Deploying Windows 8.1 with System Center 2012 R2 Configuration Manager

Conditions and Terms of UseMicrosoft Confidential

This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content and/or software included in such packages is strictly prohibited.

The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind, whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

Training package content, including URLs and other Internet website references, is subject to change without notice. Because Microsoft must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

Copyright and Trademarks © 2014 Microsoft Corporation. All rights reserved.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

For more information, see Use of Microsoft Copyrighted Content athttp://www.microsoft.com/about/legal/permissions/

Microsoft®, Internet Explorer®, Outlook®, OneDrive®, Windows Vista®, Zune®, Xbox 360®, DirectX®, Windows Server® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

3Microsoft Confidential

Module 1: The New Hardware:BIOS, UEFI, and You

Module Overview:• What is UEFI• New challenges faced with

imaging systems with UEFI

MicrosoftPartner Network

Brief History of BIOS

The Basic Input/Output System (BIOS)

What does the BIOS do?

BIOS is now considered legacy BIOS

MicrosoftPartner Network

Reasons to Replace the BIOS

Lack of networking

support (IPv6)

Limited option ROM space

2.2 TB drive limit

OEM x64 standardizatio

nAging GUI

16-bit Real Mode

MicrosoftPartner Network

BIOS Partitions

Single Windows Partition

Recommended BIOS configuration

MicrosoftPartner Network

BIOS Partitions

Single Windows Partition

Recommended BIOS configuration

MicrosoftPartner Network

Configuring UEFI Partitions

Default configuration

Recommended configuration

MicrosoftPartner Network

Configuring UEFI Partitions

Microsoft Confidential

Support for PXE Booting UEFI ONLY System• System Center 2012 SP1 Configuration Manager introduced support

for UEFI systems.• x86/IA32 UEFI Only systems require WDS on Windows Server 2012

(i.e. Intel ATOM based tablets) (http://support.microsoft.com/kb/2845997)

• x86/IA32 UEFI Only systems require System Center 2012 R2 Configuration Manager (http://technet.microsoft.com/en-us/library/dn236351.aspx)

11Microsoft Confidential

Module 2: Deploying Windows 8.1

Module Overview

12Microsoft Confidential

Similar to Windows 7 Deployment• Deployment Image Servicing and

Management (DISM)• Windows System Image Manager

(WSIM)• Unattended.xml• USMT

Deploying Windows 8.1

New Challenges• UEFI • Tablets• Appx Packages• Start Screen Customization• Disabling access to the store• Lock Screen and Desktop images• LocalGPO tool

13Microsoft Confidential

Appx Packages

• Mount WIM to a temp directory

• Dism /Image:C:\test\offline /Get-ProvisionedAppxPackages

• Dism /Image:C:\test\offline /Remove-ProvisionedAppxPackage

/PackageName:• Microsoft.BingFinance_2013.809.632.3676_neutral_~_8wekyb3d8bbwe• Microsoft.BingFoodAndDrink_2013.820.258.2561_neutral_~_8wekyb3d8bbwe• Microsoft.BingHealthAndFitness_2013.813.243.3760_neutral_~_8wekyb3d8bbwe• Microsoft.BingMaps_2013.809.2206.5385_neutral_~_8wekyb3d8bbwe• Microsoft.BingNews_2013.809.636.2800_neutral_~_8wekyb3d8bbwe• Microsoft.BingSports_2013.809.637.2803_neutral_~_8wekyb3d8bbwe• Microsoft.BingTravel_2013.809.639.25_neutral_~_8wekyb3d8bbwe• Microsoft.BingWeather_2013.809.641.3233_neutral_~_8wekyb3d8bbwe• Microsoft.SkypeApp_2013.805.1159.2246_neutral_~_kzf8qxf38zg5c• Microsoft.WindowsReadingList_2013.822.1837.5741_neutral_~_8wekyb3d8bbwe• Microsoft.XboxLIVEGames_2013.808.1749.4769_neutral_~_8wekyb3d8bbwe• Microsoft.ZuneMusic_2013.809.1658.2765_neutral_~_8wekyb3d8bbwe• Microsoft.ZuneVideo_2013.809.1659.3015_neutral_~_8wekyb3d8bbwe• Microsoft.windowscommunicationsapps_2013.822.1740.2836_neutral_~_8wekyb3d

8bbwe

http://technet.microsoft.com/en-us/library/hh824882.aspx

14Microsoft Confidential

Start Screen Customizations

Log into the reference system and make your start screen customizations

Manual Method

• CopyProfile = True in Unattended.xml

• StartTiles setting in Unattended.xml - Note: (CopyProfile wins)

• Copy the AppsFolderLayout.bin (obtain from Sysprep Audit Mode)

http://technet.microsoft.com/en-us/library/jj134269.aspx#BKMK_AppFolder

Using Powershell and GPO

• Export-StartLayout

• User Configuration\Administrative Templates\Start Menu and Taskbar\Start Screen Layout

http://technet.microsoft.com/en-us/library/dn467928.aspx

15Microsoft Confidential

Sample Script

16Microsoft Confidential

Disable Store Access

GPO - Computer Configuration\Administrative Templates\Windows Components\Store

• Turn off the Store Application

• Turn off Automatic Download and Install of updates

• Turn off Automatic Download of updates on Win8 machines

• Turn off the offer to update to the latest version of Windows

http://support.microsoft.com/kb/2826659/en-us

http://technet.microsoft.com/en-us/library/hh832040.aspx

17Microsoft Confidential

Set Lock Screen and Background

Lock Screen Custom Image

GPO - Computer Configuration\Policies\Administrative Templates\Control Panel\Personalization\Force a specific default lock screen image

• Set path to the customized Lock Screen Image

• Windows must be Activated!

http://support.microsoft.com/kb/2787100/EN-US

Background Wallpaper Customization

GPO - User Configuration\Policies\Administrative Templates\Desktop\Desktop\Desktop Wallpaper

• Set path to the customized wallpaper image

18Microsoft Confidential

Using the LocalGPO Tool

Security Compliance Manager 3.0

• Install SCM on Admin Workstation

• Install Local GPO on a Test/Reference System

C:\Program Files\Microsoft Security Compliance Manager\LGPO\LocalGPO.msi

• Set desired GPO on a Test/Reference System (gpedit.msc to edit local policy)

• Use LocalGPO to backup the settings

cscript LocalGPO.wsf /Path:c:\Images\Win8.1Build /Export

• Use LocalGPO to create a GPOPack

cscript LocalGPO.wsf /path:C:\images\Win8.1Build /export /gpopack

• Make the folder name “friendly” (rename {8C7CF2F2-1541-4D19-AE7F-EEA4F9510868} to Win8.1_GPOPACK)

• Apply GPOPack during Task Sequence

cscript GPOPack.wsf /silent

Note:

For Windows 8.1, LocalGPO.wsf and GPOPack.wsf need to be modified to support Windows 8.1 (version 6.3)

19Microsoft Confidential

Fixing LocalGPO.wsf and GPOPack.wsf for Windows 8.1 (At Your Own Risk)

Sub ChkOSVersion

20Microsoft Confidential

Module 3: Upgrading from Windows 8 to Windows 8.1

Module Overview• The upgrade process• Preparation for the upgrade• Upgrading machines via SCCM 2012

21Microsoft Confidential

Upgrade Process

• The windows upgrade process can upgrade a Windows 8 machine to Windows 8.1 in place

• The upgrade can carry over data from the previous OS as well as applications

• This upgrade can be run manually on a single machine or can be run through SCCM across an entire enterprise

• NOTE: The automated upgrade process can ONLY be run on Windows Enterprise machines with volume licenses

22Microsoft Confidential

Preparation for the upgrade

• Windows 8.1 Upgrade Assistant

Upgrade Assistant FAQ

http://windows.microsoft.com/en-us/windows-8/upgrade-assistant-download-online-faq

23Microsoft Confidential

Upgrading via SCCM 2012

Options for upgrade deployment

1. /auto:upgrade – Upgrades and preserves Applications and Data

2. /auto:data – Upgrades and preserves only Data

3. /performdu – Performs Dynamic Updates during the upgrade

4. /noautoexit – Causes the installer to always exit verbosly

Sample Command Line for SCCM 2012

Setup.exe /auto:upgrade /performdu

Windows Installer Reference

http://technet.microsoft.com/en-us/library/hh824834.aspx

24Microsoft Confidential

Module 4: Applying Windows 8.1 Update 1

Module Overview• Prerequisites for Windows 8.1 Update 1• Preparations to deploy update in SCCM 2012• Deploying the Update via SCCM• Applying the Update to an existing SCCM OSD image

25Microsoft Confidential

Prerequisites for Windows 8.1 Update 1

• http://support.microsoft.com/kb/2919442/en-us - Prerequisite for Update

• http://support.microsoft.com/kb/2939087/en-us - Fix for crashing issues

26Microsoft Confidential

Preparations to deploy update in SCCM 2012

• Software Update point installed

• Security and Critical Update Classifications syncing

27Microsoft Confidential

Applying the Update to an existing SCCM OSD image

"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe" /mount-wim /wimfile:install.wim /index:1 /mountdir:e:\images

"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe" /image:e:\images /add-package /packagepath:e:\demo\Windows8.1-KB2939087-x64.msu

"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe" /image:e:\images /add-package /packagepath:e:\demo\Windows8.1-KB2919355-x64.msu

"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe" /unmount-wim /mountdir:c:\images\mount /commit

Note: you must use the DISM version that is installed with the ADK that is at least as new as the OS version you are manipulating

DISM Reference

http://technet.microsoft.com/en-us/library/hh824821.aspx

28Microsoft Confidential