Windows 10 LTSB - OK to stick with Legacy?

[Planehazza]

We like to build the image, take a presysprep image with Ghost as a roll back in case of sysprep failure.

 

This presents us with problems with BIOS settings. We have problems getting PXE and/or Ghost USB boot disks to read the SSD drive partitions. We've found it easiest to just do away with UEFI entirely, and rely on legacy boot. Perhaps it's not the modern 'proper' way to do it, but we've not encountered issues yet... will we? Does it really matter that we're running legacy boot mode on a modern OS/PC?

 

Secondly, I'd like to ditch Ghost suite 2.5 entirely. Is it possible to use WDS to capture an image before sysprepping it?

 

Thirdly, and sort of off topic; when building your main sysprep uanttend.xml, how do you make it fully automated? I want it so that the captured image prompts us for nothing when we boot it back up after deployment. Currently, it still asks us for locale, EULA, and all the stupid annoying sliders for privacy etc. SkipUserOOBE and SkipMachineOOBE are deprecated according to WSIM. Which settings do I need to skip all the slider settings etc?

Thanks!

Edited August 9, 2017 by Planehazza

[gshaw]

Secondly, I'd like to ditch Ghost suite 2.5 entirely. Is it possible to use WDS to capture an image before sysprepping it?

 

Thirdly, and sort of off topic; when building your main sysprep uanttend.xml, how do you make it fully automated? I want it so that the captured image prompts us for nothing when we boot it back up after deployment. Currently, it still asks us for locale, EULA, and all the stupid annoying sliders for privacy etc. SkipUserOOBE and SkipMachineOOBE are deprecated according to WSIM. Which settings do I need to skip all the slider settings etc?

Thanks!

 

Drop Ghost, use MDT and make a Task Sequence that builds cleanly from the LTSB media. Personally I'd say avoid sysprepping a "Golden" image if you can help it, 10 isn't exactly friendly towards it these days imo.

[sparkeh]

Agreed, you'll have less problems if you deploy from source media and configure afterwards

[Planehazza]

Agreed, you'll have less problems if you deploy from source media and configure afterwards

 

We're obviously still thinking in old fashioned ways. We're deploying W10 to ~700 PCs. How would you account for all the software that has to go on all of the PCs? Some of the software is really old too.

 

We've built the image in audit mode and sysprepped it, then used WDS to capture the image. Is this the wrong way for W10?

Edited August 9, 2017 by Planehazza

[Rob_D]

+1 for using MDT and windows media.

We've packaged all of our apps into MDT for deployment. More work at first, but it saves us so much time now.

Some are fairly easy, when we first moved over there were a couple where we've had to go so far as to use autoit to click through the windows installer, but now we've got everything silently installing.

Although, we've still had to go to legacy boot to get some of our newer PCs to pixy boot properly.

Edited August 9, 2017 by Rob_D

[Planehazza]

+1 for using MDT and windows media.

Although, we've still had to go to legacy boot to get some of our newer PCs to pixy boot properly.

We'll look into MDT in the future, but right now we need to get our existing solution sorted:

 

 

1. installed windows 10LTSB
   
2. Boot to audit
   
3. remove all Apps and install software for that image type (maths software etc)
   
4. do all tweaks and start menu icons (mainly for local account, as we're using folder redirection via a GPO) etc
   
5. take a pre sysprep backup image
   
6. Sysprep - currently we do /generalize /oobe /shutdown /unattend:unattend_W10.xml. Should I ditch the answer file here entirely, and rely on the WDSUnattend (to wipe and partition drives) and an Image assigned unattend.xml to do all the OOBE stuff?
   
7. capture image using WDS.
   
8. Deploy image to machines with WDS and prestaged devices using MAC addresses. As said, I was of the impression it's good practice to have WDSUnattend.xml applied to WDS server that has only the WinPE pass to wipe the drive and create the partition and set the InstallTo partition etc. We have the InstallImage blank so that theoretically, the only bit we're prompted for is the image to select. The Install Image should then have a more in depth unattend.xml assigned to have a fully automated unattend (OOBE etc all applied for us).
   

 

So, using two unattends on the server, do I just sysprep the image before capture, but WITHOUT defining an answer file?

[ADMaster]

I +1 the deploying from source and install / customize during OSD.

However to answer the UEFI / Bios question... UEFI / secure boot is required if you want to take advantage of any new security features such as credential guard. so something to think about going forward.

To address the pre sysprep ghost image, have you tried clonezilla? I've not used it for about 5 years so have no idea if it will work with UEFI. Its just an idea as a stop gap measure until you sort the MDT task sequences.

[markwilfan]

We're obviously still thinking in old fashioned ways. We're deploying W10 to ~700 PCs. How would you account for all the software that has to go on all of the PCs? Some of the software is really old too.

 

We've built the image in audit mode and sysprepped it, then used WDS to capture the image. Is this the wrong way for W10?

What you do is a software audit with departments. Is the piece of software you can't package still being used. Is there an alternative? Software written in the 90s can't be expected to still be used can it? I put my ruthless admin hat on when dealing with stuff like this.

[Planehazza]

What you do is a software audit with departments. Is the piece of software you can't package still being used. Is there an alternative? Software written in the 90s can't be expected to still be used can it? I put my ruthless admin hat on when dealing with stuff like this.

We're a big school, with ~2000 students and ~350 staff. We did an audit and of the ~350 bits of software we have only a handful came back as 'can be got rid of'. I'm sure you'll know just how unpopular IT can become if one was to just sack off department critical software

 

You guys are all correct: WDS alone won't cut it, but sadly we don't have time to implement a new solution. MDT sounds great, but I'm away on my annual holiday from the 22nd leaving only two people to configure and deploy W10 to the rest of the 700 PCs. Prestaging PCs via WDSUtil etc is easy via powershell or batch files; it's the answer files that's having my life ha.

 

Once Summer is done and the PCs are in and on a working W10 install, I'll look into upgrading to MDT. Ironically (and frustratingly) I told my colleagues right from the start that I wanted to (and I believe it's best practice) push out the images as thin as possible then deploy software later. What we've done instead is build the images quite thick and considered the most 'generic' department's image as the base. This will go out to many PCs of the same type and we're building custom images for other PC types and software suites.

 

USing MDT/WDS as you recommend would get rid of all of this as we'd just be pushing W10 and injected drivers out to each PC type - no custom image required...

 

One for the future, as we have Office 365 Exchange hybrid migration to tackle in September also...

[markwilfan]

@Planehazza completely understand where you are coming from with the "do not rock the boat". Perhaps a bit of targeted culling could help. Go to the HODs individually, ask them what they use in their SOWs. Go to the dept meetings and ask directly. I have taken the opposite approach of asking what they do not use. I have asked what they use. All the rest will not be available after the summer so we can go forwards with thin image deployments.]

 

If you are on MS EES or similar licencing I would consider SCCM. It's basically free unless you want to manage servers with it. You can integrate MDT into it too to make awesome task sequences.