Zero Touch Installation Deployment Feature Team Guide

Figure 7 shows the activities that occur during the Developing Phase. Most of these activities involve preparation of the servers used to install applications and migrate existing user data. These tasks may be repetitive depending on your deployment strategy. Some deployments may require that the following sequence of server installation, stabilization, and deployment be repeated several times, either serially or in parallel, to complete an organization-wide deployment.

Figure 7. Activities during the Developing Phase
See full-sized image

The following sections describe the steps necessary to prepare the deployment process:

On This Page

	Roles and Responsibilities
	Milestones in the Developing Phase
	Preparing the RIS Server
	Installing Solution Accelerator for BDD
	Configuring the Appropriate Resource Access
	Configuring the ZTI Operating System Image
	Creating the ZTI OS Image Installation CD
	Configuring ZTI Processing Rules
	Preparing the Windows PE CDs and Images

Roles and Responsibilities

In addition to the tasks defined in the process description that follows, take note of the following responsibilities allocated to the role clusters. Table 17 defines these focus areas for the different role clusters during this phase.

Table 17. Team Roles and Responsibilities in the Developing Phase

Top of page

Milestones in the Developing Phase

Table 18 lists the project milestones and deliverables that you need to complete during the Developing Phase. The project plan you create needs to include these milestones, the resources required for each milestone, and the length of time to complete each milestone.

Table 18. Developing Phase Project Milestones and Deliverable Description

Top of page

Preparing the RIS Server

When deploying to workstations that are not managed by SMS, you can initiate the image installation process through RIS. In the ZTI deployment process, your RIS servers are responsible for installing Windows PE on the workstations. You boot Windows PE from RIS to prepare the workstation for operating system image deployment.

Ensure that the RIS servers have the:

Note   For more information about setting up and configuring your RIS server, see Deploying the OS Deployment Package Using RIS in the Microsoft Systems Management Server 2003 Operating System Deployment Feature Pack Users Guide in the Additional Resources section of this guide.

Note   For more information about adding additional network drivers to your RIS image, see Preparing the RIS Server in the Computer Imaging System Feature Team Guide, Enterprise Edition.

You need to perform additional RIS configuration that is specific to using Windows PE in the ZTI deployment process. To configure the RIS server to support Windows PE in the ZTI deployment process, perform the following steps:

Disabling Creation of the Windows PE Computer Account in Active Directory

During the ZTI deployment process, Windows PE will create a computer account in Active Directory by default. The computer name that Windows PE uses is temporary and unnecessary after Windows PE has prepared the workstation for Windows XP deployment.

To modify the Ristnrd.sif file to disable the creation of computer accounts in Active Directory, perform the following steps:

[OSChooser]    
Description ="Build 3608"
Help ="SMS 2003 SP1 Build 3174.1017, OSD Build 3608,
WinPE Source"
LaunchFile = "%INSTALLPATH%\%MACHINETYPE%\templates
\startrom.com"
ImageType =Flat
Version="5.1 (0)"

[OSChooser]
Description ="WinPE 1.5"
Help ="Windows PE 1.5 Source"
LaunchFile = "%INSTALLPATH%\%MACHINETYPE%
\templates\startrom.com"
ImageType =WinPE    
Version="5.1 (0)"

Disabling Windows PE Logging on the RIS Server

By default, Windows PE writes startup information to the Setupapi.log log file. When several workstations simultaneously boot the same Windows PE image, those workstations attempt to write to the same Setupapi.log file, which can cause slow performance because each workstation must wait to gain write access to the file. In the ZTI deployment process, RIS status logging is not required for Windows PE.

Note   The file Setupapi.log is not generated until a client boots into Windows PE.

To disable Windows PE logging on the RIS server, perform the following steps:

Modifying the Registry Settings in the Windows PE Image

To modify the registry settings in the Windows PE image on the RIS server, perform the following steps:

Set the Setupapi.log File to Read-only

To set the Setupapi.log file to read-only, perform the following steps:

Automating the RIS Client Installation Wizard

Although you have enabled the Windows PE Tools option, the process still requires manual intervention to complete the installation of Windows PE. If you are installing a single image of Windows PE, you can automate the Client Installation Wizard screens in RIS.

To automate the RIS Client Installation Wizard, perform the following steps:

Enabling Only Tools in the Choice Options Dialog Box

To enable the Tools (Maintenance and Troubleshooting) option in the Client Installation Wizard, perform the following steps:

Modifying Tools.osc and Tlchoice.osc Files

You need to modify Tools.osc so that RIS automatically selects the default tool without waiting for interaction.  

Note   In the version of RIS in Windows Server 2003 SP1 and later versions, two files need to be modified: Tools.osc and Tlchoice.osc.

To modify the Tools.osc file (or the Tlchoice.osc file for SP1), perform the following steps:

<OSCML>
<META KEY=F3 ACTION="REBOOT">
<META KEY=F1 HREF="TOOLSHLP">
<META KEY=ESC HREF="CHOICE">
<META SERVER ACTION="ENUM TOOLS CMDCONS">
<TITLE>  Client Installation Wizard   Tools</TITLE>
<FOOTER>  [ENTER] continue     [ESC] go back     
[F1] help     [F3] restart computer</FOOTER>
<BODY left=5 right=75>
<BR>
<BR>
Use the arrow keys to select one of the 
following options:
<BR>
<P left=8>
<FORM ACTION="LAUNCH">
<SELECT NAME="SIF" NOAUTO SIZE=12>
%OPTIONS%
</SELECT>
</FORM>
</P>
<BOLD>Description:</BOLD>&nbsp&nbsp
<TIPAREA>
</BODY>
</OSCML>

<OSCML>
<META KEY=F3 ACTION="REBOOT">
<META KEY=F1 HREF="TOOLSHLP">
<META KEY=ESC HREF="CHOICE">
<META SERVER ACTION="ENUM TOOLS CMDCONS">
<TITLE>  Client Installation Wizard    Tools</TITLE>
<FOOTER>  [ENTER] continue     [ESC] go back     
[F1] help     [F3] restart computer</FOOTER>
<BODY left=5 right=75>
<BR>
<BR>
Use the arrow keys to select one of the 
following options:
<BR>
<P left=8>
<FORM ACTION="LAUNCH">
<SELECT NAME="SIF" SIZE=12>
%OPTIONS%
</SELECT>
</FORM>
</P>
<BOLD>Description:</BOLD>&nbsp&nbsp
<TIPAREA>
</BODY>
</OSCML>

To modify the Tools.osc file for Windows Server 2003 SP1 or later, complete the following steps:

Customizing Login.osc

To customize Login.osc to provide credentials for authentication, complete the following steps:

<INPUT NAME="USERNAME" MAXLENGTH=255 
TYPE=TEXT VALUE=OSDUser>
<INPUT NAME="*PASSWORD" TYPE=PASSWORD 
MAXLENGTH=20 VALUE=Deploy101>

<OSCML>
<TITLE> SMS OSD Client Installation Wizard Logon</TITLE>
  [ENTER] continue     [ESC] clear     [F1] help     
[F3] restart computer</FOOTER>
<META KEY=F3 ACTION="REBOOT">
<META KEY=F1 HREF="LOGINHLP">
<META KEY=ESC HREF="LOGIN">
<META ACTION="LOGIN">
<META ACTION=AUTOENTER>
<BODY left=5 right=75>

Type a valid user name, password, and domain name. 
You may use the Internet-style logon format (for example:
Username@Company.com).        
<FORM ACTION="CHOICE">
&nbsp&nbspUser name: <INPUT NAME="USERNAME" 
MAXLENGTH=255 TYPE=TEXT VALUE=osduser> 
&nbsp&nbsp&nbspPassword: <INPUT NAME="*PASSWORD" 
TYPE=PASSWORD MAXLENGTH=20 VALUE=Deploy101>
Domain name: <INPUT NAME="USERDOMAIN" 
VALUE=%SERVERDOMAIN% MAXLENGTH=255> 
</FORM>

Press the TAB key to move between the User name, Password,
and Domain name fields.

You are connected to %SERVERNAME%
</BODY>
</OSCML>

Customizing Welcome.osc, Install.osc, and Oschoice.osc

To customize Welcome.osc, Install.osc, and Oschoice.osc to provide credentials for authentication, complete the following steps:

Complete Steps 1-4 for the following files:

An additional copy of the Welcome.osc file exists in the\RemoteInstall\OSChooser\English\ folder. This file is the language-specific version of the file. Only modify the version of Welcome.osc in the \RemoteInstall\OSChooser\ folder.

Note   Oschoice.osc is used by RIS when there is more than one RIS image to choose from. It prompts the user for the appropriate image.

Top of page

Installing Solution Accelerator for BDD

Before you can deploy images to workstations, you must install Solution Accelerator for BDD. Several technologies are included in Solution Accelerator for BDD, and you must install each technology separately.

To install Solution Accelerator for BDD, perform the following steps:

Installing the SMS 2003 OSD Feature Pack

You install the SMS 2003 OSD Feature Pack on either an SMS 2003 site server or on a workstation running the SMS 2003 Administrator Console. As previously mentioned, you must install SMS 2003 SP1 on all site servers to support the SMS 2003 OSD Feature Pack. In addition, you need to install the SMS Administrator Console supplied with SMS 2003 SP1. To ensure that more than one workstation can administer the SMS 2003 OSD Feature Pack, install the SMS 2003 OSD Feature Pack on an SMS 2003 site server (recommended).

To install the SMS 2003 OSD Feature Pack, you must:

Installing ZTI Files

Install the ZTI files in a folder in which you will create the SMS 2003 OSD Feature Pack images. To install the ZTI files, perform the following steps:

Install the Files in the Bddenterprise.msi File

To install the files in the Bddenterprise.msi file, perform the following steps:

Install the Additional Files in the Bddenterprise.msi File

In addition to the files found in the Bddenterprise.msi file, you also need to manually install files that the ZTI scripts require. Table 20 lists the additional files required and where they reside. Dbnmpntw.dll and Sqloledb.rll are only needed if you will be accessing SQL Server. Copy the files to the ZTI shared folder you created. You will add these files to phases in your Image package later as described in the Configuring the ZTI Operating System Image section of this guide.

Table 20. Additional Files Required by ZTI Scripts and Their Location

Note  You also need to include the Sqloledb.rll file in the Windows PE image. For more information about how to include files in Windows PE images, see the Microsoft Windows Preinstallation Environment User's Guide (Winpe.chm) in the Docs folder of the Windows PE 2004 CD or review the online documentation related to Windows PE at http://www.microsoft.com/whdc/system/winpreinst/default.mspx

Installing USMT 2.6

You need to install USMT version 2.6 in a shared folder. Create the shared folder so that the folder can be accessed by the SMS primary site server on which you installed the SMS 2003 OSD Feature Pack.

You can obtain USMT version 2.6 at http://www.microsoft.com/downloads/details.aspx?FamilyID=4af2d2c9-f16c-4c52-a203-8daf944dd555&DisplayLang=en.

To install USMT 2.6, perform the following steps:

Installing the AdminDB Console

When you installed the ZTI files, you installed the AdminDB console in the same folder structure. The AdminDB console should be in the AdminDB folder beneath the ZTI shared folder.

To install the AdminDB console, perform the following steps:

Installing the AdminDB Files

To install the AdminDB console, perform the following step:

Determining the Size of the AdminDB Database

Before you can run the script that creates the AdminDB database, you need to determine the size of your AdminDB database. The database needs to be created large enough to hold all the configuration information for your workstation-specific settings.

The default—9 MB—provides enough storage to support 500 computers (assuming that you are using an unmodified AdminDB database schema). For more information about modifying the AdminDB database schema, see Modifying the AdminDB Database Schema in this guide.

You must ensure that the SQL Server you select to host the AdminDB database has sufficient disk capacity to store the AdminDB database.

Running the Script That Creates the AdminDB Database

To create the AdminDB database, perform the following steps:

Configuring the Database and Log Settings for the AdminDB Console

The AdminDB console need to be configured so that the console uses the appropriate data source for the database you created earlier in the process. In addition, you need to configure the location where the console will store log files.

To configure the database and log settings for the AdminDB console, perform the following steps:

<add key="ConnectionString" value="Provider=sqloledb;
Data Source=(SQLServer); Integrated Security=SSPI;
Initial Catalog=BDDAdminDB" />

<add key="ConnectionString" value="Provider=sqloledb;
Data Source=(local); Integrated Security=SSPI;
Initial Catalog=Database" />

<add key="LogFilePath" value="C:\BDDAdminDB.log" />

Top of page

Configuring the Appropriate Resource Access

During the deployment to the workstations, the SMS client connects to the distribution point shares and shared folders. You need to create accounts within SMS for use by the SMS client when accessing these resources.

To configure the appropriate resource access, perform the following steps:

Configuring Client Access Accounts

The SMS client needs an account to provide as credentials when accessing your distribution points and shared folders. The accounts you need to configure are listed in Table 22.

Table 22. Accounts Needing to Be Configured

To configure the client access accounts, perform the following steps:

1.	Create the user account and password in an Active Directory domain.
2.	In the SMS Administrator Console, navigate to the Client node, as illustrated in Figure 8. Figure 8. Adding Client Connection accounts See full-sized image
3.	Right-click the Client node, click New, and then click Windows User Account.
4.	In the Connection Account Properties dialog box, click Set.
5.	Complete the Windows User Account dialog box by using the information in Table 23, and then click OK. Table 23. Information Required to Complete the Windows User Account Dialog Box For This Do This User name Type UserName (where UserName is the name of the user account that you wish to use). Password Type Password (where Password is the password for the user account that you wish to use). Confirm Password Type Password (where Password is the password for the user account that you wish to use).
6.	Repeat steps 3–5 for each client access account you need to create.
7.	In the SMS Administrator Console, navigate to the Component Configuration node, as illustrated in Figure 9. Figure 9. Configuring Software Distribution to use the Client Connection accounts See full-sized image
8.	In the details pane, right-click Software Distribution, and then click Properties. The Software Distribution Properties dialog box, illustrated in Figure 10, appears. Figure 10. Configuring the Software Distribution properties See full-sized image
9.	In the Software Distribution Properties dialog box, click the General tab, enter the corresponding accounts in the Legacy Client Software Installation Account and the Advanced Client Network Access Account text boxes, and then click OK.
10.	Close any open windows.

Creating Additional Shared Folders

After you have configured the SMS client access accounts, you need to create additional shared folders in which to store the user state migration data and the deployment logs. Table 24 lists the shared folders that you need to create and describes the purpose of each shared folder. For more information about the planning for these share folders, see Providing Sufficient Storage for User State Migration Data and Providing Sufficient Storage for Deployment Logs earlier in this guide.

Table 24. Shared Folders and Their Descriptions

Configuring Shared Folder Permissions

After you have configured the SMS client access accounts, you need to configure the appropriate shared folder permissions. Ensure that unauthorized users are unable to access user state migration information and the deployment logs. Only the workstation creating the user state migration information and the deployment logs should have access to these folders.

To configure the shared folder permissions for each folder listed in Table 24, perform the following steps for each folder:

The permissions you set in these steps allow a workstation to connect to the appropriate share and create a new folder in which to store user state information or logs, respectively. The folder permissions prevent other users or computers from accessing the data stored in the folder.

Note   The default permissions on the SMS distribution point shares should provide the appropriate resource access by default.

Configuring Access for Deployment Phases

The deployment of your operating system packages to your workstation can be broken down into the phases described in Table 25. These phases occur during different sequences in the deployment process.

Table 25. Operating System Deployment Phases and Their Descriptions

You can divide the authentication requirements into authentication required for:

Authenticating Access During the Package Selection Phase

During the Package Selection Phase, only a limited number of credentials are available. These credentials are stored in the Ripinfo.ini file and are used by OSD to provide access to the resources. The credentials supplied in Ripinfo.ini include credentials as specified in the:

A sample Ripinfo.ini file is illustrated in Listing 22.

Note Some parts of the following code snippet have been displayed in multiple lines only for better readability. These should be entered in a single line.

[RIPInfo]
Images=1
LocalImage=Yes
WizTitle=XPSP2
AllowMachineName=No
SiteCode=SMS
ManagementPoint=SERVER1:80
Reserved1=5EDBD289503F9DA5B84F6BA5320EACCB250DA92C
A96A46E265F7732A4071BF0BD196976C659D66
Reserved2=E35E5E17C5AD023A280D3DBC9D5C0DF0042E583
113F3A183CE7A9DDE0E15640B29D4AFC6BE517A
Reserved3=66AEA099AE219FD2A1AB1C4E97D1D3E9C67E58F60B
 
[UserCommand]
CommandLine=""\\Server1\SMSPKGE$\SMS00001
\ZeroTouchInstallation.vbs" /phase:NewComputer"  /scriptlog 
NetworkShare=\\Server1\SMSPKGE$\SMS00001
Reserved1=2BDEF2AE706BC58AEA1B1DF04F0BD8CF5C0AA
B5DDB1F43E25F2D6967E794E2F62416DCD3736A27
Reserved2=965B5E10C5D97A355AA70B0082C94BADE1A90
C403969116AF008F0618690CDAFB7A374FD7E7E56
Reserved3=C3ABADA631DDDC0686C3C3CFF748EB6F0E5FCE89AD

Listing 22. Sample Ripinfo.ini

You can only connect to the following two servers during the Package Selection:

Authenticating Access During All Other Phases

During the other phases listed in table, you can connect to:

You supply credentials when you configure a Connect to UNC action. In addition to a connection to shared folders, you can use the credentials supplied in the Connect to UNC action to authenticate to application or database servers (such as Microsoft SQL Server 2000 or Microsoft Exchange Server 2003).

To authenticate on these application or database servers, use the Connect to UNC action to connect to any share on that server. Other connections, such as Named Pipes or Remote Procedure Call, will use the same credentials you supplied in the Connect to UNC action.

Authenticating Access Through Encrypted Credentials

You can also supply credentials to the ZeroTouchInstallation.vbs script through the Encryptedsettings.ini file. The ZeroTouchInstallation.vbs. script first tries to obtain credentials from Encryptedsettings.ini to use when accessing SQL server or a shared folder (such as SLShare, UDShare, or DriverPath).

You can use this method for providing credentials when you need to deliver an SMS package to a workstation without using OSD. For example, you could use this method in the Replace Computer scenario when you send an SMSP package that captures user state migration information (see more information on this by reviewing the Replace Computers scenario earlier in this guide).

In instances where you are using OSD, use Connect to UNC instead.

The credentials stored in ZeroTouchInstallation.vbs are encrypted and decrypted by:

[Server]
NYC-AM-FIL-01=WOODGROVEBANK\NYCUtil;P@ssword
DAL-AM-FIL-01=WOODGROVEBANK\DALUtil;password!
 
[SQL]
NYC-AM-SQL-04=sa;password

To use Encryptedcredentials.ini you need to include the following in the image package:

To use Encryptedcredentials.ini to provide credentials to a server running SQL Server 2000, you need to add the SQLShare parameter in the SQL section in Customsettings.ini.

Top of page

Configuring the ZTI Operating System Image

You can configure a particular operating system to use the ZTI scripts by using the SMS Administrator Console. The SMS 2003 OSD Feature Pack defines phases, listed in Table 26, that occur during the deployment of your SMS 2003 OSD Feature Pack image to the workstation. You need to configure each phase with the appropriate ZTI script settings to fully automate your Windows XP deployment.

Table 26. SMS OSD Feature Pack Phases, the Custom Action Names, and Their Descriptions

Configuring the Validation Phase Actions

To configure the Validation Phase actions, perform the following steps:

Configuring the State Capture Phase Actions

To configure the State Capture Phase actions, perform the following steps:

Specifying User Profiles to Migrate

During the State Capture Phase, you need to specify the user profiles that you want to migrate. The deployment process provides a number of ways to specify the user profiles that you want to migrate. You can specify the user profiles to migrate in the following:

Table 29 lists the advantages and disadvantages of these methods for specifying the user profiles to migrate.

Table 29. Advantages and Disadvantages of the Methods for Specifying User Profiles to Migrate

Specifying User Profiles to Migrate in UDProfiles

The UDProfiles custom user key is used to specify the user profiles to be migrated. You can configure UDProfiles in the Customsettings.ini file or in the AdminDB database. You can specify multiple users by separating the users with a comma. Listing 24 illustrates the use of UDProfiles in specifying the user profiles to migrate.

Note Some parts of the following code snippet have been displayed in multiple lines only for better readability. These should be entered in a single line.

[Settings]
Priority= DefaultGateway, SQL, Default
CustomKeysUserData=UDShare,UDDir,
UDProfiles,SLShare,OSInstall,JoinDomain,CaptureGroups
CustomKeysSysprep=ComputerName,TimeZone,JoinDomain,
MachineObjectOU
OSDVariableKeys=OSDINSTALLSILENT,OSDINSTALLPACKAGE,
OSDINSTALLPROGRAM,OSDNEWMACHINENAME
ScanStateArgs=/i:miguser.inf /i:migapp.inf /i:migsys.inf 
/i:sysfiles.inf /i:updateuser.inf /v:7 /x /s /f /o /c
LoadStateArgs=/v:7 /c
UserExit=ZTIUserExit.vbs
 
[Default]
UDShare=\\NYC-AM-FIL-01\MigData
SLShare=\\NYC-AM-FIL-01\Logs
UDProfiles=*\*
CaptureGroups=No
OSDINSTALLSILENT=1
OSDINSTALLPACKAGE=NYC00001
OSDINSTALLPROGRAM=InstallXPAPPDOMAIN\*

Listing 24. Excerpt from a Customsettings.ini file that illustrates the use of UDProfiles

The UDProfiles custom user key is scanned by the ZTI engine and translates the setting to a corresponding /user parameter for USMT during the State Capture Phase. During the State Restore Phase, the ZTI engine passes the same /user parameter to USMT to restore the same list of users.

Note   The /user parameter (created by UDProfiles) automatically overrides any settings in Updateuser.inf. However, you cannot use UDProfiles, or the /user parameter, with the USMT /all parameter.

For more information about the parameters supported by USMT, see “To select user states to migrate using Scanstate” and “To include and exclude user states using .inf files” in User State Migration Tool Help included with USMT version 2.6.

Specifying Users Profiles to Migrate in Updateuser.inf

The deployment process utilizes a file called Updateuser.inf, as seen in Table 28. Updateuser.inf is included as a parameter on the USMT command line during the State Capture Phase. You specify the user profiles that you want USMT to migrate by entering them in the [IncludeUsers] section of the Updateuser.inf file. You can also specify user profiles that you want USMT to ignore by entering them in the [ExcludeUsers] section of the Updateuser.inf file. The Updateuser.inf file allows you to dynamically build a user list, while keeping the USMT command line the same.

The format for entering the names of the user profiles is Domain\Username (where Domain can be any Active Directory domain, or computer name for local accounts, and Username is the username of the user profile). Table 30 lists examples entries in Updateuser.inf.

Table 30. Examples of Entries in Updateuser.inf

By default, ZTI includes an Updateuser.inf file as show in Listing 25.

[Version]
Signature=$Windows NT$
DriverVer=10/01/2002,5.2.3790.1170 
 
[IncludeUsers]
*\*
%COMPUTERNAME%\*
 
[ExcludeUsers]
%COMPUTERNAME%\SMSCliSvcAcct&
%Computername%\*
APPDOMAIN\*

Listing 25. Default Updateuser.inf included in ZTI deployments

Listing 26 shows a sample Updateuser.ini. In this example, all user profiles are migrated except any user profiles for users that exist:

[IncludeUsers]
*\*
    .
    .
    .
[ExcludeUsers]
%Computername%\*
APPDOMAIN\*

For more information about the variables and wild-card characters supported by USMT in Updateuser.inf, see [Include Users] Section and [Exclude Users] Section in User State Migration Tool Help included with USMT 2.6.

Specifying Additional File Extensions to Migrate

By default, USMT migrates the file type known to the Windows operating system. You can instruct USMT to migrate additional file types by using the Userdata.inf file. The [Files and Folders] section of Userdata.inf allows you to easily migrate extensions, specific files, standard directories (like My Documents), and new directories (for example, C:\myfiles) directly to the same location on the destination computer. A sample Userdata.inf file is illustrated in Listing 27.

[Files and Folders]
EXT, doc
FILE, %appdata%\myfile.dat
DIR, %csidl_personal%*\*

Listing 27. Sample Userdata.inf

For more information about the [Files and Folders] section in Userdata.inf, see [Files and Folders] Section in User State Migration Tool Help included with USMT 2.6.

Backing Up the Administrators and Power Users Group Membership

During the State Capture Phase, the ZeroTouchInstallation.vbs script backs up the membership of the local Administrators and Power Users groups. Later in the State Restore Phase, the ZeroTouchInstallation.vbs script restores the group membership for each group to the same list of users.

If you want to disable the backup and restore of Administrator and Power Users group membership, configure the CaptureGroups setting in Customsettings.ini to NO, as illustrated in Listing 28. If the CaptureGroups setting is missing or set to any other value, the Administrators and Power Users group membership is migrated.

Note Some parts of the following code snippet have been displayed in multiple lines only for better readability. These should be entered in a single line.

[Settings]
Priority= DefaultGateway, SQL, Default
CustomKeysUserData=UDShare,UDDir,UDProfiles,
SLShare,OSInstall,JoinDomain,CaptureGroups
CustomKeysSysprep=ComputerName,TimeZone,
JoinDomain,MachineObjectOU
OSDVariableKeys=OSDINSTALLSILENT,OSDINSTALLPACKAGE,
OSDINSTALLPROGRAM,OSDNEWMACHINENAME
ScanStateArgs=/i:miguser.inf /i:migapp.inf 
/i:migsys.inf /i:sysfiles.inf /i:updateuser.inf 
/v:7 /x /s /f /o /c
LoadStateArgs=/v:7 /c
UserExit=ZTIUserExit.vbs
 
[Default]
UDShare=\\NYC-AM-FIL-01\MigData
SLShare=\\NYC-AM-FIL-01\Logs
UDProfiles=*\*
CaptureGroups=No
OSDINSTALLSILENT=1
OSDINSTALLPACKAGE=NYC00001
OSDINSTALLPROGRAM=InstallXP
TimeZone=010
JoinDomain=WOODGROVEBANK
MachineObjectOU= OU=Workstations,DC=americas,DC=corp,
DC=woodgrovebank,DC=com
ComputerName=%OSDNEWMACHINENAME%
UDDir=%OSDCOMPUTERNAME%
OSInstall=Y
 
 

Listing 28. Configuring CaptureGroups settings to disable migration of Administrators and Power Users group membership

For more information on migrating the Administrators and Power Users group membership see, Restoring the Administrators and Power Users Group Membership later in this guide.

Configuring the Preinstall Phase Actions

To configure the Preinstall Phase actions, perform the following steps:

Configuring the Postinstall Phase Actions

To configure the Postinstall Phase actions, perform the following steps:

Configuring the State Restore Phase Actions

To configure the State Restore Phase actions, perform the following steps:

Performing Steps Required for Images Created by Using the BDD Computer Imaging System

If the image you are deploying is created by using the BDD Computer Imaging System, you need to call POST2.BAT to:

To call POST2.BAT, add a new custom action after the Zero Touch Installation—State Restore custom action. The custom action should run C:\Local\POST2.BAT with no parameters.

Note   POST2.BAT (and the other batch files that POST2.BAT calls) cannot reboot the system. If a reboot is required, use a Reboot action after the custom action that runs POST2.BAT.

Restoring the Administrators and Power Users Group Membership

Earlier in the State Capture Phase, the ZeroTouchInstallation.vbs script backs up the membership of the local Administrators and Power Users groups. During the State Restore Phase, the ZeroTouchInstallation.vbs script restores the group membership for each group to the same list of users.

If you want to disable the backup and restore of Administrator and Power Users group membership, configure the CaptureGroups setting in Customsettings.ini to NO, as illustrated in Listing 29. If the CaptureGroups setting is missing or set to any other value, the Administrators and Power Users group membership is migrated.

Note Some parts of the following code snippet have been displayed in multiple lines only for better readability. These should be entered in a single line.

[Settings]
Priority= DefaultGateway, SQL, Default
CustomKeysUserData=UDShare,UDDir,UDProfiles,SLShare,
OSInstall,JoinDomain
CustomKeysSysprep=ComputerName,TimeZone,JoinDomain,
MachineObjectOU
OSDVariableKeys=OSDINSTALLSILENT,OSDINSTALLPACKAGE,
OSDINSTALLPROGRAM,OSDNEWMACHINENAME
ScanStateArgs=/i:miguser.inf /i:migapp.inf /i:migsys.inf 
/i:sysfiles.inf /i:updateuser.inf /v:7 /x /s /f /o /c
LoadStateArgs=/v:7 /c
CaptureGroups=NO
UserExit=ZTIUserExit.vbs
 

Listing 29. Configuring CaptureGroups settings to disable migration of Administrators and Power Users group membership

For more information about migrating the Administrators and Power Users group membership see, Backing Up the Administrators and Power Users Group Membership earlier in this guide.

Top of page

Creating the ZTI OS Image Installation CD

To completely automate the SMS 2003 OSD Feature Pack image installation process, you need to include the ZTI script in the image installation CD. The script ZeroTouchInstallation.vbs gathers the SMS operating system image package ID and program name.

You can create a Windows PE boot image file by using the SMS 2003 OSD Feature Pack. However, the version created by OSD cannot be customized and does not include WMI. To create a customized Windows PE boot image, you can use Config.hta or your own process. The Config.hta process adds WMI and makes other necessary changes to the Windows PE boot image. To create your own Windows PE boot CD, see Preparing the Windows PE CDs and Images, later in this guide.

Note   If the image you are creating is not for use on a RIS server, skip any RIS related instructions in this section.

To create the ZTI operating system image installation CD, perform the following steps:

In the .iso image that you create, there is a file named Ripinfo.ini. Ripinfo.ini is an answer file used by RIS to automate the installation of your operating system. When you are booting Windows PE from a RIS server, Ripinfo.ini also includes:

You need to update your images when either of the items listed above change. While you can edit the Ripinfo.ini file directly, it is recommended that you create a new image by using the Operating System Image Installation CD wizard. The wizard will automatically update Ripinfo.ini to reflect any changes in the command line or available packages.

Top of page

Configuring ZTI Processing Rules

The ZTI scripts configure workstations settings based on rules and configuration settings stored in the Customsettings.ini file or in a SQL Server database. During the MSF Planning Phase, you determined the appropriate ZTI processing rules to use in your organization. Now you need to configure those rules in the Customsettings.ini or in the AdminDB database.

To configure the ZTI processing rules, perform these steps:

Configuring Group-Based Rules in Customsettings.ini

You configure group-based rules in the Customsettings.ini file. Modify the Customsettings.ini file based on the group-based rules you determined during the MSF Planning Phase. The Customsettings.ini file, along with your group-based rules, becomes your Customsettings.ini template. For more information about determining the appropriate group-based rules, see Determining the Appropriate ZTI Processing Rules earlier in this guide.

Modifying the AdminDB Database Schema

The AdminDB database contains the workstation-based rules. The default schema contains the common characteristics used to identify and configure a workstation. However, if you want to provide additional configuration options or use other characteristics to identify a workstation, you need to modify the database schema.

To modify the AdminDB database schema, perform the following steps:

Modifying the AdminDB Console Components

You can modify or remove any column in the AdminDB database except for the following: