[This is Part 4 of 7]
Check out other parts:
Working on the Reference Machine
Virtual Machine Preparation
Reference machine is the machine that you will use as a reference to capture your image. This is the machine that you will install your custom apps and profile tweaks.
Tip: I highly recommend using virtual machine as a reference machine, and not a physical machine. Why? Well, if you use a physical machine, then many graphic drivers get installed. I spent couple of days using physical machine as a reference machine, and I got the metro apps failing. I read a blog somewhere saying something about metro apps failing randomly because of those graphic drivers. I moved to virtual machine as a reference image and the problem is sorted out. This is a very expensive lesson!!!
Tip: When using Virtual machines, usually integration tools get installed like (Hyper-v integration tools or VMware Tools), after you are have installed all applications on the reference virtual machine, make sure to uninstall those integration tools before capturing the image.
So, I have created a virtual machine with 4 GB RAM, one processor, 40 GB C drive virtual disk, and 20 GB D drive that will be used to store the captured image. I then installed Windows 8.1 from the original ISO Image that I have. I recommend to use the original Windows 8.1 ISO to initially install Windows on the reference machine, not any custom ISO to install Windows 8.1 to the reference machine.
Tip: Make sure the reference virtual machine is connected to the internet. I cannot emphasis enough that you should not use proxy settings on the reference machine in order to be able to access internet. Instead, connect the machine to direct internet line if possible without any proxy requirements. Two reasons for that, the first one, is most of the time your proxy will need credentials or have restrictions on the type of web sites to visit, you do not want anything to interfere with the type of sites your reference machine can access, and you do not want to have password popup and the need to enter passwords that will be saved on the reference machine’s credential manager. The second reason, sometimes Metro apps connect to internet to activate and they may not work correctly with proxy. I am not sure how accurate this is, but this is how I got the image working.
Finally, make sure you have couple of USB drives in hand, as you may need them to copy things around, I usually always have two 16 GB USB drives around me just in case. You do not have to do the same, this is only me.
After installing Windows 8.1 on the reference machine, and logging in using the account that is created during the Windows 8.1 installation wizard, I make sure it is connected to the internet without any proxy configuration or the need to enter credentials to access the internet.
Do not join the reference machine or activate the Windows installation. I usually connect that machine on a separate dedicated network with unrestricted internet access.
Then I start installing my custom software (not in audit mode). Below is a brief list of the software I installed in my case:
- Office 2013 including Visio
- Adobe Reader
- Microsoft SCCM Client
- Antivirus solution and security clients
- Chrome browser
- .net 3.5
I it very helpful to include the .net 3.5, you can use this link to help you install 3.5 on Windows 8.1 (http://msdn.microsoft.com/en-us/library/hh506443(v=vs.110).aspx ). Usually I run (DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:e:\sources\sxs) where E:\ is the DVD drive where the Windows 8.1 media is located.
I included Chrome browser as IE 11 that ships with Windows 8.1 sometimes has compatibility issues with some internal web sites or even public ones.
Tip: no need to install flash as IE11 handles flash sites like YouTube video without the need to do anything.
Tip: I see people installing Java Runtime here. I highly recommend not doing that. Java Runtime gets crucial updates every day and it is the main entry point for attacks. You do not want to deploy an image with outdated Java Runtime and compromise security of the machine. Instead, use SCCM or any other deployment tool that you have in place to install Java Runtime and updates after the image is deployed. In my case, I do not install Java Runtime to machines at all. When someone needs Java Runtime, the local IT will go and install the latest version on his machine. No need to have Java Runtime in all machines from day one because someday they may use it. Huge security tip.
Tip: in Microsoft documentation, software and patches are applied while in audit mode. I saw couple of blog posts reporting issues with that, so I only sysprep and customize things in audit mode, and I install everything before entering the audit mode. This is my way and I do not state that this is Microsoft way.
Tip: When installing Adobe, make sure you configure its update settings from now if you do not want the users to get a prompt to install a newer version or not. If users are not admin on their machines which is the normal case I hope, then you do not want them to get such notifications all the time about newer versions available, and no power to do anything.
Once I have everything installed, I then connect to Windows Update and install all windows updates available there. I prefer not connecting to the internal WSUS server and connect directory to Microsoft portals to get updates. Then, I update the antivirus solution, adobe and any updates available for the software I installed previously.
Once I have installed and updates everything, I usually create a folder called Tools under C:\. In this folder, I put all the administrative tools that can help local IT to do basic troubleshooting. My list is:
- FIM CM Client installation files, in case we need to provision a smart card on this machine. FIM CM is Microsoft Forefront Identity Management/ Certificate Management Client.
- Gemalto Smart Card mindriver files, which is the driver to support Gemalto Smart Cards.
- Microsoft Message Analyzer: Network tracing tool from Microsoft.
- Outlook Configuration Analyzer Tool: tool to help troubleshoot Outlook issues.
- PortQuery and PortQueryGUI: Tools to help testing connectivity on a TCP or UDP ports. Very handy tool.
- CMTrace: Configuration Manager log tracing tool. This tool is essential if you have SCCM in place and want to trace client side log files.
- MOCLogin: Tool to troubleshoot Lync issues.
- TCPView: Sysinternal GUI tool to track which processes are opening network connections.
- ProcessExplorer: Sysinternal GUI tool to track processes.
- Zoomit: Sysinternal tool.
- SysInternal Package: Zip file containing all sysinternal tools.
- Install the Telnet Client Feature.
- Readme.txt file: file to describe and document the custom image
Note: If you are not familiar with Sysinternals tools, check this URL http://technet.microsoft.com/en-us/sysinternals/bb545021.aspx. It is a must knowledge.
Note: I mentioned that I put readme.txt on the C:\Tools folder, this is a very important text file I created in notepad that has the following information, to document the version, settings and software that this image contains. The text file contains the following sections in my case:
- Header Section:
- Image Name : Windows 8.1 x64 Enterprise Edition
- Image version : v1.2
- Image type : user edition (in case you have another custom image for finance people which has the financial application installed, so I classify my images to types)
- Image creation date: 29th Jan 2014
- Software included :
Here you mention all software included in the image + the version and build number + update and patch level for each item.
- Windows Patches: I usually document here any special patches or service pack levels if any
- Tools included: Here I document every tool that I included in the C:\Tools folder
Tip: during all this, I avoid opening or updating any metro apps. It is extremely not recommended to update any metro app in the custom image. In TechNet you can find all the reasons of that.
An interesting thing that I do here is to open the registry and browse to HKEY_LOCAL_MACHINE\SYSTEM, right click and choose New Key, name it “Corp”. Inside it, I create the following values:
- String value (Image Name) : Windows 8.1 x64 EE
- String value (Image Creation) : 29th Jan 2014
- String value (Image Type) : User
- DWORD 32bit (Image version) : 1
This is extremely handy, so you can walk to any computer, and open the registry, and you have all the information that you have about what image was used to install the O.S on that computer. I also use SCCM to collect this registry value on all machines and get reports about how many computers running this version of my image!
Next, I go to C:\Windows\Web\Wallpaper\Windows, and I put their many professional wallpapers, so that if any user wants to get corporate or nice wallpaper, he can right click his desktop, personalize, desktop backgrounds, and since Windows reads the directory that we have just populated, the end user will see now many options for wallpapers that we provided him with. Cool thing indeed.
I also make sure Windows Firewall is enabled and configured correctly, and I go to services.msc and do my final touches (i.e if you are using BranchCache technology, you can set the start mode for BranchCache as automatic and start it). Even if you can do those configuration via GPOs, I always like to configure everything in the base image, and rely on GPO to enforce things.
If you are in an extreme security environment, you can open GPEDIT.MSC and configure a security settings for the machine, so that from the moment that the O.S is installed and until it is joined to the domain, it remains secured. In my case, I do not configure group policy settings in my image reference.
Finally, I restart the reference machine and check for updates one last time just to make sure everything is fine. At this phase, the reference machine has never and will never be joined to any domain, nor is it licensed or activated.
Now, open CMD as Administrator, and browse to c:\Windows\system32\sysprep>, and type:
Note: OOBE stands for Out Of Box Experience.
Windows then will reboot and show you the wizard that asks you questions when you install a new Windows Computer. Do not do anything or choose anything, just press (Control + Shift + F3) and Windows will enter something called Audit Mode.
Check out my YouTube Windows 8 Advertisement 2 minute Video :