[wds] MDT task sequence to accomplish prestaging like RIS

[mhundley]

Hi all,

 

I am a long time lurker who has got a load of great info from this site which I have been able to use in the schools I support. I work for an LA as a technician who along with my team support over 120 schools in our county.

 

I have been playing with deploying Windows 7 from a Server 2008 machine running WDS and MDT2010, I have been able to get the system set up and make changes to the default Windows 7 image which is deployed so that info is pre-filled instead of prompting the user.

 

I have got a lot of experience with using RIS/WDS Legacy to deploy XP machines which is what we currently use in many of the schools our team support. We use PXE boot to call the standard ms osc screens which prompt for username and password, In each OU we want to add machines to, we will have a user which has rights to join a machine to the domain.

 

RIS/WDS is set to respond to all machines and to create a computer account in the same OU as the user, this means when we log on with an authorised user we have the computer account automatically created in the correct place so any GPO is applied from the beginning, also it has the advantage that we dont have to prestage any machines in AD as the machine is created with the correct naming convention and incremented automatically (set by the username e.g. Class1 will give a computer name of Class1-01, Class1-02 etc)

 

The actual install of Windows is achieved by a modified .sif file so we can log on to a new machine and walkaway safe in the knowledge that the machine will do the rest for us.

 

Okay enough background babble, the actual issue I am having is in emulating the RIS way of doing things, we are not open to the idea of manually prestaging machines due to the fact that we have a lot of schools and would need to set it up in each location, also I will be writing the draft procedures for out team to use and want to keep it as simple as possible.

 

I would love to be able to PXE boot the machine, be prompted for the username and password and be able to step away. My understanding is that in RIS the machine will check in AD if the GUID/UUID exists for a computer account and if not creates a new machine record populated with the ID in the correct location.

 

My thinking is that I will need a script to run at the beginning of the task sequence which

 

1.Prompts for a username

2.Gets the GUID of the machine

3.Makes contact with the AD

4.Checks for the GUID

5(a).If there set the computername and OU settings to be used later,

5(b).If not then create the computer account in the correct place and pass the values for later use.

 

I have looked over the internet and have so far not managed to find anything which achieves the results I need, I guess its because W7 and MDT2010 are both new. I was lucky to find MSFN's Unattended Windows : Unattended Windows Introduction when I wanted to do research for XP but havent been too lucky yet.

 

Over to you guys, I am open to ideas/advice/fully formed scripts which do it for me.

 

 

Sorry for the length of post but I thought I should give as much info as I could to get started.

 

 

Thanks in advance

 

 

Marc

[mhundley]

Bump

 

Thought I might get a bit more response during the week rather than on a Friday night

[cookie_monster]

I'm going to be looking into the same issue after the xmas hols so i'll be interested in how you get on. We'll be going to Windows 7 in stages so i'll also need a way to deploy our current XP flat image do you know how to do that yet?

 

Cheers.

[azrael78]

While this may not be entirely relevant...

 

I've managed to mostly automate a Windows XP/Vista/7 install using WDS/MDT2010/SCCM - it can just be done using WDS/MDT2010.

 

If memory serves though you have to use the WAIK (Windows 7/2008 R2 version) and use Windows SIM (System Image Manager) tool to create your unattended XML files.

 

These in turn can be used instead of sysprep.inf which 2K/XP/2K3 used - however the newer answer file format is much more robust - does include joining to domains and perhaps OU placement also.

 

As for XP - I'm afraid you'd still have to use sysprep for this, but once you have the image prepped like you normally would (for something like ghost) - you can then switch over to using WDS which will treat the image as a flat image - just don't apply Windows SIM stuff to your XP build and it should just work.

 

I'm not 100% what either of you are trying to achieve exactly - if you can condense it down into what exactly you'd like it to do, I can hopefully come up with a better answer for you

 

Az

[cookie_monster]

While this may not be entirely relevant...

 

I've managed to mostly automate a Windows XP/Vista/7 install using WDS/MDT2010/SCCM - it can just be done using WDS/MDT2010.

 

If memory serves though you have to use the WAIK (Windows 7/2008 R2 version) and use Windows SIM (System Image Manager) tool to create your unattended XML files.

 

These in turn can be used instead of sysprep.inf which 2K/XP/2K3 used - however the newer answer file format is much more robust - does include joining to domains and perhaps OU placement also.

 

As for XP - I'm afraid you'd still have to use sysprep for this, but once you have the image prepped like you normally would (for something like ghost) - you can then switch over to using WDS which will treat the image as a flat image - just don't apply Windows SIM stuff to your XP build and it should just work.

 

I'm not 100% what either of you are trying to achieve exactly - if you can condense it down into what exactly you'd like it to do, I can hopefully come up with a better answer for you

 

Az

 

 

Current background. We use WDS on 2003 SP2 in legacy mode to deliver a flat XP install which is hardware independent so we only need one image on the server. I'd like to be able to keep this on the new WDS and add a Windows 7 image, I've been told I could do this by deploying my current image to a station and capturing an image before it boots and runs setup.

 

 

We use Server 2008 not 2008 R2 is what you suggested possible with just 2008 WDS and MDT2010?

 

 

That’s about all for now.

 

Cheers.

[azrael78]

We use Server 2008 not 2008 R2 is what you suggested possible with just 2008 WDS and MDT2010?

 

Don't see why it wouldn't be possible - R2 only really adds Windows 7 based support to several items, but I don't believe WDS is one of them as MDT2010 adds that support for WDS.

 

You'd have to have seperate images for XP and Win 7 due to the methods of sysprep used - but other than that you should be able to do it and I can't see a real reason why it wouldn't work.

 

Az

[cookie_monster]

Don't see why it wouldn't be possible - R2 only really adds Windows 7 based support to several items, but I don't believe WDS is one of them as MDT2010 adds that support for WDS.

 

You'd have to have seperate images for XP and Win 7 due to the methods of sysprep used - but other than that you should be able to do it and I can't see a real reason why it wouldn't work.

 

Az

 

 

I think the Windows 7 bit should be fairly straight forward I'll see about the XP bit, an XP flat install image doesn't require sysprep so i'm not sure about that bit.

 

 

So MDT2010 ties in with WDS, do you prepare the image with MDT2010 and then host it on the WDS?

 

Cheers.

[azrael78]

I think the Windows 7 bit should be fairly straight forward I'll see about the XP bit, an XP flat install image doesn't require sysprep so i'm not sure about that bit.

 

 

So MDT2010 ties in with WDS, do you prepare the image with MDT2010 and then host it on the WDS?

 

Cheers.

 

Whilst I'm sure you may be right about your XP image, I've never heard of an XP image that doesn't need sysprep in some way or another.

 

Even at the basic level - you'd need sysprep to regenerate your SIDs, which if you neglect to do can cause all kinds of problems on an AD-based network.

 

If you don't need sysprep - I'd be curious as to how your XP image works.

 

Az

 

Edit: Ah - forgot to look at MDT... will take a quick peek at what we have here as we haven't used it to push out 7. I just know that for SCCM - you need MDT2010 to be able to push out 7. Will take a look and see what we have.

[cookie_monster]

Whilst I'm sure you may be right about your XP image, I've never heard of an XP image that doesn't need sysprep in some way or another.

 

Even at the basic level - you'd need sysprep to regenerate your SIDs, which if you neglect to do can cause all kinds of problems on an AD-based network.

 

If you don't need sysprep - I'd be curious as to how your XP image works.

 

Az

 

Edit: Ah - forgot to look at MDT... will take a quick peek at what we have here as we haven't used it to push out 7. I just know that for SCCM - you need MDT2010 to be able to push out 7. Will take a look and see what we have.

 

 

 

A flat image doesn't actually use an image so it runs setup. It basically copies i386 down to the PC with an extra drivers folder, it then uses setup.sif (another name for unattend.txt) to run setup with an answer file it finds all of the drivers in the drivers folder for newer hardware. As you see it runs a windows setup install which of course generates a unique SID. It's not technically an image in the 'Ghost' sence and it takes a bit longer to build the advantage is that you only need one image for all of your hardware.

[azrael78]

A flat image doesn't actually use an image so it runs setup. It basically copies i386 down to the PC with an extra drivers folder, it then uses setup.sif (another name for unattend.txt) to run setup with an answer file it finds all of the drivers in the drivers folder for newer hardware. As you see it runs a windows setup install which of course generates a unique SID. It's not technically an image in the 'Ghost' sence and it takes a bit longer to build the advantage is that you only need one image for all of your hardware.

 

Aha - this explains my confusion.

I also don't think you need to use MDT2010 for Windows 7 but as we use SCCM for our images (or we will do) then it's a little difficult to point you in the right direction.

 

As long as Windows SIM supports Windows 7 - you should be fine.

 

Az

[mhundley]

Cookie_Monster

 

So far we have avoided the Win XP bit but are using Server 2k8R2 with WDS to successfully deploy windows 7 onto the domain. We have found several bits of useful info on the net and as with all things much more useless stuff. If you like I can dig out some of the info we have used (which will not cause any issues with the management)

 

I am making some assumptions about your setup but if it is the same as us you are creating users which you log on as in the PXE/Blue screen(forgot the name) stage which automatically gives the machine a name for the domain and puts the machine in the same OU.

 

WDS can provide the computer name in the same way as RIS/WDS legacy does but if you have two machines running at a different speed the domain join is done as part of the 7 install (at the customisation part if I remember correctly) whichever machine gets to this part first gets the earliest available machine number in AD. The only way we have found around this so far without prestaging the GUID of each machine into AD is to start one machine and then wait until it gets far enough for the next one to not catch up in time to join first.

 

The easiest way we have found so far to deploy XP is to use 2008R2 with Hyper-V and to set up a 2K3R2 server running within it using WDS legacy. As long as you set up the Forest and Domain functional levels to be 2003 then you can build and join a 2003 virtual box within the 2K8R2 host and dcpromo it as a DC within the domain, then you will have full replication between the servers so the AD is maintained when new machines are added.

 

This has advantages and drawbacks, although you can install XP clients using this method you cannot use the Driver injection offered with WDS in 2K8R2 onto windows 7 builds. One way around this would be to maintain WDS on both servers but use the 2K3 for XP and the 2K8 for Win7, stopping the WDSServer service on whichever system is not needed at the time. Over time this will not be an issue as the XP clients will start to fade away and we will have shiny Win7 Clients everywhere.

 

 

I will point out that so far everything we have done has been on test machines in the office and we have not ventured onto a live system yet.

 

 

If you have any further questions feel free to ask as we are still trying out new things ourselves and are no way there yet. But it is nice to know that someone out there works the same way we do and that there will be someone else to bounce ideas off.

 

The Guy I am working with at our place is registered on these forums as jon_boy1984 and I am sure he will post anything I have forgotten.

 

 

 

Good luck.

[cookie_monster]

Thanks mhundley i'll not be looking into this untill the new year so we'll see then.

 

 

Az, I think I need to put aside some reading time to see the differences between MDT2010 and SCCM. If both are required and what their functions are.

 

Thanks.

[DMcCoy]

WDS + Prestage

WDS + MDT

WDT + MDT/SCCM

 

These are the main choices for deploying a machine which then joins the domain. You can use WDS and script is later on in the install too.

 

The problem is the order in which the domain is joined, to use the built in domain joining function you need the computer name to be replaced in the unattended file which is what the prestage/MDT/SCCM do. You could prompt for the machine name in vista, it just didn't work as it joins the domain before setting the name. Windows 7 avoids this by simply not allowing the name prompt.

 

I did use MDT2010 but really hated it, I'm much happier with just WDS and prestaging the machines. All I need to do is boot from network and it sorts the name and image type (staff/student/board etc) from the existing account. It's a lot easier to prestage with the MAC address than the GUID since you can collect them easily from DHCP.

[cookie_monster]

WDS + Prestage

WDS + MDT

WDT + MDT/SCCM

 

These are the main choices for deploying a machine which then joins the domain. You can use WDS and script is later on in the install too.

 

The problem is the order in which the domain is joined, to use the built in domain joining function you need the computer name to be replaced in the unattended file which is what the prestage/MDT/SCCM do. You could prompt for the machine name in vista, it just didn't work as it joins the domain before setting the name. Windows 7 avoids this by simply not allowing the name prompt.

 

I did use MDT2010 but really hated it, I'm much happier with just WDS and prestaging the machines. All I need to do is boot from network and it sorts the name and image type (staff/student/board etc) from the existing account. It's a lot easier to prestage with the MAC address than the GUID since you can collect them easily from DHCP.

 

 

 

So with WDS you need to prestage all clients how does this work with a new PC do you need to grab the MAC address and then create an account before begining the build preocess?

[DMcCoy]

So with WDS you need to prestage all clients how does this work with a new PC do you need to grab the MAC address and then create an account before begining the build preocess?

 

Yes, collect the MAC addresses and prestage,

 

wdsutil /Add-Device /Device:L1301 /ID:001CC0693321 /ReferralServer:10.0.8.1 /WdsClientUnattend:WdsClientUnattend\Student.xml /User:MEDINA\WDS /JoinRights:Full /JoinDomain:Yes /OU:"OU=L13,OU=Students,OU=Computers,OU=Medina,DC=medina,DC=school"

 

This will join the machine with that MAC to the domain with the user account. This works in conjunction with the 2 unattended WDS files. If you need those files I can provide the ones we use.

 

You can also modify the existing account it you don't want to delete and recreate them. The wdsclientunattend option can be used to specify which image is installed on the machine.

[cookie_monster]

No rush as i'm not trying this untill the new year i'm just thinking things over at the mo but i'd like a look at the files when you get time.

 

Thanks.

[PiqueABoo]

It basically copies i386 down to the PC with an extra drivers folder, it then uses setup.sif (another name for unattend.txt) to run setup with an answer file it finds all of the drivers in the drivers folder for newer hardware. As you see it runs a windows setup install which of course generates a unique SID.

 

1) Ignoring pre-staging (because I didn't care about that), deploying XP more or less like this is perfectly do-able with MDT . It has and I added required drivers to a driver library. I created a task sequence that initially prompts for computer name, lets me pick from a list of target OUs and then gets on and installs XP via the I386 source on an MDT distribution share, adds the relevant drivers, adds my choice of applications (which I limited to updates to integrated OS apps e.g. a newer IE, Media Player and so on), then joins it to the domain.

 

Downside: It took some time to figure out how to make MDT do that. It takes a while to figure out how to make MDT do anything. I think it's lovely now though and 2010 is nicer than the 2008 I started with.

 

2) Google "newsid retired" or even search on here - the new, official line is that fiddling with computer SIDs is a waste of time.

Edited December 17, 2009 by PiqueABoo

[mhundley]

The main issue with prestaging into AD is that we are often either setting up a new network or completely rebuilding the whole school.

 

I would not like to have to manually enter the values using wdsutil.

 

We are trying to work on a solution which is fairly portable as we have with RIS/WDS Legacy, we work for the LA and support around 130 schools on a rolling rota.

 

Having to use wdsutil to add all machines at the start of the project is not a fun prospect so we are trying to work around it.

[DMcCoy]

The main issue with prestaging into AD is that we are often either setting up a new network or completely rebuilding the whole school.

 

I would not like to have to manually enter the values using wdsutil.

 

We are trying to work on a solution which is fairly portable as we have with RIS/WDS Legacy, we work for the LA and support around 130 schools on a rolling rota.

 

Having to use wdsutil to add all machines at the start of the project is not a fun prospect so we are trying to work around it.

 

Well you must have some unique identifying value unless you just want to use a predefined naming convention. Even MDT will need something to use, serial number, MAC, model just about anything that you can query with wmi or a combination of all of the above. Prestaging is just easier if you already know what you want the computer name to be and it won't work with those sorts of values.

[mhundley]

At the moment we are happy to use the logon user to create the computer name using the WDS naming feature.

 

We set an OU for each class and within that give a user which only has rights to create a computer account/join computer to domain. The user will have the name of the room i.e. class1, using the WDS naming the first machine will be called room1-01, machine number2 = room1-02 etc

 

I should point out that we only tend to work in primary/first and middle schools so the most machines we have in each room is around 30.

 

In a lot of rooms there will only be a couple of machines so the ability to create the user on the server then visit each room once is our goal. Essentially RIS allowed us to do this really easily so we have tried to emulate this as closely as we could.

 

The only other way I can think around this to only visit once would be to add a command to the task sequence which queried the AD structure and prompted you to select the OU needed and provide a computer name, then automatically run the wdsutil command before kicking off the setup process. However that would require some coding and the solution we have at the moment is a lot easier than that.

[cookie_monster]

It seemed more straight forward with RIS/WDS legacy. F12 give machine a name, machine account appears in the default computers folder, move account to the correct OU, done.

[PiqueABoo]

MDT 2008 & I:

 

1) [uSB|PXE|CD] boot the WinPE on a computer.

2) Pick the task sequence to install the OS I want.

3) Type in computer name.

4) Pick the target OU form drop-down list.

5) Job done or will be by-and-by. Go to next computer.

 

MDT 2010 doesn't break that and makes various server-side bits better.

[mhundley]

 

4) Pick the target OU form drop-down list.

 

 

What do you use to achieve the list? is it dynamic or hard coded, I have seen a hard coded example but if it were dynamic would be very flexible as you would not have to change whenever you add OU's to AD

 

Any chance of being cheeky and seeing your files?

 

Cheers

 

Marc

[PiqueABoo]

if it were dynamic would be very flexible as you would not have to change whenever you add OU's to AD

 

It's not that easy to do dynamic and I decided it would be too much effort. The basic problem is that WinPE being that cut-down pre-installation environment does not include the APIs you need to talk to AD easily e.g. the kind of things you can do it in a relatively trivial VBS or JS in normal Windows won't work in regular PE.

 

So I pre-define the OUs in the bootstrap.ini default section e.g.

 

[Default]

DomainOUs1=OU=Administration, OU=Computers, DC=myDomain, DC=internal

DomainOUs2=OU=Curriculum, OU=Computers, DC=myDomain, DC=internal

etc.

 

With 2008 and earlier, to actually get a computer moved into the OU selected in the Lite Touch wizard I had to add this third-party script near the end of the task sequence:

 

Z-MoveComputer_HostOS.wsf

 

The hard-coding doesn't bother me, because I've scripted/automated pretty much everything required to turn a freshly installed Server into a fully configured, first DC with all the services I want completely configured the way I want them, standard file/share structure/permissions, OU structure, comprehensive GPOs, user and resource groups, and that MDT configuration in place.

 

As part of the automation I pick up my standard MDT configuration files, including task sequences, OS images and my latest greatest driver library, and drop them on top of a default MDT distribution point. I have a script replace the text strings like "myDomain" above with the relevant one for the system e.g. "StTrinians", and similarly to localise a couple of other files.

 

If you're planning on making more than a handful of systems then investing time automating as much of the config as possible like this is definitely worth the effort - makes commissioning so much quicker and most importantly, consistent.

Edited December 19, 2009 by PiqueABoo

[oxide54]

It seemed more straight forward with RIS/WDS legacy. F12 give machine a name, machine account appears in the default computers folder, move account to the correct OU, done.

 

i agree, we ghost a generic image ( press f12 is all you need to do ghost is automated ) and then give it a computer name at the end. if its a re-ghost then the computer is already in the right ou if not then we move it afterwards.

 

 

MDT just seems like a pain in the proverbial.

 

 

btw was on a training course recently and the instructor seemed to think you could feed drivers portion of MDT exe installers for drivers and it would take them, but then again he was telling people you can't virtualize DC's