Support Team Procedures

Support Team ProceduresProcedure Category:Managed DesktopProcedure Name:Dell Build – current modelsA.ISO Document RevisionDateRevisionLast AuthorChange History07/11/20131.0Victor MeyerInitial Draft04/02/20141.1John DerkaczAmendment18/02/20141.2John DerkaczAmendment27/02/20141.3John DerkaczAmendment03/03/20141.4John DerkaczAmendment25/03/20141.5John DerkaczAmendment28/03/20141.6John DerkaczAmended prerequisites2/04/20141.7John DerkaczAdditional amended prerequisites4/04/20141.8John Derkaczamended BIOS settings11/04/20141.9John DerkaczAmended details where to obtain the passwords from8/05/20141.10John DerkaczAmended Security settings and Boot order, and removedAdditional Laptop Steps12/05/20141.10John DerkaczAmended BIOS settings : The Miscellaneous devices in theDesktop21/05/20141.11John DerkaczAmended sound settings, and additional pre-requisites26/06/20141.12John DerkaczAdded the Requirement that the newly built PC is left on thenetwork until the Anti-Virus icon is Green, and theConfiguration Manager Properties is populated with at least10 actions07/07/20141.13Ravi MatharuLine added to Prerequisites in red on how to deal with rebuiltlaptops. Also file name has been updated.Page 1 of 10

B.Related DocumentsDocument TitleRevisionAdmin Guide to BuildsC.1.0OverviewRequired steps from an admin viewOverview and ObjectivesThis document outlines the steps required to build a new Dell machine with Windows 8 operatingsystem, using SCCM. This document applies to all the new Dell PCs that will be deployed.These Include: 9020 All-in-One Touchscreen9020 All-in-One Non Touchscreen9020 Ultra Small Form Factor PCE7440 14” Non Touchscreen LaptopE7440 14” Touchscreen LaptopE7240 12” Non Touchscreen LaptopD.Prerequisites Machine needs to be created in Active Directory, in the Organisational UnitQM.DS.QMUL.ac.uk/Computer Accounts/Physical Desktops/Managed Staff Services Laptops need to be a member of the group GG-GPO-All Managed Laptops and GG-DASAllowed Computers Computer Name and MAC address have to be registered with the DHCP server and SCCMserver. The device has been added to the [Workstation] OSD – Staff Managed Service devicecollection in SCCM. Passwords for setting the BIOS and IAMT are obtained from the Applications team If the machine has been used before, the machine accounts must be removed from SCCMand Active Directory. Then re-added after 15 minutesE.Additional Prerequisites PLEASE Remember, if you need to re-image the PC, and you have data on it, you must savethe data before starting the re-image. It will overwrite the disc. When building Laptops: Please do not build them in the Docking stations If Laptops have been protected previously using Bit-Locker, then the Computer object needsto be removed from AD and from SCCM. Check with the Applications team whether theobjects have been removed and re-introduced back into AD nor before commencing.

Support Team ProceduresProcedure Category:Managed DesktopProcedure Name:Dell Build – current modelsF.BIOS ConfigurationEnter BIOS using either F2 , or F12 , then BIOS Setup, when you see the Dell Splash ScreenPlease set the BIOS settings in the order listedBIOS SettingsLaptopsDesktopsSecure BootChange to DISABLE and click APPLYChange to DISABLE and click APPLYGeneral Advanced Boot OptionsBoot SequenceSecurity Admin Password oooGeneralBoot SequenceSystem Configuration Integrated NIC SATA Operation DrivesClick ‘OK’ and click ‘EXIT’ Laptops Tick ‘Enable Legacy OptionROMs’ and click APPLYChange to LEGACY and clickAPPLYSet the standard BIOSpassword to the one providedby Skender’s TeamClick ‘OK’ and click ‘EXIT’The PC will rebootSelect F2 key at the Dell Splash screenClick ‘UNLOCK’ and type in the new BIOS passwordBIOS Settings Tick ‘Enable Legacy OptionROMs’ and click APPLYChange to LEGACY and clickAPPLYSet the standard BIOSpassword to the one providedby Skender’s Team DesktopsUn-tick all but the SSD’ andthe ‘On-board NIC’Ensure the PC boots off theSSD firstClick APPLYTick ‘Enable UEFI NetworkStack’Ensure ‘Enable w/PXE’ isselectedClick APPLY Ensure ‘RAID On’ is selected,if not tick ‘RAID On’Click APPLY Ensure all are ticked, if not tickallClick APPLY Un-tick all but the SSD’ andthe ‘On-board NIC’Ensure the PC boots off theSSD firstClick APPLYTick ‘Enable UEFI NetworkStack’Ensure ‘Enable w/PXE’ isselectedClick APPLYEnsure ‘RAID On’ is selected,if not tick ‘RAID On’Click APPLYEnsure all are ticked, if not tickallClick APPLYPage 3 of 10

USB ConfigurationBIOS Settings Un-tick ‘Enable Boot Support’Click APPLYLaptops Desktops Audio Ensure Enable Audio is ticked Miscellaneous Devices Enable all devices Security TPM SecurityChassis intrusionPower ManagementDeep Sleep Control USB Wake Support Ensure all options are tickedClick on ActivateClick on ApplyNot an optionNot an option Ensure ‘Enable USB wakesupport’ is tickedUn-tick ‘Enable Boot Support’Click APPLYEnsure Enable Audio is tickedEnsure Internal Speaker istickedEnsure Enable Microphone,and Enable Camera are tickedEnsure Enable Media Card isChosenClick APPLYEnsure the TPM services areDeactivated Click on ApplyEnsure is it set to ‘On-Silent’ Select ‘Disabled’ Click APPLY Ensure ‘Enable USB wakesupport’ is ticked Wake on LAN/WLAN Select ‘LAN Only’Click APPLY Select ‘LAN Only’Click APPLY Wireless Radio Control Ensure ‘Control WLAN radio’,and ‘Control WWAN radio’ aretickedEnsure ‘Enable Num-lockLED’ is ticked Not an option Ensure ‘Enable Num-lockLED’ is tickedEnsure ‘Enable IntelVirtualization Technology’ isUn-ticked Ensure ‘Enable IntelVirtualization Technology’ isUn-tickedPOST Behaviour Num-lock LED Virtualization Support VirtualizationVT for Direct I/O Trusted ExecutionWireless Wireless Device Enable Ensure ‘Enable VT for Direct I/O’ is UntickedEnsure ‘Trusted Execution’ is Un-ticked Ensure ‘WWAN’,‘WLAN/WiGig’ and ‘Bluetooth’are tickedEnsure ‘Enable VT for Direct I/O’ is UntickedEnsure ‘Trusted Execution’ is Un-ticked Un-tick both ‘WLAN/WiGig’and ‘Bluetooth’ Click Apply Click EXIT Wireless Wireless Switch Ensure ‘WWAN’,’WLAN’,‘WiGig’ and ‘Bluetooth’ aretickedNot an option Exit the BIOS, it will rebootAt the Dell Splash screen, press the CTRL and P . This will enter a new menu screen, which is the IntelRemote Management screen , or iAMT.Follow the directions below to ensure correct settingsiAMT Settings Enter the Intel MEBx default password Change the default password to the one provided by Skender’s team Select Intel(R) AMT Configuration and hit ENTER

Support Team ProceduresProcedure Category:Managed DesktopProcedure Name:Dell Build – current models Select Manageability Feature Selection.oEnsure it is ENABLED to enable Intel(R) AMToPress ESC to exitSelect SOL/IDE-R/KVMoEnable all of these featuresoPress ESC to exitSelect User ConsentoSet User Opt-in to NONEoSet Opt-in Configurable from Remote IT to EnabledoPress ESC to exitEnter Activate Network Access to enable Intel AMT.oPress Y key Press ESC to exit to the Main Menu Select MEBx Exit to continue booting your system.oPress Y key to confirmThe Build ProcedureBoot the PC, and hit F12 , and choose the On Board NIC Option, when you see the DELL BIOS screenPage 5 of 10

Ensure the PC gets an IP address, if it does not get an IP address then check network connectivity, andcheck whether the MAC address and Asset Number has been registered with the DHCP serverOnce it receives its IP address, you will get the following screen, Hit F12 to begin build, within a few seconds

Support Team ProceduresProcedure Category:Managed DesktopProcedure Name:Dell Build – current modelsIf you get a similar screen to the one below then either you have missed the time to hit the F12 in time, or morelikely, the PC has not been imported into the SCCM server. Ask the Project Support team to investigate.It begins loading files, and finally it stops at the Task Sequence Wizard.Click on the Next buttonYou will be faced with a choice of images you may deployChoose the (x64) windows 8 Enterprise – Staff Image – ZTI) option, the click on the Next buttonPage 7 of 10

At this point it will begin downloading the image.Once completed, approximately 30 minutes later, you will get the grey QMUL screen,

Support Team ProceduresProcedure Category:Managed DesktopProcedure Name:Dell Build – current models Hit any key you will be prompted to loginLog inBring up a CMD boxtype in gpupdate /force, hit ENTER ,This will update the policies. When prompted “do you wish to log off” Y/N Type Y Log out, and back in,Run another GPupdate /force from a command prompt.Reboot the PC, you will see the Disclaimer Log in one more timeBring up command box,Type in gpupdate /force and hit ENTER , this will update the policies again.When prompted “do you wish to log off Y/N” Type N Type in control smscfgrc and hit ENTER You will see the following screenCheck that the Client certificate is PKI, if it is set to None, closethe Configuration Manager, then wait 5 minutes, and re-run thecommand control smscfgrc.If it is still set to None, reboot the PC, and re-run the commandcontrol smscfgrc.SCCM will not communicate with the PC until there is aClient Certificate.Page 9 of 10

Whilst in the Configuration Manager Properties screen, click on the Actions Tab.Ensure that the available actions are populated with more than 10 actions. If they are not, then leave the PC onthe network until the Actions total at least 10 actions.Failure to do so will mean that SCCM agents are not running, and that the deployed applications will not beavailable to install.Finally, check that PC protected icon is Green. If not leave on the network until it is Green.Once it has the correct Client Certificate, the Actions are fully populated, and the PC is protected Bring up a CMD box, and type in gpupdate /force and hit ENTER , this will update the policiesagain. When prompted “do you wish to log off Y/N” Type N Type in ipconfig /release and hit ENTER This will release the IP address assigned to that PCYou have finished the re-imaging of and done some basic checks, if all is correct then the PC is ready forshipmentShut Down the PC, and re-boxPlease note: do not pile laptops on top of each other, make surethey are in their protective sleeve, and in their boxes. This willprevent marking the cases.

These Include: 9020 All-in-One Touchscreen 9020 All-in-One Non Touchscreen 9020 Ultra Small Form Factor PC E7440 14” Non Touchscreen Laptop E7440 14” Touchscreen Laptop E7240 12” Non Touchscreen Laptop D. Prerequisites Machine needs to be created in Active Directory, in the Organisational Unit