How to: Make a Universal Image

The goal of this document is to outline the steps to make a universal image. I created this document because I found a lack of documentation how to consolidate many images for many different system into one image that would suite a wide array of desktops and laptops. Even though I have yet to test this with servers, I am confident that this method should word from them as well. In order to make a universal image you need to establish a starting point whether that is from a base image that you want to update or a fresh install of windows. Keep in mind this process will take several hours to complete and a few days of testing. Lets go though the list of software you will need. You can find links to the software in the appendix.

Nlite
Windows Update Downloader
Driver-pack Base and Driver Packs
Windows XP disc (Pref. Corp/Enterprise with valid key)
Dial-a-Fix
Newsid
contig
streams
CCleaner
Windows Installer Cleanup
Sysprep Driver Scanner

Fresh Install – Building the image from the ground up.

When starting with a fresh install it is imperative that you have all your software handy and every step to install it well known.

Step One: Preparing the installation media

Using a copy of Nlite you can join drivers, updates, unattended settings, tweaks, and add/remove windows components. For this example we will go though the process of adding updates, unattended settings, and add/removing components. If you would like to tweak the system then please do so however make sure you fully understand how they will affect the system. This is where we choose our windows install. If you haven't copied your disc to a local drive, then just choose your disc drive with the xp disc located inside. Nlite will copy over the files to a location you choose, for this example I decided to use C:\XPsp2_Updated.

This is the main section of Nlite. Here we will choose the following. Do not select drivers, as we will integrate them with another program. Also if you are using a non Service Pack 2 disc you will need to select the service pack field.

This section allows you slipstream a Service Pack into your install. You do not need this if you have service pack 2 on your disc like I do.

This section here you can add updates, hot-fixes, etc. into you install. Sort them by build date so that your updates apply in the correct order.

This section is the add remove components section. The Compatibility list makes sure that you do not remove functionality from your install that you may need for the future.

With this section you can set the unattended options of your install. Depending on your PC you will need to set the computer type. It is far easier to go from a multiprocessor PC to a single-processor PC in the sysprep phase than it is to go from single to multi.

This is the options settings. Choose the following options for a clean install that is easy to sysprep.

This is the tweaks section. DO NOT TWEAK THE SYSTEM UNLESS YOU FULLY UNDERSTAND THE TWEAKS. Using the wrong tweak will make your efforts to make a universal image crash and burn.

Now start the process

Now we can drop the drivers into the install. You will have to re-run nlite to create a boot-able ISO however.

Step Two: Software Installation

Install all of the software you need. Do not install any software that you need to activate. If you do need to have software that requires activation install it so that it will prompt for activation on the first run. At this point tweak the system however you need it to.

Step Three: Sysprep

At this point you need to STOP EVERYTHING, and make an image of your system. Call it fresh-install. After this point there is no going back and you will need this if your image does not work correctly. Once you have made a backup of the system you can safely continue. You need to copy over the files needed for the rest of process. You will need to copy over the i386 folder from your new windows disc to c:\i386. You will need to copy over the drivers folder to c:\drivers. You will need to copy over the sysprep folder to c:\sysprep. Now modify these settings,

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup] "SourcePath"="c:\\" "CDInstall"=dword:00000000

This will set the path that windows looks for the cd to c:\ and it will tell windows that it was not installed from a cd. Now continue with Step Five: Drivers, Sysprep, & Bringing it all together! in the next section. 

BASE IMAGE – Restoring a system to a state from which you can duplicate it.

When starting with a base system that needs updated and cloned the system most likely has lots of wear and tear, with software that no one knows where the install discs are sored nor any configuration settings. This is a difficult case because you have to get the system like a new one again. This means removing software, cleaning the registry, updating system file, removing user preferences and removing any malware.

Step One: Profiles

Log on as administrator to the local machine Remove all profiles and local accounts. Create a local temp account and login. Delete the administrator profile. This will make sure the administrator gets the default settings for all local accounts. At this point disable system restore and make sure all restore points are deleted.

Step Two: Software Removal

Now login as administrator. Remove all rouge software and malware from the system. Remove all software that is not needed. If you have corrupt installs then use the windows installer cleanup from Microsoft to remove them.

Step Three: Cleanup

Install CCleaner. Run CCleaner and check to following options;

Next check the cleaning options;

Now the Issues;

The important thing to remember is that when running CCleaner it will remove most of the temp files and you still may have to do a manual clean to get the rest, however CCleaner should be fine. After you run the cleaner you will need to scan for issues. You will have to scan many times in order to get all the invalid registry entries. This is because CCleaner is not an aggressive reg cleaner. If you feel like it you can download a 14 day trial of regsupreme Baku (http://pmcchp.com/baku/index.html) or if you access to a copy of PC Tools Registry Mechanic you can use that to clean out the registry pretty well. I would recommend running Baku to thoroughly clean out the system, however this can cause a few problems for you with any thing that has been installed with the windows installer. I have seen some programs that need direct disc access like SAV / NAV have to run a quick repair the first time you delete/copy/move a file. Another example is quick time needs to run a quick repair on its self when you run it. Make sure to run all of the software you want to keep on the system and make sure they are functional after you run Baku. Baku will deep clean a system better than most programs I have seen. After you cleaned out all the temp files from the system you will need to clean out the ADS. (Alternate Data Streams) The reason this step is important is because NTFS has the ability to create a hidden stream to were you data is stored. Malware commonly uses this to exploit your system. However the reason why we are deleting the ADS is to make sure any older streams that are no longer in use. Remember we want this working like a fresh install or as close to it as possible. You need to run NTFS Streams Eraser. You can use the GUI app in the appendix or just use streams.exe from Microsoft. Its your choice however you want to run it, however the GUI is easier for most people. Here is that example,

Once that is complete use contig (from sysinternals) to defrag the hard drive. Here is the example,

Now run the built in windows defrag, you can use the GUI if you want or just issue this command from the run box;

defrag -v -f c:\

After the defrag you will need to make sure all system files are in working order. To do this you will need to purge the system file cache. This step is necessary because it will make sure there are no corrupted files or malware that will compromise the system, and the cache will be up to date. Run the following command;

sfc /purgecache

Next run this command to start the system file check;

sfc /scannow

Make sure there is a windows xp disc in the cd. The best option would be to apply the following registry fix to tell windows that it was not installed from a cd and that the install files are located on the C drive. This will allow windows to replace any bad files with the most updated version the system files. The next step it to run Dial-a-fix. When you start dial-a-fix if there are any policies running in the system that would cause problems dial-a-fix will let you know, and if it is safe to remove them. To begin dial-a-fix make sure you run all the default options;

After you run all the defaults make sure you click on Flush Software Distribution and click No on the next box.

After flushing proceed to click on the hammer icon in the bottom right hand of the main window. It will open the tools section and it looks like this;

Now run the following by clicking on them:

FlushDNS Flush Icons Repair Permissions

This step repairs permissions, icon cache and DNS cache are flushed away. This means that the system will be working like new one. Do not bother with the other options unless your having problems. After you have finished running dial a fix you will need to run one more tool, NewSID. This will make a new SID for the system so it becomes a unique system.

The system will now reboot. Once the system has rebooted you are ready to move on to the next step. Note: Once your system has a New SID you anything that checks the SID to run will not function any longer. This will cause problems for DRM related applications, so make sure to test any media, security settings, etc. after creating the new SID.

Step Four: Install software and Tweak System

Install the software you need for the system. Make any reg hacks and/or tweaks needed.

Step Five: Drivers, Sysprep, & Bringing it all together!

Now you need driver-packs for the system. You can download them from the site in the appendix and extract them. You will need to copy the D folder to c:\drivers, however make sure that c:\drivers has the compression attribute enabled on it.. The reason for the compression is to save on space. There are nearly 2GB of drivers, when compressed it comes to just over 1GB. Next we need to copy an I386 folder to the c:\i368. The most ideal i386 is on that has all the updates, and tweaks form a clean install disc made in the previous section. However if you do not have one just copy any i386 from your enterprise xp disc. Lastly copy over the sysprep folder to c:\sysprep and run the sysprep driver scanner.

Choose 1. Default. This will add a default driver path that windows uses for most everything.

Choose 2. Scan and make sure the search path is c:\drivers.

Choose 3. Add and add in c:\windows\inf again, the path that windows uses for most everything. I know we did this in step 1 however we are just making sure if something goes wrong with the system paths our system doesn't crash and burn.

Choose 5. Save.

Choose 6. Done. Once that is done you can sysprep. Make sure you make a copy of the sysprep.inf (see appendix) and name is single-core.inf and remove the following line;

;SetupMgrTag [Unattended] UpdateInstalledDrivers=yes DriverSigningPolicy=Ignore UpdateUPHAL=ACPIAPIC_MP,%windir%\inf\hal.inf OemSkipEula=Yes

This line is what determines a single core system or a dual core system. Now you need to build the mass storage devices section. This will help make sure that your storage device driver is installed correctly during the mini setup. You need to use the following command;

C:\sysprep.exe -bmsd

After this is done you will need to make sure that your sound card is uninstalled and all of the software for it is uninstalled, and that your IDE controllers are using the Standard PCI controller driver. NOW MAKE SURE YOU IMAGE AT THIS POINT HERE THAT WAY YOU HAVE A WORKING IMAGE TO WORK WITH! Now run sysprep.exe from c:\sysprep and click on the following options and click reseal.

Image this as your dual core image next rename you sysprep.inf to dual-core.inf and rename single-core.inf to sysprep.inf and image this as your single core image. YOUR DONE! 

Appendix

Software ->

1. Nlite – http://nliteos.com/
2. Windows Update Downloader – http://wud.jcarle.com/
3. Driver-pack Base and Driver Packs – http://driverpacks.net/
4. Dial-a-Fix – http://wiki.djlizard.net/Dial-a-fix
5. Newsid – http://www.microsoft.com/technet/sysinternals/Utilities/NewSid.mspx
6. contig – http://www.microsoft.com/technet/sysinternals/FileAndDisk/Contig.mspx
7. streams – http://www.microsoft.com/technet/sysinternals/FileAndDisk/Streams.mspx
8. CCleaner – http://www.ccleaner.com/
9. Windows Installer Cleanup – http://support.microsoft.com/kb/290301
10. Sysprep Driver Scanner – http://www.vernalex.com/tools/spdrvscn/index.shtml
11. Partimage – http://www.partimage.org/Main_Page – This is great software just download the system rescue cd from links on this page. However you can setup a clonezilla server (http://clonezilla.sourceforge.net/) to hold all of your images, this will make single and mass deployment very simple and easy while avoiding the headaches of buying Ghost and/or Acronis.

Sysprep Example File (>)

This is my sample sysprep file. It took some trial and error to get it right.

;SetupMgrTag [Unattended] UpdateInstalledDrivers=yes DriverSigningPolicy=Ignore UpdateUPHAL=ACPIAPIC_MP,%windir%\inf\hal.inf OemSkipEula=Yes InstallFilesPath=C:\ ResetSourcePath=C:\i386 KeepPageFile=0 [GuiUnattended] AdminPassword="lua1905" EncryptedAdminPassword=NO OEMSkipRegional=1 OEMDuplicatorstring="Aug 2007 Image" TimeZone=35 OemSkipWelcome=1 AutoLogon=Yes AutoLogonCount=2 [UserData] FullName="User Name" OrgName="Your Org or Company" ProductKey=KEY-GOES-HERE-SO-USE-YOURS [Identification] JoinWorkgroup=WORKGROUP [Branding] BrandIEUsingUnattended=Yes [Proxy] Proxy_Enable=0 Use_Same_Proxy=0 [Networking] InstallDefaultComponents=Yes [Display] Xresolution=1024 YResolution=768 [TapiLocation] CountryCode=1 Dialing=Tone AreaCode=561 LongDistanceAccess="9" [RegionalSettings] LanguageGroup=1 [SysprepMassStorage]

This work is licensed under a Creative Commons Attribution 3.0 United States License.