Sysprep unattend windows 10

This article builds on my previous two sysprep articles:

• Windows 8/8.1
• Windows 7

Files you will need…

— Windows Assessment and Deployment Kit (Windows ADK) for Windows 10

From the kit you need to install the Deployment Tools which contains Windows System Image Manager (SIM) used for creating unattend .xml files. This should be install on a computer not being used for imaging.

• Home Page
• Direct Link

— Windows 10 image.wim

To create an unattend.xml file to be used for sysprep, you will also need the image.wim file located on the Windows 10 installation disk you used to Install Windows on your image computer (located in the Sources folder).

Let’s get started…

Install Windows 10 on your image computer. Here are initial settings I use.

Initial OS Load

During Install (leave defaults unless stated

• Choose the Custom (advanced) option: Setup partition/s as needed. Format your partition/s.
• Let’s get connected:  Skip and click Next
• Get going fast:  Customize settings

Customize Settings

• Personalization: All off
• Location: All off
• Browser and protection: All off
• Connectivity and error reporting: All off
  • Choose how you’ll connect:   Join a domain
  • Who is going to use this PC?:  Operator (no password)

Immediately After Install  

• Logon using the Operator account you created above.
• Activate Windows then disconnect the computer from the Internet.
  This will ensure that the built-in apps do not update otherwise your sysprep will fail.
• Uninstall built-in apps using PowerShell. Run PowerShell as Administrator. Paste the following commands onto the PowerShell command line and hit Enter.

Get-AppxPackage *3dbuilder* | Remove-AppxPackage
                      Get-AppxPackage *windowsalarms* | Remove-AppxPackage
                      Get-AppxPackage *Appconnector* | Remove-AppxPackage
                      Get-AppxPackage *windowscalculator* | Remove-AppxPackage
                      Get-AppxPackage *windowscommunicationsapps* | Remove-AppxPackage
                      Get-AppxPackage *windowscamera* | Remove-AppxPackage
                      Get-AppxPackage *CandyCrushSaga* | Remove-AppxPackage
                      Get-AppxPackage *officehub* | Remove-AppxPackage
                      Get-AppxPackage *skypeapp* | Remove-AppxPackage
                      Get-AppxPackage *getstarted* | Remove-AppxPackage
                      Get-AppxPackage *zunemusic* | Remove-AppxPackage
                      Get-AppxPackage *windowsmaps* | Remove-AppxPackage
                      Get-AppxPackage *Messaging* | Remove-AppxPackage
                      Get-AppxPackage *solitairecollection* | Remove-AppxPackage
                      Get-AppxPackage *ConnectivityStore* | Remove-AppxPackage
                      Get-AppxPackage *bingfinance* | Remove-AppxPackage
                      Get-AppxPackage *zunevideo* | Remove-AppxPackage
                      Get-AppxPackage *bingnews* | Remove-AppxPackage
                      Get-AppxPackage *onenote* | Remove-AppxPackage
                      Get-AppxPackage *people* | Remove-AppxPackage
                      Get-AppxPackage *CommsPhone* | Remove-AppxPackage
                      Get-AppxPackage *windowsphone* | Remove-AppxPackage
                      Get-AppxPackage *photos* | Remove-AppxPackage
                      Get-AppxPackage *WindowsScan* | Remove-AppxPackage
                      Get-AppxPackage *bingsports* | Remove-AppxPackage
                      Get-AppxPackage *windowsstore* | Remove-AppxPackage
                      Get-AppxPackage *Office.Sway* | Remove-AppxPackage
                      Get-AppxPackage *Twitter* | Remove-AppxPackage
                      Get-AppxPackage *soundrecorder* | Remove-AppxPackage
                      Get-AppxPackage *bingweather* | Remove-AppxPackage
                      Get-AppxPackage *xboxapp* | Remove-AppxPackage
                      Get-AppxPackage *XboxOneSmartGlass* | Remove-AppxPackage

Open in new window

• Confirm that all the apps have been uninstalled. The shortcuts should no longer appear on the All Apps start menu.
• The following four apps should still be present as they cannot be removed. 
  • Cortana
  • Contact Support
  • Microsoft Edge
  • Windows Feedback
• NOTE: In Windows 8.1 the Store app could not be uninstalled. This has changed in Windows 10. if you would like to make this available to all users then you should not permanently uninstall preinstalled apps. Useful apps that you may want users to have access to are: Store, Calculator and Voice Recorder
• Following the uninstall instructions above will allow the apps to be reinstalled on first log on for all new users. To remove certain apps you will need to script this at logon or just after the user logs in.
• Enable the local Administrator account. Set a password for the account. Password never expires (optional).
• Update the local Operator account.  Set a password for the account. Password never expires (optional).

Now, install all necessary programs, run windows updates, configure the start screen, create local user accounts and configure the profile and OS the way you would like it to be. Find below some tips and tricks to add to your image. When completed, the computer should almost be ready to be sysprepped.

Additions – Image Tips and Tricks

Create SetupComplete.cmd File

On your image computer browse to the C:\Windows\setup directory.  Within the Setup folder create a new folder named Scripts. Within the Scripts folder create a file named SetupComplete.cmd. Commands placed in this file will run just before you are presented with the Windows logon screen. We’ll add some commands to this file shortly.

Run First Log On Commands

You can do this a few ways, including through your unattend.xml file. I choose to create a script and call it when users log in for the very first time. Launch.exe will call Cleanup.exe, which contains the commands to run.

Here is the code for the Launch.vbs script:

Set WshShell = WScript.CreateObject("Wscript.Shell")
                      Set objFSO = CreateObject("Scripting.FileSystemObject")
                      
                      strAppData = WshShell.ExpandEnvironmentStrings("%APPDATA%")
                      
                      '-----------------------------------------------------------------------
                      
                      ' Run computer cleanup script
                      
                      Set objShell = CreateObject("WScript.Shell")
                      strCleanup = strAppData & "\Scripts\Cleanup.exe"
                      objShell.run "cmd /c " & strCleanup,0,False
                      
                      '-----------------------------------------------------------------------
                      
                      WScript.Quit

Open in new window

Convert Launch.vbs to an executable (Launch.exe) and place it in Operator’s Startup folder. This file will get deleted on completion of Cleanup.exe. You should add this file just before you’re ready to run sysprep as you may need to reboot your computer at different stages.

Note: To create and compile my scripts I use VbsEdit. It’s costs $59 but you can install it on multiple machines and it comes with a lifetime license.

Now let’s create the Cleanup.exe script. Here is the code for the Cleanup.vbs:

Set WshShell = WScript.CreateObject("Wscript.Shell")
                      Set objFSO = CreateObject("Scripting.FileSystemObject")
                      Set objShell = CreateObject("WScript.Shell")
                      
                      strAppData = WshShell.ExpandEnvironmentStrings("%APPDATA%")
                      strLocalAppData = WshShell.ExpandEnvironmentStrings("%LOCALAPPDATA%")
                      strUserProfile = WshShell.ExpandEnvironmentStrings("%USERPROFILE%")
                      strAllUsers = WshShell.ExpandEnvironmentStrings("%ALLUSERSPROFILE%")
                      
                      '-----------------------------------------------------------------------
                      
                      
                      
                      ' ADD COMMANDS HERE
                      
                      
                      
                      '-----------------------------------------------------------------------
                      
                      ' Delete Launch.exe
                      
                      strAppData = WshShell.ExpandEnvironmentStrings("%APPDATA%")
                      strLaunch = strAppData & "\Microsoft\Windows\Start Menu\Programs\Startup\Launch.exe"
                      
                      If objFSO.FileExists(strLaunch) Then
                        objFSO.DeleteFile strLaunch, True
                      End If
                      
                      '-----------------------------------------------------------------------
                      
                      WScript.Quit

Open in new window

You can add any commands you like in this script. Here you can re-install OneDrive, which we will go over later in the guide. At the end of the script Launch.exe will get deleted so that it does not run again for the currently logged in user. Copy Cleanup.exe to %AppData%\Scripts. You will need to create the Scripts folder as it does not exist. 

Cleanup.exe and Launch.exe will become part of the Default profile. It will only run when a new user logs in for the very first time.

Adjust Display Settings

You may notice that some programs when opened do not display as sharp as others. In my case, as an example,  Adobe Acrobat. The program seems fuzzy or blurry when opened. If this is the case for you then check the following setting:

• All Apps — Settings — Display
• Change the size of text, apps and other items: Set the slider to 100%. I find in some cases the default is 125%.

Boot To Desktop

Boot right to the desktop. Navigate to: All Apps – Settings – System – Tablet Mode

When I sign in: Go to the desktop

Here you’re also able to set how your device handles switching from desktop to tablet mode.

WinSAT prepop (Windows System Assessment Tests Scores)

You may lose the aero theme after sysprep. Run the following command at an elevated command prompt:

WinSAT prepop

Open in new window

 This will generate the WinSAT prepop .xml results files to the Datastore directory, located at:

%WINDIR%\performance\winsat\datastore.

This enables you to keep the configured aero theme after running sysprep (otherwise it will be reset back to basic). Additional information about WinSAT can be found here.

Restart the computer then log back in as Operator. Make sure the theme is still set to your default theme. If needed, set it back to your default theme.

PowerCFG Command (GUID for Default power plan)

Specify the default power plan in your unattend.xml file. Run the following at an elevated command prompt:

Powercfg –list

Open in new window

Look for your default power plan. Write down the guid for the plan. We will add this to your unattend.xml file later.

Slipstream Drivers

To slipstream drivers into your Windows image you can use the command line utility “pnputil.exe”.

If you need a certain driver installed in the image, like an adapter, scanner or printer driver, and do not want your users to be prompted for the driver, then add it to the DriverStore in your Windows image. The command to add a driver using this utility is (HP001.inf is an example driver):

pnputil.exe -a HP0001.inf

Open in new window

The command needs to be run at an elevated command prompt. More information about this command can be found here.

Disable Windows Features or Noticifactions
 

 Using notepad, create the following registry files to disable features or notifications. Copy and paste the following code then save the file with a .reg extension. For example DisableBackupMonitoring.reg. Run the registry file/s to import the changes to the registry.

Disable Backup Monitoring:

Windows Registry Editor Version 5.00
                      
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup]
                      "DisableMonitoring"=dword:00000001

Open in new window

Disable Password Reveal:

Windows Registry Editor Version 5.00
                      
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
                      "DisablePasswordReveal"=dword:00000001

Open in new window

Disable IE Suggested Sites:

Windows Registry Editor Version 5.00
                      
                      [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Suggested Sites]
                      "Enabled"=dword:00000000

Open in new window

Note: You can also apply the registry files via group policy.

OneDrive Setup

When you use the CopyProfile switch in your unattend file, the OneDrive shortcut in the All Apps menu continues to point to the Operator account instead of the currently logged in user. To resolve this issue OneDrive needs to be re-installed on first log on for each user. Do the following when logged in as Operator:

Manually copy the OneDrive Update folder from within the Operator profile to the ProgramData folder:

%LOCALAPPDATA%\Microsoft\ OneDrive\Update  to   %PROGRAMDATA%\Microsoft\OneDrive\Update

Run the following commands at an elevated command prompt to clean up the old OneDrive folders:

move "%LOCALAPPDATA%\Microsoft\OneDrive" "%LOCALAPPDATA%\Microsoft\OneDrive.old"
                      del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk" /q/s
                      rd "%LOCALAPPDATA%\Microsoft\OneDrive.old" /q/s
                      rd "%USERPROFILE%\OneDrive" /q/s

Open in new window

To clean up the old OneDrive registry entries, create a registry file named OneDriveCleanup.reg using notepad and paste the following code. Run the registry file.

Windows Registry Editor Version 5.00
                      
                      [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive]

Open in new window

Now you can add the following code to the Cleanup.exe file you created above to re-install OneDrive when the user logs in for the very first time.

' Run OneDrive Setup
                      
                      strOneDrive = strAllUsers & "\Microsoft\OneDrive\Update\OneDriveSetup.exe /silent"
                      objShell.run "cmd /c " & strOneDrive,0,True

Open in new window

All folders will be recreated, including the All Apps shortcut.

Create Unattend.xml File

When the computer is ready you’ll need to create a unattend.xml answer file using Windows System Image Manager (Windows SIM). You should already have Windows SIM installed on another computer. If not, the download link is listed above.

1. Insert the media you used to install Windows 10 on your image computer into your CD-DVD drive.
2. Start Windows SIM. From the menu select “Tools – Create Catalog”. You’ll be prompted for the “install.wim” file located on your media. Browse to the install.wim file in the sources directory on your disk. When the catalog is complete you’ll be ready to configure your answer file.
3. I’ve attached a sample unattend.xml file for reference. Open the file with Windows SIM and take a look at some of the settings I’ve configured.

In my unattend.xml file you’ll see:

<ComputerName>*</ComputerName>

Open in new window

This will allow sysprep to provide a random name for the computer after sysprep.

<CopyProfile>true</CopyProfile>

Open in new window

This tells sysprep to copy the configured profile you’ve created to the default profile.

<SkipRearm>0</SkipRearm>

Open in new window

Set SkipRearm to 1 while customizing your computer.

Before running the Sysprep command the final time before deploying an image, rearm the computer by setting the SkipRearm setting to 0. This resets the Activation grace-period timer.

<PreferredPlan>your.guid</PreferredPlan>

Open in new window

This specifies the default power plan for your image. Update the unattend.xml file with the guid of the power plan you retrieved earlier. 

<DisableAntiSpyware>true</DisableAntiSpyware>

Open in new window

Setting this to True will disable Windows Defender. Set this to False if you are not deploying your own antivirus program.

<MachineObjectOU>OU=Re-Imaged,OU=Computers,DC=your,DC=domain,DC=com</MachineObjectOU>

Open in new window

You must specify an OU to add the computers to otherwise they will not be added to the domain.

<DoNotCleanUpNonPresentDevices>true</DoNotCleanUpNonPresentDevices>
                      <PersistAllDeviceInstalls>true</PersistAllDeviceInstalls>

Open in new window

When set to True, this tells sysprep not to remove installed hardware from the image during sysprep. This should be the case when distributing the image to the same model computer. If you would like to create a clean sysprep image, meaning you are able to install the image on any computer, no matter the hardware, the above should be set to False.  

The other thing regarding the unattend.xml, you need to create a local user during the sysprep process.  When you install Windows 10 (using the disk) you’re prompted to create a local user. This process still occurs when using an attend.xml file and sysprep. In the answer file I create a local user named TempUser. TempUser gets deleted when the laptop first boots up to Windows logon screen. The sole purpose of TempUser is to hide the prompt to create a local user after sysprep runs.

Customize the answer file to meet your image needs. After you’ve completed the unattend.xml file, copy the file to C:\Windows\System32\Sysprep.

Customize SetupComplete.cmd

On your image laptop, browse to the C:\Windows\setup\Scripts directory your created earlier.  Open SetupComplete.cmd for editing. As I said earlier, commands placed in this file will run just before you are presented with the Windows logon screen.

To delete the previously created TempUser account, add the following command to SetupComplete.cmd:

net user TempUser /delete

Open in new window

To enable the local Administrator account, add the following command to SetupComplete.cmd:  

net user Administrator /active:yes

Open in new window

Even though you may have enabled the administrator account on the imaged laptop before running sysprep, it will be disabled again.

Delete the Domain Users group from the local Administrators and Users groups using the above commands.

net localgroup Administrators "Domain\Domain Users" /delete
                      net localgroup Users "Domain\Domain Users" /delete

Open in new window

To delete the unattend.xml file, add the following command to SetupComplete.cmd:

del C:\Windows\System32\Sysprep\unattend.xml

Open in new window

Even though the passwords you enter in the xml file are encrypted, you’ll feel better knowing the file is not there. I’ve attached a sample SetupComplete.cmd file for reference. You may add whatever commands you need to run here in this file. Save the file when finished.

Note: One change I’ve noticed from Windows 8.1 to Windows 10 is that you will

not

be able to add domain users/groups to local groups through SetupComplete.cmd. If you find otherwise Let me know.

Run Sysprep

You should now be ready to run sysprep on the computer.

Note: I highly recommend that you take an image of your image computer before you run sysprep. Things DO go wrong and being able to get back to a pre-sysprep state will save you a lot of time and heart-ache.

From within the configured profile you’ve created, open a command prompt. Navigate to C:\Windows\System32\Sysprep. Type the following command to start the sysprep process:

sysprep.exe /generalize /oobe /shutdown /unattend:unattend.xml

Open in new window

The computer will shut down after sysprep has finished.

Take An Image

Now it’s time to take an image of the hard drive.  Everyone has their own way of doing this. I use Symantec Ghost as it takes an image of the whole drive.  I’ve tested ImageX and found it to have it drawbacks. The main reason I choose not to use it is because we use two partitions in our image. The C: partition for the OS and the D: partition for the users’ data. You cannot take a disk image with ImageX. You have to do each partition individually. The same goes for when applying the image. I ghost the hard drive and have our completed image.

I’ve attached a zip containing the files discussed in this guide.

I hope this guide is helpful and puts you in the right direction for a successful sysprep image. You’re welcome to post messages for your own tricks or tips that you think will be beneficial to the Windows 10 sysprep community!

Good luck!

Ivano

GuideFiles.zip

В этом гайде мы разберемся как создать собственный установочный образ с Windows 10/11 с предустановленными программами, необходимыми файлами, другими настройками среды и приложений. Превалирующий сейчас подход предполагает развертывания чистого образа Windows, после чего на компьютер устанавливаются необходимые программы: через GPO, командами загрузки и установки приложений в
AutoUnattend.xml
или в скрипте
%WINDIR%\Setup\Scripts\SetupComplete.cmd
, логон скриптами Windows, средствами автоматизации (SCCM, Intune, Ansible, и пр). Однако в некоторых случаях особенности бизнеса требуют, чтобы на компьютер сразу разворачивался готовый образ Windows со всеми необходимыми программами.

Процесс создания собственного установочного образа Windows с предустановленным софтом будет состоять из следующих этапов:

1. Развертывание чистой Windows на эталонном компьютере (виртуальной машине);
2. Вход в режим аудита, установка необходимых приложений, настройка окружения;
3. Загрузка в среде WinPE и захват WIM образа Windows с помощью DISM;
4. Замена оригинального install.wim на установочной USB флешке (ISO образе).

Если вы развертываете Windows на компьютеры в корпоративной сети, удобнее использовать MDT, который позволяет добавлять/обновлять программы в установочный процесс без модификации каждый раз установочного WIM образа.

Подготовка эталонного образа Windows с установленными программами

На первом этапе вы должны создать эталонный образ Windows со всем необходимым набором программ, файлов и настроек. Для этого нужно выполнить чистую установку Windows на виртуальную машину или компьютер

Итак, начните с получения оригинального установочного образа Windows 10/11 в виде ISO файла или сразу запишите его на загрузочную USB флешку с помощью Media Creatin Tool или Rufus.

Выполните ручную установку Windows и на этапе OOBE (когда вам предлагают выбрать региональные настройки и создать учетную запись), нажмите
CTRL + SHIFT + F3
. Это переведет компьютер в режим аудита (Audit Mode), в котором будет выполнен автоматический вход под встроенной учётной записью Administrator.

Картинка с сайта: winitpro.ru

После появления рабочего стола, сверните окно утилиты sysprep (не закрывая его) и можете приступить к установке программ, обновлений, настройке нужных параметров Windows.

В этом примере я воспользуюсь пакетным менеджером WinGet для установки программ в Windows:

winget install --id=7zip.7zip -e ; winget install --id=Notepad++.Notepad++ -e ; winget install --id=VideoLAN.VLC -e ; winget install --id=WinDirStat.WinDirStat -e ; winget install --id=dotPDNLLC.paintdotnet -e ; winget install --id=IrfanSkiljan.IrfanView -e ; winget install --id=Microsoft.PowerToys -e

Дополнительно я вручную создал каталоги и скопировал файлы для некоторых корпоративных приложений.

Картинка с сайта: winitpro.ru

Настройте ярлыки на рабочем столе, плитки в меню Start, фоновые рисунки, заставки, цветовые схемы и прочее. Настройте параметры локальной групповой политики с помощью редактора
gpedit.msc
. Эти настройки в дальнейшем будут применены ко всем пользователям на компьютерах, которые вы развернете из вашего образа.

После того, как вы завершили настройку операционной и приложений, нужно выполнить очистку Windows для уменьшения итогового размера образа.

Удалите имеющиеся теневые копии и точки восстановления:

vssadmin delete shadows /All /Quiet

Очистите неиспользуемые файлы компонентов и обновлений в папке WinSxS:

Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase

Удалите загруженные файлы обновлений Windows:

del %windir%\SoftwareDistribution\Download\*.* /f /s /q

Для очистки папок Temp, Downloads и кэша в профиле пользователя можно использовать этот PowerShell скрипт.

Выполните очистку диска с помощью утилиты cleanmgr:

Cleanmgr /sagerun:1

Очистите логи Windows:

for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Очистите корзину:

Clear-RecycleBin -Force

Чтобы применить настройки текущего пользователю к шаблонному пользователю Default, создайте файл ответов unattend.xml в каталоге C:\Windows\System32\Sysprep:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<CopyProfile>true</CopyProfile>
</component>
</settings>
</unattend>

Осталось подготовить ваш настроенный образ Windows к развертыванию с помощью утилиты sysprep.exe. Разверните окно sysprep и выберите в ней опции:

• Enter System Out-of-Box Experience (OOBE)
• Generalize
• Shutdown

Картинка с сайта: winitpro.ru

После завершения этой операции, компьютер выключиться автоматически.

Захват настроенного образа Windows с помощью DISM

На этом этапе нужно выполнить офлайн захват образа установленной Windows в WIM файл и поместить его на отдельный диск (мы подключили отдельный диск емкостью 60 Гб к компьютеру)

Загрузите компьютер с эталонной версией Windows с загрузочного диска в среде WinPE (WinRE). Можно загрузиться с установочной USB флешки с Windows и на этапе начала установки нажать
Shift+F10
, чтобы открыть командную строку.

Вам нужно идентифицировать буквы диска, которые назначены разделу с Windows и чистому разделу, куда будет скопирован WIM файл. Выполните команды:

diskpart
list disk
exit

Картинка с сайта: winitpro.ru

В нашем примере диску с Windows присвоена бука E:, а чистому диску – буква D:.

Чтобы выполнить захват офлайн образа Windows на диске E и поместить полученный WIM образ на D, выполните команду:

dism /capture-image /imagefile:D:\install.wim /capturedir:E:\ /ScratchDir:D:\ /name:"MyWinImage" /compress:maximum /checkintegrity /verify /bootable

В моем случае захват образа длился около 30 минут.

Картинка с сайта: winitpro.ru

Замена оригинального образа Windows (Install.wim) на USB флешке

После того, как вы захватили ваш настроенный образ Windows, вы можете заменить файл с оригинальным установочным образов install.wim или install.esd (ESD это формат с максимальным сжатием образа WIM) на установочной USB флешке (каталог
\sources
).

В моем случае, я переименовал старый образ в install.esd_bak и скопировал на флешку новый образ install.wim.

Картинка с сайта: winitpro.ru

Обратите внимание, что размер WIM образа с предустановленными программами существенно увеличился (с 4 до 10 Гб).

Если у вас USB флешка с FAT32 для установки Windows на UEFI компьютерах, вы не сможете разместить файл больше 4 Гб на этой файловой системе. В этом случае большой WIM файл нужно разбить на несколько мелких SWM:

Dism /Split-Image /ImageFile:D:\sources\install.wim /SWMFile:c:\tmp\install.swm /FileSize:3500

В данном случае DISM создаст четыре файла install.swm, install2.swm, install3.swm, install4.swm, которые нужно скопировать в папку
\sources
. Установщик Windows сам соберет SWM файлы при развертывании операционной системы.

Теперь вы можете с USB флешки развернуть на любой компьютере созданный вами образ Windows. После завершения установки Windows убедитесь, что все предустановленные программы доступны:

Get-Package

Картинка с сайта: winitpro.ru

Недостаток такого подхода с развёртыванием преднастроенного образа Windows в том, что для обновления любого приложения в образе вам придется пересобрать его заново.

At work I tend to deal with creating the image we use for distribution of our computers. Windows 10 was a rather unique challenge of anything that could go wrong, did. We use Windows 10 Professional. Here’s just a quick list of versions:

• 1609 — Works, but updates can get stuck, requires different UAC on a domain
• 1703 — Skipped, updating to worked fine, requires same UAC settings same as 1609
• 1709 — Skipped, updating sometimes broke the system files, UAC settings same as 1609
• 1803 — Could not get to work, updating to it broke permissions making searching impossible unless you were a pre-existing admin
• 1809 — Works, requires slightly different Unattend, works with domain settings and UAC used for Windows 7

(UAC settings need Admin Approval mode enabled and all Admins to run in Admin approval mode)

Common issues I ran into included:

• Users logged in were unable to use search features
• The very first login may appear okay, but any after that break
• Warnings about running programs as an administrator (UAC settings in domain can fix this)
• Unable to apply all group policies without numerous attempts
• Creating the .clg file needed has only worked for me once
• Enabling .NET 3.5 in Windows features
• Shutdown not working correctly

Currently I am trying to only work on a 64 bit image, we’re in the process of phasing out 32 bit. So now let’s do a walk-through and with any luck someone will find this helpful, maybe even help me fix problems I’ve come across. I’ll be doing the most recent at the time, 1809.

So the first and obvious step, install Windows 10. After installed and gets ready for setup, press Ctrl+Shift+F3. Get into Windows and get it started on updates. After that, you can install any software you need to. I personally try to install everything through Chocolatey, and I may include setting that up in another post.

So let’s talk about enabling .NET 3.5. To do this, you need the Windows 10 installation disc in, and let’s assume that it’s the D drive (adjust to your needs). You then use the command:

DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:D:\sources\sxs

After that, your .NET 3.5 should be enabled.

Now at this point, we should direct our attention to the unattend file. On another computer, install the Windows ADK (make sure the computer is the same architecture). From what I’ve read, some say to create an unattend using the install.wim on the iso, others say turn a blank Windows 10 installation to a wim and then use that. Both fail when creating the .clg file for it after a while of sitting there trying. One day after it said it failed, a .clg file magically appeared. Why or how, I don’t know. Rather than walk anyone through the process, I’ll just include the .wim and .clg file. If anyone knows why it fails making the .clg file, let me know.

WIM
CLG

So here’s the bear minimum settings I found I needed to get the installation to go through. Keep in mind, it still flashes the setup for a moment, I think it’s just because the network takes a minute to figure itself out. Open up Windows System Image Manager and create a new Unattend using the WIM file. Then add these settings at minimum:

• amd64_Microsoft-Windows-Security-SPP_neutral -> Pass 3 Generalize
• SkipRearm set to 1
• amd64_Microsoft-Windows-Deployment_neutral -> Pass 4 Specialize
• ExtendOSPartition
• Extend set to true
• Delete other options that appear
• amd64_Microsoft-Windows-Shell-Setup_neutral -> Pass 4 Specialize
• ComputerName set to *
• Set your product key
• Set your timezone
• Do NOT put in anything for copy profile, that breaks the search feature for users setup after the installation
• Delete all the other sub pieces that show.
• amd64_Microsoft-Windows-International-Core_neutral -> Pass 7 oobe System
• InputLocale set to 0409:00000409 for en-US
• SystemLocale set to en-US
• UILanguage set to en-US
• UserLocale set to en-US
• amd64_Microsoft-Windows-Deployment_neutral -> Pass 7 oobe System
• AutoLogon should be set if you need any of that set with enabled to true and logoncount to 2
• Set a password if you want it to autologon
• FirstLogonCommands is where you are going to set any Post-SysPrep stuff that should supercede a logon, add as many as you need with whatever you need
• Under OOBE you need all of these to skip the setup:
• HideEULAPage true
• HideLocalAccountScreen true
• HideOEMRegistrationgScreen true
• HideOnlineAccountScreens true
• HideWirelessSetupInOOBE true
• ProtectYourPC 2
• UserAccounts needs at least the administrator password to skip past the login
• You can either set the AdministratorPassword or right-click on LocalAccounts and create one if needed

After that is done, you should be ready to load what you need on the computer to create an image with and get that going. So let’s talk about that.

First we need to copy over our unattend.xml file we so painstakingly made. I copy this to C:\. Now there is a cleanup we can do, using the SetupComplete.cmd that will get ran automatically after. So do that, we need to create the directory C:\Windows\Setups\Scripts. Then let’s create a file called SetupComplete.cmd in that folder and open it with notepad. We need the following commands for a decent cleanup:

This will remove all the traces of our unattend file and then itself. With that being setup, we need to run the sysprep. So do this, just run the command:

«C:\windows\system32\sysprep\sysprep.exe» /generalize /oobe /reboot /unattend:c:\unattend.xml

Word of caution, this will reboot the computer, not shut it down. I’ve had to use reboot because shutdown does not shut down Windows properly, it hibernates. That means after you boot back up, it just drops you back where you were until you tell it to restart. At one point shutdown worked, but I had other issues around then and I think it was because I changed the shutdown procedure.

Anyway, that’s a rough guide for setting up a Sysprep of Windows 10 x64 version 1809 to install and skip past the setup. Hope it helps anyone having issues with this.