Windows 10 Golden Image

[Caffeine11]

We are trying to make a golden image of Windows 10. According to the internet, we should:

 

use a virtual machine

 

use audit mode

 

don't join the pc to a domain

 

disable windows update as updates, particularly feature updates, can cause sysprep to fail

 

disable windows store as windows store updates can cause sysprep to fail

 

Are you advised to do anything else when trying to produce a golden image of windows 10?

[3s-gtech]

We used to use a master image in FOG, I ditched that workflow for MDT with Windows 10. Clients now build from an update able WIM instead, and I can inject drivers, add software etc as I go. It has been the best change I've made in the last couple of years (and I've made a lot). No sysprep, woohoo!

 

Do you need to do it this way?

[Oaktech]

I gave up trying to make an image, it just took too long, and then too long to update every year. I just install via MDT or SCCM direct from the WIM file and then add apps either in the task sequence or by script (Lego WeDo, VLC, IrfanView, Office 2016) or GPO.

[ThatBoringBloke]

Old fashioned 'Golden' images aren't really ideal for Win 10.

 

That said though We do have a lightweight 'Golden' image which simply includes the OS, Office 2019 and Chrome for deployment via WDS.

The image machine is a VM, it does not join the domain, and I do not install any updates to it. I also revert the VM after sysprepping to keep the count down.

 

Upon deployment we use PDQ Deploy to update and install software.

[ITGuyNW]

Old fashioned 'Golden' images aren't really ideal for Win 10.

 

That said though We do have a lightweight 'Golden' image which simply includes the OS, Office 2019 and Chrome for deployment via WDS.

The image machine is a VM, it does not join the domain, and I do not install any updates to it. I also revert the VM after sysprepping to keep the count down.

 

Upon deployment we use PDQ Deploy to update and install software.

 

Pretty much this.

 

One image in a VM. If there's anything major like a feature update I do that, take a snapshot, sysprep and add it to the WDS server. PXE/WDS/MDT, then PDQ adds any other changes such as browser updates.

[jthompson]

Still using a WDS captured image here, following the same sort of stuff as in the opening post, but it has as little as possible done to or included in it. Group Policy does the vast majority of configuration, along with latest CU updates after imaging.

 

I gave up trying to make an image, it just took too long, and then too long to update every year. I just install via MDT or SCCM direct from the WIM file and then add apps either in the task sequence or by script (Lego WeDo, VLC, IrfanView, Office 2016) or GPO.

 

VLC can be downloaded as an MSI, btw, in case that helps you GPO one more thing. The official download page doesn't make it easy but you select 'other systems' from the download button dropdown, then Windows, then MSI for 64bit from the next download button dropdown.

[Guest Guest]

We use an image created using a VM, it only contains latest updates and has built in apps removed. I started using this when we had the covid laptops to make that process bearable

 

This gets updated monthly through config manager

[Jcx500]

Used to do this , now I just whack the wim in mdt and let scripts do the rest

[Caffeine11]

Thank you everyone for taking the time to reply.

 

I was looking at a golden image because being a school we have a lot of software and I found it easier to setup a user profile as I wanted it and then use defprof to copy that profile to the default profile as there were a lot of registry settings to find if I wanted to use group policy. However, Windows 10 and the Windows Store are now making things a lot more difficult. There also seem to be mixed views about using sysprep and copyprofile with Windows 10.

 

However, I have installed MDT and I am beginning to think that using it and group policy may save more time in the longer term.

 

Our machines come with the OS pre installed so I am looking at just installing applications as MDT will deal with exe files.

 

I used the custom task sequence as I like to try and understand what is happening and the post OS task sequence has a lot of steps that I don't understand yet.

 

Currently, my task only has three steps, disable UAC, install applications, and enable UAC. It works until there is a reboot when it stops at the login screen. If I log in manually and rerun litetouch.vbs it continues. I am currently searching for a resolution to this issue. When litetouch runs, it asks me for the password for the local admin account so I was assuming it would auto logon with that and then continue running the script.

[3s-gtech]

Do the applications have a 'no restart' switch you can use?

 

I'm trying to think when the auto-logon works - it certainly does early on in the task sequence, but not sure about later. Always found litetouch resumes itself if it has stopped along the way.

[MartinByard]

The only reason we have gone back to using a Golden Image (although only for certain areas of the Uni) is that to install some of the software via SCCM in our imaging tasksequence took the deployment time over 24 hours! (quite a lot of Autodesk software, MS Visual Studio with all its plugins and a few other biggies - so network transfer was taking up a fair chunk of time). Using the golden image with this software installed took us down to a deployment time of approx 6 hours when doing a few areas at once.

[syntax53]

Intrigued to learn about options moving away from golden images. I also work at a school and like @MartinByard and @kha11 there is so much software to be pre-loaded and pre-setting windows/application settings. I have moved to having scripts install more things post-image and hope to continue moving in that direction, which is why I'm interested in the non-SCCM options ($$).

 

With that said, golden images still work and we've made quite a few under Windows 10. Like others have said, don't feature update a pc in audit mode. If you need to upgrade a golden image, finish the sysprep sequence, update it, and then put it back in sysprep. We keep a "config" image, which is the image in audit mode just before we OOBE it and capture it into the image we use for deployment. If we need to make minor updates we use the config, and if we need to feature update we use the captured one, sysprep, and make a new image. We have it down to being able to create a golden image for a new machine in a day.

 

The Windows Store and AppX things do cause a problem. I have scripts that remove all the non-standard / non-pre-installed stuff that frequently doesn't work with sysprep. And then you post-install and pre-stage the others. This can be a pain because it works best/easiest if you can download all of the appx packages locally. We've been successful so far using tools to grab them behind the scenes from Microsoft.

Edited January 29, 2022 by syntax53