Automated Windows Deployment on a Budget

by Paul Siegel

Funding for IT is at an all-time low.  If you have "champagne taste" but working with a "beer budget."  Microsoft Deployment toolkit is the way to go.  Lucky for us, the prompt-happy "Lite Touch" can be tailored into a much less intense experience if you follow the following process. 

---

 Feeding the Prompt-Monster

There at least 13 menus throughout the deployment wizard and we need to remove them all in order to automate! Lets start by skipping the Welcome and User Credentials screen.  We need to edit the bootstrap.ini for the deployment share.  In your workbench, go to "properties" of your open deployment share and select the "rules" tab  so removing them is required for automation (see below).

---

The default boot settings.ini will look something like this:

[Settings]
Priority=Default

[Default]
DeployRoot=\\DeployNinja\images$

Time to feed the monster its first can of answers.  All you have to do is add in the following line: SkipBDDWelcome = Yes to the bootstrap.ini to bypass the Welcome screen. The user credentials prompt is skipped by adding the following lines for the user account:

UserID=Ninja
UserPassword=Passw0rd1
UserDomain=DeployNinja


This account can be a domain account or a local server or workstation account depending on your setup. For this tutorial it is a local server account. The completed Bootstrap.ini file will look like this:

[Settings]
Priority=Default

[Default]
DeployRoot=\\DeployNinja\images$ 
SkipBDDWelcome = Yes 
UserID=Ninja
UserPassword=Passw0rd1
UserDomain=DeployNinja 

Once the bootstrap.ini has been edited the boot image will need to be regenerated in order for the bootstrap.ini it be copied into the deployment boot image. This done by updating the deployment share from the menu in the top right corner of the deployment workbench. In the end, when the litetouch.vbs script is executed you will bypass the first two prompts and arrive at the task sequence menu. See the images below for the end result.  Keep in mind that anytime you edit the bootstap.ini you will need to regenerate the boot images,

Since the primary goal for the most of us is to eliminate the need to enter a password, this will be the end of the road for some.  From this menu, a user can choose the desired software to install or choose to refresh the image on their computer. Others, however, prefer the ability to re-image machines from the ground up on a regular basis.  This is where Deployment Rules come into play. Back where we accessed the bootstrap.ini there is a set of rules to further fine-tune our deployment. 

Above is the predefined set of rules for our deployment share for the default installation.  From here we have the ability to customize the prompts that appear during the task sequence OR add additional functionality.   Below is an example of a custom rule set for a fully automated single task sequence.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]

OSInstall=YES
SkipAdminPassword=YES
SkipApplications=YES
SkipAppsOnUpgrade=YES
SkipBitLocker=YES
SkipCapture=YES
SkipUserData=Yes 
SkipComputerName=YES
OSDCompterName=%SerialNumber%
SkipProductKey=YES
SkipComputerBackup=YES
SkipDeploymentType=YES
DeploymentType=NEWCOMPUTER
SkipDomainMembership=YES
JoinDomain=stinkycheese.deploymentninja.com
DomainAdmin=Administrator
DomainAdminDomain=stinkycheese.deploymentninja.com
DomainAdminPassword=Passw0rd1
SkipFinalSummary=YES
SkipLocaleSelection=YES
KeyboardLocale=en-US
UserLocale=en-US
UILanguage=en-US
SkipPackageDisplay=YES
SkipSummary=YES
SkipTaskSequence=YES
TaskSequenceID=BASE64
SkipTimeZone=YES
TimeZoneName=Eastern Standard Time

The real advantage of adding these rules in is that, if you want,  you can control how involved the user is in the task sequence. if you want the user to choose their computer name then you would change the line SkipComputerName=YES  to SkipComputerName=NO and the user can choose  the serial number as the computer name or something they specify. If you want to specify some of the settings but allow the user to pick the task sequence then remove the lines SkipTaskSequence=YES TaskSequenceID=BASE64, DeploymentType=NEWCOMPUTER. 

DeploymentType can have multiple options: the REFRESH option is used when executing the litetouch.vbs script inside of windows. NEWCOMPUTER would be used for deploying from Windows PE (Windows Deployment Services or LiteTouchPE.iso). 

Applications can also be added to the rule set to install across all task sequences without having to go back to edit them individuality by adding:


MandatoryApplications001=[guid of desired application]


The guid is automatically assigned to the application when the object is created in deployment workbench.

Domain Membership is not a requirement. If you choose to skip joining the domain you may also specify a workgroup=Ninjaland or You may also choose a specific OU in the domain by adding:

MachineObjectOU=OU=assasins,OU=Ninja,DC=local 

Rules, Wizards, and Prompts Oh MY!

 The customization is limitless and once you have a working automated deployment share there are endless means of executing your task sequences even without a pxe enviroment. For example one could use psexec to launch the litetouch.vbs on a remote machine or create custom shortcuts in the start menu that point back to the deployment share for a self service image scenario.  Happy deployments mean happy bosses , cheap deployments mean happy board members.