Configuring new computers by hand is a time-consuming way to set up new systems. Larger organizations can use System Center Configuration Manager or the Microsoft Deployment Toolkit to install a clean load of an OS. But what if you don’t need to configure a large number of systems or you have to handle OEM operating system loads? In this article, I’ll cover how you can configure your corporate-owned devices with the Windows Imaging and Configuration Designer (WICD).

Kyle Beckman

Kyle Beckman works as a systems administrator in Atlanta, GA supporting Office 365 in higher education. He has 17+ years of systems administration experience.

In larger organizations, new desktop and laptop computers typically receive a clean operating system (OS) load using some kind of OS deployment solution, such as System Center Configuration Manager (SCCM) or the Microsoft Deployment Toolkit (MDT). This may be because IT doesn’t trust (or want to deal with) the OEM load of software or that IT wants full control of the software load. However, if you have to deal with smaller groups of computers or computers that end users can purchase using corporate funds, reloading the OS may not always be an option. In these scenarios, you can use the Windows Imaging and Configuration Designer (WICD) to configure the device.

In this article, I’ll configure some of the common settings for a corporate-owned device. If you need help with installing WICD, creating a package, and exporting the package, follow the link to our previous coverage.

Upgrading edition to Enterprise ^

One of the big new features in Windows 10 is the ability to upgrade the Windows edition without the need to reload the OS. To upgrade a Windows 10 Professional computer to Enterprise edition, go to Runtime settings, EditionUpgrade, UpgradeEditionWithProductKey and set the text field to a valid Enterprise key.Upgrading Windows 10 edition with Windows Imaging and Configuration Designer

Upgrading Windows 10 edition with Windows Imaging and Configuration Designer

After a reboot, the Pro system will be converted to Enterprise. Just be aware the process can take several minutes to complete. When the process begins, you’ll get a window that says “Preparing for upgrade” that includes a status percentage. Mine sat at 100% for quite a while, but your mileage may vary depending on the hardware you’re using.

Preparing for upgrade message while Windows 10 Pro converts to Enterprise
Preparing for upgrade message while Windows 10 Pro converts to Enterprise

Adding the computer to Active Directory ^

To add a computer to Active Directory, go to Runtime settings, Accounts, Computer Account. Set the following settings:

  • Account A user account in AD that can add the computer to Active Directory. I’ve had the most success using username@full.dns.name as opposed to domain\username.
  • Password – The password of that account.
  • DomainName – The full DNS name of your Active Directory domain.
  • ComputerName – The name of the computer when it is added to AD. You can use the variables %SERIAL% (to set the computer name to the serial number) or %RAND:x% (where “x” is a number 15 or less that sets the computer name to a random name). You can also use an asterisk (*) to set the computer name to a random 8-digit name.
  • AccountOU – The full LDAP path to the OU where the computer will be stored in Active Directory. If you leave this field blank, the computer will be stored in Computers. The format you should use is: OU=SubOU,OU=TopOU,DC=subdomain,DC=domain,DC=extension. As an example: OU=workstations,OU=test,DC=corp,DC=contoso,DC=com

Settings for adding a computer to Active Directory with Windows Imaging and Configuration Designer
Settings for adding a computer to Active Directory with Windows Imaging and Configuration Designer

Adding a local Admin account ^

If you disable the built-in Administrator account and create a custom local Admin, you can create the local account using WICD. Go to Runtime settings, Accounts, Users. Type the name of the account and click Add. Go to the new UserName section that is created, enter the password of the account, and set the UserGroup to Administrators.

Adding a local account with Windows Imaging and Configuration Designer
Adding a local account with Windows Imaging and Configuration Designer

Additional configuration ^

WICD is also capable of adding Wi-Fi networks, certificates, and many of the policies that are available in Group Policy. We covered these settings in our BYOD article, but most of them also apply to corporate-owned devices.

If you’re using WICD for provisioning your corporate-owned devices, we’d love to hear how it is going for you in the com­ments!

Win the monthly 4sysops member prize for IT pros

Share
0

Articles in series

Windows Imaging and Configuration Designer

19 Comments
  1. Jan 2 years ago

    Hello,

    is it possible to keep the current computer name for the domain join?
    Bye
    Jan

    0

    • Author
      Kyle Beckman 2 years ago

      It doesn't appear to be possible looking at the documentation. But, I agree that it would be useful to have an "I know what I'm doing keep the existing name" option. If I had to guess the reason that isn't an option, it would be name collision in AD. Bad things start to happen to happen when you join a second device to AD with the same name as another device.

      0

  2. Phil 2 years ago

    Agreed that would be the reason. That said, I will not use it for my .Gov Deployments because of this reason. I can not create a ppkg that updates to ENT, Changes the name to the ASSET and then adds to the domain. I also can not add applications like office 2016.
    It's a fun tool but no where near ready or mature enough for real deployments. Those two items MUST be available to really one touch deploy.

    0

    • Author
      Kyle Beckman 2 years ago

      I completely agree. I work in HigherEd and even my colleagues are skeptical. Most Enterprises (and governmental agencies and universities) aren't buying consumer grade systems with lower versions of Windows. We're buying Enterprise-grade systems that will be re-imaged when they're powered on for the first time. I think that this tool solves a problem that isn't there for most people. It is cool to play with, but not something most large agencies are going to be interested in right now.

      0

  3. Nick 2 years ago

    hello there - have you discovered a way to have the configuration enable the built in default local administrator account (named simply, administrator?). the method you mention here for creating a different local administrator account works, but I'd really like to use this tool and have it enable 'administrator' and set the password for that. hoping you may know of a way to accomplish this 🙂

     

    thanks!

    0

    • Author
      Kyle Beckman 2 years ago

      Honestly, my experience with WICD has been limited lab use. If you're working with more than 10-20 systems, you're much better off implementing MDT and re-imaging the computers when they come in so you can have fine control over how they're configured. WICD doesn't allow for as granular control as performing a full deployment yourself.

      0

      • Nick 2 years ago

        I've been using WICD as a temporary solution to deploy windows 10, while we iron out our deployment of ibm bigfix for larger scale / further customized imaging (kind of a nightmare, I prefer MDT ...). It's not the end of the world if I can't enable the built in local administrator account, but I've also implemented MS's local admin password solution which doesn't have the logic to target and randomize passwords on more than one local admin account name. It looks like I may just have to go back and make them uniform later.

        0

        • Author
          Kyle Beckman 2 years ago

          It sounds like in this case that you're using Active Directory... you can use Group Policy to enable the local Administrator account. But you're correct, LAPS can't manage two local Administrator accounts... it can only manage the built-in Administrator account or a custom one. If you're using a uniform name, you can use Group Policy Preferences to delete the account that was created by WICD.

          0

  4. Matt Larkin 3 months ago

    We have used WICD to successfully provision a machine from out of box to having the SCCM Client installed.

    The entire process which includes: Create Local Admin, Rename PC, Join to Domain, and install SCCM Client and configures it takes around 4-5 mins.

     

    0

  5. erik 2 months ago

    Hi Matt,

    How did go about renaming PC? I need a prefix and last 7 digits but havn't been able to achive that with WICD.

    0

  6. erik 2 months ago

    Thanks, I'll give it a try. Couldn't see from the docs that this was doable.

    0

  7. Matt Larkin 2 months ago

    There is a lot the docs don’t tell you .

    I had to engineer a lot of it by trial and error .

    0

  8. erik 2 months ago

    Worked like a charm. Do you happen to know in which format computername in WICD can be customized more? I have a requirement to have only 12 characters, that is prefix with 5 and last seven char from serialnumber. I've tried several combinations but can't see to accomplish that.

    0

  9. Matt Larkin 2 months ago

    Awesome.

    Glad to hear it worked.

    In order to rename a machine,

    the max character limit is 15 chars, so your requirement should work.

    For you, I would think the computer name would be:

    The first part would be your prefix - the last part would be the serial .

    PREFI-%SERIAL%

    0

  10. erik 2 months ago

    Thanks Matt. Yes, PREFI-%SERIAL% works, but it takes the rest of the serial and adds it so in total it's 15 character. My requirement is to have only 12 characters in total, so no matter what prefix I use it will still leave me with 15 character in total (takes the rest of the serial and adds it). In OSD (ConfigMgr) I can use regex or VBscript to achieve what I need.

    0

  11. Matt Larkin 2 months ago

    Hey Erik,

    We had a similar issue with naming our Microsoft Surfaces.

    We usually name our devices DL (Dell Laptop) - Serial Number .

    For the Microsoft Surfaces, we tried to name the devices MS (Microsoft Surface) - Serial Number.

    That proved to be unsuccessful due to the Surfaces have very long serial numbers.

    We eventually went with MS%Serial% , so we could fit everything in.

    You may just have to be creative with the naming.

     

    0

  12. Matt Larkin 2 months ago

    Hey Erik,

    We had a similar issue with naming our Microsoft Surfaces.

    We usually name our devices DL (Dell Laptop) - Serial Number .

    For the Microsoft Surfaces, we tried to name the devices MS (Microsoft Surface) - Serial Number.

    That proved to be unsuccessful due to the Surfaces have very long serial numbers.

    We eventually went with MS%Serial% , so we could fit everything in.

    You may just have to be creative with the naming.

     

    0

  13. Erik 2 months ago

    Thanks Matt, will try to figure something out.

    0

Leave a reply

Your email address will not be published. Required fields are marked *

*

CONTACT US

Please ask IT administration questions in the forum. Any other messages are welcome.

Sending
© 4sysops 2006 - 2017

Log in with your credentials

or    

Forgot your details?

Create Account