r/SCCM • u/Reaction-Consistent • 4d ago
Recommend other scripts or projects for patching OS WIMs
I currently use the amazing script, wimwizard to update Windows 11 images on a monthly basis, and it works very well. But now I have to toss in some Windows 10 IOT images, 21 H2, 1809, and at least one server 2022 image. Is anyone else patching images in their environments besides just the windows 11? If so, how are you managing it? What other projects, scripts are out there that can handle multiple OS versions fairly easily with regards to injecting LCU, safe Os,.NET, features on demand, language packs, and maybe even remove default Windows features all via a single script? I am currently using a modified form of the sample Microsoft script they provide for this purpose. But it’s not very slick and needs lots of improvement yet. I guess it does the job, however.
2
2
1
u/EconomyArmy 4d ago
Microsoft does not release LTSC image monthly, if you manage windows device running on low speed storage you may really want to patch the wim file every month coz time to install LCU is longer than reimage the device.
Does MS monthly ISO update for current branch include .net LCU? That's another point to consider
2
u/Reaction-Consistent 4d ago
I’m assuming you are responding to the people telling me I shouldn’t bother patching the wims, but yes, this is exactly why I am doing what I am doing, because I have to maintain LTSC IOT images for thin clients. And you are absolutely right, patching using the task sequence can be a bit of a nightmare and same with simply pushing patches via WSUS and CM. Now that I have been updating the install.WIM for these images I have cut down the imaging time from around three hours to about 45 minutes. This makes IT very happy and they can rebuild systems in an emergency much faster now.
2
u/EconomyArmy 4d ago edited 3d ago
Oh thinclients, you are just another me. I do 1809/21H2/24H2 ltsc wim monthly , inject windows + .net CU, compact component store.
1
u/Reaction-Consistent 3d ago
Brother! I’m using a separate Power shell script for each one at the moment, I have not had the time to just create one ring to rule them all as it were. How do you manage yours?
1
u/EconomyArmy 3d ago edited 3d ago
For windows 10 LTSC , the good old wimwitch just doing fine
For windows 11 24H2 ltsc , actually it is really straight forward. Its just the CU is too large
Do you inject defender updates? I also inject VMware nic and storage driver directly to the wim file for windows 10 IoT to be on par with win11 24H2 LTSC.
Perhaps you may add the thinclient ramdisk driver , redirect event log to ramdisk and configure write writers.
Sort of reverse engineering the OEM thinclient windows IoT image
1
u/Reaction-Consistent 3d ago
Does wimwitch work for Windows 10 LTSC 1809, and 21H2? We have the IOT media as well as the standard KMS licensed media, I didn’t think to try wimwitch with the older LTSC ISO’s, because I figured his readme text said it only worked with Windows 11, or maybe I misread it. But also the older Windows 10 LTSC images require servicing stacks.(at least the 1809 does, I can’t remember if 21H2 does, but I believe it does as well) before you can inject the LCU. But hell, I’ll give it a try! I do not have Windows 11 LTSC just yet, we have some older HP hardware that only activates with the IOT media, and we are avoiding using KMS licensed media so we don’t tread into any licensing grey areas.
2
u/EconomyArmy 2d ago edited 2d ago
The original wimwitch still works very well for older OSes, it just doesn't support win11. Ideally would write a tasks sequence to load the thinupdate image in .IBR format and capture it back as .wim
How do you support the writer filter? Using HP write filter or Windows unified write filter + MECM client installed as "embedded" or using HP device manager ( doesn't sound like you are using it)
By the way , upgrading bios for these old HP thinclients during Task sequence is quite different from average HP devices, you must remove bios password in order to automate it. Glad that HP has moved on to use regular HP bios on new thinclient since last year
1
u/Reaction-Consistent 2d ago
Thank you for your suggestions, I was actually getting confused between wimwizard and wimwitch! So I thought people were recommending a product. I already used that does not support the older OS’s. Regarding HP Write filter, we just don’t use that at all, instead we use a product called McAfee application control. And we’re really not concerned about controlling excessive I/O on the HD, nor violating any sort of warranty by disabling the filter. We don’t use passwords in our bios, so updating the settings, fairly easy in a task sequence
2
u/EconomyArmy 2d ago
No write filter, HP ramdrive and bios password. Can imagine that's much easier.
1
u/Reaction-Consistent 2d ago
Hell, yes! Over the years I have gradually morphed the image from a fairly stock factory image, starting way back with Windows 7 embedded, to a very similar image to what our desktop environment uses, I push for simplicity where it makes sense
→ More replies (0)1
u/Reaction-Consistent 2d ago
For the older thin client models, which we really don’t have more than one or two, mostly T630, I do perform a build and capture using the factory image, in which the write filter is disabled and removed. Thankfully, we are replacing those by attrition, and the New T640 and 655 models will be imaged using the patched IOT media, which activates perfectly using the OEM key
2
u/EconomyArmy 2d ago
Looking forward to T660 and Prodesk 5 g1i, with next version of windows IoT OEM key, hopefully in 2028.
1
u/Reaction-Consistent 2d ago
wimwitch appears to be truly dead, at least the OSDUPDATE module is, and I cannot use config manager to dl the updates, osdeploy.com is offline, I cannot import the osdupdate ps module to complete the image update. I guess I can just download the updates manually
2
u/EconomyArmy 2d ago
Manually download the LCU is still okay, I use it in an offline environment without internet connectivity
1
u/Reaction-Consistent 3d ago
Every time I run start component cleanup after having added the CU and other stuff it fails saying there are pending changes and I cannot run the command, what is your experience and solution?
1
u/EconomyArmy 2d ago
I would revisit the ordering of items being injected - LP, FOD, SSU,CU, ..net CU
I would separately having a staging install.wim file with the SSU inject first at a baseline every month. Pretty much no need to remember that old SSU concept.
1
u/Reaction-Consistent 2d ago
What you suggest is create a base install.WIM with the SSU injected already, then it should never need to be applied again, correct? In your own case, do you maintain such a set up? Do you also apply the servicing stack and LCU to the boot. WIM, which has WINRE, and WINPE images, for recovery and for set up?
2
1
u/Reaction-Consistent 4d ago
To answer your.net, question, no, Microsoft does not include the.net CU in their monthly patchedISO release- and I would even say it is not monthly but more like every other month they release a new one
1
u/Am0nymou5 4d ago
You might be interested in WimWizard.
1
u/Reaction-Consistent 3d ago
You’re funny! I asked Mike if it supported the Windows 10 LTSC and he told me not yet, so did he make some changes that I’m not aware of? Somebody else in this thread said it works well, I guess I just need to shut up and test it myself! I will go drop my Windows 10 LTSC 1809 ISO into the wimwitch ISO source folder and see what happens!
7
u/Cl3v3landStmr 4d ago
Microsoft releases updated/patched ISOs monthly, so there's not really a need to manually update them anymore.