jmak Posted March 18, 2015 Posted March 18, 2015 Hi I'm trying to get started with WDS/MDT - I've previously used fog, but now I have 4 different models of laptop to image in one week, so the idea of a universal image greatly appeals. Whilst learning, I'm staying away from the school network. I started by setting up MDT and quite quickly got to the stage where I had configured the deployment workbench and could boot a VM in Hyper-V and have it run the task sequence to deploy the OS etc. It has now been installing updates for 7 hours but is still going, so I'm inclined to leave it - I think it's due to drastically under powered hardware. My next step is setting up a 2012r2 server in a VM to run WDS. Ideally I'd like make an "imaging solution in a box" and be able to run this on the domain once I'm happy it works and won't bork the live environment. First question: should I install MDT on that server VM? My deployment share is on a network share, so presumably the server could pick up the images even if I've created the boot files and images from MDT running from a different machine? Also, with MDT 2013, does it matter if use 32 or 64 bit version - I need to deploy both flavours of image. I installed 64 bit 1st time around and it looks like I could work with 32 bit images, but not sure. Second question: can I get away without making the server a DC? I'm running WDS in standalone mode and taking dhcp from my (home) network. I was planning to take the whole system off my main network and have just the server and machines to be built on their own network - at which point I'll run DHCP from the server. I need internet access while I'm building the server, which is why I haven't started out like this. Third question: Can I set the deployment up to configure the machine to be part of the school domain even when the WDS server isn't part of that domain? Thanks for your patience with the long post of you've got this far!
sted Posted March 18, 2015 Posted March 18, 2015 mdt\wds prefers not to be on a dc and ideally wds isnt on a dhcp server personally i turn updates off as part of the mdt sequence and let wsus handle it after ive done but i do use updated base images. its probably better to keep the actual deployment share on the pc with the toolkit installed apart from creating sysprep files it makes no odds what x64/86 base os you use. if you build images off site i dont think you can domain them and ive never tried non domain wds 1
jmak Posted March 18, 2015 Author Posted March 18, 2015 personally i turn updates off as part of the mdt sequence and let wsus handle it after ive done but i do use updated base images. I'd kind of come to that conclusion. I'm starting from an SP1 install disk, so need to get updates into the image. When I come to update the image, I hope to use this one as the baseline. It's actually got stuck a few times - for the 32 bit image, I've disabled the automatic get updates tasks and put a pause task in the task sequence - planning to run the update manually at the same stage I make my customisations to the image. apart from creating sysprep files it makes no odds what x64/86 base os you use. So I can install 64 bit MDT on a 64 bit PC and create a 32 bit image? its probably better to keep the actual deployment share on the pc with the toolkit installed Presumably it's the file created by the MDT task sequence in the deployment share that WDS needs to see? if you build images off site i dont think you can domain them and ive never tried non domain wds Oh well. It's not too many machines this time - I'll have to add them to the domain manually this time.
computer_expert Posted March 19, 2015 Posted March 19, 2015 So I can install 64 bit MDT on a 64 bit PC and create a 32 bit image? Yes, however I have been caught out with a nasty bug if you try to edit a 32bit unattend.xml on a 64bit machine - it will refuse to work (certainly using the windows 8 ADK - not sure if it has been fixed in the 8.1 adk) unless you edit the xml on a 32bit machine with WSIM installed. However the default one that MDT generates works fine when deploying a 32bit image. Presumably it's the file created by the MDT task sequence in the deployment share that WDS needs to see? The image you load into WDS is the LiteTouchPE_ARCHITECTURE.wim (where architecture is either x86 or x64) from the deployment share\boot folder Oh well. It's not too many machines this time - I'll have to add them to the domain manually this time. You may be able to fiddle it using customsettings.ini, see here for more info. The most important thing to make sure is that the AD account has the necessary permissions to add computers to the domain (I'd recommend against using the domain admin account as the password would be saved in customsettings in plain text) You can create a 'special' account that has permissions to add computers to the domain - see method 5 under the section called 'Performing Domain-Joins Securely' here. If you do go this route, do not edit the permissions on the default computer container in AD and instead create a new OU and adding the domain join account permissions to the new OU. 1
jmak Posted March 19, 2015 Author Posted March 19, 2015 You may be able to fiddle it using customsettings.ini, see here for more info. The most important thing to make sure is that the AD account has the necessary permissions to add computers to the domain (I'd recommend against using the domain admin account as the password would be saved in customsettings in plain text) You can create a 'special' account that has permissions to add computers to the domain - see method 5 under the section called 'Performing Domain-Joins Securely' here. If you do go this route, do not edit the permissions on the default computer container in AD and instead create a new OU and adding the domain join account permissions to the new OU. Just another step I can't get my head around: How/where do you specify the computer name? Some are new machines which have never been on the domain and others are re-builds, although if they get new names/ accounts it's not a disaster, I'll just remove the old ones from AD. Thanks again
sted Posted March 19, 2015 Posted March 19, 2015 Just another step I can't get my head around: How/where do you specify the computer name? Some are new machines which have never been on the domain and others are re-builds, although if they get new names/ accounts it's not a disaster, I'll just remove the old ones from AD. Thanks again unless you start messing around with the sql database bits usually when you install the pc it will ask you 1
jmak Posted March 19, 2015 Author Posted March 19, 2015 (edited) Edit: Dunce alert! I've just looked again and seen that SQL Express is part of ADK, so have found the answer to the question below unless you start messing around with the sql database bits usually when you install the pc it will ask you I *think* that's good news...... But I've just been reading more about the MDT Database bit from some of the links that @computer_expert posted and came across this on Microsoft's site: If you are using ZTI and/or UDI, you are allowed to add the MDT SQL database to any version of System Center Configuration Manager with SQL Technology; if you are using LTI, you must use a separately licensed SQL Server product to host your MDT SQL database. Does this mean that I need to get a SQL database going and licensed? As I don't think either of those are likely scenarios - I have no knowledge of SQL and no money to buy a licence... Edited March 19, 2015 by jmak
sted Posted March 19, 2015 Posted March 19, 2015 unless you really need it to auto name pc (and bear in mind you have to start the task at the pc) I just wouldn't bother its not worth the effort imo 1
computer_expert Posted March 19, 2015 Posted March 19, 2015 MDT doesn't do ZTI (zero touch installation), so I'd guess that is mainly for SCCM (MDT's bigger brother). As for the SQL database i would highly recommend it as you can do lots of helpful stuff like computer naming and storing the local admin/domain account user/password in the SQL db (rather than having it in plain text in customsettings). Another example of how the database comes in handy is you can specify all dell optiplex abc computers to get a windows 8.1 task sequence/settings but you can override the task sequence for that specific users machine that needs windows 7 due to an ancient application. 1
jmak Posted March 19, 2015 Author Posted March 19, 2015 unless you really need it to auto name pc (and bear in mind you have to start the task at the pc) I just wouldn't bother its not worth the effort imo This is ideal for just now. I guess once they're all deployed, I can use a network inventory tool to grab all of the names and MAC addresses for when I want to re-image, but that's definitely for another occasion! MDT doesn't do ZTI (zero touch installation), so I'd guess that is mainly for SCCM (MDT's bigger brother). As for the SQL database i would highly recommend it as you can do lots of helpful stuff like computer naming and storing the local admin/domain account user/password in the SQL db (rather than having it in plain text in customsettings). Another example of how the database comes in handy is you can specify all dell optiplex abc computers to get a windows 8.1 task sequence/settings but you can override the task sequence for that specific users machine that needs windows 7 due to an ancient application. SCCM is out of the question on cost grounds - the Software Assurance that's included with my subscriptions doesn't include it. I know that I'm limited to LTI without it. I can see that more granularity in image deployment control could be useful, but tbh if I can get anything deployed this week, I'll consider it a good week!
clockend25 Posted March 19, 2015 Posted March 19, 2015 It's not that much of a hassle to have to kick off a build. We have ours configured to apply different builds depending on whether it's a laptop or desktop, and install different applications based on that as well. Only a computer name needs to be entered and off it goes. In terms of the updates, I recently slipstreamed a shedload into our install image and it's cut the deploy time on our laptop builds in half. 1
sted Posted March 19, 2015 Posted March 19, 2015 It's not that much of a hassle to have to kick off a build. We have ours configured to apply different builds depending on whether it's a laptop or desktop, and install different applications based on that as well. Only a computer name needs to be entered and off it goes. In terms of the updates, I recently slipstreamed a shedload into our install image and it's cut the deploy time on our laptop builds in half. same as throwing office in there speeds up deployment no end 1
jmak Posted March 19, 2015 Author Posted March 19, 2015 My reference image is fully updated - although about to start on the 32 bit version and won't use the litetouch deployment task sequence to update this time around. I've installed and updated my customised Office deployment, Smart Notebook, flash, pdf reader, Java and a couple of "essential" edu applications that only come as .exes
jmak Posted March 19, 2015 Author Posted March 19, 2015 Trying to run before I can walk I think............ I inserted a pause into the Task Sequence following instructions from here: Create a [Mostly] Automated Reference Image in MDT – Part 5: Pause/Suspend the Task Sequence The TS did pause - the machine rebooted and a new icon was on the desktop called Resume Task Sequence. I completed my customisations, ran the shortcut, the machine rebooted and the icon had gone - but no sign of the task sequence resuming Any ideas? Thank you
kobeckman Posted March 19, 2015 Posted March 19, 2015 (Author of previously mentioned blog post here!) I've seen MDT hang up after a suspend/pause was used in a Task Sequence for a few reasons. First, you could have installed something or made a configuration that needs a reboot. I usually recommend rebooting just to clear that out if you've got a hard pause. Second, you could have problems connecting back into the deployment share. If you sit there long enough, you'll get an error. Third, other random weirdness. All I can recommend for that it to check the logs. As a general rule, checking the logs is always going to be one of the first troubleshooting steps.
jmak Posted March 19, 2015 Author Posted March 19, 2015 Hey @kobeckman - welcome to Edugeek and thanks for the suggestions It lost connection to the deployment share. I made sure I rebooted the machine more than once before I tried to resume the Task Sequence to try to avoid it getting stuck. However it had been suspended for hours........... I created a new task sequence to just sysprep and capture the machine, but now it won't capture as it can't validate credentials to access the deployment share. I know it can reach it as to kick off the task sequence I get it to run a script from there. However, after the sysprep is complete and the machine reboots, I get the solution accelerator screen and then the message that the connection is OK, but the credentials might not be. I cancel the task and the machine boots from the sysprepped image. It runs through a first time boot sequence and then I get a Windows Script Host error: Can not find script file "C:\LTIBootstrap.vbs". The machine then boots into the normal state. My plan now is to migrate the whole thing to a non-domain host machine in case it is to do with permissions being unfriendly. (I was previously working on a domain laptop from home)
kobeckman Posted March 20, 2015 Posted March 20, 2015 Yeah... that would be two huge red flags: leaving it for hours and being on your laptop away from the DC's. YMMV, but here's the setup I like to use: I have a dedicated desktop computer with two SSD's that is only used for reference images and testing things in Hyper-V. It happens to be running Server 2012 R2, but Windows 8.1 would work too. I have MDT installed directly on the computer and the deployment share is on one of the SSD's. I run the Task Sequence in a VM on that system. Having everything on an SSD makes the process pretty quick. The only lag is the WSUS server since it uses too much disk space to sit on an SSD. I've used both domain joined and non-domain joined systems for building reference images. Personally, I would stick to local accounts to avoid the AD infrastructure; it just introduces extra complexity into the process that you really don't need.
jmak Posted March 20, 2015 Author Posted March 20, 2015 It only sat there for hours because my hardware is so underpowered... I think I overcame that issue, but the credentials side seemed too complex to even try and sort out. Good news: I migrated my reference VM to a different host and successfully started a sysprep and capture task sequence. The less good news is that with 16%of the capture process complete, there's 1:33 hours remaining.... Going to be a long night
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now