  Creating and Managing System Images  The Path page in the New Deployment Share Wizard   Click Next seven times to accept the default wizard settings. The wizard creates the deployment share and the Conrmation page appears.   Click Finish. The new share appears under Deployment Shares.   Expand the MDT Deployment Share node, right-click Operating Systems and, from the context menu, select Import Operating System. The Import Operating System Wizard appears, displaying the OS Type page, as shown in Figure 3-10.  The OS Type page in the New Deployment Share Wizard Lesson 1: Designing an Image Creation Strategy     Click Next to accept the default OS Type value. The Source page appears.   Insert the Windows 7 installation DVD into the computer’s disc drive. Then click Browse, select the root of the DVD-ROM drive, and click Next. The Destination page appears.   Click Next to accept the default Destination Directory Name setting. The Summary page appears.   Click Next to begin importing the operating system image le from the Windows 7 installation disk.   When the importation process is completed, click Finish. The imported images appear in the Deployment Workbench, as shown in Figure 3-11.  Operating system images added to a deployment share  ■ Windows Imaging les are le-based images, with a .wim extension, which can contain multiple operating system images. Compared with sector-based images, Windows Imaging les are hardware independent, nondestructive, compressed, spannable, bootable, mountable, and editable. ■ Large-scale deployment environments require careful strategizing because you often need to create and manage dozens—or even hundreds—of image les. To devise a workstation image creation strategy, desktop administrators must understand the properties of image les, as well as the tools and procedures for creating them. ■ An efcient enterprise imaging strategy should enable you to create image les that deploy complete workstation environments with little or no interaction on the client side. ■ For large enterprises that require many different workstation congurations, MDT 2010 provides an efcient platform for creating and deploying multiple Windows Imaging les. ■ To implement a large-scale image creation strategy, you need a laboratory in which you can experiment with your task sequences and test them in an environment that simulates—or at least resembles—your actual production network.   Creating and Managing System Images ■ A system image that includes all of the applications, drivers, updates, and language packs that a workstation needs is called a thick image. ■ A thin image is a system image that contains the operating system, but fewer applica- tions or other software components, if any at all. Instead of deploying the applications, updates, device drivers, and language packs with the operating system, administrators deploy them afterward. ■ Hybrid images are similar to thick images in that they install all of the applications and other software components the workstation will need, but like thin images, they do not include all of those other components as part of the image le. Instead, they access the additional components from a share on the network.  You can use the following questions to test your knowledge of the information in Lesson 1, “Designing an Image Creation Strategy.” The questions are also available on the companion CD if you prefer to review them in electronic form. Note      Microsoft helps Windows 7 desktop administrators design and create Windows Imaging les with two primary support packages: the Windows 7 AIK and MDT 2010. Which of the following tools is not included as part of the Windows 7 AIK?   Deployment Workbench   Windows System Image Manager (SIM)   Sysprep.exe   ImageX.exe   Which of the following lists the three most common methods for creating operating system images, in order of increasing complexity?   Manual image creation, Microsoft Deployment Toolkit 2010, Windows 7 Automated Installation Kit   Microsoft Deployment Toolkit 2010, Windows 7 Automated Installation Kit, Manual image creation   Windows 7 Automated Installation Kit, Manual image creation, Microsoft Deployment Toolkit 2010   Manual image creation, Windows 7 Automated Installation Kit, Microsoft Deployment Toolkit 2010 Lesson 2: Customizing and Updating Images     Which of the following is not a step in a typical Windows 7 AIK image creation process?   Create an Unattend.xml or Autounattend.xml le.   Start the reference computer and supply it with the answer le to enable the oper- ating system installation to proceed unattended.   Prepare the reference computer for imaging by running the Oscdimg.exe utility.   Start the reference computer with a Windows PE disk and use the ImageX.exe utility to capture a Windows Imaging le.   When you are creating a deployment share using the Deployment Workbench appli- cation included in MDT 2010, which of the following can you not use as a location for the share?   A stand-alone DFS namespace   A domain-based DFS namespace   A local disk   A network share   Which of the following types of computer is not a required component in a Windows 7 AIK or MDT 2010 workstation image creation lab?   A domain controller   A build computer   A reference computer   A test workstation  The basic image creation process described in Lesson 1 of this chapter, in which you install and congure a reference computer and then capture an image of that computer for later deployment, is essentially a method of customizing a workstation image. Without this pro- cess, you would have to install the core operating system image on each workstation and update it from there, which is exactly what you are doing when you perform a manual instal- lation by inserting a Windows 7 installation DVD into a new computer. By adding applications, updates, device drivers, language packs, and conguration settings to the core operating system, you are taking a generic image and bringing it closer to the functional specica- tion you dened for the workstation. In this lesson, you learn about how to modify images directly, by editing them in place.   Creating and Managing System Images  ■ Understand the circumstances under which you might want to update custom image les. ■ Understand how to customize images by adding les. ■ Select a tool or technique for modifying image les.   The reference computer image creation process assumes that administrators have a relatively complex workstation conguration that they want to deploy to a large number of computers. However, this is not always the case. If you have only minor changes to make to the core operating system image, such as applying a few updates or a language pack, it might be easier to modify an image directly while it is ofine, rather than deploy it on a reference computer and capture an entirely new image. Every Windows 7 installation disk includes a Windows Imaging le called Install.wim, located in the Sources folder, which contains the core images for one or more editions of the operating system. After copying this le to a read/write medium, such as a hard disk, you can use the ImageX.exe or Deployment Image Servicing and Management (DISM.exe) utility from the Windows 7 AIK to do any or all of the following: ■ Add packaged applications ■ Add packaged updates ■ Add device drivers ■ Add language packs ■ Enable or disable operating system features ■ Append a volume image to a workstation image ■ Combine multiple images in a single Windows Imaging le For more information on using DISM.exe to modify ofine images, see “Using Deployment Image Servicing and Management,” later in this lesson. It is up to the individual administrator to decide at what point capturing a new reference computer image becomes preferable to manually customizing an image le. After you have customized an ofine image le, you can install it on your target workstations using any of the standard deployment methods. Lesson 2: Customizing and Updating Images    Administrators who have already chosen to capture new images from a reference computer installation can still update those image les after creating them. Depending on the size and complexity of your deployment project, you might choose to install your reference computer manually, or use the tools provided in the Windows 7 AIK or MDT 2010. Whichever method you choose, you are essentially conguring a workstation the way you want it and taking a snapshot of it for later use. The image le is your snapshot, which you can copy to any num- ber of other computers as needed. Of course, workstations are not static; they change over time, and it might become neces- sary to modify your image les to reect those changes. As with the initial image creation process, there are several different tools and techniques you can use to do this.  Workstations change, just as people do, and snapshots—your image les—can eventually go out of date. You can choose from several ways to update image les, but rst you might question why you should bother. After all, you can, and probably do, update your work- stations on a regular basis. Automatic Updates, Windows Server Update Services (WSUS) and System Center Conguration Manager (SCCM) 2007 are all Microsoft products that enable administrators to automate the deployment of operating system updates. With these mechanisms available, why then should you have to update your workstation images? Security is one reason. Microsoft regularly releases critical updates that address operating system security issues. As time passes and your images are less current, your original work- station congurations could become increasingly vulnerable to attack. When you deploy new workstations, up to a full day might pass before they receive updates from WSUS or SCCM, and intruders might be able to take advantage of this gap in protection. The update process can also become increasingly long and complex over time. Microsoft releases dozens of operating system updates each year, some of which have their own inter- dependencies. As your images grow older, they might eventually require literally hundreds of updates, some of which must be installed before the system can install others. It might be days after the initial deployment before WSUS or SCCM brings a new workstation fully up to date. Finally, your organization’s requirements for the workstations might change over time, requiring you to add and remove applications or change conguration settings. If, for example, your organization decides to substitute one application for another, it would become necessary for you to uninstall the old application on each new workstation you deploy and then install the new one. This is not only inconvenient for the administrator, it could also have a negative effect on workstation performance if the old application leaves les, registry settings, or other artifacts of itself behind. For any of these reasons, you might prefer to modify your workstation images, rather than recongure the workstations themselves after deployment.   Creating and Managing System Images  When a snapshot is out of date, you can always shoot another one, and the same is true of your workstation image les. If, after your initial deployment project is completed, you want to modify your base workstation conguration, you can always recongure the reference computer and create another image—take another snapshot. To do this, you can go back to your original reference computer deployment and modify the task sequence or answer le you used to install the reference computer in the rst place. Then, you must reinstall the reference computer and capture a new image of it. Of course, this assumes that you still have your original build computer and reference computer(s) in place, waiting to be updated. If you have multiple workstation images to recapture, this method assumes that you are willing to redeploy each of your reference computers and recapture an image of each one. In essence, you would be repeating your entire image creation process over again. If modifying the original task sequences or answer les seems impractical, you can always consider updating your reference computers manually, or by using standard tools such as WSUS and SCCM, mentioned earlier, and then reimaging them. This strategy would address the problem of applying multiple security updates, as described earlier, but might not be the best solution for uninstalling applications. After all, if uninstalling an old application leaves artifacts behind on the reference computer, you would just be replicating those artifacts in your new image le. This method too assumes that you still have your reference computers sitting around, waiting to serve as models for your revised image snapshots, and that you are prepared to create and store new versions of every image you created in the rst place.  One possible way to avoid having to recapture new images is to modify the deployment pro- cess for your existing images. By modifying the answer les or task sequences you use to deploy your images to your target workstations (not the ones you use to deploy your reference com- puters), you can install software packages and updates or recongure operating system settings almost immediately after the installation of the operating system. This approach reduces the time during which the workstation is vulnerable to attack because of missing updates. For more information on working with task sequences and answer les, see Chapter 7, “Designing Lite-Touch and Zero-Touch Deployments.”  When faced with changing workstation requirements, you can always recapture new image les or modify the process by which you deploy your existing image les, but you can also modify ofine image les themselves. Working with an existing image le is no different from custom- izing the base image le supplied on a Windows 7 distribution disk. You can use DISM.exe to perform any of the tasks listed earlier, as described later in this lesson. Lesson 2: Customizing and Updating Images   More INfo          Assuming that you have properly prepared your reference computer by running the Sysprep.exe tool before capturing your images, you do not need to prepare them again after modifying them with ImageX.exe or DISM.exe. You can proceed to deploy the modi- ed image les in the normal manner.  When you update your image les manually, you are obliged to keep track of those updates manually as well. If you maintain a large number of workstation images, and update them regularly, it’s easy to lose track of which hotxes you’ve applied, which conguration settings you’ve changed, and which drivers you’ve upgraded. As a result, version control is a critical part of any image update strategy, particularly if you update your images on a regular basis. For a relatively low-tech version control mechanism, you can combine a lenaming scheme with a spreadsheet listing the modications you have applied.  You can manually modify ofine images using either the DISM.exe or ImageX.exe utility, both of which are included in the Windows 7 AIK. DISM.exe is also included with Windows 7 itself, so you can modify the Install.wim image le included on all Windows 7 installation disks with- out downloading the Windows 7 AIK. Although the two programs are functionally similar and can perform many of the same image modication tasks, each one has its own syntax, and their commands are not interchangeable. ImageX.exe has been around since Microsoft rst developed the Windows Imaging le format for use with Windows Vista. The Windows 7 AIK uses ImageX.exe to capture worksta- tion images and save them as Windows Imaging les. Because it utilizes the various tools in Windows AIK, MDT 2010 also relies on ImageX.exe to capture images. Deployment Image Servicing and Management (DISM.exe) is a new program, rst released in Windows 7 and the Windows 7 AIK, which replaces the Windows Vista Package Manager (Pkgmgr.exe), PEImg.exe, and Intlcfg.exe tools. Although you cannot capture images with DISM.exe, as you can with ImageX.exe, you can modify them in much the same way.   Creating and Managing System Images exaM tIp       Before you can modify an ofine image by using either DISM.exe or ImageX.exe, you must mount the image to a folder on a local drive, as shown in Figure 3-12. Mounting an image extracts the component les from the Windows Imaging le and writes them to a folder. If the Windows Imaging le contains multiple operating system images, you must specify the one you want to mount.  Mounting an image file with DISM.exe As you apply modications, you are working on the mounted image. When you are nished, you must unmount the image, which saves the changes you made back to the Windows Imaging le. More INfo   MCTS Self-Paced Training Kit (Exam 70-680): Conguring Windows 7  Lesson 2: Customizing and Updating Images    Adding device drivers is one of the most common modications administrators can make to ofine image les, and using DISM.exe, the process is simple. In earlier versions of the Windows AIK, you had to create an answer le that pointed to the drivers and then use Package manager to apply the answer le to an image mounted using ImageX.exe. With DISM.exe, a single com- mand installs drivers to a mounted image, as shown in Figure 3-13.  Installing a driver with DISM.exe IMportaNt  /Add-Driver    When DISM.exe installs drivers, it renames them using the le names oem1.inf, oem2.inf, and so on. To remove a driver you have previously installed, you must refer to it on the com- mand line by its new name. To determine the name of the specic driver you want to remove, you can run DISM.exe with the /Get-DriverInfo parameter, as shown in Figure 3-14. This is a common practice in many DISM.exe image modication procedures. As a result, the program has several of these “Get” parameters that enable you to display information about the cur- rently mounted image. [...]... Client Configuration Strategy CHAPTER 4 1 27 More Info  Downloading the Windows 7 Security Guide The Windows 7 Security Guide is part of the Security Compliance Management Toolkit for Windows 7, available from the Microsoft Download Center at http:// www.microsoft.com/downloads/details.aspx?FamilyID=5 534 bee 1 -3 cad-4bf0-b92ba8e545 5 73 a3e&displaylang=en Creating Monolithic vs Functional GPOs When you create... configurations 1 26 CHAPTER 4 Configuring Clients Figure 4-6   The Group Policy Starter GPO Editor console The GPMC implementations for Windows 7 and Windows Server 2008 R2 include eight preconfigured starter GPOs, as shown in Figure 4 -7 , four for Windows Vista (which you can also apply to Windows 7 workstations) and four for Windows XP R2 Figure 4 -7   Starter GPOs in Group Policy Management console These... and Management (DISM.exe) ■ file-based image ■ hybrid image ■ ImageX.exe ■ language pack ■ offline image ■ online image ■ reference computer ■ sector-based image ■ target computer ■ build computer thick image Chapter Review CHAPTER 3 1 13 ■ thin image ■ Windows 7 Automated Installation Kit (AIK) ■ Windows Imaging ■ Windows Preinstallation Environment (Windows PE) ■ Windows System Image Manager (SIM)... from an elevated Windows PowerShell prompt: import-module GroupPolicy Exam Tip The increased emphasis Microsoft places on Windows PowerShell and its new capabilities in Windows 7 and Windows Server 2008 R2 is reflected in the 7 0- 686 exam Individuals taking the exam should be familiar with the new Group Policy cmdlets and with the procedure for importing the GroupPolicy module into a Windows PowerShell... Management feature in Windows Server 2008 R2 Lesson 1: Designing a Client Configuration Strategy CHAPTER 4 1 23 Note  Managing Group Policy from Windows 7 Windows 7 includes a Local Group Policy Editor snap-in for Microsoft Management Console, which you can use to manage local Group Policy settings, but this snap-in cannot manage GPOs for AD DS To manage AD DS Group Policy on a Windows 7 workstation, you... 4-2   Group Policy Management Editor 1 22 CHAPTER 4 Configuring Clients GPMC is supplied as a feature in Windows Server 2008 R2 and with all other Windows Server versions since 20 03 The feature is installed by default on AD DS domain controllers To use the GPMC on a member server, you must add the Group Policy Management feature by using the Server Manager console, as shown in Figure 4 -3 Figure 4 -3  ... scenarios set up real-world situations involving the topics of this chapter and ask you to create a solution ■ Complete the suggested practices ■ Take a practice test Chapter Summary ■ The Windows 7 Automated Installation Kit (AIK) and Microsoft Deployment Toolkit (MDT) 2010 provide administrators with the tools and documentation they need to devise an efficient strategy for creating Windows 7 workstation... Server Administration Tools for Windows 7 package from the Microsoft Download Center at http://go.microsoft.com/fwlink/?Linkid= 130 862 Then, you must turn the Group Policy Management Tools feature on by selecting Turn Windows Features On Or Off in the Programs And Features control panel, as shown in Figure 4-4 Figure 4-4   Turning on Group Policy Management Tools in Windows 7 After you turn on the group... DISM.exe adds it to the image, as shown in Figure 3- 1 5 You can use DISM.exe only to install updates that are packaged as cabinet (.cab) files or Windows Update Stand-alone Installer (.msu) files As with drivers, you cannot install msi or exe files to an offline image from the DISM.exe command line 1 06 CHAPTER 3 Creating and Managing System Images Figure 3- 1 5  Installing a package with DISM.exe If you... Using Windows Explorer, create an empty folder called Mount in your C:\Users folder 3 On the Start menu, open the Windows AIK program group, right-click Deployment Tools Command Prompt and, from the context menu, select Run As Administrator 4 In the Administrator: Deployment Tools Command Prompt window, type the following command all on one line to mount the image and press Enter: dism /mount-wim . Toolkit 2010, Windows 7 Automated Installation Kit   Microsoft Deployment Toolkit 2010, Windows 7 Automated Installation Kit, Manual image creation   Windows 7 Automated Installation Kit, . the Windows 7 AIK. DISM.exe is also included with Windows 7 itself, so you can modify the Install.wim image le included on all Windows 7 installation disks with- out downloading the Windows 7.    MCTS Self-Paced Training Kit (Exam 7 0- 680): Conguring Windows 7   Lesson