Course Outline

1. Introduction
   1. A brief overview of the course.  
   
   
2.    Windows as a Service: Patch Tuesday Will Never be the Same
   One of the most confusing parts about Windows 10 is that while it's "the last Windows" in name, in fact you may see up to three new versions of Windows 10 in any given calendar year. Furthermore, you must upgrade to at least one of those versions each year. This first section explains this new reality and how you can control your upgrades.
   1. Windows 10 Editions: Home, Pro, Education, Enterprise
   2. Know your builds: keeping track of how "upgraded" is your Windows
   3. "Isn't it free?" Well, sometimes. But probably not for you. Or me.
   4. "Upgrades" versus "updates:" Patch Tuesday gets a lot more interesting, and why they're doing it
   5. Flights and rings: yes, we’re seeing a lot of new Windows versions, but lots of other people shake them down first
   6. Control the upgrade pace with the Common Branch for Business and Windows Update for Business
   7. Engineering updates: patches save bandwidth by going torrent-ish
   8. Where WSUS and SCCM fit in
   9. An infrequent-update program: Long Term Servicing Branch delivers Windows "the old-fashioned way"
   
3.    Just a Little on the New UI: Tips for IT Pros
   Windows 10 brings with it the usual quota of GUI changes, and you surely don't need us to explain the new Start Screen to you. But Windows 10 does bring a number of changes that can actually boost productivity for IT pros, as well as a couple of "internals" features that you might never have known about that you'll find very useful. 
   1. 10's odd new "bipolar" Control Panel
   2. ... But “God Mode” is still around
   3. Virtual desktops get downright useful
   4. New hotkeys
   5. The "snipping" tool gets better
   6. Command prompt improvements

  
   
   
4.    Shiny New Boots: BIOS, UEFI and Secure Boot
   Back in the late 1900s, Intel had some great ideas on how to build better PCs, and some of those ideas have finally become commonplace. Among those ideas is a replacement for BIOSes called “UEFI firmware.” UEFI’s great, but with Windows 10, it becomes even better, as it enables a nice anti-malware upgrade called “Secure Boot” that goes an awful way towards ruining the day of many a malware authors. In this section, you’ll see what kind of hardware you need (you’ve actually probably already got it) and how to add Secure Boot to your security regimen. Perhaps most important, you’ll see how to avoid having BitLocker lock you out of your system after you’ve tweaked some small system setting.
   1.    It’s not a “BIOS,” it’s “firmware:” UEFI “BIOSes”
   2.     How Secure Boot works
   3.    Setting up a Secure Boot system
   4.   Alternate boots: booting from USB sticks and the like in a Secure Boot / UEFI world
   5.     How Secure Boot and Bitlocker interact: avoiding a “Bitlocker lockout” after system maintenance  
   
   
5.    Controlling Start and Search: Configuring the Start Menu and Cortana
   Your organization might have had many reasons for skipping 8/8.1, but we’d lay odds that at least one big reason was the Start menu. Windows 10 certainly has a Start menu that is less alien than Windows 8’s, but it still needs configuring. You can raise that Start menu by just pressing the “Windows” key… and when you do, you’ll also pull up the “Search,” which as you probably now know sports a voice interface and a name, “Cortana.” You’ll want to deploy and tweak them both, and this section shows you how.
   1. Get and capture a “standard Start menu”
   2.   Deployment options: immutable or just a suggestion
   3.     Start menu deployment limitations
   4.   The new Search: Cortana
   5.    Things to know: Cortana and privacy
   6.    Controlling Cortana with group policies
   7.   Finding Cortana’s settings
   8.   Cortana’s “Notebook”
   9.    Cortana and accounts: do you, um, have a Live account?  
   
   
6.    Windows 10 Setup: In-Place Upgrades, Disk Layout and Setup Options
   One of Windows 10’s quiet revolutions can be found in Setup.exe, which has some nice improvements. Perhaps the most interesting one is that in-place upgrades honestly do make sense now, and they’re a lot more flexible than they ever have been before. Learn about what’s new and neat in Setup in this section.
   1.    How in-place upgrades work: five steps
   2.    New Setup.exe syntax and examples
   3.    Default Windows 10 disk layout
   4. .   Windows 10 insists on a recovery partition  
   
   
7.     Windows 10 Deployment Concepts and Scenarios
   Ever since Vista, every new version of Windows brings new and (usually) improved tools to deploy Windows. Windows 10 is no different, and offers us a somewhat different mindset in that in-place upgrade works very well now. There's also a bunch of new deployment-related concepts, which we'll cover in this section to warm you up for the WinPE 10 and WICD sections.
   1. Scenarios: no need to wipe a vendor-installed OS, and in-place upgrades finally make sense
   2. How the new in-place upgrades work
   3. Automating it with new setup.exe options
   4. New default disk layout
   5. Automated Deployment Kit (ADK) changes
   6. "Capabilities:" like features, but better
   7. "Provisioning packages" simplify some upgrades
   8. Smaller Windows: CompactOS replaces WIMBoot     
   
   
8.    Windows PE 10: No Longer Optional, And Getting Better All the Time
   Microsoft created the Windows Preinstallation Environment (WinPE), a cut-down, free version of Windows that simplifies troubleshooting big problems back in 2001, but offered it solely to big customers. They opened it to the world in 2006, but it's always been a "nice to know" rather than a "need to know" Windows tool. With Windows 10, that changes, and so this brief section offers a quick tutorial on building WinPE and equipping it with PowerShell. You'll also learn what new features Windows 10's PE has.
   1. Building a WinPE-enabled USB stick with Win 10's newer, easier tools
   2. Adding features: turning on PowerShell
   3. Setup and xFAT    
   
   
9.    Windows Image and Configuration Designer (WICD)
   Automating Windows rollouts is important and every organization wants automated deployment, but making it work is complicated. The Assessment and Deployment Kit (ADK, formerly known as the Windows Automated Installation Kit or WAIK) and its cousin Microsoft Deployment Toolkit (MDT) are terrific, powerful and free tools, but also complex ones that are sadly given a miss by many IT pros. To address that, Microsoft has created a third free automated deployment tool called the Windows Image and Configuration Designer (WICD). This tool, pronounced "wicked" (which is odd, as it contains no witches but does contain wizards), seeks to simplify deployment for regular old Windows as well as device-centric versions like Windows Phone 10. In this section, we'll explore WICD so you'll know whether or not to add it to your deployment toolkit!
   1. Installing and tweaking WICD to make it useful
   2. Setup for its command-line personality, "ICD.EXE"
   3. Creating a project… just a few clicks creates a bootable USB stick that does a hands-off install
   4. The pieces: deployment assets, image time settings and runtime settings
   5. The options: image creating versus provisioning package creation, and The Five Taps (hint: they are not a 50's band)
   6. WICD provisioning packages revealed: customizations.xml and more
   7. WICD as a command-line tool: strengths, weaknesses, and a huge bug
   8. Hacking WICD: making it forget old projects    
   
   
10.    Easier App Migration: the new Scanstate
    Anyone who's ever done a mass deployment by grabbing users' current settings and files, saving them on a share and then flattening and rebuilting the users' computers with a new version of Windows knows the User State Migration Tool (USMT) and its two main components, Scanstate and Loadstate. (In case you've never used them, Scanstate packages up and saves your settings and files, before the flatten-and-rebuild. After the flatten-and-rebuild, Loadstate recovers those files and settings and restores them to the users' systems.) USMT's great, but it only migrates the users' files and application settings, not the applications themselves. That changes with Windows 10's Scanstate, which saves not only the users' files and settings but their applications as well. Sound great? Well, it is, kind of… but there are big limitations to the new Scanstate, as you'll learn in this section.
    1. Review: Scanstate background
    2. Details of new Scanstate capability with "/apps" to a provisioning package
    3. Step-by-step example
    4. Deploying saved apps: WICD is it!
    5. Provisioning package processes and Audit Mode in Windows 10    
    
    
11.    The Five Taps: Quicker Windows Rollouts
    If the machine you’re rolling out already has a copy of Windows 10 on it, you may be able to speed up your rollout with a “provisioning package,” a file you place on a USB stick, shove into the new computer, boot up the new computer and then press the Windows key five times, rapidly. In this short section, we’ll explain both the “Five Taps” and the current state of “Audit Mode.”
    
    
12.    Easier Application Rollouts: Windows 10’s Package Manager
    Deploying a new copy of an operating system gets easier and easier as time goes on, but they how to get applications on it? For some rollouts, you can just pre-install the applications in a “golden image,” and if that’s working, then fine. But Windows 10 and PowerShell’s WMF 5.0 introduce OneGet, a set of commands that let you easily existing applications on a PC or let you search “application galleries” and execute commands to quickly download and deploy applications. Even if you don’t understand PowerShell, you’ll quickly grasp the potential of OneGet and who knows, you may create an application gallery for your own organization.
    1. Application packagers: NuGet, Chocolatey and more
    2.    Using OneGet to find and install packaged applications
    3.    Doing local application inventory with the OneGet cmdlets  
    
    
13.    System Cleanup in Windows 10
    Over the years, we’ve become used to Windows boot drives becoming larger and larger – after all, desktop storage is really cheap, right? Well… maybe not. That “cheap” storage is rotational, and a standard 2.5” form factor. But who wants that? Solid state 2.5” drives are great but smaller in capacity, and the flood of very useful, insanely cheap small laptops with skinny profiles, weight under two pounds, a real keyboard are great… but they come with 128GB system drives. (And as those drives aren’t standard, they can’t be upgraded.) It is, then, a bit more of a priority to be able to do some housecleaning on the images we push out and the systems we deliver.
    1.     Deleting Windows.old without the GUI (it’s faster)
    2.     Understanding Windows “Side by Side,” why it’s a storage hog, and how to clean it out
    3.    Trimming System Restore
    4.   Do you need a pagefile? Windows 10’s pagefile changes the rules, and why Windows 10 runs better in two gigs than Windows 7 does  
    
    
14.    Storage Upgrades in Windows 10
    Speaking of new storage, like the eMMC solid state storage found in so many new inexpensive Windows 10 laptops, Windows 10 adds some new storage-related capabilities, not the least of which being that Microsoft finally fixed some really annoying CHKDSK behaviors. Find out more in this section.
    1.   Native 4K disk support
       1.    Why 4K sector disks?
       2.    4k emulation and native
       3.   Win 10 native 4K support  
    2.   New PowerShell storage cmdlets
    3.    Double-click that ISO: native ISO and VHD mounting
    4.   CHKDSK, rebooted: never fear the countdown again  
    
    
15.    Windows 10 Wants You in the Cloud: Azure AD Basics
    As you almost certainly know, Microsoft has become heavily invested in the cloud. What you may not know is that their cloud strategies are paying off well enough that many think they'll be the top dog in the cloud business soon. That has led to the fact that more and more Microsoft services – even the free ones – are cloud-based and require you to have a Microsoft cloud identity. Once, a Hotmail account could serve that purpose, but more and more you'll need an Azure Active Directory account, even if you don't use it for anything else, and meanwhile, more and more organizations don't need any on-premises AD, so Azure AD does the job for them. This section quickly introduces just enough Azure AD to get you ready to understand an interesting new Windows 10 capability – "joining a cloud." 
    1. Why on earth would I or my org use an Azure AD domain?
    2. Office 365 and Azure AD… you may have an Azure AD domain already!
    3. Azure AD terminology: tenants, vanity domains, subscriptions
    4. Understanding Microsoft accounts versus organization accounts
    5. Creating your own Azure AD (it's free)
    6. Populating your AD with Azure AD Connect
    7. Creating admins, user accounts, and enabling cloud single signon
    8. PowerShell tools to simplify Azure AD
    
    
16. Joining Win 10 Systems to a Cloud
    You already know how to join a Windows box to an AD domain. Here we'll see how and why you'd join to an Azure domain, doing a "cloud join."
    1. Why join a Win 10 device to an Azure AD?
    2. Enabling cloud join
    3. Doing cloud join
    4. Results: new security principals
    5. What cloud join doesn't do

  
    
    
17. Managing Windows 10: New Group Policy Settings
    If you've run a Windows 7 network, you've already got most of the tools you'll need to run a Windows 10 network, but Win 10 brings a few new management needs and solutions. We start covering that in this section with Windows 10's 42 (yes, it really is just 42) new group policy settings.
    1. Security settings: PIN and Virtual Secure Mode
    2. "Windows Recording" settings
    3. UI features, feedback control
    4. Windows Update for Business settings
   
    
    
18. User-Device Affinity: Preferred Computers
    If you’ve ever used folder redirection or roaming profiles, you know that they can be great but have an annoying tendency to leave a lot of junk behind on the computers you’ve logged onto at some point in the past. Windows 10 offers an improvement in the form of the “primary computer.” Its value? You can log onto any machine that you like, but your folders or profile do not roam to that machine unless it’s in your “primary computer” list.
    1.   Understanding a “primary computer”
    2.   Gotchas: this doesn’t work in a network with Windows 7 entirely
    3.   Primary computer setup: modify Active Directory
    4. Tracking PCs  
    
    
19. Windows 10’s New Software Platform: Modern and Universal Apps
    One of the biggest changes wrought by Windows 8/8.1—and one of the most-ignored and –reviled – was a completely new software platform named “Windows Runtime” or “WinRT.” That platform was originally intended to allow developers to create tablet-ish applications that relied almost solely on touch and large, clunky-looking interface elements. (That was where the “ignore” and “revile” part came from.) First called “Metro” apps and then “Modern” applications, the WinRT apps aimed to support a strongly secured “sandbox” as well as applications that ran as well on a standard Windows box as on the original “Surface RT” tablet and the Windows Phone platform. It was largely a flop. With Windows 10, however, Windows Runtime got a bit of a makeover and re-aligning to become the “Universal Windows Platform,” and UWP really pervades Windows 10, which is why this section is the first of several about “modern” and “universal” apps. Every Windows 10 admin needs to know that things in these sections because UWP in Windows 10 changes multitasking among all kinds of programs, because it actually does offer better security, and, well it’s hard to manage a Windows 10 system without working with these applications. This first section explains WinRT / UWP and the applications that it supports.
    1.   Windows application program interface (API) overview: Win32 and .NET
    2.    Why a third API, WinRT?
    3.   The three types of WinRT apps
    4.    From WinRT to UWP: “Universal” apps
    5.   Your phone as a PC: Continuum
    6.   Modern/Universal app deployment: “the Store”  
    
    
20. UWP and the OS: Multitasking and Power in Win 10
    Even if you intend never to touch a Modern/Universal application, you’ll need to understand what they’ve done to your PC: they’ve made it multitask better and use a lot less power. As you’ll see in this section, you can put Windows 10 on a circa-Windows 7 system and usually get much better battery life from it, and smoother multitasking even of “non-modern” apps.
    1.   Juggling two kinds of apps: the new multitasking structure
    2.     New multitasking with the Desktop Activity Monitor (DAM)
    3.   App rules: the system’s watching!
    4.    Shooting the hogs: controlling background processes
    5.    Sleep, Modern style
    6.      I/O coalescing, low power epoch, resiliency and Network Quiet Mode: getting more bang for your battery
    7.   Tracking the savings with powercfg  
    
    
21. Getting Modern/Universal Apps: “Windows Store for Business” and Sideloading
    Windows 8 brought the idea of the "Windows Store" and iPad-ish "modern applications," which has caught on slowly in most places, but the Store has morphed to include the more-widely-used "desktop" apps. Even better, Microsoft enables you to create your own tightly-defined version of the Store that lets your employees get apps that you want them to get. ("Curated" is the phrase Microsoft uses nowadays for such a store.) This was possible in Windows 8, but it suffered from blockers like "the employees need a credit card to get Store apps," or "you need System Center to set this up," but now just about anyone can create a curated Store, as you'll learn in this section.
    1. Intro to the new “Windows Store for Business”
    2. Flexible payment methods and inventory control
    3. Sideloading is easier, free and universal
    4. Line of business apps can be added to the Store
    5. Preinstalling apps in images
    6. Controlling (and potentially blocking) the store: the app and the service
    7. The bad news: If you don’t have Intune…   
    
    
22. Securing Windows 10: New Tools to Lock out the Bad Guys
    Windows 8 and 8.1 met mixed reviews, but almost no one seems to know that many of their most undeniably cool features were in the realm of security. Windows 10 continues that tradition with the notions of Isolated User Mode and Virtual Secure Mode, two fancy-sounding terms for a set of four technologies ("trustlets" is the new phrase) that take important, high-security data and store it in what is essentially another dimension. Windows 10 can, with the right hardware, create a block of memory whose data can only be accessed by the four in-the-box trustlets, and it's essentially impossible to create a fifth. It's neat, but fairly complex to figure out how to set up… unless you attend this last section of our class.
    1. DMA attacks: grabbing your hash
       1. How a DMA attack works
       2. Windows 10’s “basic” defense
    2. Early Launch Anti-Malware (ELAM)
       1. What it is: a new kind of scanner
       2. How it works
       3. How to set it up  
    3. User Isolation Mode: A new trust model
       1. Requirements: the right OS, and the right hardware
       2. Beyond "user mode" versus "kernel mode"
       3. The cool part: Hyper-V and a new trust model
       4. The new tools: "trustlets"  
    4. Configuration: BIOS settings, boot mode, group policy
    5. Credential Guard: the first trustlet, that eliminates pass-the-hash
    6. Why trust the trustlets?
    7. Validating Credential Guard
    8. Device Guard: the second trustlet, that blocks running malware
    9. Device Guard limitations
    10. The last two trustlets: virtual TPMs
    11. Windows Hello: biometrics, Win 10 style
    12. Windows Passport: the end to passwords
    13. Why is a PIN acceptable on a laptop?
    14. Where this leads to
    15. Next steps   
    
    
23.    “Windows Goodbye:” Understanding Pushbutton Reset
     Ever had a smartphone or a laptop start acting strangely, or perhaps needed to wipe it clean so you could give it away? As we all know, it’s pretty easy – just push the right buttons or click something in Settings, and your phone is either back in “no longer acting strangely” or “completely wiped clean” mode, and you can either start over with it, or give it away. Well, Windows 10 seeks to offer those things to your Windows laptops. In this section, you’ll learn how.
    1.      Introducing “pushbutton reset” or PBR
    2.     Simple reset versus complete reset
    3.        Activating it   
    
    
24.        Windows to Go: Your Desktop on a Stick
    Windows 10 Enterprise offers you the ability to install Windows not on a laptop, but instead onto a USB stick. You can then just boot any laptop from that USB stick and not only see your desktop and applications, you don’t see the local hard disks on the laptop… nice.
    1.    Windows to Go pros and cons
    2.   Hardware and software requirements (which are kind of stringent, be warned)
    3.      Creating the USB stick
    4.      Notes from the field on what it can and can’t do