Moving to Windows 10. Mike Sandells Computing Services Department

Transcription

1 Moving to Windows 10 Mike Sandells Computing Services Department

2 Summary of our environment Russell Group University, 25,000 students, one main campus, no WAN. 2,900 Student PCs: 1,000 in bookable rooms; 1,200 in main libraries; 700 in dept centres. Any student in any centre; assume never the same PC twice. Automated overnight re-imaging, every few weeks or as needed. 7,500 Staff PCs: Imaged by supplier, by our technicians, or by self-service by staff. 350 desktop applications: Pre-installed where needed or available for self-service install. New/updated apps requested frequently. Citrix service for remote app access. Small-scale VDI for postgrads. Slide 2

3 Our environment: In-House Tools Although we have SCCM and various other management utilities, we rely on in-house systems for: OS Installation and Imaging (based on WADK tools). Application Installation. Application Usage Statistics. Various other tools and utilities. Moving to Windows 10 mostly meant changes to these in-house systems, rather than upgrades to SCCM or similar. Slide 3

4 Typical approach to new Windows versions Staff side first. Keep existing Office version so that something remains familiar. Staff side: Testing > Proper Testing > Opt-in > Opt-out > Ask Us > No Option. Gradual rollout as PCs are replaced or reinstalled. Problems discovered while number of machines is still small. Student side: (Done every year for new apps, whether OS has changed or not.) Test centre and a number of test stations run from July. Tests OS and complete application set for upcoming academic year. Try to keep OS, Office, IE and any widely used apps constant over the year. Various means of getting application owners to go test things on new OS. Roll-out to centres during August. Slide 4

5 Windows 10 Planning for Student PCs Need stable versions and consistent interface across academic year. Students normally log in to a PC with no existing profile locally. Profile creation can be slow. Fast login achieved with roaming profiles plus folder redirection. Problems with Edge, Cortana and Start Menu for roaming users. Works fine on first login, breaks when moving to new PC. (Maybe fixed?) UWP apps provisioned during login, slowing things down. No demand for the UWP apps. Students use Chrome, not Edge or IE. So, use LTSB, plus ClassicShell for the start menu. It was that or stay with Windows 7... Slide 5

6 Windows 10 Planning for Staff PCs Much simpler: Staff typically have a main PC that they use regularly. Staff have local profiles. Profile creation happens once. The start menu works! So, using CBB by default. which means in-place upgrades. LTSB an option if self-installing. Staff may be installing PCs attached to equipment or for student use. 64bit-only for Windows 10. Complicated enough with branches and builds without bit-types as well. Slide 6

7 Windows 10 Approach Broadly, extended our existing systems to handle Windows 10. Just a question of getting existing systems to be aware of: Windows 10 as yet-another-windows-version. Branches. Build numbers (as opposed to Service Packs). UAC and Firewall. UEFI vs Legacy boot. No new infrastructure or other large changes. Postponed move to Office Slide 7

8 Tweaking the Installation In the image: Remove UWP apps from the installation image using DISM (CBB only): To List: Dism /image:<dir> /Get-ProvisionedAppxPackages To Remove: Dism /image:<dir> /Remove-ProvisionedAppxPackage /PackageName:Microsoft.XboxApp_ _... Etc. for other apps. Package names change from build to build. Make changes to HKLM registry before installation. Mount the image with dism then reg load the hives. Disable telemetry, change service startup, set policy keys. Make changes to the default user profile directly. Avoid copyprofile if you can it s been broken in various builds. Merge latest cumulative update. Get changes in place before boot, profile creation or domain join. Do later: Default file associations and start menu layout. Slide 8

9 Managing In-Place Upgrades Unavoidable for CBB if you want to keep getting security updates. Process does not honour the existing state of the machine: Hardware detection from scratch. (WOL) Services re-enabled. Default user profile replaced, ntuser.dat overwritten. UWP apps reappear. Requires 20GB free space during upgrade. Problem for small SSDs. Very slow can take an hour on traditional HDDs. Plan A Automate upgrade with a customised image and scripting: Tweaks in the image as before registry, app removal etc. Post-upgrade script puts the WOL settings back. Prevent access to Windows Update (use WSUS instead). No access to Windows Store as a side effect of above. Plan B Scheduled task to run on boot and fix things post-upgrade? Slide 9

10 Current Status Student PCs All Windows LTSB from August for 2016/17 academic year. Testing LTSB for 2017/18 academic year, with Office May stick with ClassicShell or use native start menu if it s stable. Staff PCs Proper testing from February Opt-in from April Opt-out from August Windows 7 likely to require CSD Technicians to install in near future. Currently around 75% Windows 7 : 25% Windows 10. (No 8/8.1) CBB (mostly) or LTSB. Anniversary Update (14393) in proper testing. but will skip and go direct to Creator s Update (15063). Slide 10

11 Things we ve learned Fragile if you stray from the expected use cases more so than earlier. Very consumer based. Enterprise side seems untested, even in LTSB. Roaming & redirection work, but new features don t work with them. Expecting files in appdata\local to persist. Various file locking problems ntuser.dat, desktop.ini. Likely to disappear at some point. Many compatibility issues with Edge. Tip: Edge honours most of the local intranet / trusted sites settings. And hardware for which only Windows 10 drivers exist. But, native USB3, better SSD support, high DPI support, DirectX, etc. Slide 11

12 Other Tips Proper testing, especially before any kind of big-bang rollout. Investigate the Automated Deployment Kit if you haven t already. Making changes to the installation materials saves time. Automate building images as well as deploying them. Much more consistent results. Multiple branches and frequent builds - you need to be able to slot them in. Experiment with the ISOs from the Windows Insider Preview program. If you encounter problems, raise this with Microsoft. They could do with more feedback from outside the consumer sector. Windows Insider Program for Business exists now: Slide 12

13 Questions? Now? Panel discussion in a few minutes Later? Feel free to me: Mike Sandells mikejs@liverpool.ac.uk Slide 13