What next?!

[jthompson]

The actual future MS wants is to not image your new devices, and pay them every month for every device for intune, have a user login with their corporate MSA and reconfigure the laptop on the fly

 

Are people using usb boot drives because their laptops don't have ethernet? did you switch from network boot to usb? or never had network boot?

 

I've only reimaged about 1% of our devices after the first reimage when they're new, a Windows install lasts longer than the hardware these days

If only our computers didn't suffer power cuts and lots of ungraceful shutdowns, we'd need to reimage them less often.

[3s-gtech]

Most of my reimages are due to major version changes of Windows - I think I’ll do Windows 11 next year fresh rather than in-place. Not looking forward to that!

 

The rest are for vanishingly rare SSD failures, failed Windows updates and the power being pulled.

[LeMarchand]

I tend to "re-image" every time a laptop changes hands. The "image" is OS only; everything else added via GP. Update the WIM every few months or so - nice, easy, and free.

[David44]

We are currently using RM CC4 so although we are using MDT/WDS, it has been largely hidden from us by the RM Console and their own build process running on top of Windows PE. We need to move to Windows 11 and away from RM CC4, so I am currently elbow deep in reference images and unattend.xml files etc. Making progress, slowly.

 

What I can't get my head completely around is the actual process of a technician building a PC.

 

I imagine a scenario like this. A technician PXE boots from the network, WDS takes over, startnet.cmd runs, mounts a network share and then runs setup.exe from the share with relevant switches to silently install Windows 11 and pick up the unattend.xml file.

 

For those using MDT/WDS, is that how you do it or am I missing something?

 

If so, how do you name the PC, currently the name is being picked up from the unattend.xml file. Do you copy and edit the unattend.xml file before each build to give the PC the correct name. I could add some Powershell that asks the technician for the name of the PC and then edits a copy of the unattend.xml file, or is there a better way to do this?

[PotNoodleTech]

Basically

 

When you PXE boot you set a DNS entry in your AD DHCP to tell it whichserver to point to - it then PXE boots from that server a Windows PE image from WDS (this image is generated by MDT).

 

This allows a boot with network drivers etc, which then copies the full O/S image from the MDT server and presents you with a friendly interface you can set the workstation name tick boxes for which apps you want etc.

 

This then reboots into the actual copy of Windows on the PC's SSD and then proceeds to finish installing itself.

 

So you'ge gotta use MDT (provides the final windows image including all apps settings and drivers) and WDS (provides the initial boot image / think windows bootable USB drive image).

 

There's loads of youtube videos on setting it all up you can have it done in a day.

[mavhc]

In WDS I can name the PC, or prename it based on mac address, when I was doing loads of computers I would barcode scan the mac address off the box into a spreadsheet, that had the computer names, and put the ID sticker on the laptop, then the spreadsheet created a https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wdsutil-add-device command which I'd bulk copy/paste into the server, and then just turn on computer and spam f12, from there everything is automatic.

 

Never bothered with MDT as the software I wanted would installed based on per OU GPO anyway

[PotNoodleTech]

You can probably script it but I just spend 10 seconds typing in the PC name at the start of the build proces and then off it goes.

[jthompson]

Using an MDT database to automatically set the computer name during imaging - https://4sysops.com/archives/windows-8-deployment-part-8-the-mdt-database/

[David44]

Are people building from a custom Windows 11 image or just the standard image and then removing apps and installing programs once Windows 11 has been installed?

[CHiLL]

Are people building from a custom Windows 11 image or just the standard image and then removing apps and installing programs once Windows 11 has been installed?

I haven't used sysprep or created a golden image in over 10 years now. We are just obtaining the ISO from VLSC and deploying that (or the extracted WIM) straight to the clients and then using things like AppLocker and other GPO/registry settings to restrict access to apps.

[jthompson]

Are people building from a custom Windows 11 image or just the standard image and then removing apps and installing programs once Windows 11 has been installed?

 

I'm deploying a captured custom image. Not much customisation, though: removing unwanted AppX packages, installing Office, enabling .NET 3.5 and then Windows updates for the month.

 

To get up and running, far easier to not bother with build&capture and instead just deploy a vanilla image and use Group Policy to take care of app deployments and customisations afterwards.

[mavhc]

I use dism++ https://github.com/Chuyu-Team/Dism-Multi-language to mildly edit the wim file, otherwise untouched, so easier to swap in a new one every year

[LeMarchand]

I haven't used sysprep or created a golden image in over 10 years now. We are just obtaining the ISO from VLSC and deploying that (or the extracted WIM) straight to the clients and then using things like AppLocker and other GPO/registry settings to restrict access to apps.

 

Yep, that's my current process.

[David44]

Can anyone expand on the build process?

 

What actually happens when you build a PC using WDS? Windows 11 is installed and then the following must happen in some order.

 

The PC is added to the domain.

Do you do this via the unattend.xml file?

 

A user (a domain user?) automatically signs in to the PC, mounts a network share and installs relevant applications.

Do make it auto sign in via the unattend.xml?

How do you install the applications? Just from running setups etc. from postOOBE.cmd?

How do you check that they have all been installed successfully without manually checking log files?

How do you install different applications for different departments?

[mavhc]

using WDS I have an unattend file for the boot that creates partitions, and has a username/password for an account just for wds (mostly to access the share), and optionally selects a default image

 

 

Then each image has a unattend file that sets timezone, enables admin user with net user command, joins the domain, using the wds password, then runs some scripts that do the rest. You can auto login x times too if you wish

 

           
	
                   3
                   false
                   "\\server\share\Install Wifi.bat"
               

etc

[lmgtfy]

We use FOG here......... just started to deploy windows 11 with it.... Thin image, the we use PDQ to do a post deployment software install.... PDQ also do "SmartDeploy" which does reimaging and ties everything together..... however i've not had time or a trial of smartdeploy yet.

 

PDQ deploy and inventory is epic. best thing i've ever had bought for me

 

Log term user of Fog here looking at Windows 11. Have you got Fog to work with secure boot yet or are you just running Windows 11 without the TPM requirement?

 

Thanks

[mavhc]

https://forums.fogproject.org/topic/13832/secureboot-issues/3

[garethEds]

So - further to other posts I've put on Edugeek, we had our pricing back from SmartDeploy and it's way out of our league. It's $12.32 per endpoint for 600 ($7,392) devices and $11.88 per endpoint for 700 devices ($8,316). This is Edu pricing. Maybe schools elsewhere can afford this, but it isn't ever going to be on our radar.

 

I'll keep MDT going for as long as possible and when that dies I@ll look at the PowerShell version, and if that doesn't work - then I'll think some more.

 

We are not due to go AutoPilot for a few years in the LEA yet - but an I right in saying that even this doesn't deploy and I would still need an OS on the computer to start the process? I'm wondering if I could PEXE into OSDCloud to get it all working - but how would I name machines? The one thing I like about MDT is naming machines via the database/MAC address.

 

Cheers all,

 

Gareth

[garethEds]

So adding to the conversation...... Michael Niehaus and 2Pint Software have a new bare metal deployment solution on the horizon. It's called DeployR. There was a webcast about it this week:

 

 

Looks clean and polished. Pricing availability is discussed in the webcast at 40mins.

 

G

Edited January 29, 2025 by garethedmondson