Windows 10 Deployment and Security. Crissier Jean-Francois Ageneau

Transcription

1 Windows 10 Deployment and Security Crissier Jean-Francois Ageneau

2 Agenda 1. Plan 2. Build 3. Run 4. Challenges Crissier Bechtle IT-Forum Lausanne Jean-Francois Ageneau

3 Plan 10/03/2017 This is a placeholder text for a footer 3

4 Plan Windows 10 Build Development based on DevOps CB and CBB can be considered if you want all new features and apply lite configuration LTSB is recommended if Store is not plan and a deep image configuration is required Current Branch Latest release Windows Store (Universal Apps) Fast updates/upgrade Short-term support ~9months Current Branch for Business Latest release Windows Store (Universal Apps) Deferred updates Medium-term support ~18months Long Term Support Branch No Windows Store Cumulative Updates only Long-term support 10y Equivalent to Windows 7/8 product Enterprise edition only This is a placeholder text for a footer 4

5 Plan Windows 10 Editions Pro Domain Join X X Azure Directory Domain Join X X Enterprise Mode IE Windows To Go Branch cache Credential Guard Device Guard Windows Hello X X Windows Update For Business X X Managed User Experience Dynamics Provisioning X X Direct Access AppLocker Bitlocker X X Windows Information Protection (MDM) X X Enterprise X X X X X X X X This is a placeholder text for a footer 5

6 Plan Deployment Strategy Zero Touch Installation Require Configuration Manager with Microsoft Deployment Toolkit (MDT) Full automated upgrade to Windows 10 Full automated Windows 10 installation Lite Touch Installation Require MDT Some information must be set while installed User Driven Installation Require Configuration Manager with Microsoft Deployment Toolkit Delegate deployment to user Dynamic Provisionning Create configuration package Let users enroll his device This is a placeholder text for a footer 6

7 Plan Customization Corporate configuration Branding Wallpaper Taskbar Start menu Fonts Default user settings Desktop Icons Explorer configuration File associations Language Pack Applications set Office ERP Common tools Corporate applications Customization Applications Language Pack Hardware Drivers Windows This is a placeholder text for a footer 7

8 Plan Requirement Tools to deploy Windows 10 Configuration Manager Microsoft Deployment Toolkit ConfigMgr with MDT integration Imaging And Configuration Designer Windows AIK Manage Windows 10 Key Management Service to support Windows 10 activation ConfigMgr Current Branch to support Windows Servicing WSUS to support Windows 10 Servicing Application compatibility Testing process Using Microsoft App-V or equivalent when application is not compatible Hardware compatibility Ensure drivers pack availability from makers Validate UEFI Boot or Legacy boot This is a placeholder text for a footer 8

9 Plan Deployment Tools Capabilities Configuration Manager Manage computer life cycle Microsoft Deployment Toolkit Capture Operating System Deploy Operating System ConfigMgr with MDT integration Create User Driven Installation Zero Touch installation (ZTI) Imaging and Configuration Designer (ICD) Create PPKG file to apply dynamics provisionning (MDM) This is a placeholder text for a footer 9

10 Plan Deployment method PXE Deployment Windows Server DHCP Policy for dual boot on UEFI and BIOS IP Helper for TFTP signaling Windows Deployment Service (WDS) Customize TFTP to increase boot image loading USB Stick Use MDT or Configuration Manager to create it Create USB stick from scratch with Windows AIK Dynamic Provisioning (MDM) Create PPKG for MDM enrollment Windows to Go Boot Windows from USB Stick This is a placeholder text for a footer 10

11 Build This is a placeholder text for a footer 11

12 Build Reference Image WIM Installation time Task sequence complexity From Install.wim Fast Medium, depending of customization Capture corporate wim Fast to very slow depending of the size Easy Dynamic Provisionning N/A N/A OS Image update Fast Slow Fast Application Update Configuration Update Maintenance complexity Fast Slow Fast Fast Slow Fast Easy Medium Easy This is a placeholder text for a footer 12

13 Build Create Task Sequence Create task sequence Microsoft Deployment Toolkit (MDT) or Configuration Manager to create the task sequence Call Scripts Package Deploy application Deploy customization Activation Key Windows Update Domain Join Drivers injection Bios/UEFI upgrade This is a placeholder text for a footer 13

14 Build Customization Tools LGPO to capture and apply local GPO Settings (gpedit.msc) Create Unattend.xml to set offline parameters (Reginal settings, Timezone, LP, IE search engine ) Vscript, Powershell and Batch Scripts Dynamic provisioning package 10/03/2017 This is a placeholder text for a footer 14

15 Build Windows Hardening Local User Rights Assigment Deny access from the network to local account Deny access from RDP from local account Dedicated management server Remove all entries in Act as part of operating system Remove all entries in Debug Programs Disable Local Administrator account Create a new local administrator account Deploy EMET to protect memory from malware Local Security Settings Set minimum TLS session level Set minimum Kerberos ticket encryption Set UAC to deny rights elevation Disable recovery boot Titre Lieu Prénom Nom 15

16 Run 10/03/2017 This is a placeholder text for a footer 16

17 Run Windows 10 Build Upgrade Windows Servicing Easy to manage Easy to deploy Remove customization Reinstall all builtin apps Can t add additional tasks Standard OS Upgrade Keep customization Using task sequence from MDT or ConfigMgr Update drivers if needed Keep customization This is a placeholder text for a footer 18

18 Run User Experience Manage branding using GPO (Enterprise) Start Menu Task Bar Welcome screen Configuration Manager Deploy application for the user Set configuration baseline This is a placeholder text for a footer 19

19 Run Windows 10 Security Features Windows Hello for Business - Integrate with Active Directory from Windows 10 Build 1703 Windows Defender - Malware protection Microsoft Edge New generation browser Sandboxing Smartscreen as pishing protection Device Guard Credential Guard NTFS Access Level AppLocker Bitlocker This is a placeholder text for a footer 20

20 Challenges 10/03/2017 This is a placeholder text for a footer 22

21 Challenges Management Convergence Mobile Devices Workstations Windows 10 can be manage like mobile device Universal App are available on Windows 10 Azure Directory can manage Group Policy Windows 10 can be Azure Directory joined Crissier Bechtle IT-Forum Lausanne Jean-Francois Ageneau 23

22 Challenges Mobiles Devices Application store (MarketPlace, AppleStore ) Configuration BYOD ready New deployment style Profiles Mobiles Devices Mobile Application Management Dropbox like Mobile Device Management Active Sync This is a placeholder text for a footer 24

23 Challenges Workstations Classic Application deployment Manage computers and users configuration via GPO GPO Join Active Directory User profile redirection or roaming ConfigMgr MDT Workstations File Share Active Directory PKI This is a placeholder text for a footer 25

24 Challenges Cycle management User Ready OS Preparation User Ready Enterprise Integration Application Deployment OS Deployment Application Deployment This is a placeholder text for a footer 26

25 Vos questions. Informations supplémentaires : jean-francois.ageneau@bechtle.com Titre Lieu Prénom Nom 27