Prepare for Zero Touch Installation of Windows 10 with Configuration Manager
- Windows 10 versions 1507, 1511
For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see Scenarios to deploy enterprise operating systems with System Center Configuration Manager. Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see Support for Windows 10 for System Center Configuration Manager.
This topic will walk you through the process of integrating Microsoft System Center 2012 R2 Configuration Manager SP1 with Microsoft Deployment Toolkit (MDT) 2013 Update 2, as well as the other preparations needed to deploying Windows 10 via Zero Touch Installation. Additional preparations include the installation of hotfixes as well as activities that speed up the Pre-Boot Execution Environment (PXE).
In this topic, you will use an existing Configuration Manager server structure to prepare for operating system deployment. In addition to the base setup, the following configurations should be made in the Configuration Manager environment:
Active Directory Schema has been extended and System Management container created.
Active Directory Forest Discovery and Active Directory System Discovery have been enabled.
IP range boundaries and a boundary group for content and site assignment have been created.
The Configuration Manager reporting services point role has been added and configured
A file system folder structure for packages has been created.
A Configuration Manager console folder structure for packages has been created.
System Center 2012 R2 Configuration Manager SP1 and any additional Windows 10 prerequisites are installed.
For the purposes of this topic, we will use two machines: DC01 and CM01. DC01 is a domain controller and CM01 is a machine running Windows Server 2012 R2 Standard. DC01 and CM01 are both members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see Deploy Windows 10 with the Microsoft Deployment Toolkit.
To configure permissions for the various service accounts needed for operating system deployment in Configuration Manager, you use a role-based model. To create the Configuration Manager Join Domain account as well as the Configuration Manager Network Access account, follow these steps:
On DC01, using Active Directory User and Computers, browse to contoso.com / Contoso / Service Accounts.
Select the Service Accounts OU and create the CM_JD account using the following settings:
User logon name: CM_JD
User must change password at next logon: Clear
User cannot change password: Select
Password never expires: Select
Repeat the step, but for the CM_NAA account.
After creating the accounts, assign the following descriptions:
CM_JD: Configuration Manager Join Domain Account
CM_NAA: Configuration Manager Network Access Account
Figure 6. The Configuration Manager service accounts used for operating system deployment.
In order for the Configuration Manager Join Domain Account (CM_JD) to join machines into the contoso.com domain you need to configure permissions in Active Directory. These steps assume you have downloaded the sample Set-OUPermissions.ps1 script and copied it to C:\Setup\Scripts on DC01.
On DC01, log on as Administrator in the CONTOSO domain using the password P@ssw0rd.
In an elevated Windows PowerShell prompt (run as Administrator), run the following commands, pressing Enter after each command:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force Set-Location C:\Setup\Scripts .\Set-OUPermissions.ps1 -Account CM_JD -TargetOU "OU=Workstations,OU=Computers,OU=Contoso"
The Set-OUPermissions.ps1 script allows the CM_JD user account permissions to manage computer accounts in the Contoso / Computers / Workstations OU. The following is a list of the permissions being granted:
Scope: This object and all descendant objects
Create Computer objects
Delete Computer objects
Scope: Descendant Computer objects
Read All Properties
Write All Properties
Validated write to DNS host name
Validated write to service principal name
To support the packages you create in this section, the following folder structure should be created on the Configuration Manager primary site server (CM01):
In most production environments, the packages are stored on a Distributed File System (DFS) share or a "normal" server share, but in a lab environment you can store them on the site server.
Figure 7. The E:\Sources\OSD folder structure.
To extend the Configuration Manager console with MDT wizards and templates, you install MDT in the default location and run the integration setup. In these steps, we assume you have downloaded MDT to the C:\Setup\MDT2013 folder on CM01.
On CM01, log on as Administrator in the CONTOSO domain using the password P@ssw0rd.
Make sure the Configuration Manager Console is closed before continuing.
Using File Explorer, navigate to the C:\Setup\MDT folder.
Run the MDT setup (MicrosoftDeploymentToolkit2013_x64.msi), and use the default options in the setup wizard.
From the Start screen, run Configure ConfigManager Integration with the following settings:
Site Server Name: CM01.contoso.com
Site code: PS1
Figure 8. Set up the MDT integration with Configuration Manager.
Most organizations want to display their name during deployment. In this section, you configure the default Configuration Manager client settings with the Contoso organization name.
On CM01, using the Configuration Manager Console, in the Administration workspace, select Client Settings.
In the right pane, right-click Default Client Settings, and select Properties.
In the Computer Agent node, in the Organization name displayed in Software Center text box, type in Contoso and click OK.
Figure 9. Configure the organization name in client settings.
Figure 10. The Contoso organization name displayed during deployment.
Configuration Manager uses the Network Access account during the Windows 10 deployment process to access content on the distribution point(s). In this section, you configure the Network Access account.
Using the Configuration Manager Console, in the Administration workspace, expand Site Configuration and select Sites.
Right-click PS1 - Primary Site 1, select Configure Site Components, and then select Software Distribution.
In the Network Access Account tab, configure the CONTOSO\CM_NAA user account (select New Account) as the Network Access account. Use the new Verify option to verify that the account can connect to the \\DC01\sysvol network share.
Figure 11. Test the connection for the Network Access account.
Configuration Manager has many options for starting a deployment, but starting via PXE is certainly the most flexible in a large environment. In this section, you enable PXE on the CM01 distribution point.
In the Configuration Manager Console, in the Administration workspace, select Distribution Points.
Right-click the \\CM01.CONTOSO.COM distribution point and select Properties.
In the PXE tab, select the following settings:
Enable PXE support for clients
Allow this distribution point to respond to incoming PXE requests
Enable unknown computer support
Require a password when computers use PXE
Password and Confirm password: Passw0rd!
Figure 12. Configure the CM01 distribution point for PXE.
Using the Configuration Manager Trace Log Tool, review the E:\Program Files\Microsoft Configuration Manager\Logs\distmgr.log file. Look for ConfigurePXE and CcmInstallPXE lines.
Figure 13. The distmgr.log displays a successful configuration of PXE on the distribution point.
Verify that you have seven files in each of the folders E:\RemoteInstall\SMSBoot\x86 and E:\RemoteInstall\SMSBoot\x64.
Figure 14. The contents of the E:\RemoteInstall\SMSBoot\x64 folder after you enable PXE.