CHAP 2: DEPLOY AND UPDATE OPERATING SYSTEMS

Plan and implement Windows 10 by using dynamic deployment Windows 10 offers

organizations new and exciting methods for deploying the operating system to users.
Legacy image creation-based deployment methods will continue to be supported and
used. You can expect that the adoption of the new dynamic deployment methods will
gain traction in the modern workplace and will be featured in the MD-101 exam. You
need to understand when these methods should be implemented over traditional
methods.

PROF: Mr YANKIKA Jonas

 I- Appropriate deployment option
Evaluate and select an appropriate deployment option Dynamic provisioning of Windows
10 using modern tools including mobile device management solutions offers
organizations new deployment choices. Many of these options were not available when
deploying previous versions of Windows using traditional deployment methods. Table 1-1
provides a summary comparison between modern dynamic provisioning and traditional
deployment methods, which can also incorporate image creation.

PROF: Mr YANKIKA Jonas

 1- Traditional Deployment Methods

The traditional deployment methods are covered in Exam Ref MD-100 Windows 10 by Microsoft Press.
This book focuses on the modern deployment methods because these are most likely to be examined on
the MD-101 exam. The deployment choices available to an organization may be skewed by the existing
investment it has made in traditional deployment methods and infrastructure. This may include reliance
upon on-premises tools and procedures, such as using Microsoft Deployment Toolkit (MDT) and System
Center Configuration Manager (SCCM) for Windows 7 and newer versions. These tools will continue to be
supported and can be used to support traditional deployment methods, such as bare metal, refresh, and
replace scenarios. 1/81 You should understand the modern alternatives to the traditional methods, and
these will be emphasized throughout this book and tested extensively on the MD-101 exam.

PROF: Mr YANKIKA Jonas

 2- Dynamic provisioning

Dynamic provisioning You should see a theme throughout this book, which is to
recommend an alternative method of provisioning client devices to the traditional
approach, which would typically include the following stages: Purchase or re-provision a
device. Wipe the device. Replace the preinstalled operating system with a customized
image. Join an on-premises Active Directory. Apply Group Policy settings. Manage apps
using Configuration Manager. With a cloud-based deployment approach, the stages are
simplified to the following:
 Purchase or re-provision a device.
 Apply a transformation to the preinstalled operating system.
 Join Azure AD.
 Manage the use of Mobile Device Management.
 Use MDM to enforce compliance with corporate policies and to add or remove apps.

PROF: Mr YANKIKA Jonas

 3- Provisioning packages

The types of transformations that are currently available using dynamic provisioning include:
 Provisioning packages A provisioning package is created using the Windows Configuration Designer and
can be used to send one or more configurations to apps and settings on a device.
 Subscription Activation Windows 10 Subscription Activation allows you to automatically upgrade
devices with Windows 10 Pro to Windows 10 Enterprise without needing to enter a product key or
perform a restart.
 Azure AD join with automatic MDM enrollment A device can be joined to Azure AD and automatically
enrolled into the organizational MDM solution by having users enter their work or school account
details.
 Once enrolled, MDM will configure the device to the organization’s policie
 4- Provisioning packages
Provisioning packages are created using the Windows Configuration Designer (WCD),
which is included in the Windows Assessment and Deployment Kit (Windows ADK). You
can also download the standalone Windows Configuration Designer app from the
Microsoft Store. Note Download Windows Adk 2/81 You can download the Windows ADK
from the Microsoft website at https://docs.microsoft.com/windowshardware/get-
started/adk-install. Ensure that you download the version of the Windows ADK that
matches the version of Windows 10 that you intend to deploy. If you are used to using
Group Policy Objects (GPOs), you could draw some similarities between GPOs and
provisioning packages, such as they use very small configuration files and they are used to
modify existing Windows 10 installations and configure their runtime settings.
 5- A provisioning package performance
A provisioning package can perform a variety of functions, such as:
 Configure the computer name and user accounts.
 Add the computer to a domain.
 Upgrade the Windows 10 version, such as Windows 10 Home to Windows 10
Enterprise.
 Configure the Windows user interface.
 Add additional files or install apps. Remove installed software.
 Configure network connectivity settings. Install certificates.
 Implement security settings. Reset Windows 10.
 Run PowerShell scripts.
 1- Retail and Oem Activation
Organizations with Enterprise Agreements (EA) can use volume activation methods. These provide tools
and services that allow activation to be automated and deployed at scale.
 These tools and services include Active Directory–based activation This is an automated service that,
once installed, uses Active Directory Directory Services (AD DS) to store activation objects. This
simplifies the maintenance of volume activation services for an enterprise. Activation requests are
processed automatically as devices authenticate to the Active Directory domain.
 Key Management Service (KMS) This is an automated service that is hosted on a computer within your
domain-based network. All volume editions of Windows 10 periodically connect to the KMS host to
request activation.
 Multiple activation key (MAK) Enterprises purchase product keys that allow a specific number of
Windows 10 devices to be activated using the Microsoft activation servers on the internet.
 All the above enterprise activation methods utilize services found within traditional on-premises, domain-
based environments. An alternative method of activation is required to meet the needs of devices that
are registered to cloud-based authentication and identity services, such as Azure Active Directory.
Subscription Activation allows your organization’s Azure AD tenant to be associated with an existing
Enterprise Agreement; all valid devices that are connected to that tenant will be automatically activated.
Eligible licenses that can use Subscription Activation include Windows 10 Enterprise E3 or E5 licenses
obtained as part of an Enterprise Agreement Devices containing a firmware-embedded activation key
Windows 10 Enterprise E3 in CSP (Cloud Solution Provider), which is offered as a subscription for small-
and medium-sized organizations, from one to hundreds of users

PROF: Mr YANKIKA Jonas

 2- Subscription Activation

Organizations must meet the following requirements to implement Subscription Activation: Enterprise
Agreement or a Microsoft Products and Services Agreement (MPSA) associated with the organization’s
Azure AD tenant. Windows 10 Pro or Windows 10 Enterprise is installed on the devices you want to
upgrade. Azure AD for identity management. All devices are either Azure AD–joined or are members of
an AD DS domain that is synchronized to Azure AD using Azure AD Connect. 7/81 If all the requirements
are met, when a licensed user signs in using his or her Azure AD credentials using a device, the operating
system switches from Windows 10 Pro to Windows 10 Enterprise and all Windows 10 Enterprise
features are then available. This process takes place without entering a product key and without
requiring that users restart their computers.

PROF: Mr YANKIKA Jonas

 III- Manage pilot deployment

Manage pilot deployment Embarking on any new project should be carefully planned ahead of
time so that the delivery can be given every chance of success. This is especially applicable when
deploying Windows 10 within an enterprise environment. There are several tools and services
available to help evaluate, learn, and implement Windows 10. By following best practices and
avoiding making deployment mistakes, you can ensure that your users are productive and that the
project is delivered on schedule. Windows 10 is released using a continuous delivery model
known as Windows as a Service, with a new version of Windows 10 available every six months.
Therefore, the skills you learn in deploying Windows 10 to your users will be reused again, and
often.

PROF: Mr YANKIKA Jonas

 1- Plan pilot deployments

Plan pilot deployments In this lesson, we have focused on the modern deployment technologies that
are likely to be tested on the MD-101 exam. Each organization is different, and therefore, you need to
determine which deployment method (or methods) you will use. For example, you may choose to
deploy new devices to your remote sales force using Windows Autopilot and perform an in-place
upgrade of your head office computers using the in-place upgrade method. To make effective
decisions relating to the deployment method, you should perform testing in a non-production
environment, and if you are successful, you should proceed to roll out Windows 10 to a small group
of users. By breaking down your Windows 10 deployment project into multiple stages, you can
identify any possible issues and determine solutions where available. This will involve documenting
and obtaining feedback from stakeholders at each stage. The first stage of deploying the operating
system will be with a pilot deployment.
As part of the pilot, it is important to determine the following:

-Production hardware, including PCs, laptops, and tablets, meets the minimum
hardware requirements for Windows 10.
-Peripherals, such as printers, scanners, projectors, and other devices, are
compatible with Windows 10.
-All required device drivers are available. All apps required following the
deployment will work on Windows 10.
-Any existing third-party disk encryption will work with Windows 10 (alternatively
replaced with BitLocker Drive Encryption).
-Your IT support staff has the necessary skills to support Windows 10
 4- Identify hardware requirements for Windows 10

Identify hardware requirements for Windows 10 As part of your planning

considerations, you should review the system requirements for installing Windows
10. Windows 10 can run adequately on hardware of a similar specification that
supports Windows 8.1. Consequently, most of the computers in use within
organizations today are Windows 10–capable. However, to get the best from
Windows 10, you might consider installing the operating system on the computers
and devices that exceed the minimum specifications described in Table 1-2.
 III- implement Windows 10 by using Windows Autopilot
Within a domain-based environment, deploying new devices to users has become
increasingly complex. There are many “moving” parts and components, and each one
needs to work precisely to ensure devices are compliant, secure, and usable. This is
partly due to the granular nature of the tooling used to ensure that devices comply
with strict organizational security requirements. Windows Autopilot is a solution that
radically changes this approach while allowing IT administrators to deploy secure and
compliant devices. You need to understand how to plan and implement Windows 10
within an organization using Windows Autopilot. This skill explores the planning,
example scenarios, and installation requirements for the application of Windows
Autopilot
1- Evaluate and select an appropriate deployment option
2- Windows Autopilot deployment scenarios
 3- Licensing Requirements

The following licensing requirements must be met: Devices must be pre-installed

with Windows 10 Pro, Pro Education, Pro for Workstations, Enterprise, or
Education Version 1703 or higher. Azure AD Premium P1 or P2. Microsoft Intune
or another MDM solution to manage your devices
 3- Networking Configuration

The following network configuration requirements must be met: Devices must have
access to the internet. Devices must be able to access cloud services used by
Windows Autopilot: Using DNS name resolution. Firewall access through port 80
(for HTTP), port 443 (for HTTPS) and port 123 (for UDP and NTP). The following
URLs need to be accessible:
 4- Azure Ad Configuration Prerequisites

The following Azure AD configuration prerequisites must be met: Azure AD

company branding must be configured. Azure AD automatic enrollment needs to be
configured. A device must be registered with Azure AD. Users must have
permissions to join devices into Azure AD.
 5- Implement pilot deployment Windows Autopilot

Implement pilot deployment Windows Autopilot is not complex to configure and use, though there are several services that need to work together
for your users to see a seamless out-of-box experience. After completing the prerequisites needed for Windows Autopilot, you may want to
practice using Windows Autopilot to provision Windows 10 in test lab using virtual machines. Once you have the basic functionality working,
you can explore the additional features that are available; these features can be used to streamline the deployment process or personalize the
experience for the user. These enhancements currently include: Device Groups Creating device groups with Azure AD allows you to separate
devices into logical groupings. Dynamic Groups You can use Azure AD Dynamic Groups to simplify device group management. Devices are
automatically added to the dynamic group if they meet the group membership criteria outlined in the rules. Deployment Profiles You can create a
single default deployment profile for your whole organization, or you can create additional deployment profiles and assign them to device groups.
Personalization Windows Autopilot allows you to assign a username and a friendly name to a
specific device. During OOBE, the friendly name is then shown to the user. This feature
requires Windows 10 Version 1809 or newer. Enrollment Status Page During device enrollment
into Microsoft Intune, users will be shown a progress status page, as shown in Figure 1-4
 IV- TROUBLESHOOT DEPLOYMENT
Troubleshoot deployment Before you can resolve an issue with Windows Autopilot,
you need to identify in which part of the overall process the problem is occurring.
The Windows Autopilot process can be broken down into logical stages. Network
connectivity Establish an internet connection and connect to the Windows Autopilot
service. Deployment profile and OOBE A deployment profile will be delivered to
the device to manage the Out-OfBox Experience (or OOBE). The OOBE will
complete using the settings within the deployment profile. Azure AD Has Azure AD
been configured correctly? For user-driven deployments, users need to enter their
Azure AD credentials to join the device to Azure AD. MDM enrollment issues After
being auto enrolled into the MDM service, any policies, settings, and apps will be
delivered to the device.
 1- Network connectivity

Can the device access the Windows Autopilot services? Windows Autopilot requires
internet access. Ensure that specific network requirements are met, including
firewall port settings and DNS name resolution. Only Windows 10 Version 1703 or
later can connect to the Windows Autopilot deployment service.
 2- Deployment Profile & OOBE

There are settings in the deployment profile that configure the Out-Of-Box Experience. You
should focus your troubleshooting on whether The device has received its deployment profile. A
deployment profile has been assigned to the device. The correct deployment profile type has been
assigned to the device; for example, is the device a kiosk? The assigned deployment profile
settings are correct; for example, has the Administrator account creation been configured by
accident?
 3- Azure AD

In the final stage of the Windows Autopilot process, the device will be enrolled into Mobile
Device Management. If MDM fails, then policies, settings, and apps will not be deployed to
the device. You should focus your troubleshooting on the following things: The Enrollment
Status Page is useful for troubleshooting MDM issues. Has the user been assigned an Intune
license? Ensure that users have not exceeded their device enrollment limits.
 4- Error Codes

Whenever a major issue occurs when using Windows Autopilot, an error code will
be generated. Some error codes can be viewed on the device whenever a problem
occurs during setup. Also, error codes can be viewed using the Event Trace for
Windows tool. 25/81 Some common error codes relating to Windows Autopilot are
shown in Table
 5- Identify upgrade and downgrade paths

When planning to deploy Windows 10, you should consider whether your existing
version of Windows can be directly upgraded to Windows 10 and whether you can
migrate from one edition of Windows 10 to a different edition of the same release. So
long as you are running Windows 7 or a later operating system, you can upgrade to
Windows 10. This includes upgrading from one release of Windows 10, such as Version
1703, to a later release, such as Windows 10 Version 1903...