10 Tips for a More Successful Windows Image Build & Capture

Posted on August 16, 2014 Updated on April 9, 2015

In a recent build and capture (b&c) task sequence for ConfigMgr 2012 R2 that I was helping a customer with, I decided it was worthwhile to list the top things that can be overlooked.  If these are done prior to beginning the process, then it can help to shorten and troubleshooting time involved.  Also, be sure to see my tips for installing apps during OSD.

1. Create an IP address range for content boundaries.  When doing a b&c, it is a best practice to not join the system to the domain.  So if AD Sites are used for the boundaries, then content cannot be found.  To workaround this, add a IP address range boundary for the subnet of the virtual system.
2. In task sequence step “Setup Windows and Configuration Manager”, include entry “SMSMP=SiteMPServerFQDN”.  Example FQDN: CM1.contoso.com.
3. Include installation of the latest cumulative update that is installed on the primary site.  The easiest trick for ensuring the latest CU is installed during OSD is to do:
   1. Copy the hotfix install package from “C:\Program Files\Microsoft Configuration Manager\hotfix\KBxxxxxx\Client\” into “C:\Program Files\Microsoft Configuration Manager\Client\hotfix\KBxxxxxx\”.
   2. In the task sequence step “Setup Windows and Configuration Manager”, include the line “PATCH=’%_SMSTSMDataPath%\OSD\PkgID\hotfix\KBxxxxxx\x64\patchKBinstallname.msp’.  Note that the path x64/i386 will need to be updated based upon the target OS.
4. ConfigMgr boot media (.iso, USB, etc.) has been configured to allow unknown computers.
5. Use the offline servicing functionality to pre-inject / install any Windows and .NET Framework 3.5.x security updates. Doing this to the original Windows image that was imported into the primary site will reduce the deployment time for the b&c.  Note that if you are deploying Win7 Hotfix Rollup 1 (KB2775511), it can be helpful to add it into the list for Software Updates (see http://blogs.technet.com/b/brandonlinton/archive/2013/03/13/how-to-deploy-phantom-updates-with-system-center-configuration-manager.aspx).
6. Prepare for Software Updates (e.g. MS security updates)
   1. Use multiple Install Software Updates steps.  I like to use one immediately after installing core MS software (newer versions of .NET, MSXML, PowerShell, etc.) and then use two more at the very end of the task sequence.
   2. Optional: Create a script to which associates Microsoft Office with the Windows update agent so that those patches can be installed.
7. Implement fixes and workarounds for installing packages and applications.
   1. KB2716946 fix/workaround to enable the software distribution agent during execution of the task sequence.
   2. KB2522623 fix for Windows 7 to allow applications to be installed
8. Set additional task sequence variables to prevent “Error 80070002”.  This is outlined in a TechNet support tip blog post, but impacts more than just MDT.
   1. SMSTSDownloadRetryCount = 5
   2. SMSTSDownloadRetryDelay = 15
9. Configure the Windows image to be able to “run from the server”.  In this way, the image does not need to download to the disk then finally extract … thereby causing a longer delay and more fragmentation.  To do this:
   1. On the properties of the image, go to the Data Access tab and select the option to “copy the content in this package to a package share on distribution points”.
   2. In the task sequence’s step for Apply Operating System, go to the Options tab and select “Access content directly from the distribution point”.
10. Configure the distribution point to allow anonymous connections.

In general the above items should help you to be more successful when doing an OSD image b&c.  So that it’s not left unsaid, the below items could also prove useful.

• Setup the Network Access Account for the ConfigMgr primary site.  For security, ensure that the account is a low rights domain user with a complex password and not an account with extended access rights to any systems on the network.
• Deploy the task sequence to All Unknown Computers.  In this way an record of the ConfigMgr client will not need to be created first and added into a special collection.