Michael Niehaus technology ramblings
Out of curiosity, I measured the amount of network traffic generated by Windows Update during a bare metal installation of the OS when there are no updates to install: I was using the 25H2 July WIM file from Microsoft and updating it as part of the DeployR bare metal installation process, so the only expected [ ]
These AI-inspired large Patch Tuesday updates are causing issues. Having cumulative updates suddenly picking up hundreds of individual fixes per month finally seems to have pushed WSUS over the edge: While most people noticed this after the July cumulative update, we actually noticed this earlier while working on DeployR, which has the ability to install [ ]
As I do a lot of bare metal deployments, I routinely download the latest Windows 11 ISO from https://my.visualstudio.com (subscription required, you can also get them from https://admin.microsoft.com with other subscriptions). And it never fails, they keep getting bigger. Look at the five that I have on hand: All of these are Hudson Valley releases, [ ]
Microsoft confirmed it today: https://techcommunity.microsoft.com/blog/windows-itpro-blog/get-ready-for-windows-11-version-26h2/4529367 Windows 11 26H2, like Windows 25H2, will be an enablement package, so no full OS swap feature upgrade will be needed. Given past announcements around Windows 11 26H1, released to support new ARM64 hardware, that mentioned that 26H1 cannot be upgraded to 26H2, that…
I ve been using Entra Connect Sync, formerly AAD Connect, for a long time (going back to the days when ADFS was considered the best way but it was also the most complex to implement and I had no real desire to do that). But with recent improvements to the Hybrid Azure AD Join process [ ]
Going way back into the time machine, there were third-party utilities like GhostWalker (remember Ghost?) and NewSID (from Sysinternals) that could prepare Windows for imaging. Eventually, Microsoft said you must use Sysprep, as that s the only supported way to prepare an OS for duplication. That should be the end of the story right? Not quite. [ ]
You ve all probably seen a dialog like this when using a Windows Installer MSI to upgrade an existing product: OK, files are in use. And you ve probably also seen messages where Windows Installer then says that it was unable to close the applications. But what do you think would happen if you saw this dialog, [ ]
Microsoft announced late last year that the standalone version of Microsoft Connected Cache for Enterprise is now generally available (so no longer just in preview), with one new feature added: support for HTTPS content. Before we dig more into that, let me explain what MCC for Enterprise is. This is the new standalone version of [ ]
It started off as a simple exercise: I want to grab the latest Insider build containing the features likely to be included in Windows 11 26H2 later this year. Which channel and build would that be? The answer, as illogical as it sounds, is yes. In true Hitchhiker s Guide-style, you might then ask well then, [ ]
PowerShell ships with providers that expose things like file systems, the registry, certificates, environment variables, etc. To see which are available in your PowerShell session, you can use Get-PSProvider: Not surprisingly, these behave differently based on the type of data or objects they are working with. So Microsoft provided a way to extend the provider s [ ]
Since Microsoft unceremoniously announced the immediate retirement of the Microsoft Deployment Toolkit (something that isn t surprising since it really hasn t been updated in any significant way since 2013 and leverages obsolete technologies such as VBScript and MSHTA), some of you are probably looking for a replacement. As many of you are probably aware, I ve been [ ]
I mentioned in passing in a previous blog post that the immediate retirement of MDT was caused by Microsoft not wanting to fix a security vulnerability identified by security researchers in the MDT monitoring service. If you aren t using the monitoring service, you re OK (as long as you follow some general best practices described below). [ ]
Way back in 2008, I published a blog post (now captured by the Wayback Machine) that gave a concise history of BDD, now known as MDT. Eighteen years later, I can now complete that story and expand on some of the items in more detail. (I will refrain from getting too carried away, hence the [ ]
Way back in December 2024, Microsoft released the ConfigMgr Tech Preview 2411 release. It wasn t long after that before the India-based team maintaining ConfigMgr was either laid off or reassigned to other things, so not surprisingly there was then an announcement in November 2025 that laid out a new annual release cycle for ConfigMgr. Reading [ ]
We knew the day would come, and have talked about it for a while (see my previous post). In the march toward oblivion, Microsoft appears to have taken the last step now: the Microsoft Deployment Toolkit installer MSI files are no longer available on the Microsoft download center. Assuming that wasn t an accident, that s the [ ]
I upgraded my last Windows 10 virtual machine from Windows 10 22H2 to Windows 11 25H2. The upgrade itself worked just fine (after I added a virtual TPM to the VM and expanded its available disk space). This was a media-based upgrade, using a 7GB (!) Windows 25H2 business editions x64 en-us ISO. It was [ ]
In a session at the MMS Music City event today, it was mentioned that the monthly cumulative update for October for Windows 11 25H2 was nearly 4GB: The speculation was that this was because of AI, that the models needed were bloating the size. That just really made me scratch my head. Initially, I thought [ ]
Since Microsoft has posted some documentation that makes use of my UEFIv2 module, I figured I should fix the module so that it s compatible with PowerShell 7. The new version 3.0 is available via the PowerShell Gallery; you can upgrade with: In addition to a simple fix to make the Get-UEFISecureBootCerts module compatible with PowerShell [ ]
It s been a while since there was an actual release of the Autopilot Branding script, although there were a few preview releases as we worked out kinks in the processes. Things are looking reasonably good now (thanks to feedback from several people on the preview versions), so a new 3.3.0 release was published: https://github.com/mtniehaus/AutopilotBranding/releases/tag/3.3.0 So [ ]
The number didn t manage to flip over to 5 million while I was still awake, but it had passed that threshold this morning: Yes, that s the number of views from the https://oofhours.com site. I hope that number will continue to climb. If you haven t already, subscribe via WordPress prompt and get e-mail notifications for new [ ]
As Rudy Ooms discovered on the Microsoft 365 Message Center, bulletin MC1134168 announced a change coming with the September 2025 cumulative update: You ll be able to install updates at the end of OOBE again, and you ll get a new control that enables you to turn that on or off. Weirdly, I don t see that same [ ]
For a long time, I ve used three displays attached to my MacBook Pro (well, four counting the Mac s display): One 32 monitor in the center, flanked by two 27 displays, one landscape (mostly for browsing) and one portrait (mostly for Teams/chatting). But I had an opportunity to upgrade: I could donate one of the 27 [ ]
If you re going to be in Minneapolis next month for the EUC World Amplify event, being held from August 4-7 on the University of Minnesota campus, be sure to look me up I ll be there as an attendee (a refreshing change from events where I m either speaking or preparing to speak). If you are [ ]
In the it s about time category, this one popped up on Bluesky today from Tero Alhonen: It s time to start paying attention to the new Insider builds in the dev channel, since 25H2 isn t far off.
The latest what s new doc update for Intune includes this tidbit: So now you can restrict ARM64 apps appropriately. Considering how many years ago this was first discussed, it s about time. Here s what it looks like, starting with the default of app works on any architecture : Change that to Yes and you get some checkboxes: [ ]
Version 3.1.0 is now available with a variety of fixed based on customer feedback. See the release information for more details: https://github.com/mtniehaus/AutopilotBranding/releases/tag/3.1.0 Note that this version doesn t use IntuneWinAppUtil.exe directly. Instead, the makeapp.cmd batch file will call the makeapp.ps1 PowerShell script; that script will then use the IntuneWin32App PowerShell…
Autopilot v2, a.k.a. Autopilot device preparation, was announced on May 22, 2024, it wasn t really done yet. From the original annoucement (highlight added by me): Not sure about what they consider soon but here we are a year later and we ve seen none of these items. What has happened in this past year? There were [ ]
In my previous post about pre-provisioning, I showed three apps (MDT, Office, and PowerToys) that I was installing as part of a task sequence. What I didn t show was the details for those apps. Sure, you can always add the same original app source files to SCCM, MDT, or DeployR and install them with the [ ]
Over a year ago when Autopilot v2 (a.k.a. device preparation) was announced, one of the missing features was pre-provisioning (formerly white glove provisioning ). Maybe one of these days it will finally emerge. But until then, are there other options? Certainly. First, it s worth looking at the existing Autopilot for existing devices process. Since many orgs [ ]
When Microsoft announced Autopilot v2 (a.k.a. Autopilot device provisioning), they mentioned: Hybrid AD join is no longer recommended for use with Autopilot deployments. Autopilot device preparation profiles do not support Hybrid AD Join, but the existing Autopilot flows that do are still usable. And if you dare mention it at an event, or on Reddit [ ]
2025-05-30: Added a section at the bottom based on social media chatter. Microsoft has been investing quite a bit of effort into adding new functionality into Notepad, including AI functionality to help you write content. I don t know who uses Notepad to do that sort of thing, but I m certainly not that type of person. [ ]
The title says it all well, not quite because the full description is more involved and nuanced. This post on LinkedIn from Sameer Agarwal, an Intune engineer at Microsoft, explains more: With Windows Autopilot, BitLocker automatically encrypts internal drives during the OOB experience Even though Encryption policy is not deployed (The main reason [ ]
In preparation for an MMSMOA 2025 session where I am talking about the Autopilot Branding package (among other things), I figured it was a good time to look through the feedback, issues, and pull requests and create a new release. The initial 3.0 release was published a couple of weeks ago, and after a couple [ ]
I was working on some changes to the Autopilot Branding package and testing them out on Windows 11 24H2 and noticed a problem: One of the registry values I was trying to adjust, to hide the Widget button from the task bar, wasn t working; it would get an access denied error. Since this is running [ ]
When you initially sign into Windows, by default you ll see the pulsing color screen as first-time things are done in the background: You can disable that first sign-in animation via GPO, MDM policy, or equivalent registry entry. I cover that a while back: https://oofhours.com/2020/06/08/make-esp-look-better-by-disabling-fsia/ But other than the extra CPU consumed by the animation (a [ ]
I ve done a few troubleshooting blog posts over the years, and they are easily the most popular on my site. This one in particular is still going strong (#1 post of all time), almost five years later: Windows Autopilot diagnostics: Digging deeper That post introduced a script called Get-AutopilotDiagnostics.ps1, which is still available on the [ ]
I ve seen a lot of blog posts about registering devices with Windows Autopilot, either at a command prompt in OOBE (Shift-F10, run PowerShell) or as part of some other automation. Now with Autopilot v2, there are actually two diferent types of registrations to be concerned with too: So, let s walk through the process needed for [ ]
Back when Autopilot v2 was announced, and carried over into the documentation, is a claim: [Windows Autopilot device preparation, a.k.a. Autopilot v2] reduces the time IT spends on deploying devices. OK, but what exactly does that mean? How does it reduce the time? I will assume that s talking about the time per device (since one-time [ ]
I have one big Hyper-V server, currenting running Windows Server 2022 Datacenter, that I use for lots of things (with 12 cores, 272GB RAM, 8TB of disk space). Upgrading it to Windows Server 2025 should be a straight-forward process, right? Insert the media (mounted, downloaded ISO), run SETUP.EXE, do the upgrade. But it took a [ ]
TL;DR: SCCM maintenance tasks for WSUS no longer work if you are using WSUS with the Windows Internal Database (WID). When looking at the SCCM wsyncmgr.log, I noticed some SQL exceptions that occurred with each synchronization: It s easy to see what it s trying to do: it s trying to create some indexes to improve the performance [ ]
Microsoft enabled automatic updates for PowerShell with the release of PowerShell 7.2; that continues now with PowerShell 7.4. If you re devices are updated from Windows Update directly and you ve enabled updates when you installed PowerShell 7, you re all set. But if you are using WSUS or SCCM, there s another step that is necessary: you have [ ]
I spent a lot of time in the weeds around Windows licensing, but I d prefer to forget it all. Sadly, that s usually not an option, especially as I work on Windows imaging technologies. Since it s been a while since I looked at that stuff, I figured I would start from the beginning to see if [ ]
I have merged in changes from the community to create a new release on GitHub, which you can find here: https://github.com/mtniehaus/AutopilotBranding/releases/tag/2024-12-27 You can find the release notes on the release itself: Follow the links to the pull requests (#11, #14) for full details. (It s worth noting that the remove the Windows Store item above refers [ ]
I could stop there, but I won t. In any case, let s review the Windows Enterprise SKU licensing model, straight from the source: Windows 11 Enterprise is licensed as an upgrade license to Windows Pro. But doesn t that mean you re paying for Windows 11 twice? Yes. Is there any way to avoid that? Well, you can [ ]
After a long time working exclusively on Windows devices, I had switched to MacOS on a MacBook Pro a few years ago because that was the practical thing to do while working on cross-platform development based around open-source technologies. The biggest downside: it was an Intel-based Mac, and the battery life when running Edge (for [ ]
After years of neglect, no one was terribly surprised when Microsoft said that MDT would not support Windows 11. Even prior to that, it was often up to the community to keep things working as new Windows and ADK releases came out. So it was also not surprising that the community also kept using MDT [ ]
It s something that I hadn t tried in a while: Capturing a custom Windows 11 image using MDT. But there were a few posts on Reddit commenting about challenges doing so, so I thought I d try it. First off, you should make sure that you have MDT fully updated; Johan s guide is a good start: The [ ]
Sometimes I would like to try something and have it just work. Today was not one of those times. The task was simple: I want to try to use CMPivot to query information from my VMs. Step #1: Launch CMPivot from the ConfigMgr admin console. Nothing happens. Checking the event log on the computer, I [ ]
Six conferences in one week, and boy am I tired. Well, really it was six events in one, all in the same place (Orlando) at the same time. But it was still tiring 12+ hours of sleep later and I m now functional again. This was the second year in a row that I presented [ ]
If you are using Windows 10 or 11 (i.e. everyone), you are using Delivery Optimization (DO) to download all sorts of things see Phil Wilcock s post for a good overview of where DO is used. In an ideal world, everything would be downloaded once from the internet and then pulled from peers in the [ ]