WES8 deployment with ConfigMgr 2012 SP1 or R2 (part 2)

A few months ago I did a blogpost about WES8 deployment with ConfigMgr 2012 SP1 or R2. Nothing special you can say? But the point is Microsoft changed something in ADK8.x and WES8.x, so deployment with ConfigMgr isn't working as expected anymore. This because of OSDSetupHook. After the "Setup Windows and ConfigMgr" task sequence step deployment ends. No error message, no additional packages installed, nothing. This is not the case on WES7, which is still deploying fine. Let's have a look.

The reason for this can be found on Microsoft TechNet.
Windows ADK Release Notes mentions: Changes in Out-Of-Box (OOBE) Experience.
Oobe.cmd and Setupcomplete.cmd are disabled if an OEM product key is used. This is to ensure that end-users reach Start as quickly as possible. If you have any tools or services that use this infrastructure, these must be changed to tasks that occur after the OOBE.

Add a Custom Script to Windows Setup mentions: In Windows 8, oobe.cmd and Setupcomplete.cmd are disabled if an OEM product key is used. This is to ensure that end users reach Start as quickly as possible. Any tools or services that use this infrastructure need to be moved to post Out-Of-Box Experience (OOBE) tasks.
FirstLogonCommands mentions: In Windows 8 and Windows 8.1, oobe.cmd and Setupcomplete.cmd are disabled if an OEM product key is used. This is to ensure that end users reach Start as quickly as possible. Any tools or services that use this infrastructure need to be moved to post Out-Of-Box Experience (OOBE) tasks.

Run a Custom Script after Windows Setup Completes:
You can make additional customizations after Windows Setup completes by adding commands to the %WINDIR%\Setup\Scripts\SetupComplete.cmd file. This file enables you to install additional applications, run custom Windows scripts (cscript/wscript), or make other modifications to the system before a user logs on. Setupcomplete.cmd functionality differs from the RunSynchronous and RunAsynchronous commands in the following way: Setupcomplete.cmd runs after Windows Setup completes, whereas the RunSynchronous and RunAsynchronous commands run during Windows Setup. Commands in the Setupcomplete.cmd file are executed with local system permission.

To understand the order of operations when adding a custom script after Setup:
1. After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory.
2. If a SetupComplete.cmd file is found, the file is executed. Otherwise, installation continues in the standard manner. Windows Setup logs the action in the Setupact.log file. Setup does not verify any exit codes or error levels in the script after it executes SetupComplete.cmd.
Note: You cannot reboot the system and resume running SetupComplete.cmd. When a computer joins a domain during installation, the Group Policy that is defined in the domain is not applied to the computer until Setupcomplete.cmd is finished. This is to make sure that the Group Policy configuration activity does not interfere with the script.

Looking in the setupact.log file you will see the following:
[msoobe.exe] OEM license detected, will not run SetupComplete.cmd
[msoobe.exe] TASK: End successfully running task RunSetupFinalTask

Solutions for above changes are:
1. Use a Windows 8.x KMS GVLK Client Setup Key for Win8.x Enterprise x86/x64 and all Progs in Setupcomplete.cmd are installed. Source: KMS Client Setup Keys
2. Rename the SetupComplete.cmd file to FirstLogon.cmd and replace the Sysprep.xml file by the following one. That way FirstLogon.cmd will start OSDSetupHook again.
=========================
<unattend xmlns="urn:schemas-microsoft-com:unattend">
     <settings pass="generalize">
         <component name="Microsoft-Windows-PnpSysprep" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
             <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
             <DoNotCleanUpNonPresentDevices>true</DoNotCleanUpNonPresentDevices>
         </component>
         <component name="Microsoft-Windows-PnpSysprep" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
             <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>
             <DoNotCleanUpNonPresentDevices>true</DoNotCleanUpNonPresentDevices>
         </component>               
     </settings>
        
        
         <settings pass="oobeSystem">
                 <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                         <FirstLogonCommands>
                                 <SynchronousCommand wcm:action="add">
                                         <Order>1</Order>
                                         <CommandLine>C:\Windows\Setup\Scripts\FirstLogon.cmd</CommandLine>
                                 </SynchronousCommand>
                         </FirstLogonCommands>
                 </component>
                 <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                         <FirstLogonCommands>
                                 <SynchronousCommand wcm:action="add">
                                         <Order>1</Order>
                                         <CommandLine>C:\Windows\Setup\Scripts\FirstLogon.cmd</CommandLine>
                                 </SynchronousCommand>
                         </FirstLogonCommands>
                 </component>               
         </settings>
 </unattend>
=========================
Source: My Digital Life Forums
3. Use another tooling besides of ConfigMgr to start SetupComplete.cmd after deployment, like ThinKiosk which can be downloaded for free usage (Community Edition only).
Source: ThinScale Technology

To be continued till doing another project with ConfigMgr and Thin client deployment.

WES8 deployment with ConfigMgr 2012 SP1 or R2

Last month I did a few thin client deployments with ConfigMgr 2012 SP1. When starting you have the choice to download a clean WES8 image at the HP website. That way a FLASH.IBR (4GB) is downloaded, which can be renamed to FLASH.WIM and imported in ConfigMgr. Another way to create an image is using ConfigMgr Capture media. This can be started in Windows Embedded (WES) to sysprep and upload the image. Third option is to download a clean image from the Microsoft website, using Image Builder Wizard (IBW), with the risk that HP drivers are missing after deployment. I prefer using the download option, with the image customized for HP thin clients. Let's have a look at deployment progress. 
 
Deployment is done with the option "Download content locally when needed by running task sequence" by default. That way 4GB is downloaded on Flash RAM on the thin client and extracted after that. This seems not the fastest option, because Flash RAM isn't designed to do heavy Read/Write actions at same time. In my case downloading the image took 30 minutes and extracting the image took another 60 minutes. Why Flash RAM is that slow is a question for me also. Way to slow to do multiple deployments a day I think. When using an USB-stick for doing the deployment (without ConfigMgr usage) installation is done in 120 minutes also, so not that good also.
 

Let's have a look at the different Write Filters also. ConfigMgr supports managing the following types of write filters:
-File-Based Write Filter (FBWF) on WES 7E, 7P and 2009 devices (ConfigMgr 2012 SP1 or R2 only)
-Enhanced Write Filter (EWF) RAM on WES 7E, 7P and 2009 devices (ConfigMgr 2012 SP1 or R2 only)
-Unified Write Filter (UWF) on WES8 devices (ConfigMgr 2012 R2 only)
Note: ConfigMgr does not support write filter operations when the Windows Embedded device is in EWF RAM Reg mode.
 
To create Write Filter settings use Embedded Lockdown Manager (ELM). ELM is a snap-in to the Microsoft Management Console (MMC). You can use ELM directly on a Standard 8 device, or you can use ELM on a development computer and then remotely connect to a Standard 8 device. ELM automatically detects which lockdown features are installed on the device, and displays configuration options for only those features. ELM uses Windows Management Instrumentation (WMI) to detect and change configuration settings.

In a typical installation, ELM can be found at the following location:
%SYSTEMROOT%\System32\EmbeddedLockdown.msc
Just use "Connect to Device" from a remote system and "Export to PowerShell" to save WES settings in a ps1 file. This package must be used within ConfigMgr during deployment. (for example: ELM Write Filter settings package with TC-settings.ps1 file)
 
In the task sequence (used for TC deployment) there must be a few steps added:
-Browse to the newly created deployment task sequence. Right-click it and select Edit to open the Task Sequence Editor. Select Partition Disk 0. Double-click on (Primary) Volume to edit its properties. The Partition Properties window opens. Under Use a percentage of remaining free space, enter 95. (The deployment will fail if this value is left at 100, because Windows will not be able to create the write filter partition.) 
Two more settings need to be changed for thin clients that do not have enough disk space to store both the downloaded WIM and the extracted contents locally.
-Select Apply Operating System in the Task Sequence Editor and open the Options tab. Check "Access content directly from the distribution point".
-Right-click the reference image package in Operating System Images and open the Properties dialog. Configure the Package share settings on the Data Access tab. Check "Copy the content in this package to a package share on distribution points".
When deploy the task sequence (used for TC deployment) choose the following option:
-On the Distribution Points screen, set the deployment option to "Download content locally when needed by running task sequence" and check the option "When no local distribution point is available, use a remote distribution point".

The write filter status is disabled by default after the task sequence finishes successfully. Use the following settings in the deployment task sequence to configure and enable the write filter (Source: Nothing but ConfigMgr):
-Task Sequence Variable: SMSTSPostAction > Value: cmd /c shutdown /r /t 60 /f
-Command line: bcdedit /set {current} bootstatuspolicy ignoreallfailures
-Run PowerShell Script: Package: ELM Write Filter settings & Script name: TC-settings.ps1 & PowerShell execution policy: Bypass

Download links:
Download Windows Embedded 8 Standard
Drivers, Software & Firmware for HP t610 Flexible Thin Client
Managing HP Thin Clients with SCCM 2012 SP1 (PDF)
Deploying the ConfigMgr Client to WES Devices
ELM Technical Reference (WES8)