Recommended guide for Windows 10 image creation (from scratch) ?

[george1421]

@adukes40 Only in the dev lab. We are not quite ready to roll it out to the organization. But it does work in the dev labs. We are still fine tuning the GPOs to get them to work like we want them.

[adukes40]

@george1421 thats good to hear, I was thinking about using LTSB instead of Education, because of its simplicity. Don’t have to worry about the apps, or store, and all that mess.

[george1421]

@adukes40 We went with LTSB for a few reasons, not having the consumer apps was one, the other was the longer refresh cycle. CBB will force an update even if you mark it to delay the upgrade. The force update will be 6 months after the current release was released. We have to verify each of our core applications work before we can release an new OS and twice a year is a little much OS thrashing. As soon as we would get one version tested and approved we would have to start on the next release. That is a bit crazy.

[edit] FWIW: I was just able to get CBB 1607 to create cleanly with mdt and windows updates after a bit of hacking about. The late sept 1607 cume update and setting the delivery optimization to 100d fixed the wsus updates getting stuck issue.

[Scott Adams]

@george1421 I’m doing it from audit mode, so there is only the default administrator account at that time.

I uninstall the user app and the provisioned app using a powershell script. An example of my script is:

Get-appxpackage *3dbuilder* | Remove-AppxPackage
Get-appxprovisionedpackage –online | where-object {$_.packagename –like "*3dbuilder*"} | remove-appxprovisionedpackage –online
Get-appxpackage *windowsalarms* | Remove-AppxPackage
Get-appxprovisionedpackage –online | where-object {$_.packagename –like "*windowsalarms*"} | remove-appxprovisionedpackage –online

Tom Elliott – Modded to use code format. Asterisks italicize the font in MD language.

[Scott Adams]

Not sure why, but the post removed my asterisks. There should be asterisks enclosing 3dbuilder and windowsalarms for the Get-appxpackage portions.

[MRCUR]

@george1421 If you use WSUS then updates will not force themselves on the machines unless you approve them. The “Windows Update for Business” stuff only applies to non-WSUS deployments where you’re controlling Windows Update only with group policy and no WSUS.

[MRCUR]

@adukes40 I’ll just mention that you can disable the Store and all “modern” apps with a single group policy setting. You may not need to go the drastic route of deploying LTSB if your primary concern is access to the Store & modern apps.

[george1421]

@MRCUR said in Recommended guide for Windows 10 image creation (from scratch) ?:

@george1421 If you use WSUS then updates will not force themselves on the machines unless you approve them. The “Windows Update for Business” stuff only applies to non-WSUS deployments where you’re controlling Windows Update only with group policy and no WSUS.

FWIW: There are documented “bugs” with CBB 1607 where windows updates will hang applying them. This happens with images being built in MDT as well as images already in production. The late September cume update kb3193494 as well as setting the DeliveryOptimization registry key fixed the MDT / WSUS deployment issues with image creation. I suspect that kb3193494 will also address the 1607 systems in the wild too, but we don’t have any as of now. Which will be interesting since wsus is broken so the only way to deploy that update is via some alternate methods.

[MRCUR]

@george1421 Interesting & good to know. We’re still actively deploying build 1511 and just starting to test 1607 so we haven’t seen any issues with WSUS patching 1511 so far.

[george1421]

@Scott-Adams My script essentially is the same as your except I have an array of applications that I look through and remove but they heart of the script does the same as your script does. The only difference is I’m not doing it in audit mode (if that matters).

[Scott Adams]

@MRCUR What is the group policy setting? Could be extremely beneficial to us in the education sector.

[MRCUR]

@Scott-Adams Computer Config - Admin Templates - Windows Components - Store - “Disable all apps from Windows Store”. If you enable this, all “modern” apps plus the store will be disabled.

You must be using Enterprise or Education editions to use this (I still don’t know what the difference is between Ent & EDU, so we deploy Ent at our district).

[MRCUR]

@x23piracy Are you keeping all 3 of the “store” apps? “ConnectivityStore”, “StorePurchasesApp” & “WindowsStore”?

I can’t find a clear answer on what of those three (besides “WindowsStore”) is required to make the store functional if we decide to enable it in the future. I’ve also seen it noted that “DesktopAppInstaller” may be needed for some apps to be installed through the store.

[x23piracy]

@MRCUR said in Recommended guide for Windows 10 image creation (from scratch) ?:

@x23piracy Are you keeping all 3 of the “store” apps? “ConnectivityStore”, “StorePurchasesApp” & “WindowsStore”?

I can’t find a clear answer on what of those three (besides “WindowsStore”) is required to make the store functional if we decide to enable it in the future. I’ve also seen it noted that “DesktopAppInstaller” may be needed for some apps to be installed through the store.

Since i use WILDCARDstoreWILDCARD i think yes because all of that apps cover the word “store”