Configuration and Customization

In this chapter, the methods discussed will primarily be applicable to Windows 10 Enterprise and Education Editions. If your environment also includes the Professional Edition, you will find that some recommended settings do not work or apply as expected. Microsoft maintains an index of settings that only apply to Windows 10 Enterprise and Education editions; to know more, visit https://technet.microsoft.com/itpro/windows/manage/group-policies-for-enterprise-and-education-editions. You should note that these are subject to change from release to release.
In this chapter, we will learn the following:

• Windows as a service methodology
• Windows image configuration and customization options available to enterprise administrators
• New technologies that come with Windows 10 and enrich the user experience (for example, Cortana)
• Security configuration
• Windows...

Introducing Windows as a service

Microsoft has shifted design principles of Windows image configuration significantly between Windows 7 and Windows 10. Windows 10 and Server 2016 herald a new way of doing business for Microsoft, Windows as a service (WaaS). This is now the way Windows is being designed, implemented, and serviced throughout the world. In light of this, to help enterprise environments keep up, Microsoft appears to be making significant investments in tools and process development focused on deployment. This is likely to assist with the historically lengthy process of migrating and imaging machines. There is probably no better example than the availability of the Windows Configuration Designer in the Microsoft Store, as shown in the following screenshot:

While the tool changed, the idea of configuring and tweaking an image without having to go through time-consuming...

Cortana

One of the new features of Windows 10 is Cortana. A familiar entity from those who played the Halo^TM game series, Cortana is more than a pretty face in Windows 10. It is deeply embedded into the operating system, and application developers can very easily integrate into the voice controls of Cortana to launch or manage their applications. Two examples of Cortana at work are shown in the following screenshots:

For enterprise environments, Azure AD is leveraged to manage some of their behaviors, and therefore, enterprises using Azure AD should really investigate the capabilities of Cortana. Strong integration with Office 365 and Power BI are two compelling use cases Microsoft supports now. The addition of the Microsoft Bots SDK and Cortana skills kit make this a customizable platform for enterprises to leverage for their own internal applications.

We're not simply...

Security mitigation

For the significance of Windows 10's security focus, one simply needs to look at the news. It seems every day that another story emerges of a company or organization that has had ransomware installed and then been blackmailed into paying for an encryption key to regain access to their own data. A review of the work needed to protect from these types of attacks is worth the time.

One company, Third Tier, even has a kit they offer to help prevent this sort of intrusion on your network. From the Third Tier ransomware prevention kit site, http://www.thirdtier.net/ransomware-prevention-kit/, you can see that the package makes many modifications and recommendations, including group policies, WMI filtering, software restriction policies, blocking of known attack vectors, backups, recovery methods, and even training materials to teach users to be more security...

Image customization

In an enterprise environment with many legacy applications and department configurations, deploying an image preconfigured and set up for the user makes a lot of sense. Standing up a MDT environment in an enterprise is a relatively easy task (usually it takes more change in control/security procedures than actual install/setup time) that can be completed in an afternoon in most cases. Customizing the image is best done with reproducible tooling, and MDT will help with that as you can modify the default user profile.

That is, until all your applications are migrated to the Universal Windows Platform (UWP). For more information, visit https://docs.microsoft.com/en-us/windows/uwp/get-started/whats-a-uwp. Once this happens, your user profile/default application scenarios become a bit easier to plan and deploy. This is Microsoft's long-term vision for all applications...

Upgrade expectations

Historically, when Windows upgraded, it carried all its baggage with it from the previous install (for better or for worse). Windows 10, however, seems to have deviated from this. Now if an application is deemed incompatible with the build being upgraded to, the application will simply not be present in the post-upgrade operating system. Windows should warn the user of this prior to upgrade and, if ignored, report this in a report file at C:\Windows\Panther named miglog.xml that the application was not migrated forward.

When first faced with this news, it is logical to assume that this is a complete disaster and poor choice. However, consider the upgrade process as a guardian of sorts. After the upgrade, Microsoft would like you to be able to log in to the system and actually use it to do work. If an application is going to break the installation, why migrate...

Security Compliance Manager

For those concerned with security, Microsoft has had the Security Compliance Manager (SCM) for some time. This tool lets you take trusted secure baseline configurations from https://www.nist.gov/cyberframework, Microsoft, and others and make them into group policies that you can import into your environment. Generally speaking, using this tool to securely configure your environment is preferred rather than going off into the woods on your own. The reasons for this are:

• The guidelines are created by expert security entities and professionals.

• When you have trouble and have to get support, is it better to say we followed the SCM template for secure desktops or we did a bunch of tweaks to the registry and security settings and now it doesn't work. The list of baselines is pretty comprehensive (Windows 10 is in the works at the time of writing and...

Microsoft Windows Store for Business, also known as Private Store

The Microsoft Windows Store for Business, also known as Private Store, is a new feature in build 1607 that allows enterprise administrators the ability to publish for use only certain approved applications. Furthermore, the general Windows Store can be disabled via policy, so only Windows Store for Business is allowed to install UWP apps. Conceptually, the Windows Store for Business offering is akin to SCCM's application library offering.

There are some prerequisites to enable this functionality for the enterprise. The IT administrator needs Azure AD and Windows 10 to do the initial signup, administration, distribution of apps, and license management. For the full experience though, the employees themselves need Azure AD accounts as well. The requirements are listed and explained here: https://technet.microsoft...

Microsoft telemetry

The advent of forced telemetry in Windows 10 caused a stir in the IT Pro and Enterprise administration space. For those unaware of this, Windows 10 keeps logs of many activities performed on it and ships those (anonymized) data points back to Microsoft for advanced analytics. Before you panic, let's explore what is collected and why.

What is collected?

• Type of hardware being used
• Applications installed and usage details
• Reliability information on device drivers

Why is it collected?

Microsoft gives many reasons for collecting this data. The general takeaway here should be that Microsoft uses telemetry to do its best on the functionality of future versions as well as spending the resources to fix problems in a real-world priority scenario. For example, in the past, if 10,000,000 crashes occurred in Explorer.exe daily in the world and they all had the same...

Summary

As you can see, Windows 10, and particularly build 1703, brings a lot to bear for enterprise administrators. But it is, again, a paradigm shift from the old Windows 7 image-crafting days. Carefully evaluate the capabilities at your disposal prior to starting your migration and adoption of this new technology, if possible.

In the next chapter, the administration of user accounts will be discussed, including local, domain, and Azure domain joined accounts.