SCCm Image capture hanging

[neonetman]

Well I got to the bottom of yesterdays issue, however when I'm capturing an image for sccm to deploy, the capture gets this far and then just stops and waits there (It's been there for about 4 hours now)

 

 

I'm at a loss where to even go now... about ready to put the PC in a cupboard and give up..... HELP!!!

[computer_expert]

Is there any particular reason that you are still using build & capture with all the various issues it can create?

 

I haven't used thick imaging (build & capture) since the XP days. Instead, I use thin imaging where you use the WIM image on the VLSC ISO then use task sequence steps to install updates/software etc. Yes, it may take a little longer than deploying a thick image, but when you need to update the windows image, you can just switch the deployed WIM in the task sequence (rather than go though the hassle of creating a new image). Updates shouldn't take too much time as generally you just need the latest servicing stack update and cumulative update. Drivers are dynamically deployed based on the model so you don't have to have separate images for each type of computer.

 

I've only really used MDT to do thin imaging but looking at this post, it doesn't look too much different in SCCM.

[neonetman]

TBF because I've never changed the status quo here (although I used slim in previous schools)

 

I've switched to that, and added an unattend.xml file, however the one thing I haven't got working yet is the initial request for the install locale and language. If I can work out why that is still popping up, then I'm laughing

Edited November 6, 2020 by neonetman

[jslate1980]

TBF because I've never changed the status quo here (although I used slim in previous schools)

 

I've switched to that, and added an unattend.xml file, however the one thing I haven't got working yet is the initial request for the install locale and language. If I can work out why that is still popping up, then I'm laughing

Just make sure you download the international English version iso from vlsc, then you don't have to worry about that.

[neonetman]

I now have the image deploying correctly (slim image - thanks @computer_expert), however I need the build to add a local admin account (specific username and password), and to run a script to remove a lot of the pre-provisioned store apps. we normally do this prior to capture, however I can't work out how to do this after the slim build:-

 

* GPO no longer allows me to add a user and set the password.

* The scripts to remove the apps won't run even when execution is set to bypass in the task sequence

 

Can anyone offer any guidance on this?

[psydii]

You can use GPOs to manage your local administrators: https://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/#:~:text=%20%20%201%20Step%201.%20Open%20the,groups%E2%80%9D.%20These%20two%20options%20will%20automatically...%20More%20

 

You end up with a local administrator account per computer, with each account being also domain user account, but you can then script the setting of passwords. Or you could use LAPS depending on why you needed local adminsitrator accounts per machine.

[MartinByard]

We get rid of (most of) the pre-provisioned apps running the below script, during our SCCM Task sequence, before it does the reboot to install the SCCM client and setup windows. It can be faily easily altered to either leave more apps (if they're needed) or be harsher and remove more apps by editing the whitelist in each section.

 

# Functions
function Write-LogEntry {
   param(
       [parameter(Mandatory=$true, HelpMessage="Value added to the RemovedApps.log file.")]
       [ValidateNotNullOrEmpty()]
       [string]$Value,

       [parameter(Mandatory=$false, HelpMessage="Name of the log file that the entry will written to.")]
       [ValidateNotNullOrEmpty()]
       [string]$FileName = "RemovedApps.log"
   )
   # Determine log file location
   $LogFilePath = Join-Path -Path $env:windir -ChildPath "Temp\$($FileName)"

   # Add value to log file
   try {
       Out-File -InputObject $Value -Append -NoClobber -Encoding Default -FilePath $LogFilePath -ErrorAction Stop
   }
   catch [system.Exception] {
       Write-Warning -Message "Unable to append log entry to RemovedApps.log file"
   }
}

Start-transcript -Path C:\Windows\Remove_Apps.txt -Force

# Get a list of all apps
Write-LogEntry -Value "Starting built-in AppxPackage, AppxProvisioningPackage and Feature on Demand V2 removal process"
$AppArrayList = Get-AppxPackage -PackageTypeFilter Bundle -AllUsers | Select-Object -Property Name, PackageFullName | Sort-Object -Property Name

# White list of appx packages to keep installed
$WhiteListedApps = New-Object -TypeName System.Collections.ArrayList
$WhiteListedApps.AddRange(@(
   "Microsoft.DesktopAppInstaller",
   "Microsoft.MSPaint",
   "Microsoft.MicrosoftStickyNotes",
   "Microsoft.WindowsCalculator", 
   "Microsoft.WindowsSoundRecorder", 
   "Microsoft.WindowsStore"
   "Microsoft.Windows.Photos"
))

   #"Microsoft.Messaging", 
   #"Microsoft.StorePurchaseApp",
   #"Microsoft.MicrosoftOfficeHub",
   #"Microsoft.WindowsAlarms",
   #"Microsoft.WindowsCommunicationsApps", # Mail, Calendar etc

# Windows 10 version 1809
$WhiteListedApps.AddRange(@(
   "Microsoft.ScreenSketch",
   "Microsoft.HEIFImageExtension",
   "Microsoft.VP9VideoExtensions",
   "Microsoft.WebMediaExtensions",
   "Microsoft.WebpImageExtension"
))

# Loop through the list of appx packages
foreach ($App in $AppArrayList) {
   # If application name not in appx package white list, remove AppxPackage and AppxProvisioningPackage
   if (($App.Name -in $WhiteListedApps)) {
       Write-LogEntry -Value "Skipping excluded application package: $($App.Name)"
   }
   else {
       # Gather package names
       $AppPackageFullName = Get-AppxPackage -Name $App.Name | Select-Object -ExpandProperty PackageFullName -First 1
       $AppProvisioningPackageName = Get-AppxProvisionedPackage -Online | Where-Object { $_.DisplayName -like $App.Name } | Select-Object -ExpandProperty PackageName -First 1

       # Attempt to remove AppxPackage
       if ($AppPackageFullName -ne $null) {
           try {
               Write-LogEntry -Value "Removing AppxPackage: $($AppPackageFullName)"
               Remove-AppxPackage -Package $AppPackageFullName -Verbose -ErrorAction Stop #| Out-Null
               Start-Sleep 60
           }
           catch [system.Exception] {
               Write-LogEntry -Value "Removing AppxPackage '$($AppPackageFullName)' failed: $($_.Exception.Message)"
           }
       }
       else {
           Write-LogEntry -Value "Unable to locate AppxPackage: $($AppPackageFullName)"
       }

       # Attempt to remove AppxProvisioningPackage
       if ($AppProvisioningPackageName -ne $null) {
           try {
               Write-LogEntry -Value "Removing AppxProvisioningPackage: $($AppProvisioningPackageName)"
               Remove-AppxProvisionedPackage -PackageName $AppProvisioningPackageName -Online -Verbose -ErrorAction Stop #| Out-Null
               Start-Sleep 60
           }
           catch [system.Exception] {
               Write-LogEntry -Value "Removing AppxProvisioningPackage '$($AppProvisioningPackageName)' failed: $($_.Exception.Message)"
           }
       }
       else {
           Write-LogEntry -Value "Unable to locate AppxProvisioningPackage: $($AppProvisioningPackageName)"
       }
   }
}

# White list of Features On Demand V2 packages
Write-LogEntry -Value "Starting Features on Demand V2 removal process"
$WhiteListOnDemand = "NetFX3|Tools.Graphics.DirectX|Tools.DeveloperMode.Core|Language|Browser.InternetExplorer|ContactSupport|OneCoreUAP|Media.WindowsMediaPlayer"

# Get Features On Demand that should be removed
try {
   $OSBuildNumber = Get-WmiObject -Class "Win32_OperatingSystem" | Select-Object -ExpandProperty BuildNumber

   # Handle cmdlet limitations for older OS builds
   if ($OSBuildNumber -le "16299") {
       $OnDemandFeatures = Get-WindowsCapability -Online -ErrorAction Stop | Where-Object { $_.Name -notmatch $WhiteListOnDemand -and $_.State -like "Installed"} | Select-Object -ExpandProperty Name
   }
   else {
       $OnDemandFeatures = Get-WindowsCapability -Online -LimitAccess -ErrorAction Stop | Where-Object { $_.Name -notmatch $WhiteListOnDemand -and $_.State -like "Installed"} | Select-Object -ExpandProperty Name
   }

   foreach ($Feature in $OnDemandFeatures) {
       try {
           Write-LogEntry -Value "Removing Feature on Demand V2 package: $($Feature)"

           # Handle cmdlet limitations for older OS builds
           if ($OSBuildNumber -le "16299") {
               Get-WindowsCapability -Online -ErrorAction Stop | Where-Object { $_.Name -like $Feature } | Remove-WindowsCapability -Online -Verbose -ErrorAction Stop #| Out-Null
               Start-Sleep 60
           }
           else {
               Get-WindowsCapability -Online -LimitAccess -ErrorAction Stop | Where-Object { $_.Name -like $Feature } | Remove-WindowsCapability -Online -Verbose -ErrorAction Stop #| Out-Null
               Start-Sleep 60
           }
       }
       catch [system.Exception] {
           Write-LogEntry -Value "Removing Feature on Demand V2 package failed: $($_.Exception.Message)"
       }
   }    
}
catch [system.Exception] {
   Write-LogEntry -Value "Attempting to list Feature on Demand V2 packages failed: $($_.Exception.Message)"
}

# Complete
Write-LogEntry -Value "Completed built-in AppxPackage, AppxProvisioningPackage and Feature on Demand V2 removal process"

Stop-Transcript

 

As for adding a user - any reason you couldn't add a simple run command line (or powershell, whatrever you fancy) step somewhere in the task sequence, to do :

 

net.exe user /add "Admin Username" "Admin Password" /fullname:"Admin Username" /comment:"Local admin account"
net.exe localgroup administrators "Admin Username" /add
WMIC USERACCOUNT WHERE "Name='Admin Username'" SET PasswordExpires=FALSE

[jslate1980]

I now have the image deploying correctly (slim image - thanks @computer_expert), however I need the build to add a local admin account (specific username and password), and to run a script to remove a lot of the pre-provisioned store apps. we normally do this prior to capture, however I can't work out how to do this after the slim build:-

 

* GPO no longer allows me to add a user and set the password.

* The scripts to remove the apps won't run even when execution is set to bypass in the task sequence

 

Can anyone offer any guidance on this?

 

Laps is the best way to do it, but you can set a local admin account through command line during task sequence https://blog.techygeekshome.info/2016/02/sccm-add-local-user-during-osd/

 

I use this script during task sequence to remove apps https://ccmexec.com/2018/04/windows-10-remove-builtin-apps-script-with-multiple-version-support/