mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 05:47:23 +00:00
Revert "Update build-a-distributed-environment-for-windows-10-deployment.md"
This commit is contained in:
parent
3812dcfe69
commit
ced9abd7d9
@ -33,8 +33,8 @@ Figure 1. The machines used in this topic.
|
|||||||
|
|
||||||
Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content.
|
Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content.
|
||||||
|
|
||||||
> [!NOTE]
|
**Note**
|
||||||
> Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry and, by default, it will only copy/remove files from the source that are newer than files on the target.
|
Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target.
|
||||||
|
|
||||||
### Linked deployment shares in MDT
|
### Linked deployment shares in MDT
|
||||||
|
|
||||||
@ -103,8 +103,8 @@ When you have multiple deployment servers sharing the same content, you need to
|
|||||||
UserID=MDT_BA
|
UserID=MDT_BA
|
||||||
SkipBDDWelcome=YES
|
SkipBDDWelcome=YES
|
||||||
```
|
```
|
||||||
> [!NOTE]
|
**Note**
|
||||||
> The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md).
|
The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md).
|
||||||
|
|
||||||
2. Save the Bootstrap.ini file.
|
2. Save the Bootstrap.ini file.
|
||||||
3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**.
|
3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**.
|
||||||
@ -167,8 +167,8 @@ When you have multiple deployment servers sharing the same content, you need to
|
|||||||
1. In the **Staging** tab, set the quota to **20480 MB**.
|
1. In the **Staging** tab, set the quota to **20480 MB**.
|
||||||
2. In the **Advanced** tab, set the quota to **8192 MB**.
|
2. In the **Advanced** tab, set the quota to **8192 MB**.
|
||||||
|
|
||||||
> [!NOTE]
|
**Note**
|
||||||
> It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly.
|
It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly.
|
||||||
|
|
||||||
### Verify replication
|
### Verify replication
|
||||||
1. On MDT02, wait until you start to see content appear in the **E:\\MDTProduction** folder.
|
1. On MDT02, wait until you start to see content appear in the **E:\\MDTProduction** folder.
|
||||||
|
@ -29,8 +29,8 @@ To configure your environment for BitLocker, you will need to do the following:
|
|||||||
3. Configure the operating system deployment task sequence for BitLocker.
|
3. Configure the operating system deployment task sequence for BitLocker.
|
||||||
4. Configure the rules (CustomSettings.ini) for BitLocker.
|
4. Configure the rules (CustomSettings.ini) for BitLocker.
|
||||||
|
|
||||||
> [!NOTE]
|
>[!NOTE]
|
||||||
> Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.
|
>Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.
|
||||||
|
|
||||||
For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
|
For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
|
||||||
|
|
||||||
@ -38,8 +38,8 @@ For the purposes of this topic, we will use DC01, a domain controller that is a
|
|||||||
|
|
||||||
To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory.
|
To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory.
|
||||||
|
|
||||||
> [!NOTE]
|
>[!NOTE]
|
||||||
> Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.
|
>Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.
|
||||||
|
|
||||||
In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.
|
In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.
|
||||||
|
|
||||||
@ -79,11 +79,11 @@ Following these steps, you enable the backup of BitLocker and TPM recovery infor
|
|||||||
3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives
|
3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives
|
||||||
2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy.
|
2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy.
|
||||||
3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy.
|
3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy.
|
||||||
4. Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services
|
Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services
|
||||||
1. Enable the **Turn on TPM backup to Active Directory Domain Services** policy.
|
4. Enable the **Turn on TPM backup to Active Directory Domain Services** policy.
|
||||||
|
|
||||||
> [!NOTE]
|
>[!NOTE]
|
||||||
> If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using.
|
>If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using.
|
||||||
|
|
||||||
### Set permissions in Active Directory for BitLocker
|
### Set permissions in Active Directory for BitLocker
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user