Issues Customizing/Deploying Windows 10

[Kops]

Hey everyone,

 

We recently built a new SCCM 1602 site to replace our aging SCCM 2012 server and migrated all clients/resources. Everything went pretty smooth . We have now received a new batch of Lenovo X1 Yoga laptops and have decided to do a Windows 10 pilot/rollout along with this. A colleague is looking into the backend Windows 10 requirements (some new group policies and a few other things) and I am to prepare SCCM for Windows 10 deployments.

 

I approached this the same way I approached Windows 7 imaging/deployment in the past...

 

- Installed Windows 10 on laptop

- Made some small customizations (disable 'item checkboxes' in file browser, show 'This PC' on the desktop, set sleep/power options, create local user accounts, show/hide certain taskbar icons, perform windows updates, etc)

- Captured reference image

- Created unattend.xml file using Windows SIM on a different PC

- Uploaded reference image/drivers/unattend file to SCCM, distributed content

- Build task sequence

- Deployed

 

The image deployed but with a few issues..

 

- Local and Domain Users are not getting the customizations I made (item checkboxes were enabled, did not show 'This PC' on desktop, not showing/hiding proper taskbar icons).

- Start Menu would not open

 

My questions for you all.....

 

- Am I deploying Windows 10 right?

- Can someone provide some resources for creating answer files in Windows 10?

- Best practice for creating user profile customizations like listed above, and have them applied to all user accounts who log in? (CopyProfile not working in Win10?)

 

I investigated MDT a little bit but I think that these basic functions should be achievable in SCCM without the added complexity of MDT. If MDT is truly the better way to go, any advice on learning to use that tool?

 

Your help is much appreciated

[YPCC]

Most vital one is copyprofile isnt really supported well in windows 10. Lots of issues reported about it breaking the start menu etc. Sccm uses the SYSTEM user account to perform actions therefore many user level customisations are lost if you dont use copyprofile. So youre stuck between a rock and a hard place.

 

I found manipulating the default registry is the most reliable way to retain user level customisations.

[YPCC]

Also you should always create your reference image on a virtual machine. Its simple, allows snapshots etc and zero risk of driver conflict.

[anyweb]

I agree with YPCC, stop using copyprofile and start using Virtual Machines for image building

[Kops]

Thanks for the input everyone. Sounds like there is some area for improvement in my image building process .

 

Just for my knowledge, when CopyProfile = True (in Win10 or Win7), which profile does it copy to the default? Does it use the account that is created during Windows install, or does this only work when using CTRL+SHIFT+F3 to enter Audit Mode?

 

There are certain things I'd like to have set to the default profile so that these settings apply to all users who login, just not sure how to set them anymore with Win10...

 

- Disable item checkboxes in Windows Explorer (can be set with reg keys but must it is a 'current user' setting, how would I apply these to all users that login in the future?)

- Configure some default desktop icons

- Hide on-screen-keyboard and language settings in taskbar

- Customize the taskbar notification area

[YPCC]

You need to create a script that:

 

Loads the default user registry

Adds/modifies the required reg entries

Unloads the default user registry

 

https://blogs.technet.microsoft.com/chad/2012/04/25/tip-49-how-do-you-set-default-user-profile-registry-settings/

 

Then you can disable copy profile. Your customisation will stick no matter what. It may not be how microsoft want you to do it, but its EXTREMELY reliable, providing you dont mess with the registry too much (modifying OS critical entries).

[Kops]

Thanks again for chiming in YPCC. I'm surprised that I haven't been able to find more workarounds online, I can't be the only one trying to customize user profiles in Win10?

 

Took a little digging around but I was able to make (almost) all the customizations I wanted in HKCU. For this case, I guess what I'll want to do is load the NTUser.dat from the default profile, and make the edits to HKU:\DefaultProfile instead of HKCU - sound about right?

 

 

#Load the Default Profile NTUser.dat file into Registry

reg load HKU\DefaultProfile C:\Users\default\ntuser.dat

#Disables Item Checkboxes in File Explorer

New-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "AutoCheckSelect" -PropertyType DWord -Value "0" -force

#Creates shortcut to "This PC" on Desktop

New-Item -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\"

New-Item -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel"

New-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" -Name "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" -PropertyType Dword -Value "0" -force

#Hides Touch Keyboard Button on Taskbar

New-Item -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\TabletTip\"

New-Item -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\TabletTip\1.7"

New-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\TabletTip\1.7" -Name "TipbandDesiredVisibility" -PropertyType DWord -Value "0" -force

#Remove US Keyboard/Hide the Language Bar (requires reboot)

Remove-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Keyboard Layout\Preload\" -name "2"

#Set DPI scaling (requires log out/in)

New-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Control Panel\Desktop\" -name "Win8DPIScaling" -PropertyType Dword -value "1" -force

New-ItemProperty -path "Microsoft.PowerShell.Core\Registry::HKEY_USERS\DefaultProfile\Control Panel\Desktop\" -name "LogPixels" -PropertyType Dword -value "144" -force

#Load the Default Profile NTUser.dat file into Registry

reg unload HKU\DefaultProfile

A couple things to note...

- You cant use Powershell with HKU:\ directly, Powershell can't access that hive by that name....I have to write it as Microsoft.Powershell.Core\Registry::HKEY_Users, but this works so thats fine.

- The command to include This PC on the Desktop and Hide Touch Keyboard failed because the two keys preceding keys don't exist, had to include command to create them first (shown above in blue.. not sure if that will still give desired end result)

[Kops]

Just providing an update...

 

I was not able to get the above script to properly install/deploy as a part of the task sequence. SMSTS wasn't showing any errors or failures, but the registry edits were not being applied.

What I have done instead was this...

 

- Installed Win10 on reference PC (virtual or physical)

- Enter Audit Mode by pressing CTRL+SHIFT+F3

- Ran the above script which customizes the default profile

- Ran Windows Updates

- Captured Image

- Deployed

 

This is working. I can't make every customization I wanted but 95% of them are working and after dealing with this for a week already thats better than nothing. Hopefully some more long-term and reliable solutions will become available as Win10 matures. Thanks again everyone for your help, and if anyone has any other methods please do post them!