[mdt] Update Windows 10 Gold Image - MS updates?

[kennysarmy]

My MDT journey is progressing and this is my current workflow:

 

1. Image a PC from MDT with the latest Windows 10 LTSB WIM file and as part of the task sequence install Office 2016.

 

2. Keep the imaged PC off the domain and make any necessary tweaks to the PC to make this my GOLD image.

 

3. Run sysprep and capture and put the new WIM file back on MDT for mass deployment.

 

 

One thing I'm unsure about though is how to incorporate all the latest MS updates for Windows 10 in to the GOLD image?

 

 

Can I just edit the registry to add in my WSUS server address and do the updates before I capture the image - or is there a better way?

 

Thanks for any help...

[jtotheb]

In CustomSettings.ini

WSUSServer=http://wsusservergoeshere:port

 

Then add a "Run Command Line" to the task sequence. Before Install Applications is a good place:

cscript.exe "%SCRIPTROOT%\ZTIWindowsUpdate.wsf"

 

The main man Johan Arwidmark has a pre and post application Windows Update command in his demo task sequences.

 

HTH

[Arthur]

It might be worth buying a copy of Johan's latest MDT book.

 

www.amazon.co.uk/dp/B01B3A1LIU

[jtotheb]

It might be worth buying a copy of Johan's latest MDT book.

 

www.amazon.co.uk/dp/B01B3A1LIU

 

+1 on that. It has a permanent home on my desk.

[Julian]

You may need to run the Office rearm tool before running sysprep.

 

"C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE"

 

Warning this application can only be run 3 times, make a snapshot before use, and revert to the snapshot after finishing sysprep.

 

My limited understanding is that this acts as sysprep for office, so that each copy of office has its own GUID, which is required if you are using a Office KMS server.

[kennysarmy]

In CustomSettings.ini

WSUSServer=http://wsusservergoeshere:port

 

Then add a "Run Command Line" to the task sequence. Before Install Applications is a good place:

cscript.exe "%SCRIPTROOT%\ZTIWindowsUpdate.wsf"

 

The main man Johan Arwidmark has a pre and post application Windows Update command in his demo task sequences.

 

HTH

 

Thanks.

 

So I'd add this to the task sequence in the deploy the gold image O/S ? or would it be better to add this to the task sequence that images the PC initially?

[kennysarmy]

+1 on that. It has a permanent home on my desk.

 

Thanks - I've ordered it

 

- - - Updated - - -

 

You may need to run the Office rearm tool before running sysprep.

 

"C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE"

 

Warning this application can only be run 3 times, make a snapshot before use, and revert to the snapshot after finishing sysprep.

 

My limited understanding is that this acts as sysprep for office, so that each copy of office has its own GUID, which is required if you are using a Office KMS server.

 

Thanks.

[snagrat]

[oQUOTE=Julian;1459301]You may need to run the Office rearm tool before running sysprep.

 

"C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE"

 

Warning this application can only be run 3 times, make a snapshot before use, and revert to the snapshot after finishing sysprep.

 

My limited understanding is that this acts as sysprep for office, so that each copy of office has its own GUID, which is required if you are using a Office KMS server.

 

Isn't MDT 2013 U2 Office aware so it will rearm the product for you?

 

I know previous versions didn't but I thought latest did

[jtotheb]

Thanks.

 

So I'd add this to the task sequence in the deploy the gold image O/S ? or would it be better to add this to the task sequence that images the PC initially?

 

If you add it to your gold image building sequence then subsequent deployments from that gold image won't take as long. Worth testing the usual, i.e. make sure it doesn't break anything.

[kennysarmy]

If you add it to your gold image building sequence then subsequent deployments from that gold image won't take as long. Worth testing the usual, i.e. make sure it doesn't break anything.

 

Well I added the line to my customsettings.ini and edited the task sequence.

 

All looked like it was going well but on Deployment Summary it has finished with 2 errors:

 

Failure (9902) : ZITWindowsUpdate has run and failed too many times. Count = 8

Failure (9902) : ZITWindowsUpdate has run and failed too many times. Count = 9

[kennysarmy]

If I check, four updates have installed OK.

Two Security Updates and two other updates.

[kennysarmy]

Well I added the line to my customsettings.ini and edited the task sequence.

 

All looked like it was going well but on Deployment Summary it has finished with 2 errors:

 

Failure (9902) : ZITWindowsUpdate has run and failed too many times. Count = 8

Failure (9902) : ZITWindowsUpdate has run and failed too many times. Count = 9

 

Anyone?

[kennysarmy]

You may need to run the Office rearm tool before running sysprep.

 

"C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE"

 

Warning this application can only be run 3 times, make a snapshot before use, and revert to the snapshot after finishing sysprep.

 

My limited understanding is that this acts as sysprep for office, so that each copy of office has its own GUID, which is required if you are using a Office KMS server.

 

I found this:

Rearm Office using MDT & ConfigMgr / SCCM - msitproblog

 

Which suggests that we still need to run ospp.vbs

[kennysarmy]

I found this:

Rearm Office using MDT & ConfigMgr / SCCM - msitproblog

 

Which suggests that we still need to run ospp.vbs

 

Unless you are on Update 2 for MDT 2013

[kennysarmy]

Anyone?

 

This looks like it was a specific update failing to install multiple times:

Definition Update for Windows Defender - KB2267602

 

Definition Update for Windows Defender - KB2267602 (Definition - Microsoft Community

 

I'm going to remove Windows Defender Definition Updates from my WSUS and try again....

[jtotheb]

This looks like it was a specific update failing to install multiple times:

Definition Update for Windows Defender - KB2267602

 

Definition Update for Windows Defender - KB2267602 (Definition - Microsoft Community

 

I'm going to remove Windows Defender Definition Updates from my WSUS and try again....

 

Probably easier to get MDT to exclude them:

https://scriptimus.wordpress.com/2012/03/22/mdt-2012-automating-updates-in-lite-touch-deployments/

 

In this case you can create an exclusion list using the customsettings.ini property WUMU_ExcludeID or WUMU_ExcludeKB. You can add as many of these lines as you like by incrementing a number at the end. In this example I use WUMU_ExcludeKB to exclude 3 windows updates.

 

WUMU_ExcludeKB001=976002 
WUMU_ExcludeKB002=2267621
WUMU_ExcludeKB003=2434419