VMware Workspace ONE UEM supports creating provisioning packages to install applications and configurations on Windows 10 devices prior to factory shipping.
The following guide outlines TestDrive's Workspace ONE Drop Ship Provisioning process in the ready to use environment, testdrive.awmdm.com.
Contents
Before You Begin
You need the following before you begin:
- TestDrive account in testdrive.vmware.com with enabled ready to use Workspace ONE UEM product.
- A VMware Fusion/VMware Workstation Windows 10 Pro VM or a supported machine. This guide is written for a VM with physical machine notes.
- Windows 10 ISO from either MSDN, Microsoft Volume License site or here.
- A USB drive to transfer provisioning package files and the tool to the VM.
- Windows machine must be connected to the Internet.
- Workspace ONE UEM administrator roles*:
- Intelligence & Tenant Administrator at TestDrive - Use for provisioning package management.
-
Device Administrator at World Wide Enterprises - Use for device management.
*Due to provisioning functionality design and requisite environment restrictions, two administrator roles must be used in TestDrive.
- Drop Ship Provisioning: VMware Workspace ONE Operational Tutorial
-
To use Workspace ONE Drop Ship Provisioning with Dell, you must participate in Dell Configuration Services. To begin the Dell Configuration Services project setup, see Configuration Services and click Contact Us.
Introduction
Factory Provisioning for Workspace ONE allows both OEM and VMware customers to reduce IT touch and user downtime to virtually zero!
Factory Provisioning for Workspace ONE is enabled through an innovative Windows feature that supports creating provisioning packages (configuration containers for device settings) that lets admins quickly and efficiently configure a device without having to install a new image. VMware Workspace ONE UEM customers can utilize these small PPKG files for capturing desired customizations. Factory Provisioning eliminates the need for customers to send an entire Windows image containing all of their Win32 apps to the factory.
Factory Provisioning is valuable to enterprises as it allows the device to ship directly from OEM to the user, removing costly distributor, integrator, and IT touch steps. Furthermore, the provisioning package can be reapplied automatically after a factory reset (device wipe) keeping the computer in a production-ready state.
1 - Set up apps
Talking Points
- App setup follows the Workspace ONE UEM console's friendly and familiar internal app management flow.
- Internal apps, uploaded in the console's Apps & Books section, are eligible for export to PPKG.
App setup is the foundation to package (PPKG) creation.
Note:
- App deployments are currently supported for device context, not user.
- Apps with MSTs or MSPs will fail to deploy as those additional patches are for SG-specific deployment. Re-package or zip the app with the MST/MSP already included.
In testdrive.awmdm.com, the Win32 apps are already set up. Using this preconfigured environment is the shortest and simplest path through a factory provisioning demo.
2 - Create Configuration File (unattend.xml) and PPKG
Talking Points
- Packages are, simply put, a collection of the Win32 applications with configurations that you require in your machine image.
- PPKG file creation is streamlined by Workspace ONE UEM's innovative Factory Provisioning Service.
- The configuration file (unattend.xml) creation screen contains helpful tool-tips for each available parameter.
- Workspace ONE UEM provides a convenient dashboard listing the provisioning package's configuration file (unattend.xml) and PPKG status and download links.
This video (5:46 min) shows the entire process, starting with creating the provisioning package to simulating the imaging process to the user working in Windows within Workspace ONE app! Additionally, the following troubleshooting steps are demonstrated in the video: profile troubleshooting, user cert verification via the MMC, and running mdmagent.exe.
Obviously, the linked video is edited. The process takes about between 15 minutes in real time, though individual results will vary, depending on machine resources, PPKG size, handiness with the USB drive, network performance, etc.
Factory Provisioning for Workspace ONE requires a pair of files, the PPKG and the unattend.xml. The PPKG contains the image's apps and the unattend.xml instructs the Sysprep process. Workspace ONE UEM contains an innovative UI wizard that guides the admin through creating both the PPKG and the unattend.xml files.
Use the Intelligence & Tenant Administrator at TestDrive admin role.
Go to Devices > Lifecycle > Staging > Windows and create a new package.
-
- Name the provisioning package. Description is optional.
- Select the onboarding method: Factory Provisioning
-
On configurations, set the parameters for the unattend.xml. With the TestDrive environment being on the Internet, the only supported directory type is workgroup. AD domain join options are not supported in TestDrive.
- Defaults are preset to typical settings.
-
Each parameter contains informative tooltips. Click the for details.
In TestDrive, the Windows staging and provisioning system settings for Workspace ONE Enrollment are not accessible due to system settings' design and admin role restrictions.
Here's copiable staging information:
Enrollment Server: https://testdriveds.awmdm.com
Enrollment OG: corp
Staging Account: [email protected]
Staging Account Password: FPdemoG0
- Proceed to applications. Select the apps for the deployment's package (file PPKG).
Note:
Dell apps are provided for users with supported Dell hardware. If you attempt to apply a PPKG with Dell hardware apps on something other than Dell hardware, e.g., a VM, the PPKG installation will fail.
As mentioned, to reduce time, keep the PPKG small. For example, Office 365 Pro Plus is over 2 GB. Therefore, it's not recommended to include in a live demo.
- Proceed to the summary screen. Review your configurations. Save and export.
- Name the provisioning package. Description is optional.
- Name the provisioning package. Description is optional.
- Select the onboarding method: Factory Provisioning
-
On configurations, set the parameters for the unattend.xml. With the TestDrive environment being on the Internet, the only supported directory type is workgroup. AD domain join options are not supported in TestDrive.
- Defaults are preset to typical settings.
-
Each parameter contains informative tooltips. Click the for details.
In TestDrive, the Windows staging and provisioning system settings for Workspace ONE Enrollment are not accessible due to system settings' design and admin role restrictions.
Here's copiable staging information:
Enrollment Server: https://testdriveds.awmdm.com
Enrollment OG: corp
Staging Account: [email protected]
Staging Account Password: FPdemoG0
- Proceed to applications. Select the apps for the deployment's package (file PPKG).
Note:
Dell apps are provided for users with supported Dell hardware. If you attempt to apply a PPKG with Dell hardware apps on something other than Dell hardware, e.g., a VM, the PPKG installation will fail.
As mentioned, to reduce time, keep the PPKG small. For example, Office 365 Pro Plus is over 2 GB. Therefore, it's not recommended to include in a live demo.
- Proceed to the summary screen. Review your configurations. Save and export.
- Defaults are preset to typical settings.
-
Each parameter contains informative tooltips. Click the for details.
In TestDrive, the Windows staging and provisioning system settings for Workspace ONE Enrollment are not accessible due to system settings' design and admin role restrictions.
Here's copiable staging information:
Enrollment Server: https://testdriveds.awmdm.com
Enrollment OG: corp
Staging Account: [email protected]
Staging Account Password: FPdemoG0
|
In TestDrive, the Windows staging and provisioning system settings for Workspace ONE Enrollment are not accessible due to system settings' design and admin role restrictions. Here's copiable staging information: Enrollment Server: https://testdriveds.awmdm.com |
In TestDrive, the Windows staging and provisioning system settings for Workspace ONE Enrollment are not accessible due to system settings' design and admin role restrictions.
Here's copiable staging information:
<p> Enrollment Server: https://testdriveds.awmdm.com Enrollment OG: corp Staging Account: [email protected] Staging Account Password: FPdemoG0</p>Your completed provisioning package will show up on the staging dashboard where you can monitor its status. Wait a few moments for the package to be created by UEM's provisioning service. Wait times will be longer if PPKGs are larger. Check back in the console for the unattend.xml and PPKG files. You may need to refresh the page. When ready, you'll see them available for download under status.
3 - Image Simulation & Sysprep
Now is the moment when the IT admin would send the organization's PPKGs and unattend.xml files to the OEM for imaging devices before they ship from the factory. The following section simulates the imaging process in a virtual machine.
The VMware Workspace ONE Provisioning Tool for Windows is a testing tool that's used to simulate what happens at the factory. This tool sets up the VM with the PPKG and runs Sysprep which follows the unattend.xml's parameters. Follow the below link to download the VMware Workspace ONE Provisioning Tool for Windows from My Workspace ONE:
Use a Windows 10 Pro x64 VM. You must enable audit mode. To enter audit mode, during Windows setup, when Windows enters the OOBE phase, do one of the following:
- Fusion: SHIFT+FN+CONTROL+F3
- Workstation: CTRL+SHIFT+F3 or CTRL+SHIFT+FN+F3 (on some laptops)
After successfully initiated, the machine will reboot into audit mode. The System Preparation Tool (Sysprep) will be running: ignore it.
Copy the package files and tool from your VM host to a USB drive.
- WS1 Provisioning Tool ZIP (extracted)
- PPKG
- Unattend.xml
- Stage all of the files on the Windows desktop. Disconnect the USB drive after copying files.
- The downloaded Workspace ONE Provisioning Tool is a MSI file. Run the listed command to install the tool:
msiexec /a VMwareWS1ProvisioningTool.msi /qb TARGETDIR="{target directory}\VMwareWS1ProvisioningTool" - Execute the Workspace ONE Provisioning Tool by running VMwareWS1ProvisioningTool.exe
- Select the PPKG and unattend.xml.
- Apply Full Process and restart.
The tool will display its progress in the side status area.
After restart, the machine will read the unattend.xml configuration, setting the device's system configuration and proceeding through enrollment with Workspace ONE UEM. Depending on your unattend.xml file's parameters, your login experience will vary.
Log in with the device user set in section 2.
The factory provisioning process will complete on the machine after a few minutes (depends on your machine's hardware resources).
The device's Workspace ONE provisioning will also soon begin to take place.
After the desktop loads, the Intelligent Hub will launch. Log in as your user in order to finalize device registration with Workspace ONE UEM. If you don't log in, or your authentication fails, the device will remain with the staging user.
Wait for the Hub to configure your workspace.
After a successful Hub login, before proceeding to a Workspace ONE demo, check for the user cert profile on the device, which, among the many other managed profiles, may not have landed on the device yet:
- In the console, check your device's profiles view for the installed user cert profile:
WWE - Windows - User Cert - On the machine, open MMC, add certificates for user context, and look in the personal store. Verify if your user cert has been installed by Workspace ONE UEM. If it has not, wait. You can run the mdmagent command to sync the machine to console's device services.
Workspace ONE is ready to use.
Windows apps' installations coming from UEM as well as finishing touches will continue in the background.
For a deeper demo on your managed device, reference the Windows 10 - Endpoint Management guide.
Tips
Demo Tip
-
Delete your device record.
When you're finished, be sure to delete your device record, as re-enrolling into the old device record may produce undesirable initial results for your demo.
In device details, click more actions > delete device.
Troubleshooting
- PPKG installation:
- Primary Log: C:\ProgramData\Airwatch\UnifiedAgent\Logs\PPKGFinalSummary.log
- Registry: HKEY_LOCAL_MACHINE\SOFTWARE\AIRWATCHMDM\AppDeploymentAgent
- Sysprep process:
- C:\Windows\System32\Sysprep\Panther\setuperr.log and Setupact.log.
- C:\Windows\Panther\setuperr.log and Setupact.log
- C:\Windows\Panther\Unattendgc\setuperr.log and Setupact.log