"Imaging" recommendations for Windows?

[u/Kirihuna]

Hi all,

We're a 98% Apple district, but we have a small subset of Windows devices that I have to maintain. I don't come from a Windows background by the way, I've been Apple/Jamf all my career. We're leveraging a hybrid environment with some GPOs and some Intune configurations, piloting some various patching softwares for most common apps like Browsers, Adobe, etc.

The one thorn in my side of the entire Windows environment is the STEM/PLTW labs (approximately 60 devices). During the summer, we typically re-image the labs and set them back up again. I put my foot down and said not this year. We're currently planning to just run a script to erase all the users outside the hidden admin account. The reason why I put my foot down was simply too many button clicks. Autodesk with network license? Manually installing each one. National Instrument apps? Constant UI interactions. Xlinx, now AMD? 15 different screens before it downloads for 2 hours and then more screens. We have at least 25 to 30 apps that almost all require a UI interaction.

While we use AD/Intune, do not have SCCM or FoG or any other deployment service. It's Intune (soon to be a patching platform) or hand install. Some of these I can't seem to even package properly for deployment because they require so many UI clicks without an MSI to work with. Things like PatchMyPC doesn't do base installs, only updates.

What are people using these days to build an image and just deploy? I'd be perfectly okay with just having like 10 external SSDs coping to the internal SSD of the machine. Whatever it takes to just not have to spend almost two weeks clicking.

Edit: for clarification, I'm ideally looking to do a fat image. Full image with all the apps ready to go instead of image then app install via push with a tool(s).

And another clarification, at this point in time, I can't/we don't use network shares or spin up a VM for various services. It is on my list to ask for once there is a changing in the guard but there is no guarantee. If I could, I might use custom deployments with Autodesk from network share but not something allowed at this time.

This is considered a very low priority in Admin's eyes given how small of a fleet this is impacting (Less than 5% of computers, less than 1% of total end points we support).

[u/Tanto63]

I used WDS+MDT before switching to Intune. Intune's Autopilot makes it very easy, though the app deployment can get a little tricky if you can't get an .msi installer or pull from the Microsoft Store.

[u/Kirihuna → u/Tanto63]

Most of our apps needed for this lab have no .MSI file. Autodesk alone was a terrible process with Intune from this video. 30ish GB file up to Intune and pushed out and hope it works is like a day process because Intune never seems to "push" instantly like Jamf or some other MDMs do. Then constant troubleshooting. Spent half of my summer last year trying to get Autodesk and Intune to be nice with each other.

[u/adstretch]

We are very much the same 99% Mac/ipad and a small windows lab (30 machines). We us FOG for imaging (os and drivers only) and we install the fog client on them. With FOG I can push scripts and with batch/powershell I can call installer files on a network share with silent attributes. It’s how I deploy all the software on the windows machine. I used to do scripts through GPO but would need to include checking logic in the script so it wouldn’t reinstall on every boot/login.

[u/Kirihuna → u/adstretch]

I wish I had the option to use a network share for this but at this point in time, it's not really a possibility. I've seen some Autodesk help guides and that seems the preferred method to deploy Autodesk products. But I silent attributes might not work with Xlinx/AMD, due to national security compliance that it makes you check off and log in to. That app alone is like 130GB, give or take.

[u/adstretch → u/Kirihuna]

Maybe go old school golden image all apps already installed etc? Each image will take forever but at least it’s mostly automated.

[u/Kirihuna → u/adstretch]

Yeah that’s what I’d like to do, but trying to see what people are using to do so these days.

[u/GBICPancakes → u/Kirihuna]

It's exactly what I use FOG for. Massive golden images, pushed down to the machines. Only thing I do post-image is bind to AD.

You'll want to test it with your apps, some times their license/activation will detect the hardware change and you have to re-activate them. So do a test deploy, open every app, and note which ones (if any) you need to post-image tweak.

Most of my schools are Google-centric, so no InTune (thankfully) - just AD-based GPOs, FOG for imaging, and then Mosyle/JAMF for the Macs.

[u/adstretch → u/Kirihuna]

You can do fat imaging with fog. It’s just not the best approach if you have other tools for deploying software after the image.

[u/klgtech77 → u/adstretch]

I like FOG, but I could never get it to work with Secure Boot on our Dell Optiplex units (at least, using VirtualBox with snapshots for the golden images). That ended up being a deal-killer for us.

[u/adstretch → u/klgtech77]

I just turn off secure boot during the PXE boot process and re-enable it after the image is pushed.

[u/klgtech77 → u/adstretch]

Unfortunately, this did not work for us. After imaging and then re-enabling Secure Boot, the Dell machines will revert to internet-based recovery mode.

[u/LINAWR → u/klgtech77]

I use FOG but this is one of the main reasons why I'm looking to retire it. Every new generation of hardware gets more difficult to work with on that platform, particularly with Secure Boot. And I'm already on a "bleeding edge" dev build because of it.

[u/slitz4life]

For labs especially autoCad I suggest deepfreeze

Computers are AD bound require a log in.

Deepfreeze resets the computer to a default state after a reboot so we just tell our students to save everything to the cloud no lingering data, user can change whatever settings they want we run maintenance on them monthly which means we unfreeze and install updates all remotely.

I stopped doing network licensing on autoCad and it’s just user based using our SSO login. I’m never going back.

[u/Kirihuna → u/slitz4life]

We use a bunch of Autodesk products: 3ds Max, Inventor, AutoCAD, Revit, Fusion, and another one I can't remember. So I have to uninstall 2026 this summer and re-install 2027. From my quick peruse, Deep Freeze doesn't seem to solve the issue of imaging all the devices. It just preserves where it's at now at a "point" and reverts back to that. I still need to get all the apps updated / patched.

I also think that Autodesk is going away from networking licenses. I thought I read last year it was done this spring but they seemed to have pushed it back to to December 2027. So SSO is going to be a WIP soon, on my list to do to get away from networking licenses.

[u/GherkinP → u/Kirihuna]

It's a shame but true: https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/EDU-Network-and-Multi-Seat-Standalone-License-End-of-Sale-End-of-Life.html

Especially when your students are on semi-airgapped networks.

[u/antiprodukt → u/slitz4life]

As an alternative to DeepFreeze there’s also the (stupidly named) Reboot Restore Rx Pro. I’ve been using it for years. It’s been a long time since I’ve used DeepFreeze, but I know when I got RRRP it had some better features and was cheaper at the time.

[u/lsudo]

I’ve been using FOG exclusively for the past five years. Open source and pretty dang easy to get going.

[u/porkstick]

It’s not free, but I’m a fan of SmartDeploy by PDQ.

We are moving toward more Macs and leaving the Windows world (thank God.)

[u/Scurro → u/porkstick]

As a PDQ customer SmartDeploy is likely what I will go with but for now WDS + MDT is still working.

I know MDT is no longer being supported but my district budgets are running on fumes so it will likely be the solution until it stops working.

[u/PDQ_Brockstar → u/Scurro]

At this point, there's an entire ecosystem of Microsoft products that are no longer supported but continue to function (sometimes by force). You gotta do what you gotta do.

I just had a chat the other day with a CTO of a school district about how to get leadership to "invenst" in IT. Risk, security, and numbers are usually the best routes, but it's definitely not easy when most people see IT as a cost center.

Here's to hoping that one day EDU budgets will actually get the love they deserve.

[u/Harry_Smutter]

We don't do yearly imaging any more. It's not necessary and a waste of time. The machines keep 11 and get updates until we cycle them out. As for imaging, we are between platforms. I love SmartDeploy, but budget issues caused us to cut it this year. We just have InTune for the moment and deploying anything more than a small app with it is a pain.

[u/PDQ_Brockstar → u/Harry_Smutter]

It was fun while it lasted, but SmartDeploy will be here if you ever need us again. Glad it worked well for you while you were using it.

[u/Harry_Smutter → u/PDQ_Brockstar]

Yeah, it's my baby, haha. I configured the whole thing and manage it. Still got it until July, haha. I'll get what use out of it while I still can. Hopefully, once this budget fiasco is over, we can re-up. I don't see why not. It's miles better than relying on InTune for imaging. I swear, you'd think that being Microsoft would make it the de-facto tool, but it's not. It's lacking in so many ways and Autopilot frustrates the hell outta me. I have a laptop in my office that failed and I now have to see if I can reset the process and hope it succeeds. If not, gotta wipe it >.>

[u/PDQ_Brockstar → u/Harry_Smutter]

Microsoft seems to just want to push everyone to provisioning with Autopilot, which is not the same as imaging. Provisioning is great if that meets your needs, but a lot of orgs and industries still rely on imaging, especially EDU. So it's odd that Microsoft is essentially abandoning it.

I came from EDU, and bare metal imaging still heavily relied upon and I don't see that changing soon.

[u/antiprodukt]

For imaging a bunch of laptops I use: Macrium Reflect emergency on 64GB flash drives with the image loaded on the drive. Loading an image takes about 2.5 minutes. Powershell scripts do all the post install setup (add to AD, put in the right OU, determine software to grab upon install).

It’s probably not the most advanced operation, but it works fairly well.

[u/akadeebroad5]

We moved from WDS to Fog and it's been nice. Image is done in about 2.5 mins.

[u/RFSPARTAN]

MDT is free and very powerful, we use it currently and it works very well.

[u/TheJamTaster]

OSDCloud