SOE PORTAL and CloudDeploy Release Notes

Security

Multifactor authentication (MFA) registration is now being enforced in the SOE Portal.  Whereas before you may have been able to skip MFA registration and were reminded at each login, you will now be unable to access your tenant until you have completed it.

SOE Portal File Manager (SPFM) will now also prompt you for the MFA one-time passcode from your authenticator app.

Windows 11 25H2

Version 25H2 editions of Windows 11 are now available.  These include:

• Windows 11 Enterprise Version 25H2
• Windows 11 Pro Version 25H2
• Windows 11 Education Version 25H2

In addition, the security baselines for Windows 11 25H2 have been added to the common application library.

End of Support for Windows Versions

Keep in mind that Windows versions have a limited life, after which they become unsupported by Microsoft.  The following Windows versions are now (or soon will be) out of support:

• Windows 11 22H2 Enterprise (Oct 14, 2025)
• Windows 11 22H2 Education (Oct 14, 2025)
• Windows 11 23H2 Pro (Nov 11, 2025)
• Windows 10 (Oct 14, 2025)

If you are after some advice or assistance with upgrading from Windows 10 to Windows 11, or upgrading Windows 11 to a recent feature upgrade, we have experienced consultants who can assist.

SOE Portal Windows 10 Support

The SOE Portal will continue to allow Windows 10 SOE images to be configured and built.  This is to cater for LTSC editions and to support customers who have purchased Extended Security Updates (ESU) from Microsoft to extend the life of their Windows 10 installation.  Windows 10 SOE images may not contain all the latest ESU-enabled Windows updates – these may need to be installed post-deployment.

Certification of hardware for Windows 10 will still be performed on request, but this may become limited by lack of published Windows 10 drivers.

Common apps also continue to be maintained for Windows 10, but this may also be affected as vendors drop app support for Windows 10.

Common Apps

The SOE Portal common apps library is continually maintained.  Below are some of the newly added apps:

• Citrix Workspace LTSR 25
• Citrix Workspace LTSR 25 (Single Sign-On)
• Hardening - Windows 11 25H2 Security Baseline - Local Install Domain Joined
• Hardening - Windows 11 25H2 Security Baseline - Local Install Non Domain Joined
• CitrixDell Display and Peripheral Manager

Windows 11 Enterprise LTSC

The 2024 LTSC version Windows 11 Enterprise is now available. In the SOE Portal image configuration wizard, look for the OS Edition Windows 11 Enterprise LTSC x64. The LTSC edition has a lifecycle of 5 years. For more information about the LTSC edition, check out the article What's new in Windows 11 Enterprise LTSC 2024.

Windows 11 24H2

Version 24H2 editions of Windows 11 are now available.  These include:

• Windows 11 Enterprise Version 24H2
• Windows 11 Pro Version 24H2
• Windows 11 Education Version 24H2

In addition, en-AU language features have been updated and the security baselines for Windows 11 24H2 have been added to the common application library.

Windows 10 End of Support – 14 October 2025

Microsoft have announced that support for Windows 10 will end on 14th October 2025.  This means that free security updates will no longer be available, although the Extended Security Updates (ESU) program will be able to be purchased if required.  Refer to End of support for Windows 10 and Extended Security Updates (ESU) program for Windows 10 for additional information.

If you are after some advice or assistance with upgrading from Windows 10 to Windows 11, the SOE Portal team has experienced consultants who can assist.

Retirement of Oracle Java

Oracle Java is no longer available as an SOE Portal common app. If it was selected in any of your image configurations, it will no longer be installed when your SOE image is next built.

New Java Apps

There are multiple Java (JRE, JDK) distributions available from different vendors. They are all based on the OpenJDK open-source code.  The following are now available as SOE Portal common apps:

• Amazon Corretto OpenJDK 21
• Microsoft OpenJDK 21

Enablement of MFA

Due to popular demand, we will be rolling out MFA starting from Friday 26 May 2023.  After this date, at your next sign in you will be redirected to our MFA registration page. Although you can cancel the registration, you will be reminded at each login and, of course, we strongly recommend you register ASAP using your favourite authentication app.   Once registered, on subsequent sign-ins you will be prompted to enter a one-time password code from your authentication app.

Windows 11 22H2

Version 22H2 editions of Windows 11 are now available.  These include:

• Windows 11 Enterprise Version 22H2
• Windows 11 Professional Version 22H2
• Windows 11 Education Version 22H2

Windows 10 22H2

Version 22H2 editions of Windows 10 are now available.  These include:

• Windows 10 Enterprise Version 22H2
• Windows 10 Professional Version 22H2
• Windows 10 Education Version 22H2

CloudBoot Update

CloudBoot, the mechanism for initiating a CloudDeploy SOE image deployment, has now been updated. It contains updated drivers for deployment to the latest hardware models and security enhancements.

Old versions of CloudBoot will expire at the end of January 2023. If an old version of CloudBoot is being used, an expiry message similar to the one shown below will be displayed in the top-right of the screen when a device is booted with CloudBoot.

For information on how to rebuild CloudBoot to the latest version, refer to the CloudBoot: How-To Guide article in the SOE Portal knowledge base.

Windows 10 Version 21H2

Version 21H2 has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 21H2
• Windows 10 Enterprise LTSC 2021
• Windows 10 Professional Version 21H2
• Windows 10 Education Version 21H2

Windows 11 Version 21H2

Windows 11 is now available in the SOE Portal.  The list below shows the supported editions:

• Windows 11 Enterprise Version 21H2
• Windows 11 Professional Version 21H2
• Windows 11 Education Version 21H2

Windows 11 Hardware

Remember that Windows 11 has more stringent hardware prerequisites. View them at Windows 11 requirements. Take note of the support for CPU generations and the TPM version. The SOE Portal certified hardware library has now been extended to include Windows 11 hardware. Note that only hardware models that are supported by Microsoft will be added to this list.

Custom Start and Taskbar Layout

The method of providing a Start layout for Windows 11 has changed. Windows 11 utilises a .json file (instead of a .xml file). This information has been documented for both Windows 10 and Windows 11, along with relevant links to Microsoft articles, in the SOE Portal knowledgebase article titled Custom Start and Taskbar Layout.

Offline Domain Join

If you are using SOE Portal CloudDeploy for your SOE images, there is now the ability to use Offline Domain Join (ODJ). This will allow a device that is not connected to the corporate LAN/WAN to join an on-premises Active Directory domain. New fields are shown on the Active Directory tab in the Image Configuration Wizard. To use this functionality, a service must be installed in your on-premises environment.

Knowledge Base Articles

Some of the SOE Portal knowledgebase articles have been updated, such as Active Directory Domain Join Process Overview, and some new articles have been added:

• CloudDeploy Offline Domain Join (ODJ)
• CloudDeploy ODJ Service Configuration
• Windows 11 - Lifecycle, What’s New, Release Notes

Microsoft 365 Apps

Microsoft 365 Apps now have a new home on their own pane in the Image Configuration Wizard. Options for the inclusion of Microsoft 365 Apps are displayed here, including Project, Visio, Teams and OneDrive. The architecture (x32 or x64) and channel (Current, Monthly Enterprise or Semi-Annual Enterprise) can also be selected here. And, for the first time, individual Microsoft 365 Apps can be selected or deselected. This change replaces the previous Common Applications for these apps.

Pre-registered Devices

The new computer naming option Database (CloudDeploy only) announced last month has been enhanced and is now called Pre-registered Devices. Enabling the Only allow pre-registered devices option will secure the SOE image to only allow deployment to devices that have been registered (under Images > DEVICES).

• If a deployment is initiated on an unregistered device, then a message will be displayed and the deployment will not continue.
• If the Use pre-registered devices for naming option is selected, then the computer name will be set as per the details specified in the SOE Portal for the specific device (as defined under Images > DEVICES).
• If there is no computer name specified, then the Fallback Naming Convention option will be used, which can be configured as per the standard computer naming conventions (serial numbers, asset tags, prefixes, suffixes, etc).
• The options for pre-registering computers, such as import from CSV etc, have not been changed. Note that these options are only applicable to CloudDeploy builds.

For additional details, view the knowledgebase article titled Pre-registered Devices.

Other Changes

• A new option called Disable local admin account upon successful domain join is now available on the Installation pane of the image configuration wizard.
• On the Management pane of the image configuration wizard, Microsoft SCCM has been renamed to Microsoft Endpoint Configuration Manager (MECM). The parameters have not changed.
• The reliability of the MECM agent installation during SOE deployment has been improved.
• The WIM image file created by the SOE Portal will now have the WIM image name and WIM image description properties set. This will include information such as the SOE image name, version and build date.

Windows 10 Version 21H1

Version 21H1 has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 21H1
• Windows 10 Professional Version 21H1
• Windows 10 Education Version 21H1

Manual Computer Name (and Computer Description) Entry

If using a computer naming standard of Manual, the window that prompts to collect this information has been updated. The Computer Name field is mandatory and functions as previously. The Computer Description field is new. This is optional, but if a value is defined then it will be set as the device’s description in Windows. If the device is joined to Active Directory (AD) and the join domain service account permissions allow, the Computer object’s Description property will also be set with this value.

Computer Name Database

A new computer naming option called Database (CloudDeploy only) is now available in both the Image Configuration and the SiteList wizards.

Note that this option is only applicable to CloudDeploy builds. If selected in a standard image, it is the same as selecting Manual option. This feature allows entry of device serial numbers along with associated computer names and computer descriptions on the COMPTUERNAMES tab.

Entries can be manually added, modified or removed, as well as imported from and exported to CSV. When a CloudDeploy build is being deployed, the device’s serial number will be used to retrieve the computer name and optional computer description to apply. If there is no match found in the database, then the manual computer name entry window will be displayed (as shown above). For additional details, view the knowledgebase article titled Computer Name Database.

New Knowledgebase Articles

The following new knowledgebase articles have been added to the Help section:

• Images > Computer Naming Conventions
• CloudDeploy > Computer Name Database

New Image Configuration Fields

Several new fields have been to the Image Configuration wizard:

• Installation > Activate Windows with embedded digital OEM product key (license). During the deployment process, if this option is selected an attempt will be made to locate an embedded digital Windows OEM product key and use it to activate Windows. If no embedded Windows OEM product key is detected, then default KMS licensing will be activated. Note that the version of Windows must match the embedded Windows OEM product for successful Windows activation. Consult your Microsoft licensing specialist to verify if this is a valid licensing option for your environment.
• Custom Settings > Shutdown on First Checkpoint. If this option is selected, during the deployment process the device will shut down the first time it reaches the staging checkpoint. This is ideal for use in an offsite deployment centre (e.g. hardware manufacturer’s factory or third party integration centre). After this shutdown occurs, the device can be packed and shipped to site. When the device is next booted, the staging checkpoint with be displayed as normal.
• Active Directory (On-Premises) > Specify OU to join for staging. Specifies a staging (i.e. temporary) AD organizational unit (OU) into which the device will be joined. At the end of the SOE staging/deployment process, the computer object will be automatically moved into the final OU. This allows for an alternate group of computer GPOs to be applied during staging/deployment (for example, ones that don’t include the legal logon notice prompt).
• Management > Quest KACE > Agent Token. This optional field allows the input of a KACE agent token, which is utilised for installation verification and authorisation of the KACE SMA Agent V11 and higher.

CloudBoot / ISO Update

Several notable changes have been made to CloudBoot (for CloudDeploy image deployment) and ISO boot (for Standard image deployment).

• If no hard disk drives are detected, then a message will be displayed. This often indicates a physical problem where the disk is missing or faulty. It may also be triggered on new hardware models with new chipsets – in that case, contact SOE Portal support who can arrange for support for the new model to be added.
• The hard disk drive and its capacity that is being deployed to will now be noted on the Erase data and continue confirmation prompt.
• If there are multiple hard disk drives detected on the device, then an option will be given on the Erase data and continue confirmation prompt to change the target disk. The default disk will be the first disk, unless the first disk is small (e.g. an Intel Optane disk), in which case the default will be the second disk. Remember that the first disk will be assigned the number 0.
• For CloudBoot only: When device is booted from CloudBoot, it will automatically check with the SOE Portal for any updates and automatically download and apply them as required. These updates will only be small files. This will result in enhancements and fixes to be applied without the need to rebuild and redistribute CloudBoot. For a standard SOE image that is built as an ISO, to receive these changes the SOE image must be rebuilt. For a CloudDeploy SOE image to receive these updates, CloudBoot must be rebuilt and redistributed. Note that older versions can still be used until the end of May 2021, after which the newer CloudBoot must be used.

Management Toolset

The following management toolset agents have been updated. When selected, these will be automatically installed during the device staging/deployment process. These newer versions will be included when an SOE image is built/rebuilt.

• Quest KACE SMA Agent: Version 11.0.119
• Microsoft Configuration Manager Agent: Version 5.0.9040.1010

Windows 10 Version 20H2

Version 20H2 (OS build 19042) has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 20H2
• Windows 10 Enterprise Version 20H2 LTSC
• Windows 10 Professional Version 20H2
• Windows 10 Education Version 20H2

In addition, the following Windows built-in applications may now be deselected in the image configuration wizard, which will remove them from your image:

• Cortana (Available to be removed for Windows 10 2004 and higher

New Microsoft Edge

With the release of Windows 10 20H2, Microsoft has included the new chromium-based Microsoft Edge web browser by default. It will also deploy automatically via Windows Update to earlier Windows 10 versions.

By default, SOE Portal images will suppress a number Microsoft Edge options such as the ones listed below. Note that this does not impact the functionality of Microsoft Edge should you wish to use it as your default web browser.

• Prevention of the full screen first run information screen
• Removal of desktop shortcut
• Prevention of auto-launch of Microsoft Edge on user login

While Microsoft Edge is installed by default, you may still include additional web browsers from the common application library, and change the default browser through the use of a custom application association XML file. Check out the SOE Portal Knowledge Base for more details.

CloudDeploy Updates

As part of this release, some CloudDeploy updates have also been included.

• The LocalStore Gateway field will now accept asterisk wildcards in the IP address. This is used when matching the default gateway of the device being deployed to an appropriate LocalStore. Note that using wildcards in the Gateway field is for more advanced networking scenarios, and you should ensure that the settings applied are appropriate to your environment.
• The LocalStore UNC Path field will now accept subfolders. Where previously only a UNC path like \\server\share$ was accepted, a path like \\server\share$\subfolder1\subfolder2 may now be used.
• CloudBoot has been updated to support 20H2 and to include a number of fixes. A rebuild of CloudBoot for your SOE Portal tenant is now required. Your current version of CloudBoot will still function until 19th December 2020, although errors will be experienced if deploying a Windows 10 version 20H2 iamge. Until that time, a reminder countdown will be displayed if you boot with an older version similar to the below example. If an old version of CloudBoot is used after that time, a message will be displayed to advise that the new version must be used.

Azure Active Directory Join

The ability to join a device to Azure Active Directory (Azure AD) has now been added to the SOE Portal. First of all, note that the old tab in the Image Configuration Wizard called “Active Directory” has now been renamed to Active Directory (On-Premises) but still functions the same as before. A new tab called Azure Active Directory is now available.

A .ppkg Windows provisioning package, created using the Windows Configuration Designer (a component of the Windows ADK), must be uploaded for use by the Azure AD join process. This file contains all the information required, such as the Azure AD tenant and the token (or credentials) to be used. Refer to the SOE Portal Knowledge Base article titled Azure Active Directory for information on using the Azure AD join functionality and on creating the provisioning package. Please refer to this knowledge base article even if you are experienced with provisioning packages, as it contains important notes on what to include and what not to include.

If the on-premises AD join and Azure AD join are both enabled, Azure AD becomes the fallback. If the on-premises AD is not available then the Azure AD join can be set to occur instead. Read through the above mentioned knowledge base article for details.

New Core Applications Types

In addition to the existing core application types (EXE, MSI, Script and IPC Package), three new types have been added. Take a look at the SOE Portal Knowledge Base articles in the Applications section for information about using core applications in SOE Images.

Universal Windows Platform App (AppX)

AppX Windows apps can now be installed (or "sideloaded") as part of the SOE Image.

Local Group Policy (LGPO)

An LGPO can be imported as part of the SOE Image. This is useful for setting a wide array of security and configuration options. Some common scenarios for using an LGPO is to apply a default configuration set that may be overridden by on-premises AD GPO or to apply configurations when a device is only joined to Azure AD.

Provisioning Package (PPKG)

A provisioning package, created by the Windows Configuration Designer, can now be applied as a core application. For Azure Active Directory join, use the options in the Azure Active Directory tab of the Image Configuration Wizard instead of using a configuration package as a core application. Check out the knowledge base article titled Core Application: Provisioning Package (PPKG) for information on using provisioning packages in the SOE Portal, as well as guidance for items that should not be included in provisioning packages.

Applications Associations

The SOE Portal Image Configuration Wizard now supports including an application associations XML file. This file is used by Windows to configure default file associations. For example, configuring .PDF files to open in Adobe Reader, or changing the default web browser. This setting is available on the Personalization tab.

For information creating the application association configuration file, read the knowledgebase article titled Apply Windows Default Application Associations.

Enhancements

Various other enhancements have also been made throughout the SOE Portal. Some highlights include:

• Various tweaks to the user interface, such as enlarging text fields to view more of the entered data.
• For tenants with the SiteList Advanced Feature enabled:
  • Active Directory groups, which the device will be made a member of, can now be specified for each Tier.
  • Options in the Custom tab of the Image Configuration Wizard allows the SiteList to be enabled or disabled for each image, and the installation order of the Tier and Stage 2 applications can be switched.
  • During image deployment, virtual machines will now be treated as certified. The status message at the bottom of the screen will reflect this and not show the device as being uncertified.

New Knowledge Base Articles

A series of new articles have been added to the SOE Portal Knowledge Base. They can be accessed under the Help option. New topics covered include:

• New core application types
• Azure Active Directory
• CloudDeploy

Windows 10 Version 2004

Version 2004 (OS build 19041) has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 2004
• Windows 10 Enterprise Version 2004 LTSC
• Windows 10 Professional Version 2004
• Windows 10 Education Version 2004

In addition, the following Windows built-in applications may now be deselected in the image configuration wizard, which will remove them from your image:

• Mixed Reality Viewer
• Xbox Game Bar

Deployment Fix for Lenovo Hardware

This release also includes a fix for intermittent deployment problems to Lenovo hardware. This problem only affected images which were built to an ISO (and being deployed using that ISO, USB etc) and images which were being deployed using CloudDeploy.

If you have any active images which are being deployed to Lenovo hardware via an SOE Portal ISO, we recommend you rebuild your image and the fix will be automatically included. If not deploying to Lenovo hardware, no action is required.

If you are using CloudDeploy and deploying to Lenovo hardware, you should recreate CloudBoot only and use the new CloudBoot to initiate image deployments. Rebuilding your image is not required. This version of CloudBoot will still function until 14th August 2020. Until that time, a reminder countdown will be displayed if you boot with an older version similar to the below example. If an old version if CloudBoot is used after that time, a message will be displayed to advise that the new version must be used.

Windows 10 Version 1909

Version 1909 (OS build 18363) has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 1909
• Windows 10 Enterprise Version 1909 LTSC
• Windows 10 Professional Version 1909
• Windows 10 Education Version 1909

Windows 10 1903 default app reset notifications

Some of you may have noticed that in the last few months, SOE images built with the SOE Portal for Windows 10 1903 have been displaying multiple default app reset notifications when a new user would log in for the first time, mainly related to Microsoft Edge. These notifications did not accurately indicate that an app reset was actually performed and were misleading, and potentially confusing for end users. Windows 10 1909 was affected in a similar manner.

The SOE Portal engineering team has been working with Microsoft on this, and Microsoft has been acknowledged that a Windows 10 bug was introduced in the August 2019 cumulative update. While Microsoft are working on a fix, we’ve added in a workaround which prevents these errant notifications from being displayed.

If you have built an image within the last few months and are finding these app reset notifications are displaying, please rebuild your image in the SOE Portal so that the workaround is applied as part of the build process. If you’ve any questions, please contact the SOE Portal support team.

Windows 10 Version 1903

Version 1903 (OS build 18362) has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 1903
• Windows 10 Professional Version 1903
• Windows 10 Education Version 1903

Updated Image Versioning

Up until now, the image version has included the Windows 10 release version as a single digit, which would correspond an appropriate version. For example, ZNTH.10E64.6.01.REV15 would correspond to Windows 10 Enterprise x64 Version 1809 (the 6 indicated 1809). This has now been changed. From Windows 10 Version 1903 (and future releases), the version number will be included instead of a single digit. So, for example, the image version for Windows 10 Pro x64 Version 1903 would be ZNTH.10P64.1903.01.REV15.

Read more about the image versioning standard in the follow KB article: Image Version Information

Common Applications

You will now see a number of places in the SOE Portal that display newly added or updated common applications. For example, on the login page and on the Dashboard.

In addition, icons will now display next to common applications when they are listed in the Image Configuration Wizard. This helps to assist with quick identification of applications.

Windows 10 Version 1809

Version 1809 (OS build 17763) has now been made available for the Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 1809
• Windows 10 Enterprise LTSC 2019
• Windows 10 Professional Version 1809
• Windows 10 Education Version 1809

All Windows editions are Semi-Annual Channel unless they include LTSC in the edition name.

Earlier editions are still available. Remember the handy Copy Image Config feature, which allows you to copy an entire image configuration from one version of Windows to another (ensure you do double-check your Hardware and App associations after copying).

For the build to ISO option, the latest WinPE drivers are now included to support deployment to devices from major hardware manufacturers.

Long-Term Servicing Channel

The Long-Term Servicing Channel (LTSC) edition of Windows 10 has now been updated to the latest version (2019). Note that the term LTSB (Long-Term Servicing Branch) has now been replaced with LTSC. If you have been using LTSB/LTSC 2015 or 2016, the OS description will have been automatically changed to LTSC. However, this is a cosmetic change and your Windows edition or version hasn’t changed.

Read here for additional information about the Windows 10 servicing channels: Windows as a Service Servicing Channels

Updated Device Information Application

The Device Information application which is optionally included in your SOE images has now been updated to version 1.11.  It will be automatically updated the next time you rebuild your SOE image.  Changes include:

• A new button called Diag Logs has been added to the navigation pane. This does the same as the Tools > Collect Diagnostic Logs button which you have likely used in the past when contacting SOE Portal Customer Support.
• Information on the General tab will periodically update to reflect current free disk space and Security Center status.
• Information on the Network tab will update if an IP address change is detected.
• A new Settings button is now displayed on the Tools tab to open the Windows 10 settings window.
• A number of other reliability enhancements have been made as well as improvements to the diagnostics logs.

Windows 10 Version 1803

Version 1803 (April Update) editions have now been made available to Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 1803
• Windows 10 Professional Version 1803
• Windows 10 Education Version 1803

Earlier editions are still available, but we recommend migrating to 1803 when you next rebuild your Windows 10 image.  Remember the handy Copy Image Config feature, which allows you to copy an entire image configuration from one version of Windows to another (ensure you do double-check your Hardware and App associations after copying).

Windows 10 Version 1709

Version 1709 (Fall Creators Update) editions have now been made available to Windows 10 editions in the SOE Portal.  The list below shows the newly added editions:

• Windows 10 Enterprise Version 1709
• Windows 10 Professional Version 1709
• Windows 10 Education Version 1709

The Version 1703 and earlier editions are still available, but we recommend migrating to 1709 when you next rebuild your Windows 10 image.  Remember the handy Copy Image Config feature, which allows you to copy an entire image configuration from one version of Windows to another (ensure you do double-check your Hardware and App associations after copying).

Management Toolset Agents

Updated management toolset agents are now available.  If selected for inclusion, these versions will be automatically installed during the staging (image deployment) process using the parameters you defined in the SOE Portal image configuration wizard.

• Microsoft Intune – Updated to latest version
• Quest KACE – Updated to version 7.2.10

Other Updates

As part of ongoing bug fixes and enhancements, the following items have been changed or added:

• Added the ability to remove the Print 3D built-in Windows 10 app.
• Windows 10 Professional has now been renamed to Windows 10 Pro. This is to keep in line with the terminology currently in use by Microsoft.
• In some instances after staging completes, the staging service consumes high CPU and does not terminate. This has now been resolved.
• A number of behind the scenes reliability enhancements have been implemented.

Windows 10 Version 1703

Version 1703 (Creators Update) editions have now been made available to Windows 10 editions in the SOE Portal. The list below shows the newly added editions. Also added is the ability to remove the Paint 3D, Messaging, Sticky Notes and View 3D built-in Windows apps.

• Windows 10 Enterprise Version 1703
• Windows 10 Professional Version 1703
• Windows 10 Education Version 1703

The Version 1607 editions are still available, but we recommend migrating to 1703 when you next rebuild your Windows 10 image. Remember the handy Copy Image Config feature, which allows you to copy an entire image configuration from one version of Windows to another (ensure you do double-check your Hardware and App associations after copying).

C: Drive Volume Name

Prior to this release, the C: disk volume would be automatically set to the image version if deploying the image from the ISO (e.g. USB media). We have introduced a new field on the Image Details pane in the image configuration wizard called Disk Volume Label. A value entered here will be applied as the C: disk volume label. If this field is left blank, then the image version will be automatically used (this applies to all Image File Types, not just ISO).

Capture Ghost Images

On the Image Details pane in the image configuration wizard, a new Image File Type of GHO has been added. This enables the image to be captured in Symantec Ghost format (.gho). This format can be easily integrated and deployed using Symantec Ghost tools, such as Ghost Solution Suite (GSS).

Read the below notes relating to the GHO image file type.

• Images will be captured in Symantec Ghost format (.GHO) instead of Microsoft WIM format.
• The image will be split across ~2GB files: a .GHO file and several .GHS files.
• All files will be compressed into a .ZIP file. This .ZIP file can be downloaded from the SOE Portal using the SOE Portal File Manager (SPFM), which launches when using the image Download option.

Uncertified Hardware Behaviour

During image deployment, the hardware model is detected and correlated to the hardware models selected in the image configuration wizard. This is called a certified hardware model. If the detected model does not have the drivers provisioned within the image, it is called an uncertified hardware model. There are now two options available which govern the behaviour of what occurs when an uncertified hardware model is detected. This field is located on the Hardware pane of the image configuration wizard and is titled Uncertified Hardware Action.

• Use drivers from all selected models – When an uncertified model is detected, the deployment engine try all drivers from other models selected for inclusion the SOE image. This is the action which has been occurring to date.
• Use generic hardware certification – SOE Portal engineers maintain a “generic” set of drivers for each Windows version, which includes drivers for the most commonly used hardware components. If an uncertified hardware model is detected, this generic driver set will be applied. This is the default option for new images.

Core Application Installation Timeout

When core applications are installed during image build or deployment, the application install will timeout after a specified time. This is to ensure an incorrect command line or faulty application package does not halt the build or deployment process indefinitely. The timeout default is 15 minutes and can now be configured using the new Timeout field on Options pane of the application configuration wizard. An example of when this field may be used is in an Office core application. As Office typically takes longer than 15 minutes to install, changing this setting to 25 minutes will allow enough time.

Other Updates

As part of ongoing bug fixes and enhancements, the following items have been changed:

• When a Home Page is specified in the image configuration wizard, this will now apply to the following browsers:
  • Internet Explorer
  • Microsoft Edge (Only applied once the device joins a domain)
  • Mozilla Firefox
  • Google Chrome
• Adjustments to the domain join and activate Windows jobs have been made to cater for network cards (e.g. USB dongles) which can take a longer time to initialise.

Computer Name Prefix and Suffix Options

New Naming Convention options are now available to allow a prefix and/or suffix to be used when the computer name is generated. Different prefixes and suffixes may be specified for notebooks, desktops and virtual machines.

These new options are available if using either the Serial Number or Asset Tag naming conventions. If prefixes or suffixes are not required, they may be left blank.

Local Administrator Group Members

A new option called Local Administrator Group is now available in the Domain section of the Image Configuration Wizard. This allows Active Directory groups to be specified which will be automatically made a member of the local Administrators group during staging. This is optional and may be left blank if desired.

Multiple Active Directory groups may be specified using the Add and Remove options. Note that Domain Name and User Account options must be specified (at the top of the Domain section) before using this option.

Computer Membership of AD Groups

A new option called AD Group Membership is now available in the Domain section of the Image Configuration Wizard. This allows the computer object to be automatically added to specified Active Directory groups during staging. Desktop devices (including virtual machines) will be added to the domain group(s) defined in Domain group to join (Desktops) and notebook devices (including tablets) will be added to the group(s) defined in Domain group to join (Notebooks). These are optional and may be left blank if desired.

Multiple Active Directory groups may be specified using the Add and Remove options. Note that Domain Name and User Account options must be specified (at the top of the Domain section) before using these options. The specified User Account will be used to modify the group membership, so it must have appropriate permissions in Active Directory to modify membership for the specified groups.

Office 365 now available as Common Applications

Office 365 versions of Microsoft Office Professional Plus are now available in the SOE Portal as common applications. When selected for install, the corresponding click-to-run Office version will be installed into your image. The following Office versions are available:

• Office Professional Plus 2013 32-bit (Office 365)
• Office Professional Plus 2013 64-bit (Office 365)
• Office Professional Plus 2016 32-bit (Office 365)
• Office Professional Plus 2016 64-bit (Office 365)

Other Items

Last November, Microsoft released Windows 10 Version 1511. This was added to the SOE Portal shortly afterwards, and replaced the RTM version of Windows 10. All Windows 10 images built in the SOE Portal since December 2015 have included this newer version. Our experience so far shows that it is more stable than the original Windows 10 release. If you have a Windows 10 image which was built earlier than December 2015, we recommend you rebuild with this version.

All common applications have now been updated with the latest releases. These will be automatically included in your next image build.

When deploying an image from a UFD (USB Flash Device) created from an ISO downloaded from the SOE Portal, there was a small chance that applying the image would fail in specific circumstances. This has now been rectified and ISO images will successfully deploy. Most users would not have been affected by this, but if you had noticed this problem, it will be rectified the next time your ISO is rebuilt.

Windows 10 1607 Driver Signing

In Windows 10 Version 1607, Microsoft has made some changes to the driver model. Any kernel-mode drivers must be digitally signed by Microsoft. Whilst many drivers created by hardware component manufacturers are already following this official process of having their drivers signed by Microsoft, the SOE Portal hardware certification team have been coming across instances of drivers which are not correctly signed. If a driver is signed with a valid certificate issued to a manufacturer such as Intel or Realtek, the driver is still not considered trusted by Windows 10 Version 1607.

When deploying images built in the SOE Portal (or any other mechanism) and the drivers have not been digitally signed by Microsoft, a warning prompt will be displayed. This will occur during Windows mini-setup, which is after the image has been applied but before Stage 1 commences. If any of these driver prompts are presented, the only option is to click Yes, otherwise the driver will not install for that component. Feel free to log a support request with the SOE Portal support team, who will investigate whether an updated driver is available from the relevant component manufacturer.

Please refer to our KB Article for more information on this subject: Driver Prompts in Windows 10 Version 1607

Release to Production (RTP) Feature

We continually work to make features more reliable and provide a better deployment experience. This release includes some enhancements to the user roles available within the SOE Portal.

• Download Only user role: By default, a user assigned the Download Only role will not see any images on the Images page.
• New RTP Button: If you have a role of Full Administrator, Build Administrator or Image Administrator assigned to your user account, on the Images page you will find a new button called RTP. This becomes available when you click on a completed build.
• Mark as RTP: The RTP button marks an image as RTP (Release to Production). This makes the image configuration visible to Download Only users.
• Unmark as RTP: You can also unmark an image as RTP (and this can be done under various statuses, not just when the build is complete), which will hide the image configuration from Download Only users.

Windows 10 Version 1607 (and LTSB 2016)

Version 1607 editions have now been made available to all Windows 10 editions in the SOE Portal. The 2016 LTSB edition has also been added and the Windows 10 Education edition is now available. The list below shows the newly added editions which are all available in both 64- and 32-bit. Also added is the ability to remove the Feedback Hub and Paid WiFi and Mobile built-in Windows apps.

• Windows 10 Enterprise Version 1607
• Windows 10 Professional Version 1607
• Windows 10 Education Version 1607
• Windows 10 Enterprise LTSB 2016

The Version 1511 editions are still available, but we recommend migrating to 1607 when you next rebuild your Windows 10 image. Remember the handy Copy Image Config feature, which allows you to copy an entire image configuration from one version of Windows to another (ensure you do double-check your Hardware and App associations after copying).

An important note about Microsoft Intune: The Microsoft Intune client currently cannot be installed on Windows 10 Version 1607 under specific circumstances. When an updated version is publicly released by Microsoft, we will update it in the SOE Portal. Refer to this link for more information.

Domain Join Enhancements

This release includes some enhancements to the domain join functionality.

• Computer objects in a different OU – If a computer object already exists in AD but in a different OU, an attempt will be made to move the computer object into the OU specified in the image configuration. This will preserve any computer group memberships, permissions etc. To perform this object move, it uses the credentials of the join domain service account specified in the SOE Portal, so appropriate AD permissions need to be assigned to this account. If the move cannot be performed (usually due to service account permissions), a standard Abort/Retry/Ignore prompt will be displayed with an appropriate message.
• Join domain failed settings – When the automated join domain process fails, the Abort/Retry/Ignore prompt will be displayed as it has in the past. However, it now has a Settings link on it. The most common join domain failures are due to an incorrect domain name or invalid credentials for the join domain service account. Clicking this link will display a domain information window which will allow these settings to be changed for the current deployment.

Other Updates

As part of ongoing bug fixes and enhancements, the following items have been changed:

• Added support to display the on-screen keyboard during the staging process. Tap the keyboard icon in the bottom right of the screen.
• Added touchscreen support for Microsoft Surface devices when booted into WinPE from USB media (The Erase data and continue? prompt).
• During staging, informational windows will now scale correctly on high-resolution displays for devices such as the Microsoft Surface, Dell XPS, HP Spectre 360, Lenovo Yoga etc.
• Some new hardware models with recent mass storage controllers have blue screening on Windows boot, after the image has been applied. This has only been affecting Windows 7. This problem has now been resolved. An image rebuild will be required.

Updated Common Applications

Over half of the existing common applications in the library have now been updated to their latest version. These updated versions will be automatically included the next time you rebuild your image.

Decommissioned Common Applications

A few common applications have now been decommissioned and are listed below. Take note of the information provided if you are currently using any of these common applications.

• Lenovo Solution Center Version 2 (x86 and x64) – Version 2 of the Lenovo Solution Center has been decommissioned by Lenovo. Version 3 is now available and supports all versions of Windows. If you were using version 2, you will need to select the Lenovo Solution Center V3 common application so it will be included in the next image build. Remember that when selecting a Lenovo (or Dell etc) common application, it will only be installed on appropriate hardware during staging.
• Apple QuickTime – This application is no longer supported by Apple and no updates are being provided. This common application has been decommissioned due to recent reports that it contains some security vulnerabilities. This application will no longer install as a common application. If you require this application, it will now need to be uploaded as one of your core applications.

New Common Applications

Following is a list of recently added common applications:

• Adobe Flash Player PPAPI plugin (for Chrome and Opera)
• Autodesk DWG TrueView 2017
• Dell Open Print Driver
• Lenovo Solution Center Version 3 (only installs on Lenovo devices)
• Microsoft Surface Dock Updater (only installs on Surface devices)
• Microsoft Yammer Notifier