Systems Deployment

This post is inspired by [Deploy a Windows 7 Image Containing the 100 MB System Partition]

Hey all, I've been doing Win 7 scripted installs for some time now, coupled with K2000, and I wanted to share some things that I've learned.

First though, I'd like to mention what my motivations are when deploying machines. I work in an environment that is predominantly Dell, so life is a little easier thanks to that. However, there are still many models floating around in our pool of over 600 machines, so it's not feasible to for me to maintain and deploy images - for various reasons. So, what I need out of a build process is this - a single deployment path for nearly all machines, driver independent but driver accommodating, and highly customizable. I've actually accomplished this with scripted installs, I'll get in to what I've done shortly.

Scripted installations began to look like the solution to my needs when I first jumped in to K2000, however I've run in to some issues. The biggest one is driver injection - it works great, as long as the driver pool stays relatively small. This problem is almost completely neglected in my opinion, especially when I saw K2000 gain the driver feed feature. I thought "awesome, I can suck in drivers for all the models in our environment, roll out a scripted install, and have it work on all of them!" Except it's not awesome, if my driver pool is larger than one or two models the scripted install fails with an error. I did some research on the net and gathered that there is a capacity limit to the driver library WinPE is able to handle, and that's what was killing my installations.

I became discouraged, and began to do more research on how to solve my problem. Then I've stumbled on curious options for the unattended.xml (Windows System Image Manager and the associated help files were very useful). In a nutshell, when Windows setup reaches the PnP phase, you can feed it a network path with credentials where you've stored all your drivers, and it will use them then. This is independent of WinPE phases, however WinPE is still needed to provide the necessary storage and network drivers for this step to work obviously.

So, my K2000 driver library only includes the latest WinPE driver pack from DELL (and any other necessary storage/network drivers) and nothing else. However, on my network I have a path with an x64 and an x86 driver library that currently includes five Dell models, mixed desktops and laptops. (I'll post my unattend.xml below with more notes). My driver injection problems disappeared. I've been using this method for about a year and it has been great. I now have a single deployment path for all machines and my drivers are 99% taken care of, new model comes around I just extract drivers to my network location and K2000 keeps doing the magic.

The last important element is customization. Well, I'd like to think I've come up with a fairly clever method to gain the customization of imaging and bring it to scripted installs.

Outline to creating a customized system for scripted install

1. Perform a vanilla deployment of Windows 7, single partition (important!)
2. Activate the Administrator account, and log in using it, delete any other account you were forced to create during setup
3. Perform all customization as Administrator account
   1. You may run patches, install applications (preferably utilities that are global to your builds, I like 7zip, ccleaner, etc...), tweak ui settings, registry, etc... everything you would do to a machine to make it "perfect" in your eyes.
4. Sysprep the machine with /generalize /oobe and feed it an unattend file that includes the "copyprofile" feature. This will wipe drivers, clean up what needs to be, and it will take everything you did to the Administrator profile and mirror it to Default User. So when this image (yes, wait for it ^_^) is redeployed, your new users will get all the profile goodness you've left them.
   1. Here is my sysprep command line to do the above:
      
C:\Windows\System32\sysprep\sysprep.exe /generalize /oobe /unattend:C:\Windows\System32\sysprep\win7_copyprofile_fixie.xml

   2. Here is the contents of my win7_copyprofile_fixie.xml
      
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<CopyProfile>true</CopyProfile>
</component>
<component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<FavoritesDelete>true</FavoritesDelete>
<DisableFirstRunWizard>true</DisableFirstRunWizard>
<DisableOOBAccelerators>true</DisableOOBAccelerators>
<SuggestedSitesEnabled>false</SuggestedSitesEnabled>
</component>
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<CopyProfile>true</CopyProfile>
</component>
<component name="Microsoft-Windows-IE-InternetExplorer" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<FavoritesDelete>true</FavoritesDelete>
<DisableFirstRunWizard>true</DisableFirstRunWizard>
<DisableOOBAccelerators>true</DisableOOBAccelerators>
<SuggestedSitesEnabled>false</SuggestedSitesEnabled>
</component>
</settings>
</unattend>

   3. Several notes about the xml.
      1. You'll notice I have component sections for both architectures, this allows the use of one file for all cases and makes my life easier.
      2. The IE section just takes care of some annoying IE things automatically, they are self explanatory from the code but you may look them up yourself for more info :)
      3. Notice the "copyprofile" element, that's the critical one here.
5. Once the machine has shut down, boot it to some kind of WinPE environment (don't mess up and get in to the OS, you'll have to redo everything to keep it tidy and perfect).
   1. I use a USB stick with a WinPE 3.1 environment that has all the tools I use on it. But what we really need is imagex.exe and enough free space to capture the hard disk.
6. The plan is this:
   1. We're going to capture the single partition windows system in to a .wim image using the imagex.exe tool that comes with WAIK.
   2. Then we are going to take our captured .wim, rename it to "install.wim" and replace the install.wim that exists on normal Windows 7 DVD media.
   3. Then we're going to use the Windows System Image Manager to recreate the catalog.
   4. What we'll end up with is what essentially looks like a standard issue Windows 7 setup disk, however it will have our customized but generalized build on it instead. Performing Windows setup from this disk will actually go exactly like normal setup, but the extracted content will be our stuff!
   5. We're going to upload this media in to K2000 and create a scripted deployment, but instead of the answer file wizard we're going to use our own xml file with extra awesomeness (not the one above that we used for sysprep, a different one that I'll show below).
   6. When K2000 deploys this, instead of getting a vanilla build we'll be getting a build with all of our customizations already in it, including the tweaked default profile (hooray!). And the xml file will make sure Windows PnP picks up our drivers from the network.

My unattended xml file for K2000's scripted deployment

I'm going to insert some comments to document what's going on inside, I'll double slash them (//)... but if you use this code, probably should remove them - I'm not sure if comments are supported in the real file.

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<settings pass="windowsPE">
// As in the other xml file, this one has component sections for both architectures... yes that means you have identical blocks of code
// preceeded simply by a component declaration that mentions either one architecture or the other.
//
// The Windows-Setup section is where I handle creating two partitions, kinda like how normal windows setup creates the 100mb RE partition
// and deploys the OS on the second partition that is expanded to the rest of the disk. I made the RE partition 300mb because
// Windows Complete PC Backup and Restore sometimes glitches out backing up the 100mb partition because it's "too full", so I just made it bigger.
//
// When using this answer file to partition the disk, you don't need the pre-installation steps in K2000 to do this for you.
// If you feel that this setup is not for you, maybe you still prefer the single partition deployment, a few small changes can be made to accomodate that.
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<UseConfigurationSet>true</UseConfigurationSet>
<UserData>
<AcceptEula>true</AcceptEula>
<FullName>User</FullName>
<Organization>Company</Organization>
<ProductKey>
// This is the default key to signal KVM activation
<Key>33PXH-7Y6KF-2VJC9-XBBR8-HVTHH</Key>
<WillShowUI>OnError</WillShowUI>
</ProductKey>
</UserData>
// Partition scheme is created here, should be easy to figure out
<DiskConfiguration>
<WillShowUI>OnError</WillShowUI>
<Disk wcm:action="add">
<CreatePartitions>
<CreatePartition wcm:action="add">
<Order>1</Order>
<Size>300</Size>
<Type>Primary</Type>
</CreatePartition>
<CreatePartition wcm:action="add">
<Order>2</Order>
<Type>Primary</Type>
<Extend>true</Extend>
</CreatePartition>
</CreatePartitions>
<ModifyPartitions>
<ModifyPartition wcm:action="add">
<Active>true</Active>
<Format>NTFS</Format>
<Label>system</Label>
<Order>1</Order>
<PartitionID>1</PartitionID>
</ModifyPartition>
<ModifyPartition wcm:action="add">
<Extend>false</Extend>
<Format>NTFS</Format>
<Label>windows7</Label>
<Letter>C</Letter>
<Order>2</Order>
<PartitionID>2</PartitionID>
</ModifyPartition>
</ModifyPartitions>
<DiskID>0</DiskID>
<WillWipeDisk>true</WillWipeDisk>
</Disk>
</DiskConfiguration>
// Telling setup what to deploy out of install.wim and what partition to put it on
<ImageInstall>
<OSImage>
<InstallTo>
<DiskID>0</DiskID>
<PartitionID>2</PartitionID>
</InstallTo>
<InstallToAvailablePartition>false</InstallToAvailablePartition>
<WillShowUI>OnError</WillShowUI>
<InstallFrom>
<MetaData>
<Key>/IMAGE/Name</Key>
<Value>Windows 7 Enterprise</Value>
</MetaData>
</InstallFrom>
</OSImage>
</ImageInstall>
</component>
// Different architecture, same content
<component name="Microsoft-Windows-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<UseConfigurationSet>true</UseConfigurationSet>
<UserData>
<AcceptEula>true</AcceptEula>
<FullName>User</FullName>
<Organization>Company</Organization>
<ProductKey>
<Key>33PXH-7Y6KF-2VJC9-XBBR8-HVTHH</Key>
<WillShowUI>OnError</WillShowUI>
</ProductKey>
</UserData>
<DiskConfiguration>
<WillShowUI>OnError</WillShowUI>
<Disk wcm:action="add">
<CreatePartitions>
<CreatePartition wcm:action="add">
<Order>1</Order>
<Size>300</Size>
<Type>Primary</Type>
</CreatePartition>
<CreatePartition wcm:action="add">
<Order>2</Order>
<Type>Primary</Type>
<Extend>true</Extend>
</CreatePartition>
</CreatePartitions>
<ModifyPartitions>
<ModifyPartition wcm:action="add">
<Active>true</Active>
<Format>NTFS</Format>
<Label>system</Label>
<Order>1</Order>
<PartitionID>1</PartitionID>
</ModifyPartition>
<ModifyPartition wcm:action="add">
<Extend>false</Extend>
<Format>NTFS</Format>
<Label>windows7</Label>
<Letter>C</Letter>
<Order>2</Order>
<PartitionID>2</PartitionID>
</ModifyPartition>
</ModifyPartitions>
<DiskID>0</DiskID>
<WillWipeDisk>true</WillWipeDisk>
</Disk>
</DiskConfiguration>
<ImageInstall>
<OSImage>
<InstallTo>
<DiskID>0</DiskID>
<PartitionID>2</PartitionID>
</InstallTo>
<InstallToAvailablePartition>false</InstallToAvailablePartition>
<WillShowUI>OnError</WillShowUI>
<InstallFrom>
<MetaData>
<Key>/IMAGE/Name</Key>
<Value>Windows 7 Enterprise</Value>
</MetaData>
</InstallFrom>
</OSImage>
</ImageInstall>
</component>
// This just takes care of language choices
<component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<SetupUILanguage>
<UILanguage>en-us</UILanguage>
<WillShowUI>Never</WillShowUI>
</SetupUILanguage>
<InputLocale>en-us</InputLocale>
<SystemLocale>en-us</SystemLocale>
<UILanguage>en-us</UILanguage>
<UILanguageFallback>en-us</UILanguageFallback>
<UserLocale>en-us</UserLocale>
</component>
<component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<SetupUILanguage>
<UILanguage>en-us</UILanguage>
<WillShowUI>Never</WillShowUI>
</SetupUILanguage>
<InputLocale>en-us</InputLocale>
<SystemLocale>en-us</SystemLocale>
<UILanguage>en-us</UILanguage>
<UILanguageFallback>en-us</UILanguageFallback>
<UserLocale>en-us</UserLocale>
</component>
</settings>
// Some information has to exist in multiple setup passes, so we see some familiar stuff here
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<CopyProfile>true</CopyProfile>
<RegisteredOwner>User</RegisteredOwner>
<RegisteredOrganization>Company</RegisteredOrganization>
<ProductKey>33PXH-7Y6KF-2VJC9-XBBR8-HVTHH</ProductKey>
<TimeZone>Eastern Standard Time</TimeZone>
// This autologon information has to match what you have below in Shell-Setup, where the local admin account gets created.
// Only one autlogon event is needed, KACE handles the post-installation tasks during this opportunity.
<AutoLogon>
<Enabled>true</Enabled>
<Username>Tech User Account</Username>
<Password>
<PlainText>true</PlainText>
<Value>password</Value>
</Password>
<LogonCount>1</LogonCount>
</AutoLogon>
<ComputerName>*</ComputerName>
</component>
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<CopyProfile>true</CopyProfile>
<RegisteredOwner>User</RegisteredOwner>
<RegisteredOrganization>Company</RegisteredOrganization>
<ProductKey>33PXH-7Y6KF-2VJC9-XBBR8-HVTHH</ProductKey>
<TimeZone>Eastern Standard Time</TimeZone>
<AutoLogon>
<Enabled>true</Enabled>
<Username>Tech User Account</Username>
<Password>
<PlainText>true</PlainText>
<Value>password</Value>
</Password>
<LogonCount>1</LogonCount>
</AutoLogon>
<ComputerName>*</ComputerName>
</component>
<component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<Identification>
// I like machines to be in a special group when build by KACE, this way I can do some dynamic things if I choose to.
<JoinWorkgroup>wcba-kace-scrpt</JoinWorkgroup>
</Identification>
</component>
<component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<Identification>
<JoinWorkgroup>wcba-kace-scrpt</JoinWorkgroup>
</Identification>
</component>
<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<RunSynchronous>
// I think this sets the network zone to "Work" - I think the KACE wizard did this for me initially and I kept it. There are other ways to do this in this file,
// but I'll stick with it since it works.
<RunSynchronousCommand wcm:action="add">
<Path>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 00000000 /f</Path>
<Description>Setting Network Location</Description>
<Order>1</Order>
<WillReboot>OnRequest</WillReboot>
</RunSynchronousCommand>
</RunSynchronous>
</component>
<component name="Microsoft-Windows-Deployment" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<RunSynchronous>
<RunSynchronousCommand wcm:action="add">
<Path>reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\FirstNetwork" /v Category /t REG_DWORD /d 00000000 /f</Path>
<Description>Setting Network Location</Description>
<Order>1</Order>
<WillReboot>OnRequest</WillReboot>
</RunSynchronousCommand>
</RunSynchronous>
</component>
// Same IE tweaks that I had in my sysprep unattended file, they are here just in case these got changed during generalization (happens)
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-IE-InternetExplorer"
processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<FavoritesDelete>true</FavoritesDelete>
<DisableFirstRunWizard>true</DisableFirstRunWizard>
<DisableOOBAccelerators>true</DisableOOBAccelerators>
<SuggestedSitesEnabled>false</SuggestedSitesEnabled>
</component>
<component xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="Microsoft-Windows-IE-InternetExplorer"
processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<FavoritesDelete>true</FavoritesDelete>
<DisableFirstRunWizard>true</DisableFirstRunWizard>
<DisableOOBAccelerators>true</DisableOOBAccelerators>
<SuggestedSitesEnabled>false</SuggestedSitesEnabled>
</component>
</settings>
<settings pass="oobeSystem">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
// Skip the boring questions that are always answered the same.
<OOBE>
<HideEULAPage>true</HideEULAPage>
<NetworkLocation>Work</NetworkLocation>
<SkipMachineOOBE>false</SkipMachineOOBE>
<SkipUserOOBE>false</SkipUserOOBE>
<ProtectYourPC>1</ProtectYourPC>
</OOBE>
// Create local admin account - this mimics what you would do manually during the setup wizard - remember the Administrator account is disabled by default, so this one will be your local admin.
<UserAccounts>
<LocalAccounts>
<LocalAccount wcm:action="add">
<Name>Tech User Account</Name>
<Group>Administrators</Group>
<Password>
<Value>password</Value>
<PlainText>true</PlainText>
</Password>
</LocalAccount>
</LocalAccounts>
</UserAccounts>
</component>
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<OOBE>
<HideEULAPage>true</HideEULAPage>
<NetworkLocation>Work</NetworkLocation>
<SkipMachineOOBE>false</SkipMachineOOBE>
<SkipUserOOBE>false</SkipUserOOBE>
<ProtectYourPC>1</ProtectYourPC>
</OOBE>
<UserAccounts>
<LocalAccounts>
<LocalAccount wcm:action="add">
<Name>Tech User Account</Name>
<Group>Administrators</Group>
<Password>
<Value>password</Value>
<PlainText>true</PlainText>
</Password>
</LocalAccount>
</LocalAccounts>
</UserAccounts>
</component>
</settings>
// This is where we provide the path to drivers on our network. Subfolder structures are supported just fine, ex: .\x64\network\component\xxxxx.inf
// For my dell drivers I literally have the Rxxxxx folders sitting there under their component categories, with all contents (setup.exe and all).
<settings pass="offlineServicing">
<component name="Microsoft-Windows-PnpCustomizationsNonWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<DriverPaths>
<PathAndCredentials wcm:action="add" wcm:keyValue="1">
<Credentials>
<Domain>our domain</Domain>
<Password>plaintext password for authorized account</Password>
<Username>authorized account with read only access is enough</Username>
</Credentials>
<Path>\\some_file_server\_kace\drivers\x64</Path>
</PathAndCredentials>
</DriverPaths>
</component>
<component name="Microsoft-Windows-PnpCustomizationsNonWinPE" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<DriverPaths>
<PathAndCredentials wcm:action="add" wcm:keyValue="1">
<Credentials>
<Domain>our domain</Domain>
<Password>plaintext password for authorized account</Password>
<Username>authorized account with read only access is enough</Username>
</Credentials>
<Path>\\some_file_server\_kace\drivers\x86</Path>
</PathAndCredentials>
</DriverPaths>
</component>
</settings>
</unattend>


Do note that this wasn't meant to be full documentation, hah I actually don't have any yet. I just wanted to provide enough information to put people on the right path and provide some ideas. However, if anyone has any questions or want more details about something specific, feel free to ask as I'll subscribe to this thread.

Steve