Tutorials Archives | XOAP

How to automate AWS without using Terraform

Mario — Thu, 09 Oct 2025 10:52:34 +0000

<\/path><\/svg>"},"no_headings_message":"No headings were found on this page.","minimize_box":"yes","minimized_on":"tablet","hierarchical_view":"yes","min_height":{"unit":"px","size":"","sizes":[]},"min_height_tablet":{"unit":"px","size":"","sizes":[]},"min_height_mobile":{"unit":"px","size":"","sizes":[]}}" data-widget_type="table-of-contents.default">

If you’re managing AWS infrastructure, there’s a good chance Terraform is on your radar or already part of your pipeline.

However:
a) It’s not always necessary.
b) You might not need it at all.

The effort of writing HCL, managing state files and stitching together modules can slow things down, especially for operational tasks, account bootstrapping or cross-environment scripting.

If you want fast, simple and flexible AWS automation, XOAP can be a great option, with or without Terraform.

Is Terraform really necessary?

While Terraform is great for building infrastructure, not every task is about provisioning VPCs or load balancers.

Much of what DevOps and cloud teams do looks more like this:

• Applying security settings at scale.
• Running scripts across multiple accounts.
• Automating patching, updates or cleanup.
• Enforcing compliance across environments.
• Configuring operating systems or installing apps.

Read more about Securing AWS accounts automatically

Using XOAP

XOAP can provision infrastructure, not just manage existing environments. It does this through Scripted Actions and prebuilt automation templates that let you create and configure:

• EC2 instances.
• IAM roles and policies.
• VPCs and security groups.
• S3 buckets and encryption settings.
• GuardDuty, Config, CloudTrail and other AWS services.

Instead of declaring resources in HCL, you write scripts – or use ready-made ones available in your XOAP Workspace – that tell AWS exactly what to do, which gives you:

• More flexibility to define infrastructure your way.
• Easier cross-account and multi-region provisioning.
• The ability to use conditional logic, loops and dynamic inputs.
• Simpler onboarding with no need to learn Terraform internals.

XOAP can be your provisioning engine and your operations tool, especially if you prefer scripting over declarative IaC.

What this means in practice for AWS automation

By using your own scripts or XOAP’s pre-built templates, you can automate AWS tasks directly, across any number of accounts:

• Connect your AWS environments easily (via access key or role).
• Create production-ready Landing Zones fast.
• Run Scripted Actions using PowerShell, CLI or your preferred language.
• Apply changes instantly or schedule them across time zones and regions.
• Automate configuration, security, updates and more.

No IaC or state files. Just automation that works at scale.

Read more about Automating entire AWS operations

Example: Automating patching across all your EC2s

Let’s say you want to update EC2 instances with security patches across five AWS accounts.

With Terraform, that means modeling your EC2 fleet declaratively, managing dependencies and state updates, and possibly writing a custom provider or pulling in external data.

With XOAP, it’s a Scripted Action: you select a patching script, pick the accounts and hit run.

Scripted Actions can also be scheduled to keep it fully automated.

This way, you get:

➜ Secure access to each account.
➜ Parallel execution across regions.
➜ Logging, audit trails and notifications.

Read more about Automating Amazon DCV deployment

Already using Terraform? Even better!

If your team already uses Terraform for provisioning, keep going. XOAP isn’t here to replace it, but to complement it.

While Terraform covers infrastructure provisioning, XOAP handles:

• Day-2 operations like updates, restarts or application installations.
• Cross-account orchestration, particularly when it involves configuration that goes beyond the platform’s capabilities.
• Conditional flows based on runtime state, like remediation scripts.
• Orchestration of operational sequences.
• Central view of execution history and logs.

You can even trigger XOAP actions via API to keep your workflows clean and modular.

Try XOAP now

If you’re spending time on repetitive tasks, dealing with multi-account complexity or just want a simple path to automation, XOAP can help. And if you’re already deep into Terraform, XOAP goes a step beyond.

Read also:
→Automating entire AWS operations
→Securing AWS accounts instantly
→Automating Amazon DCV deployment

Terraform is a registered trademark of HashiCorp, Inc. XOAP is not affiliated with or endorsed by HashiCorp.
Results may vary depending on AWS account configuration, access permissions and workload complexity.

Simple and flexible automation

The post How to automate AWS without using Terraform appeared first on XOAP.

How to automate AWS CIS hardening

Stella — Tue, 30 Sep 2025 07:00:39 +0000

If you manage cloud environments, you already know that security is non-negotiable, but it can slow everything down – especially when you’re spinning up new AWS accounts.

Every time you add a new account, there’s a long list of things to do: configure logs, enable GuardDuty, tweak IAM policies, block public S3 access… and so on. It’s tedious, time-consuming, and easy to get wrong.

So we built a better way! With XOAP, your AWS accounts can be CIS compliant the moment you connect them.

Why the CIS AWS benchmark matters

The CIS AWS Foundations Benchmark is a set of best practices designed to help secure AWS environments. It covers things like:

Logging and monitoring
Identity and access management
Network protections
Encryption settings
Regional coverage

Following these guidelines helps reduce risk and improve your security posture. The problem? Actually applying all of this manually isn’t simple.

Read more about CIS compliance

The problem with manual hardening

Here’s how it usually works:

A new AWS account gets created.
Someone (usually a DevOps or security engineer) goes through a checklist.
They set up CloudTrail, enable Config, turn on GuardDuty, enforce MFA, etc.
Repeat for every region and every new account.

This process is not only repetitive, but it also introduces inconsistencies, especially as your environment grows.

The fix: XOAP’s automated AWS CIS hardening

Instead of doing all that manually, XOAP lets you automate the entire process in just a few clicks. Here’s how it works:

1. Connect your AWS account

Head to your XOAP Workspace, go to Connections and add your AWS account. The setup only takes a few minutes.

2. Choose the CIS hardening script

Open Scripted Actions, click New, and select the Resource: aws-ps-account-hardening.ps1. It’s pre-built and ready to go.

3. Run now or schedule it

Run the action immediately or schedule it to run automatically at the desired time (your choice).

4. Done! Start using your hardened AWS account

That’s it. The script applies all CIS-aligned settings behind the scenes. No extra tools needed.

What XOAP configures for you

When you run the CIS hardening script, XOAP automatically configures:

CloudTrail: Multi-region, KMS-encrypted, with log file validation
AWS Config: Recording and delivery set up across your regions
Security Hub: Enabled per region and subscribed to the CIS standard
GuardDuty: Turned on and actively managed
S3: Public access blocked; SSL-only enforced via bucket policies
EBS/EC2: Default encryption enabled with your customer-managed keys
VPC: Flow logs on; optional tightening of admin ports
IAM: Strong password policy; optional MFA enforcement for console access.

All of this happens automatically, in minutes.

Why this makes a difference

Cloud teams today are moving fast and security can’t be an afterthought. With XOAP:

New accounts are secured instantly – no lag, no risk.
You get consistency at scale – the same secure setup across all environments.
Compliance is easier – CIS-aligned settings are mapped and exportable.
You don’t need to write scripts – we’ve already done that part.

Whether you’re managing a few accounts or hundreds, this saves time and reduces mistakes significantly.

Read more about CIS-ready AWS accounts

Try it now

There’s no reason to spend hours manually securing every new AWS account. It’s repetitive and pulls your team away from more valuable work.

With XOAP, CIS hardening becomes automatic. The moment an account is connected, it’s configured with security best practices: no guesswork, no delays. You get consistent, reliable security at scale without slowing anything down.

It’s a straightforward fix to a real problem. If you’re managing cloud environments and care about getting security right from day one, this is how you do it.

Please note: The hardening script is automatically available for all new XOAP accounts. If you’re an existing XOAP user, please contact us to get the script.

We cover instant AWS account security in the Automation Talks podcast
If the video does not load, adjust your cookie preferences or watch it directly on YouTube.

Helpful info:
→How to connect your infrastructure
→Automate your entire AWS operations
→Centralized script automation

CIS-ready AWS accounts

The post How to automate AWS CIS hardening appeared first on XOAP.

How to migrate from VMware to Nutanix using XOAP

Stella — Thu, 18 Sep 2025 09:22:15 +0000

Across industries, organizations are reassessing their virtualization strategies. As licensing models evolve and support costs rise, many IT teams are looking for more flexible, cost-effective platforms, without compromising performance or security.

Nutanix AHV has become a popular choice for modern enterprises. It’s tightly integrated with the Nutanix ecosystem, and built for operational simplicity. However, making the transition from VMware ESXi to AHV is no small task.

This is exactly where XOAP helps.

XOAP offers a systematic, automated and consistent method for migrating workloads from VMware to Nutanix.

VMware to Nutanix: Migration guidelines

Step 1: Assess your current environment

A successful migration starts with a complete and accurate understanding of your existing VMware infrastructure. Assess the following:

VM inventory (including OS, CPU, memory, and storage)
Oversized VMs or workloads with specific resource constraints
Application dependencies and inter-VM communication
Network architecture, including VLANs and IP mappings
Storage performance requirements and capacity utilization

Step 2: Plan the migration strategically

Rather than treating all workloads the same, segment and prioritize based on:

Business criticality and downtime sensitivity
Migration complexity (e.g., shared storage, networking requirements)
Resource usage patterns
Organizational or compliance requirements
Application owner input and change windows

Step 3: Choose the easiest migration method (XOAP)

Create platform-independent VM images

XOAP allows you to build virtual machine images that work across different platforms, cloud or on-prem. You don’t have to rebuild your environment every time you switch providers; this saves time and keeps your infrastructure consistent.

Automate your setup and delivery

With XOAP, you can automate the entire setup – from provisioning servers to deploying applications. This reduces manual work, avoids human errors, and makes sure everything is repeatable.

Create a modular and reusable delivery pipeline

XOAP uses modular components you can reuse across different projects. Once you build a process, you can apply it anywhere; it also makes it easier to update parts of your pipeline without breaking everything.

Scale fast to other platforms

Need to move to another cloud or expand to multiple regions? XOAP supports fast, consistent scaling across providers – no need to redesign your pipeline; just connect a new platform and run.

No vendor lock-in

XOAP is cloud-agnostic. Whether you’re on AWS, Azure, Google Cloud, or on-premises infrastructure, you’re not tied down – you can switch platforms without starting from scratch.

Keep know-how internal

XOAP keeps the migration process in your hands. Instead of relying on outside consultants, your internal team owns the setup, delivery, and scaling; this protects your know-how and builds in-house expertise over time.

Why migrate with XOAP?

Migrating with XOAP takes the stress out of moving from VMware to Nutanix by making the process simple, consistent, and automated. It keeps your systems properly configured without needing extra agents, gives you instant visibility through ready-to-use dashboards, and makes it easy to deploy applications or build images at scale no matter where your systems live.

Make the switch without the stress

Moving from VMware to Nutanix AHV can feel like a challenge, but XOAP makes it very straightforward. It handles the tough parts behind the scenes, keeps your systems aligned, and lets you see exactly what’s happening along the way.

No complicated setups or manual fixes – just a clear, reliable process that helps you get the job done faster and with less stress. With XOAP, migrating becomes less of a project and more of a smooth step forward.

Migrate from VMware to Nutanix

The post How to migrate from VMware to Nutanix using XOAP appeared first on XOAP.

Automating Amazon DCV deployment with XOAP

Ante — Mon, 18 Aug 2025 13:05:47 +0000

Amazon DCV (formerly NICE DCV) offers a high-performance, secure solution for delivering remote desktops and 3D applications. However, setting up DCV infrastructure manually can be time-consuming and prone to errors.

This blog post walks you through the automation process using AWS tools and XOAP to simplify the deployment of Amazon DCV.

How does it work?

Using prebuilt scripts, XOAP’s Image Management module and the Scripted Actions feature, you’ll spin up a fully functional Amazon DCV environment efficiently, reducing setup time, ensuring consistency and enabling rapid scaling in the cloud.

You can test everything in this tutorial for free, as both Image Management and Scripted Actions are available in XOAP’s free plan. Just create your account first.

The Amazon DCV deployment will take five steps:

Download a script from AWS.
Change the username in the script and upload it to XOAP.
Create a connection to your AWS environment.
Prepare your image for DCV deployment with Image Management.
Spin up the DCV infrastructure with Scripted Actions.

Let’s go into the details now.

Step 1: Downloading script from AWS

Download the script from the official AWS GitHub repository here. You can find the documentation in the AWS Administrator Guide.

Step 2: Uploading script to XOAP

Now, let’s edit the script quickly before uploading it:

• Remove the first and last lines of code: and .

• Replace the placeholder “USERNAME” in line 51 with a valid username.

• Remove the comments from lines 49 to 52 (optional, but considered a good practice).

To upload the script, open your XOAP Workspace and go to the Resources area in the left-side menu. Click + New Resource, then simply drag and drop the script. Click Next and Save.

For more information on the script’s syntax, click here.
The DCV license is free on EC2, with a required S3 policy.

Follow the Amazon DCV automation video tutorial

This video may not load due to your cookie preferences. Adjust your cookie settings or watch it directly on YouTube.

Step 3: Creating a connection to your AWS environment

In XOAP, connections are used to deploy image definitions, as well as to provision and configure cloud and on-premises environments.

• Go to Connections in the left-side menu.
• Click + New Connection.
• Select AWS as the provider and choose the connection type.
• If you’re using the AWS-Access Key type, provide your Access Key ID, Secret Access Key and Account ID.
• Click Confirm to save the connection.

Step 4: Preparing image for DCV deployment

The next step is Image Management. It’s a custom image automation module that can be found in your XOAP Workspace.

First, create a provisioner:

• Click on Image Management, then click on Provisioners in the drop-down menu.
• In the Provisioners area, click + New Provisioner.
• Under Select Type, choose PowerShell Script.
• Under Source File, select Install-DCV.ps1, the script you uploaded to XOAP.
• Enter the mandatory information and click Confirm.

Adding a provisioner in XOAP

Now, add that provisioner to a group:

• Go to Image Management > Provisioner Groups.
• Click + New Provisioner Group and select the provisioner you’ve created from Available Provisioners.
• Enter the details and click Save.

Add the group to a provisioner role:

• Go to Image Management > Provisioner Roles.
• Click + New Role and select the group you created from Available Provisioner Groups.
• Enter the details and click Save.

Note:

Each XOAP Workspace is equipped with Operating Systems that can be used as templates for further customizations. Operating system availability depends on the region and may vary. If your region is not available and you would like to adjust the operating system, you can add additional ones as needed.

The same applies to Builders, which define the connection being used, the region, the size of the VM defined to build the image and additional optional settings. You can create them before the next step or add them while defining the Image Definition.

• Now go to Image Management > Image Definitions and click + New Image. Here you will create your image – see screenshot below as a reference. If you need help creating the image, watch this short video tutorial.

Creating an image

Once your image is created, it will appear in Image Definitions.

• Click the three dots on the right in the image’s row, then click Run.

You can track the progress of the Image Definition build by either clicking on the status badge or by clicking on Runs in the upper right corner.

Once the run is finished, in the Image ID field, you will see the ID as ami-xxxxxxxxxxxxxxxxx.
It’s good to save the image ID now, as you will need it to spin up you DCV infrastructure later.

Important:
• If you don’t have it in your XOAP Workspace already, download the EC2 provisioning script below and upload it to the Resources area, just like you did with the first AWS script.

Tutorial continues below

Download the EC2 provisioning script

Step 5: Spinning up DCV infrastructure

Now that you’ve uploaded the EC2 provisioning script to Resources, let’s move to Scripted Actions.

You will find this feature in your XOAP Workspace under the Platform Management module, which helps you automate hybrid infrastructures and cloud workflows.

• Go to Platform Management > Scripted Actions and click + New Scripted Action.
• Enter a Name for this scripted action.
• Under Choose a script from Resources, select the EC2 provisioning script.
• Click Next.

Creating a scripted action

• Edit script parameters as shown below.

Important:

Under AMI_ID, use the Image ID from your Image Definition run. Specify the region where you want the EC2 instance to be created, along with the SUBNET_ID of the VPC where you want the instance to be placed. Make sure you choose the same region that was specified in your Image Definition. Otherwise, the AMI won’t be found, as they are region-specific.

Editing script parameters

• When everything’s ready, click Next.

• Select AWS from the Connections table and click Next.

• In the final scripted action creation step, you can schedule your scripted actions. We can skip that for now, so just click Finish.

The scripted action is now created and you can run it the same way you ran your Image Definition. If you want to track the progress, click on the status badge right next to the scripted action. Once the run is finished, the DCV will be ready.

You can find all the information necessary for connecting to the DCV in the scripted action’s log. To access the log, click the three dots on the right side in the scripted action’s row and click View log.

Example of a scripted action’s log

To connect to the DCV, you can use web access or the Amazon DCV client, which is available for download from AWS. Be mindful of the required Security Group rules when connecting. Direct access to the instance will be required (for web access, you will need a public facing instance).

Alternatively, you can deploy the Amazon DCV client to your endpoints worldwide using XOAP’s Application Management module. Application Management automates and simplifies software packaging and delivery to any device. This way, you can easily create a remote access solution for your endpoints.

Did we miss something? If you need help using XOAP to automate Amazon DCV deployment, just book a call and our engineers will walk you through it.

More about XOAP:
→ More on Application Management
→ Automating your entire AWS operations
→ Standardized image automation across platforms
→ Scripted Actions for centralized script management

Start automating your cloud infrastructure with XOAP

The post Automating Amazon DCV deployment with XOAP appeared first on XOAP.

Set IGEL RDP collections on the latest OS12 RDP app: A workaround

Mario — Thu, 22 May 2025 08:33:14 +0000

In IGEL OS 12, the ability to configure RDP collections via the GUI is currently not available. This can be a limitation for users in terminal server environments where managing multiple RDP session collections is crucial. In particular, environments that do not rely on Citrix or other solutions may face difficulty when trying to use RDP collections.

While this feature is not yet supported in the GUI, there is a simple workaround to configure RDP collections manually.

The workaround

Although the OS12 RDP App does not offer a direct option for configuring RDP collections through the graphical interface, you can still achieve this configuration by modifying the registry.

To configure the RDP collection, you need to set the following registry key:

				
					app.rdp.sessions.rdp0.options.load-balance-info

This registry tweak allows you to specify the load-balance info string, which is essential for RDP collections to function properly.

Why this matters

For those working in Microsoft RDS environments, especially in thin client deployments, configuring RDP collections is often a key part of session management. By using this workaround, you can continue to deploy IGEL thin clients effectively, even without the GUI option for RDP collection configuration.

Although this feature is not yet available in the GUI, this workaround ensures that you can maintain an efficient terminal server environment while waiting for future updates.

A story from one of our customers:
>> Windows Remote Desktop Services infrastructure delivery and standardization

Automate Remote Desktop Services with XOAP

The post Set IGEL RDP collections on the latest OS12 RDP app: A workaround appeared first on XOAP.

Firewall setup for Intune AD Connector in legacy systems

Mario — Fri, 02 May 2025 11:54:21 +0000

Modern endpoint management with Microsoft Intune enables IT teams to automate device provisioning and management processes, including Windows Autopilot scenarios and Hybrid Azure AD Join.

However, not every organization operates in a greenfield environment.

Legacy infrastructures, often found in healthcare, public sector, education or manufacturing come with specific challenges:

No Application Control features in firewalls
No Host-based Ruleset automation
No wildcard support for FQDN-based rules
Manual IP address maintenance is required

This blog post outlines how to design a secure and operationally manageable firewall configuration for the Intune Connector for Active Directory, even in restricted and technically outdated environments.

The challenge

The Intune Connector for Active Directory requires outbound communication to various Microsoft cloud services to function properly. However, in legacy environments, this can present some challenges:

No wildcard support in the firewall (no *.microsoft.com)
No Application Control feature available
Only specific IP addresses or FQDNs can be configured
Firewall rules must be maintained manually

Recommended technical approach

Step 1: Identify required endpoints

Microsoft provides official documentation listing all required URLs and IP address ranges for Microsoft 365 services and Intune:

Focus Categories for Intune Connector:

Microsoft 365 Common & Office Online
Intune
Azure Active Directory

Optional for Automation: Microsoft’s Endpoint API provides a machine-readable JSON file for automated processing (more here).

Step 2: Firewall ruleset design

Define dedicated outbound rules for the Intune Connector server.

Note: If DNS resolution is restricted, IP addresses must be resolved manually and configured explicitly in the firewall.

Step 3: Operational process for IP maintenance

Since Microsoft services evolve continuously, it’s essential to establish a reliable process for maintaining firewall rules.

Recommended steps:

Monthly check of the official Microsoft documentation.
Optional: PowerShell script querying the Microsoft Endpoint API for changes.
Generate an automated notification or create a ticket for the firewall team.
Keep documentation updated with the current IP ranges and URLs.

Step 4: Automation pipeline flow

Update IP Addresses: Automated PowerShell script pulls the latest Microsoft Endpoint API data.
Update DSC Config: IP addresses are dynamically injected into the DSC configuration template.
XOAP Deploy: XOAP pulls the new configuration and applies it to the target firewall servers.
Compliance check: XOAP runs a configuration compliance scan to validate correct deployment.

Read more about automated firewall changes with XOAP below ↓

Best practices for firewall management in legacy environments

Long-term optimization options

Organizations should evaluate possible optimizations over time:

Upgrade firewall systems to support Application Control features.
Implement transparent or explicit proxy solutions.
Utilize Microsoft Azure Service Tags for dynamic IP management.
Consider Azure Firewall or modern next-generation firewalls for cloud-centric environments.

Automation use cases

Fully automated firewall changes with XOAP's Configuration Management

XOAP’s Configuration Management makes it easy to define, version and automatically deploy configuration settings across systems, including firewalls, servers, and other infrastructure components.

By using Config as Code principles alongside PowerShell Desired State Configuration (DSC), firewall rules can be fully automated, audited, and enforced across multiple environments.

XOAP integration provides:

Related: Automate firewall changes with XOAP

Final thoughts

Running Intune Connector for Active Directory in environments with strict firewall rules is possible. It just takes the right setup and processes. By creating clear firewall rules, managing IPs and keeping good documentation, even older systems can safely connect to Microsoft cloud services.

Use XOAP for automated firewall changes

The post Firewall setup for Intune AD Connector in legacy systems appeared first on XOAP.

Complete Windows 11 migration guide for enterprise IT

Mario — Mon, 28 Apr 2025 11:03:10 +0000

Migrating from Windows 10 to Windows 11 isn’t just about installing a new version. It involves checking your devices, making sure apps work, and managing the user experience. Without the right tools, this can be a tricky process.

XOAP gives you a platform to handle all of it. Whether you’re working with a handful of devices or thousands, XOAP provides the right tools for imaging app deployment and system configuration.

Check upgrade readiness

Before you begin, make sure your devices meet these basic requirements:

Devices need to be running a supported version of Windows 10.
They must meet the minimum hardware requirements for Windows 11.
Secure Boot should be turned on in the BIOS, and TPM 2.0 should be available.
Use the latest drivers for Windows 11 to avoid issues like Blue Screen errors.

Tools for checking device eligibility

Use these tools to check if your devices are ready for Windows 11:

PC Health Check app
WhyNotWin11
Windows Update in Settings

Windows 11 migration phases

We’ve outlined the migration process in three main phases below. For a quick guide on what it takes to migrate devices to Windows 11, check out this blog: Windows 11 migration made easy with XOAP.

1. Pre-migration

This phase is all about getting everything ready before upgrading. Check your hardware and drivers, test your apps for compatibility, prepare your Windows 11 images, and confirm that all system settings are correct. XOAP’s tools can help you run these checks automatically.

Start by checking hardware and drivers across all devices. XOAP’s reporting and scripting tools can help you automate these readiness checks and spot any issues early. Next, test application compatibility using the Application Management module to identify apps that may need updates or adjustments.

Prepare your Windows 11 images with Image Management, making sure they include the right settings and software. Review Group Policy settings and system configurations, and use Configuration Management to automate these checks. Finally, use the same tool to apply security baselines and hardening policies so that all systems meet your organization’s compliance standards.

2. Migration

Now it’s time to actually deploy Windows 11.

Pick a deployment method (Autopilot, SCCM, Intune, PSADT, or XOAP) and test it first. Then use XOAP to handle app installs and system settings across all your devices.

VIDEO TUTORIAL: Migrating to Windows 11 using XOAP
Blog article continues below

This video may not load due to your cookie preferences. Adjust your cookie settings or watch it directly on YouTube.

Read the full tutorial: How to migrate to Windows 11 with XOAP

3. Post-migration

Once Windows 11 is installed, it’s time to make sure everything works as it should.

Run clean-up tasks like removing temporary files, updating apps, and checking system settings. XOAP can automate these tasks to save time.

Custom actions let you run specific tasks like removing Windows.old folder, installing missing language packs, or managing app compliance using scripts in XOAP. This can greatly improve your migration strategy, especially when you’re not using SCCM task sequences.

You may also be interested in:
Windows 11 migration via SCCM
Step-by-step: Windows 11 migration using GPOs and registry keys
Migration to Windows 11 with PSADT
How to migrate to Windows 11 via Windows Update in Settings

What this means for your team

Migrating to Windows 11 is a good time to review how your systems are managed. It’s not just about getting to the latest OS – it’s a chance to clean up old processes, fix what’s slowing things down and set up a simpler way to handle future updates.

Look at what worked, what didn’t and where automation or better visibility could save time. A solid approach now will save you from scrambling later.

Our platform can help you simplify that process. By automating key tasks and providing better insights, it makes future updates easier to manage.

Make Windows 11 rollout simple with XOAP

The post Complete Windows 11 migration guide for enterprise IT appeared first on XOAP.

Migrate to Windows 11 with PSADT

Perica — Fri, 25 Apr 2025 11:11:25 +0000

In our previous blog posts, we explored different approaches to migrating to Windows 11: using SCCM, through XOAP, via GPOs and registry keys and Windows Update in Settings . In this post, we’ll walk you through yet another method – deploying the Windows 11 upgrade package using our PowerShell App Deployment Toolkit (download it here for free).

Watch:
Introduction to PSADT
Install and configure PSADT
Create PSADT packages

Use PSADT to migrate from Windows 10 to Windows 11

To get started, extract the contents of your Windows 11 ISO file and include them in your PSADT package. Then, you’ll use the setup.exe file from the extracted ISO along with specific command-line parameters to upgrade from Windows 10 to Windows 11.

Once you’ve got your source file ready, it’s time to modify the “Deploy-Application.ps1” script. In the pre-installation part, it will check if a scheduled task exists and delete it (in case of failures/reruns).

				
					#### (Pre-Install) Delete Scheduled Task -------------------------------------------->
$DELTaskName = 'Win11Upgrade'
# Check if the task exists
$DELTaskExists = Get-ScheduledTask -TaskName $DELTaskName -ErrorAction SilentlyContinue
if ($DELTaskExists) {
    # Delete the task
    Unregister-ScheduledTask -TaskName $DELTaskName -Confirm:$false
    Write-Output "(Pre-Install) Task '$DELTaskName' has been deleted."
} else {
    Write-Output "(Pre-Install) Task '$DELTaskName' does not exist.  Moving on to Installation"
}

In the installation part, a scheduled task will be created and started. While loop is used to check if the task is still running after it was started.

				
					 ###># CREATE SCHEDULED TASK -------------------------------------------------------->
    $STExecutable = "$dirfiles\ISO\Setup.exe"
    $STArguments = "/Auto Upgrade /EULA accept /NoReboot"
    $STTaskName = "Win11Upgrade"
    $STTriggerTime = (Get-Date).AddSeconds(15)
    $STPriority = 4
    $STTrigger = New-ScheduledTaskTrigger -Once -At $STTriggerTime
    $STSettings = New-ScheduledTaskSettingsSet -StartWhenAvailable -Priority $STPriority -RunOnlyIfNetworkAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
    # Create a new scheduled task action
    $STAction = New-ScheduledTaskAction -Execute $STExecutable -Argument $STArguments -WorkingDirectory (Split-Path $STExecutable)
    # Create a new scheduled task principal for the SYSTEM account
    $STPrincipal = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    # Create and register the new scheduled task
    $STTask = New-ScheduledTask -Action $STAction -Trigger $STTrigger -Settings $STSettings -Principal $STPrincipal
    Register-ScheduledTask -TaskName $STTaskName -InputObject $STTask

    #### KICK OFF SCHEDULED TASK ------------------------------------------------------>
    Start-Sleep 10
    Start-ScheduledTask -TaskName "Win11Upgrade"
    #### MONITOR SCHEDULED TASK ------------------------------------------------------->
    $STTaskName = "Win11Upgrade"
    # Loop until the task is no longer running
    while ((Get-ScheduledTask -TaskName $STTaskName).State -eq "Running")
    {
        # Get task information
        $taskInfo = Get-ScheduledTaskInfo -TaskName $STTaskName
        # Verify if the task is being run by SYSTEM
        if ((Get-ScheduledTask -TaskName $STTaskName).Principal.UserId -eq "SYSTEM")
        {
            # Write to the output
            Write-Output "$STTaskName is still running as SYSTEM"
        }
        else
        {
            Write-Output "$STTaskName is still running, but not as SYSTEM"
        }
        # Wait for 10 seconds before checking again
        Start-Sleep -Seconds 10
    }
    Write-Output "$STTaskName has finished running"

In the post-installation part, created scheduled task is deleted.

				
					#### (Post-Install) Delete Scheduled Task -------------------------------------------->
    $DELTaskName = "Win11Upgrade"
    # Check if the task exists
    $DELTaskExists = Get-ScheduledTask -TaskName $DELTaskName -ErrorAction SilentlyContinue
    if ($DELTaskExists) {
        # Delete the task
        Unregister-ScheduledTask -TaskName $DELTaskName -Confirm:$false
        Write-Output "(Post-Install) Task '$DELTaskName' has been deleted."
    } else {
        Write-Output "(Post-Install) Task '$DELTaskName' does not exist."
    }

There are a couple of options to consider if you want to expand on this package:

Add Windows 11 prerequisites check
Expand it with PSADT functions like:
– Show-InstallationWelcome
– Show-InstallationProgress
– Show-InstallationRestartPrompt
Adjust available scheduled task options:
– RunOnlyIfNetworkAvailable
– AllowStartIfOnBatteries
– DontStopIfGoingOnBatteries
Add other parameters to setup.exe run (for example “/Product Server” as a workaround for the prerequisites check)

You're good to go!

Upgrading to Windows 11 with PSADT is a flexible option if you want more control over the process. With a few script tweaks, you can handle the upgrade from start to finish.

You may also like:
→Windows 11 migration via SCCM
→Step-by-step: Windows 11 migration using GPOs and registry keys
→Windows 11 migration made easy with XOAP
→How to migrate to Windows 11 via Windows Update in Settings

The post Migrate to Windows 11 with PSADT appeared first on XOAP.

Windows 11 migration made easy with XOAP

Perica — Wed, 23 Apr 2025 12:27:04 +0000

This quick guide shows how to upgrade Windows 10 devices to Windows 11 using XOAP. The example uses Lenovo T490s and walks through setting up driver and application groups, then deploying them through XOAP. You can apply the same approach to your own device type. If you need assistance, contact us here. Let’s get started!

Upgrade to Windows 11 with XOAP: Simple steps

In this example, we are going to configure the migration for Lenovo T490s devices.

Inside XOAP’s Application Management, we have created 2 Application Groups from our Applications:

Lenovo T490s (installs Windows 11 drivers for Lenovo T490s)
Migration to Windows 11 24H2 (installs Windows 11 24H2 as an in-place upgrade)

To create an application group for driver installation, you need to:

- Download the corresponding driver package for your device from a manufacturer’s web page (for our example: Lenovo PC Support – ThinkPad T490s).
- Extract and package those drivers using PSADT. For the installation part, you can use the following command inside PSADT: pnputil /add-driver $dirFiles\tp_t490s_x390_w11_22_202210\*.inf /install /subdirs
- Import the created PSADT Package in XOAP: Application Management > Applications > New Application.

After that, you can navigate to Application Groups and create an Application Group using the imported application. Application Management > Application Groups > New Group.

WATCH VIDEO
2-minute overview of the migration processTutorial continues below

This video may not load due to your cookie preferences. Adjust your cookie settings or watch it directly on YouTube.

In the New group window, set the name for the application group and search for your imported application. Once you find the correct application, go to Add Group and choose your installation settings for that package.

When creating an Application group from Windows 11 24H2 Application, there area a couple of options to choose from:

- AllowStartIfOnBatteries
- DontStopIfGoingOnBatteries
- RunOnlyIfNetworkAvailable
- SkipPrereqCheck (skips all prerequisite checks for Windows 11)

After that, we create an Application Role from those 2 Application Groups.

After the Application Role is created, we have to create a Configuration Group, inside of XOAP’s Configuration Management, by choosing our Application Role and XOAP_Applications_and_Monitoring configuration.

Then, download the registration script and deploy it to clients. Once the configuration is started on clients, both of our packages (Drivers and Win11) are going to prompt for user confirmation before installing and for a restart after installation.

All set!

That wraps it up. Once everything’s in place, XOAP takes care of the upgrade. Just adjust the steps for your own devices and you’re good to go.

You may also like:

→Complete Windows 11 migration guide for enterprise IT
→How to migrate to Windows 11 via Windows Update in Settings
→Windows 11 migration via SCCM
→Step-by-step: Windows 11 migration using GPOs and registry keys

Migrate to Windows 11 with XOAP

The post Windows 11 migration made easy with XOAP appeared first on XOAP.

Step-by-step: Windows 11 migration using GPOs and registry keys

Perica — Wed, 16 Apr 2025 11:55:10 +0000

If you’re planning to upgrade your devices to Windows 11, there are several ways to go about it. In our previous blog post, we showed how to use the Windows Update settings to start the upgrade.

In this post, we’ll focus on using Group Policy Objects (GPOs) and registry keys to manage the migration. Even if you’re using Windows Update to deploy updates, you can still control how and when Windows 11 is offered to eligible devices.

By setting the right policies, you can make sure the upgrade process fits your organization’s needs.

Guide: Windows 11 migration using GPOs/registry keys

If you are deploying updates using Windows Update, there is still a possibillity to control their delivery using different GPOs. And if you set/change proper policy, Windows 11 will be deployed on your devices if they are eligible to upgrade.

How to specify target Feature Update version in Windows 10

A new TargetReleaseVersion policy available in Windows 10 version 1803 and higher allows you to specify which feature update version of Windows 10/11 you would like your computer to move to and/or stay on until the version reaches the end of service or you reconfigure this policy.

If you don’t update this policy before the device reaches end of service, the device will automatically be updated once it is 60 days past end of service for its version.

If you specify a TargetReleaseVersion the same as the current version, Windows 10 will stay on this version until it reaches the end of service. This can also be useful to block an automatic upgrade to Windows 11.

If you specify a TargetReleaseVersion higher than the current version, Windows 10/11 will directly update only to the specified version, even if a higher version is available.

Specify target Feature Update version in Local Group Policy Editor

Open the Local Group Policy Editor.
Navigate to the location below in the left pane of Local Group Policy Editor (see screenshot below);
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update.

In the right pane of Windows Update for Business in Local Group Policy Editor, double click/tap on the Select the target Feature Update version policy to edit it (see screenshot above).
Select (dot) Enabled (see screenshot below).
Perform the following steps under Options:
Type which Windows product version would you like to receive feature updates for? E.g, Windows 10: Windows 11.
Type the version (e.g, “21H1”) you want to specify in the Target Version for Feature Updates: 24H2.
Click/tap on OK.

If you want to set the same options via registry keys, use the following key and values:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
“ProductVersion”=”Windows 11”
“TargetReleaseVersion”=dword:00000001
“TargetReleaseVersionInfo”=”24H2”

You can see a list of Windows 10 versions to use as a value in the Windows 11 release information table.

And you're done!

That’s it, your Windows 11 migration using GPOs and registry keys is complete. With these steps in place, your devices should upgrade smoothly and stay on track. Keep testing, keep things backed up and you’ll be good to go.

You may also like:
→How to migrate to Windows 11 via Windows Update in Settings
→Windows 11 migration via SCCM
→Windows 11 migration made easy with XOAP

The post Step-by-step: Windows 11 migration using GPOs and registry keys appeared first on XOAP.

Tutorials Archives | XOAP

How to automate AWS without using Terraform

Table of contents

Is Terraform really necessary?

Using XOAP

What this means in practice for AWS automation

Example: Automating patching across all your EC2s

Already using Terraform? Even better!

Try XOAP now

How to automate AWS CIS hardening

Table of contents

Why the CIS AWS benchmark matters

The problem with manual hardening

The fix: XOAP’s automated AWS CIS hardening

1. Connect your AWS account

2. Choose the CIS hardening script

3. Run now or schedule it

4. Done! Start using your hardened AWS account

What XOAP configures for you

Why this makes a difference

Try it now

How to migrate from VMware to Nutanix using XOAP

Table of contents

VMware to Nutanix: Migration guidelines

Step 1: Assess your current environment

Step 2: Plan the migration strategically

Step 3: Choose the easiest migration method (XOAP)

Create platform-independent VM images

Automate your setup and delivery

Create a modular and reusable delivery pipeline

Scale fast to other platforms

No vendor lock-in

Keep know-how internal

Why migrate with XOAP?

Make the switch without the stress

Automating Amazon DCV deployment with XOAP

Table of contents

How does it work?

Step 2: Uploading script to XOAP

Step 3: Creating a connection to your AWS environment

Step 4: Preparing image for DCV deployment

Download the EC2 provisioning script

Step 5: Spinning up DCV infrastructure

Set IGEL RDP collections on the latest OS12 RDP app: A workaround

Table of contents

The workaround

Why this matters

Firewall setup for Intune AD Connector in legacy systems

Table of contents

The challenge

Recommended technical approach

Step 1: Identify required endpoints

Step 2: Firewall ruleset design

Step 3: Operational process for IP maintenance

Step 4: Automation pipeline flow

Best practices for firewall management in legacy environments

Long-term optimization options

Automation use cases

Fully automated firewall changes with XOAP's Configuration Management

Final thoughts

Complete Windows 11 migration guide for enterprise IT

Table of contents

Check upgrade readiness

Tools for checking device eligibility

Windows 11 migration phases

1. Pre-migration

2. Migration

3. Post-migration

What this means for your team

Migrate to Windows 11 with PSADT

Use PSADT to migrate from Windows 10 to Windows 11

You're good to go!

Windows 11 migration made easy with XOAP

Upgrade to Windows 11 with XOAP: Simple steps

All set!

Step-by-step: Windows 11 migration using GPOs and registry keys

Table of contents

Guide: Windows 11 migration using GPOs/registry keys

How to specify target Feature Update version in Windows 10

Specify target Feature Update version in Local Group Policy Editor