[ltsb, 1607] Slip steam updates in to image being deployed by MDT / WDS

[kennysarmy]

We're 85 % of the way through re-imaging all our PC's and laptop from Windows 7 to Windows 10.

 

Recent updates is slowing the process of imaging down as it applies the 2018-06 Cumulative Update (KB284880)

 

I've been doing some research on how to slipstream this in to my image and came across this script:

 

$UpdatesPath = "D:\installdism\Updates\*"

 

$MountPath = “D:\installdism\Mount”

 

$WimFile = “D:\installdism\install.wim”

 

DISM /Mount-Wim /WimFile:$WimFile /index:1 /Mountdir:$MountPath

 

$UpdateArray = Get-Item $UpdatesPath

 

ForEach ($Updates in $UpdateArray)

 

{

 

DISM /image:$MountPath /Add-Package /Packagepath:$Updates

 

Start-Sleep –s 10

 

}

 

Write-Host "Updates Applied to WIM"

 

DISM /Unmount-Wim /Mountdir:$MountPath /commit

 

DISM /Cleanup-Wim

 

 

 

Updatepath is the folder where I copied all updates from an updated windows 10 computer's c:\windows\softwaredistribution\download folder

 

Mountpath is just an empty folder where dism will mount the install.wim file to inject the updates

 

Wimfile the location of a copy of the install.wim file from MDT's operating systems folder that needs updates.

 

 

However I'm not exactly sure what to do with the script, I presume this is something I'd just run once on the image on my MDT Server?

 

Or is there a better way?

[kennysarmy]

If I take a backup of the Windows 10 WIM file from the server; (D:\DeploymentShare\Operating Systems\1607LTSB) then use the DISM commands to add the necessary updates - can I just then over-write the existing WIM file with the new one?

 

OR do I need to go through the whole IMPORT process again?

[NotBatman]

Could you not just slipstream the most recent cumulative updates by importing the files from Microsoft's Update Catalog website into the applications/patches folder called during the MDT task sequence?

[SHimmer45]

you shouldnt need to reimport it if you have added anything to the WIM i dont when i have made changes and it works ok

[karlr]

My preferred method of building updates into base images is actually just to run an MDT task sequence designed to do exactly that. Install Windows using stock media, install all updates, and then sysprep + capture a base image to use. It's fully automated in the sense that the only manual intervention required is PXE booting a virtual machine to MDT, and then importing the new image into MDT when it's finished.

[gshaw]

My preferred method of building updates into base images is actually just to run an MDT task sequence designed to do exactly that. Install Windows using stock media, install all updates, and then sysprep + capture a base image to use. It's fully automated in the sense that the only manual intervention required is PXE booting a virtual machine to MDT, and then importing the new image into MDT when it's finished.

 

@karlr I see this method mentioned a lot but do you repeat it 12x a year to keep up with the monthly CUs?

 

With 10 updating so regularly I've tried to avoid any capture steps and just been building on top of the base WIM from MS media then letting WSUS handle the rest.

Edited June 25, 2018 by gshaw

[karlr]

Nope, we generally only rebuild the base image when we're preparing for a site-wide re-image. Any imaging outside of this schedule will install the updates as part of the MDT sequence, and WSUS takes care of updates to existing machines naturally. It would be a trivial task to compose a base image every month, however.

[free780]

I did get to the point with MDT and hyper v of a scheduled task that created a fresh VM with a ISO from MDT that created a fresh image. My hope was to have a monthly or every other month image. Though you do need to test that all software is installed etc.

 

I believe Office/Silver light/.net Updates can not be injected into wim files. A build and capture is still needed despite Microsoft wanting to move to upgrades and resets.

Edited June 26, 2018 by free780

[kennysarmy]

Could you not just slipstream the most recent cumulative updates by importing the files from Microsoft's Update Catalog website into the applications/patches folder called during the MDT task sequence?

 

Do you mean adding the updates here?

 

 

I've not tried this method before....

[kennysarmy]

you shouldnt need to reimport it if you have added anything to the WIM i dont when i have made changes and it works ok

 

Hi,

 

So you would take the WIM file from the "DeploymentShare\Operating Systems" folder on MDT and use the DISM commands to slip-stream in any new updates, then just replace the WIM file in the same location?

[kennysarmy]

Wondering which of the above two methods above would be the quickest during deployment?

[SHimmer45]

Hi,

 

So you would take the WIM file from the "DeploymentShare\Operating Systems" folder on MDT and use the DISM commands to slip-stream in any new updates, then just replace the WIM file in the same location?

 

 

yes thats all i do, i take a backup of the WIM before mounting it and making any changes

[kennysarmy]

yes thats all i do, i take a backup of the WIM before mounting it and making any changes

 

Thanks - and do you pull the updates from a fully patched PC's c:\windows\softwaredistribution\download folder or get the ones you are missing direct from Microsoft Update Catalog

[SHimmer45]

i use WSUSoffline updater for the initial update of a build

[kennysarmy]

i use WSUSoffline updater for the initial update of a build

 

Sorry, maybe my question was n't clear.

 

You take your existing WIM from the MDT Server and run the DISM commands to slipstream in the updates that MS have rolled out since your original WIM creation, but how do you populate the folder of updates that the DISM command looks at?

[SHimmer45]

Ah i see, then i just lift the updates from an updated machine and inject using DISM

[kennysarmy]

Ah i see, then i just lift the updates from an updated machine and inject using DISM

 

I tried that and the DISM command was n't happy! Threw a load of errors when I pointed at the latest files in C:\Windows\SoftwareDistribution\Download

 

So I looked at a freshly imaged, patched Windows 10 computer and compared with an imaged PC unpatched and found the biggest update to be:

 

2018-06 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4284833)

 

I downloaded the file windows10.0-kb4284833-x64_eb8d1b6306fe77caefec2109844be73ffc7587f6.msu from the Microsoft Update Catalog

 

I also downloaded 2018-06 Security Update for Adobe Flash Player for Windows 10 Version 1607 for x64-based Systems (KB4287903)

 

I then put both these MSU files on my Windows 10 management PC in the folder D:\updates

 

I took my Windows 10 WIM file from the MDT deployment share and copied this to the same management pc in D:\wim and then ran the following commands:

 

dism /mount-wim /wimfile:D:WIM\wim.wim /mountdir:D:WIMTEMP /index:1

 

dism /image:D:WIMTEMP /Add-Package /PackagePath:D:updates

 

dism /Unmount-Wim /MountDir:d:\wimtemp /commit

 

 

Copied the wim file back to MDT and imaged another PC.

 

Comparing a PC imaged before with this new imaged one and it ONLY shows the 2018-06 Security Update for Adobe Flash Player in the add/remove programs.

 

 

Any ideas?

[SHimmer45]

if you manually run 2018-06 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4284833) does it complete?

 

also make sure you are not injecting the delta version of the update as they do require the previous update to be installed as they dont have all the requirements prepackaged which keeps it smaller

 

DISM log suggest anything?

 

C:\Windows\Logs\DISM\

Edited June 26, 2018 by SHimmer45

[kennysarmy]

if you manually run 2018-06 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4284833) does it complete?

 

also make sure you are not injecting the delta version of the update as they do require the previous update to be installed as they dont have all the requirements prepackaged which keeps it smaller

 

DISM log suggest anything?

 

C:\Windows\Logs\DISM\

 

I looked at which were the new latest updates put on an image and downloaded them all again from the windows catalog - the last time I did just two - whether this made a difference or not I don't know but this time it slip streamed them all in!

 

 

Cheers

Edited June 27, 2018 by kennysarmy

[SHimmer45]

an update might have missed a dependency good you got it sort out

[kennysarmy]

an update might have missed a dependency good you got it sort out

 

Thanks.

 

The next issue is we install Office 2016 as part of the deployment, how can I speed up the updating of Office? I'm guessing I can't slipstream in the Office updates as it's not yet installed?

[SHimmer45]

you can download the office updates and just put them into the updates folder of the office install source when the install runs it applied what is in the updates folder.

[kennysarmy]

you can download the office updates and just put them into the updates folder of the office install source when the install runs it applied what is in the updates folder.

 

Oh!

 

Easy then - I'll give it a go - cheers.

[kennysarmy]

you can download the office updates and just put them into the updates folder of the office install source when the install runs it applied what is in the updates folder.

 

Do you know if I can just dump in the cab files or do I need to unpack them all and put the *.msp files in the updates folder?

[SHimmer45]

Do you know if I can just dump in the cab files or do I need to unpack them all and put the *.msp files in the updates folder?

 

yeah i forgot to mention you need to extract the cab (this works for 2010 and 2013 so assume 2016 is the same as the /admin option still functions and generates an MSP for controlling the installer)