Customizing post-Windows 7 image

I already done it on 7 and 8.1. So Windows 10 should work too.
TL;DR: Use virtualization to prepare windows image. That allows you to install fresh Windows with pre-installed security updates and your favourite
TODO: I might need to provide some extra screenshots for that.

Preparations

  • Any virtualization tool (I used VirtualBox)
  • WSUS offline
  • Windows<x>.iso
  • Any 3rd party apps you'd like to install

Virtualization

  • make sure that the virtual disk is in .VHD format
  • network mode in bridged one (if you want to access wsus offline client)
  • attach .iso

WSUS offline

tfw win 7 is gone

http://www.wsusoffline.net/docs/

  • I am not sure about "quality rollups" as I did not checked the KB list inside of it. Hence I relied on "use 'security only updates'"
  • I've included C++ Runtime Libraries and .NET Frameworks to make the image versatile
  • After running downloader part , a convenient way to is to create a network share for client directory.

Windows ISO

  • might consider checking checksum, if you don't trust the source

Step 1 - running the Windows instance on VM

  1. Run VM with attached .iso
  2. Proceed with installation as usual
  3. When reboot is made and you are at the "Personalize" stage (OOB Wizard???) press CTRL+SHIFT+F3
  4. VM reboots into audit mode. Ignore the sysprep and press cancel at each reboot.
  5. (I am not absolutely certain, but you should copy the whole client directory to local disk)
  6. Allow for "Automatic reboot and recall" and run. NOTE: This might take a while!
  7. When it is finally done, you will be presented with report.
  8. Remove WSUS Offline client directory!
  9. Proceed with installing 3rd party tools. Don't forget to clean any installers if copied.
  10. Not it is time to get back to the sysprep window.
  11. Not run the sysprep window.
  12. Select "Enter OOBE", "Shutdown" and "Generalize"

Step 2 - creating .wim image

  1. On your native Windows, run diskmgmt.msc
  2. Select Attach VHD with "READ ONLY" flag.
  3. Run command like this dism /capture-image /imagefile:c:\customInstall.wim /capturedir:F:\ /name:"muh Windows 8.1 image" /Description:"OP is a faggot" /compress:maximum /checkintegrity /verify /bootable
  4. Consider storing this .wim file for now and future reference.

About command

  • imagefile param is obviously the target file to be created
  • capturedir param is the partition including Windows directory, do not mistake with the other one

Step 3 - preparing bootable media

  1. I recommend RufusUSB, but simply make bootable USB media from Windows .iso. This is also the place if you want to go with UEFI part.
  2. Make sure it is in NTFS since install.wim might not fit in FAT32!
  3. Replace install.wim file from the USB media with freshly created customInstall.wim
  4. Optionally handle the ei.cfg file
  5. Congrats, you have a bootable Windows media with latest security patches and 3rd party software.

Final thoughts

  • This guide is far from perfect. Any harsh critique is welcomed.
  • Lacks screenshots
  • I don't have practical knowledge regarding deployment
  • Still the installation part can be customized and hence automatized (unattended installation)
  • This shit can be done via PXE boot, so you can even toss out USB media in the end.

Reference materials

https://finalthought.org/2015/01/15/creating-customized-windows-8-1-media-iso-wim-flash-drive/

Edit
Pub: 31 Jul 2019 17:18 UTC
Edit: 31 Jul 2019 17:19 UTC
Views: 176