mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
Deploy root code block standardization plus style updates 4
This commit is contained in:
Frank Rojas
parent
fe1d49ae81
commit
88a8bf9614
@ -93,7 +93,7 @@ All four of the roles specified above can be hosted on the same computer or each
|
||||
copy C:\winpe_amd64\media\sources\boot.wim y:\Boot
|
||||
```
|
||||
|
||||
9. (Optional) Copy true type fonts to the \boot folder
|
||||
9. (Optional) Copy TrueType fonts to the \boot folder
|
||||
|
||||
```cmd
|
||||
copy C:\winpe_amd64\media\Boot\Fonts y:\Boot\Fonts
|
||||
@ -178,8 +178,8 @@ ramdisksdidevice boot
|
||||
ramdisksdipath \Boot\boot.sdi
|
||||
```
|
||||
|
||||
>[!TIP]
|
||||
>If you start the PXE boot process, but receive the error **The boot configuration data for your PC is missing or contains error**, then verify that `\boot` directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different.
|
||||
> [!TIP]
|
||||
> If you start the PXE boot process, but receive the error **The boot configuration data for your PC is missing or contains error**, then verify that `\boot` directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different.
|
||||
|
||||
## PXE boot process summary
|
||||
|
||||
@ -210,7 +210,7 @@ DHCP OPTIONS ARE NOT RECOMMENDED AND IN SOME SCENARIOS NOT SUPPORTED. SWITCHING
|
||||
> [!NOTE]
|
||||
> The BCD store must reside in the `\boot` directory on the TFTP server and must be named BCD.
|
||||
|
||||
6. `Bootmgr.exe` reads the BCD operating system entries and downloads `boot\boot.sdi` and the Windows PE image (`boot\boot.wim`). Optional files that can also be downloaded include true type fonts (`boot\Fonts\wgl4_boot.ttf`) and the hibernation state file (`\hiberfil.sys`) if these files are present.
|
||||
6. `Bootmgr.exe` reads the BCD operating system entries and downloads `boot\boot.sdi` and the Windows PE image (`boot\boot.wim`). Optional files that can also be downloaded include TrueType fonts (`boot\Fonts\wgl4_boot.ttf`) and the hibernation state file (`\hiberfil.sys`) if these files are present.
|
||||
|
||||
7. `Bootmgr.exe` starts Windows PE by calling `winload.exe` within the Windows PE image.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ author: frankroj
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.collection: highpri
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.prod: windows-client
|
||||
ms.technology: itpro-deploy
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
---
|
||||
|
||||
# Deploy Windows To Go in your organization
|
||||
|
||||
@ -9,7 +9,7 @@ ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR)
|
||||
ms.prod: windows-client
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: high
|
||||
ms.topic: article
|
||||
|
||||
@ -8,7 +8,7 @@ author: frankroj
|
||||
ms.author: frankroj
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
|
||||
@ -48,7 +48,7 @@ The [MSIX Packaging Tool](/windows/application-management/msix-app-packaging-too
|
||||
|
||||
## Related links
|
||||
|
||||
- [Consumer applications for S mode](/windows/s-mode)
|
||||
- [S mode devices](/windows/view-all-devices)
|
||||
- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode)
|
||||
- [S mode devices](https://www.microsoft.com/windows/view-all-devices)
|
||||
- [Windows Defender Application Control deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide)
|
||||
- [Microsoft Defender for Endpoint](/microsoft-365/windows/microsoft-defender-atp)
|
||||
|
||||
@ -11,12 +11,12 @@ ms.technology: itpro-fundamentals
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: how-to
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
---
|
||||
|
||||
# Configure VDA for Windows subscription activation
|
||||
|
||||
Applies to:
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
@ -61,42 +61,55 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl
|
||||
## Active Directory-joined VMs
|
||||
|
||||
1. Use the following instructions to prepare the VM for Azure: [Prepare a Windows VHD or VHDX to upload to Azure](/azure/virtual-machines/windows/prepare-for-upload-vhd-image)
|
||||
2. (Optional) To disable network level authentication, type the following command at an elevated command prompt:
|
||||
|
||||
2. (Optional) To disable network level authentication, enter the following command at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
|
||||
```
|
||||
|
||||
3. At an elevated command prompt, type **sysdm.cpl** and press ENTER.
|
||||
3. At an elevated command prompt, enter **sysdm.cpl**.
|
||||
|
||||
4. On the Remote tab, choose **Allow remote connections to this computer** and then select **Select Users**.
|
||||
5. Select **Add**, type **Authenticated users**, and then select **OK** three times.
|
||||
|
||||
5. Select **Add**, enter **Authenticated users**, and then select **OK** three times.
|
||||
|
||||
6. Follow the instructions to use sysprep at [Steps to generalize a VHD](/azure/virtual-machines/windows/prepare-for-upload-vhd-image#generalize-a-vhd) and then start the VM again.
|
||||
|
||||
7. If you must activate Windows Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 8.
|
||||
1. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
1. Open Windows Configuration Designer and select **Provision desktop services**.
|
||||
1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
|
||||
2. Open Windows Configuration Designer and select **Provision desktop services**.
|
||||
|
||||
3. Under **Name**, enter **Desktop AD Enrollment Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
|
||||
> [!NOTE]
|
||||
> You can use a different project name, but this name is also used with dism.exe in a later step.
|
||||
|
||||
1. Under **Enter product key** type the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`.
|
||||
1. On the Set up network page, choose **Off**.
|
||||
1. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details.
|
||||
4. Under **Enter product key** enter the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`.
|
||||
|
||||
5. On the Set up network page, choose **Off**.
|
||||
|
||||
6. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details.
|
||||
|
||||
> [!NOTE]
|
||||
> This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms).
|
||||
|
||||
1. On the Add applications page, add applications if desired. This step is optional.
|
||||
1. On the Add certificates page, add certificates if desired. This step is optional.
|
||||
1. On the Finish page, select **Create**.
|
||||
1. In file explorer, open the VHD to mount the disk image. Determine the drive letter of the mounted image.
|
||||
1. Type the following command at an elevated command prompt. Replace the letter `G` with the drive letter of the mounted image, and enter the project name you used if it's different than the one suggested:
|
||||
7. On the Add applications page, add applications if desired. This step is optional.
|
||||
|
||||
8. On the Add certificates page, add certificates if desired. This step is optional.
|
||||
|
||||
9. On the Finish page, select **Create**.
|
||||
|
||||
10. In file explorer, open the VHD to mount the disk image. Determine the drive letter of the mounted image.
|
||||
|
||||
11. Enter the following command at an elevated command prompt. Replace the letter `G` with the drive letter of the mounted image, and enter the project name you used if it's different than the one suggested:
|
||||
|
||||
```cmd
|
||||
Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg"
|
||||
```
|
||||
|
||||
1. Right-click the mounted image in file explorer and select **Eject**.
|
||||
12. Right-click the mounted image in file explorer and select **Eject**.
|
||||
|
||||
8. See the instructions at [Upload and create VM from generalized VHD](/azure/virtual-machines/windows/upload-generalized-managed#upload-the-vhd) to sign in to Azure, get your storage account details, upload the VHD, and create a managed image.
|
||||
|
||||
@ -107,33 +120,50 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl
|
||||
|
||||
For Azure AD-joined VMs, follow the same instructions as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions:
|
||||
|
||||
- During setup with Windows Configuration Designer, under **Name**, type a name for the project that indicates it isn't for Active Directory-joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**.
|
||||
- During setup with Windows Configuration Designer, under **Name**, enter a name for the project that indicates it isn't for Active Directory-joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**.
|
||||
|
||||
- During setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organization's credentials.
|
||||
|
||||
- When entering the PackagePath, use the project name you previously entered. For example, **Desktop Bulk Enrollment Token Pro GVLK.ppkg**
|
||||
|
||||
- When attempting to access the VM using remote desktop, you'll need to create a custom RDP settings file as described below in [Create custom RDP settings for Azure](#create-custom-rdp-settings-for-azure).
|
||||
|
||||
## Azure Gallery VMs
|
||||
|
||||
1. (Optional) To disable network level authentication, type the following command at an elevated command prompt:
|
||||
1. (Optional) To disable network level authentication, enter the following command at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
|
||||
```
|
||||
|
||||
2. At an elevated command prompt, type `sysdm.cpl` and press ENTER.
|
||||
2. At an elevated command prompt, enter `sysdm.cpl`.
|
||||
|
||||
3. On the Remote tab, choose **Allow remote connections to this computer** and then select **Select Users**.
|
||||
4. Select **Add**, type **Authenticated users**, and then select **OK** three times.
|
||||
|
||||
4. Select **Add**, enter **Authenticated users**, and then select **OK** three times.
|
||||
|
||||
5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
|
||||
|
||||
6. Open Windows Configuration Designer and select **Provision desktop services**.
|
||||
|
||||
7. If you must activate Windows Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8.
|
||||
1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
2. Under **Enter product key** type the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`.
|
||||
8. Under **Name**, type **Desktop Bulk Enrollment**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
|
||||
1. Under **Name**, enter **Desktop Bulk Enrollment Token Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
|
||||
2. Under **Enter product key** enter the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`.
|
||||
|
||||
8. Under **Name**, enter **Desktop Bulk Enrollment**, select **Finish**, and then on the **Set up device** page enter a device name.
|
||||
|
||||
9. On the Set up network page, choose **Off**.
|
||||
|
||||
10. On the Account Management page, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials.
|
||||
|
||||
11. On the Add applications page, add applications if desired. This step is optional.
|
||||
|
||||
12. On the Add certificates page, add certificates if desired. This step is optional.
|
||||
|
||||
13. On the Finish page, select **Create**.
|
||||
|
||||
14. Copy the PPKG file to the remote virtual machine. Open the provisioning package to install it. This process will restart the system.
|
||||
|
||||
> [!NOTE]
|
||||
@ -142,9 +172,13 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j
|
||||
## Create custom RDP settings for Azure
|
||||
|
||||
1. Open Remote Desktop Connection and enter the IP address or DNS name for the remote host.
|
||||
|
||||
2. Select **Show Options**, and then under Connection settings select **Save As**. Save the RDP file to the location where you'll use it.
|
||||
|
||||
3. Close the Remote Desktop Connection window and open Notepad.
|
||||
|
||||
4. Open the RDP file in Notepad to edit it.
|
||||
|
||||
5. Enter or replace the line that specifies authentication level with the following two lines of text:
|
||||
|
||||
```text
|
||||
|
||||
@ -8,13 +8,14 @@ ms.author: frankroj
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
|
||||
# Windows Deployment Services (WDS) boot.wim support
|
||||
|
||||
Applies to:
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
|
||||
@ -9,12 +9,13 @@ ms.prod: windows-client
|
||||
ms.technology: itpro-deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: reference
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
---
|
||||
|
||||
# Windows 10 deployment process posters
|
||||
|
||||
**Applies to**
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
|
||||
The following posters step through various options for deploying Windows 10 with Windows Autopilot or Microsoft Configuration Manager.
|
||||
|
||||
@ -7,13 +7,13 @@ author: frankroj
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
|
||||
# Windows 10 deployment scenarios
|
||||
|
||||
**Applies to**
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
|
||||
@ -55,9 +55,9 @@ The following tables summarize various Windows 10 deployment scenarios. The scen
|
||||
|[Refresh](#computer-refresh)|Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. | [Refresh a Windows 7 computer with Windows 10](/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10)<br>[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager)|
|
||||
|[Replace](#computer-replace)|Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device.| [Replace a Windows 7 computer with a Windows 10 computer](/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer)<br>[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager)|
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.<br>
|
||||
>Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS.
|
||||
> [!IMPORTANT]
|
||||
> The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.<br>
|
||||
> Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS.
|
||||
|
||||
## Modern deployment methods
|
||||
|
||||
@ -106,7 +106,7 @@ For new PCs, organizations have historically replaced the version of Windows inc
|
||||
|
||||
The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include:
|
||||
|
||||
### Windows 10 Subscription Activation<A ID="windows-10-subscription-activation"></A>
|
||||
### Windows 10 Subscription Activation
|
||||
|
||||
Windows 10 Subscription Activation is a dynamic deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation).
|
||||
|
||||
@ -122,17 +122,17 @@ These scenarios can be used to enable "choose your own device" (CYOD) programs.
|
||||
|
||||
While the initial Windows 10 release includes various provisioning settings and deployment mechanisms, provisioning settings and deployment mechanisms will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for more features through the Windows Feedback app or through their Microsoft Support contacts.
|
||||
|
||||
## Traditional deployment:
|
||||
## Traditional deployment
|
||||
|
||||
New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md), and [Microsoft Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md).
|
||||
New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md), and [Microsoft Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md).
|
||||
|
||||
With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important, and will continue to be available to organizations that need them.
|
||||
|
||||
The traditional deployment scenario can be divided into different sub-scenarios. These sub-scenarios are explained in detail in the following sections, but the following list provides a brief summary:
|
||||
|
||||
- **New computer.** A bare-metal deployment of a new machine.
|
||||
- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup).
|
||||
- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup).
|
||||
- **New computer**: A bare-metal deployment of a new machine.
|
||||
- **Computer refresh**: A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup).
|
||||
- **Computer replace**: A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup).
|
||||
|
||||
### New computer
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows 10/11 Enterprise E3 in CSP
|
||||
description: Describes Windows 10/11 Enterprise E3, an offering that delivers, by subscription, the features of Windows 10/11 Enterprise edition.
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
author: frankroj
|
||||
ms.author: frankroj
|
||||
manager: aaroncz
|
||||
@ -15,7 +15,8 @@ ms.technology: itpro-deploy
|
||||
|
||||
# Windows 10/11 Enterprise E3 in CSP
|
||||
|
||||
Applies to:
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
@ -60,15 +61,15 @@ In summary, the Windows 10/11 Enterprise E3 in CSP program is an upgrade offerin
|
||||
|
||||
Windows 10 Enterprise edition has many features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management.
|
||||
|
||||
*Table 1. Windows 10 Enterprise features not found in Windows 10 Pro*
|
||||
### Table 1. Windows 10 Enterprise features not found in Windows 10 Pro
|
||||
|
||||
|Feature|Description|
|
||||
|--- |--- |
|
||||
|Credential Guard|Credential Guard uses virtualization-based security to help protect security secrets so that only privileged system software can access them. Examples of security secrets that can be protected include NTLM password hashes and Kerberos Ticket Granting Tickets. This protection helps prevent Pass-the-Hash or Pass-the-Ticket attacks.<p>Credential Guard has the following features:<li>**Hardware-level security**. Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.<li>**Virtualization-based security**. Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.<li>**Improved protection against persistent threats**. Credential Guard works with other technologies (for example, Device Guard) to help provide further protection against attacks, no matter how persistent.<li>**Improved manageability**. Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.<p>For more information, see [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard).<p>*Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*|
|
||||
|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.<p>Device Guard protects in the following ways:<li>Helps protect against malware<li>Helps protect the Windows system core from vulnerability and zero-day exploits<li>Allows only trusted apps to run<p>For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).|
|
||||
|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.<p>For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).|
|
||||
|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.<p>For more information, see [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started).|
|
||||
|User Experience Virtualization (UE-V)|With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share.<p>When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.<p>UE-V provides the following features:<li>Specify which application and Windows settings synchronize across user devices<li>Deliver the settings anytime and anywhere users work throughout the enterprise<li>Create custom templates for your third-party or line-of-business applications<li>Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state<p>For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows).|
|
||||
|Credential Guard|Credential Guard uses virtualization-based security to help protect security secrets so that only privileged system software can access them. Examples of security secrets that can be protected include NTLM password hashes and Kerberos Ticket Granting Tickets. This protection helps prevent Pass-the-Hash or Pass-the-Ticket attacks.<br><br>Credential Guard has the following features:<li>**Hardware-level security** - Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.<li>**Virtualization-based security** - Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.<li>**Improved protection against persistent threats** - Credential Guard works with other technologies (for example, Device Guard) to help provide further protection against attacks, no matter how persistent.<li>**Improved manageability** - Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.<br><br>For more information, see [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard).<br><br>*Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*|
|
||||
|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.<br><br>Device Guard protects in the following ways:<li>Helps protect against malware<li>Helps protect the Windows system core from vulnerability and zero-day exploits<li>Allows only trusted apps to run<br><br>For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).|
|
||||
|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.<br><br>For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).|
|
||||
|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.<br><br>For more information, see [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started).|
|
||||
|User Experience Virtualization (UE-V)|With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share.<br><br>When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.<br><br>UE-V provides the following features:<li>Specify which application and Windows settings synchronize across user devices<li>Deliver the settings anytime and anywhere users work throughout the enterprise<li>Create custom templates for your third-party or line-of-business applications<li>Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state<br><br>For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows).|
|
||||
|Managed User Experience|This feature helps customize and lock down a Windows device's user interface to restrict it to a specific task. For example, you can configure a device for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. You can also restrict access to services including Cortana or the Windows Store, and manage Start layout options, such as:<li>Removing and preventing access to the Shut Down, Restart, Sleep, and Hibernate commands<li>Removing Log Off (the User tile) from the Start menu<li>Removing frequent programs from the Start menu<li>Removing the All Programs list from the Start menu<li>Preventing users from customizing their Start screen<li>Forcing Start menu to be either full-screen size or menu size<li>Preventing changes to Taskbar and Start menu settings|
|
||||
|
||||
## Deployment of Windows 10/11 Enterprise E3 licenses
|
||||
@ -104,8 +105,6 @@ For more information about implementing Credential Guard, see the following reso
|
||||
- [PC OEM requirements for Device Guard and Credential Guard](/windows-hardware/design/device-experiences/oem-security-considerations)
|
||||
- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337)
|
||||
|
||||
|
||||
|
||||
### Device Guard
|
||||
|
||||
Now that the devices have Windows 10/11 Enterprise, you can implement Device Guard on the Windows 10 Enterprise devices by performing the following steps:
|
||||
@ -152,6 +151,7 @@ For more information about implementing the App-V server, App-V sequencer, and A
|
||||
- [Deploying the App-V Sequencer and Configuring the Client](/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client)
|
||||
|
||||
### UE-V
|
||||
|
||||
UE-V requires server and client-side components that you'll need to download, activate, and install. These components include:
|
||||
|
||||
- **UE-V service**. The UE-V service (when enabled on devices) monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices.
|
||||
@ -174,7 +174,7 @@ For more information about deploying UE-V, see the following resources:
|
||||
|
||||
The Managed User Experience feature is a set of Windows 10 Enterprise edition features and corresponding settings that you can use to manage user experience. Table 2 describes the Managed User Experience settings (by category), which are only available in Windows 10 Enterprise edition. The management methods used to configure each feature depend on the feature. Some features are configured by using Group Policy, while others are configured by using Windows PowerShell, Deployment Image Servicing and Management (DISM), or other command-line tools. For the Group Policy settings, you must have AD DS with the Windows 10 Enterprise devices joined to your AD DS domain.
|
||||
|
||||
*Table 2. Managed User Experience features*
|
||||
#### Table 2. Managed User Experience features
|
||||
|
||||
| Feature | Description |
|
||||
|------------------|-----------------|
|
||||
|
||||
@ -3,7 +3,7 @@ title: Windows 10 volume license media
|
||||
description: Learn about volume license media in Windows 10, and channels such as the Volume License Service Center (VLSC).
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.author: frankroj
|
||||
@ -14,7 +14,7 @@ ms.technology: itpro-deploy
|
||||
|
||||
# Windows 10 volume license media
|
||||
|
||||
**Applies to**
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
|
||||
|
||||
@ -7,12 +7,12 @@ author: frankroj
|
||||
ms.author: frankroj
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.technology: itpro-deploy
|
||||
---
|
||||
# How to install fonts that are missing after upgrading to Windows client
|
||||
|
||||
**Applies to**
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
@ -36,7 +36,7 @@ For example, if you've an English, French, German, or Spanish version of Windows
|
||||
|
||||
If you want to use these fonts, you can enable the optional feature to add them back to your system. The removal of these fonts is a permanent change in behavior for Windows client, and it will remain this way in future releases.
|
||||
|
||||
## Installing language-associated features via language settings:
|
||||
## Installing language-associated features via language settings
|
||||
|
||||
If you want to use the fonts from the optional feature and you know that you'll want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. Use the Settings app.
|
||||
|
||||
@ -57,7 +57,7 @@ Once you've added Hebrew to your language list, then the optional Hebrew font fe
|
||||
> [!NOTE]
|
||||
> The optional features are installed by Windows Update. You need to be online for the Windows Update service to work.
|
||||
|
||||
## Install optional fonts manually without changing language settings:
|
||||
## Install optional fonts manually without changing language settings
|
||||
|
||||
If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings.
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Step by step - Deploy Windows 10 in a test lab using MDT
|
||||
description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT).
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/31/2022
|
||||
ms.date: 11/23/2022
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.author: frankroj
|
||||
@ -14,23 +14,26 @@ ms.technology: itpro-deploy
|
||||
|
||||
# Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit
|
||||
|
||||
**Applies to**
|
||||
*Applies to:*
|
||||
|
||||
- Windows 10
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide:
|
||||
- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md)
|
||||
|
||||
Complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide:
|
||||
- [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md)
|
||||
>
|
||||
> [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md)
|
||||
>
|
||||
> Complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide:
|
||||
>
|
||||
> [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md)
|
||||
|
||||
The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs):
|
||||
|
||||
- **DC1**: A contoso.com domain controller, DNS server, and DHCP server.
|
||||
- **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network.
|
||||
- **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network.
|
||||
|
||||
This guide uses the Hyper-V server role. If you don't complete all steps in a single session, consider using [checkpoints](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn818483(v=ws.11)) and [saved states](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee247418(v=ws.10)) to pause, resume, or restart your work.
|
||||
This guide uses the Hyper-V server role. If you don't complete all steps in a single session, consider using [checkpoints](/virtualization/hyper-v-on-windows/user-guide/checkpoints) to pause, resume, or restart your work.
|
||||
|
||||
## In this guide
|
||||
|
||||
@ -51,8 +54,11 @@ Topics and procedures in this guide are summarized in the following table. An es
|
||||
## About MDT
|
||||
|
||||
MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods.
|
||||
|
||||
- LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction.
|
||||
|
||||
- ZTI is fully automated, requiring no user interaction and is performed using MDT and Microsoft Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment.
|
||||
|
||||
- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and Microsoft Configuration Manager.
|
||||
|
||||
## Install MDT
|
||||
@ -80,11 +86,12 @@ MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch
|
||||
|
||||
A reference image serves as the foundation for Windows 10 devices in your organization.
|
||||
|
||||
1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command:
|
||||
1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and enter the following command:
|
||||
|
||||
```powershell
|
||||
Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso
|
||||
```
|
||||
|
||||
2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D.
|
||||
|
||||
3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, select **Start**, type **deployment**, and then select **Deployment Workbench**.
|
||||
@ -119,6 +126,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi
|
||||
For purposes of this test lab, we'll only add the prerequisite .NET Framework feature. Commercial applications (ex: Microsoft Office) won't be added to the deployment share. For information about adding applications, see the [Add applications](./deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) article.
|
||||
|
||||
11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
|
||||
|
||||
- Task sequence ID: **REFW10X64-001**<BR>
|
||||
- Task sequence name: **Windows 10 Enterprise x64 Default Image** <BR>
|
||||
- Task sequence comments: **Reference Build**<BR>
|
||||
@ -211,7 +219,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi
|
||||
> [!TIP]
|
||||
> To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**.
|
||||
|
||||
26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands:
|
||||
26. Open a Windows PowerShell prompt on the Hyper-V host computer and enter the following commands:
|
||||
|
||||
```powershell
|
||||
New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB
|
||||
@ -244,6 +252,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi
|
||||
This procedure will demonstrate how to deploy the reference image to the PoC environment using MDT.
|
||||
|
||||
1. On SRV1, open the MDT Deployment Workbench console, right-click **Deployment Shares**, and then select **New Deployment Share**. Use the following values in the New Deployment Share Wizard:
|
||||
|
||||
- **Deployment share path**: C:\MDTProd
|
||||
- **Share name**: MDTProd$
|
||||
- **Deployment share description**: MDT Production
|
||||
@ -274,6 +283,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
1. Using the Deployment Workbench, right-click **Task Sequences** under the **MDT Production** node, select **New Folder** and create a folder with the name: **Windows 10**.
|
||||
|
||||
2. Right-click the **Windows 10** folder created in the previous step, and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
|
||||
|
||||
- Task sequence ID: W10-X64-001
|
||||
- Task sequence name: Windows 10 Enterprise x64 Custom Image
|
||||
- Task sequence comments: Production Image
|
||||
@ -282,17 +292,18 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
- Specify Product Key: Don't specify a product key at this time
|
||||
- Full Name: Contoso
|
||||
- Organization: Contoso
|
||||
- Internet Explorer home page: http://www.contoso.com
|
||||
- Internet Explorer home page: `http://www.contoso.com`
|
||||
- Admin Password: pass@word1
|
||||
|
||||
### Configure the MDT production deployment share
|
||||
|
||||
1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands:
|
||||
1. On SRV1, open an elevated Windows PowerShell prompt and enter the following commands:
|
||||
|
||||
```powershell
|
||||
copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force
|
||||
copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force
|
||||
```
|
||||
|
||||
2. In the Deployment Workbench console on SRV1, right-click the **MDT Production** deployment share and then select **Properties**.
|
||||
|
||||
3. Select the **Rules** tab and replace the rules with the following text (don't select OK yet):
|
||||
@ -407,9 +418,9 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This configuration is just an artifact of the lab environment. In a typical deployment environment WDS wouldn't be installed on the default gateway.
|
||||
|
||||
> [!NOTE]
|
||||
> Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress**
|
||||
> Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, enter **`Get-NetIPAddress | ft interfacealias, ipaddress** in a PowerShell prompt.
|
||||
|
||||
Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command:
|
||||
Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and enter the following command:
|
||||
|
||||
```powershell
|
||||
Disable-NetAdapter "Ethernet 2" -Confirm:$false
|
||||
@ -417,7 +428,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
|
||||
>Wait until the disable-netadapter command completes before proceeding.
|
||||
|
||||
2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt:
|
||||
2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, enter the following commands at an elevated Windows PowerShell prompt:
|
||||
|
||||
```powershell
|
||||
New-VM -Name "PC2" -NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2
|
||||
@ -437,7 +448,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env
|
||||
|
||||
5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then select **Next**.
|
||||
|
||||
6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. Re-enabling the external network adapter is needed so the client can use Windows Update after operating system installation is complete. To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command:
|
||||
6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. Re-enabling the external network adapter is needed so the client can use Windows Update after operating system installation is complete. To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and enter the following command:
|
||||
|
||||
```powershell
|
||||
Enable-NetAdapter "Ethernet 2"
|
||||
@ -462,7 +473,7 @@ This section will demonstrate how to export user data from an existing client co
|
||||
vmconnect localhost PC1
|
||||
```
|
||||
|
||||
2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and performing additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and performing additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
|
||||
```powershell
|
||||
Checkpoint-VM -Name PC1 -SnapshotName BeginState
|
||||
@ -472,7 +483,7 @@ This section will demonstrate how to export user data from an existing client co
|
||||
|
||||
Specify **contoso\administrator** as the user name to ensure you don't sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share.
|
||||
|
||||
4. Open an elevated command prompt on PC1 and type the following command:
|
||||
4. Open an elevated command prompt on PC1 and enter the following command:
|
||||
|
||||
```cmd
|
||||
cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs
|
||||
@ -498,13 +509,13 @@ This section will demonstrate how to export user data from an existing client co
|
||||
|
||||
8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share).
|
||||
|
||||
9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
|
||||
```powershell
|
||||
Checkpoint-VM -Name PC1 -SnapshotName RefreshState
|
||||
```
|
||||
|
||||
10. Restore the PC1 VM to its previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
10. Restore the PC1 VM to its previous state in preparation for the replace procedure. To restore a checkpoint, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||
|
||||
```powershell
|
||||
Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false
|
||||
@ -516,15 +527,18 @@ This section will demonstrate how to export user data from an existing client co
|
||||
|
||||
## Replace a computer with Windows 10
|
||||
|
||||
At a high level, the computer replace process consists of:<BR>
|
||||
At a high level, the computer replace process consists of:
|
||||
|
||||
- A special replace task sequence that runs the USMT backup and an optional full Windows Imaging (WIM) backup.<BR>
|
||||
- A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored.
|
||||
|
||||
### Create a backup-only task sequence
|
||||
|
||||
1. On SRV1, in the deployment workbench console, right-click the MDT Production deployment share, select **Properties**, select the **Rules** tab, and change the line **SkipUserData=YES** to **SkipUserData=NO**.
|
||||
|
||||
2. Select **OK**, right-click **MDT Production**, select **Update Deployment Share** and accept the default options in the wizard to update the share.
|
||||
3. Type the following commands at an elevated Windows PowerShell prompt on SRV1:
|
||||
|
||||
3. enter the following commands at an elevated Windows PowerShell prompt on SRV1:
|
||||
|
||||
```powershell
|
||||
New-Item -Path C:\MigData -ItemType directory
|
||||
@ -533,41 +547,52 @@ At a high level, the computer replace process consists of:<BR>
|
||||
```
|
||||
|
||||
4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and select **New Folder**.
|
||||
|
||||
5. Name the new folder **Other**, and complete the wizard using default options.
|
||||
|
||||
6. Right-click the **Other** folder and then select **New Task Sequence**. Use the following values in the wizard:
|
||||
|
||||
- **Task sequence ID**: REPLACE-001
|
||||
- **Task sequence name**: Backup Only Task Sequence
|
||||
- **Task sequence comments**: Run USMT to back up user data and settings
|
||||
- **Template**: Standard Client Replace Task Sequence (note: this template isn't the default template)
|
||||
|
||||
7. Accept defaults for the rest of the wizard and then select **Finish**. The replace task sequence will skip OS selection and settings.
|
||||
8. Open the new task sequence that was created and review it. Note the type of capture and backup tasks that are present. Select **OK** when you're finished reviewing the task sequence.
|
||||
|
||||
8. Open the new task sequence that was created and review it. Note the enter of capture and backup tasks that are present. Select **OK** when you're finished reviewing the task sequence.
|
||||
|
||||
### Run the backup-only task sequence
|
||||
|
||||
1. If you aren't already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt:
|
||||
1. If you aren't already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, enter the following command at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
whoami.exe
|
||||
```
|
||||
2. To ensure a clean environment before running the backup task sequence, type the following commands at an elevated Windows PowerShell prompt on PC1:
|
||||
|
||||
2. To ensure a clean environment before running the backup task sequence, enter the following commands at an elevated Windows PowerShell prompt on PC1:
|
||||
|
||||
```powershell
|
||||
Remove-Item c:\minint -recurse
|
||||
Remove-Item c:\_SMSTaskSequence -recurse
|
||||
Restart-Computer
|
||||
```
|
||||
3. Sign in to PC1 using the contoso\administrator account, and then type the following command at an elevated command prompt:
|
||||
|
||||
3. Sign in to PC1 using the contoso\administrator account, and then enter the following command at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs
|
||||
```
|
||||
|
||||
4. Complete the deployment wizard using the following settings:
|
||||
|
||||
- **Task Sequence**: Backup Only Task Sequence
|
||||
- **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1**
|
||||
- **Computer Backup**: Don't back up the existing computer.
|
||||
|
||||
5. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and select the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks.
|
||||
|
||||
6. On PC1, verify that **The user state capture was completed successfully** is displayed, and select **Finish** when the capture is complete.
|
||||
|
||||
7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example:
|
||||
|
||||
```cmd
|
||||
@ -582,14 +607,14 @@ At a high level, the computer replace process consists of:<BR>
|
||||
|
||||
### Deploy PC3
|
||||
|
||||
1. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt:
|
||||
1. On the Hyper-V host, enter the following commands at an elevated Windows PowerShell prompt:
|
||||
|
||||
```powershell
|
||||
New-VM -Name "PC3" -NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2
|
||||
Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20
|
||||
```
|
||||
|
||||
2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1:
|
||||
2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, enter the following command at an elevated Windows PowerShell prompt on SRV1:
|
||||
|
||||
```powershell
|
||||
Disable-NetAdapter "Ethernet 2" -Confirm:$false
|
||||
@ -628,6 +653,7 @@ At a high level, the computer replace process consists of:<BR>
|
||||
## Troubleshooting logs, events, and utilities
|
||||
|
||||
Deployment logs are available on the client computer in the following locations:
|
||||
|
||||
- Before the image is applied: X:\MININT\SMSOSD\OSDLOGS
|
||||
- After the system drive has been formatted: C:\MININT\SMSOSD\OSDLOGS
|
||||
- After deployment: %WINDIR%\TEMP\DeploymentLogs
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user