Building a Windows Server 2016 Reference Image with Microsoft Deployment Toolkit

Tue, 25 Jul 2017 20:11:33 +0000

In a previous post I walked through how to install MDT, it’s dependencies, and how to create a reference image to deploy. In this post I’ll be doing the same thing but centred around building a Windows Server 2016 image using a Hyper-V virtual machine.

Installing & Configuring Microsoft Deployment Toolkit and Dependencies.

We’ll be using Microsoft Deployment Toolkit (MDT) version 8443, which (at the time of writing: 24/07/2017) is the most recent release and fully supports Windows Server 2016. Here are the links the software we’ll be using:

Windows 10 1703 Assessment and Deployment Kit (ADK)
Microsoft Deployment Toolkit (8443)
Windows Server 2016.iso (Volume Licensing Service Center
The latest Cumulative Update for Windows Server 2016 - as of 13/03/2018 this is KB4088787, released March 13th 2018 bringing Windows Server 2016 to OS Build 14393.2125. More information is available here. Please note: Don’t download the Delta Update.

First we’ll install the Windows 10 1703 ADK which works with Windows Server 2016. The setup will need to download additional files so it may take some time depending on your internet connection.

IMPORTANT NOTE: If you have SecureBoot enabled, you’ll get a “Program Compatibility Assistant” dialog displayed and after installation, WIMs will fail to mount and unmount. This is a known issue and there is a workaround.

On the Select the features you want to install screen select:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
Imaging And Configuration Designer (ICD)
Configuration Designer
User State Migration Tool (USMT)

Now install MDT by running the setup file downloaded earlier, there is no specific configuration during the install wizard. After it’s installed we need to create the Deployment Share.

Open the Deployment Workbench from the Start Menu.
Right click on Deployment Shares.
Select New Deployment Share.
Enter the path for the Deployment Share: E:\BuildShare.
Enter the Share name: BuildShare$.
Give the share a descriptive name.
On the Options screen, accept the defaults as you can change them later.
Complete the wizard to create the share.

We now need to add an Operating System to work with.

Add an Operating System

Mount the Windows Server 2016.iso in File Explorer.
Go to Deployment Workbench > Operating Systems.
Right click and select Import Operating System.
In the wizard, select Full set of source files and then enter the root of the mounted .iso as the Source directory.
For the destination directory name enter Windows Server 2016 and complete the wizard.
Go to the Operating Systems node again and you should have four new entries, for each edition of Windows Server 2016. Rename them to: Windows Server 2016 Standard, Standard Core, Datacenter, and Datacenter Core.

Next we’ll be adding the latest Cumulative Update for Windows Server 2016 downloaded earlier, to do this we’ll be adding it to the Packages section of MDT. The reason we do this is so the CU will be installed with the Operating System, rather than relying on WSUS or Windows Updates to download and install it and in this case the initial release of Windows Server 2016 has a nasty bug which prevents it from receiving updates via WSUS, so installing the latest CU will fix this problem before it happens. Another advantage of doing it this way is the entire Task Sequence will be faster and Windows will be up to date when it is installed.

Importing Packages

Go to Deployment Workbench > Packages.
Create a folder named Windows Server 2016.
Right click on the folder and select Import OS Packages and go through the wizard to add the package. The downloaded update .msu file must be in a folder by itself.

Now we create a selection profile so that the Task Sequence only attempts to install the update for Windows Server 2016.

Creating A Selection Profile

Expand the Advanced Configuration node.
Right click on Selection Profiles and select New Selection Profile.
Name it Windows Server 2016.
On the Folders page, tick the Windows Server 2016folder under Packages and complete the wizard.

We need to now create the Task Sequence that will create our reference image of Windows Server 2016. In this example, we’ll create a Task Sequence to build an image of a Standard Edition of Windows Server 2016. To create one for the other editions, repeat the steps and choose the other editions when choosing the Operating System.

Create a Task Sequence

In Deployment Workbench, go to Task Sequences.
Right click and select New Task Sequence.
For the ID enter: WS16-S.
Name it Build Windows Server 2016 Standard.
Select Standard Server Task Sequence.
Select the Operating System Windows Server 2016 Standard.
Do not specify a product key at this time.
Enter an Organization name.
Do not specify an Administrator password at this time.
Complete the wizard.

Now we’ll configure the Task Sequence.

Configure the Task Sequence

Right click on the Task Sequence just created and select Properties.
Go to the Task Sequence tab on the Properties window of the Task Sequence.
Expand the Preinstall folder, and select the Apply Patches item.
Change the Selection Profile to Windows Server 2016.
Go to the State Restore folder and select Windows Update (Pre-Application Installation).
On the right side of the Properties window, go to the Options tab.
Uncheck the Disable this step tick box and do the same with Windows Update (Post-Application Installation).
Go to the Install Applications item.
In the right side of the Properties box, click the Options tab and then click the Disable this step tick box.
Click Apply and close the Task Sequence.

Next we’ll create a domain user account for MDT.

Create an Active Directory User for MDT

Go to Active Directory Users and Computers.
Create a user called mdt_admin.
On WDS01 (where the deployment share is hosted), give mdt_admin Full Control share permissions and Full Control permissions to all the files and folders under the deployment share.

Now we’ll configure the Bootstrap.ini and the Rules.ini files to control certain aspect of the deployment environment. The settings below enable auto log in and skip the welcome screen, so these should only be used for lab/closed environments.

Configure Bootstrap.ini

In Deployment Workbench, right click the Deployment Share and select Properties.
Select the Rules tab and click the Edit Bootstrap.ini button.
Add the settings below to the Bootstrap.ini.
Close and Save the Bootstrap.ini

[Settings]
Priority=Default

[Default]
DeployRoot=\\SERVER-NAME\Build$
UserDomain=contoso.com
UserID=mdt_admin
UserPassword=p@ssw0rd
SkipBDDWelcome=YES

Configure Rules.ini

On the Rules tab of the Deployment Share properties window, add the settings below. A lot of the settings are specific to my demo environment such as my location in the world. The [Virtual Machine] section near the top is one example of how to manage drivers and auto fill computer names for when deploying images based on the model reported by Windows. I’ll cover this in more detail a future post.

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipDomainMembership=YES
SkipSummary=YES
SkipFinalSummary=YES
SkipComputerName=YES
SkipUserData=YES

_SMSTSORGNAME=Build Share
_SMSTSPackageName=%TaskSequenceName%
DoCapture=YES
ComputerBackupLocation=\\SERVER-NAME\Build$\Captures
BackupFile=%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "-" & hour(time) & "-" & minute(time)#.wim
WSUSServer=http://WSUS-SERVER-NAME:8530
FinishAction=SHUTDOWN
SLShare=\\SERVER-NAME\Build$\Logs
EventService=http://SERVER-NAME:9800

Now it’s time to create the boot media to boot into the deployment environment.

Creating The Boot Media

In Deployment Workbench, right click on the Deployment Share.
Select Update Deployment Share.
Select Completely regenerate the boot images.
Complete the wizard. It will take some time to create the boot images.

Testing The Boot Media

To test the boot media, copy the LiteTouchPE_x64.iso from \\SERVERNAME\BuildShare$\Boot to a location where a Hyper-V Virtual Machine will be able to access it. Create a new VM in Hyper-V and configure it as such:

Gen1
2x vCPUs
4GB of RAM
NIC with access the MDT server and WSUS server.
Virtual Hard Drive of at least 80GB, preferably on an SSD.
Boot from DVD Drive using the LiteTouchPE_x64.iso from MDT.

Start the VM and it should boot from the LiteTouchPE_x64.iso into the deployment environment. You should be presented with a wizard and the name of the Task Sequence you created earlier. Select it and click Next. The Task Sequence will now run, install Windows Server 2016 Standard Edition with the Cumulative Update included, update from the WSUS server, run SysPrep and the reboot back into the MDT environment and capture the image. When this process completes the VM will be shutdown and a file named WS16-S_YEAR_MONTH_DAY_HOUR_MINUTE.wim will be in \\SERVERNAME\BuildShare$\Captures. You now have a functioning Microsoft Deployment Toolkit server, with a Deployment Share specifically configured for building reference images, and a Task Sequence to build and capture a Windows Server 2016 Standard Edition reference image.

If you have any questions or comments, please leave them below.

-Mike

Stuck Windows Updates From Windows Server Update Services (WSUS) On Windows 10 1607/Windows Server 2016

Tue, 08 Nov 2016 19:53:50 +0000

If you’ve installed a fresh install of Windows 10 1607/Windows Server 2016 recently, you may have experienced a problem when it tries to download and install updates from your local WSUS server - specifically, it doesn’t, it gets stuck. You’ve tired rebooting, stopping the BITS and WU services, deleting %systemroot%\SoftwareDistribution but nothing seems to work. Both Windows 10 1607 and Windows Server 2016 require a cumulative update that fixes this specific issue. You can of course just download the update off Microsoft’s WU servers but if you’re using MDT then you can download the update separately, and add it to MDT to push out during the install phase of the Task Sequence. You can use any Windows 10/Windows Server 2016 Cumulative Update released for Windows 10 1607, the more recent the better.

Update 16/10/2017: If you’re experiencing stuck updates (or incredibly slow during a Task Sequence) with Windows Server 2016 but not Windows 10 1607 and they are both serviced by the same WSUS server, the cause may be due to Express Updates being enabled.

Update 25/04/2017: The previous CU I listed here is now gone from the Update Catalog. Here is the most recent one I’ve tested: https://www.catalog.update.microsoft.com/Search.aspx?q=kb4015217. As before the CU is for both Windows 10 1607 and Windows Server 2016 so you don’t need to download both versions.

KB4015217 info from Microsoft - https://support.microsoft.com/en-us/help/4015217/windows-10-update-kb4015217

Original Post To build it into your MDT install sequence, download the update from the Microsoft Update Catalog and follow the steps below. Please note that the update for Windows 10 x64 and Windows Server 2016 is the same - you only need to download one of them.

Import The Update

Go to Deployment Workbench and create two new folders under the Packages node, one for Windows 10 1607 x64 and one for Windows Server 2016.
Right click on the Windows 10 1607 x64 folder you just created and select Import OS Packages.
Browse to the location of the update (you will need to put it in a folder by itself) and click Next through the wizard and wait for the Update to be imported.
As this update is the same for both Windows 10 1607 x64 and for Windows Server 2016, you can right click on the imported package and paste it into the Windows Server 2016 folder.

Create A Selection Profile

In Deployment Workbench, go to the Advanced Configuration node and expand it, then go to the Selection Profiles.
Right click and create a new Selection Profile. Name it Windows 10 1607 x64, tick the Windows 10 1607 x64 folder under Packages and click Next through the rest of the wizard.
Repeat the steps above for a Windows Server 2016 Selection Profile choosing the Windows Server 2016 folder.

Enable The Selection Profile In A Task Sequence

Create a Standard Task Sequence to install Windows 10 1607 x64.
Right click on the Task Sequence, go to Properties, go to the Task Sequence tab.
Expand the Preinstall node, and select the Apply Patches item. In the Properties tab on the right, under Selection profile, change it to Windows 10 1607 x64.

The Task Sequence will now deploy Windows 10 1607 x64 and install the Cumulative Update as part of the build.