Rolling out new computers

Morning all,

 

I'm just looking into the technology to roll out new workstations on mass and wondering how everyone else does it. Traditionally we have created a sys prepped image with Acronis and then rolled out using a USB stick. It works but is time consuming.

 

I have just looked at rolling out Windows 10 vanilla and then sending the applications via PDQ deploy, this works well but also takes a while and doesn't work with things like Visual Studio Community edition.

 

So how is everyone else doing it? Any new technology that I am not aware of come out recently with this?

create our image on the reference pc, sys prep and capture with mdt, Then import captured wim and pc drivers into wds and image, push software via bcx network management tools and gpo's

Download Win10 iso, extract wim, add to WDS, do everything else via a script

 

choco install visualstudio2019community

 

https://chocolatey.org/packages/visualstudio2019community

Sys prep shouldn't be needed anymore unless you want something very specific. You can download the Windows10 ISO and extract the WIM for version of windows you want to use. Then add this WIM to MDT and create a task sequence which installs windows and all the software you require. Can take a while to setup and add all applications with installation scripts but is worth it in the end. We now have one task sequence that does all of our machines. We can choose which software we want to install during PXE boot.

We still sysprep and capture a fat image and deploy via wds, we are a primary school with quite a lot of software, some of which is a pain to install. We have site licences for everything so only have to maintain 2 images, admin and curriculum.

I use MDT.

 

It sits over the top of WDS (and is free) and it deploys the OS and then all your apps afterwards, in it's default configuration

ADT / SCCM

or

AutoPilot/Intune

I use MDT.

 

It sits over the top of WDS (and is free) and it deploys the OS and then all your apps afterwards, in it's default configuration

 

We did a bit different at a previous place, we had a task sequence install OS and all the applications as build phase on a VM then capture the VM automatically at the end of the task sequence to the MDT server. The advantage being that there was very little deployment time at the expense of build time and getting the necesary MSIs/EXEs and the required switches (which changed on a yearly basis with some apps). We did have the option of pausing the build to install any awkward apps but rarely had to do that.

 

Deployment was much quicker with selection profiles for drivers and we regularly re-imaged IT rooms in around 40mins start to finish including packages like Visual Studio and Adobe CC. If there was an issue on a teaching PC and we did suspected the PC we could have it ready for use during a lunch break rather than the alternative of leaving it running for someone to disturb.

With half the apps having updates every month or so need a way to keep everything up to date as well

 

choco upgrade all

We use SCCM (which sits on top of WDS and we've integrated MDT). We haven't required sysprep since we implemented SCCM back in 2015 and migrated from Windows 7 to Windows 8.

We have an image which includes office 2016 and updates to the point the image was built. We Deploy this via SCCM and additional software is installed via the Task sequence depending on the needs of the user

How do you boot the workstations without a USB stick, for example imaging a whole room at once?

SCCM/WDS allows you to boot directly from the network

PXE network boot, press f12 or something while turning on computer

 

Network card then gets DHCP address, and your PXE server has added a config line in the DHCP server to say where to network boot from

You can also get the pxe boot iso from MDT, which can be burnt to cd or usb (not tried usb tbh) - I've used the iso with difficult nics

 

I've gone to thin images now, although I do edit the WIM beforehand to remove unwanted apps, and replace credprovhost.dll.mui with a custom one

How do you boot the workstations without a USB stick, for example imaging a whole room at once?

 

Network boot direct from WDS server, i.e. F12 on most PCs. Most PCs used in enterprise environments (HP, Dell, etc.) have this function from what I have found.

 

But sometimes it is possible to use a USB Ethernet dongle for devices without wired ethernet such as MS Surface, just need to get one with compatible chipset and get the drivers on the boot image.

Edited September 28, 2020 by Davit2005

Network boot from WDS server on the network.

 

Set a few details, build, come back next day to verify.

 

Don't know how years gone by we managed without this stuff now.

 

I'd mighty tempted just to do the same at home lol

Same here, WDS/MDT.

 

This is the first year we've not needed a fat image, everything is scripted that we need and have software collections for different rooms. e.g. Tick ICT for IT classrooms, Offices, Teacher PCs etc.

Given you have to create an on the fly install method to update existing machines, might as well use that for all machines.

Couple more questions:

 

How do you name the computers automatically?

How do you join the computers to the domain?

Is there any way to use different local admin passwords somehow? (we have a different password for each IT room)

Edited September 29, 2020 by supportman

You can preassign AD accounts based on MAC addresses. When we bought 150 laptops I had the mac address on the box scanned into a spreadsheet, name assigned from spreadsheet, sticker with name put on laptop. Spreadsheet created command to preassign mac<>name, and then when WDS ran it put the name in.

 

XML answer file specifies joining to domain.

 

You could script a local admin pw, or use GPO. But why do you have them?

Network boot from WDS server on the network.

 

Set a few details, build, come back next day to verify.

 

Don't know how years gone by we managed without this stuff now.

 

I'd mighty tempted just to do the same at home lol

 

I have got a MDT server at home, lol.

 

15 years ago when working as an ePos field engineer we had laptops we could boot tills from using tftpd32, considering some of the units we had to completely diss-assemble before re-imaging these were a god send and quicker than the old method of copying another till HDD (not to mention safer and no chance of getting the wrong disk imaged over, lol).

Edited September 29, 2020 by Davit2005

I create an image where its worth having some software on like Serif, which can take a while to install individually, then sysprep, mdt and pdq deploy for updates and other settings.

Couple more questions:

 

How do you name the computers automaitcally?

How do you join the computers to the domain?

Is there any way to use different local admin passwords somehow? (we have a different password for each IT room)

 

I use SCCM and these can be done:

 

How do you name the computers automaitcally?

This can be done by using variables in the Task Sequence. I don't have them to name them automatically, just before it deploys the OS, I go round each one, type the name and start the imaging process. This can be automated though: https://www.windows-noob.com/forums/topic/1133-setting-computername-during-deployment/#entry5374

 

How do you join the computers to the domain?

This is done in the Task Sequence, there's a specific step for joining the domain and specifying the AD credentials.

 

Is there any way to use different local admin passwords somehow? (we have a different password for each IT room)

We use Microsoft's LAPS for all local admin passwords. Though not different per room, every computer has it's own unique local admin password, which we can find by using the LAPS GUI, installed on our technician machines and domain controllers.

 

I believe the above can be done fairly easily in WDS too, if you don't want to purchase SCCM.

There is one thing I would recommend if you have SCCM or MDT joining computers to the domain is to setup a service account with delegated rights on a specific OU instead of a domain admin account.