Windows 10 built-in apps are typically removed in many corporate environments and can be difficult to remove as part of an SCCM or MDT OS deployment task sequence. This blog post “Removing Windows 10 Built-in Apps Offline WinPE Quick Guide” will provide the step-by-step instructions on how to successfully remove the Windows 10 Built-in apps during the WinPE phase (OFFLINE) of an SCCM or MDT deployment task sequence. The good news is Microsoft has a working PowerShell script created by Michael Niehaus that was published a few years ago but still works beautifully. In addition, the Microsoft provided script properly logs the removal results to the standard C:\Windows\CCM\Logs folder Post-OS deployment.[Read more…] about Removing Windows 10 Built-in Apps Offline WinPE Quick Guide
In the Windows 10 servicing approach (WaaS) keeping the deployment media/image up to date with the latest updates can be a challenge and confusing at times. In this blog post – “Quick Start Guide Windows 10 WaaS Servicing Updates Using OSDBuilder” I will outline the quick steps required to update the Windows 10 or Server 2019/2016 ISO media that is used during SCCM or MDT OS deployment. Using OSDBuilder developed and maintained by David Segura (OSDBuilder.com) is currently the best PowerShell module to perform offline servicing that ensures the Windows 10 ISO media (or Image) is up-to-date including enabling .NET 3.5, installing the updated OneDriveSetup and more. Moving away from building custom images (WIMs) in modern Windows 10 management is the best approach when possible. Once the ISO media is updated using this approach you only have to run a few commands each month Microsoft releases updates and re-import the current updated WIM or ISO source files for In-Place Windows 10 upgrades.[Read more…] about Quick Start Guide Windows 10 WaaS Servicing Updates via OSDBuilder
With the release of Windows 10 1809 and the current spring 1903 version, Microsoft changed the way the Remote Server Administration Tools (RSAT) gets installed. With Windows 10 1809+ the Feature On Demand option must be used vs manually downloading the RSAT MSU installer from previous versions of Windows 10. There are PowerShell scripts you can find to install RSAT for 1903 and 1809 while the PC is ONLINE but that requires the task sequence have access to the internet during MDT or SCCM OS Deployment. However, in this post (Quick Start Guide RSAT W10 1903 Offline FOD – SCCM-MDT OSD), I will outline how to do this in an OFFLINE approach without the need for an internet connection when the OSD task sequence runs for Windows 10 1903. Sure a proxy service account can be used by an SCCM task sequence step but this approach removes that need.[Read more…] about Quick Start Guide RSAT Windows 10 1903 Offline FOD – SCCM-MDT OSD
Recently, I read an excellent blog post about how a security firm outlined how they could extract the Bitlocker keys from a TPM 1.2 or TPM 2.0 device. This brute force penetration attack (test) was possible because the Bitlocker OS drive did not have a startup PIN enabled but simply a Bitlocker encrypted volume. Denis Andzakovic with Pulse Security (based in New Zealand) detailed how he was able to use open source and logic analyzer tools to extract the VMK (Volume Master Key) to ultimately decrypt the drive.[Read more…] about Require Startup TPM+PIN for Bitlocker Encryption | Enterprise Security
This Windows Server 2019 Active Directory installation beginners guide will provide step-by-step illustrated instructions to create a NEW AD forest, DNS and DHCP services. In addition, I will reference the security recommendations from Microsoft and StigViewer for new Domain Controllers that can be used for server security hardening. Sure you can use a Hydration Kit or other tools to automatically create a domain, DNS, DHCP, and SCCM ConfigMgr server. However, learning from the ground up helps to re-enforce Microsoft concepts and is a great way to learn and troubleshoot using a separate environment. Building a development AD environment is also good to test Windows 10 group policy settings, newer Windows 10 releases, SCCM OSD, Azure cloud services and more.
This blog post can also be used for Server 2016 since the Forest and Domain Functional levels are the same.[Read more…] about Windows Server 2019 – Active Directory Installation Beginners Guide
This blog post will outline how to create an Azure AD Dynamic Group for different device model types such as Dell, HP, Hyper-V Virtual Machine and Vmware Virtual Machines. I hope this blog post can provide assistance, and be a helpful quick guide. To deploy specific applications, BIOS updates or settings to a particular hardware model in Intune, manually added devices to Azure AD groups is not practical. This is especially true for companies that have thousands of devices and many hardware models. In addition, installing VMware Tools or configurations for Hyper-V VMs are common needs for IT admins.
The first task that needs to be performed is running the wmic command to gather the correct model name as listed within WMI. We can gather this information from a command line prompt using the below WMIC syntax.[Read more…] about Create Azure AD Dynamic Group for Model Type | Helpful Quick Guide