Perica, Author at XOAP

XOAPChangeBIOSsettingDSC: Master the BIOS management

Perica — Fri, 30 Jan 2026 09:09:46 +0000

Managing BIOS settings across a diverse fleet of devices has historically been a headache for IT administrators. Different vendors, different tools, and varying security requirements often lead to fragmented workflows.

To streamline this process, we are excited to share a new PowerShell DSC (Desired State Configuration) module: XOAPChangeBIOSsettingDSC. This module provides a unified way to manage BIOS configurations on both Dell and Lenovo devices using infrastructure-as-code principles.

Key features

Multi-vendor support: Works seamlessly across Dell and Lenovo hardware.
Security minded: Fully tested to work with or without BIOS passwords.
Granular control: Allows for precise setting definitions (e.g., Secure Boot, Wake-on-LAN, etc.).

Important usage notes

To ensure successful deployment, keep these two technical details in mind:

Case sensitivity: The module is case-sensitive regarding setting names. For example, you must use SecureBoot exactly as defined by the vendor; using secureboot will result in an error.
Discovery: If you are unsure of the exact naming or possible values for a setting, you can refer to the scripts within the TestScript portion of the DSC Resources. These can be used to read all available values directly from the hardware.

Why DSC for BIOS?

By using DSC, you ensure that your hardware configuration remains in the “Desired State”. If a user or an update manually changes a BIOS setting, DSC will automatically detect the drift and pull the setting back to your defined corporate standard.

Installation and usage

There are no special prerequisites for this module.

To install the module in XOAP:

Upload the zipped DSC module to Configuration Management → Modules.
Once uploaded, the module can be referenced and used in your DSC configuration as needed.

Get the XOAPChangeBIOSsettingDSC module

Simplify BIOS management across your devices. Get free access to the module now and replace manual, error-prone processes with a unified approach.

Download the free module

The post XOAPChangeBIOSsettingDSC: Master the BIOS management appeared first on XOAP.

Migrate to Windows 11 with PSADT

Perica — Fri, 25 Apr 2025 11:11:25 +0000

In our previous blog posts, we explored different approaches to migrating to Windows 11: using SCCM, through XOAP, via GPOs and registry keys and Windows Update in Settings . In this post, we’ll walk you through yet another method – deploying the Windows 11 upgrade package using our PowerShell App Deployment Toolkit (download it here for free).

Watch:
Introduction to PSADT
Install and configure PSADT
Create PSADT packages

Use PSADT to migrate from Windows 10 to Windows 11

To get started, extract the contents of your Windows 11 ISO file and include them in your PSADT package. Then, you’ll use the setup.exe file from the extracted ISO along with specific command-line parameters to upgrade from Windows 10 to Windows 11.

Once you’ve got your source file ready, it’s time to modify the “Deploy-Application.ps1” script. In the pre-installation part, it will check if a scheduled task exists and delete it (in case of failures/reruns).

				
					#### (Pre-Install) Delete Scheduled Task -------------------------------------------->
$DELTaskName = 'Win11Upgrade'
# Check if the task exists
$DELTaskExists = Get-ScheduledTask -TaskName $DELTaskName -ErrorAction SilentlyContinue
if ($DELTaskExists) {
    # Delete the task
    Unregister-ScheduledTask -TaskName $DELTaskName -Confirm:$false
    Write-Output "(Pre-Install) Task '$DELTaskName' has been deleted."
} else {
    Write-Output "(Pre-Install) Task '$DELTaskName' does not exist.  Moving on to Installation"
}

In the installation part, a scheduled task will be created and started. While loop is used to check if the task is still running after it was started.

				
					 ###># CREATE SCHEDULED TASK -------------------------------------------------------->
    $STExecutable = "$dirfiles\ISO\Setup.exe"
    $STArguments = "/Auto Upgrade /EULA accept /NoReboot"
    $STTaskName = "Win11Upgrade"
    $STTriggerTime = (Get-Date).AddSeconds(15)
    $STPriority = 4
    $STTrigger = New-ScheduledTaskTrigger -Once -At $STTriggerTime
    $STSettings = New-ScheduledTaskSettingsSet -StartWhenAvailable -Priority $STPriority -RunOnlyIfNetworkAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
    # Create a new scheduled task action
    $STAction = New-ScheduledTaskAction -Execute $STExecutable -Argument $STArguments -WorkingDirectory (Split-Path $STExecutable)
    # Create a new scheduled task principal for the SYSTEM account
    $STPrincipal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    # Create and register the new scheduled task
    $STTask = New-ScheduledTask -Action $STAction -Trigger $STTrigger -Settings $STSettings -Principal $STPrincipal
    Register-ScheduledTask -TaskName $STTaskName -InputObject $STTask

    #### KICK OFF SCHEDULED TASK ------------------------------------------------------>
    Start-Sleep 10
    Start-ScheduledTask -TaskName "Win11Upgrade"
    #### MONITOR SCHEDULED TASK ------------------------------------------------------->
    $STTaskName = "Win11Upgrade"
    # Loop until the task is no longer running
    while ((Get-ScheduledTask -TaskName $STTaskName).State -eq "Running")
    {
        # Get task information
        $taskInfo = Get-ScheduledTaskInfo -TaskName $STTaskName
        # Verify if the task is being run by SYSTEM
        if ((Get-ScheduledTask -TaskName $STTaskName).Principal.UserId -eq "SYSTEM")
        {
            # Write to the output
            Write-Output "$STTaskName is still running as SYSTEM"
        }
        else
        {
            Write-Output "$STTaskName is still running, but not as SYSTEM"
        }
        # Wait for 10 seconds before checking again
        Start-Sleep -Seconds 10
    }
    Write-Output "$STTaskName has finished running"

In the post-installation part, created scheduled task is deleted.

				
					#### (Post-Install) Delete Scheduled Task -------------------------------------------->
    $DELTaskName = "Win11Upgrade"
    # Check if the task exists
    $DELTaskExists = Get-ScheduledTask -TaskName $DELTaskName -ErrorAction SilentlyContinue
    if ($DELTaskExists) {
        # Delete the task
        Unregister-ScheduledTask -TaskName $DELTaskName -Confirm:$false
        Write-Output "(Post-Install) Task '$DELTaskName' has been deleted."
    } else {
        Write-Output "(Post-Install) Task '$DELTaskName' does not exist."
    }

There are a couple of options to consider if you want to expand on this package:

Add Windows 11 prerequisites check
Expand it with PSADT functions like:
– Show-InstallationWelcome
– Show-InstallationProgress
– Show-InstallationRestartPrompt
Adjust available scheduled task options:
– RunOnlyIfNetworkAvailable
– AllowStartIfOnBatteries
– DontStopIfGoingOnBatteries
Add other parameters to setup.exe run (for example “/Product Server” as a workaround for the prerequisites check)

You're good to go!

Upgrading to Windows 11 with PSADT is a flexible option if you want more control over the process. With a few script tweaks, you can handle the upgrade from start to finish.

You may also like:
→Windows 11 migration via SCCM
→Step-by-step: Windows 11 migration using GPOs and registry keys
→Windows 11 migration made easy with XOAP
→How to migrate to Windows 11 via Windows Update in Settings

The post Migrate to Windows 11 with PSADT appeared first on XOAP.

Windows 11 migration made easy with XOAP

Perica — Wed, 23 Apr 2025 12:27:04 +0000

This quick guide shows how to upgrade Windows 10 devices to Windows 11 using XOAP. The example uses Lenovo T490s and walks through setting up driver and application groups, then deploying them through XOAP. You can apply the same approach to your own device type. If you need assistance, contact us here. Let’s get started!

Upgrade to Windows 11 with XOAP: Simple steps

In this example, we are going to configure the migration for Lenovo T490s devices.

Inside XOAP’s Application Management, we have created 2 Application Groups from our Applications:

Lenovo T490s (installs Windows 11 drivers for Lenovo T490s)
Migration to Windows 11 24H2 (installs Windows 11 24H2 as an in-place upgrade)

To create an application group for driver installation, you need to:

- Download the corresponding driver package for your device from a manufacturer’s web page (for our example: Lenovo PC Support – ThinkPad T490s).
- Extract and package those drivers using PSADT. For the installation part, you can use the following command inside PSADT: pnputil /add-driver $dirFiles\tp_t490s_x390_w11_22_202210\*.inf /install /subdirs
- Import the created PSADT Package in XOAP: Application Management > Applications > New Application.

After that, you can navigate to Application Groups and create an Application Group using the imported application. Application Management > Application Groups > New Group.

WATCH VIDEO
2-minute overview of the migration processTutorial continues below

This video may not load due to your cookie preferences. Adjust your cookie settings or watch it directly on YouTube.

In the New group window, set the name for the application group and search for your imported application. Once you find the correct application, go to Add Group and choose your installation settings for that package.

When creating an Application group from Windows 11 24H2 Application, there area a couple of options to choose from:

- AllowStartIfOnBatteries
- DontStopIfGoingOnBatteries
- RunOnlyIfNetworkAvailable
- SkipPrereqCheck (skips all prerequisite checks for Windows 11)

After that, we create an Application Role from those 2 Application Groups.

After the Application Role is created, we have to create a Configuration Group, inside of XOAP’s Configuration Management, by choosing our Application Role and XOAP_Applications_and_Monitoring configuration.

Then, download the registration script and deploy it to clients. Once the configuration is started on clients, both of our packages (Drivers and Win11) are going to prompt for user confirmation before installing and for a restart after installation.

All set!

That wraps it up. Once everything’s in place, XOAP takes care of the upgrade. Just adjust the steps for your own devices and you’re good to go.

You may also like:

→Complete Windows 11 migration guide for enterprise IT
→How to migrate to Windows 11 via Windows Update in Settings
→Windows 11 migration via SCCM
→Step-by-step: Windows 11 migration using GPOs and registry keys

Migrate to Windows 11 with XOAP

The post Windows 11 migration made easy with XOAP appeared first on XOAP.

Step-by-step: Windows 11 migration using GPOs and registry keys

Perica — Wed, 16 Apr 2025 11:55:10 +0000

<\/path><\/svg>"},"no_headings_message":"No headings were found on this page.","minimize_box":"yes","minimized_on":"tablet","hierarchical_view":"yes","min_height":{"unit":"px","size":"","sizes":[]},"min_height_tablet":{"unit":"px","size":"","sizes":[]},"min_height_mobile":{"unit":"px","size":"","sizes":[]}}" data-widget_type="table-of-contents.default">

If you’re planning to upgrade your devices to Windows 11, there are several ways to go about it. In our previous blog post, we showed how to use the Windows Update settings to start the upgrade.

In this post, we’ll focus on using Group Policy Objects (GPOs) and registry keys to manage the migration. Even if you’re using Windows Update to deploy updates, you can still control how and when Windows 11 is offered to eligible devices.

By setting the right policies, you can make sure the upgrade process fits your organization’s needs.

Guide: Windows 11 migration using GPOs/registry keys

If you are deploying updates using Windows Update, there is still a possibillity to control their delivery using different GPOs. And if you set/change proper policy, Windows 11 will be deployed on your devices if they are eligible to upgrade.

How to specify target Feature Update version in Windows 10

A new TargetReleaseVersion policy available in Windows 10 version 1803 and higher allows you to specify which feature update version of Windows 10/11 you would like your computer to move to and/or stay on until the version reaches the end of service or you reconfigure this policy.

If you don’t update this policy before the device reaches end of service, the device will automatically be updated once it is 60 days past end of service for its version.

If you specify a TargetReleaseVersion the same as the current version, Windows 10 will stay on this version until it reaches the end of service. This can also be useful to block an automatic upgrade to Windows 11.

If you specify a TargetReleaseVersion higher than the current version, Windows 10/11 will directly update only to the specified version, even if a higher version is available.

Specify target Feature Update version in Local Group Policy Editor

Open the Local Group Policy Editor.
Navigate to the location below in the left pane of Local Group Policy Editor (see screenshot below);
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update.

In the right pane of Windows Update for Business in Local Group Policy Editor, double click/tap on the Select the target Feature Update version policy to edit it (see screenshot above).
Select (dot) Enabled (see screenshot below).
Perform the following steps under Options:
Type which Windows product version would you like to receive feature updates for? E.g, Windows 10: Windows 11.
Type the version (e.g, “21H1”) you want to specify in the Target Version for Feature Updates: 24H2.
Click/tap on OK.

If you want to set the same options via registry keys, use the following key and values:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
“ProductVersion”=”Windows 11”
“TargetReleaseVersion”=dword:00000001
“TargetReleaseVersionInfo”=”24H2”

You can see a list of Windows 10 versions to use as a value in the Windows 11 release information table.

And you're done!

That’s it, your Windows 11 migration using GPOs and registry keys is complete. With these steps in place, your devices should upgrade smoothly and stay on track. Keep testing, keep things backed up and you’ll be good to go.

You may also like:
→How to migrate to Windows 11 via Windows Update in Settings
→Windows 11 migration via SCCM
→Windows 11 migration made easy with XOAP

The post Step-by-step: Windows 11 migration using GPOs and registry keys appeared first on XOAP.

How to migrate to Windows 11 via Windows Update in Settings

Perica — Tue, 15 Apr 2025 09:20:50 +0000

Upgrading to Windows 11 is easier than you might think. If your device is eligible, you can start the process right from the Windows Update section in Settings. Follow this quick guide to check availability and begin your upgrade with just a few clicks.

Windows 11 migration via Windows Update in Settings

If upgrading from Windows 10 to Windows 11, Microsoft recommends waiting until Windows Update notifies that the upgrade is ready for the device. To check if Windows 11 is ready for a device using Windows Update, follow these steps:

Right-click on the Start menu and then select Settings > Update & Security > Windows Update.
In the Windows Update window that opens, select the Check for updates button.
Note: If there are updates available for the current version of Windows, the Windows 11 upgrade might not be made available until those updates are installed. Install any updates for the current version of Windows, restart the device, and then try checking for the Windows 11 upgrade again.
If Windows 11 is ready to be installed on the device, a message is displayed in the Windows Update window showing that Windows 11 is ready. Select the Download and Install button to start the Windows 11 upgrade.
In the Software License Terms window that opens, select the Accept and install button.
The Windows Update window refreshes, and the Status shows the progress of the Windows 11 upgrade downloading and installing.
Once the installation portion of the Windows 11 upgrade is done in Windows 10:
The Windows Update window refreshes and changes to Restart required. The Status: also updates to Pending restart.
A Windows Update notification is displayed in the notification area with the message Restart to install the newest Windows feature update.
To continue the Windows 11 upgrade, restart the device by selecting the Restart now button in the Windows Update window or Restart now in the Windows Update notification.
The device restarts and the Windows 11 upgrade process continues. The device restarts automatically a few more times to finish installing Windows 11.
The Windows sign-on screen is displayed once the Windows 11 upgrade is done. Sign in to the device to complete the upgrade.

If Windows 11 isn’t shown in Windows Update

If a message isn’t displayed in the Windows Update window that Windows 11 is ready, it could be for one of the following reasons:

The device meets the hardware requirements for Windows 11, but the Windows 11 upgrade isn’t ready to install yet.
The device meets the hardware requirements for Windows 11, but there might be a known compatibility issue with the device and Windows 11. The Windows 11 upgrade will eventually be offered if the compatibility issue is resolved. For more information, see the notification “What needs your attention” displayed during a Windows upgrade.
The device doesn’t meet the hardware requirements for Windows 11.

That's it!

And that’s all it takes to migrate to Windows 11 via Windows Update! The process is simple, and you’ll be up and running with the new OS in no time.

You may also like:
→Windows 11 migration via SCCM
→Step-by-step: Windows 11 migration using GPOs and registry keys
→Windows 11 migration made easy with XOAP

The post How to migrate to Windows 11 via Windows Update in Settings appeared first on XOAP.

Tutorial: Windows 11 migration via SCCM

Perica — Mon, 14 Apr 2025 11:07:51 +0000

Thinking about moving your organization to Windows 11? With SCCM (System Center Configuration Manager), there are two ways to get it done: Windows servicing and Task sequence. In this tutorial, we’ll walk you through both methods so you can choose the best fit for your environment.

Windows servicing

Configuration Manager requires only minimal configuration before deploying feature updates to computers. If you’ve previously deployed feature updates, most prerequisites are likely already in place. However, for new SCCM setups, some initial configuration may be necessary.

Prerequisites for the Windows 11 23H2 upgrade using SCCM

Configure Software Update Point by enabling the upgrades for Windows 10 and Windows 11.
Ensure the service connection point is online before you sync the updates.
Enable dynamic updates for feature updates in Configuration Manager Client Settings.
The product category “Windows 11” must be enabled under Software Update Point > Products.

First, you need to download the Windows 11 23H2 enablement package update using SCCM.It is recommended first to downloadthe enablement package, then distributing the content to distribution points, and finally deploying it.

Steps to get Windows 11, Version 23H2 update in SCCM

In the SCCM console, go to Software Library > Windows Servicing > All Windows Feature Updates. Then, in the search box, type “23H2” and click Search. This will filter the updates and display only 23H2 updates. Right-click on Windows 11, version 23H2 x64 2023-10B and select Download.

On the Deployment Package window, you must specify the deployment package for Windows 11 23H2 upgrade files. This deployment package that you create will contain the software update files that will be deployed to the clients.

Select “Create a new deployment package” and specify the package name as “Windows 11 23H2 Deployment Package.” Specify the package source, which is a shared folder where you want to download the updates. Enabling the binary differential replication is optional. Click Next.

On the Distribution Points page, click on the Add button and choose the distribution point servers to which you would like to distribute the Windows 11 23H2 upgrade files. Click Next.

Then, on the Distribution Settings page, configure the general distribution settings for the deployment package. Click Next.

Select an option to specify from where you want to download the updates. In the example below, we have selected the option Download software updates from the internet. Click Next.

On the Summary window, review the settings for the deployment package and click Next. Now, on the Progress tab, we see the Windows 11 23H2 Enablement Package updates being downloaded.

Steps to deploy Windows 11 23H2 feature update using SCCM

In the ConfigMgr console, navigate to Software Library\Overview\Windows Servicing\All Windows Feature Updates. Right-click Windows 11, version 23H2 x64 2023-10B update, and select Deploy.

On the General page, enter the details for the Windows 11 23H2 feature update deployment.

- Deployment name: Enter the deployment name, for example, Windows 11 23H2 upgrade.
- Description: Add a brief description about the deployment.
- Software Update Group: This is created automatically and is visible under Software Update Groups in the Configuration Manager console.
- Collection: Click Browse and select a device collection consisting of a few pilot devices selected for testing the Windows 11 2023 upgrade. After that, click Next to continue.

Accept the license terms for the Windows 11 23H2 update. Click Next.

On the Deployment Settings page, specify the type of deployment. Choose whether you want to make the Windows 11 23H2 upgrade available for users in the Software Center or deploy it as required.

The Scheduling page lets you configure schedule details for the deployment. If you want to make the Windows 11 23H2 upgrade available at a specific date and time, select Specific Time and define it. Define the deadline for installation to ensure the upgrade happens within the defined period. Click next to continue.

Specify the following user experience settings for the 23H2 update deployment:

- User notifications: Display in Software Center and show all notifications
- Commit changes at the deadline or during a maintenance window (requires restarts): Yes
- If any update in this deployment requires a system restart, run updates deployment evaluation cycle after restart: No.

Click Next.

On the Download Settings tab, specify the download settings for the current deployment:

- Client Computers can use distribution points from neighbor boundary: Yes
- Download and install software updates from the fallback content source location: Yes

Click Next to continue.

Review the deployment settings of Windows 11 23H2 on the Summary page and click Next. On the completion window, click Close.

Test the upgrade installation

After you have deployed the Windows 11 23H2 enablement package update using Windows Servicing, it’s time to test the upgrade installation on Windows computers. The end-user experience is similar to other feature upgrades.

On the client’s computer, launch the Software Center. Once the Software Center has been opened, select Windows 11, version 23H2 x64 2023-10B update by clicking the Updates tab. Click on the Install button.

Confirm that you want to upgrade this computer’s operating system. Note that this is an in-place upgrade to version 23H2, and the setup automatically migrates your apps, data, and settings. Click on the Install button to begin the Windows 11 23H2 upgrade.

Restart, and now the computer reboots. After it has rebooted, the operating system version is Windows 11 23H2.

Task sequence

To do an in-place upgrade of Windows 10 to Windows 11 via SCCM Task sequence, you must import the Windows 11 upgrade package into SCCM.

Steps to add or import Windows 11 upgrade package into SCCM

Launch the SCCM console.
Navigate to Software Library > Operating Systems > Operating System Upgrade Packages.
Right-click Operating System Upgrade Packages and click Add Operating System Upgrade Package.

On the Data Source page, click Browse and specify the folder path that contains the Windows 11 setup files. This is the folder that contains the extracted Windows 11 ISO file.

Select the option: By checking this box, you agree that when applying this operating system to the device, the applicable Windows license was purchased through volume licensing. Or that you are authorized to bind your company and agree to the Microsoft license terms on its behalf.

Check the box – extract a specific image index from install.wim file of the selected upgrade package. Select the image index appropriately and click Next.

On the General window, specify the upgrade package name as Windows 11 upgrade. You may add more details in the comment box and click Next. Click Next on the Summary window.
On the Completion window, click Close. We have successfully imported the Windows 11 upgrade package in SCCM.

Create task sequence

To create a Windows 11 In-place upgrade SCCM Task Sequence, do the following:

• Launch the Configuration Manager console.
• Go to Software Library\Overview\Operating Systems\Task Sequences.
• Right-click Task Sequences and select Create Task Sequence.

On the Create a new task sequence page, select Upgrade an operating system from an upgrade package. Click Next.

On the Task Sequence Information page, specify the task sequence name, such as in-place upgrade of Windows 10 to Windows 11 or something meaningful. Add an optional description. Click Next.

On the Upgrade Windows operating system page, select an upgrade package, click Browse and select Windows 11 upgrade package. The edition index is automatically populated. Click Next.

On the next page, select Do not install any software updates. Click Next. If you have any applications that you need to install along with this upgrade, you can define them on the Install Applications page. Otherwise, click Next.

Review the settings on the Summary page and click Next.

Finally, on the Completion page, click Close. This completes the steps for creating a Windows 11 in-place upgrade task sequence.

Deploy task sequence

After the task sequence is created, you need to distribute the content to your distribution points and deploy the task sequence to the desired SCCM Collection:

In the ConfigMgr console, go to Software Library\Overview\Operating Systems\Task Sequences.
Right-click Windows 11 upgrade task sequence and click Distribute Content to distribute content to distribution points.
Right-click Windows 11 upgrade task sequence and click Deploy to deploy the task sequence to the desired SCCM collection.

Once the task sequence is deployed and becomes available on the client, it will pop up in the client Software Center under Operating Systems.

The user will be asked to confirm if they want to upgrade the operating system on this computer. Select Install.

The task sequence progresses now and the Windows 11 upgrade files will be downloaded to the computer. The task sequence displays the Windows 11 upgrade progress percentage.

When the in-place task sequence is running, you can monitor the deployment by reviewing the smsts.log file. During the Windows 11 upgrade, the smsts.log file is located in C:\Windows\CCM\Logs\SMSTSLog folder on the client machine. The task sequence restarts the computer to complete the upgrade.

Of course, there is a possibility to adjust the task sequence to do a couple of extra steps.

For example, in the task sequence below.

Before upgrading to Windows 11:

Extra checks are performed before upgrade
InstallLanguage registry key is corrected if needed
BitLocker is suspended

After Windows 11 upgrade:

CU is installed (needed if you have an extra language pack injected in your wim file)
Inbox/Store Apps are installed with the proper language
Unwanted Inbox/Store Apps are removed
Outlook New is removed and blocked
IPU Successfull flag is written to registry

Need help?

Whether you go with Windows servicing for a simpler in-place upgrade or a Task sequence for more control and customization, SCCM makes it easy either way.

Questions? We’re just a message away!

You may also like:
→How to migrate to Windows 11 via Windows Update in Settings
→Step-by-step: Windows 11 migration using GPOs and registry keys
→Windows 11 migration made easy with XOAP

The post Tutorial: Windows 11 migration via SCCM appeared first on XOAP.

Secure your Windows environment with XOAP Windows LAPS DSC

Perica — Mon, 17 Jun 2024 12:55:30 +0000

In today’s digital landscape, maintaining the security of your Windows infrastructure is paramount. One of the critical aspects of this security is managing local administrator passwords, which, if mishandled, can become a significant vulnerability.

Say hello to XOAP Windows LAPS DSC a robust solution designed to enhance your security posture by automating the management of local administrator passwords across your Windows environment.

What is XOAP Windows LAPS DSC?

XOAP Windows LAPS DSC is a powerful Desired State Configuration (DSC) module that leverages the capabilities of the Local Administrator Password Solution (LAPS) to manage and securely store local administrator passwords on domain-joined machines. By integrating with the DSC framework, XOAP Windows LAPS DSC allows for the automated deployment and configuration of LAPS policies, ensuring that local administrator passwords are unique, randomly generated and periodically updated.

Key features

1. Automated password management: XOAP Windows LAPS DSC automates the generation, storage, and updating of local administrator passwords, significantly reducing the risk of password-related breaches.

2. Centralized control: Manage and monitor password policies centrally using DSC, ensuring consistent security practices across your organization.

3. Seamless integration: Easily integrate with existing Active Directory infrastructures, making deployment straightforward and hassle-free.

4. Compliance and auditing: Meet compliance requirements with detailed auditing capabilities, ensuring password policies are enforced and tracked.

Why use XOAP Windows LAPS DSC?

Enhanced security

Local administrator accounts are often targeted by attackers looking to gain privileged access. By using XOAP Windows LAPS DSC, you make sure that each local administrator password is unique and regularly updated, drastically reducing the attack surface.

Operational efficiency

Manual password management is not only time-consuming but also prone to errors. Automating this process with XOAP Windows LAPS DSC frees up IT resources and ensures that password policies are consistently applied across all machines.

Compliance and auditing

Regulatory frameworks often require strict password management practices. XOAP Windows LAPS DSC helps organizations meet these requirements by providing detailed logs and reports on password policy enforcement and changes.

Simplified management

With DSC, administrators can define the desired state of their infrastructure using configuration files. XOAP Windows LAPS DSC extends this capability to local administrator passwords, allowing for easy deployment and management through familiar DSC tools.

Getting started with XOAP Windows LAPS DSC

Prerequisites

Windows PowerShell: Make sure you have Windows PowerShell 5.1 or later installed.

DSC: Familiarity with the Desired State Configuration is beneficial.

Active Directory:

Active Directory environment to manage domain-joined machines
- - - Update AD schema
    - Grant permissions
    - Check Domain Functional Level (DFL) prerequisites
    - Get started with Windows LAPS and Windows Server Active Directory

Entra ID (Azure AD ) environment to manage -joined machines
- - - Enable Local Administrator Password Solution (LAPS) setting
    - Windows Local Administrator Password Solution in Microsoft Entra ID

Installation

To install the XOAP Windows LAPS DSC module, you can navigate to our Github repo. As with all other DSC modules that we provide, this one is free to use in and outside of the XOAP universe.

Download the files in the releases section and extract the contents into one of your locations that are used for searching modules. The list of locations can be shown by checking the value of the “$env:PSModulePath” variable.

An example of the standard path is: $Env:programfiles/WindowsPowerShell/Modules.

When you’re extracting the files, please use the correct folder structure:

Configuration

For easier understanding how to use XOAPWinowsLAPSDSC module, below is documentation of used resources:

⭢ AzureADWindowsLAPSSettings

				
					 AzureADWindowsLAPSSettings [String] #ResourceName
	    {
	        [DependsOn = [String[]]]
	        [PsDscRunAsCredential = [PSCredential]]
	        [AdministratorAccountName = [String]]
	        [PasswordAgeDays = [Int32]]
	        [PasswordLength = [Int32]]
	        [PasswordComplexity = [Int32]]
	        [PostAuthenticationResetDelay = [Int32]]
	        [PostAuthenticationActions = [Int32]]
	    }

⭢ LocalADWindowsLAPSSettings

				
					LocalADWindowsLAPSSettings [String] #ResourceName
    {   
        [DependsOn = [String[]]]
        [PsDscRunAsCredential = [PSCredential]]
        [AdministratorAccountName = [String]]
        [PasswordAgeDays = [Int32]]
        [PasswordLength = [Int32]]
        [PasswordComplexity = [Int32]]
        [PasswordExpirationProtectionEnabled = [Boolean]]
        [ADPasswordEncryptionEnabled = [Boolean]]
        [ADPasswordEncryptionPrincipal = [String]]
        [ADEncryptedPasswordHistorySize = [Int32]]
        [ADBackupDSRMPassword = [Boolean]]
        [PostAuthenticationResetDelay = [Int32]]
        [PostAuthenticationActions = [Int32]]
    }

⭢ WindowsLAPSEmulationMode

				
					 WindowsLAPSEmulationMode [String] #ResourceName
 {
	[DependsOn = [String[]]]
	[PsDscRunAsCredential = [PSCredential]]
	[AdministratorAccountName = [String]]
	[PasswordAgeDays = [Int32]]
	[PasswordLength = [Int32]]
	[PasswordComplexity = [Int32]]
	[PasswordExpirationProtectionEnabled = [Boolean]]
	[AdministratorPasswordEnabled = [Boolean]]
 }

Example

This is an example of a configuration that uses AzureADWindowsLAPSSettings:

				
						configuration 'TestConfigAzureAD_
	{
	    Import-DscResource -ModuleName 'XOAPWindowsLAPSDSC' -ModuleVersion '0.0.2'
	    
	    AzureADWindowsLAPSSettings 'TEST'
	    {
	        AdministratorAccountName = 'TestAdmin'
	        PasswordAgeDays = '14'
	        PasswordLength = '16'
	        PasswordComplexity = '4'
	        PostAuthenticationResetDelay = '2'
	        PostAuthenticationActions = '1'
	    }
	}
	TestConfigAzureAD

Instead of writing this configuration in a code editor locally, you can also use XOAP. Using our DSC configuration wizard, you can create a LAPS configuration by using our simple-to-use frontend, create different versions of the configuration every time you save a change and prepare everything to deploy LAPS to multiple customers and groups.

To create a new LAPS config you need to follow a few steps:

1. Navigate to the Configuration Management area, go to Configurations and click the + button to create a new configuration.

2. Define general settings like Name, Description and Tags and click “Add Resources”.

3. Select the “XOAPWindowsLAPSDSC” module, Version and Resource and configure the settings.

4. Once when all resources are configured, you can save the configuration and use it in Configuration Management groups to apply the settings to your nodes.

The good thing is, you don’t need to think about DSC syntax when you use XOAP to deploy LAPS configurations. The configuration wizard will guide you and it will allow you to input only valid types for parameters. Also, versioning of configurations allows you to easily change and deploy possible future changes of your LAPS configurations.

If you need more information about the Configuration Wizard, or how to apply configurations to your environments, please check our documentation.

Your next step

In a time where cybersecurity threats are ever-evolving, taking proactive steps to secure your Windows environment is crucial. XOAP Windows LAPS DSC offers a comprehensive solution for automating local administrator password management, enhancing security and ensuring compliance.

By integrating this module into your infrastructure, you can streamline password management processes, reduce risks and focus on other critical aspects of your IT operations.

Explore more about XOAP Windows LAPS DSC on its GitHub repository and take the first step towards a more secure Windows environment!

Deploy LAPS to multiple accounts or customers

The post Secure your Windows environment with XOAP Windows LAPS DSC appeared first on XOAP.

Offline Domain Join using XOAP and Azure Blob storage

Perica — Thu, 29 Feb 2024 12:27:02 +0000

Our module allows you to Domain Join a device that doesn’t have access to the Domain Controller (through the company network or via VPN). It’s an alternative to using Azure Hybrid Join.

While Azure Hybrid Join adds a device to Azure AD (Entra) and local AD, this option allows joining a device to local AD only. Meanwhile, Hybrid Join is limited regarding naming convention and only allows the defining of the prefix.

With this solution, it’s possible to define a prefix and to use a serial number of computers for the computer name.

Who is this for?

You can benefit from using this module whether you’re a XOAP user or not. Here’s how:

a) If you’re a XOAP user, simply set up Windows clients for use of Offline Domain Join via Azure Blob Storage using this module and XOAP console.

b) If you’re not a XOAP user, use this module in your own DSC environment, or use PowerShell scripts inside this module to create their own automation alternative for Offline Domain Join.

Want to experience everything XOAP has to offer? Create your free account here!

What does this module do?

To explain further, this module will rename the computer using the serial number and defined prefix. Afterwards, it’ll make an Offline Domain Join of the device via Azure Blob storage; if wanted.

The computer creates a request and posts it on a defined location on Azure Blob. Then, the Domain Controller will take that request and post a response on Azure Blob. This response file is then read by a computer – and the computer makes Offline Domain Join. Furthermore, the certificate will be imported from Azure Blob.

What do I need to know before I start?

To understand how to use it, knowledge of PowerShell, Active Directory and Azure Storage is needed along with these 3 components:

Server-side: modify Domain Controller to allow for Offline Domain Join
Azure Blob Storage: storage to host files needed for Offline Domain Join
XOAPOfflineDomainJoinViaBlobDSC: to set up Windows client to create request and fetch the answer for Offline Domain Join

List of prerequisites:

AzureAZ PowerShell Module (if not installed ‘Az.Accounts’ and ‘Az.Storage’ submodules are going to be installed while running this DSC module);
ComputerManagementDsc in version 8.5.0;
Azure Blob storage;
Local Active Directory;
PowerShell script that reads the request from Azure Blob Storage and sets response file and machine certificate to Azure Blob storage (example below).

				
					$WarningPreference = "SilentlyContinue" 
$Domain = "test.local.com" 
$OU = "OU=Notebooks,OU=Koeln,DC=test,DC=local,DC=com" 
 
$Tenant_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
$Subscription_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
$ResUsername = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
$SAccountname = 'xoapdeployments' 
$ContainerName = "adjoin" 
 
$FExt = ".blb" 
$BlobFolder ="adblob" 
$RequestFolder = "request" 
$JoinName ="" 
 
Set-Location C:\Scripts 
 
#SecPass.exe generetes password for Azure access 
$SecPassStr = cmd /c .\SecPass.exe $args 2`>`&1    
$cred = New-Object System.Management.Automation.Pscredential($ResUsername, (ConvertTo-SecureString -String $SecPassStr)) 
 
$ARMA = Add-AzureRmAccount -ServicePrincipal -Credential $cred -TenantId $Tenant_ID -Subscription $Subscription_ID 
$ARMA 
 
$storageContainer = Get-AzureRmStorageAccount | where {$_.StorageAccountName -eq $SAccountname} | Get-AzureStorageContainer 
 
$ComputerFiles = $storageContainer | Get-AzureStorageBlob | where {$_.Name.Contains($RequestFolder) -and !($_.Name.Contains("flag.flg"))}  | Select-Object "Name" ,"LastModified" 
 
# $ComputerFiles 
 
if($ComputerFiles) { 
    foreach($Computerfile in $ComputerFiles) { 
        $JoinName = $ComputerFile.Name.Replace("/","\") 
        # $JoinName 
        $storageContainer | Remove-AzureStorageBlob -Container $ContainerName -Blob ($JoinName) -Force 
        $JoinName = $JoinName.SubString(8) 
        $ADblobfile = $Computername + ".blob" -f $computer 
        $BlobName = ".\" + $JoinName + $FExt 
        # $BlobName 
        $run = "djoin.exe /provision /domain {0} /MachineOU {1} /machine {2} /savefile {3} /reuse /rootcacerts" -f $Domain, $OU, $JoinName, $BlobName 
        # $run 
        Invoke-Expression $run 
        $StorageBlob = $BlobFolder + "\" + $JoinName + $FExt 
        # $Storage 
        $storageContainer | Set-AzureStorageBlobContent –File $BlobName -Blob $StorageBlob -Properties @{"ContentType" = "text/plain"} 
        $storageContainer | Remove-AzureStorageBlob -Blob ($RequestFolder + "\" + $JoinName) -Force 
        Remove-Item -Path $BlobName 
    } 
} 
Remove-AzureRmAccount -Username $ResUsername

Available resources and syntax

				
					OfflineDomainJoinViaBlob [String] #ResourceName 
{ 
    [DependsOn = [String[]]] 
    [PsDscRunAsCredential = [PSCredential]] 
    Tenant_ID = [String] 
    Subscription_ID = [String] 
    Username = [String] 
    Password = [String] 
    SAccountname = [String] 
    ContainerName = [String] 
    RequestFolder = [String] 
    BlobFolder = [String] 
    CertFolder = [String] 
    [TimeoutInMinutes = [Int32]] 
    [RenameComputerUsingSerial = [Boolean]] 
    [ComputerNamePrefix = [String]] 
    [RebootAfterDomainJoin = [Boolean]] 
}

Saccountname = Storage Account Name

Ready to get started? Download this module below!

Download Offline Domain Join

The post Offline Domain Join using XOAP and Azure Blob storage appeared first on XOAP.

Perica, Author at XOAP

XOAPChangeBIOSsettingDSC: Master the BIOS management

Key features

Important usage notes

Why DSC for BIOS?

Installation and usage

Get the XOAPChangeBIOSsettingDSC module

Download the free module

Migrate to Windows 11 with PSADT

Use PSADT to migrate from Windows 10 to Windows 11

You're good to go!

Windows 11 migration made easy with XOAP

Upgrade to Windows 11 with XOAP: Simple steps

All set!

Migrate to Windows 11 with XOAP

Step-by-step: Windows 11 migration using GPOs and registry keys

Table of contents

Guide: Windows 11 migration using GPOs/registry keys

How to specify target Feature Update version in Windows 10

Specify target Feature Update version in Local Group Policy Editor

And you're done!

How to migrate to Windows 11 via Windows Update in Settings

Table of contents

Windows 11 migration via Windows Update in Settings

If Windows 11 isn’t shown in Windows Update

That's it!

Tutorial: Windows 11 migration via SCCM

Table of contents

Windows servicing

Prerequisites for the Windows 11 23H2 upgrade using SCCM

Steps to get Windows 11, Version 23H2 update in SCCM

Steps to deploy Windows 11 23H2 feature update using SCCM

Test the upgrade installation

Task sequence

Steps to add or import Windows 11 upgrade package into SCCM

Create task sequence

Deploy task sequence

Need help?

Secure your Windows environment with XOAP Windows LAPS DSC

Table of contents

What is XOAP Windows LAPS DSC?

Key features

Why use XOAP Windows LAPS DSC?

Enhanced security

Operational efficiency

Compliance and auditing

Simplified management

Getting started with XOAP Windows LAPS DSC

Prerequisites

Installation

Configuration

⭢ AzureADWindowsLAPSSettings

⭢ LocalADWindowsLAPSSettings

⭢ WindowsLAPSEmulationMode

Example

Your next step

Deploy LAPS to multiple accounts or customers

Offline Domain Join using XOAP and Azure Blob storage

Who is this for?

What does this module do?

What do I need to know before I start?

List of prerequisites:

Available resources and syntax

Download Offline Domain Join