Free ebook: Deploying Windows 10: Automating deployment by using System Center Configuration Manager

We’re happy to announce the release of our newest free ebook, Deploying Windows 10: Automating deployment by using System Center Configuration Manager (ISBN 9781509301867), by Andre Della Monica, Russ Rimmerman, Alessandro Cesarini, and Victor Silveira.

5282.9781509301867_6F8A5B58

This ebook is also available for download at the Microsoft Virtual Academy (MVA).

Get a head start deploying Windows 10—with tips and best practices from experts in the field. This guide shows you how to deploy Windows 10 in an automated way without impacting end users by leveraging System Center Configuration Manager, which is the most used product to deploy Microsoft operating systems in the industry today.

Important notice about certificate expiration for Exchange 2013 Hybrid customers

If you’re running Exchange 2013 and you’ve configured a hybrid deployment with Office 365, this post contains important information that might impact you. Please evaluate this information and take any necessary action before April 15, 2016.

On April 15 2016, the Office 365 TLS certificate will be renewed. This certificate is used by Office 365 to provide TLS encryption between Office 365 and external SMTP servers. The new certificate, which will help improve the security of mail sent to and from Office 365, will be issued by a new Certificate Authority and it will have a new Issuer and Subject.

This change has the potential to stop hybrid mailflow between Office 365 and your on-premises Exchange servers if one of the following conditions applies to you:

  • Your on-premises Exchange servers are running Exchange 2013 Cumulative Update 8 (CU8) or lower.
  • You’ve upgraded the Exchange 2013 servers that handle hybrid mailflow to Exchange 2013 CU9 or higher. However, since upgrading to CU9, you HAVE NOTre-run the Hybrid Configuration wizard (either from the Exchange Admin Center or via the direct download link).

If one of the previous conditions applies to your organization, hybrid mailflow between Office 365 and your organization will stop working after April 15, 2016unless you complete the steps below.

Note: This only affects hybrid mailflow. Regular mailflow and TLS encryption is NOT affected.

How to keep hybrid mail flowing (MUST be completed before 4/15/2016)
Let the new Hybrid Configuration wizard do it for you

You can use the latest Hybrid Configuration wizard (HCW) to configure your Exchange 2013 servers to work with the new TLS certificate. Just follow these steps:

  1. If the Exchange 2013 servers handling hybrid mailflow are running Exchange 2013 CU8 or lower, follow the instructions in Updates for Exchange 2013 to install the latest cumulative update on at least one server.
  2. After you install the latest cumulative update, download the new HCW application and run the wizard following the instructions here .

Note: For information on which releases of Exchange are supported with Office 365, see Hybrid deployment prerequisites.

Manual update

If you can’t upgrade Exchange 2013 to latest cumulative update right now (although we would like to remind you of our support policy), you can manually configure your servers to work with the new TLS certificate. On each Exchange 2013 server that’s used for hybrid mailflow, open the Exchange Management Shell, and run the following commands:

$rc=Get-ReceiveConnector |where {$_.TlsDomainCapabilities -like “*<I>*”}

Set-ReceiveConnector -Identity $rc.Identity -TlsDomainCapabilities “mail.protection.outlook.com:AcceptCloudServicesMail

http://blogs.technet.com/b/exchange/archive/2016/02/19/important-notice-about-certificate-expiration-for-exchange-2013-hybrid-customers.aspx

Download Office 2016 with Click-to-Run for Office 365 products by using the Office Deployment Tool

There are two different versions of the Office Deployment Tool available – one for Office 2013 and a different one for Office 2016. Each Office Deployment Tool works only with that specific version of Office. You can download them from the Microsoft Download Center by using the following links:

Configuration.xml

<Configuration>
  <Add SourcePath=”d:\2016\” OfficeClientEdition=”32″ Branch=”Current”>
    <Product ID=”O365ProPlusRetail”>
      <Language ID=”en-us” />
      <Language ID=”nl-nl” />
    </Product>
    <Product ID=”VisioProRetail”>
      <Language ID=”en-us” />
      <Language ID=”nl-nl” />
    </Product>
  </Add>

  <!–  <Updates Enabled=”TRUE” Branch=”Current” /> –>

  <Display Level=”Full” AcceptEULA=”TRUE” />
 
  <Logging Name=”OfficeSetup.txt” Path=”%temp%” />

  <Property Name=”AUTOACTIVATE” Value=”1″ />

</Configuration>

Download

D:\2016\setup.exe /download d:\2016\configuration.xml

Install / Configure Office 365 (2016)

D:\2016\setup.exe /configure d:\2016\configuration.xml

Source: https://technet.microsoft.com/en-us/library/jj219424.aspx

MDT 2013 Update 2 (6.3.8330) Released

The Microsoft Deployment Toolkit (MDT) 2013 Update 2 (6.3.8330) is now available on the Microsoft Download Center. This update requires the Windows Assessment and Deployment Kit (ADK) for Windows 10, available on the Microsoft Hardware Dev Center. (Note that there are known issues with the v1511 release of the Windows 10 ADK and System Center Configuration Manager; these issues do not directly affect MDT although may still impact ZTI or UDI scenarios.)

MDT 2013 Update 2 is primarily a quality release; there are no new major features. The following is a summary of the significant changes in this update:

  • Security- and cryptographic-related improvements:
    • Relaxed permissions on newly created deployment shares (still secure by default, but now also functional by default)
    • Creating deployment shares via Windows PowerShell adds same default permissions
    • Updated hash algorithm usage from SHA1 to SHA256
  • Includes the latest Configuration Manager task sequence binaries
  • Enhanced user experience for Windows 10 in-place upgrade task sequence
  • Enhanced split WIM functionality
  • Fixed OSDJoinAccount account usage in UDI scenario
  • Fixed issues with installation of Windows 10 language packs
  • Various accessibility improvements
  • Monitoring correctly displays progress for all scenarios including upgrade
  • Improvements to smsts.log verbosity

There are no other new release notes or significant known issues. See the previous post for more information as much of it is still applicable (other than the fix list above).

See the following post on How to get help with MDT.

Frequently Asked Questions

In anticipation of some questions that you may have about this release (or MDT in general):

Q: Should I expect a release of MDT with every new Windows 10 and/or Configuration Manager build release?

No. We shipped multiple MDT releases this year due to the timing of Windows 10 and Configuration Manager releases, but do not intend to keep that same cadence going forward.

Q: What branches of Windows 10 does MDT support?

MDT supports both the current branch of Windows 10 as well as the long-term servicing branch.

Q: What branches of System Center Configuration Manager does MDT support?

For ZTI and UDI scenarios MDT 2013 Update 2 supports the current branch of System Center Configuration Manager (currently version 1511) for an integrated solution for deploying Windows 10 current branch as well as prior Windows versions.

Q: When is the next planned release of MDT?

We do not currently have a timeframe. We will release any tactical changes as needed which may be required to support new builds of Windows 10 or Configuration Manager, but do not currently expect this to be needed.

Q: Is this the last release of MDT?

No, we will continue to iterate and invest in the product.

Q: Why is it still “MDT 2013” when the year is almost 2016?

Two primary reasons. First, we have only made minor changes to MDT which in our opinion does not constitute a major version revision. Second, per the MDT support lifecycle, a new major version will drop support for MDT2012 Update 1 which still supports legacy platforms.

Source

Skype for Business 2015 Planning Tool

The Skype for Business Team released Skype for Business 2015 Planning Tool. This tool asks you a series of questions about your organization and the features that you are interested in. The planning tool will then use your answers to recommend a topology based on the tested Skype for Business 2015 user model.
Your organization may have a different user model. If so, you should adjust the recommended topology as necessary to fit your organization’s needs.
What’s in the Planning Tool for Skype for Business 2015?

  • The Planning Tool now allow user to have up to 10 sites, including central site and disaster recovery site
  • The Planning Tool offers capacity guidance for Skype for Business Server 2015 new and updated features listed below.
  • You can answer the questions about these features in the Planning Tool, and then the suggested topology will contain information for those features, e.g hardware, network, DNS, certificate, IP, etc, according to the Skype for Business 2015 user model.
    • Persistent Chat
    • Archiving with Exchange integration
    • Mobility
    • Multi-view Video
    • SQL AlwaysOn
    • High Availability and Disaster Recovery
    • Office Web Apps
    • Exchange Mailbox
  • Skype for Business Server Planning Tool 2015 allows you to specify IPv6 IP addresses
  • Planning Tool identifies the IP conflicts across sites in the suggest topology. You can then choose to show or hide IP conflict in the topology
  • Planning Tool offers more user-friendly FQDN/IP/Port editing dialog
  • Planning Tool updates the suggested hardware requirements, DNS, and certificates with Skype for Business Server 2015 changes
  • Planning Tool updates the planning steps and deployment steps with Skype for Business Server 2015 changes
  • Planning Tool offers better support for accessibility requirements
  • Skype for Business Server Planning Tool 2015 offers improved export of Visio and Excel files. An exported Visio file matches the suggested topology diagram in the Planning Tool as well
  • Planning Tool no longer supports the following features:
    • Virtualized server design
    • Export the Planning Tool file to Topology Builder

Get it: https://www.microsoft.com/en-us/download/details.aspx?id=50357

Source

Windows 10 ADK update build 10586

The latest Windows 10 ADK update, build 10586, was silently released a few days ago (Thanks deploymentresearch for the download link). In this post you learn about what’s changed.

Download link: http://download.microsoft.com/download/3/8/B/38BBCA6A-ADC9-4245-BCD8-DAA136F63C8B/adk/adksetup.exe

Warning: Do NOT upgrade your ConfigMgr 2012 R2 SP1 or MDT 2013 Update 1 environments to this build yet. For ConfigMgr, even though it seems to fix the x64 UEFI / PXE and Powershell/.NET issue, which is great, the new ADK does break Computer Refresh scenarios (Bare metal works). The error code is 0x80220014. Research and discussions with the product teams in progress… MDT 2013 Update 1 yet to be validated, but error comments on twitter does not give me a warm and fuzzy feeling.

4fbe7042-d2fd-416e-a7b3-d3458a49aeec

MDT 2013 Update 1 error Dism 1726 (SSD Disk is to fast)

When you update your deployshare and you have the deploymentshare on a SSD disk. You wil get a this moment the following error

Error:

Deployment Image Servicing and Management tool
Version: 10.0.10240.16384
 
Image Version: 10.0.10240.16384
 
Processing 1 of 1 – Adding package WinPE-MDAC-Package~31bf3856ad364e35~amd64~~10.0.10240.16384
 
Error: 1726
 
The remote procedure call failed.
An error occurred closing a servicing component in the image.
Wait a few minutes and try running the command again.

Dism error

Workaround:

Disable Microsoft Data Access Components (MDAC/ADO Support)

MDAC ADO

Microsoft is investigate this problem.

Cumulative Update 10 for Exchange Server 2013

Exchange Team has released Cumulative Update 10 for Exchange Server 2013.

From the Microsoft Exchange Team blog:

The release includes fixes for customer reported issues, minor product enhancements and previously released security bulletins, including MS15-103.

Cumulative Update 10 does not include updates to Active Directory Schema, but does include additional RBAC definitions requiring PrepareAD to be executed prior to upgrading any servers to CU10. PrepareAD will run automatically during the first server upgrade if Setup detects this is required and the logged on user has sufficient permission.

The updates released today are important pre-requisites for customers with existing Exchange deployments who will deploy Exchange Server 2016.Cumulative Update 10 is the minimum version of Exchange Server 2013 which will co-exist with Exchange Server 2016.

For the full list of fixes check: KB3078678

Cumulative Update 10 is available for download here.

Rollup 11 for Exchange Server 2010 Service Pack 3

Exchange Team has released Update Rollup 11 for Exchange Server 2010 Service Pack 3.

From the Microsoft Exchange Team blog:

This release provides an important fix for an Information Store crash when customers are upgrading their Lync server infrastructure to Skype for Business.

Exchange Server 2010 Service Pack 3 Update Rollup 11, is the minimum version of Exchange Server 2010 which will be supported in a coexistence deployment with Exchange Server 2016.

Update Rollup 11 can be downloaded here.

MDT 2013 Update 1 re-released (build 8298)

MDT Team have released a newer build (8298) to address many of these issues. The Download Center is updated with the new build and is still considered MDT 2013 Update 1. Build 8290 is no longer available, no longer supported, and superseded by build 8298.

NOTE: it can take time for the files to fully propagate through the live downloads cluster, and to be refreshed on the Akamai caches. Please ensure the build version under Details is 8298. I have seen the updated page on a non-internal system; it’s there, just be patient. Use the time to review the release notes below!

The following issues are fixed in build 8298
  • Multiple drive partitioning issues are addressed by significant revisions to the Format and Partition Disk step (see release note below), including:
    • Upgrading to MDT 2013 Update 1 does not work for UEFI systems
    • An extra unneeded partition is created on both UEFI and BIOS systems
    • You cannot specify a custom partition layout containing a “Recovery”-type partition needed for UEFI systems
    • LTIApply error, “There is not enough space on the disk”
    • WINRE_DRIVE_SIZE from ZTIDiskpart.wsf is Too Small
  • Multiple issues related to XML processing:
    • Application bundles returning error 87
    • Selecting a keyboard locale in the Deployment Wizard
    • Deployments failing due to Unattend.xml errors
    • ZTIPatches returning error “Object required (424)”
    • Cleanup after image capture doesn’t remove LTIBootstrap entry
  • Several issues with the Windows 10 in-place upgrade task sequence including:
    • The upgrade process ends with warnings “Unable to create WebService class”
    • The upgrade task sequence is available from Windows PE
    • After upgrade a System_License_Violation blue screen appears
  • Applications that use a command file start using System32 as the working directory
  • Spanned images cannot be applied

Below are the revised release notes and list of known issues. These inclusive lists supersede the previously published lists. New entries are marked with an asterisk (*).

Release Notes

TechNet documentation is not updated

The MDT product documentation published on TechNet is current as of MDT 2013; it has not yet been updated for MDT 2013 Update 1.

Do not upgrade from Preview to RTM

MDT 2013 Update 1 Preview should be uninstalled before installing the final MDT 2013 Update 1. Do not attempt to upgrade a preview installation or deployment share. Although the product documentation is not updated for MDT 2013 Update 1, the information on upgrading an installation still holds true.

Windows System Image Manager will fail to validate MDT Unattend.xml templates

The Windows System Image Manager (WSIM, a component of the Windows ADK used to create and modify unattended installation answer files) does not allow blank values which exist in the default MDT Unattend.xml templates. When using WSIM option, Validate Answer File, it will return validation errors, such as “The ‘HorizontalResolution’ element is invalid – The value ” is invalid according to its datatype ‘HorizontalResolutionType’ – The string ” is not a valid UInt32 value.”

MDT removes blank values before injecting the file during deployment, so Windows always receives a valid XML answer file.

Integrating with System Center Configuration Manager

When integrating MDT with Configuration Manager, follow the version of the Windows ADK. MDT 2013 Update 1 only works with the Windows 10 ADK, so make sure it is used with a version of Configuration Manager that supports and also uses the Windows 10 ADK.

Image files larger than 4 GB are not split by default

Split image (.SWM) support is now off by default. It must be enabled by modifying %DeployRoot%\Control\Settings.xml with the following:

<SkipWimSplit>False</SkipWimSplit>

Using HideShell with Windows 10

The behavior of the HideShell option changed with Windows 10. Michael Niehaus explains this in great detail on his blog.

Changes to the Format and Partition Disk step *

The Format and Partition Disk step in the task sequence is now more closely aligned with the similar step in Configuration Manager; it will explicitly show all of the partitions that are created when the task sequence runs.

  • Backwards compatibility remains when using a task sequence that was created in a prior version of MDT. You should expect the same behavior as previously.
  • The DoNotCreateExtraPartition variable is deprecated. It should not be used with new task sequences (as the partitions are explicitly created by the task sequence step).
Changes to permissions of new deployment shares *

New deployment shares will now be created with more restrictive permissions. You should review these permissions and adjust accordingly for your access requirements.

Upgraded deployment shares are not modified, but the former default permissions are overly permissive. You should review the permissions on the share and directory and adjust accordingly for your environment.

MDT Known Issues

Static IP not restored when using media deployment

When doing a media deployment and using a static IP the static IP does not get restored.

Workarounds:

  • Modify Litetouch.wsf to enable MEDIA deployments (Keith Garner explains in this forum post)
    or
  • Add an extra Apply Network Settings action (alternative suggested by Johan Arwidmark on his blog)
Static IP not set in Network Adapter Configuration Wizard

When initializing a deployment in Windows PE and clicking Configure Static IP Address, if you uncheck Enable DHCP and enter static IP information, the following Network Settings Error will display:

WMI Function: Adapter.EnableStatic(IPAddress,SubnetMask) FAILURE: -2147467259

This warning may also be seen in the results screen and log files during a deployment.

Workaround: a static IP can be manually set from Windows PE using netsh, but otherwise there are no workarounds at this time.

UDI wizard does not handle the domain join account user name *

When using the OSDJoinAccount variable in CustomSettings.ini for a UDI task sequence, the wizard cannot be completed because the domain join account user name is encoded. The New Computer Details page will display an error, “User name format is invalid. Example is domain\user.”

Workarounds:

  • Specify the OSDJoinAccount variable in the task sequence before the UDI wizard starts.
  • Alternatively, require the user to manually specify credentials in the UDI wizard.
Unable to browse for user data path *

In the LTI Deployment Wizard, on the User Data page, when selecting the Browse button, the Browse for Folder window does not display anything for selecting a path.

Workarounds:

  • Manually enter the path (do not browse).
  • Set the UserDataLocation variable in CustomSettings.ini.
The ZTIWinRE.wsf script and PrepareWinRE variable do not function properly *

If you specify PrepareWinRE=YES in CustomSettings.ini, Windows RE does not get enabled because the commandline is malformed.

The ZTIWinRE.wsf script is deprecated and should not be used.

Windows 10 language packs may not install *

We are still investigating an issue where Windows 10 language packs may not install during LTI.

Issues after successful Windows 10 in-place upgrade *

Following a successful upgrade to Windows 10:

  • Monitoring will continue to show the task sequence in progress until a user logs on.
  • A low rights user may receive an error at logon. This is a non-fatal error; the MDT script requires administrator elevation in order to display the final summary screen. Avoid this by using the variable, SkipFinalSummary.

Windows 10 Known Issues

The following are issues that are known to the MDT product team when doing Windows 10 deployments.

Issues with CopyProfile *

We are aware of reports of issues regarding the CopyProfile property in Unattend.xml. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with CopyProfile, please open a case with Microsoft Support to troubleshoot.

USMT LoadState fails on Windows 7 *

Using MDT 2013 Update 1 to deploy Windows 7 to an existing machine (refresh scenario), and using USMT 10 to capture and restore the user data will result in an error (“DismApi.DLL is missing”) while restoring the user state on Windows 7. This is a known issue with loadstate; see https://support.microsoft.com/kb/3084782 for more information.

MDAC component fails being added to Windows PE

This is a known bug with DISM; it is external to MDT. DISM can sometimes fail to add the MDAC component to WinPE boot images. This seems to be a timing issue which most commonly occur when you are using SSD disks.

Workarounds:

  • Remove MDAC. On the deployment share properties, Windows PE tab, Features subtab, uncheck Microsoft Data Access Components (MDAC/ADO) support.
  • If you need MDAC for database connectivity, you can try updating your boot images from a system where the %TMP% directory is located on a non-SSD drive. This is not a guaranteed workaround, but has been seen to work

NOTE: we are also aware of reports of issues regarding the WMI component in Windows PE. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.

Issues with Windows PowerShell in Windows PE

Windows PowerShell cmdlets in Windows PE may not function as expected. We are investigating this issue with the Windows team. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.