Failed to Install Software Updates during Build and Capture (Error: 87D00272)

Recently I created several Windows 10 1607 images, where Offline Servicing put all Windows 10 updates needed on the image. Besides of that I created Build and Captures task sequences, with an Office 2016 package in it. Because those updates cannot be injected with Offline Servicing, I decided to add an additional Install Software Updates step in the task sequence. Nothing wrong about that :-)

During the Software Update installation step however, the following error message was displayed:
-Refreshing Updates
-Failed to RefreshUpdates, hr=0x87d00272
-Failed to run the action: Install Software Updates. Component is disabled. (Error: 87D00272)

Trick is, someone changed the Default Client Settings policy, and set "Enable software updates on clients" to No. Therefore software update scan, download and install cannot take place. Long story short, change the policy back to Yes, and start build and capture again.

Hope it helps!

Download software updates working again!

Install software updates working again!

Error 0x80070005 during Build and Capture on WORKGROUP systems

When creating a Build and Capture image, the system will be most of time in a WORKGROUP and not in a domain. On the image used for this, you can make usage on Offline Servicing for integrating Windows updates in the image. On Windows 7 SP1 this will be around 100+ updates already! When installing applications during Build and Capture however, additional updates are needed. This for applications like Internet Explorer, DotNet Framework and Microsoft Office. You can add a "Install Software Updates" step for that in the task sequence, but error 0x80070005 will be showed in the smsts.log probably. This because the system isn't allowed to download the updates (access denied). Let's have a look on that.
 

 
Before installing updates it's needed to install a hotfix first. This is KB2522623, which is needed because: "InitializeSecurityContext function might not fall back to NTLM authentication in Windows 7 or in Windows Server 2008 R2 when Kerberos fails and has the STATUS_NO_LOGON_SERVERS status". After installing the hotfix, additional updates will be installed without a problem. On above applications there will be almost 50 updates more installed! Just great to have around 160/170 updates in your image that way ;)
 
Hotfix installation: wusa <file>.msu /quiet /norestart

Source: A guide to Microsoft Products
Download: KB2522623

How to create a reference image in ConfigMgr

In ConfigMgr 2007 and 2012 the most used functionality is Operating System (OS) deployment. With OS deployment it's possible to migrate or install an unknown or known system, which can be a server, fat client (desktop or notebook), thin client or virtual desktop. To migrate or install an unknown or known system, a reference image is needed. This is the image created on a (virtual) system, which is prepared for deployment. Unfortunately you can't use the Install.wim from the Windows XP, Vista or Win7 ISO file, because it will be installed on the D: drive by default. That's the Microsoft way for creating images :)

A reference image can be created with a Build and Capture task sequence, which is the preferred way. All Windows files from a ISO file must be imported in ConfigMgr to use this task sequence. A Windows OS will be installed on the host system, Sysprep is running which reboots the system, Windows PE will start automatically and a reference image will be uploaded to the ConfigMgr server. A default Build and Capture can be created within the task sequence wizard. The ConfigMgr client will be installed in this reference image (mandatory step).

Another possibility is using ConfigMgr Capture media on an already installed system. That way the system must be joined to a workgroup and Sysprep files must be present on the host OS. In Windows 7 or Windows 8 this isn't needed, because Sysprep is build-in. When ConfigMgr Capture media is started (within Windows, because it isn't bootable) Sysprep is running which reboots the system. Windows PE will start automatically after reboot and a reference image will be uploaded to the ConfigMgr server. No ConfigMgr client will be installed this time.

A reference image contains software updates and maybe a few applications like DotNet Framework for example. It's not a best practice to install user-specific applications in the reference image. Just keep it as clean as possible! That's also the reason to create it on a virtual machine, because less drivers are needed. When using ConfigMgr 2007 it's needed to install software updates during Build and Capture to have an updated image. In ConfigMgr 2012 it's not needed anymore to install software updates during installation. Just build the image and use Offline Servicing in ConfigMgr 2012 for offline update integration.

With Windows Server 2012 and Windows 8 (which will be supported in ConfigMgr 2012 SP1), no reference image is needed anymore. Within Windows Server 2012 and Windows 8 it's possible to mount an ISO file by richtclick and mount it, without the need for additional software. Just copy the Install.wim from the (mounted) ISO file and import it in ConfigMgr 2012 SP1. Use Offline Servicing for offline update integration and you're done! That way you can save a lot of time which can be used for all new awesome functionality in ConfigMgr!

That's it for now. If there are still questions about this topic, use comments below.