When creating Windows images with lot's of updates, it's possible to shrink them before or after capturing the image. When deploying systems with less free disk space (like thin clients) this may be needed to fit. The DISM tool contains multiple servicing commands related to the component store (or the WINSXS directory). This location is used during servicing operations within Windows installations. Servicing operations include, but are not limited to, Windows Update, service pack, and hotfix installations.
The component store contains all the files that are required for a Windows installation. And, any updates to those files are also held within the component store as the updates are installed. This causes the component store to grow over time as more updates, features, or roles are added to the installation. The component store uses NTFS hard links between itself and other Windows directories to increase the robustness of the Windows platform.
The following commands can be used to shrink Windows installations and/or WIM images:
When creating a reference image use the online command:
Dism.exe /online /Cleanup-Image /StartComponentCleanup
Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
Dism.exe /online /Cleanup-Image /SPSuperseded
When the image is already created, mount it and use the offline command:
Dism /image:<path> /Cleanup-Image /StartComponentCleanup
You can also run the following command to check the status of the Component Store:
Dims.exe /Online /Cleanup-Image /AnalyzeComponentStore
This can save multiple gigabytes on the image size!
For more information:
Clean Up the WinSxS Folder
How to address disk space issues that are caused by a large Windows component store (WinSxS) directory
How to Clean up the WinSxS Directory and Free Up Disk Space on Windows Server 2008 R2 with New Update
When creating a Build and Capture image, the system will be most of time in a WORKGROUP and not in a domain. On the image used for this, you can make usage on Offline Servicing for integrating Windows updates in the image. On Windows 7 SP1 this will be around 100+ updates already! When installing applications during Build and Capture however, additional updates are needed. This for applications like Internet Explorer, DotNet Framework and Microsoft Office. You can add a "Install Software Updates" step for that in the task sequence, but error 0x80070005 will be showed in the smsts.log probably. This because the system isn't allowed to download the updates (access denied). Let's have a look on that.
Before installing updates it's needed to install a hotfix first. This is KB2522623, which is needed because: "InitializeSecurityContext function might not fall back to NTLM authentication in Windows 7 or in Windows Server 2008 R2 when Kerberos fails and has the STATUS_NO_LOGON_SERVERS status". After installing the hotfix, additional updates will be installed without a problem. On above applications there will be almost 50 updates more installed! Just great to have around 160/170 updates in your image that way ;)
Hotfix installation: wusa <file>.msu /quiet /norestart
Source: A guide to Microsoft Products
Download: KB2522623
Last month I did a new ConfigMgr 2012 SP1 installation. In the task sequence used for OS deployment, Adobe Reader, Flash, Shockwave and Java was installed also. When doing a default deployment of these tools, all will auto-update after deployment. Most of times users don't have permissions for installing these updates, so that's definitely not what you want. Let's have a look now!
Let's start with Adobe Reader first. Adobe has a Customization Wizard available, for configuring Reader during deployment. One of the options is to disable auto-update of Reader. Just deploy the MSI with the created MST file and you're done!
For example: msiexec /i AdbeRdr11000_nl_NL.msi TRANSFORMS=AdbeRdr11000_nl_NL.mst /qn
Second one is Adobe Flash. Because many updates are released, disable auto-updates is needed. This time no Customization Wizard is available. Just create a file with the name mms.cfg that contains AutoUpdateDisable=yes.
During deployment copy the file with the following commands:
32-bit Windows editions: xcopy %0\..\mms.cfg “%Windir%\SysWOW64\Macromed\Flash” /I /Y
64-bit Windows editions: xcopy %0\..\ mms.cfg “%Windir%\System32\Macromed\Flash ” /I /Y
Verify settings in Flash Player Settings Manager within control panel.
Third one is Adobe Shockwave. This time another approach is needed again. Because no Customization Wizard is available, just use registry for that. Navigate to the registry section and modify the value of the following two keys:
Key: HKLM\SOFTWARE\Adobe\Shockwave 11\AutoUpdate > Value: n
Key: HKLM\SOFTWARE\Adobe\Shockwave 11\collectstats > Value: n
Verify via: Right click -> Shockwave Settings
Fourth and last one is Java Runtime. Because many updates are released, disable auto-updates is needed. Just use registry again for that. Navigate to the registry section and modify the value of the following two keys:
Key: HKLM\SOFTWARE\JavaSoft\Java Update\Policy
EnableJavaUpdate REG_DWORD 00000000
EnableAutoUpdateCheck REG_DWORD 00000000
After using this Adobe and Java update notifications are gone!
