Windows 10 OSD Primer

Windows 10 OSD Primer

Windows 10 OSD Primer

Table of Contents Windows as a Service 3 .....................................................................................................................................

Feature Updates and Quality Updates 3 ..........................................................................................................

Windows 10 Branches 3 ....................................................................................................................................

Windows Insider & Windows Insider for Business 3 ......................................................................................

Current Branch and Current Branch for Business 4 ......................................................................................

Long Term Servicing Branch 4 ...........................................................................................................................

Compatibility 5 ....................................................................................................................................................

Security 5 ..............................................................................................................................................................

Upgrade Options – In-place vs. Wipe-and-load 6 .......................................................................................

In-place Upgrades 6 .............................................................................................................................................

Wipe-and-load 6 ...................................................................................................................................................

Deployment Planning 7 .....................................................................................................................................

Upgrade Readiness 7 ............................................................................................................................................

Choosing a Deployment Method 7 ...................................................................................................................

Selecting AD GPO vs. MDM 8 .............................................................................................................................

Defining Deployment Rings 8 ............................................................................................................................

Automating BIOS to UEFI 9 ................................................................................................................................

Cumulative Updates and Express Installation 9 .............................................................................................

Additional Tools and Resources 9 .....................................................................................................................

Summary 10 .........................................................................................................................................................

About Adaptiva 10..............................................................................................................................................

Windows 10 OSD Primer

In Adaptiva’s 2017 Windows 10 Enterprise Impact Survey, ninety-nine percent respondents said their organization is moving to Windows 10. The survey also found that while companies are taking more time than expected for planning and preparation, the actual migrations are moving faster than expected. Careful planning and design are important in any large project, but taking time to prepare carefully is especially vital with Windows 10. This is not just a move to a new operation system. It’s a shift for IT departments to manage a Windows world where everything happens faster, and frequent updates are a way of life.

Microsoft has re-invented not only how Windows is built and delivered, but also how it is serviced. Gone are the days of occasional service packs every two or three years to add functionalities to major builds. There will be no more “pick a patch” Update Tuesday to selectively (and kind of dangerously) decide which specific fixes to apply to which machines in your organization. Now, Microsoft is delivering new functionality through twice a year Feature Updates. They are delivering security patches and bug fixes via monthly Cumulative Updates. This is all arriving to you under the concept of Windows as a Service (WaaS).

Windows 10 OSD is an extremely vast topic. This guide provides a high-level introduction for the novice, or IT professional new to the world of operation system deployment. It will introduce you to key issues, technologies, and terms you’ll need to understand as you plan your migration to Windows 10.

Windows as a Service

WaaS has nothing to do with Windows as a subscription. Instead, it is all about the way Microsoft builds, tests, deploys, and updates Windows 10. So, the service part means Microsoft is delivering new Windows versions on a schedule, each having varying amounts of testing and patching. One version also has limited functionality. These versions are called branches. Microsoft has signaled new naming will be coming soon. However, it will not go live until September, so this document references the current branch terminology.

Feature Updates and Quality Updates

To keep up with a faster, and more regular, release of features and patches, Microsoft delivers two kinds of Windows 10 updates: Feature Updates and Quality Updates. Feature Updates are what we used to think of as upgrades. In the most common deployment scenarios (see Windows 10 Branches below), these will come out twice a year. They will contain new features as well as security updates and bug fixes. Quality Updates are patches to Windows 10, primarily delivering security updates and bug fixes. Quality Updates will typically come out monthly; however, they can be released at any time.

Windows 10 Branches

Windows Insider & Windows Insider for Business

With Insider Preview downloads, consumers and IT Pros can test out pre-release features and functionalities before they are made generally available. Downloads are free, but they need to sign up for the Windows Insider program. Special access for IT Pros is new, and requires that they use an Azure AD login. Microsoft gives IT Pros their own feedback loop to Microsoft, separate from consumer feedback. Before any given build gets released to the several million members of the Windows Insider program, it undergoes extensive internal testing at Microsoft across tens of thousands of users. Each of these builds is called an Insider Preview.

Without a doubt, the Windows Insider program is the best way to participate in the change process and help shape future releases of Windows 10. Consumers can join the Insider Program with a valid Microsoft Account here https://insider.windows.com. IT Pros can join with their company Azure AD login here https://insider.windows.com/forbusiness. Microsoft recommendation that IT Pros join a few test machines

Windows 10 OSD Primer

to the Insider Program to have visibility into changes that are coming, and see how the builds perform with their company’s hardware, settings, and applications.

Current Branch and Current Branch for Business

When Windows 10 is released (RTM), it is flagged as Current Branch for four months, at which point it is flagged as Current Branch for Business. There is no functional difference between Current Branch and Current Branch for Business, other than the designation. The flags are meant to designate whether the build should be deployed with limits for User Acceptance Testing (Current Branch), or if it is ready for broad deployment for an organization (Current Branch for Business). Put another way, people who can handle minor issues can run Current Branch for four months as a sort of “public quality assurance” program—then everybody else can get it. In fact, Current Branch for Business is Current Branch plus the latest Cumulative Update (CU).

Microsoft will release new versions of Windows 10 twice per year as Feature Updates. The current target is March and September. Once released, each version of Current Branch for Business will be supported for a total of 18 months, plus a 60 day grace period for those who don’t keep up.

This diagram and TechNet blog explain it more detail: https://blogs.technet.microsoft.com/uspartner_learning/2017/03/27/windows-as-a-service-deployment-rings/.

Long Term Servicing Branch

There is a lot of controversy around the deployment of the Long Term Servicing Branch (LTSB) of Windows 10. The main intention behind it is stability. To this end, it does not get Feature Updates, just Quality Updates. With LTSB, companies can defer deployment of those Quality Updates as long as desired. New releases are only rolled out every two to three years. LTSB is also somewhat feature-limited. For example, it does not include the Edge browser or Cortana. What you really need to know about LTSB is that it is not for general use.

LTSB is meant to be deployed to highly specialized machines that must remain unchanged for a long period of time, such a mission-critical PC at a nuclear power plant, ATM, factory, or operating room. If you are unsure if a PC in your organization is a candidate for LTSB, you need to ask yourself if the endpoint in question is mission critical. For example, will you go out of business if something happens to this computer and it fails to function correctly? Also, if you are installing Microsoft Office on an endpoint, then the PC should be deployed in Current Branch for Business and not LTSB. The installation of Office signifies the PC is for information workers, and not dedicated to a highly specialized task.

Engineering

builds

Broad

Microsoft internal

validation

Microsoft Insider Preview

Branch

Users

Pilot Ring IT

Several million

Time

Pilot Ring QA Pilot RingEarly Adopters

Broad deployment

Ring I

10s of thousands

Broad deployment

Ring II

Broad deployment

Ring III

Broad deployment

Ring IV

Pilot(Current Branch)

Broad deployment(Current Branch for Business)

~ 6 months

18 months

Hundreds of millions

Windows 10 OSD Primer

Many technicians are trying to make an argument for LTSB to be broadly deployed in their organization because they don’t want frequent updates. While the thoughts behind that stance are understood, the intention is often misguided. This is especially true considering the ability to defer updates and limit other features, such as Cortana, with MDM policies in a Current Branch deployment.

One particularly striking limitation of LTSB is that it has limited hardware support. You may need to deploy a new PC that requires drivers that are not available in LTSB. Because LTBS is years between releases, the currently available version of LTSB cannot possibly support new hardware released after it came out. If a PC vendor discontinues a specific generation/model, you will not be able to deploy the newer generation/model until the next LTSB update—currently scheduled for release in 2019.

It is best not to limit your organization by deploying the wrong servicing branch of Windows 10 in LTSB to bypass custom settings or application compatibility issues. Except for extremely rare cases where LTSB is appropriate, you will be better served by doing a broad deployment of Current Branch for Business. If you have issues with mission-critical applications, simply open support cases with Microsoft and work them.

Compatibility

Application compatibility is one of the top concerns when migrating to a new OS. Good news, Windows 10 is the most compatible OS that Microsoft has created. While there is no guarantee that all applications will work, the expectation is that compatibility will be in the high 90’s percentage-wise. Broken applications should be the exception not the rule.

Windows 10 is compatible with the same hardware already deployed in your organization. If hardware vendors haven’t released supported Windows 10 driver packages for older models, you can very likely use inbox drivers—those included in Windows—to get them working. With older machines, you may miss out on some Windows 10 capabilities that only run on hardware that meets specific minimum requirements. For example, UEFI mode is require to support several new security features. However, you can expect to run both old and new hardware alike.

Organizations that are dependent upon web applications as part of their Line of Business (LOB) apps can expect web compatibility to continue to be addressed through IE Enterprise Mode. Enterprise Mode allows companies to continue to use legacy apps, pages, etc. meant for older versions of Internet Explorer (IE) on the latest version of IE (IE11). While Enterprise Mode isn’t new to Windows 10 (you can use it on older versions of Windows), Microsoft is continuing to invest in the development and support of the feature. In fact, you can use Enterprise Mode in the Edge browser, or force sites to redirect to Internet Explorer. For a walkthrough of how to set that up, you can follow the TechNet documentation here https://docs.microsoft.com/en-us/microsoft-edge/deploy/emie-to-improve-compatibility.

Security

Everybody in the IT industry agrees that Windows 10 is the most secure client Operating System released by Microsoft. However, to harness many of these new security features, you’ll need to deploy Windows 10 to hardware that can support them. The most notable features are:

– Secure Boot: validates drivers and the Operating System loader for digital signature (so that malware can’t switch boot loaders)

– Device Guard: uses advanced hardware features (virtualization and TPM) to protect against threats

– Credential Guard: works on top of Device Guard to add additional protection by blocking access to credentials on domain-joined PCs when running an untrusted application, even if the app has full admin privileges

Windows 10 OSD Primer

These features require an advanced type of firmware called UEFI that supersedes the legacy BIOS firmware we’ve known for so many years. Newer systems commonly support both types of firmware. For a list of Windows 10 features requiring UEFI mode, see the following blog post:

http://deploymentresearch.com/Research/Post/514/List-of-Windows-10-features-that-requires-UEFI

The Windows 10 Creators Update released in early 2017 brought major enhancements to the Windows 10 Defense Stack. This includes major improvements to Windows Defender Advanced Threat Protection (ATP), which helps IT Pros track threats in their organization across endpoints. It enhances the security of Office 365 by providing the ability to track a virus down to the email that contains it. It even lets organizations send their own samples of malicious files found in their enterprise environment to Microsoft so the overall protection mechanism can be enhanced. The new release can also improve isolation and remediation times when threats enter the environment.

Upgrade Options – In-place vs. Wipe-and-load

In-place Upgrades

You’ll need to either upgrade in place, or wipe out existing data and install Windows 10 fresh (wipe-and-load). When you are sitting at a single PC, either one is fairly easy. When doing it for many systems remotely, the decision has broader ramifications.

The In-place Upgrade process will convert a Windows 7/8 system to Windows 10 while retaining all existing applications, settings, and data. Microsoft has built in extremely robust fallback options, so if something goes wrong, the In-place Upgrade can easily be undone with in 10 days. The process can be automated and handled remotely with deployment tools such as Configuration Manager and others.

For Windows 10 deployment, limitations with In-place Upgrades include: architecture (i.e., x86 to x64), BIOS->UEFI (more on this later), third-party disk encryption, Windows To Go, and dual- or multi-boot systems. In these scenarios, a wipe-and-load solution may be required.

For systems already running Windows 10, In-Place Upgrades will be the primary method for deploying Feature Updates.

Wipe-and-load

With wipe-and-load, the entire hard disk (or sometimes just a single boot partition), is effectively erased. The first step in a wipe-and-load process is to back up the user settings and data—also called state—so they can be restored into the new OS. For extremely light duty, such as migrating a few PCs manually, Microsoft refers people to partner laplink’s PC Mover Express product. Microsoft’s primary solution for administrators conducting large-scale, automated migrations is the User State Migration Tool (USMT). You can learn more about it here:

https://docs.microsoft.com/en-us/windows/deployment/usmt/usmt-overview

Once data is saved, then you can do any desired reconfiguration of the hardware. You may wish to erase or repartition the disk. Then you install Windows 10 on a clean system. In order to accomplish unattended, remote wipe-and-load, Preboot Execution Environment (PXE) is often used. A system can be told to look for a PXE point when it starts up. After a reboot, the system sends out a broadcast asking the other computers nearby if they are PXE points. A PXE point may then respond. The two systems communicate to establish connection, and then the PXE point delivers a Windows 10 installation boot image to the system and installation begins. This process is sometimes called “PXE booting.”

Windows 10 OSD Primer

Once the new OS is setup, you restore state using the same tool that saved it. Finally, you install applications, update drivers, apply desired settings, etc.

Larger companies often prefer wipe-and-load because it allows them to ensure that everything about a system is configured exactly as desired. Smaller organizations may like the In-place Upgrades because it is a much faster way to handle a smaller number of PCs. However, there is no hard-and-fast rule. Microsoft has made the In-Place Upgrade technology robust enough for enterprise deployment if desired.

Deployment Planning

Upgrade Readiness

Planning for Windows 10 in your environment has been simplified with the introduction of the cloud-based Upgrade Readiness (formerly Upgrade Analytics). This is a free service that collects analytics data from endpoints, and provides detailed insights in an online dashboard. Essentially, enterprises enable a telemetry engine that that sends anonymous information about each system to the cloud. It turns the telemetry data you send to Microsoft into actionable planning information. It provides hardware, driver, and application compatibility assessments. This makes it easy to know which machines are ready for Windows 10, and which ones will need help.

A migration workflow can guide you as you move everything to Windows 10. For example, the workflow will alert you if your system has incompatible drivers as well as define upgrade options. It may suggest that the driver will be replaced with an available inbox driver, or that there is no known driver in Windows 10 and therefore the PC is not a good candidate for upgrade without further testing. The same is true for your applications as the service compares what is in your environment to what is known to be working successfully in other Windows 10 installations. You can get even further insight into a large catalog of ISVs and their support statements for Windows 10 readiness of their applications (such as what versions work on Windows 10) by going to http://readyforwindows.com/. All this can even be integrated into Configuration Manager for unified reporting.

Choosing a Deployment Method

There are three mainstream options to choose from when deploying Windows 10 in your organization. While no one solution is incorrect, there are more limitations to some than others. The first option is to pick Microsoft Deployment Toolkit version 8443 (MDT 8443). MDT is a free deployment resource that allows admins to quickly standardize and automate both desktop and server operating system deployments. To deploy Windows 10 with MDT 8443, you need a file server with adequate disk space, the latest version of Windows 10 Assessment and Deployment Kit (ADK) and Windows Deployment Services (WDS) installed and configured on a server in the environment for PXE deployment support. You will need to use another tool to manage the endpoint afterwards such as Configuration Manager, Intune, or another third-party MDM solution.

The second option is to use Configuration Manager to both deploy and manage Windows 10. Generally speaking, if you want to deploy the latest version of Windows 10, you need to always be running the latest version of Configuration Manager Current Branch in your environment. You also need the latest version of the Windows 10 ADK. Should you require PXE support, that role will be configured and managed from within Configuration Manager itself. WDS, which provides the PXE support, is automatically installed and configured when you enable it from Configuration Manager. Once Windows 10 is installed, there are additional requirements to service it with Configuration Manager. Also, if you deploy and manage your PCs with Configuration Manager, you can add your Intune subscription for a hybrid setup to manage many types of scenarios.

Windows 10 OSD Primer

The third option is to use provisioning with Windows Configuration Designer (WCD) to create provisioning packages. These packages allow you to transform consumer installations of Windows 10 into a PC that can be used and managed by an organization. The authoring tool for creating these packages can be obtained for free through the Windows Store, or the Windows 10 ADK. Provisioning does not require PXE as it is a transformation package that can be pre-staged on the PC as it ships directly from the manufacturer, or it can be delivered to the end user via USB stick. PCs deployed by the provisioning method will need to be managed in the same way as PCs deployed by MDT.

Selecting AD GPO vs. MDM

Whether to use Group Policy or MDM to manage your PCs is a decision your organization should make before taking the Windows 10 plunge as it is much easier to plan for from the beginning. Group Policy is for Active Directory-only environments and requires the PC to be able to call home to get new policies. MDM is for modern environments where the PCs will roam and may never call home to a corporate network but still need to be managed.

New versions of Windows 10 will also bring new Group Policy Templates to manage new features (as well as improve management of older features). Technicians can download and import them for use in their domain environments. Security and Compliance Manager is also a powerful tool that allows you to create and export security baselines which can then be deployed via MDT, Configuration Manager, or Group Policy.

For PCs that will be managed by MDM and were previously managed by Group Policy, there is a new tool called MDM Migration Assessment Tool (MMAT). It allows you to generate a report of legacy group policy objects that can be converted to MDM policies, including which ones will need to be reworked because the scenarios are no longer supported.

Defining Deployment Rings

Deploying the Windows client Operating Systems is both a science and an art. Any deployment plan should be staged in rings, from a small number of technical users in the innermost to a huge number of non-technical users on the outer ring.

This diagram and Microsoft’s documentation gives more detail: https://docs.microsoft.com/en-us/windows/deployment/update/waas-deployment-rings-windows-10-updates.

The first ring is typically a small group within the IT department that gets new releases of the Current Branch first because they are the best equipped to handle any issues. The next ring should be done with the same Current Branch version. It should include additional IT test PCs, and a population of workers that represent different business units and can be counted on to provide prompt feedback on issues (and who are perhaps a bit patient and technically savvy than the typical end user). When the build is declared

Preview Ring 1 Ring 2 Ring 3 Ring 4 Ring 5

Insider Current Branch Current Branch for Business

Windows 10 OSD Primer

Current Branch for business, it should again be deployed in rings across business units until the entire organization is upgraded. While this process may seem overwhelming, it will become streamlined with experience.

Automating BIOS to UEFI

Many organizations are eager to use Windows 10 security features that require UEFI firmware, while many existing systems are running legacy BIOS firmware. Automatically converting systems from legacy BIOS to UEFI is a problem set of its own. PC vendors provide utilities to convert BIOS based PCs to UEFI mode, though of course these utilities only work on PCs that support UEFI. But there is another problem. UEFI uses a different kind of disk layout than legacy BIOS, so the machine has to be re-partitioned. Legacy BIOS uses a type of partition table called MBR while UEFI uses GPT. Prior to the Creators Update, the repartitioning process effectively wipes all data from the hard disk. So to migrate firmware to UEFI, technicians need to backup data and later restore it—but using a new utility (MBR2GPT.exe) released with Windows 10 Creators Update you can accomplish this in a non-destructive way.

The bottom line is that you can automate the conversion from legacy BIOS to UEFI, but you’ll need to plan carefully. Adaptiva offers a guide that will explain it all, and provide real-world examples and Configuration Manager Task Sequences to help in automating that process in your environment. You can download Adaptiva’s Secure 10: 2017 BIOS to UEFI Update on the SCCM Academy here http://www2.adaptiva.com/l/139131/2016-07-18/j7lfk. If you want to better understand how to use the new MBR2GPT.exe tool with just MDT, Microsoft provides an example here:

https://blogs.technet.microsoft.com/mniehaus/2017/04/14/moving-from-bios-to-uefi-with-mdt-8443/

Cumulative Updates and Express Installation

There are over 400 million devices running Windows 10. (If you’re into stats, check out Microsoft by the Numbers here https://news.microsoft.com/bythenumbers/windows-ten.) So even if your company hasn’t fully adopted a rollout plan, there are many that have gone before you. In late 2016, Microsoft announced a change to the way updates are delivered through the Unified Update Platform (UUP). The UUP is the Microsoft service that allows any device type to connect and download updates in smaller, optimized chunks. This is important for businesses because starting with Windows 10 1703 (Creators Update), Feature and Quality updates have moved to this platform that reduces the size of the updates that are delivered. This was needed because the Cumulative Updates to Windows 10 can grow to nearly 1GB in file size.

If you’re using Configuration Manager, you may have noticed that version 1702 brought support for express installation files for Windows 10. Beginning with Windows 10 1607 (as long as you have applied the April 2017 CU), you can reduce the size of updates that are delivered to the endpoints. Updates delivered on both the UUP and through Configuration Manager (when enabled) only deliver the differentials, or delta changes. By delivering a much smaller set of changes, you can save time, disk space, and bandwidth. However, Microsoft notes that there is a very large storage requirement on distribution point servers. So, beware that in this case what’s light on the client is heavy on the server.

Additional Tools and Resources

There are other important tools to take note of when preparing to deploy Windows 10. The first is that you need to be aware of what version of the Windows Assessment and Deployment Kit (ADK) is required to enable deployments of the client Operating System with MDT or Configuration Manager. You should deploy the latest version of Windows with the latest ADK that is released with it. The ADK is also backwards compatible, so you can deploy legacy client Operating Systems with newer versions of the ADK. The current support matrix of ADK version support for Configuration Manager can be found here:

https://docs.microsoft.com/en-us/sccm/core/plan-design/configs/support-for-windows-10

Windows 10 OSD Primer

Other tools of note for Windows 10 deployments are the Microsoft Desktop Optimization Pack (MDOP) which includes the popular Diagnostics and Recovery Tool (DaRT), a tool that can be added to your Configuration Manager boot images to allow remote access to PCs in the WinPE phase of deployment, and the Internet Explorer Administration Kit (IEAK) which allows you to create a custom configuration of Internet Explorer. For a full list of tools to consider for your Windows 10 deployments, check out this link:

https://docs.microsoft.com/en-us/windows/deployment/windows-deployment-scenarios-and-tools

Summary

This report drills down on the basics, but as you can see Windows 10 deployment and maintenance is a very deep topic. There is a lot to learn when planning for Windows 10 for your organization, and there are many tradeoffs to consider. The good news is that there is a wealth of information readily available on TechNet, in community blogs, and on our own SCCM Academy. Adaptiva provides guides for:

– Keeping your Windows 10 endpoints secure and healthy

– Questions to ask when choosing a Windows 10 OSD solution

– Converting from BIOS to UEFI (with support for MBR to GPT conversion) within two common deployment scenarios in Configuration Manager

– Detailed walkthroughs of feature highlights of the Technical Preview builds of Configuration Manager to help you plan for the changes to the platform while preparing to roll out Windows 10 in your organization

– Understanding the servicing of Windows 10 with Configuration Manager, with an explanation of how to setup and troubleshoot either scenario you decide is right for your organization

– Much more

Visit the SCCM Academy at: https://www.adaptiva.com/sccm-academy.

About Adaptiva

Adaptiva is a leading, global provider of smart scaling, network-aware IT systems management solutions, including OneSite™ and Client Health™. Adaptiva enables IT professionals to securely speed enterprise-wide software deployments without adding costly servers or throttling network bandwidth. The company’s breakthrough peer-to-peer technology uses intelligence, automation, and bandwidth optimization techniques to manage and secure endpoints faster than any other systems management solution available today. The company’s software is used by Fortune 500 companies and deployed on millions of devices in over 100 countries. Learn more at www.adaptiva.com, and follow the company at LinkedIn, Facebook and Twitter.