Configuration and Customization

In this chapter, you’ll learn best practices for image creation and customization. The methods discussed will primarily be applicable to the Windows 11 Enterprise and Education editions. If your environment also includes the Professional edition, you will find that some recommended settings do not work or apply as expected. Microsoft used to maintain an index of settings that only apply to Windows 10 Enterprise and Education editions; with the release of Windows 11, guidance has been removed on these settings for some reason. Windows 11 Education Edition (or SE) does have a few settings that can be changed on the device, listed here: https://packt.link/1BDUI.

In this chapter, we will cover the following topics:

• Evolution of Windows as a Service (WaaS)
• Image customization
• Microsoft Autopilot
• Upgrade expectations
• Security mitigation
• Security Compliance Toolkit (SCT)
• Microsoft telemetry

Evolution of WaaS

Microsoft has continued to evolve the WaaS journey with the release of Windows 11. Considering this, to help enterprise environments keep up, Microsoft has made significant investments in tools and process development focused on deployment, Autopilot being probably the best example.

While the tools changed, the idea of configuring and tweaking an image without having to go through time-consuming task sequence steps and rigorous and methodical tweaking of settings is certainly a boon for the enterprise administrator (and perhaps a bane for the deployment-focused IT professional). It’s my firm belief that IT is heading down a path where imaging (as we now know it) will be a thing of the past, where a Windows 11 machine can be plugged into a network, joined to Active Directory or Azure Active Directory (Azure AD), and policies are pushed down to configure the user experience (UX). I further suspect that eventually, a container-like technology will take hold...

Image customization

In an enterprise environment with many legacy applications and department configurations, deploying an image preconfigured and set up for the user makes a lot of sense. Standing up an MDT environment in an enterprise is a relatively easy task (usually, it takes more change in control/security procedures than actual install/setup time) that can be completed in an afternoon in most cases. Customizing the image is best done with reproducible tooling, and MDT will help with that as you can modify the default user profile.

This can be done for branding purposes or application delivery that stores itself entirely within the user profile folder structure. Once the customizations are completed, the profile is captured as the default administrator profile, so future logons inherit the customization.

Imaging process

Once your image is baked, you can take it and deploy it with System Center Configuration Manager (SCCM) or MDT or even give it to an original equipment...

Microsoft Autopilot

Microsoft Autopilot fills a gap in Bring Your Own Device (BYOD) scenarios, making IT organizations that use it more flexible on hardware acquisitions. Need to programmatically upgrade from the OEM-installed Windows Home SKU to Windows 11 Pro or Enterprise? No problem!

Microsoft Autopilot works by leveraging features available in Windows client OSes, Azure AD, and mobile device management (MDM) services such as Microsoft Intune, formerly Microsoft Endpoint Manager (MEM). Naturally, for someone to autopilot a computer from a typical store, an internet connection is required. DNS resolution for external names and ports 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP) need to be open.

The system in question authenticates with Azure AD. Once authentication happens, Microsoft Intune or another MDM solution can be used to trigger the enrollment of the device. Windows Update and Delivery Optimization are used to deliver updates, updated Microsoft Store applications, Office...

Upgrade expectations

Historically, when Windows upgraded, it carried all its baggage with it from the previous install (for better or for worse). Windows 10 and 11, however, seem to have deviated from this. Now, if an application is deemed incompatible with the build being upgraded to, the application will simply not be present in the post-upgrade operating system. One can use the /Compat command-line switch to automatically address compatibility issues. Documentation on this function is located here: https://packt.link/fv3OZ.

Windows should warn the user of this prior to upgrading and, if ignored, report this in a report file at C:\Windows\Panther named miglog.xml that the application was not migrated forward.

When first faced with this news, it is logical to assume that this is a complete disaster and a poor choice. However, consider the upgrade process as a guardian of sorts. The upgrade option will not be available if compatibility issues are present. If an application is...

Security mitigation

For the significance of Windows 11’s security focus, one simply needs to look at the news. It seems every day that another story emerges of a company or organization that has had ransomware installed and then been blackmailed into paying for an encryption key to regain access to their own data. A review of the work needed to protect from these types of attacks is worth the time.

Additionally, software products working in tandem with antivirus solutions, such as data loss prevention (DLP) software or even intrusion detection software/systems (IDS) can be used to protect organizations and their data from accidental or even intentional theft by third parties or rogue employees. The typical goal of an organization is to prevent their data from ending up on WikiLeaks, so any steps that can be taken toward that end are a good target for the enterprise administrator.

While prevention is all well and good, what about the aftermath of a detected intrusion? Are...

SCT

For those concerned with security, Microsoft has had the SCT for some time. This tool lets you take trusted secure baseline configurations from https://packt.link/OxKKv, Microsoft, and others and make them into Group Policies that you can import into your environment. Generally speaking, using this tool to securely configure your environment is preferred rather than going off into the woods on your own. The reasons for this are set out here:

• The guidelines are created by expert security entities and professionals.
• When you have trouble and have to get support, is it better to say We followed the SCT template for secure desktops or We did a bunch of tweaks to the registry and security settings and now it doesn’t work? The list of baselines is pretty comprehensive (Windows 11 is in the works at the time of writing and is available at https://packt.link/Mb2GF).

Note

For more information about SCM and its implications on security profiles, consult Chapter...

Microsoft telemetry

The advent of forced telemetry in Windows 10 caused a stir in the IT pro and enterprise administration space. For those unaware of this, Windows 10 and 11 keep logs of many activities performed on them and ship those (anonymized) data points back to Microsoft for advanced analytics. Before you panic, let us explore what is collected and why.

What is collected? Let’s take a look:

• The type of hardware being used
• Applications installed and usage details
• Reliability information on device drivers

Why is it collected?

Microsoft gives many reasons for collecting this data. The general takeaway here should be that Microsoft uses telemetry to do its best on the functionality of future versions, as well as spending the resources to fix problems in a real-world priority scenario. For example, in the past, if 10,000,000 crashes occurred in Explorer.exe daily in the world and they all had the same debugging call stack in them, Microsoft might...

Summary

As you can see, Windows 11 brings a lot to bear for enterprise administrators. But it is, again, a paradigm shift from the old Windows 7 image-crafting days. Carefully evaluate the capabilities at your disposal prior to starting your migration and adoption of this new technology, if possible.

In the next chapter, the administration of user accounts will be discussed, including local, domain, and Azure domain-joined accounts.