Windows 10 1803 - Building a Reference Image

[garethEds]

Evening All,

 

It's been a while since I've visited these parts - I hope everyone is well. I've finally decided to jump back into the Windows 10 image building after ditching it several times. Again we are using MDT and the capture process is going quite well so far.

 

I thought i'd ask if anyone has a list of steps they take when producing the image. I'm aware of removing apps - but do you do this to the reference image just before capture or do you do it at the end of the deployment process?

 

I'm at the stage of adding my software into the fat image.

 

Are there any cool scripts, things etc that I can do? I'm searching and reading at the moment - but often the real world is better than the blogs I read.

 

Cheers all,

 

Gareth

[PotNoodleTech]

Subscribed as I need to do this soon too! Hope all is ok Mr Edmondson!

[chazzy2501]

I'm doing this right now, I've got a 180 education version loaded in hyperv. I'm just going to do my usual, put stuff on, take stuff off, sysprep and capture. WDS yay! I've never got to grips with MDT and how it ties in with WDS.

 

EDIT: I'm not sure if I should go office 2016 or 2019, I'm not liking 2019 and I'm unsure how well it will auto update.

Edited November 26, 2018 by chazzy2501

[gmonks]

I used these guides when building my W10 Edu 1803 Image:

 

Removing built in apps:

This should spit out a new install.wim for you to then build your image on - import the .wim into MDT.

 

https://gallery.technet.microsoft.com/Removing-Built-in-apps-65dc387b

 

Creating and exporting Start Menu XML:

https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/

 

 

 

Some useful GPOs below too: (1803 ADMX files here)

 

 

Removal of first sign in user animation:

Group Policy – Computer Configuration –Policies – Administrative Templates – System – Logon - Show first sign-in animation – Disabled

 

Lock Screen:

Group Policy – Computer Configuration –Policies – Administrative Templates – Control Panel – Personalization – Force a specific lock screen and logon image, prevent enabling lock screen camera, prevent changing lock screen and logon image

Turn off Cortana:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Search – Allow Cortana – Disabled

Turn off Web search:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Search – Don’t search the web or display web results in Search - Enabled

Power Options:

(This policy also sets the ‘Adjust plan brightness’ settings to default)

Group Policy – Computer Configuration – Policies – Administrative Templates – System – Power Management

- Sleep Settings:

Specify the system sleep timeout (on battery): 0

Specify the system sleep timeout (plugged in): 0

Specify the system hibernate timeout (on battery): 0

Specify the system hibernate timeout (plugged in): 0

- Video and Display Settings:

Turn off the display (on battery): 0

Turn off the display (plugged in): 0

Diagnostic data to MS

Prevent device name being sent to MS in diagnostic data

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Allow device name to be sent in Windows Diagnostic Data

Level of diagnostic data to send to MS (Our level at 0 sends the bare minimum)

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Allow telemetry – Enabled – 0 Security

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Do not show feedback notifications - Enabled

Lock machine after certain period:

Computer Configuration – Policies – Windows Settings – Security Settings – Local Policies – Security options – Interactive Logon Machine Inactivity limit

Remove people button from taskbar:

User Configuration – Policies – Administrative Templates – Start Menu and taskbar – Remove the people bar from the taskbar – Enabled

Disable Windows Store:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Store – Turn off Store application – Enabled

Confirm delete recycle bin:

User Configuration – Administrative Templates – Windows Components – File Explorer – Display Confirmation dialogue when deleting files - Enabled

Disable Notifications on lock screen

User Configuration -Policies - Administrative Templates - Start Menu and Taskbar – Notifications – Turn off Toast Notifications on the lock screen - enabled

Mapped Drives Error: (Local Change)

· Open Regedit

· HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Policies -> System

· You will see ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser

Add the following key - ADD DWORD (32bit), name it "EnableLinkedConnections".

· Double click it and set the data to 1

· Reboot

 

Disable Fast Boot: (Local Change)

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power\HiberbootEnabled – set to 0

 

Disable Microsoft Edge Icon on Desktop: (Local Change)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ DisableEdgeDesktopShortcutCreation – set 1

 

 

Hope that is of some help.

Edited November 26, 2018 by gmonks

[gmonks]

New post for MDT!

 

I use these rules (can find rules under properties of deployment share)

 

This will:

Skip Admin Password

Set UK timezone

Skip User backups etc

 

When capturing make sure skip capture is No

 

 

---------------------------------------------------------------------------------------------------------------------------------------------

[settings]

Priority=Default

Properties=MyCustomProperty

 

[Default]

OSInstall=Y

SkipCapture=YES

SkipAdminPassword=YES

SkipProductKey=YES

ProductKey=INSERT PRODUCT KEY

SkipComputerBackup=YES

SkipBitLocker=YES

 

UserDomain=domain.local

UserID=Administrator

UserPassword=insertadminpw

SkipTaskSequence=No

SkipUserData=YES

SkipComputerBackup=YES

SkipLocaleSelection=YES

KeyboardLocale=0809:00000809

UserLocale=en-GB

UILanguage=en-GB

 

SkipTimeZone=YES

TimeZoneName=GMT Standard Time

 

---------------------------------------------------------------------------------------------------------------------------------------------

Edited November 26, 2018 by gmonks

[PotNoodleTech]

Great work @gmonks thanks!!

[computer_expert]

Don't use the domain admin account for joining computers to the domain. Use an account with delegated permissions to the OU(s) where your clients end up.

 

https://wibier.me/domain-join-account-for-sccm-and-mdt/

 

Also create a dedicated build account with access to the deployment share (file & share permissions)

Edited November 26, 2018 by computer_expert

[gmonks]

Great work @gmonks thanks!!

 

No problem, hopefully it helps!

[adrianjones]

Powershell Script to remove Windows 10 Apps on logon:

 

Get-AppxPackage -AllUsers | Remove-AppxPackage

Get-AppXProvisionedPackage -Online | Remove-AppxProvisionedPackage -Online

[Jeepjockey]

Hey Gareth

 

Here is a link to just what you need. Basically you use DISM to remove the apps from the .wim file before you build your image

 

https://serverfault.com/questions/770686/deploying-windows-10-in-an-enterprise-how-do-i-remove-the-pre-installed-apps

 

Cheers

David

[ticktock]

Does anyone know how to get rid of these icons via GPO. The documents and pictures icons specifically. Not too worried about the settings icon as it's disabled anyway.