Windows 10 Base Build Suggestions

[craigcamacho]

Hi Guys,

 

I'm about to embark on a project of moving a domain of about 700 clients from Windows 7 to Windows 10. We use SCCM for OSD, software deployment and updates. A large percentage of our software has been sequenced using App-V (already converted from 4.6 to the latest Windows 10 version) and the rest is either MSI or script based installers. I am planning on using Windows 10 Education and have created a 1703 image using the below checklist but was wondering if anybody else who has done a successful migration from 7 to 10 has anything else to add to the below checklist. Any advice would be gratefully appreciated.

 

• Remote registry enabled. (Enable Remote Registry service)

 

• Enable Remote Desktop

 

• Enable .Net Framework 3.5 (Turn features on)

 

• Enable App-V with Powershell

 

• Remove Provisioned Windows 10 Apps with Powershell

 

• Remove Apps for Current User with Powershell

 

• Remove Get-Help From Start Menu

 

• Remove Default Printers (Fax, Microsoft Print to PDF and Microsoft XPS Document Writer)

 

• Turn Off Windows Defender (Sophos Installed During TS)

 

• Disable OneDrive at Startup

 

• Turn Off Private Network Discovery

 

• Latest Windows Updates

 

• Uninstall VMware Tools and delete C:\Program Files\VMWare

 

• Capture

[ADMaster]

• Remote registry enabled. (Enable Remote Registry service)

• Enable Remote Desktop

• Turn Off Private Network Discovery

 

I've done this with group policy since W7 so no need to put in image

• Enable .Net Framework 3.5 (Turn features on)

 

I only have a few pieces of software that require this so push it as needed.

• Enable App-V with Powershell

Don't use myself so OK

• Remove Provisioned Windows 10 Apps with Powershell

 

• Remove Apps for Current User with Powershell

check and check I do this with a script during OSD

• Remove Get-Help From Start Menu

This may be a part of the above mentioned script will have to check

• Remove Default Printers (Fax, Microsoft Print to PDF and Microsoft XPS Document Writer)

Not bothered, but sure I could do this during OSD too.

• Turn Off Windows Defender (Sophos Installed During TS)

I use defender

• Disable OneDrive at Startup

Done with a script during OSD

 

• Latest Windows Updates

slipstreamed in via the SCCM console (I know that's not what its called anymore but don't know the new term)

• Uninstall VMware Tools and delete C:\Program Files\VMWare

• Capture

Not relevant, do everything via scripts during OSD and forget the build / capture process.

 

I'm sure you can delete printers enable .net / app-v and do the defender / sophos bit during OSD too.

scripts for .net/app-v, script or group policy for the printers and application for sophos.

[snagrat]

Printers can be removed via GPO very easily

[craigcamacho]

I've done this with group policy since W7 so no need to put in image

 

 

I only have a few pieces of software that require this so push it as needed.

 

Don't use myself so OK

 

check and check I do this with a script during OSD

This may be a part of the above mentioned script will have to check

Not bothered, but sure I could do this during OSD too.

I use defender

 

Done with a script during OSD

 

 

slipstreamed in via the SCCM console (I know that's not what its called anymore but don't know the new term)

Not relevant, do everything via scripts during OSD and forget the build / capture process.

 

I'm sure you can delete printers enable .net / app-v and do the defender / sophos bit during OSD too.

scripts for .net/app-v, script or group policy for the printers and application for sophos.

 

So are you suggesting just taking the install.wim from my VLSC media not touching it and importing that into SCCM as it is and then make all config changes during the TS or afterwards using Group Policy? Is this the typical way of doing things? Its not the way I've been taught but if its typical and a better way of doing it I'm certainly open to the idea.

[craigcamacho]

Printers can be removed via GPO very easily

 

I know as I had to do it recently when we moved from network installed printers to a follow-you print queue. I read somebody else's checklist which included removing printers so added it to mine but as suggested its something that can be done after using Group Policy.

[sted]

installing .net 3.5 if you use mdt/sccm you can just add the cab file as a package and it will deploy during install with 0 config needed

onedrive i just remove read access to the installer for auth(or staff/pupil i occasionally use it in some schools) users using gpo

defender can be turned off with gpo

i run a script during mdt to remove apps it dosent remove them for the logged in user but nobody uses local admin anyway so i dont see that as an issue alternatively you can use dism /offline on the base wim file and remove them so they never install at all

pointless printers like fax again gpo can do this

updates mdt can be set to run wsus during install as part of the task sequence i assume as sccm uses mdt it can as well

[ADMaster]

So are you suggesting just taking the install.wim from my VLSC media not touching it and importing that into SCCM as it is and then make all config changes during the TS or afterwards using Group Policy? Is this the typical way of doing things? Its not the way I've been taught but if its typical and a better way of doing it I'm certainly open to the idea.

Yes, this is the way I've done it since W8.

My upgrade from 1607 to 1703 was painless, just had to adjust a few scripts and point the TS at the new wim.

 

Here are a few items to add to your list, these are all done during OSD for me.

 

 

• Disable SMBv1 (don't think that will be an issue with 1709)
  
• Disable startup repair
  
• Disable PC reset
  
• Disable consumer experience
  
• Set file associations
  
• Set start layout xml
  
• Disable wifi on wired in all in ones
  

 

I also disable defender first run which does not apply to you and setup theme / branding.

[Fazza]

The beauty of SCCM there isnt really a right or wrong way, it either works for you or it doesnt! The 'Microsoft Way' is to create a task sequence that installs the OS along with all the software and then create a 'Golden Image' from it which you then deploy to your computers. I dont think many/any people do it that way!

 

Personally I install Windows 10 in a VM envoronment, install Office and all the other software we are licensed for and create a 'Standard Build' and then bung that in to a Task Sequence and then any room/departmental specific software gets pushed out via the TS as either an Application or Package.

 

Do whatever is easiest/best for you.

[craigcamacho]

Yes, this is the way I've done it since W8.

My upgrade from 1607 to 1703 was painless, just had to adjust a few scripts and point the TS at the new wim.

 

Here are a few items to add to your list, these are all done during OSD for me.

 

 

• Disable SMBv1 (don't think that will be an issue with 1709)
  
• Disable startup repair
  
• Disable PC reset
  
• Disable consumer experience
  
• Set file associations
  
• Set start layout xml
  
• Disable wifi on wired in all in ones
  

 

I also disable defender first run which does not apply to you and setup theme / branding.

 

Nice one cheers for the suggestions. I've imported the install.wim file from the sources folder on the media and have created a new TS and am slowly adding things in and testing. Thus far I've added file associations, remove provisioned apps, install a bunch of applications, install windows updates. I've integrated MDT in with ConfigMgr as well so am able to actually use MDT steps in my TS which adds a bit of flexibility and am able to install .NET3.5 using an add role MDT step. Also I have noticed there is a group policy for enabling the App-V client rather than running a PS script in my TS but am still testing whether that works. I'm also taking care of a few other things like remote registry and application identity using GPO aswell.

 

I have to admit that doing it this way rather than a build a capture seems so much easier and logical.

 

Guys keep any suggestions coming as to what configurations or customizations you put in your task sequences they are proving very helpful.

Edited October 10, 2017 by craigcamacho

[gshaw]

The best build is the one that comes off the ISO, do your other changes via scripts and GPOs during the Task Sequence etc.

 

Particularly relevant for W10 so when MS bring out the next build all you have to do is swap out the WIM and carry on

[Arthur]

I have noticed there is a group policy for enabling the App-V client rather than running a PS script in my TS but am still testing whether that works.

If you deploy App-V applications in your TS you are probably going to want run the command below to enable App-V prior to the GPO taking effect. Otherwise you will see the issue described here.

 

powershell.exe -executionpolicy bypass -command Enable-Appv

[craigcamacho]

The best build is the one that comes off the ISO, do your other changes via scripts and GPOs during the Task Sequence etc.

 

Particularly relevant for W10 so when MS bring out the next build all you have to do is swap out the WIM and carry on

 

Yeah I had already considered doing this especially now with Windows 10 CB and Microsoft releasing a few new versions a year. Kind of doesn't make sense to build and capture every time they release a new version but I was kind of stuck in my ways. Def much better this way.

[craigcamacho]

If you deploy App-V applications in your TS you are probably going to want run the command below to enable App-V prior to the GPO taking effect. Otherwise you will see the issue described here.

 

powershell.exe -executionpolicy bypass -command Enable-Appv

 

Yeah that's the command I had put in my task sequence. I have disabled that step for the time being whilst I test the GP and if it doesn't work can re enable the step. I don't have any App-V applications in my TS so shouldn't be an issue.