Advanced Configurations

Generally speaking, past iterations of Windows allowed something of a free for all mentality in customizing images and Windows installations. It is worth noting that most of the techniques developed by IT professionals outside of Microsoft's walls were not truly supported by Microsoft. They however certainly achieved the goals of the IT professionals to customize the Windows installation for the required business use case. Usually, the solutions were stable (enough), and Microsoft provided best effort support when issues arose, so things were good.

As IT organizations in large enterprises matured, however, business folks became involved more in the IT process. ISO, Information Technology Infrastructure Library (ITIL), change review boards, procedures, and so on all came into the IT realm. At this point, the best effort and stable (enough) aspects of...

Virtual desktops

There is perhaps no greater of a deviation from the standard Microsoft vision of Windows than virtual desktops. For those unfamiliar with the topic, the concept is that an installation of Windows is contained in a virtual machine on a host, and the host then holds as many virtual machines as it can to increase density and cost savings for the infrastructure.

Brian Madden wrote a book discussing this triangle sort of problem called VDI Delusion. The crux of the issue is that Virtual Desktop Infrastructure (VDI) items such as virtual hosts, high-speed storage, network devices, expensive software licenses, and other technologies quickly add to a large bill. Most organizations tend to think VDI means cost savings; this could not be further from the truth in many instances.

In my opinion, VDI projects that succeed are based on the concepts of control, user experience...

The Windows ICD

In the not-so-distant past, it was quite common place for an IT administrator to purchase a computer with a perfectly good Windows OS preinstalled and then bring it into the corporate environment by re-imaging with a corporate image. The reasons for this vary from organization to organization, but often contain the usual suspects of Original Equipment Manufacturer (OEM) installed cruft, trial applications, or even the wrong SKU of Windows. This is a rather inefficient process that needlessly throws out the whole operating system when only a small subset needs to be reconfigured.

With Windows 10, Microsoft is aiming to change this behavior through a technology known as provisioning packages. Provisioning packages are configuration bundles that can set core OS settings as well as install drivers or applications. There is, perhaps, no better indication of Microsoft...

Windows 10 Kiosk Mode

Windows 10 Kiosk Mode is a feature of Windows 10 designed for use in limited security or multi-user environments to restrict access to a single application. In a scenario such as an interactive directory in a building lobby, a device will need to provide the building directory functionality to many users without requiring the users to authenticate. It will also need to restrict users from accessing any applications outside of the directory application.

In order to accomplish this, Kiosk mode replaces Windows Explorer, the default shell, with an alternative application specified by the administrator. By replacing the default shell, access to the underlying Windows installation is removed and is limited to the specified application. When the replacement shell application is closed, the user session is ended, so there is no way to access the underlying operating...

AutoPilot mode

Windows AutoPilot is system management without the servers. Similar to Microsoft's InTune or SCCM, Windows AutoPilot can be used to manage devices. It requires Azure AD and some cloud-based services but the result is you can configure and tweak your devices and recover/reconfigure them quite easily without the infrastructure costs associated with a traditional SCCM multi-site deployment architecture.

At the time of writing this book, the current capabilities of AutoPilot are:

• Automatically join devices to Azure AD
• Auto-enroll devices into MDM services, such as Microsoft Intune (requires an Azure AD Premium subscription: https://docs.microsoft.com/en-us/windows/deployment/windows-10-auto-pilot#prerequisites)
• Restrict the administrator account creation
• Create and auto-assign devices to configuration groups based on a device's profile
• Customize Out of Box...

Device lockdown

Windows 8 was the last Microsoft OS to deliver an embedded edition as a formal SKU. In Windows 10, the customization may be applied directly to a Windows 10 Enterprise (or Education) installation or image file. The customization available to modify the image is found in Windows features under the device lockdown area. Those who have crafted images for Windows Embedded in the past will recognize the options and be familiar with the capabilities already. Certainly, they are worth covering in this text for a clear understanding of what these capabilities are and aren't. These features are available only in Windows 10 Enterprise and Education editions, yet are visible on a Windows 10 Professional installation. They may or may not work properly though on Professional and likely violate license terms if they do; your mileage may vary:

Device Lockdown consists of...

Summary

In this chapter, we touched upon many different topics relating to customizing and configuring the Windows image for enterprise use cases: point of sale, medical devices, kiosks in public areas, and virtualized desktops to name a few. Windows 10 can be customized in a variety of ways to meet the needs of a changing world. The good news primarily is that these modifications are coming more in the supported and standardized realm by Microsoft rather than random reghacks and tweaks that might work now and have unintended consequences later on.