[mdt] Versions for Windows 11 Deployment

[robyholmes]

Hi All,

 

We're just doing some testing with Windows 11 in our MDT setup but running into a few issues (As expected mind). For those of you with working Windows 11 MDT setups, can you confirm what version of things your running, plus any changes you made to MDT to allow it to build & deploy Windows 11?

 

So MDT Version, AKD Version, WinPE Changes Etc

 

Thank you,

Rob

[jthompson]

Windows Server 2022

MDT v6.3.8456.1000

ADK v10.1.22000.1

 

We're successfully deploying Win11 24H2.

 

BIOS/UEFI detection fix:

https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7

 

ADK tweaks (for ADK versions later than Windows 10 2004):

Make sure that deployment shares have x86 disabled in their properties.

Create folder "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs".

For ADK version 10.1.22000.1 (Win 11 22H2) or later, add required tweak to "C:\Program Files\Microsoft Deployment Toolkit\Templates\Unattend_PE_x64.xml", including updating the existing "Order" value from 1 to 2. https://github.com/MicrosoftDocs/memdocs/blob/main/memdocs/configmgr/mdt/known-issues.md#hta-applications-report-script-error-after-upgrading-to-adk-for-windows-11-version-22h2

Edited December 3, 2024 by jthompson

[Olliedawg]

Exact same as above. Quite a few tweaks needed, but once it's done it works well.

 

Using MDT here to deploy Win11 + install apps

[3s-gtech]

Server 2019

Our ADK is still the 10.1.19041 version.

MDT 6.3.8456.1000

 

Deploying Windows 11 24H2 now with this setup. I have a CMD to pause the TS to allow the network adaptor to install and initialise (that helped with W10), plus some of the tweaks from above.

[PotNoodleTech]

Server 2019

ADK 10.1.19041.1

WDS 10.1.19041.1

MDT 6.38456.1000

 

All good here.

[robyholmes]

Are any of you removing built in apps (Games, Xbox etc) during the build process in MDT? I've been trying to run a Powershell script for this in WinPE but I don't think PS is working in WinPE currently. When I started to look into that it started to look like a minefield of issues depending which version you go for. Hence this question on what other people are using.

[3s-gtech]

I still have the old Windows 10 removal script attached to the TS, but I don't think it works.

[Olliedawg]

Used to debloat with windows 10, haven't really bothered with windows 11.

 

If you have applocker setup its easy enough to lock stuff down anyways

[Julian]

We are installing Windows 11 from MDT, we are using a standand Microsoft ISO image, and then a powershell script (below) to remove some apps.

It should be easy to customize this script.

 

 

# Script to remove Windows 11 UWP apps

 

# List of apps to be removed

 

$AppList =@(

"Microsoft.549981C3F5F10",

"Microsoft.BingNews",

"Microsoft.BingWeather",

"Microsoft.GamingApp",

"Microsoft.GetHelp",

"Microsoft.Getstarted",

"Microsoft.MicrosoftOfficeHub",

"Microsoft.MicrosoftSolitaireCollection",

"Microsoft.People",

"Microsoft.StorePurchaseApp",

"Microsoft.Todos",

"Microsoft.WindowsAlarms",

"Microsoft.WindowsCamera",

"microsoft.windowscommunicationsapps",

"Microsoft.WindowsFeedbackHub",

"Microsoft.WindowsMaps",

"Microsoft.WindowsStore",

"Microsoft.Xbox.TCUI",

"Microsoft.XboxGameOverlay",

"Microsoft.XboxGamingOverlay",

"Microsoft.XboxIdentityProvider",

"Microsoft.XboxSpeechToTextOverlay",

"Microsoft.YourPhone",

"Microsoft.ZuneMusic",

"Microsoft.ZuneVideo",

"MicrosoftCorporationII.QuickAssist",

"MicrosoftTeams")

 

 

foreach ($i in $applist) {

Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq $i | Remove-AppxProvisionedPackage -Online

Get-AppxPackage -name $i -AllUsers | Remove-AppPackage -AllUsers

}

[altecsole]

Are any of you removing built in apps (Games, Xbox etc) during the build process in MDT? I've been trying to run a Powershell script for this in WinPE but I don't think PS is working in WinPE currently. When I started to look into that it started to look like a minefield of issues depending which version you go for. Hence this question on what other people are using.

 

We use Config Manager, rather than MDT, but use a PowerShell script in Window PE to remove unwanted apps.

[jthompson]

We are installing Windows 11 from MDT, we are using a standand Microsoft ISO image, and then a powershell script (below) to remove some apps.

It should be easy to customize this script.

 

 

# Script to remove Windows 11 UWP apps

...

 

I have a similar script but I don't run it in the TS. I instead run it against the vanilla ISO to strip them out of that.

Something like this to mount the image.

Mount-WindowsImage -ImagePath "E:\DeploymentShare\Operating Systems\Windows 11 Education 24H2 (Oct 2024)\sources\install.wim" -Index 1 -Path "E:\Mounted"

 

and then

 

# Create a list of unwanted AppX package names.
$Apps = @(
   "*DevHome*"
   "*FeedbackHub*"
   "*GamingApp*"
   "*GetHelp*"
   "*Getstarted*"
   "*Microsoft3DViewer*"
   "*MicrosoftOfficeHub*"
   "*MixedReality*"
   "*News*"
   "*OneNote*"
   "*Outlook*"
   "*People*"
   "*PowerAutomateDesktop*"
   "*Skype*"
   "*Solitaire*"
   "*Todos*"
   "*Weather*"
   "*WindowsMaps*"
   "*Xbox*"
   "*YourPhone*"
)

# Remove packages for all users.
ForEach($App in $Apps){
   Get-AppxProvisionedPackage -Path "E:\Mounted" | where {$_.PackageName -like $App} | Remove-AppxProvisionedPackage
}

 

and then save and dismount the image.

 

Dismount-WindowsImage -Path "E:\Mounted" -Save

 

That saves time/work during deployment.

[altecsole]

I have a similar script but I don't run it in the TS.

We used to do something similar but doing it in the Task Sequence means you can have some flexibility in what apps you remove. So, you can leave some apps in for staff computers, but remove them for students.

[PotNoodleTech]

We used to do something similar but doing it in the Task Sequence means you can have some flexibility in what apps you remove. So, you can leave some apps in for staff computers, but remove them for students.

 

Also if you remove it within the image doesnt it all get reinstalled during feature updates? Or does that happen anyway?

[jthompson]

Also if you remove it within the image doesnt it all get reinstalled during feature updates? Or does that happen anyway?

 

IDK. We tend to reimage rather than push out feature updates. Good point though, I hadn't considered it.

[DrCheese]

We don't bother removing any apps, we just block the ones we want to block via Applocker. I can't understand why people are removing things like "Windows Camera" - It's harmless & is a quick way to test webcams.

 

This means that we don't get any issues during feature updates - Previous versions of Windows would fail on upgrades if certain apps had been removed. Rather just have a vanilla image (Although we preinstall office) & call it a day.

[altecsole]

We don't bother removing any apps, we just block the ones we want to block via Applocker. I can't understand why people are removing things like "Windows Camera" - It's harmless & is a quick way to test webcams.

 

This means that we don't get any issues during feature updates - Previous versions of Windows would fail on upgrades if certain apps had been removed. Rather just have a vanilla image (Although we preinstall office) & call it a day.

 

I agree on this, and the Applocker approach is what we use for Autopilot/Intune devices. Removing apps from the image for student computers was a request from teaching staff.

[robyholmes]

We are installing Windows 11 from MDT, we are using a standand Microsoft ISO image, and then a powershell script (below) to remove some apps.

It should be easy to customize this script.

# Script to remove Windows 11 UWP apps

 

How are you running this in your Task Sequence? I've tried the script being run in State Restore phase. However I'm just getting a generic

'The type initializer for '' threw an exception'

Running the script manually on the build OS after MDT has finished works perfectly. I have a restart before script is run to make sure no WU or anything is affecting it.

Edited December 5, 2024 by robyholmes

[robyholmes]

How are you running this in your Task Sequence? I've tried the script being run in State Restore phase. However I'm just getting a generic

'The type initializer for '' threw an exception'

Running the script manually on the build OS after MDT has finished works perfectly. I have a restart before script is run to make sure no WU or anything is affecting it.

 

Update for others on this, it seems you can't use the Powershell Script option on the Task Sequence. So you use the 'Run Command Line' step instead with the following:

Powershell.exe -ExecutionPolicy ByPass -File "%SCRIPTROOT%\[i]W11 Apps Removal Script[/i].ps1"

 

I then also ran into Sysprep issues due to Language Packs which appear when you remove built in apps. These appear after a restart from the removal, which then needs another script as put below. So you'll want three steps as follows:

• Run Command Line - PowerShell Remove Built In Apps
  
• Restart Computer
  
• Run Command Line - PowerShell Remove Language Pack (Same command as above, but pointing to second script)
  

 

 

#Remove Language Pack causing Sysprep Issues
Get-AppxPackage -Name '*Microsoft.LanguageExperiencePacken-gb*' | Remove-AppxPackage -ErrorAction SilentlyContinue

(Thank you to Edugeeks @KK20 for the above - https://www.edugeek.net/forums/windows-10/219875-windows-10-20h2-sysprep-error-2.html#post1894619)

[FragglePete]

We don't bother removing any apps, we just block the ones we want to block via Applocker. I can't understand why people are removing things like "Windows Camera" - It's harmless & is a quick way to test webcams.

 

This means that we don't get any issues during feature updates - Previous versions of Windows would fail on upgrades if certain apps had been removed. Rather just have a vanilla image (Although we preinstall office) & call it a day.

 

Does this approach still leave the icons in place for the Apps and and they just don't do anything (or give an error) when clicked? Just wondering. I run a script which does remove a number of the Apps, but intrigued by your approach.

 

For reference, I've just built a new MDT server as I kept getting errors on my existing VM when I tried adding 24H2 to it. New box is running Windows Server 2025 (well, why not it works!), with ADK version 10.1.26100.1 and MDT version 6.3.8456.1000.

 

Must have been a slow day, as I added the attached image for use as my build screen when the image is downloading....

 

 

 

Pete

[PotNoodleTech]

Hahaha I want that desktop.

[David44]

What causes the progress bar to appear in that screenshot?

[FragglePete]

What causes the progress bar to appear in that screenshot?

That's just the standard Progress Bar that appears when it does the first tasks. I moved it down the screen by hand to take the photo.

 

Hahaha I want that desktop.

 

Should be attached here.....

 

9bu3f1v2.bmp

 

Pete

[Olliedawg]

Haha, that desktop background is great

[jthompson]

I'm working on the assumption the removing the provisioned AppX packages will have a benefit in reducing login times when a local profile needs to be created.

[DrCheese]

Does this approach still leave the icons in place for the Apps and and they just don't do anything (or give an error) when clicked? Just wondering. I run a script which does remove a number of the Apps, but intrigued by your approach.

 

For reference, I've just built a new MDT server as I kept getting errors on my existing VM when I tried adding 24H2 to it. New box is running Windows Server 2025 (well, why not it works!), with ADK version 10.1.26100.1 and MDT version 6.3.8456.1000.

 

Must have been a slow day, as I added the attached image for use as my build screen when the image is downloading....

 

[ATTACH=CONFIG]72767[/ATTACH]

 

 

Pete

 

haha that background is quality

 

Yeah, it leaves the icons visible, just get a blocked message when clicking on them