USMT and other deploy articles refresh 2024-08 2

This commit is contained in:
Frank Rojas 2024-08-28 20:08:01 -04:00
parent 028b1913ff
commit 524e0200fd

View File

@ -6,7 +6,7 @@ ms.author: frankroj
author: frankroj
ms.service: windows-client
ms.topic: conceptual
ms.date: 11/23/2022
ms.date: 08/28/2024
ms.subservice: itpro-deploy
---
@ -20,7 +20,7 @@ This article also covers the different types of reference images that can be bui
## Windows Assessment and Deployment Kit
Windows ADK contains core assessment and deployment tools and technologies, including:
The Windows Assessment and Deployment Kit (Windows ADK) contains core assessment and deployment tools and technologies, including:
- [Deployment Image Servicing and Management (DISM)](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows).
- [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-packages).
@ -47,7 +47,7 @@ DISM services online and offline images. For example, with DISM you can install
Dism.exe /Online /Enable-Feature /FeatureName:NetFX3 /All /Source:D:\Sources\SxS /LimitAccess
```
In Windows you can use Windows PowerShell for many of the functions done by DISM.exe. The equivalent command in Windows using PowerShell is:
Windows PowerShell can be used in Windows for many of the functions done by **DISM.exe**. The equivalent command in Windows using PowerShell is:
```powershell
Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All
@ -102,7 +102,7 @@ For more information, see [Provisioning packages for Windows](/windows/configura
### Windows System Image Manager (Windows SIM)
Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don't need Windows SIM often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall.
Windows System Image Manager (Windows SIM) is an authoring tool for **Unattend.xml** files. Windows SIM isn't normally needed when using Microsoft Configuration Manager. Microsoft Configuration Manager automatically creates and updates the **Unattend.xml** file based on settings specified in the task sequence, primarily at the **Apply Windows Settings** task. The automation in Microsoft Configuration Manager greatly simplifies the overall process.
For more information, see [Windows System Image Manager Technical Reference](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference).
@ -125,170 +125,136 @@ For more information on the VAMT, see the following articles:
Windows PE is a "lite" version of Windows used as a deployment platform.
Windows PE is like any other operating system and it needs drivers. However, it doesn't need a full set of drivers. It only needs the drivers to deploy Windows. Normally this is just network and storage drivers. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box.
![A machine booted with the Windows ADK default Windows PE boot image.](images/mdt-11-fig09.png)
A machine booted with the Windows ADK default Windows PE boot image.
Windows PE is like any other operating system and it needs drivers. However, it doesn't need a full set of drivers. It only needs a minimalist set of drivers necessary to deploy Windows. Normally only network and storage drivers are needed. Windows PE already includes a set of drivers out of the box so most devices work without the need to add any additional drivers.
For more information on Windows PE, see [Windows PE (WinPE)](/windows-hardware/manufacture/desktop/winpe-intro).
## Windows Recovery Environment
Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you'll see an automatic failover into Windows RE.
![A Windows 10 client booted into Windows RE, showing Advanced options.](images/mdt-11-fig10.png)
A Windows 10 client booted into Windows RE, showing Advanced options.
Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in currently supported versions of Windows. Windows RE is based on Windows PE. If needed, Windows RE can also be extended with custom tools. If a Windows fails to start and Windows RE is installed, an automatic failover into Windows RE occurs.
For more information on Windows RE, see [Windows Recovery Environment](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference).
## Windows Deployment Services
Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you'll use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker.
The main functions of Windows Deployment Services (WDS) are:
![Windows Deployment Services using multicast to deploy three machines.](images/mdt-11-fig11.png)
- PXE boot support.
- Multicast.
- BitLocker Network Unlock.
Windows Deployment Services using multicast to deploy three machines.
The following considerations should be observed when using WDS for operating system deployment:
In Windows Server 2012 R2, [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831764(v=ws.11)) can be configured for stand-alone mode or for Active Directory integration. The Active Directory integration mode is the best option, in most scenarios. WDS also has the capability to manage drivers; however, driver management through MDT and Configuration Manager is more suitable for deployment due to the flexibility offered by both solutions, so you'll use them instead. In WDS, it's possible to pre-stage devices in Active Directory, but here, too, Configuration Manager has that capability built in, and MDT has the ability to use a SQL Server database for pre-staging. In most scenarios, those solutions are better than the built-in pre-staging function as they allow greater control and management.
- WDS can be configured for stand-alone mode or for Active Directory integration. Active Directory integration mode is the recommended option in most scenarios.
### Trivial File Transfer Protocol (TFTP) configuration
- WDS has the capability to manage drivers. However, driver management through Microsoft Configuration Manager is more suitable for deployment due to the flexibility offered by Microsoft Configuration Manager.
In some cases, you need to modify TFTP Maximum Block Size settings for performance tuning reasons, especially when PXE traffic travels through routers and such. In the previous version of WDS, it was possible to change that, but the method of do so—editing the registry—wasn't user friendly. In Windows Server 2012, this modification in settings has become much easier to do as it can be configured as a setting.
- WDS can pre-stage unknown devices as a known computer in Active Directory. However, Microsoft Configuration Manager also has the capability of staging unknown devices as known devices in it's database. In most scenarios, Microsoft Configuration Manager is a better solution for pre-staging devices since Microsoft Configuration Manager allows greater control and management.
Also, there are a few new features related to TFTP performance:
- Trivial File Transfer Protocol (TFTP) block size and windows size settings can be configured with WDS to increase performance and download speeds during PXE booting. However, although an increase in TFTP settings can increase performance and download speeds, it can also decrease reliability and cause failures, including a reduction of download speeds. There are many variables involved when determining TFTP settings, including networking equipment, network configuration, and device compatibility.
- **Scalable buffer management**: Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer.
- **Scalable port management**: Provides the capability to service clients with shared UDP port allocation, increasing scalability.
- **Variable-size transmission window (Variable Windows Extension)**: Improves TFTP performance by allowing the client and server to determine the largest workable window size.
![TFTP changes are now easy to perform.](images/mdt-11-fig12.png)
TFTP changes are now easy to perform.
## Microsoft Deployment Toolkit
MDT is a free deployment solution from Microsoft. It provides end-to-end guidance, best practices, and tools for planning, building, and deploying Windows operating systems. MDT builds on top of the core deployment tools in the Windows ADK by contributing guidance, reducing complexity, and adding critical features for an enterprise-ready deployment solution.
MDT has two main parts: the first is Lite Touch, which is a stand-alone deployment solution; the second is Zero Touch, which is an extension to Configuration Manager.
**Note**
Lite Touch and Zero Touch are marketing names for the two solutions that MDT supports, and the naming has nothing to do with automation. You can fully automate the stand-alone MDT solution (Lite Touch), and you can configure the solution integration with Configuration Manager to prompt for information.
![The Deployment Workbench in, showing a task sequence.](images/mdt-11-fig13.png)
The Deployment Workbench in, showing a task sequence.
For more information on MDT, see the [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) resource center.
## Microsoft Security Compliance Manager 2013
[Microsoft SCM](https://www.microsoft.com/download/details.aspx?id=53353) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer.
![The SCM console showing a baseline configuration for a fictional client's computer security compliance.](images/mdt-11-fig14.png)
The SCM console showing a baseline configuration for a fictional client's computer security compliance.
## Microsoft Desktop Optimization Pack
MDOP is a suite of technologies available to Software Assurance customers through another subscription.
The following components are included in the MDOP suite:
- **Microsoft Application Virtualization (App-V).** App-V 5.0 provides an integrated platform, more flexible virtualization, and powerful management for virtualized applications. With the release of App-V 5.0 SP3, you have support to run virtual applications on Windows 10.
- **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions.
- **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation.
- **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines.
- **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, and monitor compliance with these policies.
For more information on the benefits of an MDOP subscription, see [Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack/).
<!--
REMOVING SECTION SINCE INTERNET EXPLORER IS NO LONGER SUPPORTED
## Internet Explorer Administration Kit 11
There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file.
![The User Experience selection screen in IEAK 11.](images/mdt-11-fig15.png)
The User Experience selection screen in IEAK 11.
To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Information and Downloads](/internet-explorer/ie11-ieak/ieak-information-and-downloads) page.
-->
For stand-alone WDS, TFTP settings can be configured in the WDS console under the **TFTP** tab in the properties of the WDS server. For Microsoft Configuration manager, see [Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points](/mem/configmgr/osd/get-started/prepare-site-system-roles-for-operating-system-deployments#customize-the-ramdisk-tftp-block-and-window-sizes-on-pxe-enabled-distribution-points).
## Windows Server Update Services
WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment.
WSUS is a server role in Windows Server that enables a local repository of Microsoft updates. The Microsoft Update can then be distributed from the WSUS server to devices in the organization's environment without having to go out to the public Microsoft Update site. WSUS offers approval control and reporting of update status in the environment.
![The Windows Server Update Services console.](images/mdt-11-fig16.png)
The Windows Server Update Services console.
For more information on WSUS, see the [Windows Server Update Services Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852345(v=ws.11)).
For more information on WSUS, see the [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus).
## Unified Extensible Firmware Interface
For many years, BIOS has been the industry standard for booting a PC. BIOS has served us well, but it's time to replace it with something better. **UEFI** is the replacement for BIOS, so it's important to understand the differences between BIOS and UEFI. In this section, you learn the major differences between the two and how they affect operating system deployment.
Unified Extensible Firmware Interface (**UEFI**) is used to initialize and boot a device. It's the successor for BIOS that was the method used for many years to initialize and boot a device. However, BIOS had several limitations including:
### Introduction to UEFI
BIOS has been in use for approximately 30 years. Even though it clearly has proven to work, it has some limitations, including:
This section will go over the advantages of UEFI over BIOS, how the two differ, and now it affects operating system deployment.
- 16-bit code
- 1-MB address space
- Poor performance on ROM initialization
- MBR maximum bootable disk size of 2.2 TB
As the replacement to BIOS, UEFI has many features that Windows can and will use.
### Introduction to UEFI
With UEFI, you can benefit from:
Although BIOS was used successfully on devices for many years, it has some limitations. For example:
- **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks.
- **Faster boot time.** UEFI doesn't use INT 13, and that improves boot time, especially when it comes to resuming from hibernate.
- **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start.
- **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS.
- **CPU-independent architecture.** Even if BIOS can run both 32-bit and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS.
- **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That isn't needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment.
- **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors.
- **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware can't switch the boot loader.
- 16-bit code
- 1-MB address space
- Poor performance on ROM initialization
- MBR maximum bootable disk size of 2.2 TB
### UEFI versions
As the replacement to BIOS, UEFI has many features that Windows uses. UEFI has the following features not available in BIOS:
UEFI Version 2.3.1B is the version required for Windows 8 and later logo compliance. Later versions have been released to address issues; a few machines may need to upgrade their firmware to fully support the UEFI implementation in Windows 8 and later.
- **Support for large disks** - UEFI requires a GUID Partition Table (GPT) based disk GPT supports can support disks up to approximately 16.8 million TB in disk size and more than 100 primary disks.
- **Faster boot time** - UEFI replaces interrupt call INT 13h that is available BIOS, improving boot time, especially when resuming from hibernate.
- **Multicast deployment** - UEFI firmware can use multicast directly when it boots up. With solutions such as WDS and Microsoft Configuration Manager, multicast support is only available by first booting into Windows PE. With UEFI, multicast can run directly from UEFI.
- **Compatibility with earlier BIOS** - Older devices with UEFI had a UEFI implementation that included a compatibility support module (CSM) that emulates BIOS. Due to the current wide support of UEFI, modern devices don't have CSM and therefore aren't backward compatible with BIOS. For example, Windows 11 only supports modern devices since it doesn't support BIOS and only supports UEFI.
- **CPU-independent architecture** - BIOS can run both 32-bit and 64-bit versions of firmware. However, all firmware device drivers on BIOS systems must be 16-bit. This limitation affects performance and only 64 KB of memory can be addressed. UEFI removes these limitations.
- **CPU-independent drivers** - On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. This limitation isn't needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images. EBC images allow for a processor-independent device driver environment.
- **Flexible pre-operating system environment** - UEFI supports UEFI application that can run before the OS is loaded. UEFI applications allow many additional features such as diagnostics, automatic repairs, and call home to report errors.
- **Secure boot** - Currently supported versions of Windows use the UEFI firmware validation process, called [secure boot](/windows-hardware/design/device-experiences/oem-secure-boot). When secure boot is used, UEFI ensures that it launches only a verified operating system loader and that malware can't switch the boot loader.
### Hardware support for UEFI
In regard to UEFI, hardware is divided into four device classes:
- **Class 0 devices.** The device of this class is the UEFI definition for a BIOS, or non-UEFI, device.
- **Class 1 devices.** The devices of this class behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured.
- **Class 2 devices.** The devices of this class have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available.
- **Class 3 devices.** The devices of this class are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 isn't supported on these class 3 devices. Class 3 devices don't have a CSM to emulate BIOS.
- **Class 0 devices.** Devices in this class are BIOS, or non-UEFI, devices.
- **Class 1 devices.** Devices in this class behave like a standard BIOS device, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS.
- **Class 2 devices.** Devices in this class have the capability to behave as either a BIOS device or as a UEFI device. The boot process or the configuration in the firmware of the device determines the mode. Class 2 devices use a CSM to emulate BIOS.
- **Class 3 devices.** The devices of this class are UEFI-only devices. Devices in this class must run an operating system that supports only UEFI. All currently supported versions of Windows support UEFI. Class 3 devices don't have a CSM to emulate BIOS.
In general, all modern devices are Class 3 devices. Class 0, Class 1, and Class 2 devices are older devices and are no longer manufactured.
### Windows support for UEFI
Microsoft started with support for EFI 1.10 on servers and then added support for UEFI on both clients and servers.
- Windows 10 supports both x86 and x64 versions of UEFI.
With UEFI 2.3.1, there are both x86 and x64 versions of UEFI. Windows 10 supports both. However, UEFI doesn't support cross-platform boot. This limitation means that a computer that has UEFI x64 can run only a 64-bit operating system, and a computer that has UEFI x86 can run only a 32-bit operating system.
- Windows 11 and newer only supports x64 versions of UEFI.
### How UEFI is changing operating system deployment
- UEFI doesn't support cross-platform boot.
- UEFI x64 devices can only run a 64-bit operating system. Most modern UEFI devices are x64.
- UEFI x86 devices can run only a 32-bit operating system. For Windows, only Windows 10 x86 supports UEFI x86. Windows 11 and newer doesn't support UEFI x86 although UEFI x86 devices are rare.
### UEFI considerations for operating system deployment
There are many things that affect operating system deployment as soon as you run on UEFI/EFI-based hardware. Here are considerations to keep in mind when working with UEFI devices:
- Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS.
- When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It's common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa.
- When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4 GB.
- UEFI doesn't support cross-platform booting; therefore, you need to have the correct boot media (32-bit or 64-bit).
- Class 2 devices can switch between BIOS and UEFI via the device's firmware. Make sure the desired mode for the device is selected in the device's firmware. Microsoft recommends using Class 2 devices in UEFI mode due to the added benefits and security that UEFI provides.
When a Class 2 device is switched from BIOS to UEFI, one of the following two actions needs to take place:
- Via a tool such as [diskpart](/windows-server/administration/windows-commands/diskpart), the disk needs to be converted from MBR to GPT, and then partitioned accordingly to support UEFI. For example, while Windows running on BIOS only requires one partition that can be either FAT32 or NTFS, Windows running on a UEFI device requires the following partitions:
- FAT32 boot/system partition.
- NTFS OS partition.
- Microsoft reserved partition (MSR) partition (unique to Windows).
- Recovery partition (optional).
Because the existing disk is wiped as part of this process, Windows also needs to be reinstalled.
For more information, see [UEFI/GPT-based hard drive partitions](/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions).
- The [MBR2GPT.EXE](mbr-to-gpt.md) tool used to convert the disk from MBR to GPT for use with UEFI. **MBR2GPT.EXE** also reconfigures the partitioning on the disk with the correct partitioning for Windows to run on UEFI. The benefit of using the **MBR2GPT.EXE** is that it converts the disk and repartitions it without wiping the disk and without data loss, meaning Windows doesn't need to be reinstalled.
- When you deploy a Class 2 device, make sure the boot option is set to the proper boot device (hard drive, flash drive, PXE, etc.) The boot options available on Class 2 devices might differ between BIOS and UEFI modes.
- When a UEFI device boots from media, the media has to be FAT32. UEFI only supports booting from FAT32 partitions, which is why the boot/system partition on the disk is FAT32. Additionally, FAT32 has a file-size limitation of 4 GB. OS images larger than 4 GB need to be split with a tool such as [DISM](/windows-hardware/manufacture/desktop/what-is-dism). For more information, see [Split-WindowsImage](/powershell/module/dism/split-windowsimage) or [/Split-Image](/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14#split-image).
- UEFI doesn't support cross architecture booting. x64 devices require x64 boot media and x86 devices require x86 boot media.
- Most modern UEFI devices are x64. UEFI x86 devices are rare.
For more information on UEFI, see the [UEFI firmware](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824898(v=win.10)) overview and related resources.
## Related articles
## Related content
[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)<br>
[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md)
- [Windows ADK for Windows scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md).
- [MBR2GPT.EXE](mbr-to-gpt.md).
- [UEFI/GPT-based hard drive partitions](/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions).
- [UEFI firmware](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824898(v=win.10)).