VMware Horizon 7.3.1 and Horizon Client 4.6 released

VMware has released VMware Horizon 7.3.1 and Horizon Client 4.6! With this new release, Horizon 7.3 enhances key platform features, including Horizon Virtualization Pack for Skype for Business, VMware Instant Clone Technology and the Horizon Help Desk Tool.

Many new items have been introduced, such as HTML5 video redirection support for the Chrome browser and the ability to configure Windows Start menu shortcuts for desktop and application pools using the Horizon Administrator console. As always, you can count on increased operating system support for virtual desktops and clients.

Here is an overview of the new features:

VMware Horizon 7.3 Server Enhancements

Horizon Help Desk Tool

  • Displays application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Displays Horizon Client information
  • Granular logon time metrics
  • Blast Extreme display protocol metrics

Instant Clone Technology

  • Instant-clone desktops can now use dedicated assignment to preserve the hostname, IP address and MAC address of a user’s desktop
  • Windows Server OS is now supported for desktop use
  • Instant clones are now compatible with Storage DRS (sDRS)
  • If there are no internal VMs in all four internal folders created in vSphere Web Client, these folders are unprotected, and you can delete them
  • IcUnprotect.cmd utility can now unprotect or delete template, replica or parent VMs or folders from vSphere hosts

Windows Start Menu Shortcuts Created Using the Admin Console

  • Create shortcuts to Horizon 7 resources:
    • Published applications
    • Desktops
    • Global entitlements

Cloud Pod Architecture Scale

  • Total session limit is increased to 140,000
  • The site limit is now seven

VMware Horizon Apps

  • This update makes Horizon Apps easier to use and allows the administrator to restrict entitlements
  • Restrict access to desktop and application pools from specific client machines

Resiliency for Monitoring

  • If the event database shuts down, Horizon administrator maintains an audit trail of the events that occur before and after the event database shutdown

Database Support

  • Always-On Availability Groups feature for Microsoft SQL Server 2014

ADMX Templates

  • Additional GPO settings for ThinPrint printer filtering, HTML5 redirection and enforcement of desktop wallpaper settings

Remote Experience

Horizon Virtualization Pack for Skype for Business

  • Multiparty audio and video conferencing
  • Horizon 7 RDSH support
    • Windows Server 2008 R2
    • Windows Server 2012 R2
  • Forward Error Correction (FEC)
  • Quality of Experience (QOE) metrics
  • Customized ringtones
  • Call park and pickup
  • E911 (Enhanced 911) support, to allow the location of the mobile caller to be known to the call receiver
  • USB desktop-tethering support
  • Horizon Client for Linux support for the following Linux distributions:
    • Ubuntu 12.04 (32-bit)
    • Ubuntu 14.04 (32 & 64-bit)
    • Ubuntu 16.04 (64-bit)
    • RHEL 6.9/CentOS 6.x (64-bit)
    • RHEL 7.3 (64-bit)
    • SLED12 SP2 (64-bit)

Additional NVIDIA GRID vGPU Support

  • Support for the Tesla P40 graphics card from NVIDIA

HTML5 Video Redirection

  • View HTML 5 video from a Chrome browser and have video redirected to the client endpoint for smoother and more efficient video playback

Performance Counter Improvements

  • Windows agent PerfMon counters improvements for Blast Extreme sessions: imaging, audio, client-drive redirection (CDR), USB and virtual printing

Linux Virtual Desktops

  • KDE support: Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04 and SUSE Linux Enterprise Desktop 11 SP4
  • MATE  interface is now supported on Ubuntu 14.04 and Ubuntu 16.04
  • Blast Extreme Adaptive Transport is now supported for Linux desktops
  • vGPU hardware H.264 encoder support has been added

USB Redirection

  • USB redirection is supported in nested mode

ThinPrint Filtering

  • Administrators can filter out printers that should not be redirected

Horizon Client 4.6 Updates

Security Update

  • All clients have been updated to use SHA-2 to prevent SHA-1 collision attacks

Session Pre-launch

  • Session pre-launch is now extended to both Horizon Client for macOS and Horizon Client for Windows

Apteligent

  • Integration of Apteligent crash log

Blast Extreme

  • Improvements in Blast Extreme Adaptive Transport mode for iOS and macOS
  • User can change Blast Extreme settings without having to disconnect

Horizon Client 4.6 for Windows

  • Support for UNC path with CDR

Horizon Client 4.6 for macOS

  • Support for macOS Sierra and macOS High Sierra
  • Selective monitor support
  • Norwegian keyboard support

Horizon Client 4.6 for iOS

  • CDR support with drag and drop of files in split view
  • iOS split keyboard enhancement
  • iOS UI updates

Horizon Client 4.6 for Android

  • Android Oreo support
  • Manage the Horizon server list with VMware AirWatch
  • Simple shortcuts
  • External mouse enhancements
  • Real-Time Audio-Video (RTAV) support for Android and Chrome OS

Horizon Client 4.6 for Linux

  • Blast Extreme Adaptive Transport support

Horizon Client 4.6 for Windows 10 UWP

  • Network recovery improvements

Horizon HTML Access 4.6

  • HTML Access for Android with a revised UI
  • Customization of HTML Access page

Horizon Help Desk Tool

The Horizon Help Desk Tool provides a troubleshooting interface for the help desk that is installed by default on Connection Servers. To access the Horizon Help Desk Tool, navigate to https://<CS_FQDN>/helpdesk, where <CS_FQDN> is the fully qualified domain name of the Connection Server, or click the Help Desk button in the Horizon Administrator console.

The Help Desk Tool was introduced in Horizon 7.2 and has been greatly expanded upon in the Horizon 7.3 release.

Help Desktop Tool features with Horizon 7.2:

  • Virtual machine metrics
  • Remote assistance
  • Session control (restart, logoff, reset, and disconnect)
  • Sending messages

Additional features with Horizon 7.3:

  • Display application process resources with reset control
  • Role-based access control for help desk staff
  • Activity logging for help desk staff
  • Granular login time metrics
  • Display Horizon Client information

User Session Details

The user session details appear on the Details tab when you click a user name in the Computer Name option on the Sessions tab. You can view details for Horizon Client, the VDI desktop or RDSH-published desktop, CPU and memory stats, and many other details.

  • Client version
  • Unified Access Gateway name and IP address
  • Logon breakdown (client to broker):
    • Brokering
    • GPO load
    • Profile load
    • Interactive
    • Authentication

Blast Extreme Metrics

Blast extreme metrics that have been added include estimated bandwidth (uplink), packet loss, and transmitted and received traffic counters for imaging, audio, and CDR.

Note the following behavior:

  • The text-based counters do not auto-update in the dashboard. Close and reopen the session details to refresh the information.
  • The counters for transmitted and received traffic counters are accumulative from the point the session is queried/polled.

Blast Extreme Metrics for a Windows 10 Virtual Desktop Session

Display and Reset Application Processes and Resources

This new feature provides help desk staff with a granular option to resolve problematic processes without affecting the entire user session, similar to Windows Task Manager. The session processes appear on the Processes tab when you click a user name in the Computer Name option on the Sessions tab. For each user session, you can view additional details about CPU- and memory-related processes to diagnose issues.

Role-based Access Control and Custom Roles

You can assign the following predefined administrator roles to Horizon Help Desk Tool administrators to delegate the troubleshooting tasks between administrator users:

  • Help Desk Administrator
  • Help Desk Administrator (Read Only)

You can also create custom roles by assigning the Manage Help Desk (Read Only) privilege along with any other privileges based on the Help Desk Administrator role or Help Desk Administrator (Read Only) role.

Members of the Help Desk Administrators (Read Only) role do not have access to following controls; in fact, functions such as Log Off and Reset are not presented in the user interface.

Watch this brief demonstration video of the Horizon Help Desk Tool to see it in action:

Horizon Virtualization Pack for Skype for Business

You can now make optimized audio and video calls with Skype for Business inside a virtual desktop without negatively affecting the virtual infrastructure and overloading the network.

All media processing takes place on the client machine instead of in the virtual desktop during a Skype audio and video call.

New support with many expanded features for the Horizon Virtualization Pack for Skype for Business can be found in Horizon 7.3 and Client 4.6.

New Features

Horizon Virtualization Pack for Skype for Business offers the following supported features:

System Requirements

The following table outlines the system requirements for the new release:

Supported Clients

The following table provides the list of support Horizon clients:

Start Menu Shortcuts Configured Through the Admin Console

This feature improves the user experience by adding desktop and application shortcuts to the Start menu of Windows client devices.

You can use Horizon Administrator to create shortcuts for the following types of Horizon 7 resources:

  • Published applications
  • Desktops
  • Global entitlements

Shortcuts appear in the Windows Start menu and are configured by IT. Shortcuts can be categorized into folders.

Users can choose at login whether to have shortcuts added to the Start menu on their Windows endpoint device.

Watch this brief demonstration video of the new Desktop and Apps Shortcuts feature to see it in action:

Dedicated Desktop Support for Instant Clones

Upon the initial release of instant clones in Horizon 7, we supported floating desktop pools and assignments only. Further investments have been made to Instant Clone Technology that add support for dedicated desktop pools. Fixed assignments and entitlements of users to instant-clone machines is now provided as part of Horizon 7.3.

Dedicated instant-clone desktop assignment means that there is a 1:1 relationship between users and desktops. Once an end user is assigned to a desktop, they will consistently receive access to the same desktop and corresponding virtual machine. This feature is important for apps that require a consistent hostname, IP address, or MAC address to function properly.

Note: Persistent disks are not supported. Fixed assignments to desktops does not mean persistence for changes. Any changes that the user makes to the desktop while in-session will not be preserved after logoff, which is similar to how a floating desktop pool works. With dedicated assignment, when the user logs out, a resync operation on the master image retains the VM name, IP address, and MAC address.

Support for the Tesla P40 Graphics Card from NVIDIA

VMware has expanded NVIDIA GRID support with Tesla P40 GPU cards in Horizon 7.3.

HTML5 Video Redirection

This feature provides the ability to take the HTML5 video from a Chrome (version 58 or higher) browser inside a Windows VDI or RDSH system and redirect it to Windows clients. This feature uses Blast Extreme or PCoIP side channels along with a Chrome extension.

The redirected video is overlaid on the client and is enabled as well as managed using GPO settings.

Benefits include:

  • Supports generic sites such as YouTube, without requiring a server-side plugin.
  • Provides smooth video playback comparable to the native experience of playing video inside a browser on the local client system.
  • Reduces data center network traffic and CPU utilization on the vSphere infrastructure hosts.

Improved USB Redirection with User Environment Manager

The default User Environment Manager timeout value has been increased. This change ensures that the USB redirection Smart Policy takes effect even when the login process takes longer than expected.

With Horizon Client 4.6, the User Environment Manager timeout value is configured only on the agent and is sent from the agent to the client.

You can now bypass User Environment Manager control of USB redirection by setting a registry key on the agent machine (VDI desktop or RDSH server). This change ensures that smart card SSO works on Teradici zero clients. Note: Requires a restart.

HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB uemFlags (REG_DWORD 1)

Blast Extreme Performance Counter Improvements

The Windows Agent PerfMon counters for the Blast Extreme protocol have been improved to update at a constant rate and to be even more accurate.

Counters include:

  • Imaging
  • Audio
  • CDR
  • USB
  • Virtual printing

Linux Virtual Desktops

Features and functions for Horizon 7 for Linux virtual desktops have been expanded:

  • KDE support – Besides RHEL/CentOS 6.x, the KDE GUI is now supported on RHEL/CentOS 7.x, Ubuntu 14.04/16.04, SUSE Linux Enterprise Desktop 11 SP4.
  • Support for the MATE interface on Ubuntu 14.04, Ubuntu 16.04.
  • Blast Extreme Adaptive Transport support.
  • vGPU hardware H.264 encoder support.

USB Redirection Support in Nested Mode

The USB redirection feature is now supported when you use Horizon Client in nested mode. When using nesting–for example, when opening RDSH applications from a VDI desktop–you can now redirect USB devices from the client device to the first virtualization layer and then redirect the same USB device to the second virtualization layer (that is, nested session).

Filtering Redirected Printers

You can now create a filter to specify the printers that should not be redirected with ThinPrint. A new GPO ADMX template (vmd_printing_agent.admx) has been added to enable this functionality.

By default, the rule permits all client printers to be redirected.

  • Supported attributes:
    • PrinterName
    • DriverName
    • VendorName
  • Supported operators:
    • AND
    • OR
    • NOT
  • Supported searching pattern is a regular expression.

Blast Extreme Improvements in CPU Usage

Now even lower CPU usage is achieved with adaptive Forward Error Correction algorithms. This clever mechanism decides how to handle error correction, lowering CPU usage within virtual desktop machines as well as on client endpoint devices.

Blast Extreme Adaptive Transport Side Channel

New support has been added for Blast Extreme Adaptive Transport side channels for USB and CDR communications. Once enabled, TCP port 32111 for USB traffic does not need to be opened, and USB traffic uses a side channel. This feature is supported for both virtual desktops and RDS hosts.

  • Feature is turned off by default.
  • Enable the feature through a registry key: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config\UdpAuxiliaryFlowsEnabled 1

Entitlement Restrictions Based on Machine Name

This feature allows IT administrators to restrict access to published applications and desktops based on both client computer and user. With client restrictions for RDSH, it is now possible to check AD security groups for specific computer names. Users only have access to desktops and apps when both the user and the client machine are entitled. For this release, the feature is supported only for Windows clients and works with global entitlements.

Pre-Launch Improvements

Pre-launch provides the ability to launch an empty (application-less) session when connecting to the Connection Server. The feature is now also available to Windows clients, in addition to macOS.

Also, it is no longer necessary to manually make changes to the client settings. You can configure automatic reconnection.

Blast Extreme Adaptive Transport Mode for iOS and macOS

With prior client releases, users were required to configure their Blast Extreme settings before they connected to the Connection Server. After a connection was established, the options to change the Blast Extreme setting—which included H.264, Poor, Typical, and Excellent—were unavailable.

With this release, users can change the network condition setting from Excellent to Typical or the reverse while inflight to sessions. Doing so also changes the protocol connection type between TCP (for Excellent) and UDP (for Typical).

Note: End users will not be able to change the network condition setting if Poor is selected before establishing a session connection.

Horizon Client for Windows

Horizon Client 4.6 updates include:

  • Additional command-line options for the new client installer – When silently installing the Windows client, using the /s flag, you can now also set:
    • REMOVE-SerialPort,Scanner – Removes the serial port, scanner, or both.
    • DESKTOP_SHORTCUT-0 – Installs without a desktop shortcut.
    • STARTMENU_SHORTCUT-0 – Installs without a Start menu shortcut.

  • Support for UNC paths with client drive redirection (CDR):
    • Allows remote applications to access files from a network location on the client machine. Each location gets its own drive letter inside the remote application or VDI desktop.
    • Folders residing on UNC paths can now be redirected with CDR, and get their own drive letter inside the session, just as any other shared folder.

Horizon Client for macOS

Horizon Client 4.6 updates include:

  • Apple macOS High Sierra day 0 support.
  • Users can select which monitors to use for VDI sessions and which to use for the local system.
  • Norwegian keyboard support and mappings are now available

Horizon Client for iOS

Horizon Client 4.6 updates include:

  • iOS 11 support
  • iOS split keyboard update – Removes the middle area in the split keyboard for a better view of the desktop
  • New dialog box for easy connection to a Swiftpoint Mouse

Horizon Client for Android

Horizon Client 4.6 updates include:

  • Android 8.0 Oreo support.
  • Server URL configuration – Allows administrators to configure a list of Connection Servers and a default Connection Server on Android devices managed by VMware AirWatch.

Android and Chrome OS Client Updates

Horizon Client 4.6 for Android and Horizon Client 4.6 for Chrome OS updates include:

  • Simple shortcuts – Users can right-click any application or desktop to add a shortcut to the home screen.
  • Webcam redirection – Integrated webcams on an Android device or a Chromebook are now available for redirection using the Real-Time Audio-Video (RTAV) feature.

HTML Access

HTML Access 4.6 updates include:

  • HTML Access on Android devices – Though HTML Access has fewer features than the native Horizon Client, it allows you to use remote desktops and published applications without installing software.
  • HTML Access page customization – Administrators can customize graphics and text and have those customizations persist through future upgrades.

Horizon Client for Linux

Horizon Client 4.6 updates include:

  • Support for Raspberry Pi 3 Model B devices:
    • ThinLinx operating system (TLXOS) or Stratodesk NoTouch operating system
    • Supported Horizon Client features include:
  • Blast Extreme
  • USB redirection
  • 264 decoding
  • 8000Hz and 16000Hz audio-in sample rate
  • RHEL/CentOS 7.4 support

Horizon Client for Windows 10 UWP

Horizon Client 4.6 updates include:

  • Network recovery improvements – Clients can recover from temporary network loss (up to 2 minutes). This feature was already available for Windows, macOS, Linux, iOS, and Android, and is now available for Windows 10 UWP.
    • Automatically reconnects Blast Extreme sessions
    • Reduces re-authentication prompts

We are excited about these new features in Horizon 7.3.1 and the Horizon Client 4.6.  We hope that you will give them a try.

You can download it here.

IIS Crypto the best tool to configure SSL/TLS cipher suites

IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2008, 2012 and 2016. It also lets you reorder SSL/TLS cipher suites offered by IIS, implement best practices with a single click, create custom templates and test your website.

Features

– Single click to secure your website using best practices
– Create custom templates that can be saved and run on multiple servers
– Stop DROWN, logjam, FREAK, POODLE and BEAST attacks
– Disable weak protocols and ciphers such as SSL 2.0, 3.0 and MD5
– Enable TLS 1.1 and 1.2
– Enable forward secrecy
– Reorder cipher suites
– Built in Best Practices, PCI, PCI 3.1 and FIPS 140-2 templates
– Site scanner to test your configuration
– Command line version

Screenshot1

Windows 10 1607 Windows Update Change

For those of you who have started deploying Windows 10 1607, you might notice a change in the behavior of the Windows Update agent for PCs that are configured to pull updates from WSUS.  Instead of pulling the updates from WSUS, PCs may start grabbing them from peers on your network, leveraging the Delivery Optimization service for referrals to other PCs that have already obtained the content.  This change should generally help reduce the amount of network traffic being generated for both quality (monthly) updates and feature updates, offloading that traffic from the WSUS server.  It will add some additional traffic between each client PC and the Delivery Optimization service on the internet, as it has to talk to this internet-only service in order to get a list of peers.

If the Windows Update agent can’t talk to the Delivery Optimization service (due to firewall or proxy configurations), or if there are no peers able to provide the content, it will then go ahead and grab the content from the WSUS server.

There is a new Group Policy setting available if you want to disable this behavior, e.g. because you are already using BranchCache for peer-to-peer sharing.  To do this, you need to set the “Download Mode” policy under “Computer Configuration –> Administrative Templates –> Windows Components –> Delivery Optimization” to specify “Bypass” mode, which will result in the client always using BITS to transfer the content from WSUS (with BranchCache jumping in to provide the peer-to-peer capabilities through its integration with BITS):

image291

Of course to set this policy, you need the latest ADMX files, which can be downloaded from https://www.microsoft.com/en-us/download/details.aspx?id=53430 and are also included in Windows 10 1607 and Windows Server 2016.  (The “Bypass” setting wasn’t available in previous versions.)  See https://support.microsoft.com/en-us/kb/3087759 for details on how to update the Group Policy central store with these latest ADMX files, if you are using a central store.

Source: https://blogs.technet.microsoft.com/mniehaus/2016/08/08/using-wsus-with-windows-10-1607/

MDT 2013 Update 2 Automatically move computers to the right OU.

On December 2010 i wrote an article: automatically move computers to the right OU.
In MDT 2012 update 1 this was an issue: MDT 2012 settings per task sequence

In MDT 2013 Update 2 this is still a issue:

How to fix:

I changed DeployWiz_SelectTS.vbs file and it work again Glimlach

1. Edit DeployWiz_SelectTS.vbs
2. Add after “Dim sTemplate”
Dim sCmd
Set Oshell = createObject(“Wscript.shell”)
3. Add before “End Function” (bottom of page)
sCmd = “wscript.exe “”” & oUtility.ScriptDir & “\ZTIGather.wsf”””
oItem = oSHell.Run(sCmd, , true)

Download DeployWiz_SelectTSMDT2013Update2.7z

Don’t forget to change every TaskSequence

clip_image002

Setup MDT 2013 (Update 2) to encrypt Windows 10 devices (Laptops) automaticlly

This  will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment:

  • A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password.
  • To configure your environment for BitLocker, you will need to do the following:
  1. Configure Active Directory for BitLocker.
  2. Download the various BitLocker scripts and tools.
  3. Configure the rules (CustomSettings.ini) for BitLocker.

Configure Active Directory for BitLocker

To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory.

Note
Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.

In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.

figure 2

Figure 2. The BitLocker Recovery information on a computer object in the contoso.com domain.

Add the BitLocker Drive Encryption Administration Utilities

The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell):

  1. On DC01, log on as CONTOSO\Administrator, and, using Server Manager, click Add roles and features.
  2. On the Before you begin page, click Next.
  3. On the Select installation type page, select Role-based or feature-based installation, and click Next.
  4. On the Select destination server page, select DC01.contoso.com and click Next.
  5. On the Select server roles page, click Next.
  6. On the Select features page, expand Remote Server Administration Tools, expand Feature Administration Tools, select the following features, and then click Next:
    1. BitLocker Drive Encryption Administration Utilities
    2. BitLocker Drive Encryption Tools
    3. BitLocker Recovery Password Viewer
  7. On the Confirm installation selections page, click Install and then click Close.

figure 3

Figure 3. Selecting the BitLocker Drive Encryption Administration Utilities.

Create the BitLocker Group Policy

Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile.

  1. On DC01, using Group Policy Management, right-click the Contoso organizational unit (OU), and select Create a GPO in this domain, and Link it here.
  2. Assign the name BitLocker Policy to the new Group Policy.
  3. Expand the Contoso OU, right-click the BitLocker Policy, and select Edit. Configure the following policy settings:

    Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives

    1. Enable the Choose how BitLocker-protected operating system drives can be recovered policy, and configure the following settings:
      1. Allow data recovery agent (default)
      2. Save BitLocker recovery information to Active Directory Domain Services (default)
      3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives (Do Not Enable This Winking smile)
    2. Enable the Configure TPM platform validation profile for BIOS-based firmware configurations policy.
    3. Enable the Configure TPM platform validation profile for native UEFI firmware configurations policy.

      Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services

    4. Enable the Turn on TPM backup to Active Directory Domain Services policy.

(Don’t forget to disable Secure Boot & Enable the secure boot again after deployment is succes vol!!)

Set permissions in Active Directory for BitLocker

In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the Add-TPMSelfWriteACE.vbs script from Microsoft to C:\Setup\Scripts on DC01.

  1. On DC01, start an elevated PowerShell prompt (run as Administrator).
  2. Configure the permissions by running the following command:
    cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs
    

figure 4

Figure 4. Running the Add-TPMSelfWriteACE.vbs script on DC01.

Add BIOS configuration tools from Dell, HP, and Lenovo

If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper.

Add tools from Dell

The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool:

cctk.exe --tpm=on --valsetuppwd=Password1234
Add tools from HP

The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool:

BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234

And the sample content of the TPMEnable.REPSET file:

English
Activate Embedded Security On Next Boot
*Enable
Embedded Security Activation Policy
*No prompts
F1 to Boot
Allow user to reject
Embedded Security Device Availability
*Available
Add tools from Lenovo

The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools:

cscript.exe SetConfig.vbs SecurityChip Active

CustomSettings.ini

[Default]
SkipBitLocker=YES

[LAPTOP]
TaskSequenceID=LAPTOP
MachineObjectOU=OU=Bitlocker,OU=LAPTOPS,OU=Clients,DC=wardvissers,DC=local
BDEKeyLocation=\\mdt01.wardvissers.local\Bitlocker$

Source

New Training Platform: Learn @ KEMP

Ward Vissers Blogging About Microsoft Exchange VMware and other interresting things about ICT

Your gateway to becoming proficient in all things KEMP is here! We have recently launched our Learn @ KEMP Training Portal, making it easy for you to:

• Learn about KEMP’s Series of Load Balancers.
• Get certified at all levels ranging from Sales to Advanced Technical Training.
• Explore our wealth of resources, from our “Expert Series” webinars to detailed configuration templates.
• Engage with Support & Sales through chat, community forums, blogs, social media or just regular email.

Start your learning journey today! Register for Learn @ KEMP

Once you achieve certification at any level, you will see your Badge Status update in real time, and have access to your certificate in the “My Account” section. Moreover, you can share the news of you becoming KEMP certified on LinkedIn, Facebook, Twitter etc.

Learn at KEMP Training

If you are supporting, designing, implementing, configuring or managing a KEMP LoadMaster load balancer, consider making the KEMP Certified Engineer (KCE) your immediate certification goal.

However, if you are in sales and need to know just the basics you should aim to complete our Essentials training course and achieve your KEMP Certified Salesperson badge and certificate.

For the best learning experience, the Learn at KEMP training is structured so that you complete each course level and achieve your certifications, starting off with Essentials, before you move on to the next level.

Could you be one of the select few to achieve the GOLD standard of KEMP Certified Master?

RVTools version 3.8 is now available

RVTools is a windows .NET 2.0 application which uses the VI SDK to display information about your virtual machines and ESX hosts. Interacting with VirtualCenter. RVTools is able to list information about VMs, CPU, Memory, Disks, Partitions, Network, Floppy drives, CD drives, Snapshots, VMware tools, Resource pools, Clusters, ESX hosts, HBAs, Nics, Switches, Ports, Distributed Switches, Distributed Ports, Service consoles, VM Kernels, Datastores, Multipath info and health checks. With RVTools you can disconnect the cd-rom or floppy drives from the virtual machines and RVTools is able to update the VMware Tools installed inside each virtual machine to the latest version.
rvtools_small.jpg
Version 3.8 (March, 2016)

  • VI SDK reference changed from 5.5 to 6.0
  • on vInfo tab page new field: ChangeVersion unique identifier for a given version of the configuration
  • on vInfo tab page new field: HA VM Monitoring status
  • on vInfo tab page new fields: Number of supported monitors and Video RAM in KB.
  • on vInfo tab page new field: Config status.
  • Config issues are visible on the vHealth tab page
  • on vInfo tab page new field: OS according to the VMware Tools
  • on vTools tab page new fields: App state, App heartbeat status and Kernel crash state
  • on vTools tab page new fields: Operations availability, State change support and
  • Interactive Guest Operations availability
  • on vHost tab page new field: NTPD running state.
  • NTP issues are visible on the vHealth tab page
  • on vHost tab page new field: Config status.
  • Config issues are visible on the vHealth tab page
  • on vCluster tab page new field: Config status.
  • Config issues are visible on the vHealth tab page
  • on vDatastore tab page new field: Config status.
  • Config issues are visible on the vHealth tab page
  • on vSC+VMK tab page new fields: IP 6 Address and IP 6 Gateway
  • all VM related tab pages now have a VM Object ID and VM UUID columnsall VM related tab pages now have powerstate and template columns
  • all tab pages. Now have a vCenter UUID column (= unique identifier for a vCenterServer)
  • all VM related tab pages. The Custom Attributes columns are now ordered alphabetically
  • all tab pages. A select is now a full row select so it is easier to follow the information across many columns
  • bug fix: Refresh data issue on vRP and vCluster tab pages solved
  • bug fix: Filter issue on vCluster tab page solved
  • bug fix: On vInfo tab page the HA information was not filled with cluster default values
  • bug fix: Content Libraries vmdk files are no longer reported as possible zombie files
  • bug fix: msi installer sometimes installs RVTools in root of c:\ drive. This is solved now.

MDT 2013 Update 1 re-released (build 8298)

MDT Team have released a newer build (8298) to address many of these issues. The Download Center is updated with the new build and is still considered MDT 2013 Update 1. Build 8290 is no longer available, no longer supported, and superseded by build 8298.

NOTE: it can take time for the files to fully propagate through the live downloads cluster, and to be refreshed on the Akamai caches. Please ensure the build version under Details is 8298. I have seen the updated page on a non-internal system; it’s there, just be patient. Use the time to review the release notes below!

The following issues are fixed in build 8298
  • Multiple drive partitioning issues are addressed by significant revisions to the Format and Partition Disk step (see release note below), including:
    • Upgrading to MDT 2013 Update 1 does not work for UEFI systems
    • An extra unneeded partition is created on both UEFI and BIOS systems
    • You cannot specify a custom partition layout containing a “Recovery”-type partition needed for UEFI systems
    • LTIApply error, “There is not enough space on the disk”
    • WINRE_DRIVE_SIZE from ZTIDiskpart.wsf is Too Small
  • Multiple issues related to XML processing:
    • Application bundles returning error 87
    • Selecting a keyboard locale in the Deployment Wizard
    • Deployments failing due to Unattend.xml errors
    • ZTIPatches returning error “Object required (424)”
    • Cleanup after image capture doesn’t remove LTIBootstrap entry
  • Several issues with the Windows 10 in-place upgrade task sequence including:
    • The upgrade process ends with warnings “Unable to create WebService class”
    • The upgrade task sequence is available from Windows PE
    • After upgrade a System_License_Violation blue screen appears
  • Applications that use a command file start using System32 as the working directory
  • Spanned images cannot be applied

Below are the revised release notes and list of known issues. These inclusive lists supersede the previously published lists. New entries are marked with an asterisk (*).

Release Notes

TechNet documentation is not updated

The MDT product documentation published on TechNet is current as of MDT 2013; it has not yet been updated for MDT 2013 Update 1.

Do not upgrade from Preview to RTM

MDT 2013 Update 1 Preview should be uninstalled before installing the final MDT 2013 Update 1. Do not attempt to upgrade a preview installation or deployment share. Although the product documentation is not updated for MDT 2013 Update 1, the information on upgrading an installation still holds true.

Windows System Image Manager will fail to validate MDT Unattend.xml templates

The Windows System Image Manager (WSIM, a component of the Windows ADK used to create and modify unattended installation answer files) does not allow blank values which exist in the default MDT Unattend.xml templates. When using WSIM option, Validate Answer File, it will return validation errors, such as “The ‘HorizontalResolution’ element is invalid – The value ” is invalid according to its datatype ‘HorizontalResolutionType’ – The string ” is not a valid UInt32 value.”

MDT removes blank values before injecting the file during deployment, so Windows always receives a valid XML answer file.

Integrating with System Center Configuration Manager

When integrating MDT with Configuration Manager, follow the version of the Windows ADK. MDT 2013 Update 1 only works with the Windows 10 ADK, so make sure it is used with a version of Configuration Manager that supports and also uses the Windows 10 ADK.

Image files larger than 4 GB are not split by default

Split image (.SWM) support is now off by default. It must be enabled by modifying %DeployRoot%\Control\Settings.xml with the following:

<SkipWimSplit>False</SkipWimSplit>

Using HideShell with Windows 10

The behavior of the HideShell option changed with Windows 10. Michael Niehaus explains this in great detail on his blog.

Changes to the Format and Partition Disk step *

The Format and Partition Disk step in the task sequence is now more closely aligned with the similar step in Configuration Manager; it will explicitly show all of the partitions that are created when the task sequence runs.

  • Backwards compatibility remains when using a task sequence that was created in a prior version of MDT. You should expect the same behavior as previously.
  • The DoNotCreateExtraPartition variable is deprecated. It should not be used with new task sequences (as the partitions are explicitly created by the task sequence step).
Changes to permissions of new deployment shares *

New deployment shares will now be created with more restrictive permissions. You should review these permissions and adjust accordingly for your access requirements.

Upgraded deployment shares are not modified, but the former default permissions are overly permissive. You should review the permissions on the share and directory and adjust accordingly for your environment.

MDT Known Issues

Static IP not restored when using media deployment

When doing a media deployment and using a static IP the static IP does not get restored.

Workarounds:

  • Modify Litetouch.wsf to enable MEDIA deployments (Keith Garner explains in this forum post)
    or
  • Add an extra Apply Network Settings action (alternative suggested by Johan Arwidmark on his blog)
Static IP not set in Network Adapter Configuration Wizard

When initializing a deployment in Windows PE and clicking Configure Static IP Address, if you uncheck Enable DHCP and enter static IP information, the following Network Settings Error will display:

WMI Function: Adapter.EnableStatic(IPAddress,SubnetMask) FAILURE: -2147467259

This warning may also be seen in the results screen and log files during a deployment.

Workaround: a static IP can be manually set from Windows PE using netsh, but otherwise there are no workarounds at this time.

UDI wizard does not handle the domain join account user name *

When using the OSDJoinAccount variable in CustomSettings.ini for a UDI task sequence, the wizard cannot be completed because the domain join account user name is encoded. The New Computer Details page will display an error, “User name format is invalid. Example is domain\user.”

Workarounds:

  • Specify the OSDJoinAccount variable in the task sequence before the UDI wizard starts.
  • Alternatively, require the user to manually specify credentials in the UDI wizard.
Unable to browse for user data path *

In the LTI Deployment Wizard, on the User Data page, when selecting the Browse button, the Browse for Folder window does not display anything for selecting a path.

Workarounds:

  • Manually enter the path (do not browse).
  • Set the UserDataLocation variable in CustomSettings.ini.
The ZTIWinRE.wsf script and PrepareWinRE variable do not function properly *

If you specify PrepareWinRE=YES in CustomSettings.ini, Windows RE does not get enabled because the commandline is malformed.

The ZTIWinRE.wsf script is deprecated and should not be used.

Windows 10 language packs may not install *

We are still investigating an issue where Windows 10 language packs may not install during LTI.

Issues after successful Windows 10 in-place upgrade *

Following a successful upgrade to Windows 10:

  • Monitoring will continue to show the task sequence in progress until a user logs on.
  • A low rights user may receive an error at logon. This is a non-fatal error; the MDT script requires administrator elevation in order to display the final summary screen. Avoid this by using the variable, SkipFinalSummary.

Windows 10 Known Issues

The following are issues that are known to the MDT product team when doing Windows 10 deployments.

Issues with CopyProfile *

We are aware of reports of issues regarding the CopyProfile property in Unattend.xml. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with CopyProfile, please open a case with Microsoft Support to troubleshoot.

USMT LoadState fails on Windows 7 *

Using MDT 2013 Update 1 to deploy Windows 7 to an existing machine (refresh scenario), and using USMT 10 to capture and restore the user data will result in an error (“DismApi.DLL is missing”) while restoring the user state on Windows 7. This is a known issue with loadstate; see https://support.microsoft.com/kb/3084782 for more information.

MDAC component fails being added to Windows PE

This is a known bug with DISM; it is external to MDT. DISM can sometimes fail to add the MDAC component to WinPE boot images. This seems to be a timing issue which most commonly occur when you are using SSD disks.

Workarounds:

  • Remove MDAC. On the deployment share properties, Windows PE tab, Features subtab, uncheck Microsoft Data Access Components (MDAC/ADO) support.
  • If you need MDAC for database connectivity, you can try updating your boot images from a system where the %TMP% directory is located on a non-SSD drive. This is not a guaranteed workaround, but has been seen to work

NOTE: we are also aware of reports of issues regarding the WMI component in Windows PE. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.

Issues with Windows PowerShell in Windows PE

Windows PowerShell cmdlets in Windows PE may not function as expected. We are investigating this issue with the Windows team. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.

MDT 2013 Update 1 Release Notes and Known Issues

This post is to serve as the release notes and known issues list for the current release of MDT 2013 Update 1 (v6.3.8290). Source: http://blogs.technet.com/b/msdeployment/archive/2015/08/25/mdt-2013-update-1-release-notes-and-known-issues.aspx

The list of known issues below provides a number of workarounds that are currently available to help unblock affected customers. We will revise the list as needed. Given the number of issues with this build we will release a newer build of MDT 2013 Update 1 in the next several weeks to address as many of these issues as we can. Watch this blog for more information.

Release Notes

TechNet documentation is not updated

The MDT product documentation published on TechNet is current as of MDT 2013; it has not yet been updated for MDT 2013 Update 1.

Do not upgrade from Preview to RTM

MDT 2013 Update 1 Preview should be uninstalled before installing the final MDT 2013 Update 1. Do not attempt to upgrade a preview installation or deployment share. Although the product documentation is not updated for MDT 2013 Update 1, the information on upgrading an installation still holds true.

Windows System Image Manager will fail to validate MDT Unattend.xml templates

The Windows System Image Manager (WSIM, a component of the Windows ADK used to create and modify unattended installation answer files) does not allow blank values which exist in the default MDT Unattend.xml templates. MDT removes blank values before injecting the file during deployment, so Windows always receives a valid XML answer file.

Integrating with System Center Configuration Manager

When integrating MDT with Configuration Manager, follow the version of the Windows ADK. MDT 2013 Update 1 only works with the Windows 10 ADK, so make sure it is used with a version of Configuration Manager that supports and also uses the Windows 10 ADK.

Image files larger than 4 GB are not split by default

Split image (.SWM) support is now off by default. It must be enabled by modifying %DeployRoot%\Control\Settings.xml with the following:

<SkipWimSplit>False</SkipWimSplit>

Using HideShell with Windows 10

The behavior of the HideShell option changed with Windows 10. Michael Niehaus explains this in great detail on his blog.

Known Issues

Disk partitioning issues

Symptoms:

  • Recovery partition consumes the majority of the disk on BIOS systems
    • LTIApply fails with DISM error 112, There is not enough space on the disk.
  • Recovery partition is unnecessarily visible on both UEFI and BIOS systems
  • You can’t specify a custom partition layout containing a recovery partition for UEFI systems

Workarounds: Keith Garner provides some suggestions on his blog: uberbug06 and uberbug07.

Static IP not restored when using media deployment

When doing a media deployment and using a static IP the static IP does not get restored.

Workarounds:

  • Modify Litetouch.wsf to enable MEDIA deployments (Keith Garner explains in this forum post)
    or
  • Add an extra Apply Network Settings action (alternative suggested by Johan Arwidmark on his blog)
Static IP not set in Network Adapter Configuration Wizard

When initializing a deployment in Windows PE and clicking Configure Static IP Address, if you uncheck Enable DHCP and enter static IP information, the following Network Settings Error will display:

WMI Function: Adapter.EnableStatic(IPAddress,SubnetMask) FAILURE: -2147467259

This warning may also be seen in the results screen and log files during a deployment.

Workaround: a static IP can be manually set from Windows PE using netsh, but otherwise there are no workarounds at this time.

Monitoring does not work after Windows 10 upgrade

After successfully upgrading a system to Windows 10 the MDT monitoring fails to report information. You will see the following warnings:

Unable to create WebService class

Workaround: None.

MDAC component fails being added to Windows PE

This is a known bug with DISM; it is external to MDT. DISM can sometimes fail to add the MDAC component to WinPE boot images. This seems to be a timing issue which most commonly occur when you are using SSD disks.

Workarounds:

  • Remove MDAC. On the deployment share properties, Windows PE tab, Features subtab, uncheck Microsoft Data Access Components (MDAC/ADO) support.
  • If you need MDAC for database connectivity, you can try updating your boot images from a system where the %TMP% directory is located on a non-SSD drive. This is not a guaranteed workaround, but has been seen to work.

NOTE: we are also aware of reports of similar issues regarding Windows PowerShell and WMI components in Windows PE (as well as some functional issues with these components). We have not been able to reproduce these issues, and are working with the Windows team to investigate further. If you have a reproducible issue with these components in Windows PE, please open a case with Microsoft Support to troubleshoot.

Upgrade task sequences are displayed when not applicable

Windows 10 upgrade task sequences are available when starting a deployment from Windows PE or on a non-matching architecture, however the in-place upgrade scenario is only supported when started from the full OS (it cannot be started from Windows PE) and from the correct architecture.

Workaround: Modify your upgrade task sequence properties to exclude client platforms that are not applicable. On the task sequence properties, General tab, select This can run only on the specified client platforms and then choose platforms that you want to target, for example, All x86 Windows 7 Client. This example will exclude Windows PE and Windows 7 x64 systems.

Applications with a command file (.cmd) use a Windows system working directory

If you have an application that uses a command file (.cmd) as the installation command line it will be launched from C:\Windows\System32 instead of the application’s working directory.

Workaround: See the associated bug on Connect for sample edits to ZTIApplications.wsf.

Application bundles successfully install but log an error

Application bundles will successfully install but the following warning is logged in ZTIApplications.log:

SelectSingleNodeString(CommandLine) Missing Node.

as well as the following error:

Application <app bundle name> returned an unexpected return code: 87

Workaround: See the associated bug on Connect for sample edits to ZTIApplications.wsf.

Deployment Wizard error for Keyboard Locale

Changing the keyboard locale in the Deployment Wizard will result in a script error:

Type mismatch: 'SetNewKeyboardLayout'

This error is non-fatal. Click Yes and continue.

Workarounds:

  • Specify the keyboard locale in CustomSettings.ini and hide this wizard page.
  • Edit %DeployRoot%\Scripts\DeployWiz_LanguageUI.xml to remove onchange="SetNewKeyboardLayout" from line 62.
ZTI: Offline installation of language packs or software updates fails

Using the “Install Language Packs Offline” or “Install Updates Offline” step in an MDT-integrated task sequence in Configuration Manager results in the language packs or updates not injected, and the following errors in the ZTIPatches.log:

ZTI ERROR - Unhandled error returned by ZTIPatches: Object required (424)

This error is only seen in logs, the deployment appears to be successful otherwise.

Workaround: apply updates and language packs online

Split image files do not apply

If you split a large image file to create .SWM file(s), then applying this split image file will fail.

Workaround: edit %DeployRoot%\Scripts\LTIApply.wsf, both lines 915 and 918, to add a colon and remove a space, for example on line 915 change:

sCmd = sCmd & " /SWMFile """ & sRWMPath & """"
to
sCmd = sCmd & " /SWMFile:""" & sRWMPath & """"

Do the same on line 918.

Deployment fails due to unattend.xml errors during oobeSystem

If you have edited unattend.xml and then start a deployment with the wizard page for administrator password enabled, or specified AdminPassword in CustomSettings.ini, the deployment will fail during Windows OOBE:

Windows could not parse or process Unattend answer file [C:\Windows\Panther\unattend.xml\ for pass [oobeSystem]. The settings specified in the answer file cannot be applied. The error was detected while processing settings for component [Microsoft-Windows=Shell-Setup].

Workaround: edit %DeployoRoot%\Scripts\ZTIConfigure.wsf lines 343 and 344 to append unattend: before PlainText. For example, on line 344 change:

oCurrent.parentNode.selectSingleNode("PlainText").text = "true"
to
oCurrent.parentNode.selectSingleNode("unattend:PlainText").text = "true"

Do the same on line 343.

ZTI: LTIBootstrap.vbs script not found

Towards the end of a MDT-integrated task sequence deployment in Configuration Manager a Windows Script Host popup will appear with a message similar to the following:

Can not find script file "C:\LTIBootstrap.vbs".

(The drive letter may be different depending upon the specific scenario.)

Workaround: Script changes are possible but difficult and challenging. Johan Arwidmark provides an option on his blog (see Issue #2).

LTI: Cleanup is not complete after image capture

After capturing an image and rebooting back to the drive, autologon is still configured and an error will appear about LTIBootstrap is not found. This is a minor, non-fatal error that does not affect the captured image.

Workaround: Script changes are possible but difficult and challenging, especially given the minor severity of the issue.

DISM returns error 87 when applying image

A deployment fails with the following error from DISM:

Error: 87 (The parameter is incorrect)

With further detail in the dism.log:

Failed to get the filename extension of the image file

Workarounds: This is seen when the server name is only two characters, for example DC, such that the /ImageFile parameter is similar to the following:

"\\dc\DeploymentShare$\Operating Systems\Windows 10 Enterprise x64\sources\install.wim"

Use a deployment share on a server whose name is three or more characters.

If you must use a server with a two-character name, specify its fully qualified domain name in bootstrap.ini, for example

DeployRoot=\\DC.contoso.com\DeploymentShare$

Administrative Templates (.admx) for Windows 10

Microsoft has released the Windows 10 Group Policy (.ADMX) templates . These .ADMX templates are released as a separate download package so you can manage group policy for Windows 10 clients more easily.

This new package includes additional (.ADMX) templates which are not included in the RTM version of Windows 10.

  1. DeliveryOptimization.admx
  2. fileservervssagent.admx
  3. gamedvr.admx
  4. grouppolicypreferences.admx
  5. grouppolicy-server.admx
  6. mmcsnapins2.admx
  7. terminalserver-server.admx
  8. textinput.admx
  9. userdatabackup.admx
  10. windowsserver.admx

To download the Windows 10 Group Policy (.ADMX) templates, please visit http://www.microsoft.com/en-us/download/details.aspx?id=48257

To review which settings are new in Windows 10, review the Windows 10 ADMX spreadsheet here:http://www.microsoft.com/en-us/download/details.aspx?id=25250