windows Archives | XOAP

How to (re)deploy your Windows OS with XOAP

Ante — Wed, 24 Jul 2024 11:41:47 +0000

<\/path><\/svg>"},"no_headings_message":"No headings were found on this page.","minimize_box":"yes","minimized_on":"tablet","hierarchical_view":"yes","min_height":{"unit":"px","size":"","sizes":[]},"min_height_tablet":{"unit":"px","size":"","sizes":[]},"min_height_mobile":{"unit":"px","size":"","sizes":[]}}" data-widget_type="table-of-contents.default">

Windows OS deployment is a critical task in IT management, involving the installation, customization and configuration of the Windows operating system on client computers within an organization. This process makes sure that all systems are standardized, secure and up-to-date with the necessary software and configurations to meet business needs.

However, for many, Windows OS deployment poses challenges – we’ll explain why. After that, we’ll show you how to solve them by combining XOAP with OSDCloud.

Why deploying Windows OS is not an easy task

Deploying Windows operating systems presents several challenges for IT administrators:

Customization complexity: Deploying an operating system across numerous client computers often requires tailoring settings and software to meet diverse user and departmental needs. This demands significant effort to ensure the deployment process accommodates various hardware configurations, applications, and user preferences.

Consistency and standardization: Ensuring that OS deployment is consistent across all client machines is crucial. Inconsistencies can arise from differences in hardware, prior configurations, and user-installed software. While maintaining a standardized environment enhances manageability, achieving this uniformity can be challenging.

Security and compliance concerns: Ensuring that all deployed systems are secure and compliant with organizational policies and regulatory requirements is a perpetual concern. This includes configuring security settings, installing necessary patches and updates, and verifying that all systems meet the required compliance standards.

Post-deployment support: Following the initial deployment, continuous support is crucial to resolve any issues that arise. This includes troubleshooting, system updates, and user assistance. Providing adequate support is essential for maintaining productivity and ensuring system health.

To address these challenges, consider combining XOAP with the OSDCloud solution.

OSDCloud facilitates the deployment of Windows 10/11 over the internet using the OSD PowerShell Module. The process involves booting into WinPE, where the OSDisk is wiped and partitioned. Afterward, the Windows Operating System is downloaded from Microsoft Update (using CuRL) and then staged (expanded) on the OSDisk. More information can be found on the OSDCloud website.

Let’s see how you can use OSDCloud easily without the hassle of installing additional modules or dependencies.

Simplified deployment with XOAP & OSDCloud

First, create a free XOAP account if you don’t have one yet. (No credit card required!)

Find the group named OSDCloud and select Edit.

In the group editing window, expand the OSDCloudImageCreation application and configure the parameters to define your OSD image.

Besides the standard PSADT parameters, you can define the following OSDCloud-related parameters:

Driver: Configures whether drivers should be installed directly from the manufacturer’s site. ➜ Select * to install all drivers, or None to not install any.
OSActivation: Select between Volume and Retail.
OSVersion: Select the desired OS version.
OSBuild: Select the build of the desired OS.
OSEdition: Select the edition of the desired OS.
OSLanguage: Select the language.
unattendFileLocation: The location of the unattended file used to configure the OS. ➜ If you do not define this parameter, a generic unattended file will be used, which will create two users, “Admin” and “User,” with the generic password “password.”
XOAPConfigurationGroup: The name of the configuration group to which the node should be registered. ➜ You can find the available configuration groups in your XOAP Workspace > Configuration Management > Groups.
XOAPWorkspaceID: The Workspace ID can be found on the main dashboard under “Account Information” or in your URL:

IMPORTANT:

For security reasons, always use your own unattend.xml file. If you use the generic one, make sure to change the passwords for the users after deployment is complete.

If you are using your own unattend file, please include the following line of code in the "" section:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\XOAP.ps1"

See a code example of the generic unattend.xml with the code line for running XOAP.ps1 file below:

The XOAP.ps1 file is used to register your client to your XOAP Workspace during OSD.

Once you have defined all parameters, click Save in the Edit Group window.

The next step is to run the role installation script on the machine where the installation ISO should be created.

To do this, go to Application Management > Roles. Find the OSDCloud role, navigate to the action menu, and download the installation script.

Copy the script to your desired machine, run PowerShell as an administrator and run the script.

This will install all prerequsites for OSDCloud and the creation of the ISO files.

After the script runs successfully, you should have two ISO files in C:\OSDCloudWorkspace:

The last step is to create a bootable USB stick that can be used to deploy your laptops. You can use the New-OSDCloudUSB function. Just run it from the local PowerShell (with Admin rights), select a USB device attached to your machine and wait for it to finish.

For advanced configurations and adjustments, you can download the OSDCloudImageCreation PSADT package from the example above and modify it with additional parameters to suit your needs. More information about this OSD function can be found on the OSDCloud website.

Consistent & standardized OS deployment

By combining XOAP and OSDCloud, you can easily prepare new machine deployments and automatically register them in XOAP for further management. This way you’ll have a consistent and standardized OS deployment without the need for any additional backend infrastructure.

By using our config.XO and application.XO modules, you can install all your standard applications and apply required system and user configurations or security settings.

For this purpose, have a look at our STIG and CIS DSC modules (also available on GitHub), which you can implement into your configurations. If you want to learn more or need additional help getting started with specific use cases, we are available for a free demo.

Start for free

The post How to (re)deploy your Windows OS with XOAP appeared first on XOAP.

Secure your Windows environment with XOAP Windows LAPS DSC

Perica — Mon, 17 Jun 2024 12:55:30 +0000

In today’s digital landscape, maintaining the security of your Windows infrastructure is paramount. One of the critical aspects of this security is managing local administrator passwords, which, if mishandled, can become a significant vulnerability.

Say hello to XOAP Windows LAPS DSC a robust solution designed to enhance your security posture by automating the management of local administrator passwords across your Windows environment.

What is XOAP Windows LAPS DSC?

XOAP Windows LAPS DSC is a powerful Desired State Configuration (DSC) module that leverages the capabilities of the Local Administrator Password Solution (LAPS) to manage and securely store local administrator passwords on domain-joined machines. By integrating with the DSC framework, XOAP Windows LAPS DSC allows for the automated deployment and configuration of LAPS policies, ensuring that local administrator passwords are unique, randomly generated and periodically updated.

Key features

1. Automated password management: XOAP Windows LAPS DSC automates the generation, storage, and updating of local administrator passwords, significantly reducing the risk of password-related breaches.

2. Centralized control: Manage and monitor password policies centrally using DSC, ensuring consistent security practices across your organization.

3. Seamless integration: Easily integrate with existing Active Directory infrastructures, making deployment straightforward and hassle-free.

4. Compliance and auditing: Meet compliance requirements with detailed auditing capabilities, ensuring password policies are enforced and tracked.

Why use XOAP Windows LAPS DSC?

Enhanced security

Local administrator accounts are often targeted by attackers looking to gain privileged access. By using XOAP Windows LAPS DSC, you make sure that each local administrator password is unique and regularly updated, drastically reducing the attack surface.

Operational efficiency

Manual password management is not only time-consuming but also prone to errors. Automating this process with XOAP Windows LAPS DSC frees up IT resources and ensures that password policies are consistently applied across all machines.

Compliance and auditing

Regulatory frameworks often require strict password management practices. XOAP Windows LAPS DSC helps organizations meet these requirements by providing detailed logs and reports on password policy enforcement and changes.

Simplified management

With DSC, administrators can define the desired state of their infrastructure using configuration files. XOAP Windows LAPS DSC extends this capability to local administrator passwords, allowing for easy deployment and management through familiar DSC tools.

Getting started with XOAP Windows LAPS DSC

Prerequisites

Windows PowerShell: Make sure you have Windows PowerShell 5.1 or later installed.

DSC: Familiarity with the Desired State Configuration is beneficial.

Active Directory:

Active Directory environment to manage domain-joined machines
- - - Update AD schema
    - Grant permissions
    - Check Domain Functional Level (DFL) prerequisites
    - Get started with Windows LAPS and Windows Server Active Directory

Entra ID (Azure AD ) environment to manage -joined machines
- - - Enable Local Administrator Password Solution (LAPS) setting
    - Windows Local Administrator Password Solution in Microsoft Entra ID

Installation

To install the XOAP Windows LAPS DSC module, you can navigate to our Github repo. As with all other DSC modules that we provide, this one is free to use in and outside of the XOAP universe.

Download the files in the releases section and extract the contents into one of your locations that are used for searching modules. The list of locations can be shown by checking the value of the “$env:PSModulePath” variable.

An example of the standard path is: $Env:programfiles/WindowsPowerShell/Modules.

When you’re extracting the files, please use the correct folder structure:

Configuration

For easier understanding how to use XOAPWinowsLAPSDSC module, below is documentation of used resources:

⭢ AzureADWindowsLAPSSettings

				
					 AzureADWindowsLAPSSettings [String] #ResourceName
	    {
	        [DependsOn = [String[]]]
	        [PsDscRunAsCredential = [PSCredential]]
	        [AdministratorAccountName = [String]]
	        [PasswordAgeDays = [Int32]]
	        [PasswordLength = [Int32]]
	        [PasswordComplexity = [Int32]]
	        [PostAuthenticationResetDelay = [Int32]]
	        [PostAuthenticationActions = [Int32]]
	    }

⭢ LocalADWindowsLAPSSettings

				
					LocalADWindowsLAPSSettings [String] #ResourceName
    {   
        [DependsOn = [String[]]]
        [PsDscRunAsCredential = [PSCredential]]
        [AdministratorAccountName = [String]]
        [PasswordAgeDays = [Int32]]
        [PasswordLength = [Int32]]
        [PasswordComplexity = [Int32]]
        [PasswordExpirationProtectionEnabled = [Boolean]]
        [ADPasswordEncryptionEnabled = [Boolean]]
        [ADPasswordEncryptionPrincipal = [String]]
        [ADEncryptedPasswordHistorySize = [Int32]]
        [ADBackupDSRMPassword = [Boolean]]
        [PostAuthenticationResetDelay = [Int32]]
        [PostAuthenticationActions = [Int32]]
    }

⭢ WindowsLAPSEmulationMode

				
					 WindowsLAPSEmulationMode [String] #ResourceName
 {
	[DependsOn = [String[]]]
	[PsDscRunAsCredential = [PSCredential]]
	[AdministratorAccountName = [String]]
	[PasswordAgeDays = [Int32]]
	[PasswordLength = [Int32]]
	[PasswordComplexity = [Int32]]
	[PasswordExpirationProtectionEnabled = [Boolean]]
	[AdministratorPasswordEnabled = [Boolean]]
 }

Example

This is an example of a configuration that uses AzureADWindowsLAPSSettings:

				
						configuration 'TestConfigAzureAD_
	{
	    Import-DscResource -ModuleName 'XOAPWindowsLAPSDSC' -ModuleVersion '0.0.2'
	    
	    AzureADWindowsLAPSSettings 'TEST'
	    {
	        AdministratorAccountName = 'TestAdmin'
	        PasswordAgeDays = '14'
	        PasswordLength = '16'
	        PasswordComplexity = '4'
	        PostAuthenticationResetDelay = '2'
	        PostAuthenticationActions = '1'
	    }
	}
	TestConfigAzureAD

Instead of writing this configuration in a code editor locally, you can also use XOAP. Using our DSC configuration wizard, you can create a LAPS configuration by using our simple-to-use frontend, create different versions of the configuration every time you save a change and prepare everything to deploy LAPS to multiple customers and groups.

To create a new LAPS config you need to follow a few steps:

1. Navigate to the Configuration Management area, go to Configurations and click the + button to create a new configuration.

2. Define general settings like Name, Description and Tags and click “Add Resources”.

3. Select the “XOAPWindowsLAPSDSC” module, Version and Resource and configure the settings.

4. Once when all resources are configured, you can save the configuration and use it in Configuration Management groups to apply the settings to your nodes.

The good thing is, you don’t need to think about DSC syntax when you use XOAP to deploy LAPS configurations. The configuration wizard will guide you and it will allow you to input only valid types for parameters. Also, versioning of configurations allows you to easily change and deploy possible future changes of your LAPS configurations.

If you need more information about the Configuration Wizard, or how to apply configurations to your environments, please check our documentation.

Your next step

In a time where cybersecurity threats are ever-evolving, taking proactive steps to secure your Windows environment is crucial. XOAP Windows LAPS DSC offers a comprehensive solution for automating local administrator password management, enhancing security and ensuring compliance.

By integrating this module into your infrastructure, you can streamline password management processes, reduce risks and focus on other critical aspects of your IT operations.

Explore more about XOAP Windows LAPS DSC on its GitHub repository and take the first step towards a more secure Windows environment!

Deploy LAPS to multiple accounts or customers

The post Secure your Windows environment with XOAP Windows LAPS DSC appeared first on XOAP.