Tag: Windows

MDT 2013 Update 2 (6.3.8330) Released

The Microsoft Deployment Toolkit (MDT) 2013 Update 2 (6.3.8330) is now available on the Microsoft Download Center. This update requires the Windows Assessment and Deployment Kit (ADK) for Windows 10, available on the Microsoft Hardware Dev Center. (Note that there are known issues with the v1511 release of the Windows 10 ADK and System Center Configuration Manager; these issues do not directly affect MDT although may still impact ZTI or UDI scenarios.)

MDT 2013 Update 2 is primarily a quality release; there are no new major features. The following is a summary of the significant changes in this update:

  • Security- and cryptographic-related improvements:
    • Relaxed permissions on newly created deployment shares (still secure by default, but now also functional by default)
    • Creating deployment shares via Windows PowerShell adds same default permissions
    • Updated hash algorithm usage from SHA1 to SHA256
  • Includes the latest Configuration Manager task sequence binaries
  • Enhanced user experience for Windows 10 in-place upgrade task sequence
  • Enhanced split WIM functionality
  • Fixed OSDJoinAccount account usage in UDI scenario
  • Fixed issues with installation of Windows 10 language packs
  • Various accessibility improvements
  • Monitoring correctly displays progress for all scenarios including upgrade
  • Improvements to smsts.log verbosity

There are no other new release notes or significant known issues. See the previous post for more information as much of it is still applicable (other than the fix list above).

See the following post on How to get help with MDT.

Frequently Asked Questions

In anticipation of some questions that you may have about this release (or MDT in general):

Q: Should I expect a release of MDT with every new Windows 10 and/or Configuration Manager build release?

No. We shipped multiple MDT releases this year due to the timing of Windows 10 and Configuration Manager releases, but do not intend to keep that same cadence going forward.

Q: What branches of Windows 10 does MDT support?

MDT supports both the current branch of Windows 10 as well as the long-term servicing branch.

Q: What branches of System Center Configuration Manager does MDT support?

For ZTI and UDI scenarios MDT 2013 Update 2 supports the current branch of System Center Configuration Manager (currently version 1511) for an integrated solution for deploying Windows 10 current branch as well as prior Windows versions.

Q: When is the next planned release of MDT?

We do not currently have a timeframe. We will release any tactical changes as needed which may be required to support new builds of Windows 10 or Configuration Manager, but do not currently expect this to be needed.

Q: Is this the last release of MDT?

No, we will continue to iterate and invest in the product.

Q: Why is it still “MDT 2013” when the year is almost 2016?

Two primary reasons. First, we have only made minor changes to MDT which in our opinion does not constitute a major version revision. Second, per the MDT support lifecycle, a new major version will drop support for MDT2012 Update 1 which still supports legacy platforms.

Source

Cumulative Update 11 for Exchange Server 2013

Cumulative Update 11 for Microsoft Exchange Server 2013 was released on December 15, 2015. Several nonsecurity issues are fixed in this cumulative update or a later cumulative update for Exchange Server 2013.

This cumulative update fixes the issues that are described in the following Microsoft Knowledge Base articles:

This update also includes new daylight saving time (DST) updates for Exchange Server 2013. For more information about DST, go to Daylight Saving Time Help and Support Center.

 

Download Cumulative Update 11 for Exchange Server 2013 (KB3099522) now.

Update Rollup 12 for Exchange Server 2010 Service Pack 3

Update Rollup 12 for Microsoft Exchange Server 2010 Service Pack 3 (SP3) was released on December 15, 2015. This update rollup fixesvarious issues. Before you install this update, you must remove all interim updates for Exchange Server 2010 SP3. Also, see this important information about how to install this update.

This update fixes the issues that are described in the following Microsoft Knowledge Base article:

This update also includes new daylight saving time (DST) updates for Exchange Server 2010 SP3. For more information about DST, go toDaylight Saving Time Help and Support Center.

Download Update Rollup 12 for Exchange Server 2010 SP3 (KB3096066).

Announcing Open Live Writer – An Open Source Fork of Windows Live Writer

Today is the day. An independent group of volunteers within Microsoft has successfully open sourced and forked Windows Live Writer. The fork is called Open Live Writer (also known as OLW) and it is part of the .NET Foundationand managed by this group of volunteers. Read the fantastic announcement at the .NET Foundation Blog! Download Open Live Writer now!

Windows Live Writer 2012 was the last version Microsoft released and can still be downloaded from http://www.windowslivewriter.com. If you’re not comfortable using Open Source Software, I recommend you stick with classic WLW.

If you’re willing to put up with some bugs, then join us in this brave new world, you can download Open Live Writer from http://www.openlivewriter.org. We’re calling today’s release version 0.5.

Here’s some of the added features, the removed features, the stuff that doesn’t work, and our plans for the future:

  • REMOVED: Spell Checking. The implementation was super old and used a 3rd party spell checker we didn’t have a license to include an open source release. Going forward we will add Spell Check using the built-in spell checker that was added in Windows 8. Open Live Writer on Windows 7 probably won’t have spell check.
  • REMOVED: The Blog This API. It was a plugin to Internet Explorer and Firefox and was a mess of old COM stuff.
  • REMOVED: The “Albums” feature. It uploaded photos to OneDrive but depended on a library that was packaged with Windows Live Mail and Live Messenger and we couldn’t easily get permission to distribute it in an open source project.
  • ADDING VERY SOON: Google runs the excellent Blogger blog service. We’ve worked with the Blogger Team within Google on this project, and they’ve been kind enough to keep an older authentication endpoint running for many months while we work on Open Live Writer. Soon, Google and Blogger will finally shut down this older authentication system. Blogger will use the more modern OAuth 2 and Open Live Writer will be updated to support OAuth 2. Windows Live Writer will never support this new OAuth 2 authentication system, so if you use Blogger, you’ll need to use Open Live Writer.
  • BROKEN/KNOWN ISSUES: We are actively working on supporting Plugins. We have an plan in place and we are looking for your feedback on the most popular plugins that you want brought over from the Windows Live Writer ecosystem.

Our roadmap for the future is published here on GitHub.

 

image

Windows 10 ADK update build 10586

The latest Windows 10 ADK update, build 10586, was silently released a few days ago (Thanks deploymentresearch for the download link). In this post you learn about what’s changed.

Download link: http://download.microsoft.com/download/3/8/B/38BBCA6A-ADC9-4245-BCD8-DAA136F63C8B/adk/adksetup.exe

Warning: Do NOT upgrade your ConfigMgr 2012 R2 SP1 or MDT 2013 Update 1 environments to this build yet. For ConfigMgr, even though it seems to fix the x64 UEFI / PXE and Powershell/.NET issue, which is great, the new ADK does break Computer Refresh scenarios (Bare metal works). The error code is 0x80220014. Research and discussions with the product teams in progress… MDT 2013 Update 1 yet to be validated, but error comments on twitter does not give me a warm and fuzzy feeling.

4fbe7042-d2fd-416e-a7b3-d3458a49aeec

Windows Update KB3097877 crashes Outlook

A recent update for Windows may cause Outlook to crash.

The update that causes this is KB3097877 and it appears to be limited to only some Windows 7 installations when downloading online images for a HTML message. The version of Outlook that you are using doesn’t seem to matter and other applications may also be affected.

Thanks to Howto-Outlook

MS15-122 Security Update for Kerberos to Address Security Feature Bypass (Bitlocker)

This security update resolves a security feature bypass in Microsoft Windows. An attacker could bypass Kerberos authentication on a target machine and decrypt drives protected by BitLocker. The bypass can be exploited only if the target system has BitLocker enabled without a PIN or USB key, the computer is domain-joined, and the attacker has physical access to the computer.

This security update is rated Important for all supported editions of Windows. For more information, see the Affected Software section.

The update addresses the bypass by adding an additional authentication check that will run prior to a password change. For more information about the vulnerability, see theVulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3105256.

MDT 2013 Update 1 re-released (build 8298)

MDT Team have released a newer build (8298) to address many of these issues. The Download Center is updated with the new build and is still considered MDT 2013 Update 1. Build 8290 is no longer available, no longer supported, and superseded by build 8298.

NOTE: it can take time for the files to fully propagate through the live downloads cluster, and to be refreshed on the Akamai caches. Please ensure the build version under Details is 8298. I have seen the updated page on a non-internal system; it’s there, just be patient. Use the time to review the release notes below!

The following issues are fixed in build 8298
  • Multiple drive partitioning issues are addressed by significant revisions to the Format and Partition Disk step (see release note below), including:
    • Upgrading to MDT 2013 Update 1 does not work for UEFI systems
    • An extra unneeded partition is created on both UEFI and BIOS systems
    • You cannot specify a custom partition layout containing a “Recovery”-type partition needed for UEFI systems
    • LTIApply error, “There is not enough space on the disk”
    • WINRE_DRIVE_SIZE from ZTIDiskpart.wsf is Too Small
  • Multiple issues related to XML processing:
    • Application bundles returning error 87
    • Selecting a keyboard locale in the Deployment Wizard
    • Deployments failing due to Unattend.xml errors
    • ZTIPatches returning error “Object required (424)”
    • Cleanup after image capture doesn’t remove LTIBootstrap entry
  • Several issues with the Windows 10 in-place upgrade task sequence including:
    • The upgrade process ends with warnings “Unable to create WebService class”
    • The upgrade task sequence is available from Windows PE
    • After upgrade a System_License_Violation blue screen appears
  • Applications that use a command file start using System32 as the working directory
  • Spanned images cannot be applied

Below are the revised release notes and list of known issues. These inclusive lists supersede the previously published lists. New entries are marked with an asterisk (*).

Release Notes

TechNet documentation is not updated

The MDT product documentation published on TechNet is current as of MDT 2013; it has not yet been updated for MDT 2013 Update 1.

Do not upgrade from Preview to RTM

MDT 2013 Update 1 Preview should be uninstalled before installing the final MDT 2013 Update 1. Do not attempt to upgrade a preview installation or deployment share. Although the product documentation is not updated for MDT 2013 Update 1, the information on upgrading an installation still holds true.

Windows System Image Manager will fail to validate MDT Unattend.xml templates

The Windows System Image Manager (WSIM, a component of the Windows ADK used to create and modify unattended installation answer files) does not allow blank values which exist in the default MDT Unattend.xml templates. When using WSIM option, Validate Answer File, it will return validation errors, such as “The ‘HorizontalResolution’ element is invalid – The value ” is invalid according to its datatype ‘HorizontalResolutionType’ – The string ” is not a valid UInt32 value.”

MDT removes blank values before injecting the file during deployment, so Windows always receives a valid XML answer file.

Integrating with System Center Configuration Manager

When integrating MDT with Configuration Manager, follow the version of the Windows ADK. MDT 2013 Update 1 only works with the Windows 10 ADK, so make sure it is used with a version of Configuration Manager that supports and also uses the Windows 10 ADK.

Image files larger than 4 GB are not split by default

Split image (.SWM) support is now off by default. It must be enabled by modifying %DeployRoot%\Control\Settings.xml with the following:

<SkipWimSplit>False</SkipWimSplit>

Using HideShell with Windows 10

The behavior of the HideShell option changed with Windows 10. Michael Niehaus explains this in great detail on his blog.

Changes to the Format and Partition Disk step *

The Format and Partition Disk step in the task sequence is now more closely aligned with the similar step in Configuration Manager; it will explicitly show all of the partitions that are created when the task sequence runs.

  • Backwards compatibility remains when using a task sequence that was created in a prior version of MDT. You should expect the same behavior as previously.
  • The DoNotCreateExtraPartition variable is deprecated. It should not be used with new task sequences (as the partitions are explicitly created by the task sequence step).
Changes to permissions of new deployment shares *

New deployment shares will now be created with more restrictive permissions. You should review these permissions and adjust accordingly for your access requirements.

Upgraded deployment shares are not modified, but the former default permissions are overly permissive. You should review the permissions on the share and directory and adjust accordingly for your environment.

MDT Known Issues

Static IP not restored when using media deployment

When doing a media deployment and using a static IP the static IP does not get restored.

Workarounds:

  • Modify Litetouch.wsf to enable MEDIA deployments (Keith Garner explains in this forum post)
    or
  • Add an extra Apply Network Settings action (alternative suggested by Johan Arwidmark on his blog)
Static IP not set in Network Adapter Configuration Wizard

When initializing a deployment in Windows PE and clicking Configure Static IP Address, if you uncheck Enable DHCP and enter static IP information, the following Network Settings Error will display:

WMI Function: Adapter.EnableStatic(IPAddress,SubnetMask) FAILURE: -2147467259

This warning may also be seen in the results screen and log files during a deployment.

Workaround: a static IP can be manually set from Windows PE using netsh, but otherwise there are no workarounds at this time.

UDI wizard does not handle the domain join account user name *

When using the OSDJoinAccount variable in CustomSettings.ini for a UDI task sequence, the wizard cannot be completed because the domain join account user name is encoded. The New Computer Details page will display an error, “User name format is invalid. Example is domain\user.”

Workarounds:

  • Specify the OSDJoinAccount variable in the task sequence before the UDI wizard starts.
  • Alternatively, require the user to manually specify credentials in the UDI wizard.
Unable to browse for user data path *

In the LTI Deployment Wizard, on the User Data page, when selecting the Browse button, the Browse for Folder window does not display anything for selecting a path.

Workarounds:

  • Manually enter the path (do not browse).
  • Set the UserDataLocation variable in CustomSettings.ini.
The ZTIWinRE.wsf script and PrepareWinRE variable do not function properly *

If you specify PrepareWinRE=YES in CustomSettings.ini, Windows RE does not get enabled because the commandline is malformed.

The ZTIWinRE.wsf script is deprecated and should not be used.

Windows 10 language packs may not install *

We are still investigating an issue where Windows 10 language packs may not install during LTI.

Issues after successful Windows 10 in-place upgrade *

Following a successful upgrade to Windows 10:

  • Monitoring will continue to show the task sequence in progress until a user logs on.
  • A low rights user may receive an error at logon. This is a non-fatal error; the MDT script requires administrator elevation in order to display the final summary screen. Avoid this by using the variable, SkipFinalSummary.

Windows 10 Known Issues

The following are issues that are known to the MDT product team when doing Windows 10 deployments.

Issues with CopyProfile *

We are aware of reports of issues regarding the CopyProfile property in Unattend.xml. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with CopyProfile, please open a case with Microsoft Support to troubleshoot.

USMT LoadState fails on Windows 7 *

Using MDT 2013 Update 1 to deploy Windows 7 to an existing machine (refresh scenario), and using USMT 10 to capture and restore the user data will result in an error (“DismApi.DLL is missing”) while restoring the user state on Windows 7. This is a known issue with loadstate; see https://support.microsoft.com/kb/3084782 for more information.

MDAC component fails being added to Windows PE

This is a known bug with DISM; it is external to MDT. DISM can sometimes fail to add the MDAC component to WinPE boot images. This seems to be a timing issue which most commonly occur when you are using SSD disks.

Workarounds:

  • Remove MDAC. On the deployment share properties, Windows PE tab, Features subtab, uncheck Microsoft Data Access Components (MDAC/ADO) support.
  • If you need MDAC for database connectivity, you can try updating your boot images from a system where the %TMP% directory is located on a non-SSD drive. This is not a guaranteed workaround, but has been seen to work

NOTE: we are also aware of reports of issues regarding the WMI component in Windows PE. We have not been able to reproduce this issue, and are working with the Windows team to investigate further. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.

Issues with Windows PowerShell in Windows PE

Windows PowerShell cmdlets in Windows PE may not function as expected. We are investigating this issue with the Windows team. If you have a reproducible issue with Windows PE optional components, please open a case with Microsoft Support to troubleshoot.

Office 2013 Group Policy User Settings Recommendations

The following table lists a number of user settings across each of the Office 2013 applications that I recommend you take a look at. This is just a small subset of the total number of settings, but includes some of the most important ones.

The status of each setting will vary dependant on the environment. Use at your own risk.

PRODUCT
PATH
SETTING
RECOMMENDED VALUES

Microsoft Access 2013
Miscellaneous
Disable the Office Start Screen for Access
Enabled | Not Configured

Microsoft Excel 2013
Excel Options – Save
Default file format
Enabled, Excel Workbook (*.xlsx)

Microsoft Excel 2013
Miscellaneous
Disable the Office Start Screen for Excel
Enabled | Not Configured

Microsoft Office 2013
Global Options – Customize
Allow roaming of all user customizations
Enabled

Microsoft Office 2013
Privacy – Trust Center
Disable Opt-in Wizard on first run
Enabled

Microsoft Office 2013
Privacy – Trust Center
Enable Customer Experirnce Improvement Program
Disabled | Not Configured

Microsoft Office 2013
Privacy – Trust Center
Automatically receive small updates to improve reliability
Disabled | Not Configured

Microsoft Office 2013
Privacy – Trust Center
Send Office Feedback
Disabled | Not Configured

Microsoft Office 2013
Privacy – Trust Center
Allow including screenshot with Office Feedback
Disabled | Not Configured

Microsoft Office 2013
Subscription Activation
Do not show ‘Manage Account’ link for subscription licenses
Enabled | Not Configured

Microsoft Office 2013
Subscription Activation
Automatically activate Office with federated organization credentials
Disabled | Not Configured

Microsoft Office 2013
Services
Disable Roaming Office User Settings
Enabled | Not Configured

Microsoft Office 2013
Services – Fax
Disable Internet Fax feature
Enabled

Microsoft Office 2013
Downloading Framework Components
Hide missing component download links
Enabled

Microsoft Office 2013
Microsoft Office Picture Manager
Disable File Types association dialog box on first launch
Enabled

Microsoft Office 2013
Miscellaneous
Show SkyDrive Sign In
Disabled | Not Configured

Microsoft Office 2013
Miscellaneous
Block signing into Office
Enabled | Not Configured

Microsoft Office 2013
Miscellaneous
Disable the Office Start screen for all Office applications
Enabled | Not Configured

Microsoft Office 2013
Miscellaneous
Disable Office Backgrounds
Enabled | Not Configured

Microsoft Office 2013
Miscellaneous
Suppress recommended settings dialog
Enabled

Microsoft Office 2013
First Run
Disable First Run Movie
Enabled | Not Configured

Microsoft Office 2013
First Run
Disable First Run on application boot
Enabled | Not Configured

Microsoft OneNote 2013
OneNote Options – Other
Add OneNote icon to the notification area
Disabled | Not Configured

Microsoft Outlook 2013
Outlook Social Connector
Turn off Outlook Social Connector
Enabled | Not Configured

Microsoft Outlook 2013
Outlook Social Connector
Do not show social network info-bars
Enabled | Not Configured

Microsoft Outlook 2013
Outlook Options – Preferences – Calendar Options – Office.com Sharing Service
Prevent publishing to Office.com
Enabled | Not Configured

Microsoft Outlook 2013
Outlook Options – Other – AutoArchive
AutoArchive Settings
Disabled

Microsoft PowerPoint 2013
PowerPoint Options – Save
Default file format
Enabled, PowerPoint Presentation (*.pptx)

Microsoft PowerPoint 2013
Miscellaneous
Disable the Office Start Screen for PowerPoint
Enabled | Not Configured

Microsoft Project 2013
Miscellaneous
Disable the Office Start Screen for Project
Enabled | Not Configured

Microsoft Publisher 2013
Miscellaneous
Disable the Office Start Screen for Publisher
Enabled | Not Configured

Microsoft Visio 2013
Visio Options – Save – Save Documents
Save Visio files as
Enabled, Visio Document

Microsoft Visio 2013
Visio Options – Advanced – General Options
Put all settings in Windows registry
Enabled

Microsoft Word 2013
Word Options – Save
Default file format
Enabled, Word Document (*.docx)

Microsoft Word 2013
Miscellaneous
Disable the Office Start Screen for Word
Enabled | Not Configured

Windows 8.1 with Hyper-V external switch – 802.1x will not work

I have Windows 8.1 with installed Hyper-V and virtual machines connected via Hyper-V Switch – External. 802.1x wired authentication is not working in host or in guest machine (computer is not responding to switch requests).
If I will change switch mode to Internal/Private it will start working.

Windows 8.1 with a Hyper-V external switch with 802.1x will not work!!!

From https://social.technet.microsoft.com/forums/windows/en-US/341cbe70-3fa7-4991-a7e4-4f1af63df4d0/windows-8-hyperv-8021x-eapol-request-missing i read that “official” statement from Microsoft is that 802.1x with Hyper-V on Windows 8.1 is not working by design. #Fail Microsoft.

Translate »