Windows 10 v1803 with MDT

[mansin]

Greetings all.

 

So we are trialing Windows 10 1803 and deployment is done using MDT. Stations build fine. The only issue we're seeing is that when MDT has finished installing the OS and it reboots.

 

It logs into Windows Desktop with Administrator account. It just sits there whilst it's completing the background tasks/package installs. It does eventually finish the build but would be better if it didn't stay logged in whilst doing this.

 

Any ideas about this one?

 

Many Thanks

Manny

[sted]

i dont think you can stop it logging in to install software thats how mdt works BUT you could probably add ascript that locks the pc while its doing it

[computer_expert]

Add Hideshell=Yes to customsettings.ini?

 

https://blogs.technet.microsoft.com/deploymentguys/2011/12/01/mdt-2012-new-features-hide-shell/

 

It doesn't stop MDT logging in as local admin but it does hide the explorer shell to stop people fiddling with it

[eddyc]

Add Hideshell=Yes to customsettings.ini?

 

https://blogs.technet.microsoft.com/deploymentguys/2011/12/01/mdt-2012-new-features-hide-shell/

 

It doesn't stop MDT logging in as local admin but it does hide the explorer shell to stop people fiddling with it

 

This worked for me with thanks. Is there a way to stop CTRL ALT DEL - Task Manager, etc?

 

Cheers, eddyc

[computer_expert]

You could manually set the 'DisableTaskMgr' value to 1 in the registry at the start of the task sequence (but don't forget to revert the value before the end of the TS otherwise you won't be able to access task manager with the local admin account).

 

There should also be registry values that you can set for the other values in the CAD menu as you can restrict most of these via a GPO

[eddyc]

You could manually set the 'DisableTaskMgr' value to 1 in the registry at the start of the task sequence (but don't forget to revert the value before the end of the TS otherwise you won't be able to access task manager with the local admin account).

 

There should also be registry values that you can set for the other values in the CAD menu as you can restrict most of these via a GPO

 

 

I've tried this but cannot see where I am going wrong in my task sequence. When we reach this step, it bombs out and stops.

 

cmd.exe /c "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System  /v  DisableTaskMgr  /t REG_DWORD  /d /1 /f"

 

At present the step is disabled but students are opening task mgr and killing the task sequence \ starting explorer which means we are having to bring all kit back to the office to image it which isn't ideal.

 

Kind regards, Ed

[Steve21]

Rather than disabling taskmgr etc why not just run the lock command and let it continue while locked? Guessing that should still work, but not used mdt in a long time. Just saves having to re-enable taskmgr etc and then nothing can be messed with if it's locked.

 

You can also just do DisableTaskMgr=YES within the cs.ini rather than trying to fudge it via regkeys (Assuming you're still using LTI?)

 

Steve

[eddyc]

Rather than disabling taskmgr etc why not just run the lock command and let it continue while locked? Guessing that should still work, but not used mdt in a long time. Just saves having to re-enable taskmgr etc and then nothing can be messed with if it's locked.

 

You can also just do DisableTaskMgr=YES within the cs.ini rather than trying to fudge it via regkeys (Assuming you're still using LTI?)

 

Steve

 

Interesting. Will give that one a try. Not sure if it will work for us though because if we set HIDESHELL=YES the Adobe Acrobat Pro install starts a 2nd instance of the task sequence. Setting HIDESHELL=NO and killing explore in the sequence stops that from happening.

 

When we lock computers people come along and bump them with the power button. Would much rather have the task sequence visible on screen so people can see that it is being repaired \ worked on.

[BillyAB]

I don't know if this will work for Windows 10 I'm unable to test, but it worked on Windows 7 x64.

 

A run Command Line as the first in "state restore" %SCRIPTROOT%\BHSDisableHID.cmd

Followed immediately by a restart.

 

Then right at the end, another Run Command Line %SCRIPTROOT%\BHSEnableHID.cmd

Followed immediately by a restart.

 

Scripts:

 

BHSDisableHID.cmd

:: Disable the keyboard and mouse
SET SERVICES=HKLM\SYSTEM\CurrentControlSet\Services
REG ADD %SERVICES%\kbdclass /v Start /t REG_DWORD /d 4 /f
REG ADD %SERVICES%\mouclass /v Start /t REG_DWORD /d 4 /f
ECHO Keyboard and Mouse Disabled

 

BHSEnableHID.cmd

REM Enable the keyboard and mouse
SET KEY=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
REG ADD %KEY%\996 /VE /D "Unlocking Mouse" /f
REG ADD %KEY%\996 /V 1 /D "REG ADD HKLM\SYSTEM\CurrentControlSet\Services\mouclass /v Start /t REG_DWORD /d 1 /f" /f
REG ADD %KEY%\997 /VE /D "Unlocking Keyboard" /f
REG ADD %KEY%\997 /V 1 /D "REG ADD HKLM\SYSTEM\CurrentControlSet\Services\kbdclass /v Start /t REG_DWORD /d 1 /f" /f
ECHO Enableing HID Devices

[eddyc]

I don't know if this will work for Windows 10 I'm unable to test, but it worked on Windows 7 x64.

 

A run Command Line as the first in "state restore" %SCRIPTROOT%\BHSDisableHID.cmd

Followed immediately by a restart.

 

Then right at the end, another Run Command Line %SCRIPTROOT%\BHSEnableHID.cmd

Followed immediately by a restart.

 

Scripts:

 

BHSDisableHID.cmd

:: Disable the keyboard and mouse
SET SERVICES=HKLM\SYSTEM\CurrentControlSet\Services
REG ADD %SERVICES%\kbdclass /v Start /t REG_DWORD /d 4 /f
REG ADD %SERVICES%\mouclass /v Start /t REG_DWORD /d 4 /f
ECHO Keyboard and Mouse Disabled

 

BHSEnableHID.cmd

REM Enable the keyboard and mouse
SET KEY=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
REG ADD %KEY%\996 /VE /D "Unlocking Mouse" /f
REG ADD %KEY%\996 /V 1 /D "REG ADD HKLM\SYSTEM\CurrentControlSet\Services\mouclass /v Start /t REG_DWORD /d 1 /f" /f
REG ADD %KEY%\997 /VE /D "Unlocking Keyboard" /f
REG ADD %KEY%\997 /V 1 /D "REG ADD HKLM\SYSTEM\CurrentControlSet\Services\kbdclass /v Start /t REG_DWORD /d 1 /f" /f
ECHO Enableing HID Devices

 

 

This works perfectly, thanks so much! :-)