Windows 10 Installation

1. Boot Media

1.1. Microsoft SHA1 checksums

Browse to https://www.heidoc.net/php/myvsdump.php.
Select the W Microsoft download directory.
Select Windows 10, version 22H2.
Select Windows 10 (business editions), version 22H2.

1.2. Download

Browse to https://www.google.com/ncr and search on the SHA1 checksums.

1.3. Bootable USB

1.3.1. MBR

Creation of a bootable custom Windows 10 Enterprise USB device with MBR partition table

Attach an empty external USB device.
Enter the following commands at a Command Line.

diskpart
list disk
select disk #                                   (1)
clean
clean                                           (2)
create partition primary
select partition 1
format fs=ntfs quick
active
exit

label X: Windows-10-Enterprise-22H2-x86         (3)
label X: Windows-10-Enterprise-22H2-x64         (4)

1	Replace # by the appropriate disk nr.
2	If previous command failed.
3	32-bit.
4	64-bit.

Start Windows Explorer.
Select the W:\Images\Windows\Windows 10\22H2 folder.
32-bit: Extract the en-us_windows_10_business_editions_version_22h2_x86_dvd_186a68c3.iso image to the X:\ folder.
64-bit: Extract the en-us_windows_10_business_editions_version_22h2_x64_dvd_8cf17b79.iso image to the X:\ folder.
Close Windows Explorer.
Detach the external USB device.

1.3.2. GPT

Creation of a bootable custom Windows 10 Enterprise USB device with GPT partition table

Most computers with the BIOS set to UEFI can only boot from a GPT USB device with a FAT32 file system. However, the SMRU custom created Windows image is typically 10 GB or larger. The FAT32 file system has a 4 GB file size limit, meaning it cannot hold any install.wim file that exceeds 4 GB. Therefore we do need a GPT USB device with an NTFS file system.

Rufus to the rescue. From https://github.com/pbatard/uefi-ntfs.

Rufus creates 2 partitions on the target USB disk (these can be MBR or GPT partitions). The first one is an NTFS partition occupying almost all the drive, that contains the Windows files (for Windows To Go, or for regular installation), and the second is a very small FAT partition, located at the very end, that contains an NTFS UEFI driver (see https://efi.akeo.ie) as well as the UEFI:NTFS bootloader.
When the USB drive boots in UEFI mode, the first NTFS partition gets ignored by the UEFI firmware (unless that firmware already includes an NTFS driver, in which case 2 boot options will be available, that perform the same thing) and the UEFI:NTFS bootloader from the bootable FAT partition is executed.
UEFI:NTFS then loads the relevant NTFS UEFI driver, locates the existing NTFS partition on the same media, and executes the /efi/boot/bootia32.efi, /efi/boot/bootx64.efi, /efi/boot/bootarm.efi or /efi/boot/bootaa64.efi that resides there. This achieves the exact same outcome as if the UEFI firmware had native support for NTFS and could boot straight from it.

Note: Copy the Windows 10 iso file from the network share to the local drive because Rufus does not recognise network drives.

Start Rufus with administrative privileges.
Attach an empty external USB device.
Select the external USB device.
Click SELECT.
Select the W:\Images\Windows\Windows 10\22H2 folder.
32-bit: Select the en-us_windows_10_business_editions_version_22h2_x86_dvd_186a68c3.iso file.
64-bit: Select the en-us_windows_10_business_editions_version_22h2_x64_dvd_8cf17b79.iso file.
Click Open.
32-bit: Type Windows-10-Enterprise-22H2-x86 for the Volume label.
64-bit: Type Windows-10-Enterprise-22H2-x64 for the Volume label.

Device                                  Windows-10-Enterprise-22H2-x64
Boot selection                          en_windows_10_business_editions_version_...
Image option                            Standard Windows installation
Partition scheme                        GPT
Target system                           UEFI (non CSM)

- List USB Hard Drives
- Add fixes for old BIOSes (extra partition, align, etc.)
- Use Rufus MBR with BIOS ID

Volume label                            Windows-10-Enterprise-22H2-x64
File system                             NTFS
Cluster size                            4096 bytes (Default)

+ Quick format
+ Create extended label and icon files
- Check device for bad blocks           1 pass

Click START.
Click OK to confirm.
Wait about 5 minutes for Rufus to finish.
Detach the external USB device.
Click CLOSE to close Rufus.

1.4. Windows 10 PE

Create Windows 10 PE Image.

1.5. SMRU Reference Image

Create Windows 10 Reference Image.

1.5.1. Bootable ISO (32-bit)

Creation of a bootable custom Windows 10 Enterprise iso file

Install [Windows Assessment and Deployment Kit (ADK) on 32-bit Windows 10.
Select Start > Programs > Windows Kits > Windows ADK > Deployment and Imaging Tools Environment with administrative privileges.
Contents of the C:\Users\Administrator\Make-ISO-File.bat file.

@echo off
setlocal EnableDelayedExpansion
set "BootFile=W:\Windows-10-Enterprise-x86\boot\etfsboot.com"
set "Label=Windows-10-Enterprise-22H2-x86"
set "SourceRoot=W:\Windows-10-Enterprise-x86"
set "TargetFile=W:\Windows-10-Enterprise-22H2-x86.iso"
oscdimg.exe -u2 -o -l%Label% -b%BootFile% %SourceRoot% %TargetFile%

Enter the following commands at a Command Line.

net use W: \\SMRU-HyperV01\Windows$ /P:No
cd C:\Users\Administrator
Make-ISO-File.bat

1.5.2. Bootable ISO (64-bit)

Creation of a bootable custom Windows 10 Enterprise iso file

Install Windows Assessment and Deployment Kit (ADK) on 64-bit Windows 10.
Select Start > Programs > Windows Kits > Windows ADK > Deployment and Imaging Tools Environment with administrative privileges.
Contents of the C:\Users\Administrator\Make-ISO-File.bat file.

@echo off
setlocal EnableDelayedExpansion
set "BootFile=W:\Windows-10-Enterprise-x64\boot\etfsboot.com"
set "Label=Windows-10-Enterprise-22H2-x64"
set "SourceRoot=W:\Windows-10-Enterprise-x64"
set "TargetFile=W:\Windows-10-Enterprise-22H2-x64.iso"
oscdimg.exe -u2 -o -l%Label% -b%BootFile% %SourceRoot% %TargetFile%

Enter the following commands at a Command Line.

net use W: \\SMRU-HyperV01\Windows$ /P:No
cd C:\Users\Administrator
Make-ISO-File.bat

1.5.3. Bootable USB

Update of the bootable custom Windows 10 Enterprise USB device

Attach the custom Windows 10 Enterprise external USB device.
Copy the W:\Partition-Disk.cmd file to the X:\ folder.
Copy the W:\Create-BIOS-MBR-Partitions-On-Disk-0.txt file to the X:\ folder.
Copy the W:\Create-BIOS-MBR-Partitions-On-Disk-1.txt file to the X:\ folder.
Copy the W:\Create-UEFI-GPT-Partitions-On-Disk-0.txt file to the X:\ folder.
Copy the W:\Create-UEFI-GPT-Partitions-On-Disk-1.txt file to the X:\ folder.
Delete the X:\sources\install.wim file.
32-bit: Copy the W:\Windows-10-Enterprise-x86\sources\install.wim file to the X:\sources folder.
64-bit: Copy the W:\Windows-10-Enterprise-x64\sources\install.wim file to the X:\sources folder.
Wait about 15 minutes for the copy to finish.
Detach the custom Windows 10 Enterprise external USB device.

2. Setup

2.1. Real Machine

2.1.1. Requirements

Note: Make sure that the BIOS system time is set to local time.
Note: Make sure that the BIOS is configured to AC power off after AC power loss.
Note: Make sure that the BIOS is configured to boot from the 1st hard disk.
Note: Make sure that the computer has a solid state disk of at least 200 GB.
Note: Make sure that the solid state disk have no SMART errors.

2.2. Hyper-V

2.2.1. Create Hyper-V vm

2.2.2. Configure Hyper-V vm

2.3. VirtualBox

2.3.1. Create VirtualBox vm

Start VirtualBox.
Select the Windows 10 group.
Select Group > New Machine.
Type Windows 10 Enterprise 22H2 64-bit for the Name.
Select Machine Folder | Other.
Select the V:\VirtualBox Quick\VirtualBox VMs folder.
Click Select Folder.
Select Type | Microsoft Windows.

Select Version | Windows 10 (64-bit).

Name:                   Windows 10 Enterprise 22H2 64-bit
Machine Folder:         V:\VirtualBox Quick\VirtualBox VMs
Type:                   Microsoft Windows
Version:                Windows 10 (64 bit)

Click Next.
```
Memory size:            2048 MB
```
Click Next.
Choose Create a virtual hard disk now.
Click Create.
Choose VDI (VirtualBox Disk Image).
Click Next.
Choose Dynamically allocated.

Click Next.

File Location:          V:\VirtualBox Quick\VirtualBox VMs\Windows 10\Windows 10 Enterprise 22H2 64-bit\Windows 10 Enterprise 22H2 64-bit.vdi
Size:                   200.00 GB

Click Create.
Close VirtualBox.

2.3.2. Configure VirtualBox vm

Start VirtualBox.
Select the Windows 10 > Windows 10 Enterprise 22H2 64-bit virtual machine.
Click Settings.
Select the General page.
- Select the Advanced tab.
- Select Shared Clipboard | Bidirectional.
Select the System page.
- Select the Motherboard tab.
- Uncheck Boot Order | Floppy.
- Move Floppy down to the bottom.
- Check Enable IO APIC.
- Optional: Check Enable EFI (special OSes only).
- Uncheck Hardware Clock in UTC Time.
- Select the Processor tab.
- Select Processor(s) | 2.
Select the Storage page.
- Select Controller: SATA > Windows 10 Enterprise 22H2 64-bit.vdi.
- Check Solid-state Drive.
Select the Shared Folders page.
- Click the Adds new shared folder button.
- Select Folder Path | Other.
- Select the D:\ folder.
- Click Select Folder.
- Check Auto-mount.
- Type D:\ for the Mount point.
```
Folder Path:            D:\
Folder Name:            D_DRIVE
                        □ Read-only
                        ■ Auto-mount
Mount point:            D:\
```
- Click OK.
Click OK.
Close VirtualBox.

2.3.3. Prepare VirtualBox vm

Start VirtualBox.
Select the Windows 10 > Windows 10 Enterprise 22H2 64-bit virtual machine.
Click Settings.
Select the Storage page.
- Select Controller: SATA > Empty.
- Click the Choose a virtual optical disk button.
- Select Choose a disk file.
- Microsoft: Select the W:\Images\Windows\Windows 10\22H2 folder.
- Microsoft: Select the en-us_windows_10_business_editions_version_22h2_x64_dvd_8cf17b79.iso file.
- SMRU: Select the W:\ folder.
- SMRU: Select the Windows-10-Enterprise-22H2-x64.iso file.
- Click Open.
Click OK.
Close VirtualBox.

2.4. VMware

Press Ctrl+G to grab input from keyboard and mouse.
Press Ctrl+Alt to release the mouse pointer.

2.4.1. Create VMware vm

Start VMware Workstation Player.
Select Create a New Virtual Machine.

Choose I will install the operating system later.

○ Installer disc:
○ Installer disc image file (iso):
● I will install the operating system later.

Click Next.
Choose Microsoft Windows.

Select Windows Server 2016.

Guest operating system:
● Microsoft Windows
○ Linux
○ Other

Version:                Windows Server 2016

Click Next.

Virtual machine name:   Windows Server 2019
Location:               D:\VMware\Virtual Machines\Windows Server 2019

Click Next.

Choose Store virtual disk as a single file.

Maximum disk size (GB): 60.0

● Store virtual disk as a single file
○ Split virtual disk into multiple files

Click Next.
Optional: Click Customize Hardware.

Optional: Click Close.

Name:                   Windows Server 2019
Location:               D:\VMware\Virtual Machines\Windows Server 2019
Version:                Workstation 15.x
Operating System:       Windows Server 2016

Hard Disk:              60 GB
Memory:                 2048 MB
Network Adapter:        NAT
Other Devices:          2 CPU cores, CD/DVD, USB Controller, Printer, Sound...

Click Finish.
Close VMware Workstation Player.

2.4.2. Configure VMware vm

Start VMware Workstation Player.
Select the virtual machine.
Select Edit virtual machine settings.
Select the Processors tab.

Check Virtualize Intel VT-x/EPT or AMD-V/RVI.

■ Virtualize Intel VT-x/EPT or AMD-V/RVI
□ Virtualize CPU performance counters
□ Virtualize IOMMU (IO memory management unit)

Select the CD/DVD (SATA) tab.
Choose Use ISO image file.
Click Browse.
Select the W:\Images\Windows\Windows Server 2019\en_windows_server_version_2009_x64_dvd_765aeb22.iso file.
Click Open.
Click OK.
Close VMware Workstation Player.

3. Installation

3.1. Official Microsoft Windows

Mount the en-us_windows_10_business_editions_version_22h2_x64_dvd_8cf17b79.iso file.

Boot the computer from the CD/DVD drive.

Language to install:            English (United States)
Time and currency format:       English (United States)
Keyboard or input method:       US

Press Shift+F10 to open a Command Prompt.

Enter the following commands at the Command Line.

wpeutil InitializeNetwork
ipconfig
net use W: \\SMRU-HyperV01\Windows$ /Persistent:No

Firmware: BIOS + MBR.
- Enter the following commands at the Command Line.
  diskpart.exe list disk list volume select volume # (1) assign letter=U (1) select volume # (2) assign letter=V (2) list disk list volume exit
  1 If there is a volume assigned to drive C:
  
  2 If there is a volume assigned to drive D:
- Note: M.2 SSD disks may not be assigned as disk 0.
- Note: The next commands will wipe the disk.
- Enter the following commands at the Command Line.
```
W:\Partition-Disk.cmd 0 BIOS    (1)
W:\Partition-Disk.cmd 1 BIOS    (2)
```
1 Partition disk 0 for old computers with Legacy BIOS.

2 Partition disk 1 for old computers with Legacy BIOS.
Firmware: UEFI + GPT.
- Enter the following commands at the Command Line.
  diskpart.exe list disk list volume select volume # (1) assign letter=U select volume # (2) assign letter=V list disk list volume exit
  1 Select the UEFI_NTFS volume.
  
  2 Select the Windows-10- volume.
- Note: M.2 SSD disks may not be assigned as disk 0.
- Note: The next commands will wipe the disk.
- Note: This partitioning does not work for Advanced Format drives with 4096 sector size disks.
  Because for 4Kn disks the EFI System Partition size needs to be 260 MB.
- Enter the following commands at the Command Line.
```
W:\Partition-Disk.cmd 0 UEFI    (1)
W:\Partition-Disk.cmd 1 UEFI    (2)
```
1 Partition disk 0 for new computers with UEFI.

2 Partition disk 1 for new computers with UEFI.

Enter the following commands at the Command Line.

diskpart.exe
list disk
list volume
select disk #                   (1)
list partition
exit

setup.exe /unattend:W:\Unattend-Windows-10-Enterprise-x64.xml           (2)
setup.exe /unattend:W:\Unattend-Windows-10-Pro-x64.xml                  (3)

1	Enter the disk number that was partitioned.
2	For Windows 10 x64 Enterprise
3	For Windows 10 x64 Pro

Language to install:            English (United States)
Time and currency format:       English (United States)
Keyboard or input method:       US

Click Next.

Select Windows 10 Enterprise | x64 | 10/7/2020.

Operating system                Architecture    Date modified
-------------------------       ------------    -------------
Windows 10 Enterprise           x64             10/6/2021

Click Next.
Check I accept the license terms.
Click Next.
Select the System64 | Primary partition.
Click Next.
Wait about 7 minutes for the installation to finish.

Optional: Disable voice control (2nd icon at the left side of the taskbar).
Select Thailand for the region.
Click Yes.
Select US for the keyboard layout.
Click Yes.
Click Skip to skip adding a second keyboard layout.

Select Location > No.
Select Find my device > No.
Select Diagnostic data > Send Required diagnostic data.
Select Inking & typing > No.
Select Tailored experiences > No.

Select Advertising ID > No.

Location                        No
Find my device                  No
Diagnostic data                 Required only
Inking & typing                 No
Tailored experiences            No
Advertising ID                  No

Click Accept.
Click Yes at the Networks dialog to allow this PC to be discoverable by other devices on this network.
Unmount the en-us_windows_10_business_editions_version_22h2_x64_dvd_8cf17b79.iso file.
Right-click Microsoft Edge icon on the Taskbar and select Unpin from taskbar.
Right-click File Explorer icon on the Taskbar and select Unpin from taskbar.
Right-click Microsoft Store icon on the Taskbar and select Unpin from taskbar.
Right-click Mail icon on the Taskbar and select Unpin from taskbar.
Right-click Taskbar and select Search > Search icon.
Right-click Taskbar and deselect Show Cortana button.
Right-click on Desktop and select View > Small icons.
Delete the Microsoft Edge icon from the desktop.
Shutdown the computer.

3.2. Customized SMRU Windows

Preparations.
- Make sure that the hard disk is connected.
- Make sure that BIOS Date/Time is set to local time.
- Make Sure that BIOS SATA Operation is AHCI.
- Make sure that Secure Boot is disabled.
- Make sure that TPM chip is enabled and activated.
- Make sure that Wake on LAN is LAN Only.
- BIOS: Make sure that Legacy BIOS is enabled and UEFI is disabled.
- UEFI: Make sure that UEFI is enabled and Legacy BIOS is disabled.
- UEFI: Make sure to enable Secure Boot after the Windows installation has finished.
- Optional: The following may be needed to prevent the installation from failing.
  - Make sure to power off the computer (remove battery from notebook).
  - Make sure to power off the computer (remove CMOS battery).
  - Make sure to power off the computer (reseat RAM modules).
```
Windows could not parse or process the unattend answer file for pass
[specialize]. The settings specified in the answer file cannot be applied.
The error was detected while processing settings for component
[Microsoft-Windows-Shell-Setup]
```
Attach the custom Windows 10 Enterprise USB device.

Boot the computer from the USB device.

Language to install:            English (United States)
Time and currency format:       English (United States)
Keyboard or input method:       US

Press Shift+F10 to open a Command Prompt.

Optional: Network.

Enter the following commands at the Command Line.

wpeutil InitializeNetwork
ipconfig
net use W: \\SMRU-HyperV01\Windows$ /Persistent:No

Firmware: BIOS + MBR.
- Enter the following commands at the Command Line.
  diskpart.exe list disk list volume select volume C (1) assign letter=U (1) select volume D (2) assign letter=W (2) list disk list volume exit
  1 If there is a volume assigned to drive C:
  
  2 If there is a volume assigned to drive D:
- Note: M.2 SSD disks may not be assigned as disk 0.
- Note: The next commands will wipe the disk.
- Enter the following commands at the Command Line.
```
W:\Partition-Disk.cmd 0 BIOS    (1)
W:\Partition-Disk.cmd 1 BIOS    (2)
```
1 Partition disk 0 for old computers with Legacy BIOS.

2 Partition disk 1 for old computers with Legacy BIOS.
Firmware: UEFI + GPT.
- Enter the following commands at the Command Line.
  diskpart.exe list disk list volume select volume # (1) assign letter=U select volume # (2) assign letter=W list disk list volume exit
  1 Select the UEFI_NTFS volume.
  
  2 Select the Windows-10- volume.
- Note: M.2 SSD disks may not be assigned as disk 0.
- Note: The next commands will wipe the disk.
- Note: This partitioning does not work for Advanced Format drives with 4096 sector size disks.
  Because for 4Kn disks the EFI System Partition size needs to be 260 MB.
- Enter the following commands at the Command Line.
```
W:\Partition-Disk.cmd 0 UEFI    (1)
W:\Partition-Disk.cmd 1 UEFI    (2)
```
1 Partition disk 0 for new computers with UEFI.

2 Partition disk 1 for new computers with UEFI.

Enter the following commands at the Command Line.

diskpart.exe
list disk
list volume
select disk #                   (1)
list partition
exit

exit

1	Enter the disk number that was partitioned.

Click Next.
Click Install now.
Check I accept the license terms.
Click Next.
Click Custom: Install Windows only (advanced).

Select the System64 | Primary partition.
Click Next.
Wait about 7 minutes for the installation to finish.

Select Thailand for the region.
Click Yes.
Select US for the keyboard layout.
Click Yes.
Click Skip to skip adding a second keyboard layout.
Notebook: Click I don’t have network to skip ethernet connection.
Notebook: Click Continue with limited.
Notebook: Select Skip for now to skip setting up a wifi connection.

Select Online speech recognition > No.
Select Find my device > No.
Select Inking & typing > No.
Select Advertising ID > No.
Select Location > No.
Select Diagnostic data > Send Required diagnostic data.

Select Tailored experiences > No.

Online speech recognition       No
Find my device                  No
Inking & typing                 No
Advertising ID                  No
Location                        No
Diagnostic data                 Send Required diagnostic data
Tailored experiences            No

Click Accept.
Click Yes at the Networks dialog to allow this PC to be discoverable by other devices on this network.

4. Activation

4.1. Microsoft Office

Log on as Administrator.
Make sure to have internet connection.
Start Word.
Optional: Choose Install updates only.
Optional: Click Accept.
Optional: Select the Blank document template.
Optional: Select File > Account.

Select Change Product Key.

Product key:            XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

Click Activate Office.
Close Word.

4.2. Windows 10 Enterprise

Log on as Administrator.
Make sure to have internet connection.
Open Settings > Update & security > Activation.
Note: When it takes too long, then select several tab and then return to the Activation tab.
Optional: Ignore the Windows can’t activate right now. Try activating Windows later. If that doesn’t work, contact your system administrator. Error code: 0x8007232B. error message.
Select Change product key.
Enter the Microsoft Windows 10 Enterprise product key from the OUCS.kdbx database file of KeePass Password Manager.
```
Product key:            XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
```
Click Next.
Optional: Ignore the Windows can’t activate with this product key. Go to Settings for more information. (0x8004fe33) error message.
Click Activate.
Click Close.
Close Settings.
Restart the computer.

4.3. Windows 10 Pro

Note: Computers with Windows 10 Pro do not have any product key with it.
But we can activate online.
Note: Make sure that the computer has direct internet access.

Open System.
- Select Control panel > System.
Click Activate windows.
Click Troubleshoot.
Click Activate windows.
Click Close on We’ve activated this copy of Windows message.
Close Settings.
Close System.

5. Configuration

5.1. Official Microsoft Windows

5.1.1. Administrator password

PC: Press Ctrl+Alt+Del.
VirtualBox: Select Input > Keyboard > Insert Ctrl+Alt+Del.
Select Change a password.
Leave the old password field empty.
Type Administr@t0r!!! for the new password.
Type Administr@t0r!!! to confirm the password.
Click the → button.
Click OK.

5.1.2. Computer name

Open Settings.
Select System.
Select About.

Click Rename this PC.

Computer name:          WIN10VM-ENT22H2                 # Windows 10 Enterprise
Computer name:          WIN10VM-PRO22H2                 # Windows 10 Pro

Click Next.
Click Restart Later.
Close Settings.
Restart the computer.

5.1.3. Time zone

Open Settings.
Select Time & Language.
Select Date & time.
Select the (UTC+07:00) Bangkok. Hanoi, Jakarta time zone.
Close Settings.

5.1.4. Applications

Install Delta Windows Tools.
Optional: Install VirtualBox Guest Additions.
Optional: Install VMware Tools.
Install Clink.

5.1.5. Cleanup

Enter the following commands at a Command Prompt with administrative privileges.

net user
Remove-UserAccount defaultuser0
Remove-UserAccount Default.migrated
dir /a: C:\Users
rmdir /q /s C:\Users\defaultuser0 2> nul
rmdir /q /s C:\Users\Default.migrated 2> nul

5.1.6. Thai language

Open Settings.
Select Time & language.
Select Language.
Select Add a language.
Select ไทย Thai.
Click Next.
Check Install language pack.
Uncheck Set as my Windows display language.

Uncheck Text-to-speech (5 MB).

Optional language features
■ Install language pack
  □ Set as my display language
□ Text-to-speech (5 MB)

Required language features
■ Basic typing (1 MB)
■ Supplemental fonts (2 MB)

Click Install.
Wait for the installation to finish.
Close Settings.

5.1.7. Windows updates

Open Services (Control Panel > Administrative Tools > Services) (services.msc).
Right-click Background Intelligent Transfer Service and select Properties.
Select Startup type: > Automatic (Delayed Start).
Click Apply.
Optional: Click Start.
Click OK.
Right-click Windows Update and select Properties.
Select Startup type: > Automatic.
Click Apply.
Optional: Click Start.
Click OK.
Close Services.

Open Settings.
Select Update & Security.
Click Check for updates.
Close Settings.

5.1.8. File Explorer

Start File Explorer.
Select the C:\ folder.
Select View > Details.
Move the Size column between the Name and Date modified columns.
Increase the width of the Name column.
Select View > Options > Change folder and search options.
Select the View tab.
Click Apply to Folders.
Click Yes to confirm.
Click OK.
Close File Explorer.

5.1.9. Indexing Options

Open Control Panel > Indexing Options.
Click Modify.
Check all local drives.
Click OK.
Wait about 10 minutes for indexing to finish.
Click Close.

5.1.10. System performance

Open Control Panel > System.
Select Advanced system settings.
Select the Advanced tab.
Click Performance > Settings.
Select the Visual Effects tab.
Choose Adjust for best performance.
Choose Custom.
Check Smooth edges of screen fonts.
Click Apply.
Click OK.
Click OK.
Close System.

Open Control Panel > File Explorer Options.
Select the View tab.
Check Show encrypted or compressed NTFS files in color.
Click Apply.
Click OK.
Close File Explorer Options.

5.1.11. Programs

5.1.11.1. Install drivers, software and updates

Do not activate Windows 10 Enterprise.
Do not activate Microsoft Office.
Do not install Adobe Flash Player for Internet Explorer (it is already built-in for Windows 10).
Do not install Adobe Flash Player for Plugin-based browsers.
Do not install AVG Free.
Do not install network printers.

Install 7-Zip.
Install Adobe Acrobat Reader DC.
Install Clink (Christopher Antos).
Install Fonts.
- Install Karen and Myanmar fonts.
- Install Thai fonts.
Install Free Launch Bar (Tordex).
Install LAPS.
Install MicroDicom DICOM Viewer.
Install Microsoft Office Professional Plus 2021.
Install Open-Shell.
Install OpenSSH Server.
Install Oracle VM VirtualBox Guest Additions.
Install Smartmontools.
Install Delta Windows Tools.
Install VLC Media Player (VideoLAN).
Install Zawgyi.

Disable Internet Explorer.
- Enter the following commands at a Command Prompt with administrative privileges.
```
dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64
```
Disable Windows Media Player.
- Open Programs and Features.
- Select Turn Windows features on or off.
- Uncheck Media Features.
- Click OK.
- Click Close.
- Close Programs and Features.

Uninstall Windows Media Player.
- Open Settings.
- Select Apps.
- Select Apps & features.
- Select Optional features.
- Select Windows Media Player.
- Click Uninstall.
- Close Settings.

Start System Configuration (msconfig.exe).
Select the Boot tab.
Change the Timeout value from 30 to 10 seconds.
Click Apply.
Click OK.
Click Exit without restart.
Close System Configuration.
Restart the computer.

5.1.11.2. Configuration of default applications

Open Settings.
Select Apps.
Select Default apps.
Select Email > Outlook.
Select Music player > VLC media player.
Select Video player > VLC media player.
Select Web browser > Microsoft Edge.
Close Settings.

Other

Make 7-Zip the default application for .zip files.
Make Notepad the default application for .log and .txt files.

5.2. Customized SMRU Windows

5.2.1. Computer name

Log on as Administrator.
Open Control Panel > System.
Select Change settings.

Click Change.

Computer name:  SMRUWS-IT00

○ Domain:
● Workgroup:    WORKGROUP

Click OK.
Click OK.
Click Close.
Click Restart Later.
Close System.

5.2.2. Computer

Log on as Administrator.
Press Ctrl+Alt+Delete.
Select Change a password.
Type [kbd]`` in the Old password field.
Type the new password in the New password field.
Retype the new password in the Confirm password field.
Click the → button.
Click OK.
Start Command Prompt.

Enter the following commands at a Command Prompt with administrative privileges.

Remove-UserAccount defaultuser0
Remove-UserAccount Default.migrated
rmdir /q /s C:\Users\defaultuser0
rmdir /q /s C:\Users\Default.migrated
Set-WindowsConfiguration

5.2.3. Credentials

Enter the following commands at a Command Prompt with administrative privileges.
```
Save-SmruCredentials Inventory-Zip
Save-SmruCredentials PowerShell-Email
```
Shutdown the computer.
Detach the custom Windows 10 Enterprise USB device.

5.2.4. Environment variables

Log on as Administrator.
Wait.
Open Control Panel > System.
Select Advanced system settings.
Select the Advanced tab.
Click Environment Variables.

Double-click a DELTA_* variable from the table below in the System variables panel.
Adjust its value.
Click OK.

Click OK.
Click OK.
Close System.

Variable name	Example values
DELTA_CONDITION	Bad, Good, Poor
DELTA_DEPARTMENT	DM, Finance, HR, IT, TB
DELTA_EMAIL	<user>@bhf-th.org, <user>@shoklo-unit.com
DELTA_GRANT	C-13-0001
DELTA_LOCATION	IT office
DELTA_MORU_TAG	COM-18-0211
DELTA_PHONE	-
DELTA_PRICE	38,000 THB
DELTA_PURCHASE_DATE	2014-07-24
DELTA_REMARK	From AMI, GeneXpert, Gibthai, Slow
DELTA_SITE	HPA, MKT, MLA, MSL, MST, WPA
DELTA_SMRU_TAG	SMRU-AS-COM-NB-0045, SMRU-AS-COM-PC-0045
DELTA_STATUS	Deleted, Donated, In use, Obsolete
DELTA_TBHF_TAG	TBHF-AS-COM-NB-0045, TBHF-AS-COM-PC-0045
DELTA_USER
DELTA_WAKE_ON_LAN	34:17:EB:B4:CA:8C
DELTA_WARRANTY_EXPIRES	2017-07-15
DELTA_WINDOWS_LICENSE_LABEL	No, Pro Windows 8, Windows

Variable name

Example values

DELTA_CONDITION

Bad, Good, Poor

DELTA_DEPARTMENT

DM, Finance, HR, IT, TB

DELTA_EMAIL

<user>@bhf-th.org, <user>@shoklo-unit.com

DELTA_GRANT

C-13-0001

DELTA_LOCATION

IT office

DELTA_MORU_TAG

COM-18-0211

DELTA_PHONE

DELTA_PRICE

38,000 THB

DELTA_PURCHASE_DATE

2014-07-24

DELTA_REMARK

From AMI, GeneXpert, Gibthai, Slow

DELTA_SITE

HPA, MKT, MLA, MSL, MST, WPA

DELTA_SMRU_TAG

SMRU-AS-COM-NB-0045, SMRU-AS-COM-PC-0045

DELTA_STATUS

Deleted, Donated, In use, Obsolete

DELTA_TBHF_TAG

TBHF-AS-COM-NB-0045, TBHF-AS-COM-PC-0045

DELTA_USER

DELTA_WAKE_ON_LAN

34:17:EB:B4:CA:8C

DELTA_WARRANTY_EXPIRES

2017-07-15

DELTA_WINDOWS_LICENSE_LABEL

No, Pro Windows 8, Windows

5.2.5. Time zone

Open Settings.
Select Time & Language.
Select Date & time.
Select the (UTC+07:00) Bangkok. Hanoi, Jakarta time zone.
Disable Set time automatically.
Click Change.
Adjust the date and time.
Click Change.
Enable Set time automatically.
Close Settings.

5.2.6. Quick Launch

Log on as Administrator.
Right-click the taskbar and check Toolbars > Free Launch Bar.

Installation of additional hardware drivers:

Log on as Administrator.
Open Control Panel > Device Manager.
Install the hardware driver for any unrecognized device.
Close Device Manager.

Open Control Panel > Windows Update.
Select Check for updates.
Close Windows Update.
Open Settings.
Select Update & Security.
Click Check for updates.

Restart the computer.

5.2.7. SMRU domain

Log on as Administrator.
Join the computer to the SMRU domain.
- Open Control Panel > System.
- Click Change settings.
- Click Change.
- Choose Member of > Domain:.
- Type smru.shoklo-unit.com.
- Click OK.
- Type SMRU\ADjoincom in the name field.
- Type the ADjoincom password in the password field.
- Click OK.
- Click OK.
- Click Close.
- Click Restart Now.

5.2.8. BitLocker Encryption

Prepare TPM.
Encrypt Operating system drive.
Encrypt Fixed data drives.

5.2.9. Printer Drivers

Show-NetworkPrinters
Show-NetworkPrinters | Sort-Object PortName
Install-PrinterDrivers

5.2.10. Inventory

Log on as Administrator.
Start Command Prompt with administrative privileges.
Type Show-Inventory and press Enter.
Close Command Prompt.

5.2.11. IT Helpdesk Computers

5.2.11.1. Endian Firewall

See https://www.instantssl.com/ssl-faqs/ssl-certificate-errors.html.
See https://www.attachmate.com/documentation/gateway-1-1/gateway-admin-guide/data/fxg_add_untrusted_cert.htm.
Prevent the Your connection is not private message in Google Chrome. Not secure
Prevent the This site is not secure message in Internet Explorer. This site isn’t secure
Prevent the This site is not secure message in Microsoft Edge. Certificate error
Prevent the Your connection is not secure message in Mozilla Firefox. Insecure Connection

Mozilla Firefox

Browse to https://10.10.1.170:10443.
Browse to https://192.168.25.170:10443.
Click Advanced.

Click Add Exception.

Click View.

Select the General tab.

Could not verify this certificate because it was signed using a signature algorithm that was
disabled because that algorithm is not secure.

Select the Details tab.
Select smru-efw-mrm.smru.shoklo-unit.com > Certificate > certificate Signature Algorithm.

PKCS #1 MD5 With RSA Encryption

Click Close.

Note: The following checkbox is disabled (grayed out).
Check Permanently store this exception.
Click Confirm Security Exception.

5.2.11.2. Remote Desktop Connection

Prevent the Remote Desktop Connection window with the The identity of the remote computer cannot be verified. Do you want to connect anyway? message popping up when using Remote Desktop Connection.

Log on as <IT Helpdesk User>.

Enter the following commands at a Command Line.

set "Key=HKCU\Software\Microsoft\Terminal Server Client"
reg add "%Key%" /v "AuthenticationLevelOverride" /t REG_DWORD /d "0" /f

Enter the following commands at a Command Line to restore the default behaviour.

set "Key=HKCU\Software\Microsoft\Terminal Server Client"
reg delete "%Key%" /v "AuthenticationLevelOverride" /f

There is also a HKLM\Software\Microsoft\Terminal Server Client registry key. Adding the registry value for that key prevents the popup message for all users logged on to the computer using Remote Desktop Connection.

5.2.11.3. Delta Windows Tools

Delta Windows Tools uses the SSH protocol for communication with remote computers. It is assumed that Bitvise SSH Server is installed on all SMRU computers. Only the IT Helpdesk computers should have the private key installed.

Start KeePass Password Safe.
Open the SMRU.kdbx file.
Select the Advanced tab.
Select the id_rsa-auto.pub file.
Click Save to save the Bitvise SSH Server - Private for PuTTY key to the C:\Tmp folder.
Close KeePass Password Safe.

Enter the following commands at a Command Prompt with administrative privileges.
```
move C:\Tmp\id_rsa* C:\Users\Administrator
```

5.2.12. Verification

TODO:

15) TeamViewer. -→ Check when 2 target computers are running TeamViewer. 17) Windows Updates - Download updates but let me choose whether to install them. Test Microsoft Update enable script.

OK 31) Network Adapter - Power Management. OK 32) Thai language (ink correction + thai language + language bar settings). OK 33) WinMerge settings. 35) Symantec Endpoint Protection. OK 36) Network printers. OK 39) Log on with domain user account. OK 40) Check Disk Cleanup. OK 42) Check ping from remote computer. OK 43) Check SSH from remote computer. 44) Test TeamViewer. 45) Open Control Panel > Administrative Tools > Services.

5.2.13. Issues

Installing AVG Free on the reference computer, gives many problems during installation of the deployment image on the target computer.
Note: Do not panic when the installation fails. Restart the computer and start Windows in Safe Mode. It will fail again, restart the computer once more, but this time it will finish the installation without any further errors. Just follow the instructions below.
Fail: Install Windows Windows could not finish configuring the system. To attempt to resume configuration, restart the computer.
Start Command Prompt (Shift+F10).

Enter the following commands at a Command Prompt with administrative privileges.

dir c:\windows\system32\sysprep\panther         <????>
dir c:\windows\panther                          <????>
dir c:\windows\panther\unattendgc               <????>

Optional: Start Notepad (notepad.exe)?
Optional: Open the c:\windows\panther\setupact.log file?
Optional: Close Notepad?
Click OK to restart the computer.
Press F8 while Windows restarts.
Select Safe Mode and press Enter.
Fail: Install Windows Windows cannot complete installation in Safe Mode. To continue installing Windows, restart the computer.
Click OK to restart the computer.
Wait.
Fail: Install Windows Windows could not parse or process the unattend answer file for pass [specialize]. The settings specified in the answer file cannot be applied. The error was detected while processing settings for component [Microsoft-Windows-Shell-Setup].

See C:\Windows\Panther\unattendGC\setupact.log.

_FindLatestProfile failed (0x80070003) [gle=0x00000003]
CopyProfile failed (0x80070003) [gle=0x00000003]

See http://support.microsoft.com/kb/2530664.    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Press Shift+F10 when sysprep message comes up with the error and it will open
a command prompt. Open up taskmgr, and then open up eventvwr.msc.
You might see copy profile errors.

Optional: Start Command Prompt (Shift+F10)?

dir c:\windows\system32\sysprep\panther         <????>
dir c:\windows\panther                          <????>
dir c:\windows\panther\unattendgc               <????>

Optional: Start Notepad (notepad.exe)?
Optional: Open the c:\windows\panther\setupact.log file?
Optional: Open the c:\windows\panther\unattendgc\setuperr.log file?

Optional: Close Notepad?

Start Command Prompt (Shift+F10).                                       <????>
Start Registry Editor (regedit.exe).                                    <????>
Select the *HKLM > System > Setup > Status > ChildCompletion* key.      <????>
Right-click *setup.exe* and select *Modify*.                            <????>
Change the value from 1 into 3 and select *OK*.                         <????>
Close Registry Editor.                                                  <????>
Press Ctrl+Shift+F3 to continue.                                        <????>
Close Command Prompt.                                                   <????>

A fatal error occurred while trying to sysprep the machine.
- Click *OK*.

set "Key=HKLM\System\Setup\Status\SysprepStatus"
reg query "%Key%"
# Make sure that the "GeneralizationState" value is set to "0x7".
reg add "%Key%" /v "GeneralizationState" /t REG_DWORD /d "7" /f
reg query "%Key%"
set "Key=HKLM\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
msdtc -uninstall
msdtc -install

http://www.msfn.org/board/topic/170405-windows-81-failed-after-re-image

Start Command Prompt (Alt+F10).
Enter the following commands at a Command Prompt with administrative privileges.
```
cd c:\windows\system32\sysprep\panther
dir
type setuperr.log
```

1	If there is a volume assigned to drive C:
2	If there is a volume assigned to drive D:

1	Partition disk 0 for old computers with Legacy BIOS.
2	Partition disk 1 for old computers with Legacy BIOS.

1	Select the UEFI_NTFS volume.
2	Select the Windows-10- volume.

1	Partition disk 0 for new computers with UEFI.
2	Partition disk 1 for new computers with UEFI.

Windows 10 Installation

Home

1. Boot Media

1.1. Microsoft SHA1 checksums

1.2. Download

1.3. Bootable USB

1.3.1. MBR

1.3.2. GPT

1.4. Windows 10 PE

1.5. SMRU Reference Image

1.5.1. Bootable ISO (32-bit)

1.5.2. Bootable ISO (64-bit)

1.5.3. Bootable USB

2. Setup

2.1. Real Machine

2.1.1. Requirements

2.2. Hyper-V

2.2.1. Create Hyper-V vm

2.2.2. Configure Hyper-V vm

2.3. VirtualBox

2.3.1. Create VirtualBox vm

2.3.2. Configure VirtualBox vm

2.3.3. Prepare VirtualBox vm

2.4. VMware

2.4.1. Create VMware vm

2.4.2. Configure VMware vm

3. Installation

3.1. Official Microsoft Windows

3.2. Customized SMRU Windows

4. Activation

4.1. Microsoft Office

4.2. Windows 10 Enterprise

4.3. Windows 10 Pro

5. Configuration

5.1. Official Microsoft Windows

5.1.1. Administrator password

5.1.2. Computer name

5.1.3. Time zone

5.1.4. Applications

5.1.5. Cleanup

5.1.6. Thai language

5.1.7. Windows updates

5.1.8. File Explorer

5.1.9. Indexing Options

5.1.10. System performance

5.1.11. Programs

5.1.11.1. Install drivers, software and updates

5.1.11.2. Configuration of default applications

5.2. Customized SMRU Windows

5.2.1. Computer name

5.2.2. Computer

5.2.3. Credentials

5.2.4. Environment variables

5.2.5. Time zone

5.2.6. Quick Launch

5.2.7. SMRU domain

5.2.8. BitLocker Encryption

5.2.9. Printer Drivers

5.2.10. Inventory

5.2.11. IT Helpdesk Computers

5.2.11.1. Endian Firewall

Mozilla Firefox

5.2.11.2. Remote Desktop Connection

5.2.11.3. Delta Windows Tools

5.2.12. Verification

5.2.13. Issues