Windows enterprise ready deployment on SURFACE Pro4

The great Surface Pro4 device is out and due to its outstanding capabilities many companies consider to use it as a enterprise device. But therefore you want to deploy it also in an enterprise manner.

Lets see how this works.

Rule 1 for Surface is as with any other device.
USE THE LATEST FIRMWARE AND DRIVERS!  You get them here.
Checkout recent history of firmware and drivers here.

Rule 2 you need something that allows you to boot from PXE over network

Option A: Use the Surface Pro3 dockingstation or Surface Dock. That allows you to boot via network cable from PXE with Gbit speed. Benefit of the Surface Dock is: You can update the firmware on the dock itself. Also it allows the user to choose their own viewangle (regarding the kickstand) on the Surface Pro 3/4 device.

Option B: Use the Surface Ethernet Adapter. This here supports PXE. This here is my favour. As in reality sometimes a user want to user a wired connection as well. So the user has at least one option to use the dock or the USB adapter to get a wired connection.

The Ethernet adapters in both solutions use the same chipset and provide identical functionality. Both adapters support gigabit connectivity for optimal performance during deployment, and both support the ability to boot from the network (PXE boot) without additional hardware.

Option C: You may use a 3rd party USB ethernet adapter. I dont recommend this as you have to add the adapter specific drivers first to an USB stick with an PE image you boot from stick. Then the PE integrated setup (e.g. MDT) can access the network. I would avoid this. 

Then there is another pitfall you have to keep in mind.
But this is not related to Surface in general. It is more related to the fact that slim tablets do not have wired PXE builtin.



Most PXE related deployment solutions check the MAC address to identify a machine. Then you have two options.

Option 1. Simply disable identification and allow deployment to all machines (known and unknown. Therefore I would protect your deployment e.g. through MDT with a password. Also make sure that the naming convention does not use MAC).

Option 2. Make use of MDT in general as MDT doet not use the MAC address to identify an individual computer. But you have to make sure that WDS where MDT is relying on allows unknown and known devices as well (Option in WDS server properties).

When you plan to use SCCM instead then there is even a higher dependency on this.
Please check out this BLOG.

The last question is how to tell the Surface to boot into the PXE boot.

To boot a Surface device from an alternative boot device, follow these steps:

1. Ensure the Surface device is powered off.
2. Press and hold the Volume Down button.
3. Press and release the Power button.
4. After the system begins to boot from the USB stick or Ethernet adapter, release the Volume Down button.

Note:  In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the pre-installation environment and navigate the deployment wizard.

 

There would could be even more to share.

To get the full MS story you can also checkout this BLOG here.

Windows Update for Business - how it works?

 

With Threshold 2 (v1511) Microsoft introduces Windows Update for Business (often also shortened as WUB). This is a new option to keep your infrastructure up-to-date. Just to avoid confusion. This is a new option. All old methods like WSUS/SUS or Windows Update still working!

 

This brings two benefits.

1. You get more granular control

2. You can use Windows Update without the need to use WSUS server on premise.

But keep in mind you need either: Windows Pro or Windows Enterprise. As Homeuser you do not have this option. There is an unsupported registry hack available as GPOs are using registry values.

When you use the Windows Insider program these settings are fully ignored (by purpose!)

 

How does it work.

 

 

Its very simple. Use this GPO

 

 

You find this GPO (since v1511 checkout the versioning blog entry here):

 

Computer Configuration\Administrative Templates\Windows Components\Windows Updates

You can control the upgrades (newer branches) and updates (e.g. Patch Tuesday Updates) differently. Upgrades you can defer by months. Updates you can defer by weeks.

Updates for Windows Defender are out of scope. Signature updates were installed as soon as they are available.

When you link this GPO with different settings on different OUs (Organizational Units) you can control how long a specific update/upgrade is defered.

If you find that a specific update/upgrade will cause an issue and you need additional time to fix it you can pause this until the next update/upgrade cycle. The checkbox is removed automatically after the next upgrade/update version appears.

This illustrates the different waves you can implement. You can also define more rings if you want. Typically you would also decide to test first with Insider branch or with current branch. Take advantage of your key users (e.g. SAP key user) to do the business process testing. The process owners are typically the guys they can tell you if the business process still works (e.g. SAP order, order printing etc.)

 

 

 

Here you find additional informations:

https://technet.microsoft.com/en-us/library/mt598226

My video about Windows Update and Rollout (sorry it was my session at German Technical Summit. Therfore the slides and video is in German only!) If you hear bad noise just re-adjust and lower the audio volume level. Somehow the recording get mixed badly.

https://channel9.msdn.com/Events/microsoft-techncial-summit/Technical-Summit-2015-The-Next-Level/Windows-10-Neue-Wege-zum-Rollout-und-Update

 

Have fun and enjoy WUB ;-)

Fonts are missing after Windows 10 upgrade

Recently one of my friends in an international organization run into the issue that fonts from original Windows 10 RTW (July 2015) where missing after the upgrade to the next version (aka Windows 10 v1511 or Threshold 2)
 
For example, if the English (or German, Spanish...) version of Windows 10 was installed, then the Gautami, Meiryo, Narkism or PanEuropean font is missing.
 
Reason for this is that MS streamlined the space used on systems alot. Just think of tablets (32 GB or less) and co. To save storage space these optional fonts where removed (typically supporting languages not used in the targeted region)
 

 

For example, the Meiryo or Raavi font can be used for English, but they were added to Windows to support other languges: Meiryo was created to support Japanese; Raavi was created to support Panjabi or other languages written in Gurmukhi script. Most English (or German, Arabic, Ukrainian...) speakers don't use Gurmukhi or Japanese writing, but they still would all have these fonts on their system, and many others intended for particular languages.
 
For better understanding you may read this:
http://answers.microsoft.com/en-us/windows/forum/windows_10-start/some-fonts-are-missing-after-upgrade/95839dfa-0df2-4bc0-875a-fd6b57e61fe4?page=1
 
Now lets come to a solution for this issue.
 

Home users go here:

Simply wait. :-) A maintenance task will detect the language settings and install the associated optional font features. It may take a few days before this happens. Until then, you can always install any optional font feature manually using the steps described below.
 

Installing optional features independent of language settings

Any of the optional font features can be installed manually without needing to change language settings. Here's how—I'll use the Hebrew Supplemental Fonts feature as an example:

• Click the Start button.
• In Settings, click System.
• Click Apps & features.
• Click on the link, Manage optional features.
• If "Hebrew Supplemental Fonts" is not listed among the installed features, click on the "+" icon next to Add a feature.
• Scroll to find "Hebrew Supplemental Fonts". Click on that item, then click on Install.
• Click on the back arrow in the upper corner of the window.

You should see the Hebrew feature in the list as installed or in the process of being installed.
Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work.
Also note: If you are on a work machine, some businesses manage updates separately, in which case the optional features might not even be visible to you—when you go into Add a feature, you might not see the optional features listed. If that's your situation, please get help from your system administrator.
 

System Administrators go here:

You have also here 2 options. One for manual install and one for automatic via WSUS.

Option 1 (Manually):

Manually deliver the content using dism command from the current "Windows 10 Feature on Demand" DVD you can download from VLSC (Volume Licensing Service Center) or from MSDN.
 
There you find these fonts:
 

Behind these font family names you will find these fonts:

Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting

Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda

Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia

Cherokee Supplemental Fonts: Plantagenet Cherokee

Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei

Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU

Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah

Ethiopic Supplemental Fonts: Nyala

Gujarati Supplemental Fonts: Shruti

Gurmukhi Supplemental Fonts: Raavi

Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod

Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho

Kannada Supplemental Fonts: Tunga

Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran

Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe

Lao Supplemental Fonts: DokChampa, Lao UI

Malayalam Supplemental Fonts: Karthika

Odia Supplemental Fonts: Kalinga

Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro

Sinhala Supplemental Fonts: Iskoola Pota

Syriac Supplemental Fonts: Estrangelo Edessa

Tamil Supplemental Fonts: Latha, Vijaya

Telugu Supplemental Fonts: Gautami, Vani

Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC

 

 

Please keep in mind these fonts have mostly an english part with letters you will see in latin form like ABC. Also all the way down you will see in RAAVI font (which is part of Gurmukhi Supplemental Fonts) also for e.g. Panjabi characters. You may find these with the little tool "charmap.exe" (which is part of Windows since Win3.1)

Now lets see how to add them to the system.

Simply copy the font family files from DVD and use dism to inject them on or offline as you like.

DISM.exe /Online /Add-Capability /CapabilityName:Microsoft-Windows-LanguageFeatures-Fonts-Ethi-Package

With DISM.exe /Online /Get-Capabilities you should get a list of installed features (incl. fonts) from a system where everything is still fine before you upgrade.

More to learn about this you may find here:

https://msdn.microsoft.com/en-us/library/windows/hardware/mt171094(v=vs.85).aspx

 

 

Option 2 (WSUS):

You can deliver it through WSUS. But therefor you need to install another Hotfix.

Update to enable WSUS support for Windows 10 feature upgrades:
https://support.microsoft.com/en-us/kb/3095113

 

After installing this hotfix you will see this (before you need to sync catalog again).

 

 

 

 

Have fun and enjoy the solution.

 

 

 

 

 

 

 

 

 



Windows 10 reducing the disk footprint

There are some good and space saving news around Windows 10

  1. You do not need a recovery partition anymore (recimg.exe is removed!)

• Instead files for recovery are used from /Windows/WinSxS folder
• Space savings aprox. 4 GB
• Nearly up to date recovery
• All updates are included EXCEPT the last 30 days for a good reason (to prevent that you recover a situation where a recent update broke your system).

  2. Space savings thought "Compact OS"

• You can trigger it manually through COMPACT.EXE /CompactOS:always
• MDT 2013 Update1 Task Sequence
• SCCM 2012 R2 SP1 Task Sequence

And yes there are small drawbacks. As the OS files are compressed there is a little bit more utilization on OS file access as it also need to decompress the files. But with todays processors the impact is little compared to space savings. Just think about 32 GB tablets with allways low space.

Check the full story here with Mike Niehaus:
http://blogs.technet.com/b/mniehaus/archive/2015/09/16/windows-10-reducing-the-disk-footprint.aspx

 

Windows 10 deployment with SCCM 2012/vNext

Windows 10 deployment with SCCM looks like fun but!

First of all the image capture and deploy scenarios work fine as you have learned with Win7/Win8.

There is also a "supportability thing" to keep in mind:


Windows 10 Build Support 

(Threshold 1 - Build 10240 GA in July 2015)
(Threshold 2 - Build 10586 GA in November 2015):

• System Center 2012 Configuration Manager SP2 CU1

• System Center 2012 R2 Configuration Manager SP1 CU1

• System Center Configuration Manager (Min. TP3)

 

(Redstone - (Build 1xxxx TBD) GA in Summer 2016):

• System Center Configuration Manager (RTM GA expected end 2015)

This version adds new servicing capabilities needed for Redstone and beyond. To get FULL feature support for Windows 10 you should migrate to the latest ConfigMgr available.

Also ConfigMgr will introduce similar versioning as Windows Client as well.

To get more reference checkout here:
http://blogs.technet.com/b/configmgrteam/archive/2015/10/27/system-center-configmgr-support-for-win-10-and-intune.aspx