@x23piracy a windows service can impersonate one of the logged in users without their password. Essentially the service grabs a process running as the user you wish to impersonate, and obtains a handle on the process’s access token (OpenProcessToken). The service then needs to duplicate the token so it can “impersonate” the user without affecting the process we lifted the token from (DuplicateToken), activate that token, and then perform the work. Finally the token handle must be closed.

Its a pretty win32 api heavy approach. The client does not use this technique as there is no guarantee a user is logged in at any given point.

TL;DR: grab an existing process running as that user, and perform multiple win32 API calls to impersonate that user.

@lukebarone said in Windows 10 SysPrep not working:

@loosus456 Yea, I have no objection to that. But I can’t get the Taskbar Customization to work (even after fixing the .xml file that is generated), so I gave that part up. It resets the taskbar to just Edge and Explorer, and allows users to customize it how they wish.

Hi,

you need to apply taskbar customs via group policy, if so the user has change rights:

https://social.technet.microsoft.com/Forums/windows/en-US/83b725f4-90f8-476a-bba0-3193e4e47d2e/windows-10-1607-enterprise-taskbar-items-pinned-via-layoutmodificationxml-and?forum=win10itprosetup

IMPORTANT

If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe >process restarts. If your configuration pins an app and the user unpins that app, the user’s change will be overwritten the >next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will >persist, apply your configuration by using Group Policy.

https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-10-taskbar?f=255&MSPPError=-2147217396

What ever can be done by gpo should be done with gpo (ms philosopy). If you don’t have a domain controller for gpo applyment you can simply use gpedit.msc locally to set this on your golden image.

Regards X23

This feels much better!

Upgraded Fog to 1.4.4, and captured the image, deployed it, and was presented with my AD Login screen! It logged me in, then restarted… Then let me log in properly.

A couple things I need to change on the image, but over all, this is much better than where I was before! Thank you for the advice

@thesavagetony said in Capture and Deploy Question!:

Thanks! That’s what I was finding, but maybe I misunderstood the Wiki while following it.

Can you give me a link to the article you are referring to please?

@quazz
Thanks that fixed the issue!

@redbob said in UEFI PXE boot from Windows 2003 DHCP:

it worked!

However as George said already, this is not a real solution. The network needs fixed.

@george1421 Stuck at 1º step at the moment…

@twilems No idea. If the cause is the same, then probably.

@mr626 Well done. Good testing. I’ll mark this solved as the initial question is answered. Please open a new thread on the sysprep issue!

@rosscaramell The type of disk you’re using doesn’t cause accounts to be randomly made in Windows. This isn’t related to FOG in the slightest.

you could use powershell & the api to rename everything, but it’d probably be easier to just import all the correct host data as a CSV file.

@Scott-B the address is stored in the settings.json file, as long as the new address its being pointed to has the same certificates (if its the same server then all is good).

I’m not sure how well this would work, but you could try using a snapin, that changes the files, and reboots the machine. I’d suggest trying it on one machine first and see how it goes.

@tywyn the largest difference is that SYSTEM is not allowed (by design) any interaction with the user or userspace at all. This probably also means the user’s account too. This is Microsoft’s design, not ours - and they went that route for security reasons.

When developing snapins, if your snapin will work manually but not as a fog snapin (and you’re sure you deployed the snapin correctly), you can normally assume the problem is because of the above.

Try what @Avaryan posted.

@Obsidian said:

Do I need the fog agent installed or just to register it with the fog server?

As Avaryan said, there is no need to install the client for registering. Though it can make it easier. Clients should come up as pending hosts in the FOG web interface if you have the fog-client installed on the machines. But for domain joining (and host renaming) you need to install the fog-client anyway.

@sebastian-roth Hello yes you can mark this as solved! I also want to point out that @george1421 has been great help with my troubles with getting Fog to work. He went above and beyond to help me get sorted. Really appreciate the hard work you all are doing! Thank you once again and happy holidays!

I think @george1421 is right, it really seems like a uefi image was deployed to a bios system.

@scott-b
These are interesting:

11/29/2017 11:19 AM PrinterManager Adding printers 11/29/2017 11:19 AM PrinterManager CutePDF Writer already exists 11/29/2017 11:19 AM Printer Adding: \\printerservername\Kyocera 11/29/2017 11:19 AM PrinterManager PrintUI return code = 0 11/29/2017 11:19 AM Printer Adding: \\printerservername\Xerox 11/29/2017 11:19 AM PrinterManager PrintUI return code = 0 11/29/2017 11:19 AM Printer Adding: \\printerservername\Xerox Color

Because the first one says ‘already exists’ but we don’t see the same message on the others, meaning they were not there already. This is strange. Asking @Joe-Schmitt to look at it.

Thanks @Avaryan and @Wayne-Workman. What you’ve mentioned about Fog running scripts as the System user and it not running for all users is correct. I’m going to have to go about what I wanted to do a different way but there was no issue with Fog or anything, thanks again.

@george1421 Thanks George, using net start seems to work.
@Scott-B The fogclient is included in the Image as this is the way I do it in my Win7-Images without problems.
As for now I’m fine with George’s solution, but I keep your tip in mind if other problems may show up.

@bc601 There is a section in the FOG Client page on the wiki that talks about what needs to be done if you install the fog client before you sysprep it here: https://wiki.fogproject.org/wiki/index.php?title=FOG_Client#FOG_Client_with_Sysprep
Or you can install the fog client post imaging using the msi and the setupcomplete.cmd file. Two ways to go about it to get the same results.