Skip to content

Windows 11 AVD Golden Image Checklist

This checklist outlines the steps and configurations required to create a Windows 11 AVD golden image. This document will guide you through the process using Microsoft Technet as a primary source and include additional configurations such as installing the Dutch language pack, disabling BitLocker auto-encrypt, and setting up a deployment folder.

This checklist assumes that the Azure Landing Zone, the AVD solution and the image VM have already been created. You should already be able to log into the golden image

Below we have a short list with checkboxes you can use to keep track of this checlist. The checked boxes will reset on refresh

  • 1: Configure Windows 11
  • 2: Disable Bitlocker
  • 3: Create deployment folder
  • 4: Install applications without supplier
  • 5: Install applications
  • 6: Prepare image for sysprep
  • 7: Generalize and capture the image
  • 8: Capture the VM Image
  • 9: Deploy the image

Step 1: Configure Windows 11

  1. Exclude the localadmin user account from fslogix:
    • Add this account to the exclusion fslogix group.
    • Or Run net localgroup "FSLogix Profile Exclude List" localadmin /add in CMD
  2. Install Necessary Updates:
    • Run Windows update and verify if the latest version of fslogix is installed
  3. Install nessecary Language Packs:
    • Follow the following technet article to install the language pack: https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-11-language-packs
    • When using Intune you might want to set the settings for new user accounts and the welcome screen to the newly installed language.
    • Do not forget to clear the appxpackages after the installation has finished!!
  4. Enable Microsoft Cloud Kerberos
    • This feature is used in intune-managed or hybrid-joined scenario's to retrieve kerberos tokens from Microsoft 365
    • Run reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1 in CMD

Step 2: Disable BitLocker Auto-Encrypt

  1. Open CMD as admin:
  2. Verify if the C drive is encrypted
    • Run manage-bde -status in CMD
    • If the C drive is encrypted run the following command: manage-bde -off C:
  3. Disable Auto-Encryption:
    • Run REG ADD HKLM\SYSTEM\CurrentControlSet\Control\BitLocker /v PreventDeviceEncryption /t REG_DWORD /d 1 in CMD to prevent bitlocker from auto-encrypting the C drive.

Step 3: Create Deployment Folder

  1. Create the Folder:
    • Open File Explorer and create a new folder named C:\Deployment.
  2. Copy deployment files:
    • Download the deployment files from the Azure DevOps repo into this folder.

Step 4: Install application(Without supplier)

Some applications will be installed by the supplier, this section focusses on the application we CAN install. Apps like a PDF reader, notepad++ or others.

  1. Create a folder for all installers:
    • Create the folder Software in the prevously created Deployment folder.
  2. Download installers:
    • Place al downloaded installers in the C:\Deployment\Software folder.
  3. Install Applications:
    • Install the necessary applications, make sure to install them for all users!
    • Be aware of the 'Bitness' of the applications(64 vs 32 bit)
  4. Create or cleanup shortcuts:
    • Either create or remove shortcuts in the public desktop: C:\Users\Public\Desktop
    • Either create or remove shortcuts from the startmenu: C:\ProgramData\Microsoft\Windows\Menu Start

Step 5: Install application

This step focusses on supplier installed applications

  1. Setup a meeting with the supplier:
    • Discuss any prerequisites that are required for the applications.
    • Discuss all of configuration items that are required for the applications. Think off registry settings or config file placement.
    • Also give the supplier instruction about the location of application data and configuration
  2. Let the supplier install the applications and perform the configuration
  3. Automate the app configuration:
    • Use either GPO's or Intune policies or possibly local tasks te deploy the required configurations
    • Be aware of deployment-latency when using Intune!
    • Be aware of computer or user-specific configuration!

Step 6: Prepare the image for sysprep

  1. Cleanup files and folders that are not required anymore:
    • Installer files should be in the deployment folders
    • Cleanup lingering files in the recycle bin, desktop, download and documents folder
  2. Create snapshot of the current os disk in Azure:

Step 7: Generalize and Capture the Image

  1. Run Sysprep:
  2. Press Win + R, type sysprep, and press Enter.
  3. In the Sysprep window, select "Generalize" and "Shutdown."
  4. Click "OK" to begin the generalization process.

Step 8: Capture the VM Image

  1. Capture the VM:
  2. Power off the VM.
  3. Right-click on the VM in Hyper-V Manager and select "Export."
  4. Follow the wizard to save the VM image to a specified location.

Step 9: Deploy the Image

  1. Deploy the VM:
  2. Use the captured VM image to deploy new AVD instances.
  3. Ensure that the deployment script or process includes any necessary configurations.

By following this checklist, you will have a fully configured Windows 11 AVD golden image ready for use in your virtual desktop environment.