[sccm 2012] Raw ISO - No captured Image

[Planehazza]

Those that have ditched deploying captured WIMs in favour of a full task sequence approach, what windows tweaks/settings etc. do you deploy as part of the TS? Little things like This PC rather than Quick Access etc.

 

My captured image is now super thin to the point I really do not need to be capturing a reference image anymore. I just want it to go OS > updates > software > customisation etc. in one nice thorough task sequence.

 

We do not have Intune and we cannot afford to do so, so we're stuck with SCCM even for deployed laptops (I know I know, it's shocking, but I don't call the shots...).

 

Thanks!

[CHiLL]

Most of that is done via Group Policy to be honest. Our devices are managed only by SCCM too and the Task Sequence doesn't do that much that isn't pre-configuring (our TS was built using MDT). Most changes include auto-joining the domain, setting language and timezone, installing drivers, installing key applications (such as Office, Smoothwall Monitor, Impero, etc) and a couple of other customisations including disabling WinRE and resetting mouse suppression (there was a bug at some point where the mouse cursor wouldn't show during the OSD, so if it errored out, you couldn't use the mouse).

[mavhc]

I don't bother, Quick Access is better, shows recent files, frequent folders. Just put up a poster explaining what's been default for 9 years by now.

 

Also given win 11's file explorer is rewritten from scratch, doubt it'll work

[Planehazza]

I don't bother, Quick Access is better, shows recent files, frequent folders. Just put up a poster explaining what's been default for 9 years by now.

 

Also given win 11's file explorer is rewritten from scratch, doubt it'll work

 

We don't use any of the standard W10 user libraries though. All files and data live on Google Drive, so the only reference to that is via a mapped drive. So, the only drive they need to see is G: drive so it would make much more sense to show that and only that.

[mavhc]

We don't use any of the standard W10 user libraries though. All files and data live on Google Drive, so the only reference to that is via a mapped drive. So, the only drive they need to see is G: drive so it would make much more sense to show that and only that.

 

You don't redirect your docs/downloads/desktop/pictures to Gdrive?

 

Either way the rest of the space will fill with Gdrive folders as they're used often, and below that is recent files

 

https://github.com/gwblok/garytown/tree/master/ConfigMgr/Baselines to powershell config them

[jthompson]

Aim to do as much of that stuff via Group Policy (Quick Access vs This PC can be done by GPO).

I remove unwanted AppX packages from the vanilla ISO prior to importing it (still using MDT here but am assuming the same principle applies). It can be done in a single command that works off a CSV. Removing them in the task sequence doesn't work reliably.

[kidpressingbuttons]

we deploy only the raw iso- remove all bloat during build using the task sequence. So much easier when updating to latest OS versions.

[jthompson]

IME having a captured image with Office and updates installed deduplicates a tonne of processing and network traffic, and halves our deployment time on the client (MDT). Would be interested to hear what others' experiences are on that front with regards to MECM and deploying captured vs vanilla images.

[mavhc]

But how often do you reimage machines? Then again, how often do you update the base image these days, Win 10 feature updates have been minor/non existent for 4 years now

[kidpressingbuttons]

we deploy office and windows update as part of the task sequence so all still pulling from the same place basically. We reimage everything at least once a year. Full trust all using the same task sequence makes life very easy

[mavhc]

What's the reason to reimage every year?

[jthompson]

But how often do you reimage machines?

It's more the odd machine in a room that needs reimaging, but can be finished in 20mins and ready for the next lesson rather than taking the best part of an hour and not being ready. That's my main reason for wanting to optimise for minimal deployment time, at the expense of an automated build and capture needing a few hours every few months to complete. Routinely reimaging entire rooms doesn't happen as often these days, mainly because the lion's share of configuration is done by Group Policy and not baked in by imaging.

[jthompson]

Those that have ditched deploying captured WIMs in favour of a full task sequence approach, what windows tweaks/settings etc. do you deploy as part of the TS? Little things like This PC rather than Quick Access etc.

 

Install .Net Framework 3.5 . The Surpass SecureClient exam software requires that, so it's nice to not have to wrestle with installing that at short notice during exams season.

[kidpressingbuttons]

Always seen a yearly reimage as good practice to keep things clear and ensure all is running smooth and up to date

[mavhc]

You have to be up to date in days not years though

[Planehazza]

You have to be up to date in days not years though

 

For us, it's a mixture of several small issues, largely human errors in small, overstretched teams where the basic housekeeping often gets overlooked. In a high school where behaviour is shocking and devices are frequently broken, PCs are moved and repurposed repeatedly. Inevitably they end up in the wrong room, or apprentices don't rename things correctly, so it's often best to start afresh and give DNS a good purge etc.

 

We're running W10 22H2 currently, and as said above, it's the last feature update for W10 so building a new image isn't really needed often, which is conversely also a reason I want to move away from having an 'image' entirely, be it thick or thin. We're not a huge trust and scheduled imaging is done out of term time, and with multicast we can blitz through suites fairly quickly. When a PC is to be imaged due to an error (looking at you, Lightspeed...) or potential malware, the 45 mins or so that the PC is offline isn't too bad an issue - plenty other devices that can be used. Obviously different for a classroom.

[Planehazza]

You don't redirect your docs/downloads/desktop/pictures to Gdrive?

 

Either way the rest of the space will fill with Gdrive folders as they're used often, and below that is recent files

 

https://github.com/gwblok/garytown/tree/master/ConfigMgr/Baselines to powershell config them

 

Nope, but I haven't wanted to put some time into looking at it. Standard folder redirection doesn't work, as it applies that before Google drive has loaded and mapped the G Drive that the windows folders are trying to redirect to. I'll look at this option, thanks. Personally, I really just want to go to 365 - it's far superior, in my opinion. I have been trialling registry keys that hide all of the libraries and set This PC instead of Quick Access and have it working quite nicely in testing.

 

Regarding downloads, I'm personally contemplating whether that folder should be redirected at all and instead we purge that folder regularly. Too many staff let this folder build up to many GBs because they're too lazy or IT illiterate to manage it. Often important, working files are housed there and it triggers me to no end.

 

Aim to do as much of that stuff via Group Policy (Quick Access vs This PC can be done by GPO).

I remove unwanted AppX packages from the vanilla ISO prior to importing it (still using MDT here but am assuming the same principle applies). It can be done in a single command that works off a CSV. Removing them in the task sequence doesn't work reliably.

I had a similar PS1 batch file that would do the same that was applied during image build.

 

When you say via GPO, do you mean as preference registry key?

Edited May 2, 2024 by Planehazza

[jthompson]

I had a similar PS1 batch file that would do the same that was applied during image build.

 

When you say via GPO, do you mean as preference registry key?

 

Yes. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced", "LaunchTo" REG_DWORD updated to 1.

 

I found that AppX removal during task sequence in MDT was unreliable (due to some unpredictable sequencing behind the scenes) which meant that some packages weren't ultimately removed every time. May be different in SCCM/MECM, I guess. That's why I use Mount-WindowsImage against the raw ISO, run the Remove-AppxProvisionedPackage commands and then save using Dismount-WindowsImage before importing that modified ISO.

[Planehazza]

Yes. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced", "LaunchTo" REG_DWORD updated to 1.

 

I found that AppX removal during task sequence in MDT was unreliable (due to some unpredictable sequencing behind the scenes) which meant that some packages weren't ultimately removed every time. May be different in SCCM/MECM, I guess. That's why I use Mount-WindowsImage against the raw ISO, run the Remove-AppxProvisionedPackage commands and then save using Dismount-WindowsImage before importing that modified ISO.

 

Sounds like we've had very similar experiences and thought processes. I had a right mare capturing the image due to some weird appx, where if allowed to run, they would break the capture process. I', going back 12 months so I'm very overly simplifying an old memory.

 

That GPP reg key is the one I have been testing, I believe.