remove features / reduce wim size

[ADMaster]

I’ve always done everything during OSD, but I’m testing new methods because of my 10 min first log on.

I’m rewriting @Arthur’s script to remove appx packages and I’ve also explored NTLite.

NTLite lists several language packs that we will never use. However when I run this code

Get-WindowsPackage -Path $mount | where{$_.PackageName -like "*Lang*"} | ogv

I only get a few results and they are all English.

Do the language packs take up enough space to bother with?

 

What features do you remove and why? I noticed the script has a section where it removes features.

One thing I am adding to my script is exporting the Education edition into a new wim so there is only one index.

 

Thoughts? Ideas?

[mrwoberts]

I build my wim purely using Arthur's script, with only minor changes, and I don't see a 10 minute first login, especially not on SSD computers. Worst time on a HDD is approx 2 mins.

What version are you using, 1709, 1803, 1809??

What customisations are you making to your wim file?

When you get your first login time, is that with a domain joined account over wireless?

[ADMaster]

When I say first log in, I mean the very first log on after install. This is what takes 10 minutes. Other users first logins are 2 - 3 minutes, I’ve not timed it this time around. I have detailed tests I did on 1803 and this is 1809 doing the same thing.

Here are my tests from then

http://www.edugeek.net/forums/windows-10/197560-1803-very-slow-first-logon.html#post1688159

There is a screen shot of my TS on here somewhere, before this script, I have not modified the wim.

During OSD I disable startup repair, consumer experience, defender first run, chrome first run, 3d objects folder, remove apps, onedrive, and install printer drivers, needed software and the latest CU.

There is probably a thing or two I’ve missed but I’d have to look at the TS when I’m at work tomorrow.

 

A couple of the steps require mounting and modifying the default ntuser.dat. My next step is to start disabling TS steps starting with those to see if things change.

 

But for this thread, I’m curious on what others take out of the wim and what it offers.

Time savings in login / unwanted garbage such as the apps, or features simply not needed / security risk. I could understand removing smbv1 but its not in the OS anymore.

 

All this is being done on a VM for now.

[jmak]

Another question rather than an answer:

 

I also use Arthur's script, but once you've edited the wim, sysprep fails. Could I make customisations on a VM, then sysprep and then run the script? Or should I make the effort to learn more about Task Sequences?

[ADMaster]

I'd make the effort to learn about task sequences and figure out what works best for you. There is a trade off when testing a new build.

Running my app removal script during OSD takes about 3 minutes according to the logs.

Running the script on the wim takes over an hour. My script on the wim is also applying the latest CU, but the majority of the time is mounting and dismounting.

When I'm testing changes it is much quicker to edit the TS and try again vs modifying the wim.

 

When I have all the changes in place, modifying the wim should take a few minutes off each deployment, but for a few minutes I've never bothered.

Also with a TS, I can apply different changes without having multiple wims.

[alfatec]

Take a look at my post here. Even on a new build of 1803/1809 first login is only about 30 seconds on a non ssd hard drive. All about the profile!!!!

http://www.edugeek.net/forums/windows-10/190996-cheeky-request-stealing-gpos-7.html

[ADMaster]

I'll look through the default profile stuff to see if I can improve first log in for other users.

I've found the long log in only happens to domain admin, I've posted the details in the main 1809 thread.

[alfatec]

When I create my master image I always login as the domain administrator before I Sysprep, that way the profile is already created.

[fiza]

I build my wim purely using Arthur's script,

Would someone please put up a link to this script? @Arthur ?

 

Just starting our first Win10 build so need all the help we can get.

[jmak]

Would someone please put up a link to this script? @Arthur ?

 

Just starting our first Win10 build so need all the help we can get.

This is the thread: http://www.edugeek.net/forums/windows-10/165029-how-get-rid-candy-crush-soda-saga-other-windows-10-start-menu-junk-good.html

 

The latest version of the script I can see in it is post 158. (Page 7 out of 20 for me, but struck me that's going to depend on how many posts your show per page.)

@Arthur is suggesting an alternative method now which is more flexible (see the end of the thread), but I haven't got round to trying it yet. Despite the fact that the script was posted in February, it worked fine for me with 1803; I haven't tested it on 1809 though.

 

If you're starting out with Windows 10 the whole thread is worth scanning through - you'll get a good idea of some of the most widely faced issues as well as information on how people worked round them.

 

Good luck!

[Arthur]

Would someone please put up a link to this script?

Here's a direct link to the post @jmak mentioned...

 

www.edugeek.net/forums/windows-10/165029-how-get-rid-candy-crush-soda-saga-other-windows-10-start-menu-junk-good-7.html#post1620538

 

I wouldn't really recommend it now that OSBuilder has been released. It does everything far better than my script.

 

There's also Adam Gross' Service-WIM.ps1 script (which itself it based on Johan Arwidmark's Create-W10RefImageViaDISM.ps1 script), but he also recommends OSBuilder.

 

https://github.com/AdamGrossTX/PowershellScripts/blob/master/Windows%2010%20Servicing/Service-WIM.ps1

 

To use the Dynamic Updates feature, you must have Dynamic Updates enabled in SCCM, otherwise the script won't find the updates. If you have an alternate method to get the updates, just modify the script to handle that. Hopefully I can get a Windows Update URL to use instead of querying SCCM.

 

You will have to pre-download you SSU, LCU and Flash Updates from the Windows Update Catalog.

 

The base script components were stolen from Johan Arwidmark @jarwidmark and bits and pieces from others along the way. Also, thanks to Johan for mentioning this script at Microsoft Ignite 2018 in the BRK2288 and BRK4028 sessions.

 

If you want an ultimate, hands-off servicing tool, please take a look at David Segura's (@SeguraOSD) OSBuilder tool. It does EVERYTHING and is way better than this!

 

https://deploymentresearch.com/Research/Post/672/Windows-10-Servicing-Script-Creating-the-better-In-Place-upgrade-image

 

Each version of Windows 10 typically has a base support of 18 months (some exceptions apply), meaning that you should make sure to upgrade to the next version before the support ends. If not, you don’t get any more security updates, and that’s not good. Once the next version (feature update) is installed, you keep the system updated and secure by installing monthly cumulative updates. However, sometimes, like in May 2018, in order to apply the May 2018 CU for Windows 10, you also needed a servicing stack update (KB4132650), which also needs another reboot (yuk).

 

When servicing Windows 10 offline you should also update the WinRE.wim (hiding inside the install.wim/index), and index 2 of the boot.wim (Index 2 is the setup image, Index 1 is no longer used). For WinRE, the monthly updates includes OS fixes that might be needed for a future Recovery experience or upgrade success. Microsoft do fixes a few issues that way. For WinPE, the monthly updates patches setup for media boot scenarios if you are going to use the boot.wim for deployment purposes. Now, the boot.wim image is not used for In-Place Upgrades, but why not update it while you are running the script anyway

 

Upgrading your image offline

Unlike images used for bare metal deployment, which happily accepts images that have been captured via both build and capture processes as well as offline servicing, images that you use for Windows 10 servicing (upgrades / feature upgrades), has proven works best when serviced offline. Here follows high-level steps of the offline servicing process.

 

• Mount the Windows 10 ISO of the version you are upgrading to
   
   
  
• Update the core Windows 10 WIM (install.wim / index)
  
  • Extract the Windows 10 Enterprise or Windows 10 Education index from the install.wim (If you’re deploying Windows 10 Pro you’re doing it wrong)
    
  • Mount the extracted WIM image
    
  • If the CU requires a servicing stack update (SSU), again, like for the May 2018 CU, apply that SSU first
    
  • Apply the CU
    
  • Apply the latest Adobe Flash update
    
  • Cleanup the image to reduce size
    
  • Add .NET Framework 3.5
    

   

  [*]Update WinRE which is lurking inside the install.wim

  • Extract the WinRE.wim from the install.wim
    
  • Mount the WinRE.wim
    
  • If the CU requires a servicing stack update (SSU), again, like for the May 2018 CU, apply that SSU first
    
  • Apply the CU
    
  • Cleanup the image to reduce size
    
  • Dismount the WinRE image and save the changes
    
  • Export to a new image, again to reduce size
    

   

  [*]Dismount the install.wim image and save the changes

  • Export to a new image, again to reduce size
    

   

  [*]Update WinPE (boot.wim)

  • Mount the boot.wim, index 2
    
  • If the CU requires a servicing stack update (SSU), apply that SSU first
    
  • Apply the CU
    
  • Cleanup the image to reduce size
    
  • Dismount the WinRE image and save the changes
    
  • Export to a new image, again to reduce size
    

Note #1: Microsoft currently don’t offer any supported solution for updating the compatibility database in the image.

 

^ My script (and @3s-gtech's amended version) never did all of this, but OSBuilder does.

Edited December 7, 2018 by Arthur

[aac]

We have just started deploying our Windows 10 1809 base image and also had the issue of 10 minute first logon for Domain Admin account only. Issue was resolved by enabling the GPO "Admin Approval Mode for Built in Admin Account". We skipped Server 2016 and started deploying Server 2019 and I can confirm that it is also required on Server 2019 for certain functionality to work and probably 2016 aswell. Be careful if setting this GPO as standard for all servers though as certain Server 2012 R2 setups do not play well with Admin Approval mode enabled and file servers are one of these thus I turn on this GPO for new servers manually but set it to apply to workstations automatically...

[ADMaster]

I did a quick test by setting the reg value on one machine and it appears to have done it.

 

What 2012 R2 issues did you have? I'd like to just add this to my security GPO for all machines. I could also just set the reg value as a step in the TS.

[aac]

Hi ADMaster, our 2012 R2 file server was unable to access shared drives and was throwing up spurious errors upon login. I can't remember exactly what the error messages were but it was fairly clear they were permissions related and thus turning off Admin Approval Mode resolved the issue.