This guide uses the proof of concept (PoC) environment, and some settings that are configured in the following guides:
Complete all steps in these guides before you start the procedures in this guide. If you want to skip the Windows 10 deployment procedures in the MDT guide, and move directly to this guide, at least install MDT and the Windows ADK before starting this guide. All steps in the first guide are required before attempting the procedures in this guide.
The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs):
This guide uses the Hyper-V server role to perform procedures. If you don't complete all steps in a single session, consider using checkpoints and saved states to pause, resume, or restart your work.
Multiple features and services are installed on SRV1 in this guide. This configuration isn't a typical installation, and is only done to set up a lab environment with a bare minimum of resources. However, if less than 4 GB of RAM is allocated to SRV1 in the Hyper-V console, some procedures will be slow to complete. If resources are limited on the Hyper-V host, consider reducing RAM allocation on DC1 and PC1, and then increasing the RAM allocation on SRV1. You can adjust RAM allocation for a VM by right-clicking the VM in the Hyper-V Manager console, select Settings, select Memory, and modify the value next to Maximum RAM.
This guide provides end-to-end instructions to install and configure Microsoft Configuration Manager, and use it to deploy a Windows 10 image. Depending on the speed of your Hyper-V host, the procedures in this guide will require 6-10 hours to complete.
The procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed.
| Procedure | Description | Time |
|---|---|---|
| Install prerequisites | Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK. | 60 minutes |
| Install Microsoft Configuration Manager | Download Microsoft Configuration Manager, configure prerequisites, and install the package. | 45 minutes |
| Download MDOP and install DaRT | Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10. | 15 minutes |
| Prepare for Zero Touch installation | Prerequisite procedures to support Zero Touch installation. | 60 minutes |
| Create a boot image for Configuration Manager | Use the MDT wizard to create the boot image in Configuration Manager. | 20 minutes |
| Create a Windows 10 reference image | This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image. | 0-60 minutes |
| Add a Windows 10 OS image | Add a Windows 10 OS image and distribute it. | 10 minutes |
| Create a task sequence | Create a Configuration Manager task sequence with MDT integration using the MDT wizard | 15 minutes |
| Finalize the OS configuration | Enable monitoring, configure rules, and distribute content. | 30 minutes |
| Deploy Windows 10 using PXE and Configuration Manager | Deploy Windows 10 using Configuration Manager deployment packages and task sequences. | 60 minutes |
| Replace a client with Windows 10 using Configuration Manager | Replace a client computer with Windows 10 using Configuration Manager. | 90 minutes |
| Refresh a client with Windows 10 using Configuration Manager | Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT | 90 minutes |
Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ
Note If the request to add features fails, retry the installation by typing the command again.
Note The rest of this article describes the installation of SQL Server 2014. If you download a different version of SQL Server, you may need to modify the installation steps.
Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso
D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms
Installation will take several minutes. When installation is complete, the following output will be displayed:
Microsoft (R) SQL Server 2014 12.00.5000.00 Copyright (c) Microsoft Corporation. All rights reserved. Microsoft (R) .NET Framework CasPol 2.0.50727.7905 Copyright (c) Microsoft Corporation. All rights reserved. Success Microsoft (R) .NET Framework CasPol 2.0.50727.7905 Copyright (c) Microsoft Corporation. All rights reserved. Success One or more affected files have operations pending. You should restart your computer to complete this process.
New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action allow New-NetFirewallRule -DisplayName "SQL Admin Connection" -Direction Inbound -Protocol TCP -LocalPort 1434 -Action allow New-NetFirewallRule -DisplayName "SQL Database Management" -Direction Inbound -Protocol UDP -LocalPort 1434 -Action allow New-NetFirewallRule -DisplayName "SQL Service Broker" -Direction Inbound -Protocol TCP -LocalPort 4022 -Action allow New-NetFirewallRule -DisplayName "SQL Debugger/RPC" -Direction Inbound -Protocol TCP -LocalPort 135 -Action allow
$AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\" Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0 Stop-Process -Name Explorer
Get-Service Winmgmt Status Name DisplayName ------ ---- ----------- Running Winmgmt Windows Management Instrumentation Test-NetConnection -ComputerName 192.168.0.2 -Port 135 -InformationLevel Detailed ComputerName : 192.168.0.2 RemoteAddress : 192.168.0.2 RemotePort : 135 AllNameResolutionResults : MatchingIPsecRules : NetworkIsolationContext : Internet InterfaceAlias : Ethernet SourceAddress : 192.168.0.2 NetRoute (NextHop) : 0.0.0.0 PingSucceeded : True PingReplyDetails (RTT) : 0 ms TcpTestSucceeded : True
C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe
adsiedit.msc
C:\configmgr\SMSSETUP\BIN\X64\Setup.exe
There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment.
Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Select Close when installation is complete.
Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 1 Stop-Process -Name Explorer
This step requires a Visual Studio subscription or volume license agreement. For more information, see MDOP information experience.
Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso
D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi
Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx64.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64" Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx86.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x86"
This section contains several procedures to support Zero Touch installation with Microsoft Configuration Manager.
New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" New-Item -ItemType Directory -Path "C:\Sources\OSD\OS" New-Item -ItemType Directory -Path "C:\Sources\OSD\Settings" New-Item -ItemType Directory -Path "C:\Sources\OSD\Branding" New-Item -ItemType Directory -Path "C:\Sources\OSD\MDT" New-Item -ItemType Directory -Path "C:\Logs" New-SmbShare -Name Sources$ -Path C:\Sources -ChangeAccess EVERYONE New-SmbShare -Name Logs$ -Path C:\Logs -ChangeAccess EVERYONE
Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, enter the following commands at an elevated Windows PowerShell prompt on SRV1:
WDSUTIL.exe /Set-Server /AnswerClients:None
(Get-NetAdapter "Ethernet").MacAddress
Note If the internal network adapter, assigned an IP address of 192.168.0.2, isn't named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing ipconfig.

dir /b C:\RemoteInstall\SMSBoot\x64 abortpxe.com bootmgfw.efi bootmgr.exe pxeboot.com pxeboot.n12 wdsmgfw.efi wdsnbp.com
Note If these files aren't present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing net.exe share REMINST at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. You can also enter the following command at an elevated Windows PowerShell prompt to open CMTrace. In the tool, select File, select Open, and then open the distmgr.log file. If errors are present, they will be highlighted in red:
"C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe"
The log file is updated continuously while Configuration Manager is running. Wait for Configuration Manager to repair any issues that are present, and periodically recheck that the files are present in the REMINST share location. Close CMTrace when done. You'll see the following line in distmgr.log that indicates the REMINST share is being populated with necessary files: Running: WDSUTIL.exe /Initialize-Server /REMINST:"C:\RemoteInstall" Once the files are present in the REMINST share location, you can close the CMTrace tool.
Copy-Item -Path "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" -Destination "C:\Sources\OSD\Branding\contoso.bmp"
Note You can open C:\Sources\OSD\Branding\contoso.bmp in Microsoft Paint to customize this image.
Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe'
In the trace tool, select Tools on the menu and choose Find. Search for "STATMSG: For example:
STATMSG: SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590)
dir /s /b C:\RemoteInstall\SMSImages C:\RemoteInstall\SMSImages\PS100004 C:\RemoteInstall\SMSImages\PS100005 C:\RemoteInstall\SMSImages\PS100006 C:\RemoteInstall\SMSImages\PS100004\boot.PS100004.wim C:\RemoteInstall\SMSImages\PS100005\boot.PS100005.wim C:\RemoteInstall\SMSImages\PS100006\WinPE.PS100006.wim
Note The first two images ( *.wim files) are default boot images. The third is the new boot image with DaRT.
If you've already completed steps in Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit then you've already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: Add a Windows 10 OS image. If you've not yet created a Windows 10 reference image, complete the steps in this section.
Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso
Note Since we aren't installing applications in this test lab, there's no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you're also installing applications.
[Settings] Priority=Default [Default] _SMSTSORGNAME=Contoso UserDataLocation=NONE DoCapture=YES OSInstall=Y AdminPassword=pass@word1 TimeZoneName=Pacific Standard TimeZoneName OSDComputername=#Left("PC-%SerialNumber%",7)# JoinWorkgroup=WORKGROUP HideShell=YES FinishAction=SHUTDOWN DoNotCreateExtraPartition=YES ApplyGPOPack=NO SkipAdminPassword=YES SkipProductKey=YES SkipComputerName=YES SkipDomainMembership=YES SkipUserData=YES SkipLocaleSelection=YES SkipTaskSequence=NO SkipTimeZone=YES SkipApplications=YES SkipBitLocker=YES SkipSummary=YES SkipRoles=YES SkipCapture=NO SkipFinalSummary=NO
[Settings] Priority=Default [Default] DeployRoot=\\SRV1\MDTBuildLab$ UserDomain=CONTOSO UserID=MDT_BA UserPassword=pass@word1 SkipBDDWelcome=YES
Tip To copy the file, right-click the LiteTouchPE_x86.iso file, and select Copy on SRV1. Then open the c:\VHD folder on the Hyper-V host, right-click inside the folder, and select Paste.
New-VM -Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB Set-VMMemory -VMName REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20 Set-VMDvdDrive -VMName REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso Start-VM REFW10X64-001 vmconnect localhost REFW10X64-001
This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you'll have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is REFW10X64-001.wim.
New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" cmd /c copy /z "C:\MDTBuildLab\Captures\REFW10X64-001.wim" "C:\Sources\OSD\OS\Windows 10 Enterprise x64"
Note If content distribution isn't successful, verify that sufficient disk space is available.
Complete this section slowly. There are a large number of similar settings from which to choose.
If you completed all procedures in Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini.
notepad.exe "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini"
[Settings] Priority=Default Properties=OSDMigrateConfigFiles,OSDMigrateMode [Default] DoCapture=NO ComputerBackupLocation=NONE OSDMigrateMode=Advanced OSDMigrateAdditionalCaptureOptions=/ue:*\* /ui:CONTOSO\* OSDMigrateConfigFiles=Miguser.xml,Migapp.xml SLSHARE=\\SRV1\Logs$ EventService=http://SRV1:9800 ApplyGPOPack=NO
Note To migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts:
OSDMigrateAdditionalCaptureOptions=/all
In this first deployment scenario, you'll deploy Windows 10 using PXE. This scenario creates a new computer that doesn't have any migrated users or settings.
New-VM -Name "PC4" -NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 40GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 Start-VM PC4 vmconnect localhost PC4
The following two procedures 1) Replace a client with Windows 10 and 2) Refresh a client with Windows 10 have been exchanged in their order in this guide compared to the previous version. This is to avoid having to restore Hyper-V checkpoints to have access to PC1 before the OS is upgraded. If this is your first time going through this guide, you won't notice any change, but if you have tried the guide previously then this change should make it simpler to complete.
Before you start this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It's not required to delete the stale entries, this action is only done to remove clutter.

In the replace procedure, PC1 won't be migrated to a new OS. It's simplest to perform this procedure before performing the refresh procedure. After you refresh PC1, the OS will be new. The next (replace) procedure doesn't install a new OS on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer.
If an error is displayed at this stage, it can be caused by a corrupt MDT integration. To repair it, close the Configuration Manager console, remove MDT integration, and then restore MDT integration.
Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
New-VM -Name "PC4" -NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 2048MB -Buffer 20 Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF
Hyper-V lets you define a static MAC address on PC4. In a real-world scenario, you must determine the MAC address of the new computer.
Checkpoint-VM -Name PC1 -SnapshotName BeginState
Tip If you don't see the computer account for PC1, select Refresh in the upper right corner of the console.
Note This command requires an elevated command prompt, not an elevated Windows PowerShell prompt.sc.exe stop ccmsetup "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /Uninstall
Note If PC1 still has Configuration Manager registry settings that were applied by Group Policy, startup scripts, or other policies in its previous domain, these might not all be removed by CCMSetup /Uninstall and can cause problems with installation or registration of the client in its new environment. It might be necessary to manually remove these settings if they are present. For more information, see Manual removal of the Configuration Manager client.
net.exe stop wuauserv net.exe stop BITS
Verify that both services were stopped successfully, then enter the following command at an elevated command prompt:
del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" net.exe start BITS bitsadmin.exe /list /allusers
"\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1
Get-Content -Path c:\windows\ccmsetup\logs\ccmsetup.log -Wait
control.exe smscfgrc
If the client isn't able to find the PS1 site, review any error messages that are displayed in C:\Windows\CCM\Logs\ClientIDManagerStartup.log and LocationServices.log. A common reason the client can't locate the site code is because a previous configuration exists. For example, if a previous site code is configured at HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode, delete or update this entry.
Note It might take several minutes for the client to fully register with the site and complete a client check. When it's complete you will see a green check mark over the client icon as shown above. To refresh the client, select it and then press F5 or right-click the client and select Refresh.

In the Configuration Manager console, in the Software Library workspace, under Operating Systems, select Task Sequences, right-click Replace Task Sequence, select Deploy, and use the following settings:
control.exe smscfgrc
C:\Windows\CCM\SCClient.exe

In Software Center, select Available Software, and then select the Replace Task Sequence checkbox. See the following example:
Note If you don't see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available.
Start-VM PC4 vmconnect localhost PC4
Note The next procedure will install a new OS on PC1, and update its status in Configuration Manager and in Active Directory as a Windows 10 device. So you can't return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this action for all VMs.
To save a checkpoint for all VMs, enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
Checkpoint-VM -Name DC1 -SnapshotName cm-refresh Checkpoint-VM -Name SRV1 -SnapshotName cm-refresh Checkpoint-VM -Name PC1 -SnapshotName cm-refresh
The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking Deployments, and then double-clicking the deployment associated with the Install Windows 10 Enterprise x64 collection. Under Asset Details, right-click the device and then select More Details. Select the Status tab to see a list of tasks that have been performed. See the following example:
You can also monitor progress of the installation by using the MDT deployment workbench and viewing the Monitoring node under Deployment Shares\MDT Production. When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise OS. 