Windows 11 Readiness with Workspace ONE

October 01, 2021

Windows 11 is nearly upon us—October 5th to be exact­—and we need to know which devices in our fleet are ready to upgrade! Microsoft has published specifications here, but you may still wonder:

  • How do I take those specifications and get a simple dashboard view of my fleet?
  • How do I report on which devices meet ALL those specifications?
  • Which devices do not meet the hardware specifications?
  • Can I identify what those devices are missing?
  • Are some devices due for a hardware refresh?

The excellent news is that Workspace ONE Sensors combined with Workspace ONE Intelligence dashboards and reports can provide you all the information you need to plan for OS upgrades, hardware upgrades, or even hardware refresh!

We’re excited to have just announced formal support for Windows 11 with Workspace ONE. For more information, see Windows 11 Readiness for Workspace ONE UEM (85839).

Determining which devices are ready for Windows 11

The dashboard shown in the image below uses Workspace ONE Sensors to retrieve the relevant data from the Operating System, in line with Microsoft’s Windows 11 requirements. This means VMware Workspace ONE can read attributes such as OS Disk Size, OS Disk space, Memory, TPM version, and so on, to provide you a list of devices that are Windows 11 ready.

The Windows 11 Readiness dashboard provides the basis to get you started. You can add different attributes or adjust the dashboard and reports if there are any changes to Windows 11 requirements. The following sections walk through how to create this dashboard.

If you are not familiar with Workspace ONE Sensors or Workspace ONE Intelligence custom dashboards or reports, then check out these great resources on Tech Zone:

Step 1: Create and assign Workspace ONE Sensors to devices

In order to determine if a Windows device meets each specification, you must deploy a Workspace ONE Sensor (Sensor) to all Windows devices.

To ensure it gets assigned to all devices, create a Smart Group at the Customer organization group (OG) or root of your multi-tenant hierarchy. In the Workspace ONE UEM Console, navigate to Groups and Settings > Groups > Assignment Groups and select Add Smart Group.

I have named this Smart Group “All Windows devices”.

Ensure to select your filter criteria as Platform & Operating System = Windows Desktop and select Greater Than or Equal to Windows 10 (10.0.10240) so this captures all Windows 10 devices.

Feel free to change the Windows version if you like, the importance is to specifically target the Smart Group to Windows 10 devices.

Graphical user interface</p> <p>Description automatically generated

When you are finished, click Save.

After you have created the Smart Group targeting all Windows 10 devices in your environment, create the Sensors using the templates provided in the VMware EUC Samples GitHub repository.

You can find ALL the Windows Sensors in the GitHub repository.

You can either copy and paste the scripts individually into the Workspace ONE UEM Console, or bulk import the scripts using the Guides on GitHub.

Each of the following Sensors returns a value that will be used within the Workspace ONE Intelligence Dashboards and Reports. To create the Dashboard, we will need the following Sensors:

  1. bios_secure_boot
  2. os_disk_size
  3. os_disk_free_space
  4. system_logicalprocessors
  5. system_totalphysicalmemory
  6. tpm_highest_version

After creating the Sensors, you need to assign them. Select the appropriate sensor, click Assign, and assign the sensor to the Smart Group named “All Windows 10 devices”.

In the Assignment deployment, you can Select which triggers should cause this Sensor to run on assigned devices. This can be scheduled or by an Event such as Login, Log Out, Start-up, or User Switch.

Select event Schedule, as this will run straight away and every 6 hours. Alternatively, if you are happy for the data to trickle in, you can select the Start-Up Event type.

It can take some time for the data to come through into Workspace ONE Intelligence, allow a few hours, and then navigate to the Workspace ONE Intelligence console to start creating your custom Dashboards and Reports.

Step 2: Configure Windows 11 Readiness Dashboard in Workspace ONE Intelligence

In Workspace ONE Intelligence, I have created a custom dashboard under My Dashboards and named it “Windows 11 Readiness”.

To create a Widget on the Dashboard, Select Add Widget and Custom Widget.

The dashboard will have six widgets. Repeat these steps for each widget listed below.

Each widget reports on one or more sensors and displays the count of devices meeting specific selection criteria. Configure each widget by:

  1. Using the Workspace ONE UEM: Device Sensors category.
  2. Name your Widget.
  3. Under Data Visualization select Measure Count of Device GUID.
  4. Add filter “Last Sync Time within last 60 day(s)” - I added this filter so I don’t get stale records skewing my numbers.

Create Widget 1: Total Devices Ready for Windows 11

image 101

This widget filters on all six sensors and counts the number of devices that match them combined.

Add the following filters:

  1. Last Sync Time within Last 60 days
  2. bios_secure_boot = true
  3. system_logicalprocessors >= 2
  4. system_totalphysicalmemory >= 8
  5. os_disk_size >= 64
  6. os_disk_free_space >= 10
  7. tpm_highest_version >= 1.2
Create Widget 2: Devices not Ready - TPM

This widget filters on the following:

  1. tpm_highest_version < 1.2
  2. Last Sync Time within Last 60 days
Create Widget 3: Devices not Ready – SecureBoot

This widget filters on the following:

  1. Last Sync Time within Last 60 days
  2. bios_secure_boot = false
Create Widget 4: Devices not Ready – Memory

This widget filters on the following:

  1. Last Sync Time within Last 60 days
  2. system_totalphysicalmemory < 8
Create Widget 5: Devices not Ready – Storage

This widget filters on the following:

  1. Last Sync Time within Last 60 days
  2. os_disk_size < 64
  3. os_disk_free_space < 10
Create Widget 6: Devices not Ready – CPU

This widget filters on the following:

  1. Last Sync Time within Last 60 days
  2. system_logicalprocessors < 2

Step 3: Create Windows 11 Readiness Reports

Reports are created using the same sensors and filters, but they allow you to customize the columns displayed and include other relevant information. For example, you might want to know the device name, make and model, user assigned to the device, their email address, first and last name, so that you can match this with your asset management processes if you need to replace the hardware.

To create a report, under the Workspace ONE Intelligence > Reports dashboard, Add a Custom Report. Select the Workspace ONE UEM: Device Sensors category. Again, I added a filter to each report, to only show devices that have sync’d to Workspace ONE UEM within the last 60 days, so I don’t get stale records.

Report 1: Devices Ready for Windows 11

This report filters on all six sensors and displays the devices that match all filters.

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • bios_secure_boot = true
  • system_logicalprocessors >= 2
  • system_totalphysicalmemory >= 8
  • os_disk_size >= 64
  • os_disk_free_space >= 10
  • tpm_highest_version >= 1.2

image 102

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacture Date
  • OS Build
  • bios_secure_boot
  • system_totalphysicalmemory
  • system_logicalprocessors
  • os_disk_size
  • os_disk_free_space
  • tpm_highest_version
  • Warranty
  • Status
  • Last Sync Time

image 103

Pro Tip:

You can create a Workspace ONE Intelligence Automation to Tag each device as Ready for Windows 11. This Tag can then be associated with a Smart Group and Profile to approve the Windows 11 Feature Update.

 

Report 2: Devices not Windows 11 Ready – TPM less than 1.2

This report filters on Last 60 days and only shows devices that either do not have a TPM chip or have a TPM chip prior to 1.2.

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • tpm_highest_version < 1.2
     

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacture Date
  • OS Build
  • tpm_highest_version
  • Warranty Status
  • Last Sync Time
Report 3: Devices not Windows 11 Ready – SecureBoot not Enabled

This report filters on Last 60 days and displays devices that have SecureBoot disabled.

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • bios_secure_boot = false

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacture Date
  • OS Build
  • bios_secure_boot
  • Warranty Status
  • Last Sync Time
Report 4: Devices not Ready – Memory less than 8 GB

New accordion content

This report filters on device seen in Last 60 days and RAM less than 8 GB.

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • system_totalphysicalmemory < 8

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacturer Date
  • OS Build
  • system_totalphysicalmemory
  • Warranty Status
  • Last Sync Time

 

 
Report 5: Devices not Ready – Storage less than 64 GB and 10 GB free

This report filters on device seen in Last 60 days and displaying devices that have less than 64 GB disk space total for the System Drive AND have less than 10 GB free space on that drive:

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • os_disk_size < 64
  • os_disk_free_space < 10

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacture Date
  • OS Build
  • os_disk_size
  • os_disk_free_space
  • Warranty Status
  • Last Sync Time
Report 6: Devices not Ready – CPU Cores less than 2

This report filters on device seen in Last 60 days, showing devices that have less than 2 CPU cores:

Add the following filters to the report:

  • Last Sync Time within Last 60 days
  • system_logicalprocessors < 2

Finally, add the following columns to the report:

  • Device GUID
  • Friendly Name
  • Email Address
  • First Name
  • Last Name
  • Manufacturer Name
  • Model
  • Manufacture Date
  • OS Build
  • system_logicalprocessors
  • Warranty Status
  • Last Sync Time

In Summary

Workspace ONE Sensors and Workspace ONE Intelligence Dashboards and Reports are a very powerful and flexible toolset. As you can see, it is easy to create custom Dashboards and Reports to help you plan for your Windows 11 upgrade, as well as identifying which devices need to be refreshed to support your upgrade.

Filter Tags

Workspace ONE Workspace ONE Intelligence Workspace ONE UEM Blog Announcement Intermediate Manage

Phil Helmling

Read More from the Author

EUC Staff Architect, EUC Engineering, VMware. Phil Helmling has been working in IT for over 30 years, with nearly two decades’ hands-on experience with VMware technologies, and nearly three decades with Windows technologies. Specializing in IT architecture in the End User Computing space, Phil has designed and deployed hundreds of successful solutions for organizations of all sizes and verticals.