Creating the ZIP file containing Office source

• Create a folder named "C:\O365" on the computer where you installed Windows ICD
• Extract the Office Deployment Tool inside "C:\O365" folder.
• Edit the "Configuration.xml" file using Notepad. I put an example below.

<Configuration>
  <Add SourcePath="" OfficeClientEdition="32" Branch="Current">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
  </Add>
  <!--  <Updates Enabled="TRUE" Branch="Current" /> -->
  <Display Level="None" AcceptEULA="TRUE" />
  <Logging Level="Standard" Path="C:\Windows\Debug" />
  <!--  <Property Name="AUTOACTIVATE" Value="1" />  -->
</Configuration>

• Open a Command Prompt and run the following command to download Office source.

  C:\O365\setup.exe /download configuration.xml

  • That will download Office source inside "C:\O365" folder
• ZIP the "C:\O365" folder into a file called "O365.zip"

Create the PowerShell script to install silently Office

• Copy the sample code below and save it into a file called "Start-ProvisioningCommands.ps1"

<#
.Synopsis
 Office 2016 installation sample script
.DESCRIPTION
 Extract the ZIP and run the Office setup.exe with the configuration file as a parameter
#>
[CmdletBinding()]
[Alias()]
[OutputType([int])]

Param
(
 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $Log = "$env:windir\debug\Start-ProvisioningCommands.log"
)

Begin
{
 <#
 # Start logging
 #>
 Start-Transcript -Path $Log -Force -ErrorAction SilentlyContinue

<#
 # Extract the ZIP
 #> 
 $Archives = Get-ChildItem -Path $PSScriptRoot -Filter *.zip | Select-Object -Property FullName
 ForEach-Object -InputObject $Archives -Process { Expand-Archive -Path $_.FullName -DestinationPath "$env:TEMP" -Force }
}

Process
{
 <#
 # Office 2016 installation
 #> 
 $WorkingDirectory = "$env:TEMP\O365"
 $Configuration = Get-ChildItem -Path $WorkingDirectory -Filter *.xml | Select-Object -Property FullName
 [XML]$XML = Get-Content -Path $Configuration.FullName
 $XML.Configuration.Add.SourcePath = $WorkingDirectory
 $XML.Save($Configuration.FullName)

 # Run Office 2016 setup.exe
 Start-Process -FilePath "$WorkingDirectory\Setup.exe" -ArgumentList ('/Configure "{0}"' -f $Configuration.FullName) -WorkingDirectory $WorkingDirectory -Wait -WindowStyle Hidden

 # If you want to remove the extracted Office source, uncomment below
 # Remove-Item -Path $WorkingDirectory -Force
}
End
{
 <#
 # Stop logging
 #> 
 Stop-Transcript -ErrorAction SilentlyContinue
}

Create the Provisioning Package using Windows ICD

• Open Windows ICD and navigate to [Runtime Settings]>[ProvisioningCommands]>[DeviceContext]
  • Under [CommandFiles] add "O365.zip" and "Start-ProvisioningCommands.ps1" files
  • Under [CommandLine], type the following command which will install silently Office:

    PowerShell.exe –ExecutionPolicy Unrestricted .\Start-ProvisioningCommands.ps1

• Register device in the Corporate infra
  • Domain Join --> OK
    • [Runtime Settings]>[Accounts]>[Computer Account]
      • [Account] domain\account (i.e. contoso\admin)
      • [DomainName] domain FQDN (i.e. contoso.com)
      • [Password] domain join account password
  • Azure AD Join --> NO (it's related to the authentication method of enrollment offered by PPKG which is not compatible with Azure AD Join as well as Intune)
  • Intune enrollment --> NO (same as above)
  • SCCM On-prem MDM enrollment --> OK (not tested personally but found a great article explaining how to do it)
• Profiles
  • WIFI --> OK
    • [Runtime Settings]>[ConnectivityProfiles]>[WLAN]>[WLANSetting]
      • Add the [SSID] of the WiFi
      • Under [WLANXmlSettings], fill [AutoConnect], [HiddenNetwork], [SecurityKey] and [Security Type]
  • Certificates --> OK
    • For Root CA Certificate, [Runtime Settings]>[Certificates>[RootCertificates]
      • Type a [CertificateName] and click [Add]
      • [CertificatePath] path to the CER root CA certificate file
  • Email profile --> since in a BYOD scenario you don't know the domain or azure AD account, I don't think it's something possible with provisioning
• OS Customization
  • Start Menu --> OK (note: it doesn't apply to the current user but to any new users on the computer)
  • Wallpaper --> NO (copy the image file but doesn't apply it, don't know yet if it's an expected behavior. will update you later again on that)
  • Local Account creation --> OK
    • [Runtime Settings]>[Accounts]>[Users]
    • Type a [User Name] and click [Add]
    • [Password: password of the newly created account
    • [UserGroup] add the user to "Administrators" group for instance
  • UWF --> OK
    • [Runtime Settings]>[UnifiedWriteFilter]
    • [FilterEnabled] TRUE
    • [OverlaySize] in MB (i.e. 1024)
    • [OverlayType] select RAM or Disk
    • [Volumes]
      • Type the [DriveLetter] to filter (i.e. "C:") and click [Add]
      • [Protected] TRUE
  • Bitlocker --> NO (yes using manage-bde command within a script)
  • Edition upgrade --> OK (only from Pro/Edu to Enterprise)
    • [Runtime Settings]>[EditionUpgrade]
    • [UpgradeEditionWithProductKey] type the Enterprise product key
• Universal Applications
  • Install --> OK (don't forget to enable sideloading, deploy the certificate, dependencies as well as the app file)
    • To enable sideloading, [Runtime Settings]>[Policies]>[ApplicationManagement]>[AllowAllTrustedApps]>[Yes]
    • To deploy certificate, [Runtime Settings]>[Certificates]>[TrustedPeopleCertificates]
      • Type [CertificateName] and click [Add]
      • [TrustedCertificate] specify the path to the app certificate file
    • To import app with dependencies, [Runtime Settings]>[UniversalAppInstall]
      • Type [PackageFamilyName] and click [Add] (can be any name)
      • [ApplicationFile] specify the ".appxbundle" file
      • [DependencyAppxFiles] add one by one all the dependencies files
  • Uninstall --> OK
    • [Runtime Settings]>[UniversalAppUninstall]
    • On a computer where the app to uninstall is installed, run the PowerShell command get-appxpackage to find the package family name.
    • Type the [PackageFamilyName] found using the above command.
• Win32 applications installation
  • MSI --> OK
    • [Runtime Settings]>[ProvisioningCommands]>[DeviceContext]
    • [CommandFiles] add the MSI file
    • [CommandLine] type the command line to install the MSI package: "msiexec.exe /i xxx.msi /q"
  • Office --> OK (I will write another article to explain how to do that using WICD).

1. Windows Hello stability (should solve the Windows Hello camera getting stuck issue)
2. Fan tuning
3. Wake up from sleep issues
4. WiFi performance on SP4
5. Surface Dock display improvements (new firmware).

1. From [Admin] > [Mobile Device Management] > [Device Group Mapping]
2. Click on "Add" to create a new category
   1. We create a "Sales" category and link it to the "Sales Devices" group
   2. We create a "HR" category and link it to the "HR Devices" group
3. Done!

Reason

Workaround

For already deployed computers

For computers not yet deployed

• Connect to Microsoft Intune management portal
• From "Policy", create a new "Custom Configuration" policy for Windows 10.

• Create a new OMA-URI setting. You will find details on the CSP policy reference page.
  • OMA-URI: ./User/Vendor/MSFT/Policy/Config/ApplicationManagement/RequirePrivateStoreOnly
  • Value: 1

• Then validate the policy.

• And deploy that policy to a user collection. Here is the end result after you refresh MDM policy on a Windows 10 computer: public store's tabs has disappear but business store is still there :)

1. Download and install from Microsoft Update
2. Download the MSI version of the drivers/firmware update and deploy it either manually or by another management tool (like SCCM)

Microsoft Update Catalog

• Product: Windows 10 and later drivers; Windows 10 and later upgrade & servicing drivers (you can select either one)
• Classification: Drivers

WSUS

Additional notes for Android: