with some of the Windows deployment tools, you should review
332this chapter to look for the improved-upon tools. If your experience relates to the
333Windows XP era, you will be pleased to learn that the Microsoft tools available have been
334improved greatly and that many have matured into some excellent utilities for you to use.
335Some tools are built into Windows, such as Sysprep and Deployment Image
336Servicing and Management Technical (DISM) , while other deployment tools are available
337by downloading them from the Microsoft Download Center.
338This chapter will introduce the tools and methodologies used to install, upgrade, and
339deploy Windows that will form the foundation of the more advanced topics, which will be
340covered in the remaining chapters.
341From Floppy Disks to Cloud Installation
342The Windows installation process has come a long way in the last 20 years. Windows 98
343could be installed one file at a time, copied by the setup program from 38 1.68 MB floppy
344disks. With Windows XP, a bootable CD-ROM drive was still very rare, and you could
345obtain or create the Windows XP setup boot disks from Microsoft. The Windows XP setup
346required six floppy disks just to install the setup program, then provided access to the
347remaining installation files held on the Windows XP CD-ROM.
348With Windows Vista through to Windows 8.1, Microsoft moved to a new image-based
349installation format that used the Windows Image (WIM) file format. Each WIM contained
350the entire operating system, which could be mounted, maintained, and updated easily
351using new the deployment tools.
352© Chris Rhodes and Andrew Bettany 2016
353C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
354DOI 10.1007/978-1-4842-1827-3_1
3551CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
356Although Windows 10 retains many of the same WIM components that its
357predecessors had, Windows 10 offers another change in the way that Windows is updated
358and maintained. Windows Update now provides the ability to deliver both security and
359driver updates and also new feature upgrades to Windows 10, while the new provisioning
360packages feature allows the direct deployment of updates and features to a live system.
361Understanding the Windows Boot Process
362Before we discuss the various options for installing and deploying Windows, we should
363first review the new startup process that has replaced the old Ntldr process that existed
364with Windows XP. Ntldr has been replaced by the Windows Boot Manager and the
365Windows Boot Loader. The boot.ini file has been replaced by the boot configuration
366data (BCD) registry file.
367The simplified boot process for Windows Vista and later versions of Windows is
368illustrated in Figure  1-1 .
369Windows
370Resume
371Application
372BIOS or EFI
373Windows
374Boot Manager
375Boot
376Configuration
377Data
378Windows
379Boot Loader
380Windows
381Recovery
382Environment
383Figure 1-1. Windows boot process
384Some of the components of the BCD file are shown in Table  1-1 .
3852
386Windows
387Vista or laterCHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
388Table 1-1. Boot Components
389File/Process Description
390BCD Boot Configuration Data (BCD) store, a registry-
391like database that replaced boot.ini with a more
392robust and flexible file
393WinRE Replaces the command-line recovery console
394with a GUI recovery option
395Windows Boot Loader \Windows\System32\WinLoad.exe
396Windows Boot Manager BootMgr is read-only and hidden and is located in
397the root directory of the active partition
398Windows Memory Diagnostic \Boot\MemTest.exe
399Windows Resume Application Used to restore Windows from hibernation:
400\Windows\System32\WinResume.exe
401The BCD registry file is located in the following location based on the motherboard type:
402• BIOS-based systems : \Boot\Bcd on the active partition
403• Extensible Firmware Interface ( EFI ) – based systems: \EFI\
404Microsoft\Boot\ folder on the EFI system partition
405There are several ways in which you can view and modify the entries in the BCD
406registry file, as listed in Table  1-2 .
4073CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
408Table 1-2. Methods of Modifying the BCD
409Tool/Utility Description
410Startup and Recovery Within the Advanced tab of the System Properties dialog
411box, there are several options for selecting the default
412operating system to boot up and for configuring the time
413delay after which the boot menu will appear.
414System Configuration Utility
415( Msconfig.exe ) Troubleshooting GUI tool you can use to configure
416startup options
417BCD Windows Management
418Instrumentation provider The Windows Management Instrumentation ( WMI )
419allows you to script utilities that modify the BCD. More
420information can be found at https://msdn.microsoft.
421com/library/aa362675.aspx
422BCDEdit.exe BCDEdit.exe is a command-line utility that replaced
423Bootcfg.exe , which was available in Windows XP.
424BCDEdit requires an administrative command prompt.
425You can type bcdedit.exe to view the contents of the
426BCD registry file, as shown in Figure  1-2 .
427Third-party tools There are several third-party tools that allow you to
428edit the BCD registry file using a GUI, including the
429following:
430DualBootPRO ( http://www.dualbootpro.org/ )
431EasyBCD ( https://neosmart.net/EasyBCD/ )
432Visual BCD Editor ( http://www.boyans.net/ )
433If you open an administrative command prompt and type bcdedit.exe , the contents
434of your BCD registry file will be displayed, as shown in Figure  1-2 .
4354CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
436Figure 1-2. Using the BCDedit.exe command to view the BCD contents
437BCDedit is a powerful tool, and care should be taken when modifying the file, as your
438system may not boot if you incorrectly edit the file. For detailed information relating to
439the BCDedit utility, type bcdedit.exe /? .
440To display detailed information about a parameter or switch, type bcdedit.exe /?
441<Parameter> .
442For example, bcdedit.exe /? /createstore .
4435CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
444Understanding the Hardware Abstraction Layer
445In older versions of Windows, the hardware abstraction layer (HAL) component,
446typically the dynamic link library file called Hal.dll , created significant problems when
447you attempted to move a Windows installation from one system to a newer system; for
448example, after a system failure. A backup image of Windows XP or Windows Server 2003
449was not hardware independent, and any recovered system had to be restored back onto
450identical hardware.
451The purpose of the HAL is to create a separation between the operating system
452and the physical hardware components on the motherboard. In simple terms, the HAL
453provides the necessary drivers for communicating with the computer’s processor and
454memory.
455Windows Vista and later releases incorporate the ability to automatically detect
456which HAL should be used at boot time. The detect HAL feature, which is an option that
457can be set within the BCD, is most often used when the device has multiple operating
458systems installed, such as in a dual-boot scenario.
459For Vista only, there was a setting hidden within the System Configuration Utility
460( MSConfig.exe ) called Detect HAL, which allowed you to force the operating system to
461search for the different versions of the HAL during deployment. If multiple options were
462available, Windows would then add a prompt into your boot menu so you could choose
463which operating system to boot.
464â–  Note The Detect HAL option within the System Configuration Utility was deprecated in
465Windows 7 and later. To configure this setting, you would use the BCDEdit tool and use the
466command bcdedit /set {current} detecthal yes .
467Introduction to Windows Deployment Tools
468Some of the common tools and features available for Windows installation and
469deployment are provided freely by Microsoft. However, you need to understand some of
470the underlying technologies that relate to Windows installation and deployment before
471we cover the enterprise tools later in this book.
472We will cover the following tools in this section:
4736
474• Cabinet files
475• Windows Imaging Format
476• Windows Setup
477• Sysprep
478• ImageX
479• DiskPart
480• PowerShellCHAPTER 1 ■ AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
481The Windows Assessment and Deployment Kit (ADK) , which replaces the Windows
482Automated Installation Kit (Windows AIK) , is covered later in this chapter.
483Cabinet Files
484Cabinet ( .cab ) files are frequently used by older versions of Windows to hold installation
485files in a compressed status until they are required by the setup program. If a file is too
486large even when compressed, the .cab file can be spread over several .cab files.
487You may still encounter .cab files today, as they are commonly used to reduce
488file size and download time when obtaining files from the Internet or from a corporate
489intranet server. Some third-party independent software vendors (ISVs), such as
490InstallShield and WISE, use the .cab format for installation purposes.
491Windows Imaging Format
492You should be familiar with the .zip or .rar file extensions — files that contain compressed
493files. First introduced with Windows Vista, the Windows Imaging format (WIM) is a
494file-based disk image format that allows Windows to highly compress files relating to
495the installation of a Windows operating system. In each .wim file you can store multiple
496operating system images.
497Image-based setup is used in high-volume deployment scenarios, such as in an
498enterprise environment. Images can also be maintained individually or in an ad-hoc
499manner by using tools such as Deployment Image Servicing and Management ( DISM.exe ),
500which can patch or install software updates directly into the WIM file.
501The simplified logical layout of a WIM file structure is shown in Figure  1-3 .
502Image 1
503Metadata
504resource
505(Image 2)
506Metadata
507resource
508(Image 1)
509WIM
510Header
511WIM File
512Image 2
513Figure 1-3. Structure of Windows Imaging file format
514There are six optional components contained within a WIM file, as follows:
515•
516WIM Header – Content definition and resource information,
517including various .wim file attributes, such as version, size, and
518compression type
5197CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
520• File Resources – Packages containing data, such as source files
521• Metadata Resource – One metadata resource component in each
522image in a .wim file. Contains information relating to how the data
523is organized in the .wim file, such as directory structure and file
524attributes
525• Lookup Table – Information relating to resource file memory
526locations in the .wim file
527• XML Data – Contains additional data about the image. To
528view the XML data, you should use the Dism /Get-ImageInfo
529command.
530• Integrity Table – A security hash used to verify the integrity of an
531image
532Windows Setup
533The setup executable (now called Setup.exe ) for Windows installs can be set with various
534parameters to control how the Windows image ( .wim ) file behaves during the installation.
535When Setup. exe is used with an answer file, the installation process can be fully
536automated. The unattend.xml answer file format replaces the answer files used in earlier
537versions of Windows, such as unattend.txt , Sysprep.inf , or winnt.sif .
538Some common Windows Setup command-line options include the following:
539• Setup /unattend:\\server\share\unattend.xml (Enables you
540to use an answer file with Windows Setup)
541• Setup /wds /wdsdiscover /wdsserver:MyWDSServer (Specifies
542the name of the Windows Deployment Services server that the
543client should connect to)
544• Setup /installfrom:D:\custom.wim (Specifies a different
545Install.wim file to use during Windows Setup)
546Windows is installed in stages. The phases of a Windows installation are known as
547configuration passes . Later in this chapter, you will learn that you can create unattended
548installations using an answer file. The answer file can customize the installation by
549applying changes in one or more of the configuration passes. The diagram shown in
550Figure  1-4 shows the configuration passes that are available for the Windows Setup.
5518CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
552windowsPE
553(Windows Setup
554settings)
555offlineServicing
556specialize
557oobeSystem
558Figure 1-4. Windows Setup.exe configuration passes
559The four configuration passes that Setup.exe will apply are as follows:
560• windowsPE – This is used to specify which Windows image to
561install and to configure the disk, volumes, and formatting and
562install boot-critical drivers
563• offlineServicing - This configuration pass is used to apply the
564Windows image to a hard disk and to apply updates, drivers, or
565language packs.
566• specialize - After the Windows image boots for the first time,
567unique security IDs (SIDs) are created and many Windows
568features and hardware-specific settings are configured.
569• oobeSystem - During this configuration pass, settings are applied
570to Windows before the Windows Welcome starts, such as to create
571user accounts, specify language, and set locale settings.
5729CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
573Sysprep
574The System Preparation tool ( Sysprep ) has been available since Windows NT 4.0 and is
575used for Windows operating system deployment. The version that is included in Windows
576Vista and later allows you to prepare an operating system for cloning using the WIM disk
577image format. When combined with an answer file, Sysprep can be used to fully automate
578the deployment of new computers using the configuration settings contained in the
579answer file.
580Answer files are created using the Windows System Image Manager, which will be
581discussed later in this chapter.
582If you run Sysprep without an answer file, the tool will generalize the Windows
583installation, which removes all personal settings, user profiles, drivers, hardware profiles,
584and any saved restore points. When Windows is restarted, Windows Setup will apply the
585specialize configuration pass only and presents you with the out-of-box experience
586(OOBE) with the Windows Welcome screen. At this screen you can then customize your
587system, create user accounts, name the computer, and perform other tasks.
588Since Windows 8.1, the Sysprep graphical user interface (GUI) as shown in Figure  1-5
589has been deprecated, but it still exists and is supported.
590Figure 1-5. Using the Sysprep tool to generalize Windows
591It is not possible to specify an answer file when using the GUI tool. You should use
592an elevated command prompt and use the command-line tool sysprep.exe to initiate
593Sysprep. This file is located in the C:\Windows\System32\Sysprep folder.
59410CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
595There are two main options available to you when using Sysprep, as follows:
5961. Sysprep /audit – Restarts the computer into audit mode.
597Audit mode is used to test and evaluate the installation
598of Windows that is being prepared for deployment. In
599Audit mode you can continue to add additional drivers or
600applications to Windows and either use the Sysprep /audit
601setting again or use Sysprep /generalize .
6022. Sysprep /generalize – Prepares the system for imaging and
603removes unique information from your Windows installation.
604Sysprep resets the security ID (SID), clears any system restore
605points, and deletes event logs. Normally it is used with the /
606shutdown switch.
607The command-line options available for Sysprep are listed in Table  1-3 , and the
608syntax is as follows:
609sysprep.exe [/oobe | /audit] [/generalize] [/reboot | /shutdown | /quit]
610[/quiet] [/unattend:answerfile]
611Table 1-3. Sysprep Command-Line Options
612Option
613Description
614Example usage
615/audit Restarts the computer into audit mode
616Sysprep /audit
617/generalize Prepares the Windows installation to
618be imaged
619Sysprep /
620generalize /
621shutdown
622/oobe Restarts the computer into OOBE
623mode
624Sysprep /
625generalize /
626shutdown /oobe
627/mode:vm Generalizes a Virtual Hard Disk (VHD). Sysprep /
628You can only run VM mode from inside generalize /oobe
629a VM.
630/mode:vm
631/reboot Restarts the computer
632/shutdown Shuts down the computer after the
633Sysprep command completes
634/quiet Useful for scripting; Sysprep will
635run without displaying on-screen
636confirmation messages
637/quit Closes the Sysprep tool after the
638Sysprep command completes
639/unattend:<answerfile> Applies settings in an answer file
640to Windows during an unattended
641installation
642Sysprep /
643audit /reboot /
644unattend:F:\
645Unattend.xml
64611CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
647Sysprep will remove any unique configurations that have been applied to the
648installation. During the “generalization” process existing elements, including Computer
649name, Security Identifier (SID) , and the Driver Cache will be discarded and will be rebuilt
650during the reboot sequence.
651â–  More Info You can find more information on the Sysprep (System Preparation) Overview
652Hardware Dev Center page. This page also contains links to resources related to creating the
653answer files that you use with Sysprep: https://msdn.microsoft.com/library/windows/
654hardware/dn938335(v=vs.85).aspx
655ImageX
656This command-line tool, introduced in Windows Vista, was one of the first tools that
657allowed you to capture, modify, and apply WIM images. The version available with
658Windows 7 allowed you to mount multiple images simultaneously with an increased
659reliability over that in Windows Vista.
660ImageX has been deprecated in Windows 8, and DISM is the replacement tool when
661managing and servicing images. ImageX is included in this book for reference only; you
662should use DISM wherever possible.
663DiskPart
664DiskPart is a command-line utility that allows you to manage Windows disks and
665volumes. Although many of the tasks are similar to the Disk Management snap-in within
666Windows, with DiskPart you can perform a superset of the actions that are supported by
667the GUI .
668To launch DiskPart, follow these steps:
6691. Open an elevated command prompt, or use Windows+X and
670choose Command Prompt (Admin).
6712. Type DiskPart and press Enter.
6723. After DiskPart loads, the cursor will show DISKPART> .
6734. To obtain detailed help with examples of a command, type
674HELP followed by the command. For example, HELP LIST
675provides the syntax that DiskPart uses.
6765. To exit DiskPart, type EXIT and press Enter, then close the
677command window.
678DiskPart.exe offers the ability to script disk management using the command
679prompt or PowerShell.
68012CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
681â–  Note You can abbreviate most of the DiskPart commands. For example, you can use
682SEL instead of SELECT or PART instead of PARTITION .
683PowerShell
684This is the tool of choice for system administrators who manage a large number of client
685machines or servers. PowerShell offers a fully scriptable and extensible object-oriented
686programming language that is fully embedded in all modern versions of Windows,
687including client and server operating systems.
688Unlike previous versions of Windows where GUI snap-ins were the predominant
689admin tools, a great many administrative actions can now only be performed using
690PowerShell. New services such as Office 365 and Microsoft Azure utilize PowerShell for
691nearly all administrative tasks.
692This book does not have the room to cover PowerShell in much detail, but, where
693possible, references to PowerShell will be included. If you are unfamiliar with PowerShell,
694you should review the potential that PowerShell offers, especially if you manage a large
695number of devices or users.
696The Windows Assessment and Deployment Kit
697The Windows Assessment and Deployment Kit (ADK) replaces the Windows Automated
698Installation Kit (Windows AIK) and includes a number of powerful tools and wizards
699that allow you to fully customize your Windows deployments by creating images and
700provisioning packages.
701The ADK is used for Windows 8 and later, and the AIK was used for Windows Vista
702and Windows 7 installations. The tools are backward compatible, and therefore you
703should ensure that you use the latest version of the toolkit.
704The latest version of the ADK is compatible with Windows 10 and includes the
705following key tools, which will be introduced in this chapter:
706• Windows System Image Manager
707• Windows Preinstallation Environment
708• Deployment Image Servicing and Management
709• Windows Imaging and Configuration Designer
710• Windows Assessment Toolkit
711• Windows Performance Toolkit
712â–  More Info You can download the Windows ADK from https://msdn.microsoft.com/
713windows/hardware/dn913721.aspx
71413CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
715When you install the ADK you should ensure that the required deployment tools and
716features are installed. You should review the installation options in each feature, as shown
717in Figure  1-6 .
718Figure 1-6. The Windows Assessment and Deployment (ADK) setup
719Windows System Image Manager
720First introduced in Windows Vista, the Windows System Image Manager (Windows
721SIM) is used for creating and editing answer files ( Unattend.xml ), which can be used to
722automate the installation of all versions of Windows from Windows Vista and later.
723The Windows SIM is included in the Windows Assessment and Deployment Kit
724(ADK) and is compatible with Windows 8 and later, and is also found in the Windows
725Automated Installation Toolkit (AIK) , which is used with Windows Vista and Windows 7
726only. Both toolkits can be used for the following high-level scenarios:
72714
728• Create a new answer file to be applied to a Windows image during
729installation
730• Edit an existing answer file
731• Add additional device drivers to an answer file
732• Add applications or additional drivers to an answer fileCHAPTER 1 ■ AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
733• Add updates to a Windows image offline
734• Create a configuration set of distribution files
735• Import packages to a distribution share available for deployment
736Examples of installation tasks that you can configure in an answer file using the
737Windows SIM include the following:
738• Partition and format hard disks
739• Install windows
740• Add or change language packs and settings
741• Modify video display settings
742• Create the computer name
743• Install third-party applications
744• Install device drivers
745• Add activation keys for Windows and Office
746• Add user accounts
747• Add Windows updates and upgrades
748When you first begin using the Windows SIM, you should take a look at a sample
749answer file. Included with the ADK for Windows 8.1 is a sample Autounattend.xml
750file located in the C:\Program Files (x86)\Windows Kits\8.1\Assessment and
751Deployment Kit\Deployment Tools\Samples\Unattend folder. The sample files
752provided include all of the settings that are needed to automate Windows installation.
753Unfortunately, there is no sample available for Windows 10 at the time of going to print.
754When configuring the answer file you will add the various components that will
755configure Windows. One of the most common settings found in most answer files will
756relate to setting the Windows Shell Setup component. You will notice that there are two
757components available depending on the architecture of your machine, as follows:
758• amd64_Microsoft-Windows-Shell-Setup for 64-bit Windows
759• x86_Microsoft-Windows-Shell-Setup for 32-bit Windows
760Select the Windows image component applicable to your destination computer
761and then right click the setting. When you use the Windows SIM you will notice that the
762available components can be applied to one or more configuration passes, as shown in
763Figure  1-7 .
76415using
765CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
76616CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
767We learned earlier in the chapter that the Windows installation is performed via
768configuration passes, with four passes being used by Windows Setup. The amd64_
769Microsoft-Windows-Shell-Setup component should be added to the specialize pass.
770You should spend some time familiarizing yourself and experimenting with building
771and fine tuning an answer file using the Windows SIM.
772Answer files can be used to remove much of the user interaction normally required
773during a Windows installation, which will then ensure an efficient and consistent
774deployment.
775â–  More Info The Windows System Image Manager Technical Reference can be found
776here: https://technet.microsoft.com/en-us/library/cc766347(v=ws.10).aspx
777The Windows SIM does not modify the settings directly in a WIM file; rather, it
778modifies the answer file. You would use DISM to modify actual WIM files.
779Windows Preinstallation Environment
780Known as Windows PE or WinPE , this tool provides a lightweight version of Windows
781that is bootable and is often used for the deployment of Windows or for launching
782troubleshooting tools on a system while it is offline.
783WinPE has the following functions within an enterprise setting:
784• Deployment of workstations and servers
785• Recovery platform to launch recovery tools
786• Platform for running third-party utilities
787WinPE can be booted using a USB flash drive, PXE boot on the network, a CD-ROM,
788or directly from a hard disk. Windows Setup, Windows Deployment Services (Windows DS),
789System Center Configuration Manager (SCCM) , and Microsoft Deployment Toolkit (MDT)
790all use Windows PE to launch the deployment or capture wizards during boot time.
791WinPE has been available since Windows XP and is a replacement for the MS-DOS
792boot disk. Originally only available to original equipment manufacturers, (OEM), the
793WinPE is now available within the Windows AIK and ADK . The versions and availability
794of WinPE are shown in Table  1-4 .
79517CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
796Table 1-4. Windows Preinstallation Environment Major Versions
797Version Description and Code Base
7981.0 Lightweight version of Windows XP
7992.0 Built from the first edition of Windows Vista
8003.0 Built from Windows 7 and included in the AIK version 2.0
8014.0 Built from Windows 8 and included in the Windows ADK for
802Windows 8.0
8035.0 Built from Windows 8.1 and included in the Windows ADK for
804Windows 8.1
80510.0.10240 Built from the Windows 10 and included in the Windows ADK
806(Windows Kits 10)
807â–  More Info You can find more information on the WinPE: Create USB Bootable drive
808TechNet page: https://technet.microsoft.com/ library/hh825109.aspx
809After you have installed the ADK for Windows 10, you can create a bootable WinPE
810USB flash drive by following these instructions:
8111. Launch the Deployment and Imaging Tools Environment.
8122. At the Deployment and Imaging Tools Environment
813command prompt, type copype.cmd x86 c:\winpe_x86 .
8143. Install Windows PE onto the USB flash drive, specifying
815the appropriate drive letter using the following command:
816MakeWinPEMedia /UFD C:\WinPE_x86 G: .
817You should now be able to boot to the USB flash drive, and Windows PE should load
818the command window.
819â–  Note The Makewinpemedia command-line tool is new for Windows 8 and later. The tool
820simplifies the creation of bootable Windows Preinstallation Environment (Windows PE) media.
821Deployment Image Servicing and Management
822The Deployment Image Servicing and Management (DISM) command-line tool offers
823administrators new functionality to prepare, service, and manage Windows images.
824DISM has consolidated and improved many existing or deprecated tools, such as ImageX,
825that are used when working with WIM files. DISM replaces PEimg, Intlcfg, and Package
826Manager, which were distributed with the Windows OEM Preinstallation Kit (Windows
827OPK) for Windows 7.
82818CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
829DISM can be used install, uninstall, configure, and update Windows features,
830packages, drivers, and international settings within offline Windows image ( .wim ) files or
831virtual hard disks (VHD).
832Some of the DISM servicing commands can also be used to service an online
833operating system.
834In addition to being available as part of the ADK, DISM is installed on Windows 8.1
835and later and can be used to service the following Windows environments:
836• Windows 10, Windows 8.1, Windows 8, Windows 7
837• Windows Server 2012 R2, Windows Server 2012
838• Windows Server 2008 R2, Windows Server 2008 SP2
839• Windows PE 10.0, Windows PE 5.0, Windows PE 4.0 and Windows
840PE 3.0
841In addition to the command-line tool, there are over 20 DISM cmdlets available in
842the DISM PowerShell module.
843â–  More Info You can find more information on the DISM-Deployment Image Servicing
844and Management Technical Reference for Windows TechNet page: https://technet.
845microsoft.com/library/hh824821.aspx
846Windows Imaging and Configuration Designer
847The Windows Imaging and Configuration Designer (ICD) is a new feature available in
848the ADK for Windows 10. In Chapter 4 you will learn how to use enterprise tools such
849as Microsoft Deployment Toolkit (MDT) , which allows you to customize nearly every
850component of Windows and its deployment within a large organization. The ICD allows
851you to provision components, updates, and apps onto an online (running) or offline
852Windows 10 system without the need to reimage the device or use an enterprise tool such
853as MDT or System Center Configuration Manager ( SCCM ) .
854The ICD allows you to perform the following tasks:
855• Create a provisioning package that can be used to update or
856modify devices without fully reimaging them
857• Customize an existing Windows 10 image to be used for specific
858purposes or locations, such as installing language packs or apps
859• Works with both online and offline images
860The ability to deploy a provisioning package rather than needing to deploy the
861entire Windows image allows the more efficient use of network bandwidth and results in
862quicker deployments and more flexible provisioning without the investment of learning
863complex tools such as MDT or SCCM.
86419CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
865The packages (with a .ppkg file extension) can configure single or multiple
866configurations.
867Examples of scenarios when you could use provisioning packages include:
868• Installing or uninstalling applications, including traditional apps
869and modern apps
870• Adding or enrolling certificates; for example, to join a secure
871wireless network
872• Enrolling a device in corporate mobile device management
873(MDM) policies
874• Upgrading Windows
875• Configuration of bring your own device (BYOD) with corporate
876features such as Work Folders
877Once you have installed the ADK for Windows 10, you can review the available
878settings and create a new provisioning package using the following steps:
87920
8801. From the Start Menu, click “All apps” and open Windows Kits,
881then select Windows Imaging and Configuration Designer.
8822. In the Windows Imaging and Configuration Designer screen
883click “New provisioning package.”
8843. On the New Project screen, provide a project name, project
885folder, and option description and click Next.
8864. On the New Project screen, click Next and then click Finish.
8875. On the Available Customizations screen, expand and review
888the two nodes: Deployment Assets and Runtime Settings.
8896. Under the Available Customizations, expand Runtime Settings
890and navigate to the ConnectivityProfiles\WiFiSense node, as
891shown in Figure  1-8 .
8927. Disable the WiFiSenseAllowed option. The setting is shown in
893the Selected Customizations section on the right pane.
8948. You can add more settings to the provisioning package as
895required. Once finished, click Save on the File menu.
8969. Explore the options on the menu to export or deploy the
897provisioning package.package
898CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
89921CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
900If you export the customization , the ICD tool will generate a file with a provisioning
901package ( .ppkg ) file extension, which can be distributed the system that requires the
902package. You can deploy directly within the ICD to a USB drive or a removable drive, or
903export the provisioning package, which can then be made available across the network or
904issued as an email attachment.
905The provisioning package includes two files, a .ppkg file and a digitally signed catalog
906file ( .cat ). Both files must be present when the package is distributed and installed.
907â–  Note ICD packages can be configured to apply to Windows desktop or mobile editions,
908Windows 10 IoT Core devices, or all Windows editions.
909Upon receipt of the two files, the user will launch the .ppkg file and provide
910administrative credentials. After the confirmation prompt shown in Figure  1-9 , the
911provisioning package will silently install.
912Figure 1-9. Installing a provisioning package created with the ICD
913■ More Info You can learn more about the new ICD with the “Getting Started with
914Windows ICD” guide here: https://msdn.microsoft.com/ library/windows/hardware/
915dn916112%28v=vs.85%29.aspx
916If you want to script the provisioning of packages, you should use the Windows ICD
917( icd.exe ) command-line tool.
91822CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
919Windows Assessment Toolkit
920The Windows Assessment Toolkit allows you to test, monitor, diagnose, and report on
921Windows with regard to performance, reliability, and functionality. You can also focus the
922assessment on single or multiple sets of components.
923This is useful when evaluating why a driver or app is not functioning properly. The
924Windows Assessment Toolkit is highly regarded as a very accurate testing tool, and it is
925typically used by the helpdesk, OEMs, and ISVs and can be installed on Windows 8 and
926later.
927The toolkit includes three components:
928• Windows Assessment Console
929• Assessments
930• Assessment Platform
931By using the Windows Assessment Toolkit, you can configure and then run
932performance assessments within the GUI console on a variety of system components,
933such as battery life, browsing experience, and hardware performance. Each assessment
934can run for between five minutes and several hours and consists of various preconfigured
935performance jobs that can be created, run, viewed, and managed within the tool and be
936run together on the device under testing. The Windows Assessment Console displaying
937the battery life during connected standby assessment is shown in Figure  1-10 .
93823Console
939CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
94024CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
941After the tests have been performed, the results obtained can include diagnostics
942and remediation information, which are useful when determining areas that need
943additional investigation or changes to the system.
944Once jobs have been created in the Windows Assessment Console, you can use the
945command line to run jobs using the axe.exe command-line tool. Using this tool will give
946you the following benefits:
947• There is reduced system overhead through not using the GUI.
948• There is less impact on performance metrics.
949• Running a job at the command prompt uses fewer resources and
950has less impact on performance metrics.
951• You can automate a job using axe.exe .
952• Additional options and parameters are available when using
953axe.exe .
954â–  More Info You can learn more about the new Windows Assessment Toolkit with
955the “Windows Assessment Toolkit” guide here: https://msdn.microsoft.com/en-gb/
956library/windows/hardware/dn923543(v=vs.85).aspx
957Windows Performance Toolkit
958The Windows Performance Toolkit includes several low-level tools that will record and
959analyze issues on your Windows system. The Windows Performance Toolkit consists of
960two tools:
961• Windows Performance Analyzer (WPA)
962• Windows Performance Recorder (WPR)
963The WPA uses results from the WPR and Windows Assessment Console and presents
964them as graphs and tables, allowing you to analyze system and application performance.
965You would first run the WPR to capture trace information on performance criteria,
966which you can select on your system. You can select discrete components, such as file I/O
967activity and CPU usage, or use preset scenarios that can detect glitches with audio, video,
968the Edge browser, and more. Once you have allowed the tool to record and save the data,
969you then load the data into the WPA to analyze the results and display them, as shown in
970Figure  1-11 .
97125Windows
972CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
97326CHAPTER 1 â–  AN INTRODUCTION TO WINDOWS INSTALLATION METHODOLOGIES AND TOOLS
974Both WPA and WPR are advanced-level tools that can be used by members of
975helpdesk support, developers, and independent software vendors (ISVs) to assist in
976troubleshooting hardware, Windows components, and application-performance issues.
977â–  More Info You can learn more about the new Windows Performance Toolkit with the
978“What’s New in the Windows Performance Toolkit” guide here: https://msdn.microsoft.
979com/library/windows/hardware/dn927303(v=vs.85).aspx
980Summary
981Schools, colleges, and enterprises are examples of organizations that need to deploy and
982manage a large number of desktops, laptops, and tablets. As Windows continues to grow
983in functionality, the underlying components contained in the operating system create
984more complexity when administrators need to deploy and maintain Windows.
985We have seen that Microsoft effectively reinvented the method of Windows
986deployment with the release of Windows Vista, and the tools have continued to evolve.
987In this chapter you have seen that there are many tools and utilities that are available and
988that require careful attention; otherwise, your deployment may not go as planned.
989With the introduction of the topics in this chapter, you should have a firm foundation
990on which the remaining chapters will build. We will focus on installing Windows locally in
991the next chapter.
99227CHAPTER 2
993Installing Windows Locally
994The majority of PCs already have Windows preinstalled when you purchase them. Most
995users will never need to install Windows and will continue to use the same version of
996Windows for the whole lifetime of the device. Often OEMs configure their PCs with
997additional software, which can offer utilities and tools or trial versions of software, such as
998Office 2013.
999Within a business environment, the experience is the opposite of that of the
1000consumer. It is unlikely that the default installation is retained “as is,” and the IT team will
1001often replace the preinstalled version of Windows with a custom-built version that can be
1002deployed as a complete operating system, including the business applications, drivers,
1003and branding. This is often referred to as a Wipe and Load installation, and has been
1004commonplace for many years.
1005In addition to installing Windows onto a hard drive in your computer, you can now
1006install Windows directly into a virtual hard disk (VHD) and then provide the user the
1007ability to boot into a choice of operating systems, including booting to the version of
1008Windows installed into a VHD.
1009Virtualization allows the hosting of your operating system without worrying about
1010the HAL or device-specific drivers. It has allowed many IT pros to build virtual machines
1011as reference machines, which can then be sysprepped and deployed across the network.
1012Virtualization allows for quicker and simpler deployment and testing and is often used
1013within a corporate environment by the IT department.
1014In this chapter we will review the options and the tools used to install Windows
1015locally and troubleshoot installation issues that you may encounter.
1016Creating Windows Installation Media
1017(DVDs, USB, etc.)
1018We learned in Chapter 1 that installation media has evolved from floppy disks to CD-
1019ROMs and DVDs, and that it is quite rare to receive any physical media when you
1020purchase Windows nowadays. With Windows 7 it was possible to include multiple
1021versions of Windows on the same DVD because of the use of the new Windows Image
1022format ( WIM ).
1023© Chris Rhodes and Andrew Bettany 2016
1024C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
1025DOI 10.1007/978-1-4842-1827-3_2
102629CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1027If you are installing or reinstalling Windows 8.1 or Windows 10 and you do not have
1028the installation media available, you can use the Windows Installation Media Creation
1029Tool, shown in Figure  2-1 , which will create the installation media and download it
1030for you. This tool allows you to specify the language, edition, and architecture for the
1031installation file and allows you to choose to save the installation file either as an ISO file or
1032directly to a USB flash drive. You can download the tool from the following URL: https://
1033www.microsoft.com/en-gb/software-download/windows10 ( Windows 10 version).
1034Figure 2-1. Using the Windows Installation Media Creation Tool
1035A consumer will purchase media from retail outlets, such as Best Buy or PC World.
1036Enterprises normally access media from the Volume Licensing Service Center (VLSC) , as
1037shown in Figure  2-2 , or download it from the Microsoft Developer Network (MSDN).
1038â–  Note
1039VLSC and MSDN Subscriptions: The MSDN subscription portal can be found at
1040https://msdn.microsoft.com/en-us/msdn-subscriptions-overview.aspx . The VLSC
1041can be found at https://www.microsoft.com/Licensing/servicecenter/default.aspx
104230Windows
1043CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
104431CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1045With an MSDN subscription , you are able to access over 11 terabytes of Microsoft
1046products that have been produced by Microsoft. In addition to software and license keys
1047to activate the software, MSDN also provides monthly Microsoft Azure cloud credit,
1048collaboration tools, training, and support.
1049An enterprise will typically download the ISO image of Windows and use this with
1050the volume license key allocated to the business as part of the VL subscription. Within
1051the VLSC you can only download ISO images, but in the MSDN you can download ISO or
1052VHD versions of Windows.
1053â–  Note The VHD file size is 7613 MB for the Windows 10 Enterprise (x64) VHD, compared
1054to the Windows 10 Enterprise (x64) ISO, which is 3757 MB in size.
1055You can use a VHD file directly with Hyper-V. However, you would mount an ISO
1056image directly within File Explorer to perform an upgrade, attach it as a virtual DVD to a
1057virtual machine, or burn it to removable media such as a DVD or USB thumb drive.
1058The easiest method of burning a Windows 7 or 8 image to a DVD or USB thumb drive is
1059to use the Windows USB/DVD Download Tool, which is available free. The tool allows you
1060to create a copy of your Windows 7 or Windows 8 ISO file on a USB thumb drive or a DVD ,
1061which is then bootable. Although not supported, this tool also works with Windows 10.
1062â–  Note The Windows USB/DVD Download Tool is no longer available from the Microsoft
1063Store but can be downloaded from http://wudt.codeplex.com/ . You need to make sure
1064that your USB stick is large enough to accommodate the Windows installation files, so it is
1065recommended that you use a drive that is at least 8 GB in size. To create a bootable USB
1066drive containing the Windows 10 installation files, perform the following steps:
106732
10681. Open the Windows 7 USB/DVD Download Tool.
10692. In Step 1, browse or type the name and path of your Windows
107010 ISO file and click Next.
10713. In Step 2, click USB device.
10724. In Step 3, insert your USB device and select the device in the
1073drop-down list, then click Begin Copying.
10745. Confirm your acceptance that the USB device will be erased to
1075allow the process to continue.
10766. In Step 4, the tool will format the drive and copy the files from
1077the ISO file to the device.
10787. Once completed, the tool will display the message “Backup
1079completed.” You can close the tool.CHAPTER 2 ■ INSTALLING WINDOWS LOCALLY
1080The USB device will be configured to be bootable and can now be used to install
1081Windows onto a bare metal computer or device. You may need to configure the computer
1082to boot the USB drive within the BIOS or UEFI settings, or select the drive from a BIOS
1083boot menu during boot up.
1084â–  Note F8 may not work: If you have a modern PC with a UEFI BIOS and a fast SSD drive,
1085Windows will boot so quickly that there is no time to interrupt the boot procedure with F8 or
1086Shift F8, or for the system to display “Press F2 for Setup.” On older PCs with a classic BIOS
1087and no SSD drive, pressing these keys might still work.
1088If you are unable to download or use the GUI tool , you can manually create a
1089bootable USB thumb drive using DiskPart, a command-line utility available in all modern
1090versions of Windows and also within the Windows PE.
1091To create a bootable USB flash drive , follow the following steps:
10921. Insert a USB flash drive into your computer.
10932. Open an elevated command prompt window.
10943. Type DiskPart .
10954. Type list disk and press Enter.
10965. All the disks on the computer should be displayed. Note the
1097drive number or drive letter of the USB flash drive.
10986. Type select disk <X> , where X is the drive number of your
1099USB flash drive, and then press Enter.
11007. Type clean , and the press Enter. This command deletes all
1101data from the USB flash drive.
11028. Type create part pri and press Enter. This creates a new
1103primary partition on the USB flash drive.
11049. Type select part 1 and then press Enter. This selects the
1105partition that you just created.
110610. To format the partition, type format fs=ntfs quick and then
1107press Enter.
110811. Type active and then press Enter. This allocates a drive letter
1109to the drive.
111012. Type exit and then press Enter to exit the DiskPart utility.
111113. You can now extract all of the files in the ISO image to the root
1112of the USB flash drive.
111333CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1114â–  Note UEFI does not support booting to NTFS USB drives. If your system uses Unified
1115Extensible Firmware Interface (UEFI), you should format the drive as FAT32 rather than as
1116NTFS. To format the partition as FAT32, type format fs=fat32 quick and then press Enter.
1117The Basic Input/Output System (BIOS) used to configure and initialize hardware
1118during the booting process has been largely unchanged since the mid-1970s and offers
1119very little protection against modern malware attacks. Unified Extensible Firmware
1120Interface (UEFI) is the successor of BIOS and offers IT administrators significant security
1121enhancements that protect the system from attacks on pre-boot vulnerabilities, such as
1122rootkit infection. As we learned in Chapter 1 , UEFI also provides) an abstraction layer,
1123which allows the interface to be independent of the processor architecture.
1124Deploying Windows 7 and earlier editions onto a UEFI system could prove
1125challenging, as initially there was no support for UEFI on 32-bit Windows 7. 64-bit
1126versions of Windows supported UEFI, and Windows 8 offered optimizations that allowed
1127systems to benefit from Secure Boot and faster boot times. Early versions of UEFI caused
1128some compatibility issues with Secure Boot and certificates. Today, most computers
1129are shipped with the UEFI 2.4 specification, which was finalized in April 2013 and offers
1130improved compatibility and enhanced the UEFI 2.31 version.
1131Performing a Clean Installation of Windows
1132Now that you have created your installation media, you can perform a clean installation
1133of Windows. You should configure your BIOS or UEFI to allow you to boot to your
1134installation media, such as a USB drive. This can be achieved by modifying the BIOS
1135setting or choosing a custom boot order during the boot process. Check your options
1136onscreen during booting and select the appropriate key.
1137Typically, the preboot BIOS or UEFI options will offer you the ability to change the
1138boot priority order. You should consult your motherboard manufacturer to confirm how
1139to modify your boot menu. Keys such as DEL, F2, and ESC are often used to invoke setup
1140or the boot menu. An example of the boot priority order listing is as follows:
114134
1142• Hard drive
1143• USB hard drive
1144• CD/DVD
1145• USB CD/DVD
1146• USB floppy
1147• NetworkCHAPTER 2 ■ INSTALLING WINDOWS LOCALLY
1148â–  Note If you are performing a clean installation of Windows, you should consider
1149checking whether there is a motherboard firmware upgrade available. Firmware upgrades
1150once Windows is installed can cause activation issues. Check the website of your
1151motherboard manufacturer for available upgrades and instructions.
1152If you already have an existing Windows installation, the boot process will detect this
1153and ask if you want to boot to the installation media. At this point, you should press any
1154key to allow the PC to load the setup files rather than boot to the existing installation.
1155You should check that your computer will meet the minimum hardware
1156requirements for the operating system. Table  2-1 shows the minimum hardware
1157requirements for Windows 8.1 and 10.
1158Table 2-1. Minimum Hardware Requirements
1159Hardware Component Windows 8/8.1 Windows 10
1160Processor 1 gigahertz (GHz) or faster
1161with support for Physical
1162Address Extension (PAE), No-
1163eXecute (NX), and Streaming
1164SIMD Extensions 2 (SSE2) Same as Windows 8/8.1
1165(1 gigahertz (GHz) or
1166faster processor), or
1167system on chip (SoC)
1168RAM 1 gigabyte (GB) (32-bit) or 2 GB (64-bit)
1169Hard disk space 16 GB (32-bit) or 20 GB (64-bit) Graphics card Microsoft DirectX 9 graphics device or later with
1170Windows Display Driver Model (WDDM) 1.0 or newer
1171If you are unsure whether your processor supports NX or SSE2, you can use a
1172Windows Sysinternals tool called Coreinfo, a command-line tool that will create an
1173output of your system CPU and memory topology, as shown in Figure  2-3 .
117435CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1175Figure 2-3. Using Coreinfo to check processor feature compatability
1176â–  More Info You can download Coreinfo v3.31 from https://technet.microsoft.com/
1177en-us/sysinternals/cc835722
1178There are several ways in which a clean installation of Windows can be performed,
1179as shown in Table  2-2 .
118036CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1181Table 2-2. Windows Installation Methods
1182Installation Method Description
1183Install from DVD You can use the installation media provided with a
1184retail copy of the operating system, or you can burn an
1185installation media obtained from MVLS or MSDN to
1186optical media. This installation method is the slowest
1187method.
1188Install from USB Used to install on one computer at a time. Installation
1189from a USB device is quicker than using a DVD. You
1190must modify BIOS or UEFI settings to allow booting
1191from USB.
1192Install from Windows
1193Deployment Server (DS) Requires Windows DS and Dynamic Host
1194Configuration Protocol (DHCP) on a Windows-based
1195server on the network. Target computer network
1196card must support Pre-Boot Execution Environment
1197(PXE). Windows DS allows the automated installation
1198of system images and the deployment of Windows to
1199multiple computers simultaneously using multicast.
1200Install an image from
1201Windows Preinstallation
1202Environment (PE) Boot the device using Windows Preinstallation
1203Environment (PE) and then use one of the following
1204deployment options:
1205Use Deployment Image Servicing and Management
1206(DISM) to apply the Windows image
1207Use the Microsoft Deployment Toolkit (MDT)
1208deployment solution
1209Use the System Center 2012 R2 Configuration Manager
1210(SCCM) deployment solution
1211Both MDT and SCCM are enterprise-level solutions
1212that allow you to deploy Windows to hundreds or
1213thousands of devices at once and allow you to configure
1214lite-touch installation (LTI) and zero-touch installation
1215(ZTI), which allow either minimal user interaction or
1216no user interaction during the deployment.
1217Install over the network Start the computer by using Windows PE and connect
1218to a copy of the installation files stored on a shared
1219network folder. You would use this method when you
1220are unable to utilize a USB device, Windows DS, MDT,
1221or Configuration Manager.
122237CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1223During a clean installation on a new hard drive, you should perform the following
1224steps to install Windows 8.1:
12251. Insert the installation media that contains Windows 8.1 and
1226boot the computer to load it.
12272. When the Windows Setup screen appears, choose the
1228appropriate regional settings, then click Next.
12293. In the Windows Setup window, click Install.
12304. On the License Terms page, select the “I accept the license
1231terms” checkbox and then click Next.
12325. On the Which Type of Installation Do You Want? page, click
1233Custom: Install Windows Only (advanced).
12346. On the Where Do You Want to Install Windows? page, click
1235Next.
1236Windows will now install and the following stages will be performed:
1237• Copying Windows files
1238• Getting files ready for installation
1239• Installing features
1240• Installing updates
1241• Finishing up
1242Depending on your hardware performance , Windows should complete the process
1243within 15 to 20 minutes, and the machine will reboot several times. Once Windows
1244has completed the installation, you will be presented with the Personalize and then
1245the Settings welcome pages in Windows 8.1, or the Get Going Fast page if you install
1246Windows 10.
1247â–  Note If you are installing Windows on a machine that already has an operating system
1248installed, you will need to erase the partition that you intend to install Windows on, and
1249therefore you must ensure that all data and settings that you want to retain are backed up
1250prior to deleting the partition.
1251If the Windows installation fails to complete, you should consider the following
1252issues and possible remedies:
125338
1254• Corrupt ISO image – download a new ISO image
1255• Faulty installation media, such as a corrupt DVD – try burning the
1256DVD at a slower speed
1257• Drive controller issues – update the firmwareCHAPTER 2 ■ INSTALLING WINDOWS LOCALLY
1258• Drive corruption – fix drive errors or replace the drive
1259• RAM memory errors – click the “Repair your computer” link and
1260run the built-in Memory Diagnostics tool
1261• Motherboard firmware corruption or incompatibility – update the
1262firmware
1263When faced with installation failure issues you should troubleshoot the problem to
1264find the cause and then replace the corruption or failed component. You can also use the
1265Startup Repair recovery tool if there is an issue or corruption with the boot process once
1266Windows has been installed.
1267Migrating to a New Version of Windows ( USMT ,
1268Easy Transfer)
1269Windows allows users and system administrators to migrate the user state, which
1270contains the data and settings, from one computer and apply them to another computer.
1271This is especially advantageous when you have many customized settings and files that
1272are stored locally on the source computer.
1273You must first decide which type of migration scenario you are using, as follows:
1274• Side-by-side migration – This method migrates the information
1275from the source computer and applies it to the new computer.
1276The migration files can be stored in an intermediate store on
1277another computer, such as a file server on the network.
1278• In-place migration – In this scenario the source computer is
1279refreshed with the new operating system and the user state
1280from the original operating system is then applied to the new
1281installation. This is also known as a wipe-and-load or refresh
1282scenario.
1283Both of the migration scenarios require a clean installation of Windows.
1284A migration provides the user with a clean installation, which can be used to provide
1285a newer operating system to the user while retaining most if not all of the customized
1286Windows and application settings. By offering a clean install, all previous files and any
1287potential harmful malware or obsolete file “clutter” on the computer will be removed,
1288which can enhance the performance and productivity of the device.
1289In an upgrade operation all of the user files, settings, and applications are retained,
1290which is beneficial to the end user because the loss of productivity is minimized. With
1291a clean installation and migration scenario, the process is more complicated and could
1292be more time consuming, because a migration will typically require the reinstallation of
1293applications and the reconfiguration of applications and settings.
129439CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1295Microsoft provides two tools for you to use when performing a migration, as follows:
1296• Windows Easy Transfer (WET) – This is a GUI tool that can be
1297used with Windows 7 or Windows 8 (it is not available with
1298Windows 10). The WET tool is built into Windows and can found
1299by searching for Windows Easy Transfer on the Start screen. WET
1300can also be installed onto a down-level operating system, such as
1301Windows 7, from the Windows 8 installation media. For Windows
13028.1, you can still use WET to import settings but not to export
1303them.
1304• User State Migration Tool (USMT) – This is useful for larger
1305projects and is a command-line scriptable tool that can be used
1306with all versions of Windows. The USMT is part of the Windows
1307Assessment and Deployment Kit (ADK) for Windows 10; more
1308information about the Windows ADK can be found at https://
1309msdn.microsoft.com/en-us/windows/hardware/dn913721.aspx?
1310f=255&MSPPError=-2147217396
1311You will learn about advanced deployment tools later in this book, and you should
1312know that when you use the Microsoft Deployment Toolkit (MDT), USMT is integrated
1313into MDT and can be used as part of the deployment and migration process.
1314USMT uses three command-line tools, with the ScanState and LoadState tools being
1315the most important:
1316• ScanState.exe – for performing the user-state backup
1317• LoadState.exe – for performing the user-state restore
1318• UsmtUtils.exe – adds support for directory and cryptographic
1319options and for your migration
1320USMT supports migrating from a 32-bit architecture to a 64-bit operating system. For
1321example, you can use USMT to migrate from Windows 7 x86 to Windows 10 x64.
1322USMT will migrate data contained in the user profile and also settings contained
1323in Control Panel configurations and file types. The configuration settings are stored
1324in templates that are used by USMT. For Windows 10 deployments, the two default
1325templates are MigUser.xml and MigApp.xml , which will migrate the following data and
1326settings:
132740
1328• Folders from each profile, including user profiles and shared and
1329public profiles (including My Documents, My Video, My Music,
1330My Pictures, desktop files, Start menu, Quick Launch settings, and
1331Favorites folders)
1332• Specific file types
1333• Operating system component settings
1334• Application settingsCHAPTER 2 ■ INSTALLING WINDOWS LOCALLY
1335The overview steps that need to be performed in any migration scenario include the
1336following:
13371. Back up your computer.
13382. Save user settings and data for migration (WET or ScanState.exe ).
13393. Install Windows using a clean installation.
13404. Reinstall applications.
13415. Restore user settings and data (WET or LoadState.exe ).
1342â–  Note Once the migration data and settings have been captured using ScanState.exe ,
1343it is important that any applications you want the retained settings applied to are installed
1344onto the new computer prior to using LoadState.exe .
1345There are many third-party migration tools that offer enhanced functionality when
1346performing migrations; for example, some of the following tools offer the ability to rejoin
1347computers to the domain, allow push migrations, and provide GUI support for migrating
1348to Windows 10. Some tools available are listed in Table  2-3 . These tools often allow a free
1349trial version, but if you want to use them in a professional environment you will need to
1350purchase the appropriate license.
1351Table 2-3. Some Thied-Party Migration Tools ( Paid )
1352Tool URL Description
1353User Profile Wizard http://www.forensit.
1354com/domain-migration.
1355html Offers user profile migrations,
1356including domain join and VPN
1357capability
1358Zinstall Easy
1359Transfer http://www.zinstall.
1360com/products/zinstall-
1361easy-transfer GUI tool that migrates files and
1362settings. Works with Windows XP,
1363Vista, 7, 8, and 10
1364Zinstall WinWin http://www.zinstall.
1365com/products/zinstall-
1366winwin GUI tool that migrates applications
1367in addition to files and settings.
1368Works with Windows XP, Vista, 7, 8,
1369and 10
1370CloneApp http://www.mirinsoft.
1371com/ Creates a backup of your app settings
1372from the Windows directories and
1373the Registry, which can then be
1374reinstated on the new machine
1375PCmover http://www.laplink.com GUI tool that migrates applications,
1376files, and settings; works with
1377Windows XP, Vista, 7, and 8
137841CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1379Managing the Windows Boot Partitions and Files
1380The boot and system partitions are the volumes on a hard disk that Windows uses to start
1381and load the operating system. The terms are quite old and relate to the earliest days of
1382computing. Unfortunately, when you try to learn what each partition contains, it can be
1383confusing, and you may think Table  2-4 contains the wrong information.
1384Table 2-4. System and Boot Partition Contents
1385Partition Contents Notes
1386System Files required to boot Windows The Boot folder contains files
1387that start Windows, including
1388the Windows Boot Manager
1389( BootMgr ).
1390Only ever have one system
1391partition on a computer running
1392Windows.
1393The files found in the active
1394partition are used to determine
1395the operating system used to start
1396the computer.
1397Boot
1398Contains system files
1399The boot partition contains
1400Windows operating system files.
1401In a multiboot scenario, each
1402version of Windows will be stored
1403on a separate volume containing
1404the respective Windows operating
1405system files.
1406We will see later in this section that it is essential that you can identify the correct
1407partition, as you can cause the device to be unbootable if you mix the partitions.
1408There are several ways for you to identify which partition is the boot or system, such
1409as using PowerShell, Disk Management, and BCDEdit. We will use the Disk Management
1410snap-in to view this information using the following the steps:
141142
14121. Search for and open Disk Management.
14132. Expand the width of the Status column.
14143. You should now see the status of the partitions, and the drive
1415letters if provided.
14164. The system partition is indicated by (System) (no drive letter,
1417in our example).
14185. The boot partition is indicated by (Boot) (C: drive in our
1419example, as shown in Figure  2-4 ).CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1420Figure 2-4. Disk Management displaying boot and system partitions
1421To list the system partition using PowerShell, you can use the following cmdlet: Get-
1422Volume -FileSystemLabel "System Reserved"
1423The configuration parameters for loading Windows are stored in the Boot
1424Configuration Data (BCD) store. The primary tool for working with the actual boot
1425records is the command-line tool BCD Editor ( Bcdedit.exe ). Great care should be
1426exercised when modifying the boot records, as misconfiguration can lead to an unstable
1427or non-bootable device.
1428To view the contents of your boot configuration, use the following steps:
14291. Open an elevated command prompt or administrative
1430PowerShell console.
14312. Type BCDEdit /v and then press Enter.
14323. Review the output.
1433If you have a multiple -boot system, the output should be similar to the contents of
1434Figure  2-5 .
143543CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1436Figure 2-5. Using BCDEdit to view the boot configuration
1437In Figure  2-5 , you should see two sections: a Windows Boot Manager and a Windows
1438Boot Loader. The descriptions of the boot entries are shown as Windows 8.1 and
1439Microsoft Windows 10. Each operating system found in the boot configuration database
1440will have its own globally unique identifier ( GUID ). In the example shown in Figure  2-5 ,
1441the two GUIDs are as follows:
144244
1443• Windows 8.1: {37e47a93-6808-11e5-b2f0-83e8e58e54e8}
1444• Microsoft Windows 10: {37e47a8f-6808-11e5-b2f0-
144583e8e58e54e8}CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1446Note that there is a third entry for an Ubuntu installation, with the GUID of
1447{37e47a99-6808-11e5-b2f0-83e8e58e54e8} , but this entry has scrolled off the screen.
1448If you want to change the displayed name of the operating system setting, you can
1449use the following command:
1450BCDEdit /set {GUID} description “OS Name”
1451Substitute the GUID placeholder for the Windows Boot Loader identifier (GUID)
1452found in the Windows Boot Loader entry that you want to change.
1453â–  Note If you have multiple boot sectors, these will be listed using the BCDEdit tool. For
1454non-Windows entries, this will be listed with a section heading named “Real-mode Boot
1455Sector.”
1456Multi-Booting Windows
1457Multi-booting a computer allows you to install multiple operating systems on the same
1458computer. You may want to run Windows 7 as your main business operating system and
1459also use Windows 10 for home use or testing while you evaluate it or become comfortable
1460with the new operating system.
1461Multi-booting Windows can be useful in certain specialist cases, such when users
1462share a device and each user requires a different operating system. The main reasons for
1463using a dual-boot configuration are as follows:
1464• Testing a new operating system – This is the most common use
1465for a multi-boot configuration. New operating systems, especially
1466when in the beta or preview phase, are often incomplete or
1467contract bugs or compatibility issues with hardware and software.
1468By multi-booting the new OS and test driving it on the physical
1469hardware, you can evaluate to see if it is compatible with your
1470existing hardware while retaining the full functionality of the
1471device, which can be booted back to the original operating
1472system.
1473• Testing application compatibility – Often your current or legacy
1474applications may not be compatible with a new operating system.
1475Issues with compatibility can force you to delay or even to not
1476upgrade your version of Windows. You should therefore establish
1477a system of testing the application compatibility as soon as
1478possible and report problems to your own development team or
1479the independent software vendor (ISV) so that they can begin to
1480resolve issues early.
148145CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1482•
1483Multiple users – A multi-boot situation can allow one computer
1484to be used with multiple users, with either the same operating
1485system version or different versions installed. Example usage
1486cases include shift workers working at different times of the day
1487on a single PC, users requiring specialist or legacy applications
1488that rely on an older operating system, or software requiring
1489access to older hardware or peripherals. Of course, there are other
1490more modern methods of sharing a PC among multiple users,
1491such as using different user accounts.
1492We will cover the use of Hyper-V and booting to VHD — which offer users modern
1493alternatives to multi booting — later in this chapter, but we should appreciate that there are
1494numerous users who are very much still operating a multi-boot scenario, either at home
1495or in a business environment.
1496The process for creating a multi-boot environment must start with proper planning
1497and precautions. You should ensure that you either have a full backup of your computer
1498or use a test lab to perform the operation.
1499To multi-boot Windows with any other operating system, you should first install the
1500newest version of Windows that is available on the computer.
1501In order to keep the two operating systems logically separate, you need to have at
1502least two partitions on your computer. If you do not have a spare partition, you may need
1503to create one, and that could involve shrinking your current operating system partition to
1504free up space. This is performed using a third-party tool, or by using built-in tools such as
1505DiskPart or Disk Management. To use Disk Management to create a second partition on
1506which to install Windows in a multi-boot environment, follow these steps:
150746
15081. Type diskmgmt.msc into the Search box or Run command and
1509then press Enter.
15102. Locate the primary partition, which is marked as (Boot, Page
1511File, Crash Dump, Primary Partition) and is normally
1512your C: drive.
15133. Right click the C: drive and select Shrink Volume.
15144. In the Shrink C: dialog box, enter the size in MB that you want
1515to shrink the drive, such as 40960 MB, as shown in Figure  2-6 ,
1516and click Shrink.
15175. The 40.00 GB partition will be formatted by the Windows
1518installation program. Close Disk Management.2-6.
1519CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
152047CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1521The next stage in creating a dual-boot environment is to install the second operating
1522system onto the newly created partition, as follows:
152348
15241. Insert your installation media, such as a DVD or bootable USB
1525drive.
15262. Reboot your system and press any key when the system
1527detects the bootable USB drive or DVD.
15283. After the setup program loads, proceed with the setup as for
1529a clean installation and select the newly created Unallocated
1530Space (the 40.0 GB drive in the preceding example) as the
1531location in which to install Windows, then click Next.
15324. Allow the Windows installation to complete and then
1533configure the additional version of Windows.
15345. To switch between the two operating systems, you will need
1535to reboot your system and choose the desired version of
1536Windows in the boot menu.
15376. On the Choose an Operating System boot menu, if you click
1538the “Change defaults or choose other options” link you will be
1539presented with the Options screen, as shown in Figure  2-7 .
15407. In the Options menu you can choose how long the onscreen
1541prompt will be visible and which operating system you want
1542to boot by default, and also access repair tools.menu
1543CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
154449CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1545If you can’t live without using the F8 key to bring up the Advanced Options menu,
1546which is disabled in Windows 8 and newer (though it is still present in Windows Server
15472012 and newer), you can modify the boot manager to revert to the legacy (F8) setting as
1548follows:
15491. Launch an administrative command prompt.
15502. Type BCDEdit /set {default} bootmenupolicy legacy and
1551press Enter.
15523. Reboot your system.
15534. Try to press F8 during booting; the Advanced Options menu
1554should now appear.
15555. To reset the system to the default, repeat Step 1 and type
1556BCDEdit /set {default} bootmenupolicy standard .
1557There are many third-party tools that can be used to simplify the process of
1558dual-booting Windows. Often the vendor will allow a free trial to evaluate the tool; for
1559enterprise usage you should purchase the applicable license. Some of these tools are
1560listed in Table  2-5 .
1561Table 2-5. Some Third-Party Dual-Boot Tools
1562Tool URL Description
1563Acronis Disk Director 12 http://www.acronis.com/
1564en-us/personal/disk-
1565manager/ Create and manage disk
1566partitions to store different
1567file systems or operating
1568systems on one disk
1569EasyBCD http://neosmart.net/
1570EasyBCD/ Provides GUI tool to dual-
1571boot Windows, Linux, Mac,
1572and Unix. Boot from and
1573into USB drives, ISO images,
1574virtual disks, and more.
1575Windows 10 compatible
1576BootIt Bare Metal http://www.
1577terabyteunlimited.com/
1578bootit-bare-metal.htm Manage your partitions;
1579install and boot multiple
1580operating systems
1581DualBootPRO http://www.dualbootpro.
1582org/ Allows manipulation
1583and editing of the Boot
1584Configuration Data (BCD)
1585store and includes built-in
1586diagnostics to help find and
1587correct errors in the BCD
1588store
158950CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1590Installing a Non-Windows OS, Such as Linux/MAC
1591Linux can run from just a USB drive without your configuring your system. If you plan to
1592use Linux often you can install it on your PC alongside Windows as a “multi-boot,” which
1593will give you a choice of either operating system each time you boot your PC.
1594To multi-boot with Windows and Linux, you must install Linux on your PC after
1595Windows has already been installed. First, you need to download the version of Linux that
1596you want to install. In the following example I have used Ubuntu LTS, which requires 1006
1597MB and can be downloaded as an ISO from http://www.ubuntu.com/download/desktop .
1598â–  Note Windows should always be installed first. If you install Windows after Linux,
1599Windows will ignore the Linux installation and will overwrite the Linux boot loader with the
1600Windows version. Always install Windows first and then Linux.
1601With a modern version of Linux, the process of setting up dual booting is quite
1602straightforward and painless. The steps are as follows:
16031. Boot your Windows PC to a USB drive or DVD containing your
1604Linux distribution.
16052. At the GNU GRUB screen select Install Ubuntu.
16063. Choose the option to install Ubuntu alongside Windows, as
1607shown in Figure  2-8 , and do not choose the option that will
1608overwrite your Windows system with Linux.
16094. Allow Ubuntu to install.
161051alongside
1611CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
161252CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1613Once Ubuntu has been installed, you can select Linux or Windows from the boot
1614menu by using the arrow keys and the Enter key.
1615If you want to view your files stored on a Windows partition, most Linux distributions
1616allow you access in your Linux desktop file manager. Windows does not natively provide
1617easy access to the Linux ext4 file system, however. You can install a third-party file-
1618explorer driver that supports ext4 file systems on your Windows machine if you require
1619that functionality.
1620Examples of Windows file-system drivers that support Linux file systems include
1621Ext2Fsd, Linux Reader from DiskInternals, and Ext2explore.
1622If you encounter problems with the boot loader or Linux not appearing in your boot
1623menu, you can try one of the following troubleshooting options:
1624• Boot to a Windows Recovery environment and choose “start up
1625repair,” or type Bootrec.exe /fixmbr into an elevated command
1626prompt.
1627• Use the EasyBCD third-party tool to create a Linux entry in your
1628boot menu.
1629• Use the Ubuntu live-CD, live-USB, or Ubuntu installation media
1630and boot to Linux, then download and install the Boot-Repair tool
1631within Ubuntu.
1632• If you are using Hyper-V, modify the boot order within the firmware
1633settings to prioritize booting the shimx64.efi boot loader.
1634VHD Boot
1635If you are not confident with dual booting, or if you would like to run another operating
1636system within a virtual hard disk (VHD) , you can using VHD Boot. VHD Boot is still
1637relatively new and is thought of as being quite specialist. Instead of installing the
1638operating system directly onto the physical hard drive, you prepare a virtual hard drive
1639first and then install the operating system directly onto this, fooling Windows into
1640thinking it is a normal drive during the installation process.
1641To create a VHD and configure it so that you can install Windows, you should follow
1642these steps:
16431. Type diskmgmt.msc into the search area or right click the Start
1644button and click Disk Management.
16452. In Disk Management click Action, then click Create VHD.
16463. On the Create and Attach Virtual Hard Disk dialog box,
1647provide the parameters for your VHD. An example VHD
1648would be:
1649a. Location: C:\VHD\Windows10vhd.vhd
1650b. Virtual hard disk size: 40 GB
1651c. Virtual hard disk format: VHD
1652d. Virtual hard disk type: Fixed size
165353CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
16544. Click OK to create your VHD. Because we selected fixed
1655type, this may take several minutes to complete, and you
1656will see the creation progress in the bottom right of the Disk
1657Management dialog box.
16585. Once created, your new VHD should automatically be
1659attached to the system, but if not, use Disk Management to
1660attach the drive as follows: Click Action, then click Attach
1661VHD, browse to your new VHD, and choose the VHD to
1662attach.
16636. If you prefer to use the command line, you could also use
1664the DiskPart tool and type create vdisk file= C:\VHD\
1665Windows10vhd.vhd maximum=40960 type=fixed to achieve
1666the same result.
16677. Leave the VHD drive in the Not Initialized state; this will be
1668updated once Windows installs to it.
16698. You are now ready to install Windows into your VHD file.
1670To install Windows inside your VHD file, you should follow these steps:
167154
16721. Insert your Windows media (or ISO if you are using a Virtual
1673Machine) into your computer and boot from it.
16742. Follow the onscreen prompts, providing the appropriate
1675information until the Where Do You Want to Install Windows?
1676screen appears.
16773. Press Shift+F10, which will launch an administrative
1678command prompt window.
16794. In the administrative command prompt window type
1680DiskPart .
16815. In DiskPart, type List disk .
16826. Locate the VHD disk that you have created and type select
1683vdisk file=D:\VHD\Windows10vhd.vhd (notice the drive
1684letter has been changed).
16857. In DiskPart, type attach vdisk and press Enter.
16868. Type Exit to close DiskPart and then close the administrative
1687command prompt window.
16889. In the Where Do You Want to Install Windows? screen, click
1689Refresh, and your VHD disk should now appear.
169010. Select the VHD drive and allow Windows to install normally.
169111. Upon completion, after rebooting the machine, you should
1692see the ability to choose an operating system during boot
1693time, as shown in Figure  2-9 .operating
1694CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
169555CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1696Installing Windows in Hyper-V
1697Hyper-V has been available for several years and has improved steadily against its arch
1698rival VMware. One huge advantage for Microsoft in driving awareness (and adoption) is
1699that Hyper-V is bundled into the business editions of Windows 8 and later and offers you
1700a production-class virtualization tool.
1701Your hardware needs the following characteristics to support virtualization using
1702Hyper-V:
1703• Windows 8 Pro or Enterprise or newer
1704• 64-bit architecture
1705• 64-bit processor with Second Level Address Translation (SLAT)
1706• Minimum of 4 GB system RAM
1707• BIOS/UEFI-level hardware virtualization support
1708The ability to test and evaluate other operating systems within a sandboxed
1709virtualized environment is so much quicker (and easier) once you have an understanding
1710of virtualization and Hyper-V.
1711In this last section of this chapter, we will provide detailed steps for you to follow to
1712install Windows 10 Enterprise Evaluation within a Hyper-V virtual machine, as follows:
17131. Download the Windows 10 Enterprise Evaluation ISO from
1714https://www.microsoft.com/en-us/evalcenter/evaluate-
1715windows-10-enterprise .
17162. Launch Programs and Features from the administrative menu
1717on the Start button.
17183. Click Turn Windows Features On or Off.
17194. Enable the Hyper-V feature by placing a tick next to Hyper-V,
1720as shown in Figure  2-10 .
1721Figure 2-10. Naming your Hyper-V virtual machine
172256CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
17235. Reboot Windows to complete the configuration of Hyper-V.
17246. Launch Hyper-V by typing Hyper-V into the Start menu or
1725searching for Hyper-V.
17267. To create a virtual machine, in the Actions pane click New >
1727Virtual Machine.
17288. On the Before You Begin screen, click Next.
17299. On the Specify Name and Location screen, enter the desired
1730name for the VM.
173110.
1732Modify the location to store the VM to be a location such as D\
1733VMs\ and click Next, as shown in Figure  2-11 .
1734Figure 2-11. Hyper-V virtual machine beginning Windows 10 installation
173511. On the Specify Generation screen, select Generation 1 and
1736click Next.
173712. On the Assign Memory screen, enter a memory size, such as
17382048 MB, ignore the Dynamic Memory option, and click Next.
173957CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
174058
174113. On the Configure Networking screen, select a suitable
1742network connection or select Not Connected and click Next.
174314. On the Connect Virtual Hard Disk page, select Create a Virtual
1744Hard Disk, leave the default 127 GB dynamically expanding
1745virtual hard disk settings, and click Next.
174615. On the Installation Options screen, select the Install an
1747Operating System from a Bootable CD/DVD-ROM option.
174816. Select the Windows 10 Enterprise Evaluation image file ( .iso )
1749downloaded in Step 1 and click Next.
175017. On the Completing the New Virtual Machine Wizard screen,
1751review the selected options and click Finish.
175218. Hyper-V will provision the virtual machine.
175319. In Hyper-V Manager, right click on the newly created virtual
1754machine and click Start.
175520. Right click or double click on your virtual machine and click
1756Connect to open the virtual machine.
175721. The virtual machine will begin to install Windows 10
1758Enterprise, as shown in Figure  2-12 , from the ISO file, which is
1759configured as a virtual DVD.2-12.
1760CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
176159CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1762You should familiarize yourself with Hyper-V, as virtualization is an excellent tool for
1763testing, troubleshooting, evaluating, sandboxing applications, deployment testing, and
1764many more operations.
1765Some of the many benefits of using virtualization in Hyper-V include the following:
1766• Released in 2008 – It is a mature and well-supported platform.
1767• Saves time – Physical devices, especially servers, take a long time
1768to provision, maintain, and update/patch, whereas virtualization
1769can speed up tasks with very fast virtual hardware.
1770• Speed of provisioning and decommissioning – Physical hardware
1771needs to be purchased, shipped, unboxed, and set up, whereas
1772virtual machines can be provisioned extremely quickly.
1773• Ease of repetitiveness – Tasks can be automated, repeated,
1774paused, copied, and exported.
1775• Secure and stable – Hyper-V utilizes a micro-kernelized
1776hypervisor, which allows device drivers and other components to
1777be stored in a compartmentalized fashion.
1778• Windows-based platform – The Hyper-V platform is Windows
1779based, which has a familiar MMC GUI and can also be completely
1780driven and managed by PowerShell.
1781Windows Activation Options (Retail, MAC,
1782KMS, AD BA)
1783Microsoft has used the activation of Windows to safeguard its own intellectual property
1784from piracy theft by proving that the user of the software has a valid software license.
1785Over the last 20 years, Microsoft has developed and introduced several different
1786methods of activating software. Some are evolutions over time, while others have been
1787available concurrently throughout this period in differing scenarios and for various types
1788of licensed customers.
1789The activation process requires external validation, which can be done via one of the
1790following validation services:
1791• online activation service at Microsoft
1792• by phone to an automated activation service at Microsoft
1793• through a Key Management Service
1794• through Active Directory Directory Services
1795Once the activation process has succeeded, the software key is then linked to the
1796specific hardware of the device. You should be aware that if your hardware significantly
1797changes, such as if you change the processor or add a new graphics card, the device may
1798“look” like it is different than the original, and you may need to reactivate the system with
1799Microsoft so that they can update the license record.
180060CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1801You should also be very careful when purchasing Windows outside of normal
1802corporate channels. Some editions do not offer you the same functionality; for example,
1803a Windows 8.1 DVD purchased in a big box store may not be able to join and connect to
1804a corporate network that uses a domain. As you can imagine, it would not be appropriate
1805or cost effective for a large organization with thousands of devices to purchase retail
1806versions of Windows. They are able to bulk purchase keys as part of a Volume Licensing
1807program that Microsoft operates. In most cases, a corporation will have a relationship
1808with a software asset and licensing management partner, who will provide the most
1809appropriate and cost-effective licensing for your business.
1810â–  More Info For more information relating to licensing and volume activation, visit
1811http://go.microsoft.com/fwlink/?LinkId=378217&clcid=0x409
1812There are six types of keys available, as shown in Table  2-6 .
1813Table 2-6. Types of Microsoft License Keys
1814Type of Key Description
1815Retail license key Software purchased at a retail store such
1816as Best Buy (standalone or bundled with
1817hardware) will contain one unique product
1818key supplied on a label inside the Windows
1819box. It can be used only once to activate the
1820bundled software on one device. Typically,
1821the Windows keys are 25 characters in length
1822and are similar to this: AVFD3-2FPPP-
1823ABY43-QR3VK-WT4CK. Some devices still
1824carry a sticker that contains the Certificate of
1825Authenticity (COA), which is attached to the
1826device.
1827Original equipment manufacturer (OEM ) The OEM purchases a bulk amount of keys
1828from Microsoft and allocates one key to each
1829piece of software or hardware device. These
1830keys are not transferrable away from the
1831OEM device.
1832Key Management Service (KMS) key
1833Part of the Microsoft Volume Licensing
1834program, requiring the Volume Activation
1835Services server role to be running on a
1836Windows Server 2012 or newer. Allows
1837Windows 7 and newer versions to activate
1838without needing to connect to Microsoft
1839activation servers.
1840KMS requires a minimum estate size of 25
1841client computers, or more than five servers
1842to use KMS activation.
1843(continued)
184461CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1845Table 2-6. (continued)
1846Type of Key Description
1847Active Directory – based activation Part of the Microsoft Volume Licensing
1848program , requiring the Volume Activation
1849Services server role to be running on a
1850Windows Server 2012 or newer. Allows
1851Windows 7 and newer versions to activate
1852without needing to connect to Microsoft
1853activation servers. Within a domain, this
1854method allows Active Directory Domain
1855Services (AD DS) to store the activation
1856status of devices, and the device remains
1857activated so long as it remains part of the
1858domain .
1859Multiple activation key (MAKs ) Obtained only as part of the Microsoft
1860Volume Licensing program. A fixed number
1861of activations can be made available to a
1862MAK key. Once the activation pool has been
1863depleted, no further device will be activated
1864unless the MAK key is reloaded.
1865Digital entitlement (hardware-based key) A new method introduced with Windows
186610 that allows the hardware itself to be
1867registered and effectively become the key.
1868This information is recorded by Microsoft
1869for licensing purposes so that if you need to
1870reinstall your device at a later date, there is
1871no need for license key entry. The computer
1872information could be obtained from the
1873system BIOS or UEFI configuration.
1874â–  Note The free Windows 10 license available from Microsoft until July 2016 can
1875be used when you are upgrading from a licensed version of Windows 7, 8, or 8.1. The
1876upgrade process registers on Microsoft’s activation servers a unique ID that is tied to your
1877PC’s hardware. Subsequent reinstalls of Windows 10 after July 2016 on the same PC will
1878automatically be activated. You can find more information about the “Get Windows 10”
1879promotion at the Microsoft Store here: http://www.microsoftstore.com/store/msusa/
1880en_US/pdp/Windows-10-Home/productID.319937100
188162CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1882To determine the status of a Windows 8.1 or later device, open a command prompt
1883and type the command shown in Figure  2-13 :
1884Cscript C:\windows\system32\slmgr.vbs –dli
1885Figure 2-13. Enable the Hyper-V feature in Windows 10
1886Some editions of Windows may be able to use one or more activation methods.
1887Table  2-7 shows the types of activation available for Windows 8.1 and Windows 10.
188863CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1889Table 2-7. Activation Options Available
1890Version of Windows Activation Method
1891Comments
1892Windows 8.1 Retail license key Windows 8.1 Pro Retail license key,
1893MAK key,
1894KMS keys Windows 8.1 Enterprise MAK key,
1895KMS keys Volume Licensing only
1896Windows 8.1 evaluation
1897edition (90 days) No key required Available as an ISO
1898image from MSDN
1899and Microsoft Partner
1900network
1901Windows 10 Enterprise
1902evaluation edition (90 days) Key not needed For recovery scenarios,
1903the following key is
1904provided: VTNMT-
19052FMYP-QCY43-QR9VK-
1906WTVCK
1907Windows 10 Home Digital Entitlement, retail
1908license key Digital Entitlement does
1909not require you to enter a
1910prod uct key.
1911Windows 10 Pro Digital Entitlement,
1912MAK key,
1913KMS keys Windows 10 Enterprise MAK key,
1914KMS keys Volume Licensing only
1915Windows 10 Education MAK key,
1916KMS keys Volume Licensing only
1917Evaluation editions of many current versions of Windows software are available at
1918https://www.microsoft.com/en-us/evalcenter .
1919â–  Note The version of Windows 10 (version 1511 or higher) can be activated using
1920selected Windows 7, 8, and 8.1 product keys. More information can be found here:
1921http://windows.microsoft.com/en-us/windows-10/activation-in-windows-10
192264CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1923The MAK method of activation is typically used in corporate scenarios where
1924the devices rarely or never connect to the corporate network. There are two types of
1925activation for MAK keys, as follows:
1926• Independent activation – Each device will connect to the
1927Microsoft activation servers (via the Internet or telephone) and
1928activate.
1929• MAK Proxy activation – This activates to a centralized
1930activation proxy device, which then connects to Microsoft. An
1931enterprise-level configuration tool called the Volume Activation
1932Management Tool (VAMT) is used to configure the MAK Proxy.
1933â–  Note Windows 10 and 8.1 do not have a grace period. You are encouraged to activate
1934Windows once installation has been completed, otherwise the user will be prevented from
1935customizing the device.
1936Troubleshooting Activation Issues
1937This list features several common issues relating to activation that you may encounter:
1938• Take care when employees purchase OEM or retail Windows
1939devices from computer stores, as sometimes a retail or OEM key
1940cannot be used to join a computer to a domain, and you will need
1941to upgrade the version of Windows to Pro or Enterprise with a
1942new key.
1943• If a device is initially activated and then deployed to a remote
1944worker, you should take care not to use a KMS key unless you
1945expect the user to connect the device to the corporate network at
1946least once in every 180 days; otherwise, the device will fall out of
1947activation.
1948• If you use KMS, you can allow computers to use RPCs over TCP/IP
1949using the default port of 1688 to connect to the KMS host. Ensure
1950that this port is configured in your firewall; otherwise, activation
1951may fail.
1952• Windows Server 2012 and newer are required to use AD-based
1953activation.
195465CHAPTER 2 â–  INSTALLING WINDOWS LOCALLY
1955• The AD DS schema must at least be at the Windows Server 2012
1956functional level to allow AD-based activation to operate.
1957• Once implemented once, AD-based activation is operational
1958forest wide.
1959• MAK keys can be used accidently or carelessly; tight control and
1960guidance of MAK Volume Licensing should be provided to ensure
1961wasted activations do not occur.
1962Summary
1963Often, consumers will purchase devices preinstalled with Windows by the OEM, and they
1964will have little ability to customize the experience until the OOBE stage of the Windows
1965installation. In many environments, such as a college or enterprise where hundreds or
1966thousands of devices are replaced or upgraded each year, it is important to appreciate
1967that organizations often wipe the OEM build and reload a clean installation that is free
1968from OEM customizations and any third-party software.
1969You have seen how you can use virtualization software such as Hyper-V to install
1970Windows directly into a virtual environment. Hyper-V can allow you to rapidly provision,
1971modify, save, and even deploy Windows within a fast and efficient tool that is commonly
1972used within organizations.
1973Microsoft successfully reduces the level of piracy of its software by various methods
1974of activation using product keys. You should know the differences between each key type
1975and the activation methods and be able to choose the most appropriate licensing model
1976for your needs.
1977Not all installations of Windows result in a clean installation or reinstallation onto
1978new hardware. Often, if a device’s hardware is relatively new, it may be suitable to
1979perform an upgrade of the software on the existing hardware. In the next chapter we will
1980explore the various options available to you to upgrade your operating system.
198166CHAPTER 3
1982Upgrading the Windows
1983Client Operating System
1984Up until Windows 10, Microsoft historically released several new operating systems per
1985decade. While most PC owners keep the preinstalled version of Windows that came on
1986the system, a large percentage of owners seek to upgrade to the latest version. Most users
1987who upgrade do so to take advantage of the latest functionality that the new system offers.
1988Users who purchase new equipment with the latest operating system can benefit from
1989both additional software functionality and new hardware advancements.
1990Since Windows Vista, most system hardware has been suitable for upgrading
1991between versions without the need to change processors or increase RAM levels, which
1992means it is easier (and cheaper) for you to upgrade than to purchase a whole new system.
1993The newest devices are often factory sealed, which reduces the option to upgrade
1994hardware components, whereas older systems can still be upgraded with faster hard
1995drives, more RAM, and other components.
1996Older software can become a serious security risk. Mainstream support for Windows 7
1997SP1 ended in 2015, and extended support ends on January 14, 2020. It is likely, therefore, that
1998within five years the majority of computers will be running Windows 10. With Windows 10,
1999the free upgrade offer that ran through July 29, 2016, enabled millions of users of Windows 7
2000Service Pack 1 (SP1) and Windows 8.1 to upgrade directly to Windows 10.
2001In this chapter, we will review the options and the tools used to upgrade Windows
2002locally and troubleshoot upgrade issues that you may encounter.
2003Upgrade vs. Clean Installation
2004Historically, it has generally been better to perform a clean installation whenever
2005possible. This advice is no longer applicable when considering Windows 10, and
2006Microsoft now recommends that you use the upgrade option if you are upgrading from
2007Windows 7SP1 or Windows 8.1 to the latest version of Windows.
2008© Chris Rhodes and Andrew Bettany 2016
2009C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
2010DOI 10.1007/978-1-4842-1827-3_3
201167CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2012Clean installations are where you install Windows onto a freshly formatted hard
2013drive. This method is still useful if you have one or more of the following scenarios:
2014• Installing onto a new hard drive
2015• Current installation is infected by malware, such as Ransomware,
2016which is difficult to remove
2017• OEM installation is full of unwanted software, sometimes referred
2018to as bloatware
2019• Changed system architecture (for example, you added more RAM
2020to your PC, and now want to use an x64 version)
2021• Using corporate customized image
2022It is not possible to provide a definitive rule regarding whether your upgrade will be
2023successful. If your operating system has been in use on your computer for more than two
2024years, it may be more appropriate to perform a clean install or reinstatement of the OEM
2025installation , or to restore from one of your early backups or recovery disks. Reinstating the
2026version of Windows that originally came with the device can be useful for several reasons:
2027• Device drivers should work without any compatibility issues.
2028• The appropriate system architecture is correctly configured.
2029• Your device will be activated using the original or OEM-installed
2030version of Windows.
2031• With a full backup, all installed applications will be restored
2032(although this may also include bloatware).
2033For organizations that have already created customized images of the desktop, the
2034process of reimaging a device can be performed very quickly and reliably. Typically,
2035the process for building, testing, and finalizing a custom deployment image may take in
2036excess of six months. It may be worth considering testing the upgrade process from your
2037current operating system directly to Windows 10 rather than waiting until a new custom
2038Windows 10 image is available. You may find that this works well, within the earlier
2039adopter or pilot group, as a work around for your system until your deployment team fully
2040evaluates and builds their image.
2041You can perform an in-place upgrade over the Internet or create standalone
2042installation media and then upgrade offline using the downloaded media. You will see
2043in the following sections that much of the upgrade process and end result is the same,
2044regardless how you instigate the upgrade.
2045Upgrading and Downgrading Windows
2046There are only certain upgrade paths available, depending upon which edition of
2047Windows is currently installed. We will focus on the upgrade paths that are available to
2048Windows 7 and Windows 8/8.1 in this chapter. If your system is less than five years old, it
2049should meet the minimum specifications for upgrading to a later version of Windows.
2050You can check whether the device hardware supports Windows 10 by visiting
205168CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2052the https://www.microsoft.com/en-us/windows/windows-10-
2053specifications?OCID=win10_null_vanity_win10specs website and reviewing the
2054system requirements listed there.
2055It is useful to know that even once you have upgraded to Windows 10, you will be
2056able to revert your system back to its original version of Windows.
2057During the upgrade process, Windows 10 creates a backup of your previous
2058operating system files in the C:\Windows.old folder. After your upgrade to Windows
205910, if you are not happy with the new version of Windows, you are able to revert back
2060to the earlier edition. This process is quite painless, and if you revert within 30 days of
2061upgrading, you can navigate to the Recovery section, then the option titled “Go Back to
2062Windows 8.1” within the Settings app, as shown in Figure  3-1 .
2063Figure 3-1. Revert to previous version of Windows
2064After 30 days, Windows 10 will automatically delete the previous installed version to
2065release storage space. With the Windows 10, version 1607 (also known as the Anniversary
2066Update), you will only have 10 days to revert to your earlier operating system. On some
2067tablet devices with small hard drives, this is a useful feature. If you need to revert to your
2068previous version after the month has elapsed, you will need to recover from the backup
2069drive that you created prior to the upgrade, or perform a fresh install of your earlier
2070operating system.
207169CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2072If you click the Get Started button for the “Go Back to Windows 8.1” option, you will
2073initiate the process to revert to your earlier operating system. You will be asked to answer
2074a short survey that tells Microsoft why you want to go back. The process will remove
2075any new apps that you have installed and any settings that you have modified since
2076upgrading to Windows 10. Your files should remain after reverting is complete, but it is
2077recommended that you have a backup just in case.
2078During the reversion process your computer will reboot several times, and it can take
2079some time to complete.
2080If you want to remove the previous operating system version sooner than the
2081automatic 30 days, you can do so manually by running the Disk Cleanup tool . To run the
2082Disk Cleanup tool follow these steps:
20831. Search for Disk Cleanup in the search area.
20842. Select the option to “Clean up system files” and allow the Disk
2085Cleanup tool to rescan the drive.
20863. Check the “Previous Windows Installation(s)” option (this is
2087not selected by default) as shown in Figure  3-2 .
2088Figure 3-2. Manually reclaim the disk space from a previous version of Windows
208970
20904. In the Disk Cleanup prompt, “Are you sure you want to
2091permanently delete these files?”, select Delete Files.
20925. Disk Cleanup will begin file deletion, and the process will
2093provide you with one more warning and confirmation that
2094deleting the previous version of Windows will prevent you
2095from restoring the machine back to the previous version of
2096Windows.CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
20976.
2098Click Yes to confirm. The deletion of the files relating to the
2099previous version of Windows can take several minutes.
2100There is a built-in Scheduled Task that automatically removes the Windows.old
2101folder after 30 days. On a newly upgraded PC, you can locate the task in Task Scheduler
2102at \Microsoft\Windows\Setup\SetupCleanupTask as shown in Figure  3-3 . You may want
2103to edit the scheduled task to run after 60 days or disable the task entirely by removing the
2104enabled check, done within the Triggers tab of the SetupCleanupTask Properties window.
2105Figure 3-3. Windows.old cleanup of scheduled task
2106Upgrading the Windows OS from DVD or USB
2107Although the upgrade is now the recommended deployment method for existing devices
2108running Windows 7 or Windows 8.1 to obtain Windows 10, you can still use other
2109methods, such as “wipe-and-load,” using a USB drive or DVD, or over a network if you are
2110deploying a customized corporate image, as you will see in a later chapter.
2111If you are installing the Windows 10 Home or Pro editions, the easiest way to obtain
2112the Windows 10 installation media is to create your own using the Media Creation Tool
2113(MCT) for Windows 10, as shown in Figure  3-4 , which generates a ready-to-use, bootable
2114USB flash drive or an ISO file that you can then burn onto a DVD. The MCT can be
2115downloaded at https://www.microsoft.com/en-gb/software-download/windows10 ? .
211671CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2117Figure 3-4. Using the Media Creation Tool
2118The MCT tool allows you to specify the language, edition, and architecture (whether
2119x86 or x64, or both) for the installation file and allows you to choose to either save the
2120installation file as an ISO file or copy it directly to a USB flash drive.
2121When you run the MCT, it will download several gigabytes of files for the installation
2122media, so you should not use this method if you are using a metered or slow Internet
2123connection.
2124With your Windows DVD or USB now created, you can upgrade the operating system
2125in situ by inserting it into a running Windows 7SP1 or Windows 8.1 machine. If you have
2126downloaded the ISO with the Windows 10 installation media, you can use this to burn it
2127to a DVD or to install Windows 10 into a Hyper-V virtual machine.
2128To upgrade Windows from installation media you should follow these steps:
212972
21301. Insert your Windows 10 media into your computer.
21312. Choose “Run Setup.exe” from the popup AutoPlay dialog box.
21323. Select Yes from the User Account Control prompt.
21334. Windows 10 will install the setup files.CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
21345.
2135If you are connected to the Internet, you should tick the
2136option to allow setup to Download and Install Updates
2137(Recommended), as shown in Figure  3-5 , as this will ensure
2138that the latest build of Windows 10 is installed, along with the
2139latest updates.
2140Figure 3-5. Install latest updates for Windows
21416. Click Next and then click Accept to agree to the license terms.
21427. The Setup app checks to see if the device has at least 2 GB of
2143RAM if you are using x64 architecture as well as sufficient free
2144disk space for the installation. It will then offer you the option
2145to change the upgrade options.
21468. To review the upgrade options, you should click the “Change
2147What to Keep” link on the Ready to Install page and make any
2148changes to the options, as shown in Figure  3-6 .
214973CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2150Figure 3-6. Choose your upgrade options
21519.
215274
2153Click Next and then click Install.
215410. Windows 10 Setup will begin the installation phase of the
2155upgrade and may restart during this process.
215611. You can cancel the operation at any stage by clicking the
2157Cancel button, as shown in Figure  3-7 , and your computer will
2158be returned to its original state.CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2159Figure 3-7. You can cancel the upgrade at any time
2160Once Setup has copied all of the current Windows operating system to the
2161C:\Windows.old folder, the upgrade will reboot and then continue. You will notice
2162a change from a blue background to a black screen with a progress indicator, which
2163provides you with details of the upgrade stages, as shown in Figure  3-8 .
2164Figure 3-8. Details of the Windows 10 upgrade stages
216575CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2166Upon completion, you will be presented with a “Hi there, welcome back!” screen,
2167as shown in Figure  3-9 , which prompts you to verify your login credentials. The system
2168knows who you are, since this is an upgrade, and this prevents an unauthorized user from
2169upgrading your device and gaining access to the system.
2170Figure 3-9. Log in to the device during the upgrade to Windows 10
2171After you log in to the system you can continue the upgrade process using the
2172steps here:
217376
21741. After successful logon you will be offered the Express settings
2175to accept, or you can choose Customize settings.
21762. Review the option and click Use Express Settings. (You can
2177modify the settings at any time.)
21783. Review the new apps that are built into Windows 10, including
2179Photos, Microsoft Edge, Music, and Movies & TV.
21804. Click Next.
21815. The upgrade process will reboot a couple more times to
2182complete the upgrade, and then you will be presented with a
2183series of messages that indicate that Windows 10 is setting up
2184your apps.CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
21856.
2186Once the apps have been installed in the background,
2187Windows 10 will display the upgraded desktop, as shown in
2188Figure  3-10 .
2189Figure 3-10. Windows 10 desktop
2190Upgrading the Windows OS with Windows Update
2191One of the painless ways of upgrading Windows is by allowing Microsoft to update your
2192system in a completely automated way. During the first year after release, Windows 10
2193perfected the upgrade process by rolling out in-place upgrades to millions of home users
2194and Windows Insider program members. Prior to each upgrade, a system recovery point
2195was created, and in the unlikely event that the upgrade was unsuccessful, the system
2196could be easily reverted to the previous state.
2197Windows 10 will not be issued service packs like previous versions of Windows were.
2198Previous versions received roll-up upgrades as part of a series of service packs, available
2199via Windows Update as follows:
2200• Windows Vista – Two service packs; last one was available on May
220126, 2009
2202• Windows 7 – Single service pack, available on February 22, 2011
220377CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2204• Windows 7SP1 Convenience roll-up update – available on May 17,
22052016 (via the Microsoft Update Catalog website)
2206• Windows 8 – Upgrade to Windows 8.1 via Windows Update is not
2207available.
2208• Windows 8.1 – Windows 8.1 Update released on April 8, 2014.
2209Only certain editions of Windows 7 or 8.1 can be upgraded directly using the
2210Windows Update service , as shown in Table  3-1 .
2211Table 3-1. Using Windows Update to Upgrade to Windows 10
2212SKU to Be Upgraded
2213Windows Update
2214Windows 7 Pro No
2215Windows 7 Enterprise No
2216Windows 7 Pro with SP1 Yes, with update KB 2952664 installed
2217Windows 7 Enterprise with SP1 No
2218Windows 8 Pro No
2219Windows 8 Enterprise No
2220Windows 8.1 Pro Yes, with updates KB 2919355 and KB 2976978
2221installed
2222Windows 8.1 Enterprise No
2223Windows 10 Pro (1507) Yes (if not activated using Key Management Service
2224[KMS])
2225Windows 10 Enterprise (1507) Yes (if not activated using KMS)
2226Businesses with Windows Enterprise editions can upgrade older versions of
2227Windows to the latest offering as part of their enterprise Software Assurance volume
2228licensing benefits.
2229With the new rapid upgrade cadence now in place to maintain Windows 10, you
2230will see regular upgrading of your system. Microsoft has announced that there will be a
2231minimum of two upgrades to Windows 10 per year. The upgrades are completely separate
2232from the daily, weekly, and monthly security updates that your system also receives.
2233â–  Note Although Windows RT is now discontinued, you can use the update KB3033055,
2234“Update for Windows RT 8.1 feature improvement,” to install the Windows 10–style Start
2235menu on Windows RT devices.
223678CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2237Once you are ready to upgrade, you can use Windows Update to pull down the
22382604.5 MB in installation files as an optional update within the Windows Update, which is
2239labeled “Upgrade to Windows 10 Home, Version 1511, 10586,” as shown in Figure  3-11 .
2240Figure 3-11. Upgrade to Windows 10 via Windows Update
2241If you are familiar with creating installation media, you will have used the Windows
2242image format (WIM) or ISO files before. For the upgrade, Windows 10 uses the new
2243Electronic Software Download (ESD) file format, downloads the image .ESD file to the
2244C:\Windows\SoftwareDistribution\Download folder, and uses the C:\$Windows.~BT\
2245Sources folder during the actual installation. The ESD file format is a compressed and
2246encrypted version of the .WIM file format and contains just a single Windows image. With
2247the enhanced compression, the ESD file is approximately 30 percent smaller than the
2248.WIM format, which makes it a suitable file format when being delivered through Windows
2249Update.
2250Once the upgrade has been downloaded, the system will prepare for the upgrade.
2251This includes creating a backup of the system in the Windows.old folder on the system
2252drive. If your computer has low disk space available, the Windows Setup Upgrade Wizard
2253will allow you to store the Windows.old backup folder onto an external drive, such as
2254an external USB drive, thereby freeing up approximately 8 to 10 GB, depending on the
2255version of Windows being upgraded.
2256Before progressing with the upgrade, you can postpone the actual installation and
2257schedule the upgrade to occur at a more convenient time, such as overnight. At the
2258preferred time, the upgrade will commence automatically.
225979CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2260Once the upgrade process commences, there is no user interaction required, and
2261Windows will automatically restart. An onscreen status indicator will describe the various
2262activities and their progress in the following stages:
2263• Copying files
2264• Installing features and drivers
2265• Configuring settings
2266Once completed, the upgrade process announces “Welcome to Windows 10!” Here,
2267you will need to enter the password for the user who initiated the in-place upgrade. If the
2268credentials verify against the original Windows installation, the out-of-box-experience
2269(OOBE) sequence commences with the Get Going Fast screen, and Windows 10
2270introduces new features such as Cortana , as shown in Figure  3-12 .
2271Figure 3-12. Windows 10 upgrade’s Meet Cortana screen
2272Once Windows has walked you through the onboarding process, you will be
2273presented with the new Windows 10 desktop, which displays a blue screen with light
2274shining through the Microsoft Windows logo on the right side of the screen.
227580CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2276Upgrading the Windows OS from PC Settings
2277Once you have upgraded to Windows 10, you can choose whether you want your
2278computer to benefit from the latest upgrades that are made available by Microsoft.
2279Windows 10 will be continuously updated and upgraded by Microsoft, and in theory you
2280should never need to change the operating system again. These upgrades will be referred
2281to as builds , and it is expected that Microsoft will release two to four builds each year. By
2282allowing Windows 10 to upgrade, you will see upgrades that allow your system to take
2283advantage when new biometric devices, Trusted Platform Modules (TPM) , or processors
2284become available.
2285If you want early access to the upgraded features, you can join the Windows 10
2286Insider Preview Program, which is useful so that you can test and evaluate potential
2287upgrades some months before they are released to the mainstream customer base. It is
2288not recommended to use Windows Insider builds in a production environment, but you
2289can use them in a virtual machine or multi-boot scenario.
2290With the Windows 10 build process, the build will move through progressive
2291branches on its way to the general release and then be made available to enterprise users.
2292A visual representation of how the build and branch development process works is shown
2293in Figure  3-13 .
2294Hundreds
2295of millions
2296Several million
2297Users
2298Engineering
2299builds
230010s of
2301thousands
2302Broad
2303Microsoft
2304internal
2305validation
2306Microsoft
2307Insider Preview
2308Branch
2309Current Branch
2310Current Branch for Business
2311Time
23124 to 6 months
23134 months
23148 months
2315Figure 3-13. Windows 10 upgrade and build branches timeline
2316You should look at the guideline dates along the lower axis, as these roughly define
2317how long each branch will benefit from testing/bug-fixing before the build moves on to
2318the next branch on the right.
2319You can sign up as a member of the Windows Insider Preview Program by visiting
2320https://insider.windows.com/ .
232181CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2322Once you have signed up for Windows Insider, you can decide which of the two
2323levels of adoption of preview builds you want to participate in. The two update speeds are
2324referred to as rings :
2325• Fast ring – You receive the latest build at the earliest opportunity.
2326• Slow ring – Availability of the build is delayed until it has been
2327exposed to the Fast ring members for a few weeks and the
2328majority of bugs or issues have been addressed.
2329You can turn off the Insider Preview feature on your computer and revert to the last
2330Current Branch version at any time.
2331To enable the Insider Preview builds on your Windows 10 computer, follow these
2332steps:
23331. Sign up to be part of the Windows Insider Preview Program at
2334https://insider.windows.com/ .
23352. Sign in to your PC with the Microsoft account you used in
2336Step 1.
23373. Open the Settings app.
23384. Select Update & Security and then Advanced Options.
23395. Click Get Started button under Get Insider Builds section.
23406. Read the warning message shown in Figure  3-14 and click
2341Next to continue.
2342Figure 3-14. Agreeing to install Windows Insider builds
234382CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
23447. Restart your PC.
23458. Sign back in to your PC with the Microsoft account you used
2346in Step 1.
23479. Open the Settings app.
234810. Select Update & Security and then Advanced Options.
234911. Under Get Insider Builds, you can choose either the Slow or
2350Fast ring.
2351â–  Note Once you have joined the Windows Insider Preview Program, it can take up to 24
2352hours before your PC downloads the Fast or Slow ring updates.
2353Each Current Branch (CB) or Current Branch for Business (CBB) build that is
2354released is assigned a version number that corresponds to the release date, with the year
2355and month in yydd format, such as 1511 or 1607.
2356The Current Branch for Business servicing option is not available for users running
2357the Home edition of Windows 10. The CBB is meant for enterprises that require extra
2358time for testing and evaluating the build of Windows 10. With the CBB they can defer the
2359upgrade cycle up to one year from each Current Branch release.
2360If you are a business customer running the Enterprise edition of Windows 10, you
2361can select the “Defer upgrades” option within the Settings app, as shown in Figure  3-15 .
236283CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2363Figure 3-15. Defer upgrades
2364To manually configure your PC to move from the Current Branch to be on the
2365Current Branch for Business, follow these steps:
236684
23671. Click the Start button and open Settings screen.
23682. Click Update & Security.
23693. The Windows Update page opens.
23704. Click Advanced Options.
23715. Select “Defer upgrades” option.
23726. Close Settings screen.CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2373The facility to defer upgrades and join the Current Branch for Business can also
2374be configured using Group Policy, System Center Configuration Manager (SCCM) , or
2375the Enterprise Mobility Suite. A new feature — made available with Windows 10, version
23761511 — called Windows Update for Business allows administrators to further control how
2377upgrades are obtained and allow an additional deferral of upgrades for up to at least
2378eight months.
2379While deferring upgrades, devices running Windows 10 Pro, Enterprise, and Education
2380on the CBB will continue to receive monthly security updates. When the maximum deferral
2381period has expired, the upgrades will be automatically installed. You will learn about a special
2382build of Windows 10 Enterprise called Long-Term Servicing Branch (LTSB) in Chapter 6 .
2383Troubleshooting Upgrade Issues
2384Although upgrading to Windows 10 is a great deal more reliable than any other previous
2385Windows upgrade that you may have encountered, there are still potential issues, work-
2386arounds, and best practices that you should be aware of.
2387You should be wary of systems that may be very old and have previously undergone
2388other upgrades. On most PCs you can often find the original certificate of authenticity
2389(COA) sticker on the chassis of the PC, which will advise you of the OEM-installed version
2390of Windows. If the sticker relates to Windows XP or Vista, you should investigate to see if
2391the internal hardware will support Windows 10. If you have the Get Windows 10 (GWX)
2392app installed, you can check the compatibility report there to make sure your Windows 7
2393or Windows 8.1 PC can run Windows 10 as follows:
23941. Click the Get Windows 10 app icon on the taskbar
2395notification area.
23962. Click on the “hamburger” menu button at the top left corner
2397of the app.
23983. Click on Check Your PC under the Getting the Upgrade
2399section.
24004. Click the “View report” link.
24015. Review the compatibility report to see if Windows 10 will work
2402on your system.
2403You could also check whether the device hardware supports Windows 10 by
2404reviewing the system requirements at https://www.microsoft.com/en-us/windows/
2405windows-10-specifications?OCID=win10_null_vanity_win10specs .
2406Operating System Stability
2407If the system you are intending to upgrade is unstable, then it is not a good candidate to
2408upgrade, as you may carry forward any current problems to your new operating system.
2409You should check the reliability of the system by launching the Reliability Monitor. This
2410is done by typing reliability into the Start screen and clicking View Reliability History
2411in the Control Panel. The tool will display a summary of the reliability history for your
2412system, as shown in Figure  3-16 .
241385CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2414Figure 3-16. Reliability Monitor screen
2415The Reliability Monitor screen shows a line graph with a scale from 1 to 10 and a
2416date timeline along the bottom axis. The graph rises and falls based on how the system
2417performs. If the system exhibits regular software or driver errors, the system stability may
2418encounter apps crashing or a service stopping. With every system issue that degrades
2419system stability, the graph value will fall, while on a stable system the line graph will rise
2420and be consistently near the maximum level of 10.
2421The Reliability Monitor is a powerful tool, and you should take a look at your system,
2422using the monitor to drill down into any stability issues that are present.
2423Troubleshooting Windows 10 Upgrade Error Codes
2424During the upgrade process, Windows 10 will create an installation log file, which you can
2425inspect to diagnose and troubleshoot what went wrong. The installation log file is located
2426at C:\windows\Panther\UnattendGC\SetupAct.log .
2427As an example, if Windows detects that you are trying to use the wrong installation
2428media, you should find an entry such as “Info [windeploy.exe] OEM license detected, will
2429not run SetupComplete.cmd” within the log file.
2430Other clues may be found within the setuperr.log , which is found at
2431C:\$Windows.~BT\Sources\Panther\setuperr.log .
2432If the problem relates to a compatibility issue, you should review the error code
2433presented. Some of the most common error codes relating to upgrading are shown in
2434Table  3-2 .
243586CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2436Table 3-2. Common setuperr.log Upgrade Error Codes
2437Error Code Description
24380xC1900200 PC does not meet Windows 10 system requirements.
24390xC190020E Insufficient free hard drive space
24400xC1900204 Wrong Windows 10 SKU or architecture
2441Block Upgrading to Windows 10
2442If you do not want your current system that is running either Windows 7SP1 or Windows
24438.1 Update to be upgraded to Windows 10, you can block it by configuring Group Policy
2444settings on your PC as follows:
24451. Open Local Group Policy editor by typing gpedit.msc .
24462. Expand Computer Configuration.
24473. Expand Administrative Templates and then click Windows
2448Components.
24494. Expand Windows Update.
24505. Double-click “Turn Off the Upgrade to the Latest Version of
2451Windows through Windows Update.”
24526. Click Enable.
24537. Close Local Group Policy editor and reboot your system.
2454â–  Note There are several third-party apps that you can install that will prevent your PC
2455from updating to Windows 10, such as Never10, found at https://www.grc.com/never10.
2456htm , or GWX Control Panel, found at http://blog.ultimateoutsider.com/2015/08/
2457using-gwx-stopper-to-permanently-remove.html .
2458Once configured, the system will not automatically detect, download, or install the
2459Windows 10 upgrade. You can still upgrade to Windows 10, but you will need to initiate
2460this manually.
2461Upgrading a System with BitLocker Drive Encryption
2462If your current system is encrypted using Device Encryption or BitLocker Drive
2463Encryption technology , the Windows 10 upgrade process will automatically process the
2464upgrade, and you won’t need to manually disable or suspend the BitLocker. You do not
2465need to decrypt your hard drive prior to upgrading to Windows 10. The upgrade process
246687CHAPTER 3 â–  UPGRADING THE WINDOWS CLIENT OPERATING SYSTEM
2467will recognize that BitLocker is enabled and will suspend the encryption and then resume
2468it after the final configuration reboot. If you don’t use a TPM, you will be asked to enter
2469your password or PIN during startup.
2470If you find that the upgrade process does not recognize the drive as being BitLocker
2471encrypted, you should start the update process using the Setup.exe from within
2472Windows 7SP1 or Windows 8.1 rather than booting directly from the installation media.
2473It is also a best practice to ensure that you know how to access the BitLocker recovery
2474key in case you forget your password.
2475Summary
2476Many experienced users and IT pros may be skeptical about moving away from the
2477traditional wipe-and-load installation process to the newly recommended “in-place
2478upgrade” path. You should review and evaluate the new options available so that you
2479can decide for yourself. Often, the organizations that embrace the latest enhancements
2480in Windows deployment, maintenance, and updating are the ones that benefit from
2481significant savings in both efficiency and costs.
2482You have seen how you can use the various upgrade methods that are available, such
2483as using Windows Update or the MCT tool, and how to defer upgrades to your enterprise
2484devices using the CBB branch.
2485You have reviewed several troubleshooting scenarios and learned that not all
2486installations of Windows are suitable for upgrading. In the next chapter, you will explore
2487methods of installing customized builds of Windows using enterprise tools, reference
2488images, and deployment methodologies.
248988CHAPTER 4
2490Automating Windows
2491Deployment with Lite Touch
2492In this chapter, we will be examining the role of Lite Touch in operating systems
2493deployment. Lite Touch describes a methodology for deployment of images to PCs with
2494minimal interaction with the target computer. It all starts with an image.
2495For many years, systems administrators have sought to achieve what was always seen
2496as the holy grail of desktop deployment: the gold image. So what is a gold image, why seek
2497it, and why is it perhaps almost foolish to embark on such a quest?
2498It helps to have some historical perspective on this, to see where we are today
2499and how we ended up here. In the days pre-Windows 95 and Window NT 4.0, desktop
2500computers usually came with an Original Equipment Manufacturer (OEM)-installed copy
2501of Windows. Either that, or due to the low count of PCs in networks, they may have gotten
2502their operating system and applications installed manually from CD-ROMs and/or floppy
2503disks. Retrospectively, this has been known as a high-touch deployment. This was not
2504a major pain initially, but as time went on and more and more PCs found their way into
2505companies, automation was sought.
2506This was not just for the distribution of the operating system, but also for all the
2507“glue” that went with the OS, such as device drivers (which were almost always required
2508to have been manually added to operating systems at that time) and other essential
2509business software, such as anti-virus. New tools started to emerge around the mid-1990s
2510that helped to automate the creation and distribution of operating system images that
2511were crafted by the administrator. Principal among these tools were Ghost and AltIris
2512(although there were others).
2513So, what is so important about trying to achieve the gold image? Really, it stems from
2514an IT department’s desire to have a consistent and supportable environment that allows
2515for ease of reimaging if a computer runs into problems. This makes it uneconomic to
2516spend excessive amounts of time in troubleshooting and fixing the computer, compared
2517to the time and energy expended in reimaging with the gold image.
2518© Chris Rhodes and Andrew Bettany 2016
2519C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
2520DOI 10.1007/978-1-4842-1827-3_4
252189CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2522â–  Note Lite touch is not only a concept, but also describes the process and the set
2523of tools that are used to achieve this. In today’s environments, this is usually done using
2524the Microsoft Deployment Toolkit (MDT), Windows Deployment Services (WDS), and some
2525manual steps performed by an engineer at the PC itself. By its very definition, in lite
2526touch the support engineer is physically touching the PC, albeit in a limited way, and is
2527not expected to press every button and check every checkbox that an installation would
2528otherwise require. Lite touch differs from zero-touch deployments in that zero touch does
2529not require any physical presence at the PC to undertake a deployment. This is achieved by
2530using management tools such as Microsoft Systems Center Configuration Manager (SCCM).
2531Creating a Reference Machine (Sysprep)
2532So, let’s imagine that you have decided that creating an image is the way to go to deploy a new
2533operating system version to your computers (as opposed to in-place upgrades). What should
2534go in your image? Should you keep it skinny and have a minimal number of applications and
2535other software installed in it, or should you install every variation of software so that everyone
2536is catered for? In reality, this is not possible due to licencing implications. You don’t need to
2537install every application into your image however, for it to be described as a thick image. While
2538it is impractical to install them all, there is a case for installing a majority of applications into
2539an image for ease of use once the image arrives at the PC.
2540These extremes are known as thin and thick images, respectively. In each case,
2541whether you decide to go thin, thick, or something in between, you need to start off by
2542having a reference computer to work on.
2543CUSTOM
2544ISATION
2545APPS
2546cd-rom/DVD
2547UPDATES
2548Figure 4-1. The gold image
254990
2550DRIVERSCHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2551â–  Note Thin images are not simply left thin. They are augmented post-deployment
2552with applications and other required components, such as printers. This augmentation is
2553performed with a variety of tools, such as SCCM, Group Policies, App-V, and RemoteApp.
2554In the case of App-V and RemoteApp, the applications are not even installed on the PC,
2555meaning a very agile deployment with few dependencies.
2556The reference computer could be a physical machine, which would be meaningful
2557if it represented the majority of the installed bases of hardware in the environment, or it
2558could be a virtual machine. Having a virtual machine makes a lot of sense. It’s hardware
2559independent, has no requirements for extra device drivers, and is extremely portable —
2560another tech support person could import it to their computer and work on it equally the
2561same. This also means that any bloat from manufacturer drivers or third-party packaged
2562applications that may come with a new PC is minimized.
2563Any potential issues with hardware are also kept to a minimum with a virtual
2564machine , especially if using Hyper-V to host it, as Windows operating systems today do
2565not require any drivers or customization to allow them to recognize the fact they are
2566running on a hypervisor; they can be said to be driver-neutral. Another advantage is that
2567you can utilize Hyper-V checkpoints for testing, which can reduce the time between test
2568iterations. This is typically the way that reference computers are created today.
2569One thing to bear in mind is that, ultimately, images (built from the reference
2570computer) are only relevant to the environment in which they are created and must
2571include all the components relevant to that environment. So what should you include in
2572the image? As Figure  4-1 shows, you should think about a line of business applications,
2573device drivers, Windows updates, and any other customization that is relevant to the
2574business of applications or the operating system environment. This, then, is your SOE, or
2575standard operating system environment, but it is not yet an image.
2576You can either build a reference image manually or use automation, such as utilising
2577MDT. As we will be examining MDT in more detail later, let’s look at how to build it
2578manually for now. This may be regarded as a high-touch method, but it is intended to
2579only have to be done once anyway.
2580One possible way to build a reference image is to take a retail DVD media disc and
2581construct an answer file using Windows System Image Manager (SIM) (see later in this chapter
2582for more information). The answer file contains the answers that the setup program questions
2583during setup, such as which drive to install to and which language/regional settings to use.
2584A simple walkthrough on how to build the reference computer on a physical
2585computer is as follows:
25861. Create an answer file using Windows SIM.
25872. Place answer file on the root of a USB drive and insert it into
2588the computer.
25893. Run Setup from the DVD media.
25904. Configure Windows settings.
25915. Install updates.
25926. Install applications and configure them.
259391CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2594Alternatively, skip Steps 1 and 2 and run setup manually from the installation media.
2595This route is convenient when building a virtual machine – based reference computer and
2596installing Windows from an ISO file.
2597Once Windows is installed, it’s time to configure any aspects of the operating system
2598that the business requires, such as applying any initial first-run configuration steps.
2599Applications that are considered core, like Microsoft Office, may get installed at this
2600time if it makes sense to include it, versus installation post-deployment using another
2601mechanism like SCCM.
2602One challenge administrators traditionally face is ensuring that the image that
2603eventually gets created doesn’t go “stale” too quickly. You could install all the relevant
2604updates to Windows at the time of building the reference computer, but over time more
2605updates will inevitably be released by Microsoft. This would mean that the reference
2606computer would get progressively more out of date and require time to get the deployed
2607operating system updated and ready for use by the end user. The time taken to install
2608a back catalog of updates can be longer than it took to deploy the image, thus being
2609somewhat self-defeating.
2610■ Tip Once the reference computer is saved as an image, it’s important to have a
2611strategy for keeping the image up to date. This used to involve deploying the image,
2612updating it, preparing it for capture once more, and then recapturing it. Now, it is possible to
2613add updates to offline images using DISM. An example of this is seen here:
2614Dism /Add-Package /PackagePath:/PackagePath:C:\MSU\Windows10-KB12345678-x64.
2615msu /Image:C:\mount\boot /LogPath:AddPackage.log
2616This is only an excerpt of the steps required. More information can be found at
2617https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufacture/
2618desktop/add-updates-to-customized-windows-and-winpe-images
2619Now that that reference computer is built and includes the components that we
2620wanted, we can start to think about creating an image of this computer, with the intention
2621of cloning it to dozens of other computers. However, it’s not possible just to “just clone it.”
2622Some work needs to be done to remove any specifics, such as the computer name and other
2623settings, that would be incompatible with cloning. This process is known as generalizing .
2624To generalize a computer, you must run the system preparation tool sysprep.exe
2625in the generalize mode. Generalizing a computer prepares it for imaging by removing
2626system restore points, clearing event logs, and removing the computer name, among
2627other tasks.
2628â–  Tip You must use the version of Sysprep that is provided with the Windows version
2629that you intend to configure. Sysprep is included in every installation of Windows and can be
2630found in %WINDIR%\system32\sysprep .
263192CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2632Figure  4-2 shows Sysprep in action. There are two cleanup actions that can be
2633specified. The main one that prepares a system for imaging is the Enter System Out-Of-
2634Box Experience (OOBE) mode . This mode, upon the rebooting of the computer, would put
2635the computer into the specialize pass of Windows Setup, requiring information like a
2636computer name and a user name to be entered to finish off the installation. An answer file
2637for this stage can be created using Windows SIM and will be explained later.
2638Figure 4-2. The System Preparation Tool (Sysprep.exe)
2639The other mode is Enter System Audit mode, which puts the computer into audit
2640mode after the next reboot. Audit mode allows for engineers to test configurations before
2641committing to a signed-off build for imaging. Think of it almost like a try-before-you-buy
2642mode that would be used prior to generalizing. This allows for a complete bypass of the
2643OOBE pass and access to the desktop for validation of the reference computer, or any
2644other last minute additions, such as drivers.
2645Chapter 1 contains information on running Sysprep from a command line and the
2646syntax to be used, which also allows for a custom answer file to be used.
2647It’s worth noting that there is a limit to how many times Sysprep can be run against
2648an activated system, which is three for older versions such as Windows Vista and
2649Windows 7, while for Windows 8.1 and Windows 10 it’s eight times. Technically, Sysprep
2650itself can be run an unlimited number of times, but the activation clock of the computer
2651starts once it has been activated the first time. A workaround to this is using virtual
2652machines, specifically checkpoints, as recommended earlier. A better way to avoid this
2653limit is to add a specific product key into an answer file in the Microsoft-Windows-
2654Shell-Setup\ProductKey section of the specialize pass. This will kick up the need to
2655activate again on the deployed computer.
265693CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2657â–  Note There is a widely perceived notion that running Sysprep is essential in order
2658to avoid having computers with duplicate security identifiers or SIDs. SIDs are generated
2659on each computer during Windows Setup and form the basis of the ID for accounts on
2660that computer. For many years, administrators thought that generalizing a computer was
2661essential to avoiding duplicate SIDs. In reality, this is a myth, as it makes no practical day-
2662to-day difference on a client computer.
2663The shutdown options also include reboot and quit. Normally, shutdown is used, as
2664it allows you to take your time getting ready to start the machine up for capturing it with
2665bootable media (WinPE).
2666Creating Unattended Installations (Windows SIM)
2667Moving from high touch to lite touch is where automation begins to take hold. To this
2668end, you will need to start looking at creating answer files that will provide the input that
2669Windows Setup would normally expect to be passed in using end-user manual input,
2670such as typing the computer name.
2671One of the tools in the Windows ADK that will be required for this is Windows Setup
2672Image Manager (Windows SIM). Windows SIM is designed to help administrators tailor
2673their own answer files to be used in the following common scenarios:
2674• For building a reference computer from media
2675• For building a regular computer from media
2676• To accompany sysprep.exe to help finalize post-imaging setup
2677(OOBE)
2678The answer files that Windows SIM will help create are XML based and could really be
2679edited in a text editor if you had the will to do so. In reality, this is too time consuming, and
2680an intimate knowledge of all of the settings available in the different passes of Windows
2681Setup would be required. Windows SIM exposes these settings for us, so no guesswork
2682is required. The first step in using SIM is to add an existing image in the Windows Image
2683section. A good place to start (as you haven’t created a custom image yet) is to use
2684install.wim from a Windows ISO or DVD. This is the shipped copy of Windows that a
2685normal computer is installed from. It’s a good idea to copy all of the source files to your
2686hard drive first so there are no issues relating to read-only media. Typically, you need to
2687catalog this so that the tool enumerates the configurable settings and packages from inside
2688the image. Once this is done, you will create a new answer file in the middle pane.
2689Next, you will expand the Components and Packages area in the image and view
2690the components that you wish to add to your answer file to customize Windows Setup.
2691Settings may be applied to one or more than one pass, depending on the relevance of
2692the settings in it. The available choices are displayed once you click on a component, as
2693shown in Figure  4-3 .
269494CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2695Figure 4-3. Windows SIM interface
2696You may recall from Chapter 1 that there are seven passes (phases) of Windows
2697Setup, which are:
2698windowsPE
2699offlineServicing
2700generalize
2701specialize
2702auditSystem
2703auditUser
2704oobeSystem
2705These passes control the processing of the Windows Setup process, and there are
2706defined tasks that occur at these different stages. That said, some tasks can be performed
2707in more than one pass.
2708Once a component has been added to the relevant pass of Setup, you can start to
2709customize the data using the middle and right-hand panes in the tool. For example, in
2710Figure  4-4 , Windows Mail has been configured to be hidden.
271195CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2712Figure 4-4. Customizing components in Windows SIM
2713If making an answer file for automated installation from a media-based install (as
2714described in the section earlier relating to building a reference computer), you would
2715save the file as autounattend.xml . This is what the Windows Setup program is hard
2716coded to look for on removable media drives, such as a USB drive, during the first stage of
2717setup. If located, it automatically uses it and processes it.
2718Packages can be added to the answer file in addition to the settings from
2719components just discussed. Packages include updates and language packs. Packages
2720can be added or removed from the image. The concept of removing packages includes
2721the ability to remove some in-box software from users that may not be desirable in a
2722corporate environment, such as Windows Media Player. Packages are configured only
2723in the offlineServicing pass. This is similar to how DISM was mentioned before for
2724adding Windows updates to offline images to keep them fresh.
2725â–  Note Answer files can be called anything (except the autounattend.xml file used for
2726media-based installs in conjunction with a USB drive). However, it is common practice to
2727name the setup answer file Unattend.xml . You would then use the answer file by calling it
2728as a parameter of Windows Setup; for example:
2729Setup.exe /unattend:unattend.xml
2730If you were creating an answer file to automate a sysprepped computer coming into the OOBE
2731stage after deploying an image, your syntax going into Sysprep may look something like this:
2732Sysprep /generalize /oobe /unattend:C:\unattend.xml /shutdown
273396CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2734Once you’ve edited the answer file, it is a great idea to have it validated before saving
2735it and using it. Validation checks that the entered values are relevant to the data type
2736expected. This does not mean that your answer file is 100 percent guaranteed to work, but
2737it will eliminate common typos and mistakes. Testing is really the only way to tell for sure
2738that it works!
2739■ Note There are so many settings that can be customized that it’s a good idea to use
2740the in-built documentation inside Windows SIM to help answer any questions you may have
2741regarding what the settings do and what values you can assign to them. There are too many
2742to list in this book.
2743Configure and Troubleshoot WDS
2744Now that you have created a reference computer and run Sysprep on it, the next task is to
2745copy that computer into an image. You could do that locally, using DISM to create a WIM
2746file that contains your image.
2747Figure  4-5 shows an example of how that might look.
2748Figure 4-5. Capturing an image with DISM
2749This command would capture the contents of the C: drive into a file named c:\
2750windows.wim and associate a name of image1 with the stored image. (You may recall
2751we discussed the WIM file format in Chapter 1 .) This needs to be run from outside of
2752Windows itself. Following the line of logic in this chapter, we would by now have run
2753Sysprep and shut down the computer. To get to this point of capturing a reference
2754computer, you will need to boot into an operating system that allows for the capture to
2755take place, but does not interfere with Sysprep and the OOBE pass that will follow.
2756This is called WinPE (Windows Preinstallation Environment). WinPE (or a custom
2757version of it) is what is used during Windows Setup. The Windows ADK provides tools to
2758create your own WinPE media, which can be used to boot from a USB drive, for example.
2759A run-through of how to create this is found in Chapter 1 . Once booted into this cut-down
2760version of Windows, a limited set of tools are made available, but all that is needed here is
2761a basic command line to perform the capture using DISM.exe .
276297CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2763â–  Note WIM files are not images. WIM files can contain one or more images. Multiple
2764images can be stored within the same file. This results in storage efficiency, as files are
2765single-instanced. In other words, if you were creating three images based on Windows 10,
2766the duplication of files would be avoided, and the size of the WIM containing the images
2767would be less than the sum of its parts. Add to that the fact that you can also compress files
2768in a WIM and you get highly effective storage for your images.
2769Installing a WDS Server
2770This is useful to know; however, on a large corporate network this is a little clunky,
2771especially when considering you may need to deploy that image hundreds of times over.
2772There is an alternative, and that is to use Windows Deployment Services (WDS). WDS
2773acts as a repository for WIM images on the network, with many added advantages.
2774WDS has the capability to serve images to clients over the network using PXE
2775boot. PXE boot is a special function of network interface cards that supports booting
2776the computer to the network rather than booting from a hard drive. This requires no
2777operating system to be present on the computer, as the network stack required is included
2778in the PXE specification. Clients boot to the network, acquire an IP address from DHCP,
2779and then locate the WDS server automatically.
2780Sound good? Let’s install WDS and look at how to create and distribute images using
2781the network rather than DISM and WinPE locally. In Windows Server 2012 R2 and above,
2782WDS is an installable role. When you install it, there are two role services, as shown in
2783Figure  4-6 . Installing both of these on the same server is the typical configuration.
278498CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2785Figure 4-6. Installing WDS
2786Once WDS is installed, it requires configuration to have it be ready for use on the
2787network. The following settings need to be configured as part of the post-installation wizard:
2788• There is a choice whether to install WDS as a standalone service
2789on the network or to integrate with Active Directory (AD).
2790Generally, it is integrated with Active Directory so that you can
2791work with OU containers for the storage of computer accounts,
2792(which would need to be created anyway once a computer joins a
2793domain) and to leverage AD groups for assignment of permissions
2794on images to restrict access. You may install it standalone if you
2795are working on a client site and using your own server to distribute
2796images as a one-off rather than the customer’s server.
2797• Path to store image files. This is straightforward. Tell the
2798wizard where you would like to store images. It defaults to
2799C:\RemoteInstall , but usually WDS servers have other
2800disks provisioned for this purpose because of capacity and
2801performance reasons.
2802• Should the server respond to clients? While you can have it live by
2803default, in practice it makes sense to say no initially then activate
2804it later once you actually have some images ready to upload or
2805capture.
280699CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2807•
2808DHCP options. WDS listens on port 67, like DHCP servers do
2809for lease generation for IP addresses. There can be a conflict,
2810however, if the DHCP server is the same server as the WDS server.
2811The wizard looks to remedy this if it detects this scenario. More
2812information about this, and different related scenarios, will be
2813covered later in the last section of this chapter.
2814Once configured, the WDS administration console looks like the one in Figure  4-7 .
2815Figure 4-7. The WDS console
2816Getting to Know WDS
2817Within the Servers container, each WDS server added has a number of default containers.
2818Install Images is where your WIM-based images will logically reside (wherever
2819they may rest on the hard drive). Images can be stored in image groups for ease of
2820administration. Boot Images is where your WinPE images will live. These can be created
2821using the Windows ADK and added here, or built using standard ones from the Windows
2822Setup ISOs/DVDs (more on this shortly).
2823Pending Devices is a container to use if you have decided to set the PXE response
2824setting in the wizard to require admin approval. This means that each unknown client
2825that requests to connect to the WDS server must be manually approved before an image
2826can be distributed. If the server is using automatic approval for clients, then this container
2827100CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2828is redundant. This setting is configurable using the properties on the server, as shown
2829in Figure  4-8 . The setting recommended in the wizard would be the first option, but you
2830then change it once ready to receive clients. “Known clients” refers to computers that are
2831prestaged in AD. More about prestaging will be covered later.
2832Figure 4-8. Configuring the PXE response settings
2833The Multicast Transmissions container is where an administrator can create
2834a multicast job that will be deployed to a number of client computers simultaneously
2835using a multicast stream (as opposed to clients’ receiving an image using 1:1 unicast
2836transmissions). This is very useful when deploying the same image to a room full of
2837computers at the same time. The image is preselected, and either the stream begins when
2838101CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2839a specified threshold number of computers is reached or auto-cast is used to continue
2840deploying the image until all computers have received it, even if they did not start at the
2841same time as the other computers.
2842Finally, the Drivers container is where device driver packages can be grouped
2843together and added to images, which will be covered later.
2844Boot Images
2845So, now the server is built, the next task is to add images. Let’s start with the boot images .
2846There are two choices here. You can either upload into the console WinPE images that
2847you already made using the ADK tools (as long as they are in WIM format), or you can
2848import a WIM from a Windows Setup disc or ISO file.
2849â–  Tip If you view a Windows Setup ISO or DVD, you will find a folder called \Sources .
2850This contains two WIM files, Boot.wim and Install.wim. Install.wim contains the install
2851image(s) that a normal setup of Windows would use. Boot.wim contains a WinPE-based
2852image, which is what Windows Setup uses for the installation process. You can add either or
2853both of these as starters to help you get up and running quickly in WDS.
2854If you decide to use a boot.wim file from an ISO, you will need to convert this after
2855adding it into two further images, a capture and a discover image. The capture image
2856is used when a PXE client is started up, with the intention of capturing a reference
2857computer. A discover image is used for PXE clients when they want to download an image
2858from WDS. Each image is broadly the same, but has different user interface options for
2859each use case.
2860â–  Note You should consider a mixed environment where there are 32-bit and 64-bit
2861client computers. You can either standardize having only 32-bit discover and capture
2862images, or have iterations of both. Due to the CPU architecture, 32-bit computers cannot use
286364-bit images, but 64-bit computers can use either type of image.
2864Install Images
2865Once the boot images are added, you may need to add drivers to them to account for
2866device driver requirements for the WinPE stage of setup. Primarily, this would be network
2867card drivers and disk controller drivers to allow for setup to complete. All other drivers
2868should be added to the install image, such as video card drivers. Note that this may also
2869involve duplicating the drivers added to the boot images too, as these are only relevant
2870to the PE phase, are used only during that time from RAM, and are not persistent on the
2871target computers.
2872102CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2873Just like the boot images, install images need to be added. Install images can be
2874sourced from the following:
2875• A standard install.wim file from a Windows disc/ISO
2876• a WIM you have previously created offline
2877• a new capture from a reference computer
2878Again, an easy way to get started is to add an image like Windows 10 Enterprise from
2879an ISO using the “Add Install Image” option on the Install Images container.
2880Once an install image is added, some options can be configured on the image, such as
2881permissions for who is allowed to install it (otherwise, anyone might be able to PXE boot any
2882computer and receive a corporate image from WDS). You can also associate an answer file
2883with the image that you have previously authored in Windows SIM, as shown in Figure  4-9 .
2884Figure 4-9. Adding an answer file to an image in WDS
2885103CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2886To test that WDS is working, take a computer with PXE support (a virtual machine
2887is best, as it has native support for this without any other drivers, and can easily be
2888reset after testing) and attempt to boot to the network. For most computers, F12 on the
2889keyboard (or Enter, for virtual machines) must be pressed to confirm the network boot.
2890Once the client computer has found the WDS server and acquired its IP address, a menu
2891is shown, such as the one seen in Figure  4-10 .
2892Figure 4-10. PXE boot menu
2893Here, you can see the capture and discover images that you created earlier. You can
2894now image a machine that was prepared with Sysprep up to the server, or download one
2895to the computer.
2896â–  Tip Naming your images with an easy-to-understand naming convention, such as the
2897one in Figure 4-10 , will help your technicians connect correctly to WDS.
2898104CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2899Troubleshooting WDS
2900There are many moving parts to WDS, as it relies on several server-side components, as
2901well as on PXE and the network, to all behave in order for it to work. In this section, we
2902will look at some of the main areas that can go wrong and how to remedy them.
2903One of the most common issues that arises is having the incorrect DHCP settings,
2904such as missing options or incorrect server names or boot file name s .
2905Scenario DHCP Configuration
2906WDS and DHCP running on
2907the same server WDS must not listen on port 67. Set this during
2908the configuration wizard or later using the DHCP
2909properties tab on the server in the WDS console, as
2910shown in Figure  4-11 . Ensure you set both checkboxes
2911as advised. Usually done if DHCP is detected as being
2912installed first. Ensure that option 60 is set in the DHCP
2913scope/server options with a value of PXEClient .
2914WDS and DHCP running on
2915different servers in the same
2916subnet No configuration needed on WDS or DHCP. Broadcasts
2917allow clients to find both servers, which listen on port
291867 — DHCP for the IP address allocation and WDS for
2919requests to find it (both share the same port).
2920WDS and DHCP running on
2921different servers in different
2922subnets Configure options 66 and 67 in DHCP scope options.
2923Ensure that option 66 details the WDS server name and
292467 has the boot file name of either boot\x86\pxeboot.
2925com or boot\x64\pxeboot.com for 32-bit and 64-bit
2926client support, respectively.
2927105CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2928Figure 4-11. DHCP settings
2929Permissions on images can be a problem. The user performing the installation
2930needs NTFS permissions that allow them to read the relevant image file(s). Check group
2931memberships and the access control lists to ensure they can read them. Usually, default
2932permissions are fine, but it’s something to check that would prevent access to deploying
2933an image.
2934Reference computers will fail to capture unless they have had Sysprep applied first.
2935This is actually checked by the capture image process, and capturing is halted if it is not
2936found.
2937106CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2938Clients’ not booting to the network correctly is a common problem. Not all
2939computers may have the capability to perform PXE boots. Verify the network card can
2940perform this, and also check the PXE boot option in the computer’s BIOS or UEFI, and
2941that the boot order has PXE at the top of the boot priority list.
2942Not having the right architecture boot images (x86/x64) is something to check as
2943well. x64 clients can happily use x86 boot images and x64 images, but x86 clients can only
2944use their own architecture images and will fail to locate boot images when PXE booting.
2945You can check which are available in the Boot Images container in the WDS console.
2946Configure and Troubleshoot MDT
2947Microsoft Deployment Toolkit , or MDT, is a free download tool from Microsoft that takes
2948deployment to another level, one of greater automation. MDT is not part of the Windows
2949ADK, so you must remember to download it separately (it’s approximately 20 MB in size).
2950You can download the Microsoft Deployment Toolkit from https://technet.microsoft.
2951com/windows/dn475741.aspx .
2952â–  Tip Always download the latest version of MDT, as it is constantly being revised for
2953new scenarios and operating systems. At the time of going to print, the current version is
29542013 Update 2. Ensure that the Windows ADK is installed before installing MDT. The versions
2955of MDT are tied to the ADK versions.
2956So, why do I need MDT in my life if I already have WDS and Windows SIM and the
2957other components of the Windows ADK? MDT can also be integrated with WDS and
2958SCCM (which will be covered in the next chapter). MDT is designed to help create end
2959to end solutions for deployment in order to create the lightest lite-touch process possible
2960without going the whole hog and using SCCM for zero-touch installations.
2961MDT has a management tool interface called the Deployment Workbench that
2962contains two main nodes: Information Center (documentation of how it works) and
2963Deployment Shares (the bit you configure). The first thing you must do with MDT
2964is to create a Deployment Share, which can be located on the local computer. The
2965Deployment Share is a shared folder that contains all the components that you will use
2966for deployments, such as scripts, driver packages, and images.
2967Once a share is provisioned, the full structure of MDT can be properly seen, as
2968shown in Figure  4-12 . You will recognize some similarities to WDS here, such as drivers,
2969but also some new containers, like applications.
2970107CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2971Figure 4-12. Deployment Workbench
2972Task Sequences
2973Essentially, with MDT you will create task sequences , which are deployment processes
2974that incorporate installing the operating system, drivers, applications, and more to client
2975computers.
2976There are several key task sequences that you can leverage that MDT has precreated
2977the structure of. These are shown in Figure  4-13 . This includes scenarios like building the
2978reference computer in the first place or new installations or upgrades of Windows. A good
2979place to start is the Standard Client Task Sequence. This walks you through the process of
2980installing Windows with automation.
2981108CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2982Figure 4-13. The New Task Sequence Wizard
2983â–  Note Before building task sequences, you need to populate MDT with the building
2984blocks that MDT uses, such as operating systems, drivers, applications, and language packs.
2985109CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2986As we need at least an operating system for this task sequence, we will look at adding
2987that first and come back to the task sequence later. Adding an operating system gives you
2988the choice of adding one of the following:
2989• A full set of source files (such as from an ISO)
2990• Custom image file (from a WIM you previously built)
2991• An image stored on WDS (that you previously created)
2992Now that the Deployment Share contains at least an operating system, we can
2993create the task sequence. Start the task sequence by configuring the general settings
2994for information such as name and ID. Then, after selecting the sequence type from the
2995templates just mentioned, you can pick from operating systems you have previously
2996added, as shown in Figure  4-14 .
2997Figure 4-14. Selecting an operating system image in a task sequence
2998110CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
2999Information can be added to the operating system — similar to with answer-file
3000creation in Windows SIM — such as product key and admin password. Remember, of
3001course, that the ADK components live underneath MDT, so we are building on the tools
3002already installed and adding interfaces to those tools here. Of course, for true lite touch,
3003you need to automate as much as possible, but anything left blank that setup would
3004require will result in a user prompt during setup. The goal usually is to streamline this so
3005that once the task sequence is in motion on a client computer the technician can walk
3006away and leave it.
3007After the task sequence is created, you will need to go back and edit some of the
3008settings to suit your requirements; for example, adding applications or partitioning
3009the hard drive before installation. An example of this is shown in Figure  4-15 , where an
3010application is added to the sequence.
3011Figure 4-15. Editing a task sequence
3012111CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3013Adding Applications
3014Application source files can be added to the Deployment Share for integration into your
3015task sequences. More complex task sequences will add applications to the deployed
3016operating system as a post-installation process (as opposed to them being included in the
3017image in the first place). While you can potentially add any application, you need to make
3018sure that the application can be installed without user intervention. For example, you
3019could install a Windows Installer – based application by specifying the /q parameter on
3020the command line when running the setup program, such as XMLnotepad.msi /q.
3021â–  Tip Testing is generally important for task sequences anyway, but especially for
3022application installers that you want to run silently (without user intervention). It may take a
3023few runs before you get it to run perfectly, as you may need to supply information in an XML
3024or other file for input to the installation program.
3025To add an application to the Deployment Share, in the workbench, right click
3026Applications and add the application, pointing the wizard to where the installation
3027files reside so that they can be added to the share or referenced from a network share.
3028It’s common practice for administrators to manage a software share on the network for
3029centrally locating application installation programs. This can also include scripts and
3030transform files used for silent installation and is useful in helping keep software up to date
3031without having to rebuild the whole image.
3032Packages
3033One useful feature of MDT is the ability to add other OS packages to the task sequence.
3034For example, this can include language packs, Windows update packages , and other
3035related files. These must be in the file format of .CAB or .MSU for installation to the image.
3036Adding packages is done similarly to how applications are added — by pointing the wizard
3037to the source files’ folder on the drive, which adds them to the Deployment Share.
3038Updating the Deployment Share
3039Once you have created a task sequence or configured any settings in MDT, you will be
3040required to update the Deployment Share . This step is not obvious to the uninitiated, but
3041is essential. This process checks for changes and rebuilds a boot image incorporating the
3042new changes made. This boot image is created as both a WIM file and an ISO file. You
3043can then choose to add this to WDS as a boot image or add it to a USB drive for booting
3044without WDS. It is possible to build USB media that contains everything that is needed
3045to provision a remote computer without the network being present, which is ideal for
3046remote workers, such as field engineers or home workers. Again, ADK is being used
3047underneath to full effect to build the media.
3048112CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3049To test the media, you can either boot using the lite-touch boot image from USB or
3050WDS or connect to the Deployment Share and run the script to load the Deployment
3051Wizard, which controls the rest of the process on the client computer (such as \\server\
3052DeploymentShare$\Scripts\LiteTouch.vbs ).
3053Troubleshooting MDT
3054MDT itself is pretty complex, but also builds upon many other components, so
3055troubleshooting can be tricky. Add to that the fact that most clients are connecting over a
3056network to the Deployment Share and/or WDS and you almost have a recipe for disaster!
3057Well, maybe not quite that bad, but you need a sound methodology for approaching
3058troubleshooting. Try to understand what’s going wrong and why. For instance, if you
3059cannot update the Deployment Share, do you have access to the share? Are the WinPE
3060components from ADK installed?
3061â–  Tip Ensure all relevant ADK components installed; otherwise, updating Deployment
3062Share can fail—for example, if you did not have the WinPE components installed. You will
3063need at least Deployment Tools, WinPE, and optionally USMT tools and ICD from the ADK.
3064Sometimes the easy things are the ones that are overlooked, so it’s well worth
3065checking access control lists for the share and NTFS permissions for the accounts
3066performing lite-touch deployments on the Deployment Share. Note also that by default
3067the share is a hidden share (it ends with a $ ; for example, deploymentshare$ ) so don’t
3068expect to easily browse to it over the network!
3069From a diagnostics perspective, we are well catered for with MDT—it’s almost like
3070they expect it to fail! On a client performing a lite-touch installation, a series of logs are
3071created that can be interpreted if there is a failure. These live in C:\MININT\SMSOSD\
3072OSDLOGS during setup and later get moved to %WINDIR%\SMSOSD or %WINDIR%\TEMP\SMSOSD
3073after a successful installation.
3074Among the logs is BDD.log , which is the main aggregated log to check. There are
3075also other logs, such as LiteTouch.log and WPEinit.log , that cover specific stages of
3076lite touch in more detail. The logs require a tool called Trace32 to help read them, which
3077is freely available online as part of the SCCM 2007 Toolkit. For more information, see
3078https://technet.microsoft.com/en-us/library/dn781088.aspx .
3079One area of MDT that has a massive amount of potential is two rule files named
3080customsettings.ini and bootstrap.ini . While they are fairly simple in construction,
3081the breadth of settings that these can touch during a lite-touch install are vast. It can vary
3082from whether to join a domain to more complex operations. You can edit the files directly,
3083but it’s easier to access them from the Rules tab and the Windows PE tab, respectively,
3084within the Deployment Share properties screen.
3085113CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3086An example of a bootstrap.ini file is shown next. The bootstrap file is copied to the
3087WinPE media, which is another reason why you need to update the Deployment Share
3088when you make a change:
3089[Settings]
3090Priority=Default
3091[Default]
3092DeployRoot=\\server\DeploymentShare$
3093UserDomain=Adatum
3094UserID=Technician1
3095UserPassword=Pa$$w0rd
3096SkipBDDWelcome=Yes
3097Customsettings.ini follows the same .ini file structure as just seen, but contains
3098settings such as time zone, domain join settings, admin password, and other OOBE settings.
3099It goes without saying that although it provides for great customization, it is only a text file,
3100so it is prone to user error in the form of typos and malformed parameters and values.
3101Deployment Hints, Tips, and Shortcuts (Including
3102Activation Issues)
3103As you have picked up on while reading this chapter, there are lots of technical tools,
3104files, and settings that make up a successful lite-touch deployment. Understanding these
3105moving parts is key to ensuring deployment success. From experience over the years,
3106there are a few tips to pass on that will help ensure that your deployments run smoothly.
3107Activation
3108First, let’s revisit Windows Activation . This was mentioned in Chapter 2 , but is worth
3109revisiting here. Most organizations tend to settle on one strategy for all clients to make
3110life simple, instead of mixing approaches. Choose either KMS, MAK, or Active Directory
3111activation. Try not to mix and match too much. Typically, for an AD-based network,
3112and assuming client support, at least Windows 8.1 is required; you would use this today.
3113Previously, many networks managed their own activation by using a KMS server. Not
3114having a KMS server available during a deployment, or having it in a remote office, can
3115be troublesome. It’s better to leverage the nearest domain controller, which in effect all
3116become KMS servers, eliminating a single point of failure on the network.
3117Be aware that activation is not just a one-time deal. For example, using KMS with
3118remote workers can be a problem. You may have deployed new images on laptops in
3119the corporate network, activated them, and then shipped them out to remote workers.
3120After 180 days, activation will occur again, but what if the PC is always remote? This is
3121something you must factor in, and a simple VPN connection may suffice, or else look at a
3122mix of activation methods, perhaps using MAK keys for the remote PCs if connectivity to
3123the workplace is an issue.
3124114CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3125â–  Tip Get to know slmgr.vbs . This tool is used with volume activation and has numerous
3126useful switches that are helpful for diagnosing activation states and issues. If you run
3127slmgr.vbs /dlv , for instance, it will display the licensing state, activation count, and more,
3128as shown in Figure 4-16 . For more options, type slmgr.vbs /? at a command prompt. Look
3129into /ato and /rearm especially.
3130Figure 4-16. Activation reporting with Slmgr.vbs /dlv
3131Drivers
3132Device drivers are needed for three different phases during a deployment. Those are
3133WinPE, setup itself, and post-installation of the operating system. Keep these as simple
3134as possible! Do you really need that fancy driver package from the manufacturer if a
3135standard built-in Windows driver will suffice? Do you need a video driver added in the
3136first two phases when we are working with simple interfaces? No. Keep the specialized
3137drivers down as far as possible, using built-in drivers wherever possible, and falling back
3138to manufacturer drivers when you have to.
3139115CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3140Drivers can always be added in the future through WDS and MDT to keep images
3141valid for new hardware. This doesn’t involve deploying the images, adding them, running
3142Sysprep, and then reimaging the computer. You can add drivers offline to your images in
3143both tools. The same can be said of updates too.
3144Sysprep
3145When running Sysprep , ensure you are using the correct version for the operating system in
3146question; for example, the copy of Sysprep that ships with Windows 8.1 cannot be used on
3147a Windows 10 computer and vice-versa. Sysprep generally works flawlessly, but does have
3148logs for its actions in the different passes that it uses. You’ll find these in the following areas:
3149• Generalize: %Windir%|System32\Sysprep\Panther
3150• Specialize: %Windir%\Panther\
3151• Unattended Windows Setup actions: %Windir\Panther\
3152Unattendgc
3153In terms of running Sysprep, try to keep the environment as clean as possible and
3154minimize tampering from end-user accounts. One reason for this relates to some of the
3155built-in Store apps, such as Mail and News. If these have been removed or updated by
3156users, Sysprep will fail, as it is expecting these to be present because they are in-box apps
3157that come shipped with Windows 8.1 or Windows 10. This can be a show-stopping fail for
3158Sysprep. A best practice is to always use a local administrator account to build and test the
3159reference computer. Keep down activations as well, as mentioned earlier in this chapter.
3160WDS
3161One area of WDS to look into is prestaging clients, which will help with minimizing
3162which clients WDS has to listen for. This involves associating a computer’s MAC address,
3163GUID, or DUID with a computer account in Active Directory. Once entered, you can
3164specify a default WDS server and default image to the computer. This can help automate
3165the deployment of images to known clients, and also helps prevent unknown clients
3166from using WDS in the first place, as now the PXE response setting of the server can be
3167changed to only respond to known computers. You can also ensure that the client resides
3168in the correct Organization Unit in AD so that it receives the correct group policies from
3169day one. This also means that you can use Group Policy as a way to deploy software into
3170your image at first boot/first logon, instead of cramming it into your image.
3171The Iceberg of MDT
3172Working with MDT can be a little like seeing an iceberg . When creating task sequences,
3173there’s a heap of settings below the waterline that you may never see unless you go
3174looking for them. Always look at the settings after running the wizard. There are so many
3175options in there (too many to call out here) that would potentially go unnoticed if you
3176only created a task sequence in the wizard and walked away. That would be a real shame,
3177as there really is so much below the surface.
3178116CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3179This also extends to the bootstrap and customsettings ini files. If you plan to use
3180MDT half seriously, you should spend time reading up on them and experimenting with
3181their settings to really derive the most benefit from MDT. Also, in the same vein, you may
3182want to look at spending time learning the passes of Windows Setup and how you can
3183automate setup.
3184Testing, Testing, Testing
3185Lots of iterative testing is required, not always because it didn’t work the first time, but
3186rather to ensure that you iron out all the wrinkles in a deployment. For example, your
3187deployment may successfully install an operating system to a computer. Perhaps a part of
3188it didn’t work, yet it was not enough of a show-stopping event for MDT to fail the whole
3189task. You’ll certainly want to use virtual machines for testing, given their ease of reversal
3190capability.
3191Dream Chasing
3192When building images, it is tempting to make the most perfect image possible, with the
3193most applicable updates known to the world today. Be careful, as you can end up spending
3194lots of time chasing the dream and never wind up deploying anything, as by the time
3195you’ve parcelled everything you wanted, then put it through testing, another update comes
3196out and you must start over again! It’s OK for your image to not be 100 percent perfect. So
3197what if a handful of updates have to be installed post-install? Is that so bad? There has to
3198be a trade-off with perfection and what you can afford to live with in your deployment.
3199Summary
3200You’ve learned through the course of this chapter what lite touch means and how moving
3201from high-touch deployment to lite touch involves many more tools and technologies. It
3202also means more automation, and that does mean time savings. Invest the time now into
3203learning those tools to save time later. You’ll be glad you did, as it means you can reuse that
3204knowledge over and over and apply it to other operating systems you deploy in the future.
3205We’ve covered what is involved in creating a reference computer and turning it into
3206an image, using Sysprep along the way to generalize the machine settings. Imaging the
3207computer using DISM on a single computer is fine, but moving that up to an Enterprise
3208scale involves drafting in other tools, such as Windows SIM, to create answer files that
3209automate Windows Setup and OOBE in preparation for end-user use.
3210Windows Deployment Services has been explained to give you the option of storing
3211and accessing images from a network server. Taking advantage of PXE boot, modern
3212computers can access a WDS server whenever a new image needs to be installed on a
3213computer, or if the computer runs into problems and it would be quicker to reimage the
3214computer back to a stable state than to spend time fixing it.
3215Finally, we’ve looked around MDT and how it can really help automate not only
3216the stages of Windows Setup, but beyond that to add drivers, applications, and other
3217packages to your images for more complete deployments to the desktop.
3218117CHAPTER 4 â–  AUTOMATING WINDOWS DEPLOYMENT WITH LITE TOUCH
3219Despite this chapter focussing on lite-touch deployments, and most people using
3220that approach to configure clean installs of operating system images, don’t forget that
3221Microsoft prefers that users upgrading to Windows 10 perform in-place upgrades, and
3222tools like Windows SIM and MDT are geared for those scenarios as well.
3223In the next chapter, we will be looking at taking this a step further and building
3224toward zero-touch deployments.
3225118CHAPTER 5
3226Automating Windows
3227Deployment with Zero Touch
3228In this chapter, we will be exploring how System Center Configuration Manager (SCCM)
3229can be used to take automation of deployments to the highest possible level — that of
3230zero touch. Simply put, this means that we can deploy an operating system and all of its
3231applications by centrally controlling the process, without requiring any input from the
3232end user or a technician (which would have been the case with lite touch).
3233Throughout this chapter, we will be building on the technologies and tools explained
3234in Chapter 4 , so everything you now know about lite touch will be put to good use here.
3235â–  Note There are several versions of System Center Configuration Manager in general
3236use today. This includes the 2007 R3 version and the 2012 R2 version. For the purposes of
3237this chapter, we will focus on the current one at the time of going to press, which is 2012.
3238Most of what is covered in this chapter equally applies to all versions, but some screenshots
3239and features and supported operating systems are different between the versions; for
3240example, Windows 10 deployments are only supported on the 2012 version. For simplicity,
3241we will describe the versions generically as just SCCM from now on.
3242Zero-touch deployments are often also known as zero-touch installations, or ZTI,
3243just like lite touch is often known as LTI. Although the term differs, we are talking about
3244the same thing, and the one constant is using a management tool like SCCM. Other
3245management tools on the market offer similar features, but this chapter only shows how
3246to achieve zero touch by using SCCM.
3247Overview of System Center Configuration
3248Manager
3249What is System Center Configuration Manager (SCCM) ?
3250© Chris Rhodes and Andrew Bettany 2016
3251C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
3252DOI 10.1007/978-1-4842-1827-3_5
3253119CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3254SCCM is one of the component technologies in the Microsoft System Center suite.
3255This includes:
3256• System Center Configuration Manager
3257• System Center Virtual Machine Manager
3258• System Center Operations Manager
3259• System Center Service Manager
3260• System Center Orchestrator
3261• System Center Data Protection Manager
3262• System Center App Controller
3263• System Center Endpoint Protection
3264These components can be used on their own independently or, in many cases, can
3265be linked together and linked to other software, such as Windows ADK. SCCM itself is
3266designed to aid the IT administrator in several ways. These include asset intelligence
3267through client reporting of hardware and software, application and operating system
3268delivery, and patch management.
3269â–  Note The Windows ADK is required to be installed as a prerequisite before SCCM can
3270be installed as it requires many of the component parts, such as WinPE, USMT, and other
3271tools that are required for operating system deployment.
3272The way it works is by having a central database managed by one or more servers
3273that have clients reporting in using an installed agent. The agent needs to be installed
3274on computers in order for them to be known to SCCM, and therefore to be able to be
3275targeted by the administrator when an application, operating system, or setting needs
3276to be deployed. This is undertaken silently in regards to the end user of the computer,
3277and the agent takes care of when and how to perform the configuration change. When
3278the changes are applied, centralized reporting at the server side can be used to view the
3279success or failure of that change for that one computer, or across the whole environment.
3280A typical SCCM deployment contains several components that work together.
3281In larger environments, these roles are found on dedicated servers, while in smaller
3282networks some roles are found together on the same server.
3283Depending on the size of the network, the location of offices, clients, and other
3284factors will determine the structure of your SCCM deployment. It’s beyond the scope of
3285this chapter to elaborate on the design of an SCCM hierarchy, but it will at least contain
3286the following items.
3287120CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3288Sites
3289• A primary site – the minimum requirement. A primary site can
3290exist on its own or have other primary sites in the hierarchy
3291alongside it, and can also have child secondary sites.
3292• Secondary sites (optional) – secondary sites relieve the burden
3293of the client load and traffic from the primary site and allow for
3294localization of services; for example, to account for slow WAN
3295links. Secondary sites always include a management point and
3296distribution point. Database replication occurs within the primary
3297site.
3298Site System Servers
3299All servers running SCCM are regarded as site system servers and can have any of the
3300following main roles installed (although there are more roles available):
3301• Site Server – first server in the site that contains the core services
3302• Database Server – runs SQL Server to act as the database store for
3303SCCM data
3304• Management Point – main reporting point for clients when
3305they check on their hardware and software status. Location for
3306distribution of policies to clients.
3307• Distribution Point – server that maintains the applications,
3308packages, boot files, and operating system files that will be
3309deployed to clients
3310• Software Update Point – interfaces with WSUS for synchronizing
3311software updates into SCCM, and ultimately updates to clients
3312â–  Note A primary site always includes at least the site server, management point,
3313distribution point, and site database site system roles. Other roles are optional, and not all
3314are shown here.
3315Figure  5-1 shows a typical deployment scenario for a small-to-medium-sized
3316company deployment of SCCM, utilizing a single server with all the mandatory site server
3317roles installed.
3318121CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3319SITE
3320SERVER
3321PRIMARY
3322SITE
3323CLIENTS
3324Figure 5-1. A typical SCCM deployment
3325Clients
3326SCCM clients are computers that have the SCCM agent installed on them. At this time,
3327the supported list of operating systems runs from Windows XP to Windows 10, and also
3328Windows Server 2003 and above. Interestingly, non-Microsoft operating systems such as
3329Ubuntu and MAC OS X are also supported.
3330The client installs an agent that reports back inventory knowledge to the
3331management point, and the client also receives instructions on installations and other
3332tasks it needs to perform. Think of it like an obedient servant, always carrying out its
3333master’s instructions. The agent can perform various tasks, including applying software
3334metering rules, asset inventory, software updates, and more.
3335Table  5-1 shows the different methods for installing the client agent software onto
3336Windows computers (processes differ for Linux and Mac), including a push install
3337method, deploying as part of an image, or by using Group Policy software installation. To
3338some extent it doesn’t matter how it gets there, as long as it does. And when it does, it will
3339ensure the client agent starts to report in to the management point it has been told to use.
3340122CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3341Table 5-1. SCCM Client Installation Options
3342Installation Method Description
3343Manual installation From installation media by an administrator
3344Client push Uses native push method in SCCM to remotely install the agent
3345to discovered computers
3346GPO Distributes using Group Policy software installation
3347Software update point Uses WSUS for installation
3348Logon script Integrates install into a logon script
3349Upgrade Uses SCCM software deployment to upgrade an earlier version
3350client
3351Task sequence Deploys as part of a lite- or zero-touch installation
3352Image deployment Incorporates into a WIM-based deployment
3353Configuring OSD in System Center
3354You learned in Chapter 4 how MDT and Windows SIM help us to produce a healthy level
3355of automation through task sequences and answer files, respectively. Here, we will focus
3356on how SCCM can bring more to the table and advance that technology even further. In
3357the language of SCCM, the process of deploying operating systems is commonly referred
3358to as Operating System Deployment (OSD) .
3359What Is OSD?
3360SCCM can be used to perform deployments from the following four scenarios:
3361• Image capture of a reference computer
3362• User state capture and restore using the User State Migration Tool
3363(USMT)
3364• Operating system image deployment to a collection of computers
3365• Creation of task sequences (which can contain a variety of tasks)
3366123CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3367In Figure  5-2 , you can see the operating systems node in the Software Library
3368concerning OSD. This area in the management console holds some containers that
3369should look familiar by now, as they have overlapping features with MDT and WDS .
3370These include:
3371• Drivers – downloaded device drivers imported into SCCM
3372• Driver packages – same as in MDT
3373• Operating system images – WIM files
3374• Operating system installers – OS ISOs for deployment
3375• Boot images – capture and discover WIMs added here
3376• Task sequences – similar to MDT task sequences
3377Figure 5-2. The operating systems node in the software library
3378You should by now be picking up on the fact that your knowledge of MDT and WDS
3379is carried over here (albeit in a slightly different interface, and with further options yet to
3380be explored at this point).
3381124CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3382Configuring SCCM for OSD
3383Although support for much of the feature set required for OSD is ready to go, there is
3384one area in particular that requires additional configuration . If you intend to use PXE
3385boot clients to boot to SCCM, then you must install WDS on site systems that have the
3386Distribution Point (DP) role installed, and then configure it to listen for clients (as if
3387building a regular WDS server). This allows Configuration Manager to use the PXE
3388listener components that are found natively in WDS.
3389Once WDS is installed on the DPs, support must then be enabled by clicking on the
3390properties of the DP object, then on the PXE tab. You then configure “Enable PXE support
3391for clients” and at least the “Allow this distribution point to respond to incoming PXE
3392requests” option, and maybe also to respond to unknown clients, as shown in Figure  5-3 . I’ll
3393note here also that adding a password can be useful to help prevent users from accidentally
3394reimaging their PC, if the boot order becomes changed.
3395â–  Tip When making changes to a DP, such as adding an image, you are required to
3396update the distribution point. This is necessary to ensure that the files can be found on the
3397DP, ready for clients to use. This is achieved by choosing the option to distribute content. You
3398then choose which DPs (or DP groups) will receive the files. This must be done in advance of
3399deploying this to clients, and it can take time to distribute multi-gigabyte files.
3400125CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3401Figure 5-3. Configuring PXE support on a Distribution Point site server
3402The next steps to configuring OSD support are similar to how WDS is configured —
3403images are required. Images are, of course, boot images and installation images. Just like
3404with WDS, you could add some default images from installation media like Windows ISOs,
3405or you could custom create your own with the ADK tools. When it comes to installation
3406images, you could actually use SCCM to create a deployment task sequence that captures
3407an existing computer, including the Sysprep stage and capture process. Alternatively, if you
3408manually created an image using DISM, you could also add this here too.
3409Images are required for the next steps in the process, which is to distribute images to
3410client computers using either lite- or zero-touch methods. This will be explained in the
3411next section.
3412126CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3413Integrating MDT with System Center
3414Although task sequences appear in the software library, as you saw in Figure  5-2 , full
3415MDT functionality is not present by default. You can work with the task sequences node
3416in the library and create task sequences that deploy an operating system image, or that
3417deploy and capture a reference machine, for instance, but it’s not the same as actually
3418using MDT, although there are many crossovers.
3419To get the most out of task sequences and deployment in general in SCCM, you
3420should install the latest copy of MDT into your environment. This brings around 280
3421enhancements to the standard feature set. You integrate MDT and SCCM by installing
3422MDT on a computer that has the SCCM management tools installed (typically your
3423admin workstation where you will be creating task sequences). Once this has completed,
3424from the Start Menu on that computer, load the Configure ConfigMgr Integration
3425application that got installed with MDT. This tool integrates the two technologies. You
3426need to identify the site server name and site code, as shown in Figure  5-4 , to get it
3427configured.
3428Figure 5-4. Configuring SCCM and MDT integration
3429127CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3430Now that this is installed, reopen the SCCM management console, where new
3431options will be available, such as Create MDT Task Sequence , as shown in Figure  5-5 .
3432Figure 5-5. MDT Task Sequences in SCCM
3433MDT task sequences parallel the functionality you would expect to see in the
3434MDT Deployment Workbench, but the benefit here is the ability to leverage the extra
3435capabilities of SCCM for deployment. You may recall from Chapter 4 that MDT has
3436various task sequences and that SCCM natively does as well. Table  5-2 summarizes the
3437choices available.
3438128CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3439Table 5-2. Microsoft Deployment Toolkit Task Sequences
3440MDT Task Sequence Name SCCM Task Sequence Name MDT & SCCM Integrated
3441Task Sequence Name
3442Sysprep and capture Install an existing image
3443package
3444Standard client task sequence Build and capture a reference Client replace task
3445o/s image
3446sequence
3447Standard client replace task
3448sequence Install an existing image
3449package to a virtual hard
3450drive
3451Microsoft deployment
3452custom task sequence
3453Standard client upgrade task
3454sequence Custom task sequence
3455Server task sequence
3456Custom task sequence
3457Client task sequence
3458User-driven installation
3459replace task sequence
3460Lite-touch OEM task sequence
3461Standard server task sequence
3462Standard server upgrade task
3463sequence
3464Post OS installation task
3465sequence
3466Deploy to VHD client task
3467sequence
3468Deploy to VHD server task
3469sequence
3470So, on the face of it, MDT has the widest range of choices for task sequences. One
3471thing to note, however, is that the integrated task sequences in SCCM all take shape based
3472on the same set of choices, and although they appear differently, they still have options
3473that parallel MDT task sequences. An example of this can be seen in Figure  5-6 , where
3474there is the option to capture an image as part of the sequence or to skip the capture and
3475deploy only.
3476129CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3477Figure 5-6. Integrated SCCM/MDT task sequences
3478Of course, the whole point of SCCM deployments is to take advantage of zero-touch
3479installations. This is where the task sequences in SCCM really come into their own. To
3480make a task sequence zero touch, there are two main areas to configure. You can see
3481in Figure  5-6 the step named Deployment Method , which is where you are prompted if
3482you would like the task sequence to be zero touch or user driven (a.k.a., lite touch). If
3483you choose zero touch, the task sequence prompts for input for the settings package, as
3484shown in Figure  5-7 .
3485130CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3486Figure 5-7. Settings package choices in the task sequence
3487At this stage you can point to a settings package you have already created or you can
3488have it generate one for you. This creates an answer file for setup and a customsettings.ini
3489file . Each has default choices (mostly in the answer file) that remove the need for any user
3490input at all when the task sequence is being deployed to clients, when running Windows
3491setup on the target computers.
3492This is another example of where the ADK tools are being used under the hood for
3493you, and a level of abstraction from those is being achieved in SCCM. Another area where
3494MDT integration brings more to the table in SCCM is when you edit the task sequence
3495after creation. This gives a very wide range of options for extra customization, including a
3496specific menu of options from MDT, as shown in Figure  5-8 .
3497131CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3498Figure 5-8. Editing a task sequence and adding MDT steps
3499Some great examples of this are adding PowerShell scripts (which could basically
3500be doing almost anything, so it extends the scope of the task sequence almost infinitely)
3501and some useful components like adding language packs, which is useful when you have
3502multi-language deployments of an image.
3503Once you have created a task sequence, you can deploy this to a collection.
3504Collections are groups of computers that you create in SCCM. These can have a direct
3505membership (like a static membership) or be based on a dynamic membership; for
3506instance, the “All Windows 7 computers” option has a rule that checks the operating
3507system version. There are some default collections in SCCM, but usually administrators
3508will want to create several of their own.
3509132CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3510To deploy the task sequence, you will use the “Deploy Software Wizard” option by
3511selecting the object and selecting the “Deploy” option for it. This then asks you which
3512collections you would like to distribute it to and whether this is a required or optional
3513deployment. You can see some of these settings in Figure  5-9 . Required deployments
3514are useful when you want to ensure that all computers in a group or department are
3515deployed at the same time, such as overnight. You also have the option of scheduling the
3516deployment, and even using “wake-on” LAN functionality to wake systems up at night
3517and install the package before shutting the system down again.
3518Figure 5-9. Deploying a task sequence to a collection
3519133CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3520To summarize the process end to end of creating a zero-touch installation, a high-
3521level overview version of the steps is presented here:
35221. After installing SCCM, install WDS and configure PXE boot if
3523required.
35242. Install MDT and integrate MDT with SCCM.
35253. Create new task sequence(s).
35264. Choose to install an image with the option of capturing the
3527source computer first, and also backing up and restoring user
3528state with USMT.
35295. Ensure that zero touch is selected and a settings package
3530removes user input.
35316. Edit the task sequence for further customization.
35327. Include updates, applications, and the SCCM client
3533installation package.
35348. Distribute content to distribution point(s).
35359. Deploy to collection(s).
353610.
3537Verify success using the reporting functions of SCCM.
3538Monitoring and Troubleshooting Zero Touch
3539So, with all this enterprise software in SCCM, layered upon the Windows ADK, resting on a
3540SQL Server database, and augmented with WDS and MDT, what can possibly go wrong?!
3541Clearly there are many moving parts to this machine. No longer do we have
3542an application like Windows SIM creating answer files that are used in a lite-touch
3543installation of Windows. SCCM brings a world of asset intelligence, reporting, and new
3544methods of installing operating system images. A working knowledge of how System
3545Center Configuration Manager works is really needed in order to troubleshoot it
3546effectively. While that may be beyond the scope of this chapter, this section will give you
3547some pointers and tips to help you troubleshoot your zero-touch installations.
3548Distribution Points
3549There are several reasons why a deployment may fail because of distribution points.
3550Some are more straightforward than others. The main tip is to ensure that the distribution
3551point(s) have been updated. You can choose which DPs get copies of the files that
3552make up your task sequence, which includes the installation and boot images. It’s not
3553necessarily the case that all DPs have the ability to serve clients with your images, as you
3554may not have included them all when distributing the content. You should check which
3555DP(s) are configured to receive your task sequence and change it as needed to include
3556other DPs that serve affected clients.
3557134CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3558■ Tip Consider using fallback DPs as well to avoid clients’ not installing due to their
3559preferred DPs not being available or not storing the content in the first place.
3560You can also run into issues where remote clients do not install the task sequence.
3561This is actually a setting on the task sequence that can be enabled or disabled for remote
3562clients. The default is that they would not install it.
3563Don’t forget also that shifting multiple GB images does take time, and you need
3564to be patient to let that happen before deploying the OSD task to clients. You can use
3565the console to check on the status of this before starting a deployment. If a DP is being
3566updated when you begin a deployment, that deployment will fail with an error.
3567â–  Tip SCCM 2012 R2 now has the ability to deploy cloud-based distribution points that
3568are intended to serve remote workers by using Microsoft Azure–based DPs. This can help
3569solve issues related to not finding the closest site correctly or a lack of bandwidth, especially
3570with OSD deployments.
3571Logs
3572During a task sequence , the client writes to a log file named SMSTS.log . Depending
3573on where in the sequence it is, the file may be in one of several different places on the
3574machine. For instance, it resides in x:\windows\temp\smstslog\smsts.log during the
3575PXE stage. At the end of the process, it can be found in C:\windows\system32\ccm\logs .
3576This is the main log and is the most important one to start with for troubleshooting task
3577sequences specifically, but it’s worth noting that there are literally dozens of log files in
3578SCCM that can help to diagnose faults across all aspects of the product.
3579Monitoring
3580With zero touch, the whole point is that no one needs to be there to babysit the installation
3581process . This begs the question: how can you tell it worked? SCCM has a rich reporting
3582feature set for you to see what is going on at any point. Here’s a few areas to look at to help
3583assist you in understanding which clients have/have not received an operating system:
3584• With MDT integration, real-time monitoring data can be viewed
3585from within the MDT Deployment Workbench. In the Deployment
3586Workbench, expand MDT Production and look at the Monitoring
3587node. This will show the progress of the deployment process.
3588• You can also check the Deployments node in the Monitoring
3589area of the SCCM Management Console to check on the overall
3590status (compliance) of computers that should have processed the
3591installation.
3592135CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3593•
3594Reports in the Monitoring area in the console can be used in
3595conjunction with SQL Server Reporting Services to create and run
3596reports on all kinds of aspects of SCCM, including OSD.
3597Task Sequences
3598A few simple things to check in task sequences often show you missed options. Check the
3599following:
3600• Does the task sequence list the package as required or available ?
3601If required , then clients should process it if it applies to their
3602collection. If it’s available , then the default is not to install it, but
3603rather to offer it optionally.
3604• Did you use a settings package, and does it contain all the
3605customization necessary to fully complete an installation without
3606user input? There are so many settings that can be configured in
3607customsettings.ini , and you will need to validate that the data
3608is good, no typos of course, and that it adheres to the format that
3609it is expecting.
3610• If you are not sure where a task sequence is failing, configure
3611the task sequence so that it is visible to the end user so you can
3612interactively view which step is failing. This is really useful during
3613testing when bottoming-out issues.
3614Clients
3615There are all sorts of reasons why a client doesn’t successfully get installed. One quick
3616check is to see which collection(s) the client belongs to. Don’t forget — some collections
3617may be using a dynamic membership that uses a query to determine membership, so just
3618because PC1 was a member of Collection1 yesterday doesn’t mean it is today. You can
3619add and remove PCs from collections as needed.
3620Generally speaking, the SCCM agent on a client is fairly bulletproof, and you should
3621resist uninstalling it and reinstalling it in an attempt to solve problems. This doesn’t
3622usually solve them anyway, as typically problems are not on the client itself.
3623â–  Tip On boot images, enable support for the Windows command prompt by configuring
3624the Customization tab on the boot images. This will allow a technician to press F8 during
3625OSD deployment on a client for troubleshooting anything locally outside of the OSD
3626processes, such as running Diskpart, IPConfig, or other command-line tools.
3627136CHAPTER 5 â–  AUTOMATING WINDOWS DEPLOYMENT WITH ZERO TOUCH
3628Clients can fail to connect to the PXE server during boot. Check the obvious things,
3629like whether the DHCP server has enough spare addresses. But also look into whether
3630you have a network admin account created for the PXE clients so as to be able to connect
3631to SCCM from bare-metal installs. By default, this will need to be created from scratch, so
3632PXE boots don’t work out of the box.
3633Check to see if the necessary drivers are present in your images. You will need, as a
3634minimum, network card drivers for WinPE and the installation phases. This may involve
3635adding the same drivers twice over.
3636Summary
3637In this chapter, you have learned how to create zero-touch deployments (often known
3638as ZTI). Layering System Center Configuration Manager onto the Windows ADK can
3639help you create task sequences more easily and with a greater depth of settings for either
3640lite-touch or zero-touch installations. SCCM also goes beyond deploying the operating
3641system and applications though, as it is an enterprise-class product that can be used to
3642collect hardware and software inventory information, deploy configuration settings and
3643applications, and also meter their use. We’ve really only skimmed the surface of SCCM’s
3644capabilities in this chapter, and perhaps this may inspire you to find out more.
3645More important, though, this chapter has sought to educate you in how to create zero-
3646touch deployments so you are able to move task sequences you learned about in Chapter 4
3647using MDT on its own up to the next level and be able to instruct entire collections of
3648computers that they need to install your task sequence at a time of your choosing. You will
3649need to experiment with the capabilities you have learned about here and create a test
3650lab where you can build and trash, many times over, the environment in order to be fully
3651confident that your task sequence can be deployed to 10,000 computers hands-free!
3652137CHAPTER 6
3653Updating and Maintaining
3654Windows
3655Why bother? It worked when it left the factory, didn’t it?
3656Operating systems today are more complex than ever before. The sheer amount of
3657lines of code that goes into making an operating system (OS) runs into the millions. There
3658is going to be the occasional bug that needs fixing, but updates are more than just bug
3659fixes. Modern operating systems receive updates that cover a range of different areas,
3660which will be explored in this chapter.
3661One thing that needs to be understood early on is that applying updates is very much
3662a facet of supporting modern operating systems (and not just Windows). Understanding
3663how and why updates are applied and the infrastructure that supports this is vital to
3664ensuring that computers are up to date and continue to function correctly.
3665This is, in fact, no different than other technologies we consume in our everyday
3666lives. Car engine management systems, smart TVs, set-top boxes, and more all use
3667this same principle, and if you think about it, it makes sense. Updating your TV or
3668set-top box allows you to discover new channels or content not previously available
3669to you. Updating your car allows for better engine and fuel performance based on
3670field data collected from hundreds of cars driving millions of miles.
3671Failure to update computers is not really an option in today’s world. If a vulnerability
3672exists, has been identified, and has had a fix put out, then there is a duty of care by the IT
3673professional to ensure that the computers that they look after get that update installed as
3674quickly as possible. That said, there is a trade-off between getting a machine up to date as
3675promptly as possible and the need to pause and reflect on the potential negative impact
3676that could occur if the update fails and puts the machine into a non-working state.
3677In this chapter, we will explore these issues and learn how Windows can be
3678configured appropriately and how Windows Server Update Services (WSUS) can be
3679employed to control how and when updates are deployed in an organization.
3680Updates vs. Upgrades
3681Before you learn more about how to configure updates, it’s important to understand the
3682difference between updates and upgrades and the different types of updates available to
3683install.
3684© Chris Rhodes and Andrew Bettany 2016
3685C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
3686DOI 10.1007/978-1-4842-1827-3_6
3687139CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3688Updates (commonly described as patches ) fall into several different classifications.
3689Not all of these are patches (or fixes), which it is why it’s not accurate to describe them as
3690such. Table  6-1 describes the different kinds of updates available.
3691Table 6-1. Update Configuration Options
3692Update Type Explanation
3693Critical Update A fix that addresses a non-security-related
3694critical bug
3695Definition Update Anti-malware or anti-virus definition
3696update for Windows Defender
3697Drivers Hardware device drivers
3698Feature Packs New feature release rolled into a product
3699Security Updates Fix that addresses a security-related
3700vulnerability
3701Service Packs Cumulative set of combined updates that
3702can be installed as one to save time and
3703provides a measured level of compliance.
3704Often also contains new features.
3705Tools Utility or set of tools
3706Update Rollups Like a smaller scale service pack, contains
3707a cumulative set of updates to install as a
3708single entity to save time and provides a
3709measured level of compliance
3710Updates Anything else not covered by security
3711updates, critical updates, or other category
3712to provide a fix for a specific issue
3713Upgrades New builds of Windows that bring new
3714features and fixes
3715As you can see, there’s a spread of different updates. Some are released almost daily,
3716as in the case of definition updates, and some on a much slower release cycle, such as
3717service packs or update rollups. It’s worth noting that some types of updates have over
3718time become less important. Service packs (SPs) are a prime example of this.
3719Going back over historical service packs, there has been a shift from fewer service
3720packs, where customers would often hold off deploying updates individually and deploy a
3721service pack once a year or so instead, to a release cadence where Microsoft has stopped
3722entirely in favour of smaller incremental updates or using the update rollup approach to
3723allow customers to milestone their release internally. As you can see from Table  6-2 , that
3724changeover is now complete.
3725140CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3726Table 6-2. Service Packs
3727Operating System Final Service Pack
3728Windows NT 4.0 6a
3729Windows Server 2000 4
3730Windows Server 2003 2
3731Windows XP 3
3732Windows Vista / Windows Server 2008 2
3733Windows Server 2008 R2 / Windows 7 1
3734Windows Server 2012 / Windows 8 None
3735Windows Server 2012 R2 / Windows 8.1 None
3736Windows 10 None
3737Upgrades (not to be confused with updates), describe whole new builds of Windows
3738that are released that contain new features. So, these are not really about bug fixes,
3739but more about delivery of new functionality to the operating system through feature
3740enhancements of existing apps/technologies or the addition of entirely brand new
3741features.
3742Configuring Windows Update
3743Since Windows 95, Microsoft has offered a service through which customers can
3744receive updates to their operating systems, and more recently other apps such as Office
3745applications. This was previously known as Windows Update, but later became known
3746as Microsoft Update (incorporating the updates to Office and other products). Within
3747Windows itself, there is a way to configure how Windows updates, and the feature is
3748known as Windows Update in the Control Panel, as shown in Figure  6-1 , a screenshot
3749taken from a Windows 8.1 computer.
3750141CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3751Figure 6-1. Windows Update in the Control Panel
3752Assuming for now that a computer is using the Microsoft Update location for
3753updates, and not WSUS, there are a few options can be configured around how it works,
3754such as how to download and install updates. These options are summarized in Table  6-3 .
3755142CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3756Table 6-3. Update Configuration Options
3757Option Explanation
3758Install updates automatically
3759(recommended) This is really the no-brainer option, and it’s also the
3760default. This will check for updates on a cyclical
3761basis, download them, and then install them without
3762interaction. This is really the best option for 99
3763percent of computers.
3764Download updates but let me
3765choose whether to install them Not a bad option, as it checks automatically for
3766needed updates and will download them to the
3767local drive, ready for installation. However, it won’t
3768actually install updates until the administrator of the
3769computer has consented to that.
3770Check for updates but let me
3771choose whether to download
3772and install them Similar to preceding option, but the decision of
3773whether to download is also placed in the hands of
3774the administrator.
3775Never check for updates (not
3776recommended) This is for the minority of cases where either an
3777alternative update strategy (e.g., manual installation
3778approach) is employed or there is no reason to install
3779updates, such as for a test virtual machine that does
3780not have network access.
3781Clearly Microsoft has a preference for Windows machines, and the naming gives
3782that away. But let’s reflect on these options. Installing updates automatically seems to
3783make perfect sense, as this is really a case of “let the computer get on with it.” So why
3784would you not want this? There are some situations where going “off-grid” makes sense.
3785Some computers will never connect to the Internet, or even to any network. There are
3786standalone computers that run factory floor – type applications that are not networked, or
3787virtual machine – based installations of Windows that are connected to private networks
3788or no network at all.
3789The other two options are halfway houses that can potentially leave computers in a
3790less than ideal state. If the computer, for example, is configured to download updates, but
3791to wait for an administrator to approve the installation, invariably the user will postpone
3792the install, as they are permitted to do so, because, by definition, they are using the
3793computer and will most likely not want to be distracted by the installation or a possible
3794reboot following it. The option to notify for download first also compounds that issue,
3795leading to situations where computers are not compliant for varying lengths of time — or
3796worse, computers that do not get the necessary updates installed at all.
3797143CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3798In other words, leaving matters in the hands of the end user may not be such a great
3799idea, as across a network, a systems administrator will not have an easy way of knowing
3800the overall state of computers without visiting them individually or relying on other tools,
3801such as System Center Configuration Manager or Microsoft Intune.
3802The remaining options in the user interface are more straightforward. Selecting
3803“Recommended updates” ensures that computers receive lower-tier updates that are not
3804flagged as critical or security. The different types of updates will be explored later in this
3805chapter.
3806Windows 10 computers have a different interface for configuration, but the options
3807are broadly similar. Figure  6-2 shows the configuration options for Windows 10 using
3808the new Settings app, rather than Control Panel, which was used in previous versions of
3809Windows.
3810Figure 6-2. Windows 10 update settings
3811You’ll notice that the main options are essentially hidden away from the main view
3812here, and that’s intentional. Microsoft has taken a much different angle on updates (and,
3813for that matter, upgrades) in Windows 10. Most users won’t go beyond this screen, where
3814they can check for updates and see when the update check was last performed.
3815It’s only when you dig a bit deeper that the advanced settings uncover more about
3816how it works. You can configure Windows 10 for “Automatic (recommended)” or, as
3817Figure  6-3 shows, “Notify to schedule restart.” So, in other words, you can’t postpone the
3818download or the installation in the same way as before.
3819144CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3820Figure 6-3. Advanced Windows 10 settings
3821This is a significant shift in direction, with the upshot being that Microsoft should be
3822better able to ensure that computers are receiving their updates more quickly and more
3823consistently. This is beneficial going forward, as computers across the world will be more
3824in step with one another, and there will not be as big a lag between managed devices
3825that are up to date and computers where it is not seen as important to be kept up to date.
3826There are exceptions to this, such as offline computers, ATMs, and other line-of-business
3827computers that cannot be connected to the Internet.
3828Also within the advanced options are options to defer upgrades (note the word
3829upgrades , not updates) and the ability to store updates on your computer for others to
3830use, and likewise to be able to obtain updates from other computers on your network. For
3831home networks or workgroups without WSUS servers, it is a great idea to be able to cache
3832bits to reduce the bandwidth used for common updates that would otherwise have to be
3833downloaded multiple times on the same network. You can even configure Windows to
3834solely obtain updates from local network computers. So, for example, in a small network
3835one computer can be designated to download the updates from Microsoft Update online,
3836and the rest can stream from this computer.
3837The ability to receive updates for other products that are curated by Microsoft
3838Update is also a benefit, especially when using products such as Microsoft Office.
3839Originally, Office updates were provided separately, but it makes sense to create a more
3840seamless experience for the end user where all major software, not just the operating
3841system, is covered by the same update process. This can also include software that
3842accompanies devices, such as mouse driver applications and other driver packages.
3843145CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3844Services
3845It’s important at this point to explain that there are a couple of services in Windows that
3846control how Windows Update works. First, there is the Windows Update service, which
3847does the heavy lifting of checking which updates are installed locally, checking against
3848the database of what is available, downloading, installing, and reporting on the state
3849of updates. This is clearly the main component for operations. It is supplemented by
3850the Background Intelligent Transfer Service (or BITS). This is a dependency service for
3851Windows Update, so both need to be running for updates to work. We’ll cover more on
3852this in the troubleshooting section later.
3853Windows 10
3854With Windows 10, Microsoft has taken a very different view of updates and upgrades,
3855as alluded to previously. This has a big impact on how you choose to update PCs going
3856forward, so it’s worth spending some time examining what the options are. Let’s start by
3857looking at the way versioning works.
3858We’ve already seen how the concept of service packs has vanished. In the past,
3859service packs gave many organizations an excuse for delaying their deployments of
3860Windows until a perceived stable level was reached. Taking this to the extreme, Microsoft
3861has announced that Windows 10 will be the last version of Windows that they produce,
3862and they will instead move to an update cadence of a continuously updating model, so
3863versioning becomes less relevant. This brings Windows in line with other software, such
3864as smartphone apps, where consumers do not expect a one-off development of code, but
3865rather a constant tweaking and improvement.
3866So, how does that work?
3867As you saw in Chapter 3 , Windows 10 devices will fall into one of four main
3868categories, which Microsoft calls servicing models. These servicing models distribute new
3869operating system upgrades . These are summarized in Table  6-4 .
3870146CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3871Table 6-4. Windows 10 Servicing Models
3872Servicing Model Explanation
3873Windows Insider Preview Program Designed for early adopters, software
3874developers, and enthusiasts who want cutting-
3875edge builds delivered as soon as possible in
3876order to test and evaluate new features. Carries
3877more risk than other models, but ensures the
3878most up to date state of features.
3879Current Branch (CB) The bulk of computers worldwide fit into this
3880category. Consumer PCs and devices will use
3881this as their default, and it cannot be disabled
3882on Home edition. The mainstream option.
3883Current Branch for Business (CBB) Includes Pro, Enterprise, and Education
3884editions. Allows organizations the ability to
3885defer upgrades up to four months.
3886Long-Term Servicing Branch (LTSB) For computers that run mission-critical
3887applications where up-to-dateness is not
3888required for greater long-term predictability
3889of build state. Lacks Edge browser, Windows
3890Store, Cortana, and other preinstalled universal
3891apps. Uses a specific SKU variant of Enterprise
3892edition named Enterprise LTSB.
3893Drilling into these a little further is necessary, as they are less widely understood
3894because Windows 10 is relatively new, despite the growing installed base. Microsoft
3895introduced the Windows Insider program while Windows 10 was in development to
3896allow users to sample a development version of the product (what would in the past have
3897been called a beta). Millions of people took Microsoft up on this. There are always going
3898to be people who want the latest and greatest, either to be ahead of the curve with new
3899technology from an enthusiast perspective or because they will be supporting Windows
3900or applications that use Windows with this in the future.
3901The Insider program allowed Microsoft to receive a massive amount of telemetry data
3902back on how users were using Windows, and also on what worked or what didn’t work, in
3903order to help fine tune Windows 10 for its eventual release. This worked out so successfully,
3904that Microsoft decided to continue the program even after Windows 10 was released to
3905the public at large. Users can opt-in their PC to being part of the Insider Program using
3906the Settings app in Windows 10, as shown in Figure  6-4 . It is not a permanent change, as
3907it is reversible, but users in the Insider Program must be aware that this carries some risk,
3908as they are using builds that have not had much real-world “air time” outside of being
3909developed and deployed at Microsoft. This is really Microsoft allowing early adopters to test
3910the waters and be a first wave of public testers. Only enable this feature on a test computer or
3911if you are happy to bear the risk and take regular backups of data.
3912147CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3913Figure 6-4. Enabling Insider builds
3914Within the Insider program there are two “rings”: fast and slow. These rings dictate
3915how frequently your computer receives new builds that are published to the Internet for
3916computers that have opted in. You can almost think of it as cutting edge and not-quite-so
3917cutting edge, but still ahead of the curve. You can switch between these at any time in the
3918Settings app after configuring it for first use.
3919â–  Note Insider builds are sourced from Windows Update on the Internet, so are not
3920applicable for distribution from a WSUS server. Signing up for Insider builds requires signing
3921in with a Microsoft account.
3922Current Branch (CB) is expected to be adopted by most small- to medium-sized
3923organizations and consumer devices. This will result in hundreds of millions of devices
3924at pretty much the same build level as one another at any given point in time. This
3925distribution of builds ensures that the widest and most diverse set of computer hardware
3926and industries is running these builds. If anything goes awry, it will be quickly spotted
3927by the telemetry data (although in theory this should not occur due to tens of millions of
3928Insider computers having run these first).
3929Computers using Current Branch cannot decide when they will receive builds if they
3930are obtaining updates from Windows Update. This means that the main installed base
3931of Windows 10 computers (especially in the consumer space) will be aligned with one
3932another. Administrators who manage computers using WSUS have more control over
3933their distribution, which will be explained shortly.
3934Current Branch for Business (CBB) – enabled computers are essentially the same
3935as CB computers, but with the option to defer the upgrades component. This option is
3936only available to the following editions of Windows: Pro, Education, Enterprise, Mobile
3937Enterprise, and IoT Core Pro.
3938148CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3939To configure one of the eligible editions for CBB, you need to configure either the
3940Settings app or Group Policy settings, as shown in Figure  6-5 .
3941Figure 6-5. Enabling Current Branch for Business
3942149CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3943You can see from Figure  6-5 that in the Settings app you can only set the option to
3944defer upgrades (with no value for the period possible). In Group Policy, however, you
3945can fine tune the settings and configure the value for upgrades to a maximum of eight
3946months, and one month for updates. So, essentially, a computer can be kept reasonably
3947up to date for security updates and other fixes, but lag by up to eight months on new
3948builds that deliver added functionality.
3949â–  Note When an organization configures some or all of its computer in this way, it is said
3950to have deployed Windows Update for Business. In reality, all you are doing is configuring
3951the deferral options, rather than deploying a service as the name may suggest.
3952The Long-Term Servicing Branch is the final servicing model and is aimed at a
3953completely different use-case scenario. While it should be observed that having updated
3954or upgraded computers overall is a good thing, and having harmony worldwide makes
3955it easier for Microsoft and organizations to support, there are some exceptions to this.
3956Consider a computer that resides on a factory floor and runs a production process in a
3957plant that runs 24/7. Or a computer in a hospital that only manages a piece of medical
3958equipment. It’s likely that these computers are classed as mission critical in their
3959own way, but equally they can be regarded as single-use devices that run a specific
3960workload. The computers may never be connected to a network, much less the Internet,
3961so the relevance of keeping these kinds of computers up to date becomes somewhat
3962nonexistent — as long as Windows runs reliably, of course.
3963Administrators who maintain these types of computers usually want to balance a
3964computer’s pace of updates with the need to keep the computer up as long as possible in
3965a stable state without the added complications of untested updates interfering.
3966Recognizing this type of scenario, Microsoft has made available a different edition
3967of Windows 10 that uses this longer term servicing model entirely, known as Windows 10
3968Enterprise LTSB. This is only available to education and enterprise customers and cannot
3969be easily switched to without (re)installing the entire operating system, so it needs to be
3970carefully planned and used on a case by case basis in an organization.
3971It’s possible to have computers in an organization belonging to any combination of
3972the four servicing models. At any given point, within each model, there can be computers
3973that are also said to belong to different “branches” of servicing depending on how the
3974administrator has set the computer up.
3975Let’s have a look at how that might work for a fictitious company that has 1,000
3976computers. Consider that, all things being equal, the company understands the
3977importance of maintaining up-to-date computers and has a proactive policy on
3978managing updates. Most computers would be configured to use Current Branch and,
3979due to the size of the company, most likely would be deploying updates using WSUS.
3980These computers would be serviced according to the way in which the administrator
3981has deployed WSUS on the network. There could, for instance, be some computers that
3982update more frequently than others, or some that get updated manually.
3983150CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
3984There may also be some computers that software developers use to test new applications.
3985These applications may require access to the latest builds to ensure that the developers can
3986check application compatibility across any new builds that their customers may be using.
3987These computers may use Insider Program builds, but some computers may use the slow
3988ring and some the fast ring branches. So, at any given point in time, there are some computers
3989using the very latest build available and some that lag by a few days or weeks to allow for
3990comprehensive testing with a semi-stable release that won’t be updated too frequently.
3991Other computers on the network may be deemed mission critical, and the
3992administrators may want to mitigate some risk by effectively creating groups of computers
3993that have deferred options set (a.k.a. Current Branch for Business). Within this subset
3994of computers using CBB, there could be some computers being serviced with updates
3995lagging by two weeks, some by three weeks, and some by four weeks. The same could be
3996true for upgrades (new builds) as well, so some could lag by four months or eight months.
3997The servicing branch is therefore dictated by the build that the computer is on and
3998the updates configuration that services that build at a given point. So, Computer1 may be
3999using build 1025, with no delay in receiving updates. Computer2 may be using build 1000
4000with no delay in receiving updates either, but those updates are relevant to build 1000,
4001not 1025. That said, there will be some updates, like regular Windows Defender malware
4002definitions, that would be the same on both computers.
4003Setting Up and Managing WSUS
4004In the early days of Microsoft Update, administrators lacked the tools to control the
4005distribution of updates to computers that they managed. Much less so, administrators
4006also did not have insight into the state of compliance of their computers in regards to their
4007update state. The larger the size of the network, the more this problem was compounded.
4008Administrators turned to Microsoft and third parties to come up with a solution.
4009Originally, Microsoft lacked the tools, and the third-party market helped develop
4010a solution. Microsoft eventually took this on in its own right as the service that has
4011become WSUS. It was a company called Shavlik Technologies that produced a tool called
4012HFNetChk (short for HotFix Network Checker) in 2001 that started the ball rolling, which
4013then led to Microsoft releasing a tool called MBSA (Microsoft Baseline Security Analyzer ).
4014The premise of both tools was a way for administrators to assess the update state of the
4015computers that they managed on their network (rather than individually).
4016â–  Note Hot fix is the name given to a specific type of update that customers used to
4017request outside of the normal channel of update distribution to fix specific issues in the field
4018on Microsoft technologies like Windows Server, SQL Server, and Exchange Server. These
4019days the term is less used as customers are more aligned to having the term update cover
4020the different varieties discussed at the beginning of this chapter. Likewise, the term patch is
4021usually referred to in a generic sense by administrators implying any type of update, but it
4022remains in use as a slang term.
4023151CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4024From these roots, SUS (Software Update Services), later WSUS (Windows Server
4025Update Services), was born. This integrated service allows administrators to control
4026the release of updates of all kinds to the computers on their networks, with the added
4027intelligence of update-by-update or computer-by-computer reporting (which will be
4028covered later). WSUS is widely used in small-, medium-, and large-sized organizations.
4029It is often used in conjunction with System Center Configuration Manager in larger
4030enterprise networks. It is beyond the scope of this chapter to show that integration here,
4031but the principles of how WSUS works there is reflected in the System Center tools.
4032In a typical basic deployment that a small- or medium-sized organization would
4033use, the architecture of a WSUS infrastructure would look like the one in Figure  6-6 . Here,
4034you can see that a single WSUS server deployed behind the corporate edge firewall (but
4035not typically in a perimeter network) would be used to connect to Microsoft Update
4036online, synchronize the content, and control the update distribution for the connected
4037clients that are configured to use it. Note that not all computers on the network have to be
4038configured to use WSUS just because it is there.
4039Figure 6-6. A basic WSUS infrastructure
4040152CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4041Installing and Configuring WSUS
4042WSUS is now an integral part of the Windows Server operating system family of product,
4043far from its origins as a downloadable add-on for Windows Server 2003. It is installed
4044as a role in Windows Server 2012 R2, as shown in Figure  6-7 . The server running WSUS
4045requires at least 2 GB RAM over the minimum for Windows Server, plus enough disk
4046space to store the amount of updates that the administrator chooses to cache from the
4047Internet. A recommended starting point is 50 GB to 100 GB. The actual amount depends
4048on the types of update classifications, products covered, and language iterations of the
4049updates stored locally.
4050Figure 6-7. Installing WSUS
4051Regardless of the version of Windows Server that WSUS is deployed to, a common
4052requirement is that a database must be used in support of the server. That database
4053can be a SQL Server database on the same or a separate server, or a Windows Internal
4054Database (WID), which can be installed as shown in the previous figure. For smaller scale
4055networks or for testing, a WID is recommended.
4056There are other scenarios in which WSUS can be deployed, and the most common
4057other way is as a hierarchy of servers. This would suit a network that consisted of a main
4058office and multiple regional or branch offices where centralized control would achieve
4059consistency and ease of management instead of managing a series of independent WSUS
4060servers, for example.
4061153CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4062The benefits of a hierarchy include minimizing the amount of times that an update
4063needs to be downloaded from the Internet, hosting updates physically close to the clients,
4064and synchronizing update approval states for updates across sites.
4065When WSUS is deployed in a hierarchy, administrators can choose to have the
4066servers configured in either replica mode or autonomous mode, as shown in Figure 6-8 .
4067Figure 6-8. WSUS hierarchy configuration
4068In replica mode, all the update approval settings, computers, and other settings are
4069mirrored from the upstream server. This simplifies administration in an organization that
4070needs the consistency of a parallel configuration across sites to ensure that computers
4071that are serviced by WSUS meet compliance settings. The other way that a hierarchy can
4072be configured is in autonomous mode, where the upstream server is used purely as a
4073synchronization point for the updates themselves rather than using the Internet directly.
4074In this mode, the downstream server administrator can control how and when updates
4075get distributed without regard to how the upstream server is configured.
4076It is worth noting that there other options for WSUS server configurations, such as
4077with load-balanced clusters or by not caching the updates from the Internet but rather
4078leaving the download of updates to the client to perform independently. This is good
4079when the connection from the client to the WSUS server is poor compared to the client’s
4080connection to the Internet.
4081154CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4082Other options that are defined during setup of WSUS include the schedule (a time
4083once a day or at night is selected) for when to synchronize from Microsoft Update and the
4084products and classifications to sync.
4085â–  Tip When WSUS syncs with Microsoft Update, it also syncs the published catalog of
4086updates. When configuring WSUS for the first time, it’s a good idea to allow WSUS to sync
4087once with only a very small set of products and classifications selected in order for it to
4088obtain the most up-to-date list of products and categories from the catalog, from which
4089you can choose later. For example, with the version of WSUS included with Windows Server
40902012 R2, there is no in-box knowledge of Windows 10 operating systems until the first sync.
4091It’s also very important to note that WSUS needs to update itself to provide support for
4092Windows 10 feature upgrades, an update that is installed as described here:
4093https://support.microsoft.com/en-us/kb/3095113 .
4094Approving Updates
4095A key area in WSUS configuration is setting how and when to approve updates for
4096installation on connected clients. Just because a client is configured to point to the WSUS
4097server and the server has recently synced new content, it does not mean that the client
4098will receive many updates. An administrator must decide how this should occur.
4099This decision can be different for different sets of computers, known as computer
4100groups in WSUS. For example, for Windows client operating systems it may be a good idea
4101to automatically download and install updates without prior testing in an environment if
4102testing is not possible due to resource constraints or attitude to risk. For server operating
4103systems, it may be decided to not automatically install updates at all, and instead
4104have them installed manually during a maintenance window to prevent unscheduled
4105downtime. Alternatively, you can specify group policy settings that suppress the reboot
4106until manually enacted, which is a more sensible idea.
4107To help understand this, let’s look at the default rule that exists out of the box. This
4108can be seen in Figure  6-9 .
4109155CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4110Figure 6-9. Automatic approval rules
4111In this graphic you can see that by default all clients would receive critical updates
4112and security updates. From earlier in the chapter you’ll recall these are arguably the most
4113important update types, so this ensures that computers have a certain level of protection
4114from vulnerabilities that could affect them.
4115Other rules can be established that have the following properties:
4116• Update classification type (e.g., definition updates)
4117• Specific product (e.g., Windows Defender)
4118• Deadline (e.g., within two days of approval)
4119• Computer Groups (e.g., all computers)
4120The previous example would relieve a lot of administrative effort, as it would be
4121desirable to have Windows Defender up to date with malware definitions without
4122needing to manually approve this daily.
4123156CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4124From time to time, administrators may want to decline an update. For example, it
4125may be desirable to prevent a feature update from installing when it has been determined
4126unnecessary or may cause compatibility problems internally. At any given point, the
4127WSUS admin can decline an update, even if it has been delivered to other computers
4128previously.
4129Configuring Clients
4130For a client (and this can be server as well as client operating systems) to connect
4131with and use WSUS, the computer must have some settings configured. These can be
4132configured via either the Registry or Group Policy. You may recall from Figures  6-1 , 6-2 ,
4133and 6-3 that there is not a way to do that through the Control Panel or the Settings app in
4134Windows 10.
4135If using the Registry, use the following sub key: HKEY_LOCAL_MACHINE\Software\
4136Policies\Microsoft\Windows\WindowsUpdate
4137The minimum that must be configured are the keys for WUServer and
4138WUStatusServer . These are the pointers to the WSUS server and are either HTTP or
4139HTTPS URLs, such as HTTP://WSUS.Apress.com . Other optional settings will be discussed
4140shortly.
4141The preferred route, however, is to use Group Policy, either by using a Group Policy
4142Object (GPO) in Active Directory or by using the local Group Policy editor tool on a non-
4143domain-joined computer.
4144â–  Note Domain membership of computers using WSUS is not important, but almost by
4145definition, the fact there is a WSUS server indicates an infrastructure in place that would
4146typically include Active Directory.
4147In the Group Policy editor, navigate to Computer Configuration ➤ Policies ➤
4148Administrative Templates ➤ Windows Components ➤ Windows Update.
4149Figure  6-10 shows the Group Policy settings available. Note that these do not all
4150relate to WSUS usage; most of these can be used even if using Microsoft Update directly.
4151157CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4152Figure 6-10. Group Policy settings
4153The highlighted setting “Specify intranet Microsoft update service location” is the
4154equivalent setting to the Registry key mentioned earlier. Three other important related
4155settings of note are:
4156158
4157• Defer Upgrades and Updates – This setting, discussed earlier, will
4158be ignored if configured if the “Specify intranet . . .” setting is also
4159configured.
4160• Enable client-side targeting – This can be used to create the
4161computer groups used for update approval and automatic
4162approval rules. Any text string value can be used here, such as
4163Desktop Computers or Laptop Computers , if an admin needs to
4164distinguish different computers for approval reasons.
4165• Configure Automatic Updates – This is typically set to a value of 4,
4166where the admin wishes to enforce that the client automatically
4167downloads the updates to the computer and schedules an
4168installation of those updates (default is at 3am each day). If the
4169computer is not on at 3am, then whenever the computer is next
4170on after that time is used; for a typical desktop PC this would be
4171first thing in the morning the next day. (This is equivalent to the
4172setting “Install updates automatically (recommended)” from
4173Table  6-3 earlier in the Control Panel settings).CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4174After configuring a client to use WSUS, the computer can either be rebooted or
4175just wait for the settings to kick in on the next sync cycle (the setting for which is the
4176“Automatic Updates detection frequency” option from Group Policy, which has a default
4177value of 22 hours). So, within a day of being configured, you should expect to see the
4178client start to show up in the reporting in the WSUS administration console. We will take a
4179look at this in the next section.
4180Let’s take a look at a summary of the remaining Group Policy settings for
4181completeness. These are shown in Table  6-5 and apply to all Windows client versions
4182unless otherwise indicated.
4183Table 6-5. Group Policy Settings
4184Setting Explanation
4185Do not display “Install Updates and
4186Shut Down” option in Shut Down
4187Windows dialog box. Toggles whether or not to show to users the
4188option of installing updates upon shutdown, even
4189if there are updates ready to install. Applies to
4190Windows XP SP2, Vista, 7.
4191Do not adjust default option to
4192“Install Updates and Shut Down” in
4193Shut Down Windows dialog box. Whether or not “Install Updates and Shut Down”
4194can be used as a default option, else the last
4195shutdown choice selected is shown.
4196Enabling Windows Update Power
4197Management to automatically wake
4198up the system to install scheduled
4199updates. Unless on battery power, the PC will wake from
4200sleep/hibernation to install updates at the
4201configured time.
4202Applies to Windows XP SP2, Vista, 7.
4203Always automatically restart at the
4204scheduled time. A reset timer showing 15 minutes displays after
4205installing updates instead of showing on the login
4206screen for two days. Applies to Windows 8/RT.
4207Automatic Updates detection
4208frequency. Interval used to check for updates. In actual fact,
4209a figure of up to 20 percent of this value is taken
4210off the time set. For example, if 20 hours was
4211configured, then somewhere between 16 and 20
4212hours is used to randomize different computers
4213for load reasons. Default is 22. Applies to XP and
4214above (except RT).
4215Do not connect to any Windows
4216Update Internet locations. Despite a computer being configured to use
4217WSUS, it will still use the Internet location
4218periodically for Microsoft Update or the Store.
4219This prevents those connections. Applies to
4220Windows 8.1 and above.
4221Allow non-administrator users to
4222receive update notifications. Older operating systems before Windows 8 did
4223not show standard users update notifications, so
4224they would not see a prompt to install updates if
4225some were pending. This is already configured
4226this way for Windows 8 and above anyway.
4227Applies from Windows XP.
4228(continued)
4229159CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4230Table 6-5. (continued)
4231Setting Explanation
4232Turn on software notifications. Gives users using Microsoft Update information
4233on optional applications available. It’s disabled by
4234default. Applies to Windows Vista and 7.
4235Allow Automatic Updates
4236immediate installation. Should updates that do not reboot the PC or
4237restart services be installed as soon as they are
4238downloaded?
4239Applies from Windows 2000 through 8.1.
4240Turn on recommended updates via
4241Automatic Updates Will important as well as recommended updates
4242be downloaded? Default depends on computer’s
4243existing setting.
4244Applies from Windows Vista through 8.1.
4245No auto-restart with logged-on
4246users for scheduled Automatic
4247Updates installations. If a user is logged on, the PC waits for the user
4248to restart it if required, rather than performing
4249the reboot automatically. Users receive a five-
4250minute warning before reboot if set to “disabled”
4251otherwise. Applies to Windows 2000 and above.
4252Reprompt for restart for scheduled
4253installations. Like a snooze button action on an alarm clock. If a
4254user postpones the reboot (if required) after update
4255installation, then how long before displaying the
4256prompt to reboot again? Default is ten minutes.
4257Applies from Windows 2000 through 7.
4258Delay restart for scheduled
4259installations. Wait time before a scheduled restart occurs after
4260update installation completes.
4261Applies from Windows 2000 through 7.
4262Reschedule Automatic Updates
4263scheduled installations. Wait time after a boot before previously missed
4264scheduled installations proceed. Default is one
4265minute. Applies from Windows 2000 through 7.
4266Allow signed updates from an
4267intranet Microsoft Update service
4268location. Whether to accept updates that are signed by
4269third-parties when delivered from WSUS. Applies
4270to XP and above (except RT).
4271You can tell from the table that some settings either do not apply to the most recent
4272Windows versions or are moot if the computer is configured to use WSUS such that the
4273administrator would decide what type of updates the computer would receive. Be aware
4274that some settings can null others. For example, deferring updates will not have any effect
4275if the computer is set to use a WSUS server and the administrator uses approval rules or
4276manual approval for updates/upgrades anyway.
4277160CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4278Troubleshooting and Repairing Windows Update
4279Issues
4280There are many moving parts when it comes to troubleshooting Windows Update issues
4281on client computers. It is recommended to follow a logical troubleshooting methodology
4282to help get to the bottom of the issue(s).
4283For example, is the computer connected to the corporate network or Internet,
4284depending on whether WSUS or Microsoft Update is being used? Can the update source
4285be reached; can you ping it?
4286Let’s spend some time looking into some possible causes and look also at some
4287solutions.
4288Source Configuration
4289First, it’s a good idea to establish what the source of updates is for the computer. You can
4290validate this by using the Registry or Group Policy settings shown previously to determine
4291how the computer is configured. A value for the intranet update service must also be
4292accompanied with a setting for the intranet statistics server. Usually these are the same
4293server. In other words, if these are configured then the computer is using WSUS; if they
4294are not, we can assume it is using Microsoft Update.
4295Most intranets use HTTP paths for these addresses. Sometimes SSL has been
4296configured, and while principally it is the same service being accessed, the ports being
4297used are different, which may have a bearing on any firewall ports that may be open/
4298closed in between the client and update server. These are pretty standard ports, however,
4299using TCP port 80 or 443 depending on whether HTTP or HTTPS is used, respectively.
4300Another cause for failure to connect can be that if using HTTPS, the certificate
4301installed on the server needs to be from a certificate authority that the client trusts
4302and can’t be expired. All certificates will expire at some point, and it could be that the
4303administrator configured a one- or two-year certificate. All of a sudden it stops working
4304for everyone when it was working fine yesterday. This could be the result of an invalid or
4305expired certificate.
4306If you are having difficulty determining the Group Policy settings — for instance, you
4307don’t have the ability to launch the group policy editor tool — then try using GPresult.
4308exe /V or /Z from a command prompt. GPResult is used to show what settings have been
4309configured in Group Policy and from which policy : local-, domain-, or OU-based policy?
4310In MMC.exe you can also try adding the Resultant Set of Policy snap-in and generating
4311RSoP Data, which will show you the same output. This can help to show if the computer is
4312configured to use the correct WSUS server, for example.
4313Detection
4314Don’t forget that the default cycle for a client to check in with the server (either WSUS or
4315Microsoft Update) is 22 hours. There can be a natural lag, therefore, from configuring a
4316GPO, having that GPO picked up by a client, starting to use that new setting, and checking
4317in with the new server. Patience can sometimes count for a lot here, especially if it’s a new
4318computer being set up on the network for the first time.
4319161CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4320There is a way to force the Windows Update component to check for updates — in
4321other words, to avoid waiting another 22 hours for the next cycle. In a command prompt,
4322type wuauclt.exe /detectnow. Don’t expect to see much in the command prompt
4323to show the success or failure of this! What you are doing is queuing the process that
4324starts detection , which involves the computer going away and having a look at what is
4325has installed and what updates are available on the update server, then computing the
4326differences that need to be downloaded and installed. If an update task is in mid-flow,
4327then the new request gets queued behind it.
4328â–  Tip Patience is key when troubleshooting! Detection cycles and reporting lags are to
4329be expected. It’s tricky to appreciate on a modern PC that there should be so much waiting
4330around, but it is recommended to wait a day or two before sweating on an update problem.
4331Reasons include waiting for new Group Policy changes to be detected and applied, waiting
4332for the update cycle to begin, and waiting for reporting in the database to have occurred.
4333You can check the results of detection activities in Event Viewer, more specifically
4334in Applications and Services Logs ➤ Microsoft ➤ Windows ➤ WindowsUpdateClient ➤
4335Operational Log. This log can also be used for diagnosing and reporting on a wider set of
4336issues around updates.
4337In operating systems older than Windows 10, you can also check the log information
4338recorded in C:\Windows\Windowsupdate.log . This gives more detailed information that
4339can be used for troubleshooting.
4340For newer operating systems like Windows 10, there is a PowerShell cmdlet called
4341Get-WindowsUpdateLog that takes the content saved in event-tracing format and stored in
4342C:\Windows\Logs\WindowsUpdate and converts it into a readable text file on the desktop
4343of the user. This is equivalent to the output that would previously otherwise be found in
4344C:\Windows\Windowsupdate.log . You will need to refer to online resources like TechNet
4345to interpret this information, as it does not include header information or code-number
4346lookups.
4347Metered Connections
4348When a Windows computer is connected to a WiFi network, it attempts to assess whether
4349the connection is using mobile broadband, such as over a tethered Internet connection
4350using your phone’s built-in mobile hotspot functionality. Since Windows 8.1, these types
4351of connections can be classed as ‘metered connections’, either automatically via detection
4352by the operating system or manually by the user.
4353It is by design that Windows updating activities are suspended over metered
4354networks. This would, for example, prevent 3G/4G mobile data plans from being depleted
4355by the volume of network traffic that can occur, especially if a new upgrade build is
4356detected. You can check a computer’s metered state in the Settings app, under Network &
4357Internet ➤ WiFi ➤ Advanced Options, as shown in Figure  6-11 .
4358162CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4359Figure 6-11. Metered WiFi connection settings
4360Services
4361Looking back at the services that were discussed earlier in this chapter, it is well worth
4362checking to see if they are all correctly running. You should find that both the BITS and
4363Windows Update services are in a running state when your computers are working
4364correctly. If you need to, you can restart them, but often this will not produce a quick
4365turnaround on results due to the intervals mentioned in the previous tip.
4366Targeting
4367If the client-side targeting Group Policy setting has been used in conjunction with
4368WSUS, then the computer will belong to a computer group in WSUS. You will recall that
4369update approvals can be targeted at one or more computer groups. These can also be
4370hierarchically configured. For example, you can have a top-level group called Client
4371Computers that contains two subgroups underneath named Laptops and Desktops. This
4372gives you the flexibility of being able to target approved updates to either the Laptops or
4373Desktops group individually, or to all Client Computers at once. Despite the name, it is
4374not assured that just because a computer is a laptop it necessarily is in the correct group,
4375because incorrect targeting of the Group Policy setting could misplace it.
4376163CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4377Computer group membership can also be set server-side in the WSUS
4378administration console, whereby an administrator can manually create groups or
4379drag and drop computers between groups. You can also end up with a situation where
4380groups are created manually, but the Group Policy settings may deploy a differently
4381spelled version of the same name. This would result in the computer(s)’ not having the
4382appropriate updates approved to them, and they may not pick up some or all updates in
4383the expected way as a result. This is shown in Figure  6-12 , where an accidental typo has
4384resulted in the wrong name for the Desktops group.
4385It’s worth pointing out the catch-all group called Unassigned Computers, which is
4386where computers end up that did not have client-side or server-side targeting configured.
4387Again, the state of approvals of updates for this set of computers could be at odds with
4388other correctly configured computers. It’s recommended that you check to see if there
4389are any computers in that group and either manually move them or modify Group
4390Policy settings to align them to the intended group, or to ensure that that group is used
4391for approving updates. For instance, you could create an automatic approval rule that
4392approved all update classifications for all products downloaded to that group. That way
4393they would always get updates, but not perhaps in the staggered way that other correctly
4394configured computers would.
4395Figure 6-12. WSUS computer groups
4396164CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4397Reporting
4398You can also see the state of compliance in the summary pie charts in Figure  6-12 , which
4399are displayed for each of the computer groups in the middle pane. Further drill-down is
4400required for individual computers, which can be achieved using the Reports node in the
4401same tool.
4402In the WSUS console, there are three different types of reports that an administrator
4403can access, as follows:
4404• Update Reports – shows the status of updates, such as approval state
4405• Computer Reports – computer orientated view to show which
4406updates does a given computer have, or group of computers
4407• Synchronization Reports – state of last syncs with Microsoft Update
4408These reports give very granular insight into the state of a given update or a given
4409computer. For instance, you would be able to tell which updates had installed correctly,
4410failed to install, or are required but not yet installed for a given computer. You could also
4411examine a specific update to see which computers it was installed onto or had failed to
4412install onto. Using reports as a troubleshooting tool can be very effective courtesy of the
4413depth of information sent to the database by the clients during the update checks.
4414Other Network-Related Issues
4415As mentioned earlier, there are many moving parts here that could cause issues with
4416updating computers. Assuming that Control Panel, the Settings app, or Group Policy are
4417correctly configured, there are other checks you can perform, such as the ones below:
4418TCP/IP Configuration – Does the client have an appropriate
4419IP address, subnet mask, DNS server, and default gateway for
4420the network?
4421Name Resolution – Does the client successfully resolve the
4422endpoint (WSUS or Microsoft Update) name?
4423Firewall Access – Can the client reach the desired server endpoint
4424using HTTP(S)? In actual fact, there are quite a few names that
4425are documented on Microsoft’s website that may be used by
4426Microsoft Update or WSUS synchronizations, such as http://
4427windowsupdate.microsoft.com and http://*.windowsupdate.
4428com . For access to WSUS, computers typically use ports 80/443,
4429but they can also use 8530 and 8531, so it’s worth checking what’s
4430used and what ports are open on the server or any other devices
4431that lie between the client and the server.
4432165CHAPTER 6 â–  UPDATING AND MAINTAINING WINDOWS
4433Summary
4434Keeping Windows up to date is highly recommended so as to maintain good protection
4435from malicious attacks, malware, and bugs. To reduce the likelihood of attack through
4436a known vulnerability, Microsoft will adopt a more forceful approach to updates in
4437the future. For the consumer users of Windows 10, all updates and upgrades will
4438automatically be applied to devices. You have seen how enterprises will be able to
4439manage updates using Group Policy and WSUS.
4440Devices that are typically located outside of your corporate network pose additional
4441challenges in relation to how you can manage and maintain them. In the final chapter,
4442you will learn how you can manage devices using Microsoft Intune, which is especially
4443useful for the management of devices used outside of the corporate environment.
4444166CHAPTER 7
4445Managing Windows Updates
4446with Intune
4447Today’s modern workplace is very different than that which existed ten to fifteen years
4448ago. At that time, users would typically use a desktop PC or laptop, but would mostly work
4449from the same office each day. Occasionally, they would visit a customer, but for the most
4450part administrators had pretty good fingertip control over the computers they managed.
4451Typically, client computers would be domain joined, and administrators enjoyed a high
4452level of management control using services like Active Directory and Group Policy.
4453Today is different. Laptops and tablets outsell desktop computers, and many users
4454work for extended periods away from their main desk or, in some cases, never go into the
4455office at all, always working remotely. The concepts of Bring Your Own Device (BYOD)
4456and Choose Your Own Device (CYOD) are phenomena that administrators have had to
4457wrangle with in recent years.
4458This had led to a need for a more open approach to PC and device management that
4459extends beyond an organization’s traditional four walls. Modern workers demand greater
4460freedom of movement and flexibility, but at the same time administrators are under
4461pressure to deliver device security and ensure that corporate data can be safely accessed
4462by trusted users.
4463Cloud-based services that address this need for modern device management have
4464been quickly evolving over the last two to three years. Microsoft has been at the cutting
4465edge of this wave of change and has been offering Microsoft Intune as a service that
4466allows administrators to manage a diverse range of modern devices from the cloud.
4467Overview of Microsoft Intune
4468Microsoft Intune is a cloud-based service that organizations can subscribe to. It
4469encompasses services that you may expect to find in a modern enterprise network, but
4470that are accessed instead from the cloud. These services act and work very much like
4471their on-premise equivalent services. The main difference is that the administrator does
4472not own and manage the platform directly. Instead, the organization is a tenant within a
4473much larger system.
4474© Chris Rhodes and Andrew Bettany 2016
4475C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
4476DOI 10.1007/978-1-4842-1827-3_7
4477167CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4478This becomes attractive to systems administrators for various reasons. First, the
4479organization is free of network infrastructure costs. No WSUS server, Active Directory
4480domain controllers, DNS servers, or any kind of server are required. Organizations just
4481need clients, a subscription, and an Internet connection. That’s it.
4482Clients need not be domain joined. In fact, they do not have to be connected to
4483a corporate network of any kind. The clients simply need Internet connectivity. This
4484enables the administrator to support users who work in the field from a customer site, or
4485even home-based workers, with the same level of control.
4486Like many cloud services, Microsoft Intune is a moving target in terms of
4487functionality, as Microsoft will, from time to time, roll out new features. As they manage
4488the backend service, there is no interaction required by administrators to receive the new
4489updates to the service.
4490The main features that are part of Microsoft Intune are:
4491• Mobile Device Management (MDM)
4492• Mobile Application Management
4493• Windows Firewall Management
4494• Endpoint Protection
4495• Selective wipe capability of applications and data from devices
4496• Hardware and software inventories and reports
4497Much of Microsoft Intunes’ functionality mirrors that of System Center 2012
4498Configuration Manager. System Center 2012 Configuration Manager (SCCM) is one of
4499the components of System Center that can be used to manage clients and servers on a
4500corporate network. For many administrators of small- and medium-sized organizations,
4501the cost, skills, and management required to run SCCM make it not viable.
4502Intune allows even very small organizations to leverage SCCM-style features
4503at a fraction of the cost within minutes of provisioning the service. For example, an
4504administrator can drill down to examine how many of the managed devices have a
4505particular application installed or to see which updates are installed on each device.
4506Integrating Intune
4507It is worth noting that Intune can also be a part of an Office 365 subscription. For
4508those organizations that have a commercial subscription to Office 365, such as an E3
4509subscription, the MDM capabilities of Office 365 — such as policy controls and device
4510wipe — are actually components of Intune.
4511Crucially for customers who use Microsoft Enterprise Mobility Suite (EMS) , Intune is
4512a core component of the identity and management toolset. Intune provides the MDM and
4513application management components. It can also be tightly integrated with installations
4514of Microsoft System Center 2012 Configuration Manager for the unified management
4515of computers and devices based on the premises and cloud-based devices, giving
4516administrators single-pane management of all the devices that they manage whether they
4517exist in the corporate network or not.
4518168CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4519Creating a Microsoft Intune Subscription
4520Before creating a Microsoft Intune subscription, it is worth reviewing how the
4521organization will be using the service and which clients they intend to enroll and manage.
4522In terms of how the organization will use the service, careful planning must occur
4523when connecting Intune with Exchange Server or System Center 2012 Configuration
4524Manager. This, however, is beyond the scope of this chapter.
4525Supported Clients
4526Microsoft Intune supports a wide range of clients that run Windows, iOS, and Android.
4527However, it is important to distinguish here the different ways that clients can interact
4528with Intune. Our goal for this chapter is to learn how to manage Windows updates using
4529Intune. As such, the clients must obviously be running not only Windows, but also the
4530Intune client software that is downloaded from the management portal. This is referred to
4531as Managing Computers in the Intune portal. We will explore this in more detail shortly.
4532This software gives us full-fidelity management of our clients, including inventory and
4533policies, as well as Endpoint protection and Windows updates.
4534The other way that clients can enroll in Intune is by using the client’s built-in
4535MDM capabilities. Modern mobile operating systems, as found on iOS-, Android-, and
4536Windows-based phones, tablets, and other devices, come with MDM client software. This
4537links to a management authority that controls policies, such as security and encryption
4538settings, on the device. This is referred to as M anaging Mobile Devices in the management
4539portal , as shown in Figure  7-1 .
4540Figure 7-1. Computer Management
4541169CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4542For the purposes of the rest of this chapter, we will focus on clients that enrolled
4543by installing the client software, and that can therefore take advantage of the ability to
4544control Windows updates (Managing Computers). Table  7-1 shows the supported list of
4545clients that can be managed in this way.
4546Table 7-1. Supported Microsoft Intune – Managed Computers
4547Operating System
4548Editions (x86 & x64)
4549Windows Vista Business, Enterprise, Ultimate
4550Windows 7 Professional, Enterprise, Ultimate
4551Windows 8 Pro, Enterprise
4552Windows 8.1 Pro, Enterprise
4553Windows 10 Pro, Enterprise
4554Aside from the operating system version and editions, and the need for Internet
4555connectivity, the only other requirement is that the client installation software be
4556installed by a user that is a member of the local administrators group.
4557â–  Note Due to the technical similarities with System Center 2012 Configuration Manager,
4558Intune-managed devices cannot be running the client agent software for SCCM 2012 or
4559earlier versions. These must be uninstalled before enrolling a device in Intune.
4560Subscriptions
4561The best way to learn Microsoft Intune is to create a subscription . You can create a trial
4562subscription by following these steps:
45631.
4564170
4565Create a tenant subscription in Intune. The easiest way to
4566do that is by connecting to http : //www.microsoft.com/
4567intune . From there, a free trial can be set up that can later
4568be converted into a paid subscription. The way that Intune
4569is licensed is per user, not per device, so it would be possible
4570for a user to own several devices that were all connected
4571to Intune and only pay for that one user. The approximate
4572cost is $6 USD per user (although this can change and will
4573be converted to local currencies; for example, in the United
4574Kingdom this works out to be £3.70, factoring in currency
4575and taxes).CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
45762.
4577Create the subscription based on using Intune as a standalone
4578service (as opposed to integrating with System Center 2012
4579Configuration Manager) as it is more straightforward. First, fill in
4580the form as shown in Figure  7-2 . It will default to one license, but
4581you can add more licenses on the next page and then go through
4582the checkout process. More licenses can be added later in the
4583admin area in Intune. For now, let’s assume you want to trial
4584Intune as you are learning more about it, so use the Try Now
4585button on-screen instead of purchasing the subscription at this
4586time. This will give you 100 user licenses to play with for 30 days.
4587Figure 7-2. Signing up for an Intune subscription
4588â–  Note You will observe in Figure 7-2 that a custom domain name is created as part of
4589the sign-up process in the format of customer.onmicrosoft.com . This is the same as the
4590process of creating an Office 365 subscription, and in fact the two share the same backend
4591authentication service, Azure Active Directory. You can also add public domain names that
4592you own into Intune to make user identities easier for users to work with.
4593171CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
45943.
4595Once signed up, either with a trial or a paid account, the next
4596step is to add users. This is required so that your end users
4597can then enroll devices into Intune. You are directed to the
4598Account Portal, where there are two choices: adding new
4599users into Intune or using user accounts that already exist,
4600such as in your company’s Active Directory, and then using
4601single sign-on. Both options are shown in Figure  7-3 . To keep
4602things simple, we will skip Active Directory integration and
4603synchronization to Intune, as we want to focus on updates.
4604Figure 7-3. Adding users in Intune
4605When creating new users, the domain name that was established in the sign-up is
4606used as the naming suffix. Using Figure  7-2 as an example, a new user could be User1@
4607ApressRocks.onmicrosoft.com . The administrator is given the optional choice as to
4608whether to give each new user administrative permissions or just have them as a standard
4609Intune user, as shown in Figure  7-4 .
4610172CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4611Figure 7-4. Assigning user roles
4612Enrolling Clients
4613Once user accounts are added, you must navigate to the Admin Console and then to the
4614dashboard to begin managing your devices, as you saw in in Figure  7-1 . Remember that
4615Intune can be used not only as an MDM solution for mobile devices, such as tablets and
4616phones, but also as a solution for managing Windows-based PCs by installing the client
4617software.
4618The client software needs to be installed onto the target computers so that Windows
4619updates can be managed. Exactly how the client software gets onto the PCs is not so
4620important, as long as it does. Here are the main ways that the client software can be
4621deployed:
4622• Install as part of an operating system image (it is effectively
4623preinstalled when Windows is deployed)
4624• Deployed through Active Directory Group Policy (the computer
4625needs to be domain joined)
4626• Local user installs the software (local administrator access
4627required on the computer)
4628• Users access the Intune Company Portal and self-enroll (local
4629administrative access required. Internet Explorer required also)
4630Once a computer is enrolled, the computer is linked to the user account that was
4631used to install the client software. It is worth noting that Microsoft Intune Endpoint
4632Protection is also installed by default. Endpoint Protection is the enterprise protection
4633software that helps to protect against viruses and malicious software.
4634173CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4635â–  Note The amount of bandwidth required to run an Intune-enrolled device varies, but
4636is approximately 10 MB per day. This allows for the device to check in with Intune cloud
4637services to report hardware and software inventory, Windows updates, and policy checks
4638and to download Endpoint Protection updates.
4639To install the client software, you must first download it from the Admin node of the
4640Intune portal. The download is a single zip file that contains an installation file named
4641Microsoft_Intune_Setup.exe , which is generic to all Intune tenants, and a specific
4642certificate named MicrosoftIntune.accountcert , which identifies the client to that
4643particular organization’s tenant account in Intune.
4644Once installed, the client software installs agents that will report into Intune over the
4645Internet on the status, such as the hardware and software inventory and which Windows
4646updates clients have deployed. Once the client is installed and the computer has checked
4647in to Intune for the first time, the computer should be visible in the Admin Console, as
4648shown in Figure  7-5 .
4649Figure 7-5. Verifiying succesful client installation
4650Configuring Microsoft Intune Updates
4651Once you have your subscription created and your clients connected to Intune, it’s time
4652to turn your attention to how you will manage updates using Intune. In Chapter 6 , we
4653covered how WSUS works for devices that connect to the corporate network for updates.
4654In simple terms, Intune is really a WSUS service in the cloud. Most of the principles and
4655knowledge learned about WSUS management apply here too.
4656In fact, the similarities are such that it is easier to explain how they are different. In
4657Chapter 6 , we discussed how WSUS servers can be configured either to store updates
4658locally or to never store updates and have the clients obtain the files from the Internet
4659instead. In the case of Intune, there is no choice, as updates always come from the
4660Internet.
4661174CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4662Also, Intune does not support driver updates at this time, so drivers would need to be
4663managed separately by Windows or as part of an image (see Chapter 4 ).
4664â–  Note WSUS can bring greater efficiency to the network, as updates only need to be
4665downloaded once to the server, and then all clients can obtain the update from the intranet.
4666This caching not only saves bandwidth, but also means that clients that are not up to date
4667can become compliant without touching the Internet and therefore without being at risk
4668from an exploit that a security update may otherwise protect against. This is a potential
4669disadvantage with Intune that needs to be considered.
4670Figure  7-6 shows an overview of the Intune Updates node in the console. From here the
4671administrator can access reports, add new updates to manage, and configure settings such as
4672automatic approval rules, which we will discuss in more detail in the following pages.
4673Figure 7-6. Intune Updates node
4674Let’s start by looking at the update classifications as seen in Figure  7-6 . These
4675classifications mirror the options a WSUS administrator would see, with the exception of
4676drivers, which has already been pointed out. Unlike WSUS, the updates available to the
4677tenant administrator of Intune do not need to be synced with Microsoft Update (the main
4678originating source of updates).
4679By default, an administrator will see an overwhelming amount of back-catalog
4680updates here dating back many years, all of which are not approved for install. It may look
4681daunting, but in fact you are not expected to approve each and every update — it would be
4682too time consuming (although if you really wanted to, you could!).
4683175CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4684Third-Party Updates
4685One of the great features of Intune is the ability to add third-party updates for
4686deployment. Now, bear in mind that Intune can also deliver applications to clients
4687anyway — this is not the same thing. Third-party updates are updates that can be deployed
4688in the same way as Microsoft-supplied updates, but are uploaded by the administrator
4689and can be from any vendor. These updates must install silently — that is to say, without
4690user interaction — but can take the form of any of the following file types:
4691• EXE - traditional executable
4692• MSI - Windows Installer application
4693• MSP - Windows Installer patch
4694Once you have the update in one of the preceding formats, in the Intune Update
4695node, click the Add Updates button to have it download a small uploader application that
4696walks you through the process. You must supply some information, such as publisher and
4697description, and you can also configure requirements, such as an operating architecture
4698(x86/x64) and OS version (e.g., Windows 8.1). Detection rules in Intune are used to ensure
4699that all the computer groups that an update is approved for, would install it once. You
4700can also create a custom rule that looks for a prerequisite, such as the presence of a file or
4701registry key, to help determine whether the update is required for a computer or not. You
4702also need to point it to the dependency software that this depends on having be installed
4703to update. At this point the update is ready to approve, but like all the other updates it is
4704not approved by default.
4705Approving Updates
4706As we have learned, the Microsoft and third-party updates will not be installed onto any
4707computers until they are approved by an administrator. In the case of third-party ones,
4708this is not too time consuming, as you are unlikely to have that many, but certainly for the
4709thousands of Windows updates on offer approving every one is not viable.
4710This sets the stage for automatic approval rules . Before we embark on creating these,
4711however, we need to understand the concept of computer groups. As in WSUS, computer
4712groups allow the administrator to segment different sets of computers in any way they
4713want — for example, to differentiate intranet computers and home workers’ computers — so
4714that different updates can be applied to each group. There are some default groups, as
4715shown in Figure  7-7 .
4716176CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4717Figure 7-7. Default groups
4718New computers that get enrolled into Intune end up in the All Computers group,
4719but you can create your own custom groups and move computers between them.
4720Alternatively, if you are happy that all computers you manage should be treated the
4721same and have the same updates, it is fine to leave it at that and deploy updates to All
4722Computers.
4723Back in the Updates node, if you click on Configure Updates, you are taken to
4724Admin ➤ Administration ➤ Updates to set up categories, classifications, and automatic
4725approval rules, as shown in Figure  7-8 .
4726177CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4727Figure 7-8. Configuring Updates settings
4728One of areas that is worth exploring is the Product Category area, where you can
4729select/deselect products and their respective versions. For example, you can select
4730Windows and then select the versions, such as 7, 8.1 and 10. All Windows versions are
4731selected by default, as Intune is for Windows machines anyway. You must check this
4732from time to time as new versions of software are released to ensure you are covering the
4733products used on your managed computers.
4734You can see from Figure  7-8 that you can also select Update Classifications , such as
4735Security Updates, Definition Updates, and Critical Updates, to name a few. This list rarely
4736changes, so don’t worry too much about this after configuring it for the first time.
4737The most important section on this page is the Automatic Approval Rules area. This
4738is where you will configure rules that approve updates based on the criteria that you
4739specify. For example, you could create a rule that affects Windows, Skype, and Office
4740versions from the product category, and allows critical as well as security updates, and
4741finally deploys this to the All Computers group. You would repeat as needed until you
4742have fulfilled the business logic for each computer group you defined.
4743â–  Tip It is a good idea to run the new rule after you create it to push along the process of
4744getting the first batch of updates out to the computers. This will then apply the rule logic to
4745the updates collection.
4746178CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4747Bear in mind, however, that there are sometimes updates that require manual
4748approval. This is sometimes because there might be a functionality change or an end-user
4749licence agreement that requires administrative approval, despite the rules you have set
4750up. Sometimes this is also because the update cannot be uninstalled once installed. These
4751updates that require manual approval are called out for you, as you saw in Figure  7-6 earlier.
4752It is worth mentioning that updates can also be declined. For example, you may not
4753want the functionality change an update could bring, or you may want to suppress an
4754update until an application can be tested first.
4755Reports
4756As in WSUS, one of the most valuable facets of using Intune for update management is
4757the ability to view drill-down reporting. You can create an update report (among other
4758reports, such as detected software for inventory of applications on computers) for specific
4759groups or for all groups, and also specify the types of updates you want to include.
4760Figure  7-9 shows an example report that displays the state of updates, with a focus on a
4761specific update, showing which computers need the update, which have it already, and
4762which have failed to install it.
4763Figure 7-9. Sample update report
4764This kind of cloud-based reporting is invaluable and really underlines the value in
4765using Intune for checking the compliance of remote computers.
4766Agent Settings
4767In the same way that automatic approval rules can be created to affect the way
4768different computers apply updates, the Intune client agent can also be configured in
4769a configuration policy. You will find these configuration policies in Policy ➤ Add ➤
4770Computer Management ➤ Microsoft Intune Agent Settings.
4771179CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4772There are numerous areas such Endpoint Protection settings that can be configured
4773in the Intune Agent configuration policy, but Figure  7-10 shows the section related to
4774updates.
4775Figure 7-10. Intune agent updates settings
4776A summary of some of the settings is shown in Table  7-2 , which is useful for the
4777upcoming section on troubleshooting.
4778Table 7-2. Default Update Policy Settings
4779Setting Value
4780Update and application detection frequency 8 hours
4781Install updates and applications automatically as scheduled Every day, 03:00am
4782Delay following Windows restart to begin installing missed
4783scheduled updates and applications 5 minutes
4784180CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4785Troubleshooting Microsoft Intune Updates
4786Troubleshooting Intune clients can be tricky from the outset, as they can simply be
4787Internet-connected Windows computers that you do not have direct contact with in the
4788same way you would traditionally manage desktop PCs within a corporate environment.
4789You must approach troubleshooting Intune-managed updates systematically to
4790ensure success.
4791First, start by verifying that the client is listed as a managed client in the Intune
4792Admin Console. You can do this by looking in Groups ➤ All Devices ➤ All Computers.
4793You can see an enrolled client in Figure  7-11 , along with its computer name, when it last
4794updated, and other useful information.
4795Figure 7-11. Enrolled devices list
4796If the computer is not even listed here, then there is an issue with the client not
4797communicating with the Intune services, or the client software was not successfully
4798installed. Communications failures are hard to diagnose remotely, as you may not have
4799physical access to the computer. First, try to identify whether the issue is a generic Internet
4800access problem or whether it is just the Intune servers that cannot be accessed. Do not
4801overlook proxy servers that may exist between the computer and the Internet as well.
4802â–  Tip A simple way of testing whether a client can access Intune services over the
4803Internet is to try and access https://manage.microsoft.com from a web browser on the
4804computer. If this cannot be reached, then there is either a DNS or Internet access issue or
4805the service is down. To check the status of Intune services, visit https://status.manage.
4806microsoft.com/StatusPage/ServiceDashboard
4807181CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4808Bookmarking the Service Dashboard URL can be a fast way of verifying whether a
4809connectivity issue is likely to affect lots of devices, or indeed if the problem exists at the
4810user’s device rather than in the cloud, or any other transient Internet issue. Figure  7-12
4811shows the current status of service in each Intune datacenter location.
4812Figure 7-12. Intune service status
4813Check also that the client software installed successfully. There are numerous error
4814codes that can be reported in the Alerts area of the Admin Console if a client has an issue,
4815but can still connect to Intune. It can be worth attempting to reinstall the client software.
4816This is not as straightforward as finding the application in Programs and Features in the
4817Control Panel and removing it, as it is not visible there. The device needs to be “retired”
4818from the Intune Admin Console, which creates a task to uninstall it. It can then be
4819reinstalled in the same way a client is provisioned for the first time, as was discussed
4820earlier in this chapter.
4821Checking services is a really good way of determining that the problem does not exist
4822on the client computer. The main Intune-related service is called the Microsoft Online
4823Management Client Service. This should be running, and it communicates with Intune for
4824most of the client-server interactions. The other dependency service to check is Windows
4825Update. This service is the same service that was mentioned in Chapter 6 , but it will have
4826been modified to point to Intune for management while working in the same way.
4827One possible reason why a domain-joined client may not be reporting in an update
4828status to Intune is a conflict with Group Policy Object (GPO) settings. Consider this
4829example: you have deployed WSUS to manage desktop computers and created a GPO
4830that configures those machines to use the WSUS server as the point for updates. You have
4831some domain-joined clients that are supposed to be managed by Intune, but actually pick
4832up the WSUS server GPO settings, in which case GPO will win over the Intune settings
4833and the client will use WSUS only. Use GPResult.exe /Z or the Resultant Set of Policy
4834MMC snap-in to diagnose whether this is the case. You should exclude computers in this
4835type of scenario from being affected by such a policy.
4836182CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4837Patience!
4838One thing that IT professionals are known for is being impatient. We expect to click a
4839button and “Hey, Presto!” it’s done. Well, sort of. With Intune, there are several intervals
4840during which an administrator should be patient and wait for before throwing the towel
4841in. These are summarized next, with default values taken from Table  7-2 :
4842• Time from installation of client software to it being reported in the
4843Admin Console: 30 minutes. (Typically, it’s less than this, but to
4844manage expectations, Microsoft recommends waiting at least this
4845length of time before troubleshooting.)
4846• Time for approved updates to show as needed on a computer
4847(up to eight hours for detection frequency)
4848• Time for approved updates to download to client (depends on
4849type of update and whether there is a deadline for the update)
4850• Time for downloaded update to install (03:00 every day, or when
4851the computer is next booted if missed)
4852• Time for installed updates to be reported back to Intune. (This
4853works in the detection cycle, like checking for updates, so it can
4854show a false picture in the short term where computers may be up
4855to date but Intune is not aware of that yet).
4856In other words, do not expect an even, universal view of the managed PCs in
4857the short term. Things will work themselves out, and computers that have an update
4858approved to them should get the update downloaded, installed, and reported back to
4859Intune in due course. In the short term, however, expect that some computers will not be
4860switched on, will not be connected to the Internet, or will be waiting for scheduled check-
4861ins before acting on instructions. Don’t forget, these are configurable as well!
4862Summary
4863In this chapter, we have seen how Microsoft Intune can be used to manage updates for
4864clients even if they are remote from the corporate network. The Intune administrator has
4865a few configuration tasks that are unique to that service, such as initially adding the client
4866agent software to devices so that they can be managed. Once under the control of Intune,
4867many aspects of update management are very similar to what you saw in Chapter 6 .
4868Certainly as a skillset, an administrator with experience of WSUS will not have a steep
4869learning curve, though they will need to adapt what they know about on premise – based
4870update management to how it works in the cloud.
4871We hope that you have enjoyed reading this book and that it has given you much
4872greater insight into installing and updating Windows, whether that is on a per computer
4873basis or at scale on a larger network using services such as WDS and WSUS.
4874183CHAPTER 7 â–  MANAGING WINDOWS UPDATES WITH INTUNE
4875You should now feel more confident that you know how Windows can be installed or
4876upgraded and kept updated, and how administrators can deploy it at scale over a network
4877using lite-touch or zero-touch methods via MDT and SCCM. Importantly, you also know
4878how to keep Windows plugged into the update and upgrade cadence that Microsoft
4879introduced with Windows 10, so that your devices will remain protected and up to date
4880and you can control and have ownership of the process, whether you are using SCCM,
4881WSUS, or Intune to manage the clients.
4882Now, it’s your turn to take what you have read about and start using the tools that we
4883have described throughout the book!
4884Andrew & Chris
4885184Index
4886„ A
4887Activation process, windows , 60–64
4888Active Directory – based activation , 62
4889Automated Installation Kit (AIK) , 13, 17
4890Automating Deployment
4891clients , 136
4892distribution points , 134
4893installation process , 135
4894logs , 135
4895MDT functionality
4896Confi gure Confi gMgr Integration
4897application , 127
4898Create MDT Task Sequence , 128–129
4899customsettings.ini fi le , 131
4900Deployment Method , 130
4901SCCM/MDT task sequence , 130
4902OSD
4903confi guration , 125
4904MDT and WDS , 124
4905PXE support , 125–126
4906SCCM
4907clients installation , 122–123
4908components , 120
4909site system servers , 121
4910task sequences , 136
4911„ B
4912Basic Input/Output System (BIOS) , 34
4913Boot and system partitions , 42–45
4914Boot Confi guration Data (BCD) , 2
4915BCDEdit.exe , 4
4916BIOS-based systems , 3
4917components , 2
4918EFI , 3
4919HAL , 6
4920Ntldr process , 2
4921startup and recovery , 4
4922system confi guration utility , 4
4923third-party tools , 4
4924WMI , 4
4925Bring Your Own Device (BYOD) , 167
4926„ C
4927Cabinet ( .cab ) fi les , 7
4928Certifi cate of authenticity (COA) , 85
4929Choose Your Own Device (CYOD) , 167
4930Current Branch for Business (CBB) , 83, 148
4931„ D
4932Deployment Image Servicing and
4933Management (DISM) , 1, 7, 18
4934Deployment Shares , 107
4935Device management
4936Windows 10
4937CBB , 148–149
4938Current Branch , 148
4939Insider program , 148
4940long-term servicing branch , 150
4941service model , 147
4942Windows Update
4943Control Panel , 142
4944services , 146
4945Windows 10 , 144–145
4946WSUS
4947client confi guration , 157, 163
4948computer groups , 155, 164
4949detection process , 162
4950Group Policy settings , 157, 159
4951HFNetChk , 151
4952hierarchy confi guration , 154
4953© Chris Rhodes and Andrew Bettany 2016
4954C. Rhodes and A. Bettany, Windows Installation and Update Troubleshooting,
4955DOI 10.1007/978-1-4842-1827-3
4956185â–  INDEX
4957Device management (cont.)
4958infrastructure , 152
4959Installation process , 153
4960reporting , 165
4961services , 163
4962source of, updates , 161
4963updates vs . upgrades , 139, 141
4964WiFi connection settings , 163
4965disk management , 43
4966DiskPart , 12
4967Distribution point (DP) , 125
4968„ E
4969Electronic Software Download (ESD) , 79
4970Enterprise Mobility Suite (EMS) , 168
4971Extensible Firmware Interface (EFI) , 3
4972„ F
4973Floppy disks , 1
4974„ G
4975Globally Unique Identifi er (GUID) , 44
4976Graphical User Interface (GUI) , 10, 12
4977Group Policy Object (GPO) , 182
4978„ H
4979Hardware abstraction layer (HAL) , 6
4980Hyper-V , 56–58, 60
4981„ I, J
4982Image-based setup (IBS) , 7
4983ImageX , 12
4984Imaging and Confi guration Designer (ICD)
4985customization , 19, 22
4986MDT , 19
4987online and offl ine images , 19
4988provisioning package
4989creation , 19–20
4990digitally signed catalog fi le , 22
4991installation , 22
4992.ppkg fi le , 22
4993scenarios , 20
4994SCCM , 19
4995Independent software vendors (ISVs) , 27
4996Information center , 107
4997186
4998„ K
4999Key Management Service (KMS) key , 61
5000„ L
5001Linux/MAC , 51, 53
5002Long-Term Servicing Branch (LTSB) , 85
5003„ M, N
5004Media Creation Tool (MCT) , 71
5005Microsoft Baseline Security Analyzer
5006(MBSA) , 151
5007Microsoft Deployment Toolkit
5008(MDT) , 17, 19, 107
5009Microsoft Intune
5010confi guring
5011agent settings , 179
5012automatic approval rules , 176
5013default groups , 177
5014EXE , 176
5015MSI , 176
5016MSP , 176
5017update classifi cations , 175, 178, 179
5018creation
5019adding users , 172
5020assign role , 173
5021computer management , 169
5022Microsoft_Intune_Setup.exe , 174
5023tenant subscription , 170
5024features , 168
5025integration , 168
5026troubleshooting, service status , 182
5027Microsoft license keys , 61
5028Microsoft volume licensing program , 62
5029Multi-Booting Windows , 45–46, 48, 50
5030Multiple activation key (MAKs) , 62
5031„ O
5032Operating System Deployment (OSD) , 123
5033Original equipment
5034manufacturer (OEM) , 61
5035Out-of-box-experience (OOBE) , 80, 93
5036„ P, Q
5037PowerShell , 13â–  INDEX
5038„ R
5039Retail license key , 61
5040„ S
5041Security Identifi er (SID) , 12
5042System center confi guration manager
5043(SCCM) , 17, 19, 85, 119
5044System image manager (SIM) , 91
5045System preparation tool (Sysprep) , 1, 10
5046„ T, U
5047Th ied-party migration tools (Paid) , 41
5048Th ird-party dual-boot tools , 50
5049Troubleshooting activation , 65–66
5050Troubleshooting process
5051BitLocker Drive Encryption , 87
5052device , 85
5053policy settings , 87
5054reliability monitor screen , 86
5055setuperr.log , 87
5056Trusted Platform Modules (TPM) , 81
5057„ V
5058Virtual hard disk (VHD) , 53–55
5059Volume licensing service center (VLSC) , 30
5060„ W, X, Y, Z
5061WDS
5062clients , 116
5063device drivers , 115
5064DISM
5065boot images , 102
5066DHCP settings , 105–106
5067install images , 103
5068install WDS server , 98
5069NTFS permissions , 106
5070PXE response settings , 101
5071WIM fi le , 97
5072WinPE , 97
5073gold image , 90
5074iceberg , 116
5075iterative testing , 117
5076MDT
5077add applications , 112
5078BDD.log , 113
5079bootstrap.ini , 114
5080customsettings.ini , 113
5081Deployment Workbench , 107–108
5082edit task sequences , 111
5083new task sequences , 108–109
5084packages , 112
5085update Deployment Share , 112
5086OOBE , 93
5087reference computer , 92
5088Sysprep tool , 93, 116
5089virtual machine , 91
5090Windows Activation , 114
5091Windows SIM , 94
5092Windows Assessment and Deployment Kit
5093(ADK) , 7, 13–15, 17–18, 20, 40
5094Windows Assessment Toolkit , 23
5095Windows Automated Installation Kit
5096(AIK) , 7, 14
5097Windows Boot Loader identifi er
5098(GUID) , 45
5099Windows Deployment Services (WDS) , 90
5100Windows image format (WIM) , 1, 7, 29, 79
5101Windows installation
5102BCD , 2
5103BCDEdit.exe , 4
5104BIOS-based systems , 3
5105components , 2
5106EFI , 3
5107HAL , 6
5108Ntldr process , 2
5109startup and recovery , 4
5110system confi guration utility , 4
5111third-party tools , 4
5112WMI , 4
5113cloud installation, fl oppy disk to , 1
5114tools
5115ADK , 13
5116DiskPart , 12
5117DISM , 19
5118ICD , 19
5119ImageX , 12
5120PowerShell , 13
5121Sysprep , 10
5122WIM , 7
5123Windows Assessment Toolkit , 23
5124Windows SIM , 14
5125WinPE , 17
5126.cab fi le , 7
5127Setup.exe , 8
5128Windows Performance Toolkit , 25
5129187â–  INDEX
5130Windows installations
5131BIOS , 34
5132boot process , 35
5133Coreinfo , 36
5134DVD , 29, 32
5135failure issues , 39
5136GUI tool , 33
5137hardware requirements , 35, 38
5138methods , 37–38
5139MSDN subscription , 32
5140upgrade
5141Cortana , 80
5142Disk Cleanup tool , 70
5143OEM installation , 68
5144PC settings , 81
5145process , 80
5146revert process , 70
5147SetupCleanupTask window , 71
5148troubleshootingprocess (see
5149(Troubleshooting process) )
5150vs . clean installations , 68
5151Windows OS, DVD/USB
5152(see (Windows OS, DVD/USB) )
5153Windows update service , 77–78
5154188
5155USB fl ash drive , 33
5156USMT , 39–40
5157Windows Management Instrumentation
5158(WMI) , 4
5159Windows OEM Preinstallation Kit
5160(Windows OPK) , 18
5161Windows OS, DVD/USB
5162cancel button , 75
5163install Windows 10 , 72
5164MCT tool , 72
5165upgrade, Log in , 76
5166Windows 10 desktop , 77
5167Windows 10 upgrade stages , 75
5168Windows Performance
5169Analyzer (WPA) , 25, 27
5170Windows Performance
5171Recorder (WPR) , 25, 27
5172Windows Performance Toolkit , 25
5173Windows Preinstallation Environment
5174(Windows PE/WinPE) , 17
5175Windows Server Update Services
5176(WSUS) , 139
5177Windows Setup Image Manager
5178(Windows SIM) , 14, 94