# Overview OSConfig is a **method** of applying Operating System configuration during a Windows Deployment as a Package, without having multiple steps in your Task Sequence. This allows for **simple** configuration that is **independent** of a Task Sequence. ## Modular Because the goal of OSConfig is to remove all Customizations from the Task Sequences, and to place all of them in OSConfig, this allows the customizations to be Modular. The benefit of this is that you can use this in whatever Deployment method you can think of. Additionally, this allows the customizations to be integrated in a Provisioning Package :) ## OSConfig Deployment Scenarios OSConfig has been testing in the following Operating System Deployment Scenarios * Standalone (autounattend.xml) * MDT Client Task Sequence * MDT Upgrade Task Sequence * ConfigMgr New PC Task Sequence * ConfigMgr Upgrade Task Sequence * Provisioning Packages The flexibility of OSConfig makes this method of Operating System configuration **ideal**, as it is completely modular. This gives you the ability to freely to design whatever configuration you can script without any limitations. ## Supported Operating Systems The OSConfig method has been tested on Windows 7 and Windows 10, and should work without issue on Windows Server deployments. ## Enterprise Customization We all know what it looks like if you do nothing. This is simply not an ideal presentation for your Enterprise. OSConfig uses Group Policy as the primary method of customizing the Operating System. ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5Nrox4t-k74tgWWo%2Fimage.png?alt=media\&token=58692b19-3e59-4020-b156-5259e78c17b6) ## Group Policy It's actually much easier to take all your Policies and Preferences and put them in Group Policy instead of having multiple steps and custom scripts in your Task Sequence ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5Q0bzmWIQwTtJNS_%2Fimage.png?alt=media\&token=1f724139-6c19-4e63-9b59-6aa1e9a6f403) ## Local Copy Once you have all your settings in Group Policy, simply copy the Policies from SysVol to your OS during deployment, or run in an SCCM Package. ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5Ruu3-rpHhhMgE-s%2Fimage.png?alt=media\&token=74cad351-f7e6-4616-b1a3-a06424c39e1a) ## LGPO Use Local GPO to apply these Policies ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5U8FEGWD7Vz-4b98%2Fimage.png?alt=media\&token=8eb2ad55-3523-49f5-8cf5-bb306ff3609d) ## Apply Preferences with PowerShell Since LGPO only applies Policies and not Preferences, simply add a PowerShell script to read the GPO Preferences and apply the settings (yes I will publish said script soon) ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5VmAq4O5Lo7Pr5jE%2Fimage.png?alt=media\&token=ca68bf48-991c-4040-8eeb-9d76928fc922) ## Customized OS And as soon as Windows starts for the first time, everything is configured exactly how you want it. Fully customized without multiple steps in the Task Sequence. Screenshots below were taken on first boot from OOBE without joining a Domain. All customizations are done locally, without separate Reg Hacks. ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5YopvUuR_Ku0GGZV%2Fimage.png?alt=media\&token=24fc3257-385c-4a2a-a832-d6d1916dd7bc) ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5_R2xf7FTAxxAnXz%2Fimage.png?alt=media\&token=39e88b69-4e8f-41da-b98c-1dcc8af90360) ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5az7_xEa4x_LztyA%2Fimage.png?alt=media\&token=55595812-e70d-497c-86bc-02f73357c996) ![](https://118121972-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmHrtEh3IN0vTzrXZ7Z%2F-LmI4x1gbz7utI3MPAK6%2F-LmI5cTbgYbgY1QwOMpK%2Fimage.png?alt=media\&token=50c72166-d954-421a-8212-7d2fc3977f2f) # Release Notes **OSConfig** is configured as a **Complete Demo** that can be downloaded from GitHub ## 18.9.4 (September 4, 2018) * **OSConfig.ps1** updated to support Provisioning Packages * **Import-GPO.ps1** updated to hide progress (required for Provisioning Packages) ## 18.9.3 (September 3, 2018) * Set-StartLayout.ps1 - resolved an issue where LayoutModification was not copied to existing User Profiles * Minor formatting updates to existing PowerShell scripts ## 18.8.31 (August 31, 2018) * Updated GPOs * Tweet Release ## 18.8.30 (August 30, 2018) * Script cleanup ## 18.8.29 (August 29, 2018) * Initial upload # LGPO LGPO is required for full OSConfig functionality. It is part of the Microsoft Security Compliance Toolkit and can be downloaded from the following link {% embed url="" %} From the link above, when selecting Download, you have to option to select individual components. Select the LGPO.zip Extract the zip and place LGPO.exe and LGPO.pdf into the OSConfig\LocalPolicy\LGPO directory # OSDeploy PowerShell Module The OSDeploy PowerShell Module is published on PowerShell Gallery ## Installation **PowerShell Uninstall Previous Versions:** ``` Uninstall-Module -Name OSDeploy -AllVersions -Force ``` **PowerShell Install Latest Version:** ``` Install-Module -Name OSDeploy -Scope CurrentUser -Force ``` ## OSConfig Functions * **New-CAB** - Input the path of a Directory * Creates a CAB file of the Directory * Used for creating a CAB for Provisioning Packages * **Show-RegistryXML** - Input the path to a Directory containing RegistryXML files * Displays the Registry Modifications contained in the RegistryXML files ## Release Information ### 18.9.4 (September 4, 2018) * New-CAB will create a CAB file from a Directory for use in Provisioning Packages * Show-RegistryXML will display registry entries contained in RegistryXML files ​ # Deployment You can use the following methods for deploying OSConfig customizations. I will try to add detailed instructions for each of these methods in the near future . . . * **Configuration Manager** \* \* \* * Upgrade Task Sequence using a Package * Upgrade Task Sequence using a Provisioning Package * **Microsoft Deployment Toolkit** \* * New PC Task Sequence using a Provisioning Package * Upgrade Task Sequence using Run Command Line * Upgrade Task Sequence using a Provisioning Package * **Stand-Alone** * Using AutoUnattend.xml and PowerShell (Specialize Phase) * Using AutoUnattend.xml and a Provisioning Package ​ Last updated Thu Aug 30 2018 20:01:24 GMT+0000 (UTC) # ConfigMgr New PC TS Package The easiest method of applying OSConfig to a New PC is directly from a Package and a Run Command Line. This method is not recommended for testing as the OSConfig progress is not displayed. The following steps are required * OSConfig must be created as a Package (no Program) ## Create an ConfigMgr Package Create a new Package with Source Files to the root of your OSConfig content. Do not create a Program. Distribute Content to your Distribution Points ## Task Sequence Run Command Line Add a Run Command Line step after the "Setup Windows and Configuration Manager" step. Use the following Command Line: ``` PowerShell.exe -ExecutionPolicy Bypass -File .\OSConfig.ps1 ``` Make sure that you disable 64-bit file system redirection and that you run from your OSConfig package. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKwqhsTZPll-U84guww%2F-LKwtr1UN9a4xQy8fpmp%2F2018-08-27_14-39-12.png?alt=media\&token=fdd81a72-097d-4cfd-8558-ddefa6914881) ## Complete If everything worked fine, your Operating System should show all your customizations ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKwix12wRxkEZMyaLLw%2F-LKwoqp5n4zxZy_8jFat%2F2018-08-27_13-20-06.png?alt=media\&token=8de91bf7-f5bc-443b-b4b3-458f3d2dd47b) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLBTcwdDu808ZW2IqWV%2F-LLBTqAs_5iWS_Mk71fo%2F2018-08-30_15-16-30.png?alt=media\&token=e1fdb285-24c8-466e-9af0-1d8364ddcd49) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLBTcwdDu808ZW2IqWV%2F-LLBUL1zLqIDAKHynyMh%2F2018-08-30_15-17-46.png?alt=media\&token=4c449534-b888-4a26-bf73-bb3eb95ff753) The Support Group is from the Domain GPO ​ # ConfigMgr New PC TS Unattend.xml You can deploy OSConfig in a Configuration Manager Task Sequence in the Specialize Phase of an Unattend.xml. The following requirements must be met Create a new Package with Source Files to the root of your OSConfig content. Do not create a Program. Distribute Content to your Distribution Points Edit your Partition Disk steps to ensure that the Windows Partition Drive Letter is assigned a Variable. This is typically OSDisk. Repeat this process for both BIOS and UEFI Windows Partitions Inset a Run Command Line step with your OSConfig Package to copy the contents locally. Use the following Command Line ``` cmd.exe /c md %OSDisk%\ProgramData\OSConfig & cmd.exe /c xcopy ".\*" %OSDisk%\ProgramData\OSConfig /y /e ``` OSConfig is executed by adding the following command line to the Specialize Phase in the Unattend.xml ``` PowerShell.exe -ExecutionPolicy Bypass -File C:\ProgramData\OSConfig\OSConfig.ps1 ``` Here is a minimal Unattend.xml (x64 and x86) for reference that can be used. Create a Package for your Unattend.xml ``` EnableAdmin 1 cmd /c net user Administrator /active:yes UnfilterAdministratorToken 2 cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken /t REG_DWORD /d 0 /f disable async RunOnce 3 reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer /v AsyncRunOnce /t REG_DWORD /d 0 /f OSConfig 4 PowerShell.exe -ExecutionPolicy Bypass -File C:\ProgramData\OSConfig\OSConfig.ps1 EnableAdmin 1 cmd /c net user Administrator /active:yes UnfilterAdministratorToken 2 cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken /t REG_DWORD /d 0 /f disable async RunOnce 3 reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer /v AsyncRunOnce /t REG_DWORD /d 0 /f OSConfig 4 PowerShell.exe -ExecutionPolicy Bypass -File C:\ProgramData\OSConfig\OSConfig.ps1 ``` Make sure the Apply Operating System step contains the proper Unattend.xml and the OSDisk settings During OS Deployment you will see progress during the Specialize phase before first logon If everything worked fine, your Operating System should show your customizations immediately. # ConfigMgr New PC TS Provisioning Package To use OSConfig in a Provisioning Package, the following changes to the Task Sequence need to be made * OSConfig.ppkg must be created as a Package (no Program) * Windows Partition Drive Letter must be saved as a Task Sequence Variable ## Create an OSConfig Package for the PPKG File Create a new Package with Source Files to the root of your OSConfig PPKG content. The package will contain only the PPKG file, nothing else. Do not create a Program. Distribute Content to your Distribution Points ## Task Sequence Partition Steps Edit your Partition Disk steps to ensure that the Windows Partition Drive Letter is assigned a Variable. This is typically OSDisk. Repeat this process for both BIOS and UEFI Windows Partitions ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKwix12wRxkEZMyaLLw%2F-LKwkxIG1Hj2Vm8qe6kg%2F2018-08-27_14-01-01.png?alt=media\&token=3d9b6984-b48d-4a9d-badc-4a56811a1edf) ## Package Run Command Line Inset a Run Command Line step with your OSConfig PPKG Package to inject the PPKG to the Offline Windows Image (in WinPE). Use the following Command Line ``` dism /Image=%OSDisk%\ /Add-ProvisioningPackage /PackagePath:"OSConfig.ppkg" ``` ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKxAJJc2KOoA_Bgksoh%2F-LKxAnPFRbH0a6s8Ufur%2F2018-08-27_15-55-55.png?alt=media\&token=d1da140e-65d7-4c9e-86c3-af310d93a7eb) ## Deployment OSConfig.ps1 will execute silently during the OOBE Phase, but the child scripts will not ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKxAJJc2KOoA_Bgksoh%2F-LKxCWG8-QTq4b37nNaa%2F2018-08-27_16-06-35.png?alt=media\&token=d6982caa-6319-4628-b1ed-35aae6a126cc) For fully silent operation during OOBE, you can edit OSConfig.ps1 file to make everything run hidden ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKxAJJc2KOoA_Bgksoh%2F-LKxCnkMFQPG2XoWZG8J%2F2018-08-27_16-05-56.png?alt=media\&token=2899354f-9eff-473a-bac3-ce6ddee6f60a) ## Complete When complete, everything should have applied properly. You can check the PPKG LOG file or the OSConfig Log files to determine if there were any issues. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKxAJJc2KOoA_Bgksoh%2F-LKxDYtKIrbh8hyzjP3A%2F2018-08-27_16-11-18.png?alt=media\&token=9e924de5-4efd-40d1-ad47-878777b3c28d) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLBTcwdDu808ZW2IqWV%2F-LLBTqAs_5iWS_Mk71fo%2F2018-08-30_15-16-30.png?alt=media\&token=e1fdb285-24c8-466e-9af0-1d8364ddcd49) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLBTcwdDu808ZW2IqWV%2F-LLBUL1zLqIDAKHynyMh%2F2018-08-30_15-17-46.png?alt=media\&token=4c449534-b888-4a26-bf73-bb3eb95ff753) The Support Group is from the Domain GPO ​ # MDT New PC TS OSConfig can be added to an MDT Task Sequence in a few steps. Once you have OSConfig properly configured, copy it to your MDT Deployment Share. I prefer to keep mine in the following location ``` \OSDeploy\OSConfig\* ``` ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLXs-wOWxBb7RPJJoh3%2F2018-09-03_23-35-27.png?alt=media\&token=a761cb44-33d9-4220-bacf-584cd7762929) ## Verify OSDisk Make sure that your Format Partition steps use OSDisk for your Windows Partition ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLXsSiqKDqNzIyqo6nj%2F2018-09-03_23-32-22.png?alt=media\&token=d6a43c78-30fc-4511-bb1c-4bd334a37aeb) ## Task Sequence Copy OSConfig Step Edit your task Sequence and in the Postinstall Phase, add a **Run Command Line** step right before Restart computer called **Copy OSConfig** with the following **Command line** ``` cmd /c robocopy "%DeployRoot%\OSDeploy\OSConfig" %OSDisk%\ProgramData\OSConfig *.* /mir /ndl /nfl /r:1 /w:1 /xj /z ``` ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLY1HAE8zpLZRyUH_IE%2F2018-09-03_23-43-05.png?alt=media\&token=cad062e4-9739-48ae-b20a-7acebb4b85f2) In the Options tab, add a 1 to the **Success codes** and check **Continue on error** ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLY1QEp2io6iivUdBJK%2F2018-09-03_23-41-56.png?alt=media\&token=3d380fb5-1552-4ee3-a1ba-05453b45f83e) ## Task Sequence Pause Step I add a Run Command Line step to open Notepad with 'Continue on Error' during testing. This allows the Task Sequence to pause so I can take a VM Snapshot. You must open Notepad with 'cmd /c', otherwise Notepad will be hidden. Use the following Command Line ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLXtKdgbK7rw6XiBqA_%2F2018-09-03_23-44-05.png?alt=media\&token=66a6606f-d0a0-46e4-9f5c-075e629f66e4) ## Edit the Task Sequence Unattend.xml Add a new RunSynchronousCommand entry to your Unattend.xml file at \\Control\\\\Unattend.xml ``` OSConfig 5 PowerShell.exe -ExecutionPolicy Bypass -File %ProgramData%\OSConfig\OSConfig.ps1 ``` When complete, it should look like this: ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LJHnUmulgpoKqJ0TzIb%2F-LJHrSd_gUc_gqRlYUo3%2F2018-08-07_0-27-35.png?alt=media\&token=bc91dfc3-b2d6-4528-94b7-fd15429d7184) Save and close it. ## Run the Task Sequence If you added Notepad to pause the Task Sequence, take a VM Snapshot. Close Notepad and the Task Sequence will continue. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLY3WcOtnJrXD-tvDLR%2F2018-09-04_0-31-44.png?alt=media\&token=1fbdd367-26f3-42c4-a91a-795b324d9c22) OSConfig will be copied to OSDisk and the computer will restart. During the Specialize Phase (OOBE), OSConfig will execute. Depending on how you have your Child scripts set to process, you can maximize the minimized Window. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLY46qVInqQjVQkckza%2F2018-09-04_0-35-03.png?alt=media\&token=25897e1b-36a9-4661-bd70-a3857d8374c5) In the image below, the Appx Packages are being removed ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXqhd28iwIvmxcL-cW%2F-LLY4NBB07qiuNmNh_w9%2F2018-09-04_0-35-16.png?alt=media\&token=46395558-6b59-4fdd-96a1-4dd04b625e92) ## Complete If everything is configured properly, your customizations should show up as soon as the Task Sequence gets to the Desktop ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLY4kn1_XoWA1FXYszA%2F-LLY6wmoaVY5XokEavTN%2F2018-09-04_0-47-58.png?alt=media\&token=d9b326f7-1fae-49ab-a230-b71aea24d80a) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLY4kn1_XoWA1FXYszA%2F-LLY727BKY4d1he-GwmT%2F2018-09-04_0-47-15.png?alt=media\&token=af7da54e-4121-4343-b964-d04e0785f76f) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLY4kn1_XoWA1FXYszA%2F-LLY74cNFePbx044T5gL%2F2018-09-04_0-47-39.png?alt=media\&token=0fb3dc4c-dcfb-4704-bed7-814e8678b27c) You can even verify Local Policy to make sure that all the GPOs were applied ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLY4kn1_XoWA1FXYszA%2F-LLY7OtJCWGPPt5cT1MI%2F2018-09-04_0-50-00.png?alt=media\&token=ec93f830-0d0d-4ed6-88ad-69b9fc3dd1a3) ​ # Customize This section will detail the Components of OSConfig and how they Customize the OS . . . ## OSConfig.ps1 This is the Main script that kicks everything off in the following steps ### Relocate OSConfig If OSConfig.ps1 is not executed from C:\ProgramData\OSConfig\\\*, it will be coped there automatically ### Log Environment Variables Environment Variables will be logged and saved in the OSConfig Transcript ### Increase Screen Buffer Size When running OSConfig in the OOBE Phase, there are no defaults set for PowerShell Console. A default will be added to allow for extended scrolling ### Execute Child-Items The Main part of OSConfig.ps1 is to search for all subdirectories and to execute all PowerShell scripts that exist in the root of the subdirectories. These can be anything you want . . . the choice is up to you. I have included some of the customizations that I run to help you get a head start. # Alpha Since OSConfig process subdirectories Alphabetically, the Alpha directory was created to run these scripts first ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLDmMyB19Gj7fR3Z6ui%2F-LLDjdypdIA2NTL8d1PG%2F2018-08-31_1-49-10.png?alt=media\&token=abab33c6-d51c-40bd-a771-1c5e8c48a33e) ## Backup-Registry.ps1 This PowerShell script will export the registry into reg files. These files are saved in %ProgramData%\OSDeploy\RegistryBackup\\%DateTime% While these files are not necessary, they do provide a snapshot of the system before OSConfig does its damage. Additionally you can use this script to create a snapshot anytime, or even use it as a Before/After to see what changes are made when configuring a setting ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLDmMyB19Gj7fR3Z6ui%2F-LLDkk__9GwCKkxEeT6_%2F2018-08-31_1-53-17.png?alt=media\&token=feeca836-7eca-4c5d-a93f-fa0da2cdecd9) ## Remove-AppLockerPolicies.ps1 Deletes %SystemRoot%\System32\AppLocker. This prevents any AppLocker configuration from disturbing OS Upgrades. These should be reapplied from a Domain GPO without issue ## Remove-LocalPolicies.ps1 Deletes %SystemRoot%\System32\GroupPolicy. This clears out Local Policies that may impact OS Upgrades # Apps Files and scripts related to Applications or Appx Packages should be placed in this directory ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLDmSzIjL5fQ5XYNpNG%2F-LLDmv5gLH8UxtRg9Z1t%2F2018-08-31_2-03-44.png?alt=media\&token=fb45285b-c3f4-4b51-8ecb-dcf5bc41a115) ## AppAssocWin10.xml Sample Application Association file for Windows 10. This contains entries to use PhotoViewer instead of the Photos App for viewing Images. PhotoViewer is not enabled by default in Windows 10 and requires adding registry keys to enable ## Remove-AppxPackagesWin10.ps1 Sample script to remove Appx Packages from Windows 10. Additionally, this script will export a list of installed Appx Packages to C:\ProgramData\OSDeploy\Apps\\\* ## Set-AppAssoc.ps1 Uses DISM to import the Default App Associations file # Background If you don't want the default Hero wallpaper and the random Logon Background, then you need to customize the Background. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLT3BNPzYYgnx2_fplo%2F-LLT3S7fgvfylRMPZu8W%2F2018-09-03_1-14-32.png?alt=media\&token=7db8c009-6c41-403d-a336-264512cb64f8) ## Web This directory contains the 4k Wallpaper that is part of Windows 10. Windows does not honor a custom background set in Group Policy and a Custom Theme during Feature Updates (Upgrades). Unfortunately the only way to resolve this is to overwrite the Wallpaper that exists in this directory. Replace the contents of the Web directory with your custom Wallpaper. For my Enterprise, we use a solid blue color. Selecting a solid color prevents issues with stretching images. ## Background.bmp Used for Windows 7 ## LockScreen.jpg Custom Lock Screen image if you are going to set one. Requires Local Policy to be set to use the custom Lock Screen background. ## Set-Background.ps1 Script to make the modifications to the Background for the Lock Screen and the Wallpaper. ## Wallpaper.jpg Custom Windows Wallpaper. Requires Local Policy to be set and modifications to the Theme file # LocalPolicy LocalPolicy is the bridge to bringing your Group Policy Objects into Local Policy. Currently Group Policy and Registry Group Policy Preferences are applied using OSConfig and the Import-GPO.ps1 LGPO.exe is required for LocalPolicy to apply. This is not included in the OSConfig download ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLDoqFi9T_2uoCWYrVi%2F-LLDosyYa57bd4FsSJX0%2F2018-08-31_2-11-57.png?alt=media\&token=9384cc6a-cb90-45fa-99c6-9883bf799cf7) ## ImportGPO GPO Backups or GPO copies from Sysvol placed in this directory will be applied to Local Policy using Import-GPO.ps1 ## ImportTXT LGPO Text files placed in this directory will be processed by LGPO.exe using Import-TXT.ps1 ## LGPO Directory containing LGPO.exe as detailed on this link ## Import-GPO.ps1 Script to process GPO files contained in the ImportGPO directory ## Import-TXT.ps1 Script to process LGPO Text files contained in the ImportTXT directory ​ ​ ​ # ImportGPO Group Policy Objects placed in this directory will be applied with OSConfig ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLFknBHlyPo31rdlk4S%2F-LLFlyUt0IcWItJrwjTf%2F2018-08-31_11-18-46.png?alt=media\&token=94ad4ec5-365f-435b-8e6d-b2a5d690b01e) In the image above, the following GPOs will be applied * OSDeploy Branding * OSDeploy Win7 * OSDeploy Win10 ## Backup-GPO.ps1 Script to copy specified GPOs into the ImportGPO directory. This file can be edited as needed with the names of your GPOs ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLFknBHlyPo31rdlk4S%2F-LLFmeLV_V2IwFwUmZDS%2F2018-08-31_11-21-32.png?alt=media\&token=73d1bb26-77ab-421d-afa4-d0faa5823feb) # ImportTXT LGPO supports the import registry import using TXT files. I won't go into too much detail on this, you can learn how to use this by reading LGPO.pdf included with the LGPO download. TXT files placed in this directory will be imported by Import-TXT.ps1 ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLNp8ZPhZ2AMp1ecjrF%2F-LLNpRD15Phqf6s0vNhd%2F2018-09-02_0-50-39.png?alt=media\&token=3691b7a1-984b-4433-854e-a40309a2be4a) # LGPO Place LGPO.exe (and LGPO.pdf) in this directory. You can read more about where to get LGPO.exe from this link[LGPOwww.osdeploy.com](https://www.osdeploy.com/osconfig/downloads/lgpo)[PreviousImportTXT](/docs/untitled-1/localpolicy/importtxt)[NextImport-GPO.ps1](/docs/untitled-1/localpolicy/import-gpo.ps1) ![](https://legacy.gitbook.com/@segura/avatar) Last updated Sun Sep 02 2018 05:54:53 GMT+0000 (UTC) # Import-GPO.ps1 This script is the key to importing Group Policy. The script imports all GPO's in the ImportGPO directory. Pay attention to the naming standards. If you need a GPO in this directory applied to Windows 10 and not any other Operating System, make sure Win10 is in the name of the GPO. The same pattern applies to Win7 and Windows Server (Windows Server filtering was added to this script in version 18.9.2) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLNqOh84SnQf0aMTGZD%2F-LLNryHay5Dio2SLD0If%2F2018-09-02_1-01-15.png?alt=media\&token=2f3a39ac-e9a2-4647-b586-19fd44bebefa) ## Import Registry Preferences The same filtering is used in finding GPO Registry.xml files (Windows Server filtering was added to this script in version 18.9.2). ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLNqOh84SnQf0aMTGZD%2F-LLNsNL7tEIM1oCYTMk0%2F2018-09-02_1-01-15b.png?alt=media\&token=18b97d14-45a0-428d-8cf9-dca2b13c00c3) The next step is to mount the Default User and Administrator Registry Hives ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLNqOh84SnQf0aMTGZD%2F-LLNt5k34lscARhmYIj-%2F2018-09-02_1-05-51.png?alt=media\&token=642b2773-9772-423d-b1a7-7ff53d3f4a27) And then to go through all the XML nodes ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLNqOh84SnQf0aMTGZD%2F-LLNtJRT2f2Xm6kMcGVs%2F2018-09-02_1-05-51b.png?alt=media\&token=33fcecac-180c-45a9-89d6-a5732d126f58) And write the Registry Values into the Registry (hives will be dismounted when complete) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSiEpxc9rNGOVOfeBR%2F-LLSiz-ESpmBxC4yITc_%2F2018-09-02_23-40-15.png?alt=media\&token=bb3c607a-adca-4249-8c06-29d8678c5e1e) During execution of the script, the console output will look like this ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSiEpxc9rNGOVOfeBR%2F-LLSiIhePlr0lT7E9Pck%2F2018-09-02_23-37-17.png?alt=media\&token=ed6e0a8b-bd4d-4b2b-9366-ace06ec00970) ​ # RegistryXML RegistryXML is a method to add Registry entries into your Windows Image. Registry XML files added to this directory will be imported by Import-RegistryXML.ps1 You can easily convert existing REG files to RegistryXML files by using the following website[Registry To GroupPolicyPreferences XML ConverterRegistry To GroupPolicyPreferences XML ConverterÜber die Group Policy Preferences (GPP) kann man unter anderem Registry-Einträge per Gruppenrichtlinie an Client-Rechner verteilen. Was bei einem einzelnen Eintrag manuell noch machbar ist, wird zu einer aufwändigen und fehlerträchtgallery.technet.microsoft.com](https://gallery.technet.microsoft.com/scriptcenter/Registry-To-GroupPolicyPref-9feae9a3) # Scripts Scripts are where you should put general PowerShell scripts to configure your deployments. Samples have been provided. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSldcgrF7Qp2MwNkKF%2F2018-09-02_23-47-54.png?alt=media\&token=1890d22c-34a2-4798-a159-b015ead15bc6) ## Disable-VmPasswordChange.ps1 Script sets a registry value if the Computer Model is like 'Virtual'. The Machine Password change is what prevents reverting back to old snapshots on Domain joined computers ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSnl27mrwcTydI7enK%2F2018-09-03_0-00-56.png?alt=media\&token=4d185aa3-61e0-4c82-9ade-d2163dde10a3) ## Enable-RemoteRegistry.ps1 Script enables the Remote Registry service ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSnSBqA_pzRmA0u5iV%2F2018-09-02_23-59-22.png?alt=media\&token=19eaa78e-4526-4c0b-9ddc-ebcba479bba9) ## Remove-OneDriveShortcut.ps1 This script will remove the OneDrive shortcut from the Start Menu ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSn1y-jU70tzurahxn%2F2018-09-02_23-57-50.png?alt=media\&token=afcb84eb-56f6-439a-b7b4-2c3e58eb63b4) ## Set-OemModel.ps1 The purpose of this script is to set the OEM information with the Computer Manufacturer and Model. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSm19_EEWtMYOA8xrO%2F2018-09-02_23-51-24.png?alt=media\&token=90913a1d-e216-4a15-ab4a-9c555ea7811e) Script Processing ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLSkKX9HATPGmlE4aR4%2F-LLSmXpvu4TanR9ZOp2j%2F2018-09-02_23-55-52.png?alt=media\&token=c99d83c3-0243-4648-9cf6-b63384e73bfc) Script Results ​ ​ # Start This page is incomplete and is being updated Customizations to the Start Layout should go in this directory. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLT5INrUTXUtbR_h6xK%2F-LLT5Vz4gaCaJHUgJRYQ%2F2018-09-03_1-23-27.png?alt=media\&token=1b086541-d84f-47f1-bde6-5e0e93619558) ## LayoutModificationWin10.xml Sample Layout Modification. Copied to ​ ​ # Theme Theme customization is important if you want to get rid of the "Hero" wallpaper for new users. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLXjHrBwp3C3sXByR_E%2F-LLXjTFKX6r3_27LlFAU%2F2018-09-03_23-01-03.png?alt=media\&token=5a8d6fe9-f16e-4526-9bd2-356cc1138358) ## Set-Theme.ps1 This script will determine the Operating System and copy either the Win7.theme or the Win10.theme to Custom.theme (in this directory). Set the Theme file to %ProgramData%\OSConfig\Theme\Custom.theme in Group Policy ## Win7.theme Windows 7 Aero Theme file with the Wallpaper entry removed ## Win10.theme Windows 10 Aero Theme file with the Wallpaper entry removed # Zeta Zeta exists to process scripts at the end of OSConfig. In this case I process the Backup-Registry.ps1 script that was executed in the Alpha component ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLT1LR2gg_NBbNgdERx%2F-LLT1XbavghAy3HdFGwZ%2F2018-09-03_1-06-18.png?alt=media\&token=ae5b391a-2973-4c58-8053-4779776ef99f) ​[PreviousTheme](/docs/untitled-1/theme)[NextGroup Policies](https://www.osdeploy.com/osconfig/docs/group-policies) ![](https://legacy.gitbook.com/@segura/avatar) Last updated Mon Sep 03 2018 06:08:11 GMT+0000 (UTC) # Group Policies # Best Practices I'll keep this page updated with Best Practices when creating your OSConfig Local Policy ## Policy Comments Always include comments when editing your Policies . . . ## Edit Local Policy with Reg Keys Don't do this! See the following link[https://www.osdeploy.com/osconfig/group-policies/best-practices/edit-local-policy-with-reg-keyswww.osdeploy.com](https://www.osdeploy.com/osconfig/group-policies/best-practices/edit-local-policy-with-reg-keys) ​ # Edit Local Policy with Reg Keys ## Edit Local Policy with Reg Keys If you are adding registry entries in any of the following Keys in the Registry in your Task Sequence . . . * HKEY\_CURRENT\_USER\Software\Policies * HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Policies * HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies * HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKAuHVN3q0Xpn4QxuOH%2F-LKAyEtKLNlR3-mOkqvv%2F2018-08-18_2-30-23.png?alt=media\&token=9effb4af-d8f6-4a5b-b07a-8ff4350b498d) Stop doing this! Make your changes the right way . . . Manage these changes using Local Policy, Group Policy, or ConfigMgr! ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKAuHVN3q0Xpn4QxuOH%2F-LKB-DzbJQECHJm5WJET%2F2018-08-18_2-46-33.png?alt=media\&token=ea65f341-a6d6-4641-8baf-8f1ba8a305f5) Last updated Fri Aug 31 2018 18:05:15 GMT+0000 (UTC) # Active Directory GPO You can create a Local Policy for OSConfig by creating an Active Directory Group Policy Object. If you have Full Control of Active Directory and you can create a GPO, then good for you. My role in my Enterprise is to customize the Operating Systems, and to create our Deployment strategy for Operating Systems. I am not a Security Expert . . . so I will not get deep into the Security side of things when working with GPOs. For the purpose of this guide, I will detail how to create a GPO for OS Customization only. It is up to you to determine the strategies for enforcing and item level targeting. To be clear, the GPO's that we will use will not be used for Policy on a Domain, but for OS Deployment only. Back to AD . . . I have rights in my Enterprise to create a GPO, but not to link it to an OU. I turn those into our AD team to implement, but if I am going to use a GPO for OS Customization only, then no need to turn over the GPO . . . which means I maintain full control. If you do not have rights to create a GPO, get with your Active Directory guys to create these for you and grant you permission to edit them, and let them know it's ok if you don't get permission to link them to an OU. I manage a mixed Enterprise of both Windows 10 and Windows 7 so this guide will detail both If you do not have rights to Active Directory Group Policy Management, then why not create a VM Domain Controller? ## Create GPO's I recommend creating the following GPOs in Active Directory ​ # Build a Domain Controller If you do not have rights to create a GPO in Active Directory, or you do not use Active Directory, you can easily build one in a Virtual Machine. Create a new Virtual Machine without External Network Access (you don't want to see your Production Network). You can add a Network Adapter with 'Internal' to access your PC if necessary ## Install Windows Server 2016 Standard (Desktop Experience) Take the Defaults ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSJGYkwXSlM0XGjrNL%2F2018-08-21_11-28-05.png?alt=media\&token=23d6e53e-d75a-4146-b761-a7d9bb04bd88) Select Windows Server 2016 Standard (Desktop Experience) ## Rename Your Server Choose a friendly name ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSKYgYuc67Eu3NaPPV%2F2018-08-21_11-33-43.png?alt=media\&token=b222442e-1be8-41d1-8058-9eb87ebc6bf7) ## Add Roles and Features Add Active Directory Domain Services ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMCZw2HOpFmHDRxAc%2F2018-08-21_11-37-26.png?alt=media\&token=3ff857f3-c7e1-4b7e-9f17-da47f2652123) Group Policy Management Feature should automatically be selected ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSML5grgjbd_OmG-zD%2F2018-08-21_11-37-35.png?alt=media\&token=3b2c694d-f7b6-425e-b4c9-7a47c0acc94e) Promote the server to a domain controller ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMY7FIaWPqIyOONOP%2F2018-08-21_11-39-12.png?alt=media\&token=96bd9607-2e07-4150-9c28-3ca661f35052) Add a new forest and specify a Root domain name (make one up) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMeiY4tenmOKU0kmQ%2F2018-08-21_11-39-55.png?alt=media\&token=ab13d77c-c375-4269-8086-80d23b6d8677) Set the DSRM password ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMlAublC68jqCd9RJ%2F2018-08-21_11-40-15.png?alt=media\&token=87677b49-504d-44bb-8bf3-3a297d60056d) Press Next on the next few screens ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMwcMsl4s9Q6l5Ja3%2F2018-08-21_11-40-43.png?alt=media\&token=63b05f18-fe63-4033-9856-dcdab603108e) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSMzWB6DURXgHuXvTK%2F2018-08-21_11-40-59.png?alt=media\&token=31f65871-0fae-4512-9068-272bbcfc721e) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSNHpXlpQxL4HcaKZ8%2F2018-08-21_11-45-07.png?alt=media\&token=bdea3311-fd2f-47a2-948d-28db44ce258e) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSNNncFUH8s7-yGh2A%2F2018-08-21_11-45-19.png?alt=media\&token=43dbf7f1-6780-4f4b-8ef7-edf03253e2db) Press Install ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSNRkbSTIitTP63d9V%2F2018-08-21_11-45-49.png?alt=media\&token=607b0f13-d7c5-4035-8055-aa358fe6ed53) A Restart will be required to complete the installation ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSHEyCM5JQm-MmCW_s%2F-LKSNtFB-1ZbTU_RJTA0%2F2018-08-21_11-48-23.png?alt=media\&token=636a84cb-2208-42e2-ab3d-cb72c6c0428d) ​ # Update ADMX Templates The goal of this section is to setup a GPO with Policies and Preferences (Registry) for Windows Deployments. If you do not manage Active Directory, then don't worry about this step. Get your AD Team to get the latest ADMX Templates published. ## Install ADMX Templates Make sure that before you start, you have updated your ADMX Templates from this link ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSOdzXCbltoxdbZYRU%2F-LKSOm7DLiT9ziOCjRVl%2F2018-08-21_11-51-45.png?alt=media\&token=5e8958e8-c896-422b-af06-adaca5037949) ## Copy Policy Definitions Copy the PolicyDefinitions from C:\Program Files (x86)\Microsoft Group Policy\\\* to your SYSVOL (C:\Windows\SYSVOL\domain\Policies) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSOdzXCbltoxdbZYRU%2F-LKSPoBYqEQzqFPjes8c%2F2018-08-21_11-57-02.png?alt=media\&token=87993ea2-42ef-46b1-a06f-8ae56d5a324d) Remove Languages that you don't need ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSOdzXCbltoxdbZYRU%2F-LKSQ7JUQUYEPM6OQudC%2F2018-08-21_11-58-19.png?alt=media\&token=b84096c7-c98d-4ca9-b6d9-ad37e87e0cfe) ## Open Group Policy Management Everything looks good! ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LKSOdzXCbltoxdbZYRU%2F-LKSQSc_cwuToYBzvKFQ%2F2018-08-21_11-59-41.png?alt=media\&token=f2c864fa-1637-4839-8ba8-4199e095330e) # Local vs Domain Policies Applying a Domain GPO to a Workstation for OS Customizations is not the same as a Domain GPO that is Enforced. This means that even though you can use a GPO to do the OS Customizations, it is no different than setting a Local Policy. Anyone with Administrative Rights will be able to open GPEDIT.MSC and make the change ## Enforcing Policies If you need to Enforce any of these settings, you must join the computer to a Domain and link the GPO to the Computer or User's OU. This guide will not go into doing this, but if you want to go this route, keep your Enterprise OS GPO's used for customizations separate from your Enforcement. ## Registry Group Policy Preferences Registry Group Policy Preferences are applied by editing the Current User, Local Machine, and Users hives. Additionally, the Default User and Administrator (if applicable) hives are mounted and modified. In this instance, there is nothing preventing these settings from being undone. Just like Enforcing Policies above, if you need Registry modifications Enforced, they must be set in a Domain GPO. ## Workgroup Policies I work in a large Enterprise, and what makes my situation a challenge is that there are instances where we deploy systems that are not joined to a Domain. These are Workgroup Computers. If all your computers are Domain joined, then you have it easy . . . but if you deploy an OS for Workgroup and Domain, keep your Policies and Preferences for Enterprise OS configured for the Workgroup Computer. Domain settings can be applied from an Active Directory GPO when the Computer logs into the Domain with a Domain User Account. What this means is that for Workgroup Computers, set your Internet Homepage to the public Corporate Homepage . . . and let your Intranet Homepage be set for Domain Computers. If the Workgroup Computer will be disconnected from your Domain, don't mess with applying WSUS settings, leave things pointing to Windows Update. Don't set CM settings in your Policies, let CM handle this . . . basically if these settings are already being configured by your Domain GPO, there is no need to set these in Enterprise OS. ## Summary To sum it up, the Group Policies that will be used in OSConfig should only be used for OSConfig, and not for Policy Enforcement, just as your current customizations in your Task Sequence are only for customizations during OS Deployment, and not for any other purpose after the OS has been deployed . . . and keep in mind if you deploy computers in Workgroups or not when configuring your settings. # Import OSDeploy GPOs The OSConfig repository you downloaded includes some sample Group Policy Objects. These are GPO Backups (not copies from Sysvol). ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLFknBHlyPo31rdlk4S%2F-LLFlyUt0IcWItJrwjTf%2F2018-08-31_11-18-46.png?alt=media\&token=94ad4ec5-365f-435b-8e6d-b2a5d690b01e) ## Create and Import OSDeploy GPOs In Group Policy Management, create a new GPO. In my example I have created **OSDeploy Branding**. Right click on the OSDeploy Branding GPO and select **Import Settings** ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLG9r3d9i6N5aLO7dZa%2F-LLGAzCI-LWbO9g7VcfN%2F2018-08-31_13-12-27.png?alt=media\&token=d9073ad7-0b1b-4a2a-a218-849884bd3998) Select the OSDeploy Branding GPO from the OSConfig Repository and import it ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLG9r3d9i6N5aLO7dZa%2F-LLGBYSLGkjNQvb7WZNm%2F2018-08-31_13-14-09.png?alt=media\&token=538372e4-6402-4880-95e5-e0a03346f0c8) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLG9r3d9i6N5aLO7dZa%2F-LLGBfp19aH9_FnDVHXU%2F2018-08-31_13-14-52.png?alt=media\&token=64f5cf06-b1ef-42cb-bc8b-c51d41e6c7ce) ## Complete Repeat this process for OSDeploy Win10 and OSDeploy Win7 and you should be ready to start editing the GPOs ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLG9r3d9i6N5aLO7dZa%2F-LLGCD0GRlKGOlMUe_yG%2F2018-08-31_13-17-39.png?alt=media\&token=0c3236ad-5a5b-4f16-8ea6-7b4307ee20b0) # Edit OSDeploy Branding GPO Now that you have imported your OSDeploy GPOs, you can edit them. OSDeploy Branding should contain all your unique settings for your Enterprise. ## Filter Policies for Easy Viewing The easiest way to see configured Policies is with a Filter set to Configured Policies ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLGG22wFRsZ8Vd6cHPz%2F-LLGGiIvHi25sHlYYJK0%2F2018-08-31_13-37-06.png?alt=media\&token=a6a3aa02-2890-4dab-a484-21185d146a74) ## Configure Start Pages Set your proper Edge Start Page ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLGG22wFRsZ8Vd6cHPz%2F-LLGGxPS0Da-R9XgzmcT%2F2018-08-31_13-38-16.png?alt=media\&token=7d0988bc-0df5-489b-8745-888fa770d2b2) ## Logon Image, Default Associations, Start Layout, and Theme (User) The remainder of the Policies are as needed. Disable the Policies you do not intend to use ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLGG22wFRsZ8Vd6cHPz%2F-LLGHMzJpYFdsdl4EYXH%2F2018-08-31_13-39-26.png?alt=media\&token=083b8f02-2c83-40c1-92ee-d45011e698ad) ## Edit Registry Preferences Edit the existing registry entries for your Enterprise for both Computer and User Configuration ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLGG22wFRsZ8Vd6cHPz%2F-LLGI1K2UZxoRZ5o87pJ%2F2018-08-31_13-42-11.png?alt=media\&token=b3ddf8fe-e277-4856-9a25-4d20fa8278ee) ## Complete Once you have made these changes, simply Backup or Copy this GPO and place it in OSConfig at the following path ``` OSConfig\LocalPolicy\ImportGPO\OSDeploy Branding ``` ​ # Provisioning Packages You can easily convert OSConfig into a Provisioning Package for Windows 10 once you have all your settings complete. Before getting started, you will need to install Windows Imaging Configuration Designer (WICD or Windows ICD). This is a component of the Windows ADK so get this installed before getting started. You will also need to create CAB files when creating Provisioning Packages. You can easily make one using the [OSDeploy PowerShell Module](https://www.osdeploy.com/osconfig/downloads/osdeploy-powershell-module)​ ## Articles * ​[PowerShell Script to PPKG](/docs/untitled-3/powershell-script-to-ppkg) - Convert a PowerShell Script to a Provisioning Package * ​[OSConfig to PPKG](/docs/untitled-3/osconfig-to-ppkg) - Convert OSConfig into a Provisioning Package ​ # PowerShell Script to PPKG In this example, the PowerShell script Set-OemModel.ps1 will be converted to a Provisioning Package. This script is part of OSConfig and found in the OSConfig\Scripts directory. This script has a simple purpose of setting the OEM Model information in System Properties. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_iliKdB2f1uJcXXsD%2F2018-09-02_23-55-52.png?alt=media\&token=ecac3f26-9c7e-4b15-9eaa-7319b049806c) ## Windows Imaging and Configuration Designer If you don't have WICD installed, you can get it from the Windows 10 ADK. Create a new Project ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_jCJJhBsj6EjMpC6a%2F2018-09-04_12-58-43.png?alt=media\&token=209ee04f-90b4-4e55-8ac1-720697b0b2e3) ## Switch to Advanced Editor Switch from the Basic to the Advanced Editor ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_jU-CvnhOcjlzogri%2F2018-09-04_12-59-34.png?alt=media\&token=8dc69a34-951f-4812-b898-55905f2361ca) ## Remove Runtime Settings Select Runtime settings from the right Navigation Pane and select Remove ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_k2xpxXmCFhxAWV_M%2F2018-09-04_13-01-41.png?alt=media\&token=10107926-b6ad-4f36-8076-1a5005b608ef) ## Create a ProvisioningCommand In the left Navigation Pane, expand ProvisioningCommands and PrimaryContext. Add a Name and press the Add button ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_kzg8AiNUzT7hKw_1%2F2018-09-04_13-05-18.png?alt=media\&token=c22e40d4-426f-4ba4-a07c-d17be34e7fa7) ## Set the Command Select the Command on the Left Navigation Pane. In the Main window, Browse for the PowerShell file and enter the following CommandLine ``` PowerShell.exe -ExecutionPolicy Bypass -File Set-OemModel.ps1 ``` Set the other values ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_mfhMrDXFEkYQY_G2%2F2018-09-04_13-13-17.png?alt=media\&token=d22dce08-32c8-4551-b910-084b6b11782e) ## Export the Provisioning Package Select Export from the top Menu and then select Provisioning package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_nCQvCpQPrRXINS8B%2F2018-09-04_13-16-02.png?alt=media\&token=3cc94aa9-5a44-40ff-84b2-508237c0853c) ## Build Owner Change the Build Owner to IT Admin ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_nSMXNDydHD3b6IHN%2F2018-09-04_13-16-57.png?alt=media\&token=7a0db67b-5c89-481e-bd2c-3c875be70900) ## Build Security Leave this blank for general Provisioning ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_ngRG3xiRmfZQMAVC%2F2018-09-04_13-17-55.png?alt=media\&token=a8d2b017-b68f-4589-9bb2-4dffceee02cd) ## Save Path Set the proper location to save the Provisioning Package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_oJw6vABFEL3WR8MR%2F2018-09-04_13-20-52.png?alt=media\&token=a2bbaeda-9fb8-47ee-be70-cba4d3d8778d) ## Build Build the Provisioning Package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_oT9YOsYzucXJdin2%2F2018-09-04_13-21-30.png?alt=media\&token=5058e56d-7039-4b47-9dcb-c894b3c85736) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_oYTvxfO4Tzrq2DW1%2F2018-09-04_13-22-10.png?alt=media\&token=91ca5869-c74c-4dfb-b6fc-1e8f4a8047b2) ## Testing You can easily test a Provisioning Package by simply double clicking on the file. You will be prompted for confirmation ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_or4RIIX_qaA1SHrg%2F2018-09-04_13-23-09.png?alt=media\&token=559a893d-44b9-4ff0-b4a7-ba075cedc749) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_hfn01nEHFwm-_y4g%2F-LL_p7sI1Y_e-kTCklpL%2F2018-09-04_13-24-13.png?alt=media\&token=791a5ac6-547e-44ae-bd56-ab6b320ec11b) ## Validation Here is a before and after to show the results ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_rCpxohq9rY3wAhfF%2F-LL_rIejahPnEIr3inHP%2F2018-09-04_13-32-32.png?alt=media\&token=570f6773-eeee-45d0-b2ff-0ec3c3405ed5) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_rCpxohq9rY3wAhfF%2F-LL_rKc1aNjGtyFTUl5b%2F2018-09-04_13-32-55.png?alt=media\&token=c3a22b2e-f4b2-479e-9808-336a59fcd28f) ## Download You can download the Provisioning Package created in this page by selecting the link below ## Further Information Provisioning Packages are expanded to the Current User %Temp% directory ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LL_smmckOUyo6m2f0fa%2F-LL_sy55A4dQs445Rmc_%2F2018-09-04_13-27-55.png?alt=media\&token=935d896c-bba1-4dc7-87af-b55c7bbe2abd) In the case of Provisioning Packages that are executed in OOBE, they are in the following location ``` %SystemRoot%\System32\Config\SystemProfile\AppData\Local\Temp\ProvisioningPkgTmp\* ``` ​ # OSConfig to PPKG This is the Cheddar. If you have OSConfig customized to your liking . . . you can proceed to the Finish Line and create a Provisioning Package. You can following this process or use the Microsoft Guide linked below ## OSDeploy PowerShell Module Before going any further, make sure you have the OSDeploy PowerShell Module installed, unless you want to create a CAB DDF file manually. ## Convert OSConfig to CAB Use New-CAB (OSDeploy PowerShell Module) to create a CAB from a Directory using the following command ``` New-CAB -SourceDirectory D:\DeploymentShare\OSDeploy\OSConfig ``` ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa3jUFNB83d138RQQM%2F2018-09-04_14-32-23.png?alt=media\&token=7bf399b5-8b21-4db5-b603-dc1df7095830) When complete, you will have a DDF (Directive File) and CAB ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa4uWLWhdtYC-shFj3%2F2018-09-04_14-35-01.png?alt=media\&token=68fa3ef3-2f8a-4afe-be23-4f5285b6b7b1) ## Create a New Advanced Provisioning Package Using WICD, create an Advanced Provisioning Package and enter some random details ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa5g4HmoZZB43eCcrm%2F2018-09-04_14-39-28.png?alt=media\&token=c383d55f-9eda-4032-bc23-7e7038a3ab0c) All Windows desktop editions should work fine ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa5qSrIe2-eC3AFEfa%2F2018-09-04_14-39-53.png?alt=media\&token=6545df5c-06d2-42e9-bae1-8fde9e82986e) ## Create a Provisioning Command In the left Navigation Pane, expand ProvisioningCommands and PrimaryContext. In the Name field, enter OSConfig and press the Add button ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa6_F2Kaw4PxC_6K_a%2F2018-09-04_14-44-50.png?alt=media\&token=39c7a9f7-6915-4761-9112-87aabf8b39e2) ## Set the Command File Select the Command on the Left Navigation Pane. In the Main window, Browse to OSConfig.ps1. Enter the following CommandLine ``` PowerShell.exe -ExecutionPolicy Bypass -File OSConfig.ps1 ``` Set the other values as shown ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa7nvdZJALcKbSeXJi%2F2018-09-04_14-50-26.png?alt=media\&token=15a6f538-3cc6-4fcc-93f6-fd0c38efca24) ## Add a Dependency Package Now its time to add a Dependency Package. In the Left Navigation Pane, select DependencyPackages. In the Main window, Browse to the OSConfig.cab and press the Add button. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa8Dm8PRAsDfVRnMw9%2F2018-09-04_14-52-12.png?alt=media\&token=11d35daa-baac-4427-bb3a-c9677ca9f778) ## Export the Provisioning Package Select Export from the top Menu and then select Provisioning package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa8_1UM08i4SrfwM9u%2F2018-09-04_14-53-48.png?alt=media\&token=aabff1ec-f74c-4714-9abf-8e4c5693c511) ## Build Owner Change the Build Owner to IT Admin ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa8m3KTo3bTCdmuQTi%2F2018-09-04_14-54-37.png?alt=media\&token=b977b96a-b0a6-4aab-a1eb-c99065ec24ad) ## Build Security Leave this blank for general Provisioning ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa8xgnTawzKxfK5knq%2F2018-09-04_13-17-55.png?alt=media\&token=9142398d-b653-4c18-b4db-9bd1294cf45c) ## Save Path Set the proper location to save the Provisioning Package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa980sF0-wJHzQ0Z7C%2F2018-09-04_14-56-28.png?alt=media\&token=fa1ec02e-a3a3-41c7-a646-821ab49be6a8) ## Build Build the Provisioning Package ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa9Fy3mAsSZVDoATnA%2F2018-09-04_14-56-52.png?alt=media\&token=3796cfed-09df-4f6a-af2f-5dd8f5e4c4ff) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa9LX96GpV88femPkA%2F2018-09-04_14-57-21.png?alt=media\&token=eed668bb-6d5a-4438-8f6b-374ade0255bc) ## Complete Now you have a complete OSConfig as a Provisioning Package. You can now use this in your OS Deployments ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLa1UvcMvZoaBXkyqEv%2F-LLa9e3flBo50eui9hu_%2F2018-09-04_14-58-17.png?alt=media\&token=da60e969-1abd-4c52-a6c3-3af64705a900) See this link for guides on adding the Provisioning Package in the Task Sequence ​ # Registry Working with the Registry is probably the most important things about customizing Windows. Everybody does it, and there are many different ways to do it. Most resources you will find typically add Registry entries from the command line (Reg Add), others import a REG file, or run a CMD or PS1 script. I will not go into detail on any of these methods, instead focusing on GPP Registry and RegistryXML Files. ## Articles * [Group Policy Preferences](broken://pages/-LLbqKELmR5lIVk5V9u4) * [GPP Registry.xml](broken://pages/-LLc0Zbx0XCzWpZ9t9GQ) * [GPP RegistryXML Files](broken://pages/-LLcMSaLX5NOW6BXXISC) * [Convert REG to RegistryXML](broken://pages/-LLcRTjb8mFwbsxJlb1O) * [Apply RegistryXML Files](broken://pages/-LLcVB0eAUJf18zIoVrv) ## Conclusion After reading the above articles, you should have a firm understanding of GPP Registry and how to create and apply RegistryXML Files. You can easily create your own RegistryXML library of settings instead of adding multiple Run Command Line steps in your Task Sequence. **Please share your favorite RegistryXML additions to Windows so I can add them to the RegistryXML Library!** # Group Policy Preferences Let's start with a Group Policy Object. Both Computer Configuration and User Configuration contain a Registry section under Preferences\Windows Settings. The purpose of these sections is to add Registry values and apply them through the GPO. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbuPjOk4X9NyiylUHd%2F2018-09-04_23-05-53.png?alt=media\&token=7c595e43-aa80-4a5f-b6c3-63bd8103a762) ## Adding a Registry Value You can add a Registry Value by using 'Registry Item'. Think of 'Collection Item' as a folder. 'Registry Wizard' allows you to browse and copy values from the system Registry. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbutDFogZtFbcc7fNy%2F2018-09-04_23-08-47.png?alt=media\&token=d577dfff-58e9-475c-b19a-46f8fb9a4d0d) ## Create a Collection Item Start by creating a **Computer Configuration Collection Item** called **Registered Owner** by right clicking on Registry and selecting **New > Collection Item**. As you can see a **Collection Item** can also be described as a Folder. This is useful in organizing entries. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbw0Gn-jKao8iGpBty%2F2018-09-04_23-13-46.png?alt=media\&token=32917809-db31-46d4-ac19-d9e047927701) ## Create a Registry Item In the **Registered Owner Collection Item**, right click on **Registered Owner** and select **New > Registry Item**. In Key Path, browse to **HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion** and select **RegisteredOwner**. Press the **Select** button. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbxXGHAy8W0KqW53N7%2F2018-09-04_23-18-11.png?alt=media\&token=8762de2d-e431-4925-bcc4-2325a711cdee) Now you can set the Value data to whatever you want and press OK to save it ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbxsUj14ZwltjoX8OK%2F2018-09-04_23-21-26.png?alt=media\&token=88de746e-bee7-4d96-abc0-4934405badc9) And now you have created your first Registry Preference ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbyFiqNi_64T_Xdjg2%2F2018-09-04_23-23-17.png?alt=media\&token=95b4d3f7-eea1-4e08-8431-6d6fe224799e) ## Using Registry Wizard Instead of selecting New > Registry Item, try **New > Registry Wizard** instead. This will bring up a **Registry Browser** and allow you to select multiple Registry Items. Press **Finish**. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLbzY8R83-n3zYXVY6l%2F2018-09-04_23-28-41.png?alt=media\&token=2128810a-9652-44f3-9237-37821b264f39) Now you have nested **Collection Items** (Folders) with the Registry Values that were checked. You can edit these as needed. One thing about using the Registry Wizard is that I absolutely hate working with it. For one thing I have noticed, not everything checked seems to transfer over . . . the second thing is that you cannot maximize the Registry Browser window. This is absolutely annoying! ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLbqIf_33VsJ7Oh72TU%2F-LLc-_ooCiBz7Qyn0Exq%2F2018-09-04_23-33-38.png?alt=media\&token=7a5b5e6f-3451-4176-9780-3285bb4511a5) ## Next Steps Now it's time to learn about Group Policy Registry.xml on the next page . . . # GPP Registry.xml Let's take a look at Group Policy Preferences Registry.xml . . . ## GPO Unique ID Every GPO has a Unique ID (GUID). This can be found in the GPO Details ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLc0YKiyRxmhb_j36bN%2F-LLcId0oirlTmlSMRAvw%2F2018-09-05_0-56-22.png?alt=media\&token=0b528751-897c-4e36-9756-f8bc655895f8) ## Sysvol In the Domain Sysvol, the Unique ID is in the Policies. If you have set a GPP Registry item, all the Registry entries are saved in a file called Registry.xml. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLc0YKiyRxmhb_j36bN%2F-LLcJnvhfG8J8DMk5kl3%2F2018-09-05_1-00-22.png?alt=media\&token=309d8671-3e46-47a1-bd93-a948fe1dd1ce) ## Read GPP Registry.xml If you have installed the OSDeploy PowerShell Module . . . You can easily read the GPP Registry.xml file in PowerShell ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcQvTg_a-nJ-DOflzi%2F-LLcQzTTMHbTacxkpQM0%2F2018-09-05_1-33-26.png?alt=media\&token=6ac84c59-217e-4af7-b58c-33baa98c564c) ## Apply GPP Registry.xml OSConfig automatically applies Group Policy Preferences Registry.xml when the GPO is added into the LocalPolicy Customization ​ Last updated Wed Sep 05 2018 06:33:56 GMT+0000 (UTC) # RegistryXML Files While the Policy contains a Registry.xml file, you can actually create separate, individual XML files that contain Registry settings. I call these RegistryXML Files . . . The neat thing about working in Group Policy Management is the fact that you can Copy anything from GPP Registry ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcN3OBygvMf38dttE-%2F2018-09-05_1-16-12.png?alt=media\&token=8c0ee8b4-8a12-4722-b1fd-0eb2cb620019) And Paste it in Windows ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcNYadNuubE0D48eV9%2F2018-09-05_1-18-15.png?alt=media\&token=822eb46f-8a9e-4c0a-8d08-c89ad03e56e1) So what does this mean? ## RegistryXML Library This is why I included a RegistryXML Library as part of OSConfig. This allows you to select whatever files you want in Windows Explorer, and Copy them to the Clipboard ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcOT3nXw1Kwfwru6AJ%2F2018-09-05_1-21-53.png?alt=media\&token=46402f77-95bb-4b34-b92f-40933cfa109b) And Paste them right into Group Policy Management Preferences ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcOwqVEMiXwuiUDk35%2F2018-09-05_1-24-14.png?alt=media\&token=fdaf3924-c588-4744-9b81-83bafca6a539) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcPMC4VpFBhIS-WvIR%2F2018-09-05_1-26-22.png?alt=media\&token=e35d5d7a-2f1c-4d8a-ab8f-a1e8992a80ae) ## Show-RegistryXML Works like a champ! ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcMJNXENIGdCf-GefE%2F-LLcQay3ktGc3c5Pn5jL%2F2018-09-05_1-31-31.png?alt=media\&token=d06601ed-0532-46e6-b3bc-5db36aef4d8c) ​ # Convert REG to RegistryXML Here is where things get very easy . . . let's first find a REG file that we want to add to Group Policy. A great place to find all kinds of REG files is to check at Ten Forums. Here is one that will add an **Edit with PowerShell ISE as Administrator** in the Context Menu. In the link below, download the REG file A simple right click and Copy on the XML file your downloaded, then Paste into Group Policy Management. These Registry values will be added by OSConfig when adding the GPO to the LocalPolicy Customization # Apply RegistryXML Files While you can add your Registry settings in Group Policy Preferences, there is an easier way. Simply place the RegistryXML file you created on the last page in your **OSConfig\RegistryXML\ImportXML** directory. OSConfig will automatically apply any XML files in this directory to the Registry of the Deployment OS. ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LLcRPTOIEJqhCRkP2MS%2F-LLcVrA_2VniI5YzBU3m%2F2018-09-05_1-54-27.png?alt=media\&token=741b5fbe-a7fe-4506-9616-92c42daf2256) ## Wrap-Up After switching to RegistryXML, there is absolutely no way I am going back to multiple steps in my Task Sequence for making Registry modifications . . . Keep this in mind . . . **until you separate your Customizations from your Task Sequence, you will never be able to create Provisioning Packages to apply the Customizations.** # How To The following pages will detail how to perform specific activities with OSConfig. Content coming soon # Theme Customization Get a copy of your aero.theme file from C:\Windows\Resources\Themes and copy to a subdirectory of OSConfig called Theme ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LJMX-Q8oGKnBtUBJC1Z%2F-LJMXMN8e8cfLRHjQQP8%2F2018-08-07_21-15-41.png?alt=media\&token=ba27b72a-99d3-4b10-adb1-491bbf581fdc) Rename the file to Custom.theme Edit the file and change the Wallpaper from the default value to the following line and save it ``` Wallpaper=%ProgramData%\OSConfig\Background\Wallpaper.jpg ``` ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LJMX-Q8oGKnBtUBJC1Z%2F-LJMXnzEHbT6HhdaWec4%2F2018-08-07_21-18-51.png?alt=media\&token=64083be3-985d-4771-97c5-172d694fb84c) ![](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LDKRxGiKLYjW1gana2O%2F-LJMX-Q8oGKnBtUBJC1Z%2F-LJMXsAVn5MgFHXyq3Ph%2F2018-08-07_21-20-13.png?alt=media\&token=90e346dc-141d-4cbd-9d8f-9b25775d03d2) ​