I am trying to master MDT deployment, which seems to be a very versatile tool.

The way I do it is:

  • install windows 7 on a reference PC, change screen saver and background and internet time settings.
  • run sysrep on the reference PC.
  • use imagex to capture image.wim
  • use MDT to create a deployment share and task sequence.
  • create a bootable USB pen drive, PXE boot the new PC, and install.

After that, login as a local admin, join the domain (or .leave it in the WORKGROUP)

After reboot, I noticed that the things like: firewall settings, Windows update settings etc are greyed out (control panel -> windows update -> change settings). There is a text message saying: Some settings are managed by your system administrator.

Well, I am logged in as local administrator. So why things are greyed out? Any thoughts?

PS: half of my users MUST be local administrator on his own PC/laptop, due to the nature of their work. So I must make sure local admin can change settings on their own PC.

-- to answer @WinOutreach4 questions --

  • I run the GUI version of sysprep, so only 3 options are used: OOBE, generalise, shutdown after sysprep.
  • I did not use audit mode to change anything.
  • We use samba domain, not windows active directory domain, so I cannot try WDS. However one reason I am trying out MDT is because it is likely we will be moved to windows AD domain, so I can NIC book the PCs and launch the imaging process.
  • I use MDT2012 to create deployment share, and use the LiteTouch_x64.iso to PE boot the PC, the install process will pick up the image etc from the deployment workbench PC. In order to save wasting many CD/DVDs, I created a bootable USB pen drive and copied the iso content in the pen drive.

Thanks for looking into this.

-- end --

-- to answer @WinOutreach4 questions --

  • I don't think I have 'copyprofile' on. The screen saver and background is done through local group policy. I used the local administrator account to make these changes. Then the local group policy is saved as part of the image.
  • I only create 1 local account to finish the installation of the reference PC. I will look into the audit mode.
  • PS: In my reference image, I only have a few things customised: screensaver/background, a few registry settings, that's all. I don't install any applications during imaging. Application installation is done as part of Deployment Share creation - I add Applications, and they are included in the Deployment Sequence. I also inject device drivers at this stage. So if I watch my deployment process, the first part is image deployment, then there is a page with a list of applications for me to choose which ones to install. In this way, I can keep 1 master image for all types of machines, all types of users.

In future when I have a windows domain, I will probably leave the screensaver/background to group policy, hence the reference image will be very very simple to maintain. Applications installation can either be done as provided by MDT, or using group policy installation.

The unatend.xml is uploaded to: http://www.mediafire.com/?ad56zq06kxkqssv (I cannot find a place to upload it in serverfault)

again, thx for your time!

-- end --

--Last Update: success-- Thanks to @WinOutreach4 (especially to you WinOutreach4 for taking out time testing) & MDT Guy, I got it working in the end!

3 things to do: 1) Add WillWipeDisk to unattend.xml 2) Add CopyProfile (=true) to unattend.xml 3) ApplyGPOPack=NO in the ini file

Thank you so much! I didn't see these settings in any of the tutorials/blogs/youtubes I went through, and you helped me out. Cannot thank you enough...


  • 1
    Group policy settings?
    – Nathan C
    Jun 4, 2013 at 13:21
  • @NathanC Could you be more specific? Do you mean I must go through group policy to change them? Jun 4, 2013 at 13:25
  • If you have group policy enforcing windows update and firewall settings, you'd need to go through that to change those. Even when logged in as an administrator group policy overrides the settings unless allowed via group policy itself.
    – Nathan C
    Jun 4, 2013 at 13:26
  • @NathanC No, we are in Linux Samba domain, not windows Active Directory domain. So no group policy in that sense. Jun 4, 2013 at 13:27
  • Ah, interesting. Check the "Local Security Policy" on the machine too. Someone more familiar with MDT will probably give a more definitive answer.
    – Nathan C
    Jun 4, 2013 at 13:30

1 Answer 1


So why things are greyed out? Any thoughts?

Good point on MDT's versatility, its the single most powerful systems deployment tool I have ever had the privlidge of working with, you're getting close, but a few pointers here.

  1. ALWAYS, ALWAYS, ALWAYS, build your images in a Virtual Environment, this pays for itself in dividends as it effectively guarantees the image will run on anything down the road, laptops, desktops, whatever.
  2. Double check and make sure ApplyGPOPack=NO is set in your ini file.
  3. Copy Profile=True needs to be set in your unattend.xml file if you're trying to build a default user profile in 7.
  • 1
    +1 for item 2. Better yet disable the gpo step at the end of the deployment task sequence
    – Greg Bray
    Jun 8, 2013 at 3:28
  • @MDT Guy Thanks for the tip on ApplyGPOPack! I got it all working now. PS: the reason I used a laptop is that our organisation don't have access to VMware workstation. WMware player seems no longer free for commercial use. I hence tried it in Oracle Virtual Box, then I could not boot from WinPE, which means I could not run imagex to capture WIM... I might try again in future when time permitting. Jun 10, 2013 at 10:37
  • @GregBray I have local gpo included in the reference image which need to be deployed to new machines. Not sure if the gpo will get deployed to the new machines, if I disable gpo step under the State Restore section. I will try it out when time permitting. Thanks for your input! Jun 10, 2013 at 10:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .