Recommended guide for Windows 10 image creation (from scratch) ?

[St.Nikolai]

This post is deleted!

[x23piracy]

Hi,

i do the following, install Win 10 with latest Media Creation Builder iso,
when Setup asks for Express Settings press STRG + SHIFT + F3 to enter audit mode.

Client will reboot and logon with embedded administrator account, install and change anything you want.

Then sysprep /oobe /generalize /shutdown /unattend:c:\unattend.xml

Now you can create the image.

For an unattend file i recommend this site: http://windowsafg.no-ip.org/win10x86_x64.html
dont forget to add the copyprofile option to your unattend.xml else it will not copy your adit profil to default user.

Do not uninstall modern apps in windows 10 only remove them from startmenu, you get messed when removing staged apps.

If you ever wnat to rework the image, deploy it somewhere and then go back to audit mode with sysprep /audit /reboot
then delete all created profiles and users except build in administrator do your changes and sysprep again

sysprep /oobe /generalize /shutdown /unattend:c:\unattend.xml

Regards X23

[URfog]

@x23piracy said in Recommended guide for Windows 10 image creation (from scratch) ?:

Hi,

i do the following, install Win 10 with latest Media Creation Builder iso,
when Setup asks for Express Settings press STRG + SHIFT + F3 to enter audit mode.

Client will reboot and logon with embedded administrator account, install and change anything you want.

Then sysprep /oobe /generalize /shutdown /unattend:c:\unattend.xml

Now you can create the image.

For an unattend file i recommend this site: http://windowsafg.no-ip.org/win10x86_x64.html
dont forget to add the copyprofile option to your unattend.xml else it will not copy your adit profil to default user.

Do not uninstall modern apps in windows 10 only remove them from startmenu, you get messed when removing staged apps.

If you ever wnat to rework the image, deploy it somewhere and then go back to audit mode with sysprep /audit /reboot
then delete all created profiles and users except build in administrator do your changes and sysprep again

sysprep /oobe /generalize /shutdown /unattend:c:\unattend.xml

Regards X23

Hi @x23piracy , Would you tell what version of W10 are you using?

Thanks in advance

[x23piracy]

@URfog sure, Windows 10 Pro via MS Media Creation Tool (iso). I also found a way to remove all store apps except the store itself without getting sysprep problems.

Regards X23

[URfog]

Thank you so much, I’ve been dealing with the unattend file for days with no result and thsi page saved me from disaster

Bye

[Scott Adams]

@x23piracy How did you go about doing this? I’m running into an issue with sysprep anytime I try to remove a Windows 10 app. It sure would be nice to not have those pesky apps in my image.

[george1421]

@Scott-Adams How are you removing this applications? You have to uninstall them from the current users and then remove them from the system. The last time I built a win10 reference image (on CBB 1511) I was able to do it and sysprep without any issues, but I used a powershell script to extract the unwanted applications.

[x23piracy]

Hi,

@Scott-Adams said in Recommended guide for Windows 10 image creation (from scratch) ?:

@x23piracy How did you go about doing this? I’m running into an issue with sysprep anytime I try to remove a Windows 10 app. It sure would be nice to not have those pesky apps in my image.

Get-AppxPackage -AllUsers | where-object {$_.name –notlike “*store*” -And $_.packagename –notlike “*culator*”} | Remove-AppxPackage
Get-appxprovisionedpackage –online | where-object {$_.packagename –notlike “*store*” -And $_.packagename –notlike “*culator*”} | Remove-AppxProvisionedPackage -online

I did this based on 1511 and updated later to 1607, i always restore my image to a virtual box to rework on it and then i also do actual windows updates… so i was coming with that script above from 1511 just FYI…

I would like to keep store and new calculator, if you remove the new calc anyway you need to install windows 7 calculator for windows 10…if you need a calc app, in business you will. ;): http://winaero.com/blog/get-calculator-from-windows-8-and-windows-7-in-windows-10/

Regards X23

[adukes40]

Anyone played with the LTSB version of Win10 in their environment?

[george1421]

@adukes40 Yes. I suspect the 2016 one should be in the works soon. I think 2015 LTSB dropped in Nov of 2015.

But right now CBB 1607 has issues with WSUS updates not applying, so I suspect they are trying to nail that one down first. (edit: Actually I just found an article that says LTSB 2016 will be released on Oct 1 [today]. Its unclear if that date is still valid or not).

[adukes40]

do you use it, George?

[george1421]

@adukes40 Only in the dev lab. We are not quite ready to roll it out to the organization. But it does work in the dev labs. We are still fine tuning the GPOs to get them to work like we want them.

[adukes40]

@george1421 thats good to hear, I was thinking about using LTSB instead of Education, because of its simplicity. Don’t have to worry about the apps, or store, and all that mess.

[george1421]

@adukes40 We went with LTSB for a few reasons, not having the consumer apps was one, the other was the longer refresh cycle. CBB will force an update even if you mark it to delay the upgrade. The force update will be 6 months after the current release was released. We have to verify each of our core applications work before we can release an new OS and twice a year is a little much OS thrashing. As soon as we would get one version tested and approved we would have to start on the next release. That is a bit crazy.

[edit] FWIW: I was just able to get CBB 1607 to create cleanly with mdt and windows updates after a bit of hacking about. The late sept 1607 cume update and setting the delivery optimization to 100d fixed the wsus updates getting stuck issue.

[Scott Adams]

@george1421 I’m doing it from audit mode, so there is only the default administrator account at that time.

I uninstall the user app and the provisioned app using a powershell script. An example of my script is:

Get-appxpackage *3dbuilder* | Remove-AppxPackage
Get-appxprovisionedpackage –online | where-object {$_.packagename –like "*3dbuilder*"} | remove-appxprovisionedpackage –online
Get-appxpackage *windowsalarms* | Remove-AppxPackage
Get-appxprovisionedpackage –online | where-object {$_.packagename –like "*windowsalarms*"} | remove-appxprovisionedpackage –online

Tom Elliott – Modded to use code format. Asterisks italicize the font in MD language.

[Scott Adams]

Not sure why, but the post removed my asterisks. There should be asterisks enclosing 3dbuilder and windowsalarms for the Get-appxpackage portions.

[MRCUR]

@george1421 If you use WSUS then updates will not force themselves on the machines unless you approve them. The “Windows Update for Business” stuff only applies to non-WSUS deployments where you’re controlling Windows Update only with group policy and no WSUS.

[MRCUR]

@adukes40 I’ll just mention that you can disable the Store and all “modern” apps with a single group policy setting. You may not need to go the drastic route of deploying LTSB if your primary concern is access to the Store & modern apps.

[george1421]

@MRCUR said in Recommended guide for Windows 10 image creation (from scratch) ?:

@george1421 If you use WSUS then updates will not force themselves on the machines unless you approve them. The “Windows Update for Business” stuff only applies to non-WSUS deployments where you’re controlling Windows Update only with group policy and no WSUS.

FWIW: There are documented “bugs” with CBB 1607 where windows updates will hang applying them. This happens with images being built in MDT as well as images already in production. The late September cume update kb3193494 as well as setting the DeliveryOptimization registry key fixed the MDT / WSUS deployment issues with image creation. I suspect that kb3193494 will also address the 1607 systems in the wild too, but we don’t have any as of now. Which will be interesting since wsus is broken so the only way to deploy that update is via some alternate methods.

[MRCUR]

@george1421 Interesting & good to know. We’re still actively deploying build 1511 and just starting to test 1607 so we haven’t seen any issues with WSUS patching 1511 so far.