Techdays 2017 Pre-Conf Slides

Me and Jörgen Nilsson (@ccmexec) did a pre-conf together at Techdays in sweden. And after much slacking here are now the slide deck from that pre-conf.

Here is the link to download the slidedeck!!ArAh2CEqOjRkk-8ZDAVJ1vRqi8Glxg




Windows 10 1709 Reference Image

Update – 2018-03-06 – Read at the bottom

When creating a Windows 10 reference image a common issue is that the store updates will autoupdate while you are busy installing software updates and applications. This then causes sysprep to fail in giant ball of fire.

To solve this there are basically two options and for some option one doesn’t seem to work which is why I always opt for option two.

Option 1, follow the guidance for disabling auto store updates. This consists of adding a DWORD registry item to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore named AutoDownload with a value of 2. More info on how to do this check out the blog over at

Option 2, is to use a WSUS and then disable internet access for the duration of the build. This can easily be achieved using PowerShell and a sprinkle of magic.

Here is how! Lets start with creating a small PowerShell Script.

param (

If (!$Disable) {
Write-Output “Adding internet block”
New-NetFirewallRule -DisplayName “Block Outgoing 80, 443” -Enabled True -Direction Outbound -Profile Any -Action Block -Protocol TCP -RemotePort 80,443

if ($Disable) {
Write-Output “Removing internet block”
Get-NetFirewallRule -DisplayName “Block Outgoing 80, 443” | Remove-NetFirewallRule


Save that into as Invoke-InternetAccess.ps1 and place the file into the MDT deployment share script folder.

Now time to set the sequence.
Add two “Run PowerShell script” steps as shown below.


For the first one just set the script name to Invoke-InternetAccess.ps1
For the second one set the script name to Invoke-InternetAccess.ps1 and parameters to –Disable

All done! Now you can run your sequence and not worry about any store updates during your build.

Update – 2018-03-06
There has been some discussion around this and there is an alternative to the way below which will work if you use MDT. The solution is a simple as it is elegant and requires very little configuration.

All you would need is to set HideShell=YES in your customsettings.ini. This will not load a full explorer and hence store will not start and there will be no store updates downloaded.


Happy deploying


Techdays 2017

I have the great honor of presenting at TechDays sweden this year. I will be doing a pre conf together with Jörgen Nilsson about Client management. We will show of tips and trix, give some insight on how to surive the Windows As A Service change and talk about the future of client management.

Make sure to reserve your seat now and we will see you there. For more information check out the preconf site for TechDays here

Hope to see you there!


ADK 1703 Image Mount workaround

There has been alot of chatter around the new ADK for Windows 10 1703. Microsoft somehow signed a mountdriver with a bad certificate. This means mount operations fail. All around deployment father Michel Niehaus has found a workaround and you can read the full post from him here

The short story is that you need to modify a registry value to use the built-in driver instead. So if you don’t want to read the full story change the following registry value

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WIMMount
Key: ImagePath

Set the value to

Then you can mount images again!

Note: There are people saying you can turn of SecureBoot to make it work and while this is true. You should not turn SecureBoot off.

Note 2: Microsoft is working on a fix for the ADK.


ADFS Single Sign on with Edge

I usually don’t blog about ADFS but since I recently had to solve this issue for a customer I thought someone else might find it usefull as well.

When you use Edge or Chrome as your primary browser and using a machine that should have SSO with Office 365 and Sharepoint you still get a login page. This happens because by default ADFS have a set of trusted browser strings and others will be prestend with a form authentication.

To fix this on your ADFS server you need to use a couple of simple powershell commands.

Let’s start with just getting what browser strings are trusted currently.

Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents


As you can see there browser agent for Edge and Chrome are missing. To fix this we run the following powershell command.

Set-AdfsProperties –WIASupportedUserAgents @("MSAuthHost/1.0/In-Domain","MSIE 6.0","MSIE 7.0","MSIE 8.0","MSIE 9.0","MSIE 10.0","Trident/7.0", "MSIPC","Windows Rights Management Client","Mozilla/5.0","Edge/12")

Then restart the ADFS service

Restart-Service ADFSSrv

That is, you can verify the settings by getting the ADFS properties again


All done and Single Sign On will should now work using Edge or Chrome as well!



ConfigMgr 1703 Technical Preview

ConfigMgr 1703 TP has just been released and I am really exited by all the new features! Three of the ones you should check out are the Collapsible task sequence groups, the ability to control Windows Analytics and the direct links to applications in software center

Collapsible Task Sequence Groups

MDT has had this for a long while but now ConfigMgr gets it as well. This will help out while editing a task sequence. And it looks a bit like this


Windows Analytics

There is now a new settings group in the client settings that’s called Windows Analytics and there you can enter your Commercial ID (found in the settings of OMS) and select the type of telemetry data sent to Windows Analytics.

It looks a bit like this


When you get data back you can connect Windows Analytics with ConfigMgr and then get collections based on the data in Windows Analytics. For instance a collection with all machines that are ready for the next version of Windows without known upgrade issues.


Create direct links to applications in Software Center

So one request that has been around for a while is the ability for admins to give end users a direct link to the install section of an app in software center. This has previously been done with a workaround and calling the WMI methods involved. Starting with 1703 you can now easily deploy your own link as URL links.

Its pretty straight forward, create a URL link specify the link to be Softwarecenter:SoftwareID=<ApplicationID>

To find the ID either use powershell and the Get-CMApplication command or use the gui end show the column named “CI Unique ID”

You will then end up with a URL looking something like this


Note that this new feature requires the new agent version available with 1703 and does not work with previous agent versions.

Below is a short script that can help you easily create these shortcuts. Just run it on your CM Server or a machine with the console installed. Select the applications you want and it will create the shortcuts on your desktop ready for distribution to other machines.

Created:     2017-03-31
Version:     1.0
Author :     Peter Lofgren
Twitter:     @LofgrenPeter
Blog   :

This script is provided "AS IS" with no warranties, confers no rights and
is not supported by the author

1.0 - Initial release

# Import the ConfigurationManager.psd1 module
Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
# Set the current location to be the site code.
Set-Location "$((Get-PSDrive -PSProvider CMSite).Name):"

#Get Application Name
$AppName = Get-CMApplication | Select LocalizedDisplayName | Out-GridView -PassThru
foreach ($App in $AppName) {
  $Application = Get-CMApplication -Name $App.LocalizedDisplayName

  #Get Application ID
  $ID = ($Application.CI_UniqueID -split "/")[0] + "/" + ($Application.CI_UniqueID -split "/")[1]

  #Create URL Link on desktop
  $Shell = New-Object -ComObject ("WScript.Shell")
  $Favorite = $Shell.CreateShortcut($env:USERPROFILE + "\Desktop\$($App.LocalizedDisplayName).lnk")
  $Favorite.TargetPath = "SoftwareCenter:SoftwareID=$ID";
  $Favorite.IconLocation = "C:\Windows\ccm\SCClient.exe, 0";


If you want to read more about the other new features check out the post by the team here


System Center ConfigMgr 1702

Here we go again. New version of ConfigMgr! This time around it brings a bunch of new cool features and improvements. It also brings along the end of the 2008 era for site servers and SQL servers.

This is all good news but it requires some planning and managinig before an upgrade can be done if you are still running Windows Server 2008 or SQL server 2008.

For a complete list of what’s new and removed check out the official documentation here.


Happy deploying!