Surface Pro - Enterprise

Deployment Quick Start

Guide

Page 1

Introduction
The purpose of this guide is to enable you to Deploy Windows 8 to Surface Pro devices using the
Microsoft Deployment Toolkit (MDT) and System 2012 Center Configuration Manager. This guide is
scenario based, it outlines common scenarios and then details how to implement each scenario. The
scenarios covered are:

1.
2.
3.
4.

1.1

Deploy Windows 8 from an MDT network deployment share.

Deploy Windows 8 from an MDT media based deployment share.
Deploy Windows 8 using System Center Configuration Manager 2012.
Deploying Surface Pro drivers and firmware to a running Operating System

Assumptions
This guide assumes that you are adding Surface Pro deployment to an existing MDT or Configuration
Manager environment and that the reader is knowledgeable in the use of MDT and Configuration
Manager 2012.
The guidance included in this guide is provided in the context of Surface Pro deployment, however most
of the information provided also applies to other UEFI based hardware.
If you are new to Windows deployment then it is recommended that you refer to the MDT Quick Start
Guides.

1.2

Surface Pro drivers

Surface Pro requires a common driver set for all scenarios, before beginning deployment you should
obtain the Surface Pro drivers from the following location:
Surface Pro firmware and driver pack - This pack contains all of the drivers and firmware required to
deploy Surface Pro. The latest version can be downloaded from http://go.microsoft.com/fwlink/?LinkID=301483&clcid=0x409

1.3

Hardware requirements
This section outlines the hardware requirement for the scenarios listed in this guide.
To perform a network deployment the Surface Pro must first be connected to the network. There are two
options to connect to the network, via the Surface Pro Ethernet Adapter which provides full PXE boot
support or via a bootable USB key and an Ethernet adapter connected via USB.
Hardware

Description

Scenario

USB key

For a network based deployment this key will

be used to host the Windows PE boot Image
created by MDT, it is recommended that this is

MDT Network Deployment

(removable)

ConfigMgr Network Deployment

Page 2

at least 1GB. For ConfigMgr based media

deployment it is recommended that the key is
at least 8GB

ConfigMgr Media Deployment

Not required for PXE based deployments

using the Surface Pro Ethernet Adapter.
USB Key
(Fixed)

USB hub or docking

station

For a MDT media based deployment this key

will be used to host the Media Deployment
Share, it is recommended that this is at least
8GB. The Key must identify itself as a fixed
drive.

MDT Media Deployment

Surface Pro has a single USB port, booting to

the network using a USB Key and a USB
Ethernet Adapter requires two USB ports. To
provide these ports a USB hub or docking
station is required.

MDT Network Deployment

MDT Media Deployment
ConfigMgr Network Deployment
ConfigMgr Media Deployment

Not required for PXE based deployments

using the Surface Pro Ethernet Adapter.
Ethernet connectivity

During the deployment we need Ethernet

based connectivity to connect to perform a
domain join (if required). This connectivity can
be provided either through a docking station
or a USB Ethernet adapter.

MDT Network Deployment

MDT Media Deployment
ConfigMgr Network Deployment
ConfigMgr Media Deployment

It is recommended that the Surface Pro

Ethernet Adapter is used.

Note - It is not necessary to disable Secure Boot to deploy Windows 8 to Surface Pro. Surface Pro
will successfully boot to a USB boot disk or PXE with Secure Boot enables. Secure Boot is a feature
that helps prevent unauthorized firmware, operating systems, or UEFI drivers (also known as
Option ROMs) from running at boot time. For further details please review http://technet.microsoft.com/en-us/library/hh824987.aspx

Page 3

Deploy Windows 8 from an MDT network deployment share

In this scenario we will deploy Windows 8 to a Surface Pro using a network based MDT deployment share.

2.1

Hardware requirements
The Surface Pro provides PXE boot support however you must use the Surface Pro Ethernet Adapter. If a
PXE adapter is not available then a USB key together with a USB Ethernet adapter can be used instead.
To boot to a network (non PXE) the following hardware is required:

1.
2.
3.

USB key (removable)

USB hub or docking station
Ethernet connectivity

To Boot to a network using PXE deployment the following hardware is required:

1.

2.2

Surface Pro Ethernet Adapter.

Driver requirements
A driver will be required for the USB Ethernet adapter if it is not included as a Windows 8 inbox driver.
Please download the driver for the USB Ethernet adapter from the hardware vendor. The Surface Pro
Ethernet Adapter requires a driver for Windows PE.

2.3

Implementation directions
The following section outlines the implementation steps for this scenario, the steps are:

1.
2.
3.
4.
5.

2.3.1

Import Surface Pro Drivers into MDT.

Create an MDT Windows PE boot image.
Prepare bootable USB key (USB Boot only)
Update WDS Server with boot image (PXE Boot only)
Boot the Surface Pro using the USB key.

Import Surface Pro Drivers into MDT

The following steps outline how to import the Surface Pro drivers into MDT. The drivers required for the
deployment are broken down into two areas:

1.
2.

Windows PE drivers
Windows drivers

Import Windows PE Drivers

It is critical that the driver for the USB Ethernet Adapter is included in the boot image. When managing
Windows PE drivers it recommended that you create an MDT selection profile that includes only the
drivers required for Windows PE to connect to the network and mass storage devices.

Page 4

1.

Import the USB Ethernet Adapter driver and place it in the correct folder that you created for your
selection profile.

Import Windows Drivers

It is recommended that all of the Surface Pro drivers are injected into the Windows 8 driver store during
deployment. To perform this process we recommend that you use the Model Information collected via
WMI to group the drivers. The Surface Pro is identified as Surface with Windows 8 Pro.

1.

In MDT under Out-of-Box drivers create a driver folder for the Surface Pro. For example
Windows8-X64\SurfacePro

2.

Import the Surface Pro firmware and driver pack that you previously downloaded (Error!
Reference source not found.) into MDT, placing it in the folder that you created in the previous
step.

3.

Update the Customsettings.ini file for Surface Pro. The following is provided as an example:
[Settings]
Priority=Model,Default
Properties=DriverSelectionProfile
[Default]
[Surface with Windows 8 Pro]
DriverGroup001=Windows8-X64\SurfacePro
DriverSelectionProfile=nothing
XResolution=1920
YResolution=1080

Note The DriverSelectionProfile variable is critical to successfully injecting all of the required
drivers. This variable forces all of the drivers in the specified selection profile to be injected into
the Windows 8 driver store regardless of whether the device is detected at during deployment.
Some of the devices on the Surface Pro are not visible until other drivers are installed hence they
are not detected vid PnP enumeration and hence DriverSelectionProfile is required.

2.3.2

Create an MDT Windows PE boot image

Once the Windows PE drivers have been imported into MDT you need to create a Lite Touch ISO image.
To create a Lite Touch ISO image:

1.

In the MDT Deployment Workbench right click on the deployment share you are using to deploy
Windows 8 and select Properties.

2.
3.
4.
5.
6.

Select the Windows PE tab.

In the platform drop down selector select x64.
Ensure that Generate a Lite Touch bootable ISO image is checked.
Click OK to close the Properties windows.
Right click on the deployment share you are using to deploy Windows 8 and select Update
Deployment Share.

The ISO image called Lite TouchPE_x64.iso will now be generated and will be placed in the <deployment
share>\Boot folder. This process may take up to five minutes.

Page 5

2.3.3

Prepare Bootable USB key

Important - This step is not required when PXE boot is used.

The bootable Windows PE ISO image must now be extracted and placed on a USB key.
To prepare the USB key:

1.
2.

Format the USB key with FAT32

Note - Do not use NTFS as this is incompatible with UEFI

Navigate to the <deployment

share>\Boot folder and mount the Lite TouchPE_x64.iso image.

3.

Copy the contents of the ISO image to the USB key.

2.3.4

Prepare PXE Server

Important - This step is not required when USB boot is used.

The bootable Windows PE image must now be placed on the WDS PXE server. It is recommended that a
Windows Server 2012 WDS server is used however Windows Server 2008R2can also be used. For further
details please refer to http://technet.microsoft.com/en-us/library/hh974416.aspx .
To Update the PXE server:

1.

Load the updated Windows PE boot image on the WDS server.

2.3.5

Boot the Surface Pro using the USB key.

You are now ready to deploy Windows 8 to the Surface Pro.

To Deploy Windows 8 using USB Boot:

1.
2.
3.

Attach the USB hub or docking station to the Surface Pro.

Insert the USB Ethernet adapter and the USB key into the USB Hub or docking station.
Press and hold the volume down button and then press the power button, continue to hold the
volume down button until the Surface starts to boot from the USB key.

The Surface Pro should now boot from the MDT Windows PE media and connect to your deployment
share and allow you to perform a normal deployment.
To Deploy Windows 8 using PXE Boot:

1.
2.

Attach the Surface Pro Ethernet Adapter to the Surface Pro.

Press and hold the volume down button and then press the power button, continue to hold the
volume down button until the Surface starts to boot from the USB key.

A dialog box will appear that states that it is Checking Media Presence. Then it will Start PXE over
IPv4.

3.

When prompted press Enter for network boot service.

The Surface Pro should now connect to your PXE server and allow you to perform a normal deployment.

Page 6

Deploy Windows 8 from an MDT media based deployment share

In this scenario we will deploy Windows 8 to a Surface Pro using a USB key that contains an MDT
Windows Media Deployment Share.
Surface requires bootable media that is formatted as FAT32. The problem with FAT32 is that it has a
maximum file size limitation of 4GB. This limitation is easily exceeded when deploying a custom Windows
image. To work around this issue you must to use USB media that supports multiple partitions:

1.
2.

A FAT32 boot partition.

A NTFS partition that contains an MDT Media Deployment Share.

The key to creating a USB Key with multiple partitions is to get the right type of USB key. Most USB keys
identify themselves as removable media, these keys cannot contain multiple partitions. The USB must
identify itself as fixed, the best type of key to perform this process is a key that is designed for Windows
To Go. The following site lists recommended Windows To Go keys http://technet.microsoft.com/library/hh831833.aspx.

3.1

Hardware requirements
For this scenario the following hardware is required:

1.
2.
3.

3.2

USB key (fixed)

USB hub or docking station
Ethernet connectivity

Driver requirements
A driver will be required for the USB Ethernet Adapter if it is not included as a Windows 8 inbox driver.
Please download the driver for the USB Ethernet Adapter from the hardware vendor. The Surface Pro
Ethernet Adapter requires a driver for Windows PE.

3.3

Implementation directions
The following section outlines the implementation steps for this scenario, the steps are:

1.
2.
3.
4.

3.3.1

Import Surface Pro Drivers into MDT.

Create a Windows MDT Media Deployment Share.
Prepare Bootable USB key.
Boot the Surface Pro using the USB key.

Import Surface Pro Drivers into MDT

The following steps outline how to import the Surface Pro drivers into MDT. The drivers required for the
deployment are broken down into two areas:

1.

Windows PE drivers

Page 7

2.

Windows drivers

Import Windows PE Drivers

It is critical that the driver for the USB Ethernet Adapter is included in the boot image. When managing
Windows PE drivers it recommended that you create an MDT selection profile that includes only the
drivers required for Windows PE to connect to the network and mass storage devices.

1.

Import the USB Ethernet Adapter driver and place it in the correct folder that you created for your
selection profile.

Import Windows Drivers

It is recommended that all of the Surface Pro drivers are injected into the Windows 8 driver store during
deployment. To perform this process we recommend that you use the Model Information collected via
WMI to group the drivers. The Surface Pro is identified as Surface with Windows 8 Pro.

1.
2.

In MDT create a driver folder for Surface Pro based on your driver deployment methodology.
Import the Surface Pro firmware and driver pack that you previously downloaded into MDT,
placing it in the folder that you created in the previous step.

3.

Update the Customsettings.ini file if required for Surface Pro. The following is provided as an
example:
[Settings]
Priority=Model,Default
Properties=DriverSelectionProfile
[Default]
[Surface with Windows 8 Pro]
DriverGroup001=Windows 8 - x64\Microsoft-SurfacePro
DriverSelectionProfile=nothing
XResolution=1920
YResolution=1080

Note The DriverSelectionProfile variable is critical to successfully injecting all of the required
drivers. This variable forces all of the drivers in the specified selection profile to be injected into
the Windows 8 driver store regardless of whether the device is detected at during deployment.
Some of the devices on the Surface Pro are not visible until other drivers are installed hence they
are not detected vid PnP enumeration and hence DriverSelectionProfile is required.

3.3.2

Create a Windows MDT Media Deployment Share.

A Media Deployment Share (DS) should now be created to deploy Windows 8 Surface Pro image.
To create a Media Deployment Share:

1.
2.
3.

In the MDT deployment Workbench navigate to your Windows 8 deployment share

Navigate to Advanced Configuration.
Right click Media and select New Media.

Page 8

4.

In the New Media field specify a folder that will store the Media Deployment Share files, for
example C:\Media.

5.
6.
7.
8.

Select an appropriate selection profile that contains all of the files required for deployment.
Click Next.
Click Next.
Click Finish.
The deployment share has now been initialized, next the settings for the Media Deployment Share
must be populated and then the deployment share.

9.

You should now see the Media Deployment Share, right click the Media Deployment Share and
select properties.

10. Select the Rules tab and update the rules as required for your deployment. Generally these rules
are copied from the deployment share that was used to create the Media Deployment Share.

11. Select the Windows PE tab and update the Windows PE Drivers and Patches selection profile as
required for your environment.

12. Click Ok.

13. Right click the Media Deployment Share and select Update Media Content.
14. When the update process is complete click Finish.

3.3.3

Create Bootable USB key.

The USB must now be formatted and configured with the Media Deployment Share. It is important to
verify that the drive is reporting itself as fixed.
To verify disk type:

1.

Insert the drive into a device and open My Computer:

1.1

If the drive shows up under Hard Disk drives: Fixed

1.2

If the drive shows up under Devices with removable Storage: Removable

To create a USB drive with multiple partitions perform the following steps:

1.
2.
3.

Open an elevated command prompt

Type in Diskpart and hit enter
Type in the following commands:
List disk
Sel disk <X> (where <X> is your USB drive number)
Clean
Create Part Primary size=2048
Assign
Active
Format fs=fat32 quick Label=Boot
Create part primary
Assign
Format fs=ntfs quick Label=Deploy
Exit

Page 9

Now the MDT media deployment files must be copied to the USB key, the following steps assume that
your MDT Media DS files are located in C:\Media.
To populate the Key with MDT Media DS files:

1.

Copy files to BOOT drive(FAT32)

1.1

Copy c:\media\content\boot folder to root of the BOOT drive

1.2

Copy c:\media\content\efi folder to root of the BOOT drive

1.3

Copy c:\media\content\autorun.inf, bootmgr, bootmgr.efi to root of the BOOT drive

1.4

Create Deploy folder in root of the BOOT drive

1.5

Copy c:\media\content\deploy\boot to Deploy folder in the BOOT drive

2.
2.1

Copy files to DEPLOY Partition(NTFS)

Copy c:\media\content\deploy folder to root of the DEPLOY drive

For further details on creating boot media for UEFI deployment please refer to the askcore blog.

3.3.4

Boot the Surface Pro using the USB key.

You are now ready to deploy Windows 8 to the Surface Pro.

To Deploy Windows 8:

1.
2.
3.

Attach the USB hub or docking station to the Surface Pro.

Insert the USB key into the USB Hub or docking station.
Press and hold the volume down button and then press the power button, continue to hold the
volume down button until the Surface starts to boot from the USB key.

The Surface Pro should now boot from the MDT Windows PE media and connect to your Media
Deployment Share and allow you to perform a normal deployment.

Page 10

Deploy Windows 8 using System Center Configuration Manager

2012 SP1
In this scenario we will deploy Windows 8 to a Surface Pro using System Center Configuration Manager
2012 SP1 OSD deployment. This scenario will cover deployment using three approaches:

1.
2.
3.

4.1

Network based deployment using PXE boot

Network based deployment using a bootable USB key
Media based deployment

Hardware requirements
The Surface Pro provides PXE boot support however you must use the Surface Pro Ethernet Adapter. If a
PXE adapter is not available then a USB key together with a USB Ethernet Adapter can be used instead.
To Boot to a network using PXE deployment the following hardware is required:

1.

Surface Pro Ethernet Adapter.

Important It is not recommended to deploy multiple machines with the same Ethernet Adapter. The
Surface Pro Ethernet Adapter has a fixed MAC Address. If the same Ethernet adapter is used to deploy
multiple machines with Configuration Manager they will be recognized as the same machine.
To boot to a network (non PXE) the following hardware is required:

1.
2.
3.

USB key at least 2GB (removable)

USB hub or docking station
Ethernet connectivity

To boot to media the following hardware is required:

1.
2.
3.

USB key at least 8GB (removable)

USB hub or docking station
Ethernet connectivity

Note - A fixed USB drive is not required when using Configuration Manager for USB based
deployments. Configuration Manager Splits WIM files that are over 4GB to meet the file size limit of
FAT32.

4.2

Driver requirements
A driver will be required for the USB Ethernet Adapter if it is not included as a Windows 8 inbox driver.
Please download the driver for the USB Ethernet Adapter from the hardware vendor. The Surface Pro
Ethernet Adapter requires a driver for Windows PE.

4.3

Implementation directions
The following sections outline the implementation steps for this scenario, the steps are:

Page 11

1.
2.
3.
4.

4.3.1

Import Surface Pro Drivers into Configuration Manager.

Prepare bootable USB key (USB Boot only)
Boot the Surface Pro using the USB key. (USB Boot and Media Deployment)
Boot the Surface Pro using PXE. (PXE Boot only)

Import Surface Pro Drivers into Configuration Manager

The following steps outline how to import the Surface Pro drivers into MDT. The drivers required for the
deployment are broken down into two areas:

1.
2.

Windows PE drivers
Windows drivers

Import Windows Drivers

It is recommended that all of the Surface Pro drivers are injected into the Windows 8 driver store during
deployment. To perform this process we recommend that you use the model Information collected via
WMI in conjunction with categories and driver packages to manage the drivers. The Surface Pro is
identified as Surface with Windows 8 Pro.

1.

Import the Surface Pro firmware and driver pack that you previously downloaded (Error!
Reference source not found.) into Configuration Manager, configuring the drivers based on your
driver deployment methodology.

Import Windows PE Drivers

It is critical that the driver for the USB Ethernet Adapter is included in the boot image.

1.

Import the USB Ethernet Adapter driver and add it to your x64 boot image, update the Boot image
on the distribution points when prompted.

4.3.2

Prepare Bootable USB key

Note - This step is not required when PXE boot is used or for media based deployments.

The USB key must now be prepared to boot to USB. This is performed by using the Configuration
Manager Create Task Sequence Media option.
To prepare the USB key:

1.
2.
3.
4.
5.
6.
7.

Insert the USB into a workstation that has the Configuration Manager Console installed.

8.

Click Yes to accept the warning message.

Launch the Configuration Manager Console.

Open Software Library and navigate to Overview \ Operating Systems.
Right click Task Sequences and select Create Task Sequence Media.
Select Bootable media then click Next.
On the Select how media find a management point pane select an option and click Next.
On the Specify a media type pane click USB flash drive, select the USB key, then click Next.

Page 12

Note Do not select the ISO option. You cannot create and ISO and then extract the contents of
the ISO to a USB key as it does not contain the correct boot files for UEFI.

9.

On the Select security settings for the media select the appropriate options for you organization,
click Next.

10. Select an x64 boot image and a management point, then click Next.
11. On the Customization pane, click Next.
12. On the Summary pane, click Next to begin creating the USB key.

4.3.3

Prepare Media Deployment USB key

Note - This step is only required for media based deployments.

The USB key must now be prepared to boot to USB. This is performed by using the Configuration
Manager Create Task Sequence Media option.
To prepare the USB key:

1.
2.
3.
4.
5.
6.
7.

Insert the USB into a workstation that has the Configuration Manager Console installed.
Launch the Configuration Manager Console.
Open Software Library and navigate to Overview \ Operating Systems.
Right click Task Sequences and select Create Task Sequence Media.
Select Standalone media then click Next.
On the Select how media find a management point pane select an option and click Next.
On the Specify a media type pane click USB flash drive, select the USB key, then click Next.
Note Do not select the ISO option. You cannot create and ISO and then extract the contents of
the ISO to a USB key as it does not contain the correct boot files for UEFI.

8.
9.
10.
11.

Click Yes to accept the warning message.

If required specify a media password, click Next.
Select a task sequence to deploy, click Next.
Select the Distribution Point from which to gather the content required by the task sequence, click
Next.

12. On the Customization pane, click Next.

13. On the Summary pane, click Next to begin creating the USB key.

4.3.4

Boot the Surface Pro using the USB key.

You are now ready to deploy Windows 8 to the Surface Pro.

To Deploy Windows 8 using USB Boot (Media and USB Boot):

1.
2.
3.

Attach the USB hub or docking station to the Surface Pro.

Insert the USB Ethernet adapter and the USB key into the USB Hub or docking station.
Press and hold the volume down button and then press the power button, continue to hold the
volume down button until the Surface starts to boot from the USB key.

Page 13

The Surface Pro should now boot from the Configuration Manager Windows PE media and connect to
configuration Manager and allow you to perform a normal deployment.
To Deploy Windows 8 using PXE Boot:

1.
2.

Attach the Surface Pro Ethernet Adapter to the Surface Pro.

Press and hold the volume down button and then press the power button, continue to hold the
volume down button until the Surface starts to boot from the USB key.

A dialog box will appear that states that it is Checking Media Presence. Then it will Start PXE over
IPv4.

3.

When prompted press Enter for network boot service.

The Surface Pro should now connect to your PXE server and allow you to perform a normal deployment.

For further details on creating bootable media please refer to - http://technet.microsoft.com/enus/library/bb632725.aspx

Page 14

Deploying Surface Pro drivers and firmware to a running

Operating System
A driver and firmware pack is provided that includes all on the drivers required for Surface Pro. These
drivers can be applied when an operating system is deployed to the Surface Pro or post deployment. This
section details how to deploy these drivers and firmware to an online machine.
Firmware Deployment
The pack includes firmware that are delivered in the form of a driver package. This is part of a UEFI feature
called capsule packages. These capsule packages can be installed several ways:

Published via Windows Update

Injected into an offline Windows image

Manually installed online

Note - They cannot be installed via Windows Software Update Service (WSUS).
The firmware is exposed to the machine as a device under the firmware node in device manager.

To update the firmware manually, install the driver package on the machine then Windows will seamlessly
take care of the update process for you. Once installed a flag is set for the loader and on restart all
available firmware updates are applied. During the boot process a dialog will appear that states installing
system updates.
Driver Deployment
All of the drivers within the pack can be installed manually by right clicking on the device in device
manager and selecting the appropriate driver to install. This is a laborious process. It is possible to
automate this process using a PowerShell script that calls the PnPUtil utility.
The following script iterates recursively through the pack and installs all of the drivers that it finds:
$ScriptPath = Split-Path -parent $MyInvocation.MyCommand.Definition
$files = get-childitem -path $Scriptpath -recurse -filter *.inf
foreach ($file in $files)
{
Write-host "Injecting driver $file"
pnputil -i -a $file.FullName
}

To use this script extract the driver pack and place the script in top level folder of the extracted zip file.
Then execute the script, it will install all drivers (including firmware). This could also be packaged into a
Configuration Manager package and deployed to existing machines.

Page 15

Page 16