Microsoft product end of support dates are sometimes not easy to find and its not getting any better with the "current branch" releases and cloud solutions being governed by the Modern lifecycle policy.
Likewise with the "traditional" products, most end of life information is available here – but to say that the information is difficult to search through is an understatement.
It also sometimes lacks detail, for example, there is no metion of the differing support for Windows 8.1 without update 1 and with update 1.
We have a number of clients that take the approach that while a server is running, to leave it there – and while I may personally not like this approach (i prefer to roll through the OS upgrades as they come out) – they have a valid approach and end of life information is important for them.
Windows 10 dates have been sourced from the product lifecycle page, however this blog entry states than an additional 6 months has been granted to displayed Windows 10 versions.
If you find the below useful – cool. If i've got something wrong, or missed something that is key (in your opinion), please leave a comment.
So you've just picked up your shiny new Microsoft Surface Laptop and want to put your current Windows 10 Enterprise SOE on it. Of course you have it all set up in SCCM (right?), so you figure you'll kick off a build and be up and running in a half hour or so.
Granted, the Surface Laptop isn't marketed as an Enterprise device and comes with Windows 10 S pre-installed, but you can do a simple in-place upgrade to Windows 10 Pro. So obviously it should be capable of running any of the Windows 10 OS's (which it is).
PXE doesn't work. I've got a couple of USB to Ethernet adapter that works fine with PXE on other devices – but they simply don't work with the Surface Laptop. Updated the firmware on the laptop to the latest (as Surface Pro's had similar issues with old firmware), and still had the same issue. Whether this is unique to the Surface Laptop I have, or all of them – I'm not sure (as I've only got the one so far).
The keyboard doesn't work in WinPE. Touchpad mouse works fine – so you can kick off the task sequence – you just can't use the keyboard at all. Fine if your task sequence is fully automated, but if you need to enter a computer name or troubleshoot issues, you're going to need to import some drivers.
SecureBoot. Once I'd decided to use a bootable USB to kick off the task sequence, it started running through fine. Rebooted into Windows Setup, then proceeded to complain about the "Microsoft-Windows-Deployment" component of the Specialize pass in the Unattend.xml. Long story short, it's caused by SecureBoot (more on this further down).
So lets break this down into how to fix each.
PXE: Simply put, I haven't been able to fix this. Updated firmware, used different PXE capable USB to Ethernet devices. As above, I'm not sure if this is just the one I have, or all of them – or even if it'll be fixed in newer firmwares. At this stage, it looks like the only option is SCCM boot media. Since the Surface Laptop only has a single USB port, you'll either need to use a USB/Ethernet combo (like one of these – not sure if they're PXE capable or not, haven't tested), or you'll need to use an external USB hub. Note: you can initiate PXE from full power off by pressing Volume Down + Power. If you want to USB boot, you need to go into the UEFI setup by pressing Volume Up + Power. On the boot settings page, you can swipe left on any of the boot options to initiate a 'boot now to selected device'.
SecureBoot/Unattend.xml: This one is a little more tricky. Essentially if you look at the setupact.log file, you'll see something along the lines of "[SETUPGC.exe] Hit an error (hr = 0x800711c7) while running [cmd / c net user Administrator /active:yes]". 0x800711c7 translates to "Your organization used Device Guard to block this app". According to this Microsoft article, it's due to the Code Integrity policy in UEFI being cleared as part of the OS upgrade (from Windows 10 S to something else). Since Windows 10 S won't let you launch certain executables, it blocks them during the OS Deployment as well. Supposedly fixed by a reboot – but by then you've broken your OS deployment. The obvious fix is to disable SecureBoot, then re-enable it after the task sequence completes. I'm not really a fan of this approach, and I'm not sure how you'd automate it (even if you could).
During my research, I found a reference to someone suggesting that applying the Surface Laptop drivers during the OS Deployment actually fixes the issue. I'm not 100% sure if this is the case – as I disabled SecureBoot, rebooted and re-enabled SecureBoot before testing out this process – but doing so afterwards did actually work (with SecureBoot enabled). Since I've only got the one device so far, I'll update this blog once I've tested on others. I've put some instructions further below on how to import the drivers into SCCM (as they're provided in MSI format now, and you'll need them to apply before Windows Setup).
Obviously you can now also add the keyboard drivers to the required boot image!