[mdt] MDT and Windows Updates

[Olliesaurus]

Hi all,

 

After finally getting all of my applications onto the server, tested and licensed (today I might add) I have come to a bit of a brick wall..

 

My MDT setup works perfectly, I have tested every driver for every computer and laptop, I have run a test deployment to one computer/laptop of each model and can confirm they work.

 

However...

I am completely stumped how I am going to deploy the Windows Updates with the initial install of Windows 7...

The idea of deploying a OS without the updates is a little daunting.

 

Anyone got any tips on how I can incorporate all of the latest Windows 7 updates into my install.wim?

 

Thanks,

 

Olliesaurus

[pritchardavid]

You could make a sequence that installs Windows 7 then installs the latest updates, then making the image. Just run this once a month when the updates come out, then you can always have a fully patched wim. This is what I'm gonna try soon

[free780]

1. When you do a build and capture do the windows updates as part of the task sequence. You can specify the wsus server in customsettings.ini

 

2. Add packages to mdt. Point to wsus content folder on the wsus server. However these will be deployed when the OS is. Long wait.

 

3. Add windows update to the task sequence for deployment. You have to wait a long time.

 

4. Try an do offline update http://technet.microsoft.com/en-us/magazine/hh825626.aspx

 

I couldn't get this to work.

 

5. Move to sccm which has offline updates on wim files.

[Olliesaurus]

I was hoping I would be able to inject the drivers into a Win7 SP1 iso and then import that into MDT.

 

I have tried a few ways but the only updates I seem to be able to get access to (msu files anyway) are few and far between...

[wigwam]

Add WSUS server and once it has downloaded throw this line in to the custom settings.

WSUSSERVER= and then link it to your WSUS server

 

when you have done that ensure you have synced all updates and then approve them all and then in the standard task's ensure the windows update sections are enabled.

 

Job done.

 

When deploying it will look for the WSUS server and grab what it needs.

[VeryPC_Tom_M]

I was hoping I would be able to inject the drivers into a Win7 SP1 iso and then import that into MDT.

 

I have tried a few ways but the only updates I seem to be able to get access to (msu files anyway) are few and far between...

 

Microsoft Update Catalog

 

That site should have all of the MSU files you could wish to download! It'll be time-consuming, and the interface isn't the best in the world...

[free780]

Its all to get you to buy SCCM!

[garethEds]

When creating a new build image we use the OfflineWSUS Installer application and download all the updates seperate. Then once the fresh install is made the updates are added. It creates an up to date image for a while and lessens the load on the WSUS server when building and also makes it a bit quicker.

 

I create a new image once a year.

 

Gareth

[Olliesaurus]

Thanks for your input all, I decided to go down the route of WSUS, it takes a little longer but if appears to work without any issues, maybe one day when I am a little braver I will give another go at injecting the drivers into the WIM.

 

Thanks,

 

Olliesaurus

[IKWeb]

Hi all,

 

After finally getting all of my applications onto the server, tested and licensed (today I might add) I have come to a bit of a brick wall..

 

My MDT setup works perfectly, I have tested every driver for every computer and laptop, I have run a test deployment to one computer/laptop of each model and can confirm they work.

 

However...

I am completely stumped how I am going to deploy the Windows Updates with the initial install of Windows 7...

The idea of deploying a OS without the updates is a little daunting.

 

Anyone got any tips on how I can incorporate all of the latest Windows 7 updates into my install.wim?

 

Thanks,

 

Olliesaurus

 

Hi

 

You dont incorporate the windows updates into your WIM file, you tell the MDT server at the end of the build to go away and check your WSUS server for update and if MDT finds any it will install them for you as part of the install process. You add the commands in the Rules section of your MDT.

[garethEds]

Hi

 

You dont incorporate the windows updates into your WIM file, you tell the MDT server at the end of the build to go away and check your WSUS server for update and if MDT finds any it will install them for you as part of the install process. You add the commands in the Rules section of your MDT.

 

I disagree a little bit there. When you are creating your reference image there is nothing to stop you installing Windows 7 then installing updates and then capturing the most up to date image you can. That is what we do.

 

Before creating a fresh image (once every 6 months) I download all updates using WSUS Offline Installer. I then create my reference image and install all the updates from a USB stick. Like I say this makes sure I have the most up to date image I can get.

 

Oh and I've still got the WSUS checks in there as well as I know there will be updates between images. Certainly saves downloading 100 or so updates everytime I build a machine.

 

Isn't that how everyone does it?

 

Gareth

[IKWeb]

I disagree a little bit there. When you are creating your reference image there is nothing to stop you installing Windows 7 then installing updates and then capturing the most up to date image you can. That is what we do.

 

Before creating a fresh image (once every 6 months) I download all updates using WSUS Offline Installer. I then create my reference image and install all the updates from a USB stick. Like I say this makes sure I have the most up to date image I can get.

 

Oh and I've still got the WSUS checks in there as well as I know there will be updates between images. Certainly saves downloading 100 or so updates everytime I build a machine.

 

Isn't that how everyone does it?

 

Gareth

 

Ahh in that case if your creating a FAT image with updates as part of the image then yes, sorry you are right, Here we push out a basic Windows 7 image, from the source files from the Windows 7 DVD, and then updates are installed by MDT, and applications via MSI. We don't incorporate anything in the WIM file at all.

[garethEds]

Ahh in that case if your creating a FAT image with updates as part of the image then yes, sorry you are right, Here we push out a basic Windows 7 image, from the source files from the Windows 7 DVD, and then updates are installed by MDT, and applications via MSI. We don't incorporate anything in the WIM file at all.

 

I see where you are coming from but doesn't it make sense to cut down the deployment time by making the best Windows 7 base image possible? If you simply install Windows 7 SP1 then there are around 100 individual updates to go on during the WSUS stage of deployment. This takes time. It would be quicker to get them into the base from day one.

 

Gareth

[IKWeb]

I see where you are coming from but doesn't it make sense to cut down the deployment time by making the best Windows 7 base image possible? If you simply install Windows 7 SP1 then there are around 100 individual updates to go on during the WSUS stage of deployment. This takes time. It would be quicker to get them into the base from day one.

 

Gareth

 

If your after a fast way then, yes adding the updates to the image would make the deployment faster. But then on a down side you have to then keep this image up to date, and i haven't come across a IT department who have enough time to do this.

 

All the software we install is done via MSI so we have no need for images which include applications.

[garethEds]

If your after a fast way then, yes adding the updates to the image would make the deployment faster. But then on a down side you have to then keep this image up to date, and i haven't come across a IT department who have enough time to do this.

 

All the software we install is done via MSI so we have no need for images which include applications.

 

Again I see your point but I believe we should be trying to make our job easier and get machines up and running quicker (for the benefit of the pupils). INstalling updates from USB is a lot quicker than installing during the deployment process. Making a new image every six months isn't that time consuming if you plan it.

 

Our software is MSI/GPO as well. The only one we include in the image is CS3 - but even that is going soon as we are to purchase CS6 in June which is supposed to have an improved deployment method.

 

Gareth

[steewy]

I personally use this little software: Windows Updates Downloader (WUD) Update Files (ULs)

 

Every month the update list gets updated so get the latest updates. You can download all the offline MSU updates. Once you have them, simply mount your wim image, insert updates with command prompt and voilà !

 

if you need the command to add updates to your WIM image let me know.

 

EDIT cmd commands:

 

Run cmd as administrator on your mdt server!

 

Add Updates:

 

 

 

 

Add Updates:

 

 

 

 

dism /Mount-Wim /WimFile:D:\UpdateImage\wcsc.wim /Index:1 /MountDir:D:\UpdateImage\Mount

 

 

 

 

dism /Image:D:\UpdateImage\Mount /Add-Package /PackagePath:"D:\UpdateImage\updates\Security Updates"

 

 

 

 

dism /Image:D:\UpdateImage\Mount /Add-Package /PackagePath:"D:\UpdateImage\updates\Non-Security Updates"

 

 

 

 

dism /Image:D:\UpdateImage\Mount /Add-Package /PackagePath:"D:\UpdateImage\updates\.NET Framework 3.5.1 Updates"

 

 

 

 

 

Closing VIm and saving changes:

 

 

 

 

dism /Commit-Wim /MountDir:D:\UpdateImage\Mount

 

 

 

 

Unmount Image:

 

 

 

 

dism /Unmount-Wim /Commit /MountDir:D:\UpdateImage\Mount

 

 

 

 

Adding as a new image on MDT server service:

 

 

 

 

wdsutil /Add-Image /ImageType:Install /ImageGroup:Win7 /ImageFile:D:\UpdateImage\wcsc.wim/SingleImage:”Windows 7 Pro X86” /Name:"Windows 7 April 2013" /Description:"Updated Windows 7 April 2013"

 

 

 

 

Or replace the existing image modify text if needed:

 

 

 

 

wdsutil /Replace-Image /Image:”Windows 7 Enterprise” /ImageType:Install /ImageGroup:Win7 /ReplacementImage /ImageFile:D:\Win7Enterprise.wim

Edited May 16, 2013 by steewy

[dany2010]

Hi Steewy,

 

That looks like a solution that i might try to get working. I've just enabled the windows update bit in MDT and its gone from 20-30 mins to hour and a half sometimes.

 

I see youve put the updates on the boot image in WDS, i take it thats the LiteTouchPE_x86.wim MDT creates.

 

If MDT updates the boot image do you then have to re-apply the updates to the new LiteTouchPE_x86.wim?

 

Thanks

[sted]

Hi Steewy,

 

That looks like a solution that i might try to get working. I've just enabled the windows update bit in MDT and its gone from 20-30 mins to hour and a half sometimes.

 

I see youve put the updates on the boot image in WDS, i take it thats the LiteTouchPE_x86.wim MDT creates.

 

If MDT updates the boot image do you then have to re-apply the updates to the new LiteTouchPE_x86.wim?

 

Thanks

 

litetouch _xXX.wim is just the boot file updating it with anything other than drivers is pointless. If you want to deploy pre updated windows the easiest way is deploy to a test pc/vm. install updates and any software you want on base install (so i do office for example) then create a capture task in mdt. Run that on the test pc IN WINDOWS then add the new wim its created into mdt and then create a task to deploy that

[steewy]

Hi Steewy,

 

That looks like a solution that i might try to get working. I've just enabled the windows update bit in MDT and its gone from 20-30 mins to hour and a half sometimes.

 

I see youve put the updates on the boot image in WDS, i take it thats the LiteTouchPE_x86.wim MDT creates.

 

If MDT updates the boot image do you then have to re-apply the updates to the new LiteTouchPE_x86.wim?

 

Thanks

 

 

Never update your litetouche.wim image. This is only the boot image !

The boot image mainly contains drivers and parameters of the bootstrap.ini.

 

Go to your deployment share. Operating system, your OS. In that folder you will have the wim image you captured. This is the image that you need to update.

 

Good luck

[dany2010]

Thanks sted.

 

That is one solution but is a step backwards for us as this is where we came from. Having to install and create images from machines.

 

What about adding the drivers to the file

MDT\Operating Systems\windows7os\sources\install.wim

 

This os is taken straight of the disk and isn't a captured image

Edited July 2, 2013 by dany2010

[sted]

you only do it once and all pcs use the image. Drivers add them to mdt drivers ection and let it sort them itself. You can in theory apply updates to an offline image but its just imo easier to fire up a vm and pull a copy

[steewy]

Thanks sted.

 

That is one solution but is a step backwards for us as this is where we came from. Having to install and create images from machines.

 

What about adding the drivers to the file

MDT\Operating Systems\windows7os\sources\install.wim

 

This os is taken straight of the disk and isn't a captured image

 

I never added drivers that way as it's the original CD.

I always add my drivers manually to your operating system WIm image that you captured.

 

I understand you need to install that image on you entire network so you should install W7 on one machine.

-Install all the updates

-Do not enter any serial or activate windows

-Install the apps you need (I prefer to install them after deploying the windows so you have a lit Image)

-Capture the image Adrian Costea's blog » Sysprep and Capture a Windows Image with MDT 2012

[dany2010]

Sorry. Not sure why I said drivers. I meant updates

 

Im going to give this a go

http://technet.microsoft.com/en-us/magazine/hh825626.aspx

 

Just having to unapprove 2000 updates that computers dont need as its currently got 20gb of updates in so would take about a year to install a machine.

Edited July 2, 2013 by dany2010

[steewy]

It works the same way. I add my updates to the main WIM image.

[steewy]

Sorry. Not sure why I said drivers. I meant updates

 

Im going to give this a go

Geek of All Trades: Cheating Isn

 

Just having to unapprove 2000 updates that computers dont need as its currently got 20gb of updates in so would take about a year to install a machine.

 

By personal experience I'll recommend you to capture a new image with all the updates.

 

It's so nice to build a machine in less than one hour and you don't have to install any updates.