Part I – Deploy Windows 8.1

Part I – Building a Windows 8.1 Image
Part I of our Deploy Windows 8.1 series consists of building a W8.1 image on a computer. It doesn’t matter what the device is. For this example, we will be using a Microsoft Surface but it can be anything such as a Dell Venue 11 or any number of tablets. The imaging tool that you use can also be any one of your choosing. Microsoft’s imaging tool is called ImageX. This article is not a detailed step-by-step instruction on how to use ImageX to build an image for deployment. There are plenty of other sites out on the blogosphere that can walk you through that process. This article explains the issues and concerns found during the process of activating the first Windows 8.1 system on a corporate network.

Installing Windows 8.1 on a Microsoft Surface
I downloaded a valid version of Windows 8.1 and started a fresh installation on a Windows Surface. The installation was smooth, it took a very long time but I didn’t run into any major issues with the actually installation of the operating system itself. That is until it came down to connecting the Surface to the network. As you may or may not know, the Surface does not come with a network interface card (NIC). Therefore, the only choice is to connect to a wireless network. No problem, right? Well, maybe it isn’t as straight forward as I originally thought it would be. For the love of God, I could not get this Surface to connect to my corporate wireless network. Prior to loading Windows 8.1, this computer had Windows 8 loaded and it connected just fine to the wireless network. Of course, in order to get the Windows 8 Surface to connect to the corporate wireless network, I had to download and install the Intel Proset Wireless drivers so that the wireless NIC could recognize the Leap/WPA/TKIP security in place.

I did install the latest Intel Proset Wireless drivers on my Windows 8.1 Surface and it did allow me to choose a Cisco Leap but it did not give me an option to select WPA (only WPA2) nor set the encryption to TKIP. This was the first major issue I ran into. Luckily there is a way around this. I documented this process in another blog post named, WPA and TKIP missing after upgrade to Windows 8.1. Once I was able to connect to the corporate wireless network, I was able to join the domain and we were off and running.

Of course, if I wanted to, I could have connected a USB NIC and connected to the wired network but that would have only been a temporary solution. I still needed to figure out how to get W8.1 connected to a Cisco wireless network running Leap secured with WPA/TKIP.

Join the Corporate Domain
I joined the Surface to the corporate domain and then let SCCM 2012 do its thing. System Center Configuration Manager 2012 is a Microsoft application that manages large numbers of computers (devices). You can use it to push software installations, Microsoft Windows updates, perform software and hardware inventories, deploy operating systems, perform remote management of devices and push System Center Endpoint Protection which is Microsoft’s antimalware/virus protection software application. It is an all-encompassing suite of components all bundled together providing a robust solution for any mid to large enterprise.

I waited for the Surface to have all its software installed but I noticed that the Endpoint Protection agent had not installed. Why? On my Surface, I opened File Explorer and navigated to the SCCM agent logs located at C:\Windows\CCM\Logs\ and opened the EndpointProtectionAgent.log. It was there that I noticed the following errors:

0x8004ff71 – Failed to install EPclient
this was followed by
0x8004100e – Failed to retrieve definition version from WMI

After performing some research, I found that there are some prerequisites I need to take care of before we are ready to partake in a Windows 8.1 deployment. This was the second major issue I ran into. Before SCCM 2010 SP1 could successfully deploy Endpoint Protection, I needed to apply the latest Cumulative Update 3 (CU3). I know we weren’t at the latest CU so what level were we? To find out the SCCM version I turned to the registry on the SCCM server:

HKLM\Software\Microsoft\SMS\Setup\CULevel

The value in the CULevel key will tell you what version you are at. In this case, the value was set at ‘2’.

Download the SCCM CU3 from Microsoft. It’s actually a Hotfix, go figure. Use the following Technet article to install the CU3 update to the existing SCCM 2012 SP1 environment.

Once the SCCM 2012 environment is updated and the new SCCM agent is pushed to the Windows 8.1 device, the Endpoint Protection agent should install successfully.

Other References
Microsoft Plan for Windows 8.1
Russ Rimmerman – Technet (great post on how SCCM work with SCEP)

———–> Part II – Using KMS to  activate Windows 8.1 clients