How do YOU deploy Windows

[ThatBoringBloke]

As a Google school who is moving more and more towards a serverless environment I'm just curious how you deploy Windows?

 

All of our staff run Windows PC's and as I look to remove servers slowly from our onsite estate it's got me thinking about OS deployment and how we would do it in the future without a deployment server. I no longer feel the need to rebuild machines each summer, but every now and then one breaks and needs to be re-imaged.

 

Currently I'm looking at a generic clean Windows Install from USB and then using PDQ to deploy everything else, but for those of you that have gone serverless (be it using 365/Azure/EntraID or Google) how do you delpoy a clean windows build? Can you even do this from the cloud without third party software?

[Oaktech]

Azure and Intune - Completely fresh install with a file on the stick generated with Windows Config Designer. Works a treat.

[MrEprise]

Mini PC with WDS/MDT and IP helper to point PXE to it?

 

Why does going Serverless mean you can't have some sort of computer to do all of these little things. My take on "going Serverless" to me means getting rid of all the full blown power-hungry Servers rather than getting rid of it all.

[ThatBoringBloke]

Mini PC with WDS/MDT and IP helper to point PXE to it?

 

Why does going Serverless mean you can't have some sort of computer to do all of these little things. My take on "going Serverless" to me means getting rid of all the full blown power-hungry Servers rather than getting rid of it all.

 

WDS/MDT still requires a 'Server' though. Even if it is just a PC you still need to licence it.

 

- - - Updated - - -

 

Azure and Intune - Completely fresh install with a file on the stick generated with Windows Config Designer. Works a treat.

 

So essentially booting to USB?

[Oaktech]

Mini PC with WDS/MDT and IP helper to point PXE to it?

 

Why does going Serverless mean you can't have some sort of computer to do all of these little things. My take on "going Serverless" to me means getting rid of all the full blown power-hungry Servers rather than getting rid of it all.

 

Depends what is driving this - our MAT is driving it and they are intending on *totally* serverless. Serverless to them means the only infrastructure on site is switches and a smoothwall. They are paying a get-out clause for one of our schools to move their telephones to their new cloud based platform from having a tiny PC on site as a phone server - despite the system being less a year old.

[Oaktech]

WDS/MDT still requires a 'Server' though. Even if it is just a PC you still need to licence it.

 

- - - Updated - - -

 

 

 

So essentially booting to USB?

 

Yup USB stick to install which at the language screen installs a profile and completes the install - some apps, names the device and joins to intune.

 

We have 5 sticks - Student wired, Student WIFI, Staff wired, Staff WIFI and Admin.

[mavhc]

Are you planning to move everyone to Chrome OS?

[Mr.Ben]

Might not work for all organisations (we are all primary), but we plan with W11 to do all initial builds via MDT at our office site, then via USB for all future single rebuilds.

 

For the W11 roll out we will also have a 'mobile' MDT server and kit (which we copy the database onto) for roll outs on site.

 

This is only for initial builds/wipes. One the initial stuff is done it's into Autopilot

Edited November 21, 2023 by Mr.Ben

[CHiLL]

SCCM (using WDS and MDT). Once all configured, deploying Windows is a basically zero touch. We don't capture/modify any Windows images, we just get the ISO from Microsoft, import it to SCCM, create a Task Sequence with the necessary drivers, essential apps and other amendments (such as join domain) and it goes off and does it. Just PXE boot a PC on the network, select the TS and then specify a machine name if necessary. It just does the rest automatically. I just need to manually move the machine into another OU and add laptops to our dot1x groups, that's it. Once imaged, SCCM will automatically install all the other apps/updates that are targeted for that machine/group.

[chaplic]

New Laptops, straight into autopilot, remove any manufactuer crap. Add to Azure AD group depending on student or teacher laptops. Policies settings Intune apps, all come down from there, including dynamic groups to push the correct drivers/ firmware etc.

 

Rebuilds would just take ISO from Microsoft, apply to USB and install then as above.

[lmrogers]

For those using AutoPilot and Intune, how quickly do the computer apply the policies and how effective are they? Espeically shared devices, are they consistent for each user?

[Oaktech]

For those using AutoPilot and Intune, how quickly do the computer apply the policies and how effective are they? Espeically shared devices, are they consistent for each user?

 

Pretty quick. Certainly comparable to on prem for most policies. I'm happy with it for that purpose. Our issue has been OneDrive being slow/inconsistent to connect to shared libraries.

[Netwacky87]

Our issue has been OneDrive being slow/inconsistent to connect to shared libraries.

 

Don't know if this would help but -

 

We added this regedit to InTune and GPO - HKEY_CURRENt_USER\Software\Microsoft\OneDrive\Accounts\Business1 - timerautomount 1

 

This made our shared libraries mount significantly quicker but if its a large library, it takes a while to placemark and index the files.

 

[TechMonkey]

Device with need for local drives at all times - SCCM

Anything else - Intune, Autopilot, Fresh install.

[chrisgreenwood]

Azure and Intune - Completely fresh install with a file on the stick generated with Windows Config Designer. Works a treat.

 

How does this work when you have to reload every pc in school?

 

We currently PXE boot then intune does the rest but we may go serverless in school (or ditch as many servers as possible) in 2025 due to them becoming EOL

[Olliedawg]

MDT / WDS. Using a fresh ISO, applications installed via task sequence in MDT. Takes about 30 minutes before it's done (bar any windows updates)

[garethEds]

We use MDT to deploy our machines and then PDQDeploy to push out applications depending on where the machine is based and which Task Sequence we have built from. Works lovely. We've just renewed our subscription to PDQ.

 

We looked at PDQConnect but it was too expensive.

 

Gareth

[ThatBoringBloke]

Are you planning to move everyone to Chrome OS?

 

No, long term plan is all staff are to remain on Windows, Students will mainly use ChromeBooks with only the occasional need to use Windows for specialist areas.

We are looking at the need for onsite AD. Since staff mostly use their own device exclusively (Classroom PC, Office PC) I can authenticate them with GCPW.

[TheHyperTechie]

As a Google school who is moving more and more towards a serverless environment I'm just curious how you deploy Windows?

 

All of our staff run Windows PC's and as I look to remove servers slowly from our onsite estate it's got me thinking about OS deployment and how we would do it in the future without a deployment server. I no longer feel the need to rebuild machines each summer, but every now and then one breaks and needs to be re-imaged.

 

Currently I'm looking at a generic clean Windows Install from USB and then using PDQ to deploy everything else, but for those of you that have gone serverless (be it using 365/Azure/EntraID or Google) how do you delpoy a clean windows build? Can you even do this from the cloud without third party software?

 

I would be interested to know where you get with this. We are currently a google school with students all having Chromebooks and the majority of staff using windows laptops/desktops. Our server was on its last legs so I decided to enrol our windows devices into GCPW with advanced desktop security so you can apply CSP policies/restrictions to them (like intune). The only issue that remains for me is the imaging side, as it has to all be done manually.

[PotNoodleTech]

Yes out of date here on this one - still using PXE boot to WDS/MDT server that has worked so well for so many years.

 

Question for those using totally modern Intune / Azure etc I've heard it's a lot of work to get it all set up tested etc and quite a lot of advanced knowledge needed to get (and keep) it working - is this true?

[ThatBoringBloke]

I would be interested to know where you get with this. We are currently a google school with students all having Chromebooks and the majority of staff using windows laptops/desktops. Our server was on its last legs so I decided to enrol our windows devices into GCPW with advanced desktop security so you can apply CSP policies/restrictions to them (like intune). The only issue that remains for me is the imaging side, as it has to all be done manually.

 

For me it's all dependent on how often you re-image. I don't if I can avoid it.

 

We are currently using WDS/MDT, but long term this will be obsolete, hence why I asked the original question.

 

Currently its looking like a USB build, manually naming, then PDQ deploy for everything else.

I have tested this and it works quite well.

[mavhc]

MS's theory is you can take the OEM laptop image, login to your AAD work account and it'll automatically remove the OEM crap and install your stuff, if it needs reimaging go back to OEM recovery partition

[Dos_Box]

Moving to the O\S Deployment forum.

[6Foot2]

Imaging/Build method history (most recent > oldest) SCCM, WDS, Symantec Ghost, RM Connect 2.4, 2.3 (can't remember if the build method had its own name) RM NET LM (diskless stations)

[PotNoodleTech]

Aah connect 2.3 them were the days - build off a flopy disk!