Back to basics – Automating the Windows To Go setup (Windows 8.1 Enterprise)

Earlier this week I got an email from a fellow deployment geek, where he wanted to know how he could enable the local Administrator account on his Windows To Go stick (Windows 8.1 Enterprise). He had created the reference image in MDT 2013 (as you always should), but after running through the Windows To Go creator wizard and trying the USB stick, it run through the normal OOBE wizard, and also had the local administrator disabled. This post shows you how to automate the Windows To Go Setup, as well as some additional tips and tricks for testing and creating the image.

Background info

A Windows To Go stick, the first time you boot it, behaves like any other Windows setup. If you don't provide an answer file, the setup will stop and prompt you for things. To automate the setup, simply copy an unattend.xml file to the Windows\System32\Sysprep folder of your USB stick.

Screen from the setup wizard when booting a Windows To Go stick without providing an unattend.xml.

Sample Unattend file for Windows 8.1 x64

Below you find a sample unattend.xml for Windows 8.1 x64 that automates the OOBE setup, enables the local administrator account, uninstall WinRE, and join the Windows To Go stick to the corp.viamonstra.com domain. As mentioned previously in this post: To automate the setup, simply copy an unattend.xml file to the Windows\System32\Sysprep folder of your USB stick (assign a drive letter first).

Unattend.xml copied to Windows\System32\Sysprep folder of the USB stick.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
        <RunSynchronous>
             <RunSynchronousCommand wcm:action="add">
             <Description>EnableAdmin</Description>
             <Order>1</Order>
             <Path>cmd /c net user Administrator /active:yes</Path>
             </RunSynchronousCommand>
             <RunSynchronousCommand wcm:action="add">
             <Description>UnfilterAdministratorToken</Description>
             <Order>2</Order>
             <Path>cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken /t REG_DWORD /d 0 /f</Path>
             </RunSynchronousCommand>
             </RunSynchronous>
        </component>
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <Identification>
                <Credentials>
                   <Username>MDT_JD</Username>
                   <Domain>VIAMONSTRA</Domain>
                   <Password>P@ssw0rd</Password>
                </Credentials>
                <JoinDomain>corp.viamonstra.com</JoinDomain>
                <MachineObjectOU>OU=Workstations,OU=ViaMonstra,DC=corp,DC=viamonstra,DC=com</MachineObjectOU>
            </Identification>
    </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
           <RegisteredOrganization>ViaMonstra</RegisteredOrganization>
           <RegisteredOwner>ViaMonstra</RegisteredOwner>
           <TimeZone>Pacific Standard Time</TimeZone>
           <ComputerName>*</ComputerName>
           <CopyProfile>true</CopyProfile>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <InputLocale>0409:00000409</InputLocale>
            <SystemLocale>en-US</SystemLocale>
            <UILanguage>en-US</UILanguage>
            <UserLocale>en-US</UserLocale>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>1</ProtectYourPC>
                <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
                <HideLocalAccountScreen>true</HideLocalAccountScreen>
            </OOBE>
            <UserAccounts>
                <AdministratorPassword>
                    <Value></Value>
                    <PlainText>true</PlainText>
                </AdministratorPassword>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                    <Password>
                            <Value>P@ssw0rd</Value>
                            <PlainText>True</PlainText>
                    </Password>
                    <Description>Temp account</Description>
                    <DisplayName>Temp account</DisplayName>
                    <Group>Users</Group>
                    <Name>TempAccount</Name>
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>
        </component>
    </settings>
</unattend>

Sample Unattend.xml:

Take it further – Automate everything with PowerShell

On the Deployment Guys blog you find a great PowerShell script written by Lutz Seidemann (Solution Architect with Microsoft Consulting Services). This script automates the entire build of the Windows To Go stick (in a project you may have to create hundreds), as well as building and injecting an unattend.xml file on the fly. Beautiful! Here is the post:

Create Windows-To-Go drives in a simple Factory mode
http://blogs.technet.com/b/deploymentguys/archive/2013/02/27/create-windows-to-go-drives-in-a-simple-factory-mode.aspx

More PowerShell for Windows To Go.

Here is another useful post on automating the creation of Windows To Go:

Deploy Windows To Go in Your Organization
http://technet.microsoft.com/en-us/library/jj721578.aspx

Reference images for Windows To Go

Unlike normal reference images, you want to add at least a few generic network and video drivers to a reference image used for Windows To Go. At the very least, add some additional network drivers, because without them, Windows will have a hard time downloading other drivers.

Tips for testing in Hyper-V

If you want to test your Windows To Go stick, and you don't have a physical machine available, you can add is a pass-through disk in Hyper-V and test it there. If the USB stick doesn't show, please make sure it's set to offline in disk manager.

Happy deployment,

/ Johan