Security updates in answer file breaks pass 2 offline servicing

Has anyone noticed that if you put security update packages in the answer file, it breaks during the offline service part of the installation? At least, on a VM it does. The message it gives is "Windows could not apply unattend settings during pass [offlineServicing]."

Has anyone found a workaround for applying security updates automatically as part of an installation? I think it can't be done during OOBE as part of first logon, because some of the updates need a restart.

I'm trying this for Windows 10 IoT Enterprise LTSC.

Thanks in advance.

There are two possible solutions that I can think of:

1) Run a script after setup has completed with SetupComplete.cmd

After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory.

If a SetupComplete.cmd file is found, Windows Setup runs the script. Windows Setup logs the action in the C:\Windows\Panther\UnattendGC\Setupact.log file.

2) Inject the security updates into your Windows image

This is the method that I use. With the release updates on Patch Tuesday, I inject both the security and non-security updates into my Windows image. That way, there is no need to install any updates after unattended setup of Windows.

Let me know if you have any questions.

Integration of monthly updates into the offline image is preferred, especially for secure environments. This avoids the pending reboot for specific updates, like .NET when applied from answer file install passes or SetupComplete.

Beside the monthly CU's, you can integrate the Secure DBX security update for UEFI firmware. Though you should be careful and check if the target HW is cleared, as some systems have experienced issues with it.

Thank you both, hsehestedt and garlin. That actually makes much better sense for my scenario.

- - - Updated - - -

So I mount the install.wim using dism /Mount-Wim and then I can use /Add-Package on the mounted offline image for all the packages I want (I suppose...?)

Do I need to worry about package order or packages that require a restart after installing, or anything like that?

Yes, mount the offline image and DISM /Add-Package (in no particular update order).

Though you might want to wait for the next Patch Tuesday (Feb. 14, 2023) to save yourself the duplication of effort :)

garlin said:

Yes, mount the offline image and DISM /Add-Package (in no particular update order).

Though you might want to wait for the next Patch Tuesday (Feb. 14, 2023) to save yourself the duplication of effort :)

Well, apparently the order does matter, somewhat: SSU file (that's servicing stack?) first, then others that might depend on that being a certain version. And there's the KB5022282 update that won't install at all - just says "Error 13" and "The data is invalid."

(By the way, I'm expanding the msu's and creating a configuration set from the cabs, and then applying the unattend rather than directly adding the packages. It seems to choke on package names being too long otherwise.)

It's frustrating that it's so difficult to find clarity on this stuff...my goal isn't to maintain an image, but to create a documented, consistent process for others at my company to follow when they need to generate fresh OS Images for our various clients. Each one will be unique, to some degree, but it should be easy enough to know how to always get to the latest baseline, and finding + applying needed upgrades to the image from the install media is (I think) the first step of that.

On a side-note, I really appreciate you and the others on this site! I've learned more in a week her than I could ever find just searching online, especially when I often don't even know the questions to ask!

- - - Updated - - -

Follow-up: Success!

I rebooted my dev PC, since some of these seemed to be resource intensive. (I saw complaints in the dism.log file about running out of memory!)

1. Get fresh install.wim

2. Mount

3. Add packages (.msu files - not as unattend) in KB number order. (I don't know how important this was, but I know some packages may depend on others.)

4. Commit and unmount

5. Create installer and install

Et voila! Get-HotFix shows all the packages from step 3.

Thanks for the guidance!

@dpengel3,

I share some of the frustrations that you have. This is a topic I have been deep-diving into for several years now, and it took me a LONG time to figure out all the details.

First, let me show you the order in which updates should be applied, using Microsoft's own documentation:



Notes regarding the above table:

NOTE 1: Microsoft now ships the Latest Cumulative Update (LCU) and Servicing Stack Update (SSU) as a single combined package in the LCU update. The SSU should be extracted from the combined package in order to install it first.

NOTE 2: The above table indicates that the LCU is not applied to the WinRE.win, however, it has been determined from working with a vulnerability addressed by Microsoft in January, 2023 that the LCU SHOULD BE APPLIED to the WinRE.wim. So, the step in the table above that says to see note 2 could be considered to be step 6a (between steps 6 and 7).

NOTE 3: I have written a batch file that automates the installation of all the needed Windows components. I have also written a program that is far more advanced than the batch file. In both cases, I work with all the necessary Windows updates. I don't bother with language and font support. In the above chart, those steps that I have enclosed in parenthesis are steps that my batch file and program do NOT address. Should they be needed, it would be easy to add those steps to the process.

Below is a copy of my batch file. The batch file will take any one edition of Windows from a Windows ISO image and inject all the updates noted in the above chart. In other words, it does the updating in the CORRECT manner by updating the WinRE.wim, the boot.wim, the install.wim, and the media outside of the WIM images. The batch file is heavily commented so that you should be able to follow what is happening rather easily.

Please feel free to use the batch file as is, or to simply dissect it to help you understand the proper sequencing of steps. Note that there are a few hard-learned steps included that I pretty much could not find documented by Microsoft anywhere.

If you want some GREATLY enhanced functionality, including the ability to do almost anything you could imagine with the management and updating of Windows images, please do let me know and I will show you where to get my program.

Finally, my batch file and the program are both based upon notes that I have been putting collecting for the past several years. Those notes cover both Windows unattended installation and management / updating of Windows images. Currently, I'm up to 71 pages of notes, but they serve as a great "how to" on this topic. Once again, if you are really interested in this, do let me know and I will make them available to you. I just didn't want to throw this at you without you expressing interest first, because it might just be overload if you didn't want to take it that far

Here is that batch file. IMPORTANT: Before running the batch file, note that there are prerequisite steps that you need to take and user-defined variables that you need to set. Please read the instructions near the top of the batch file in order to properly make use of it.

Code:

@echo off
cd /d %~dp0
cls


::::::::::::::::::::::::::::::::::::::
:: Windows Image Updater            ::
::                                  ::
:: Version 5.0.2                    ::
::                                  ::
:: Feb 6, 2023 by Hannes Sehestedt  ::
::::::::::::::::::::::::::::::::::::::


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::                                                                                                     ::
:: PURPOSE OF THIS SCRIPT                                                                              ::
::                                                                                                     ::
:: This script will take one Windows edition in a Windows ISO image and inject Windows                 ::
:: updates into it. The updated edition of Windows will be saved to a new file containing              ::
:: just that one edition of Windows. As an example, assume that you have a retail Windows              ::
:: ISO image. This ISO image has multiple editions of Windows such as Win 11 Home, Pro, etc.           ::
:: Each edition of Windows has an index number associated with it.                                     ::
::                                                                                                     ::
:: For example, on the US English consumer edition ISO images from Microsoft, Windows 11 Pro is index  ::
:: number 6. To get a list of Windows editions and the index number associated with each edition, you  ::
:: can run this command:                                                                               ::
::                                                                                                     ::
:: dism /Get-WimInfo /WimFile:C:\Project\ISO_Files\Sources\install.wim                                 ::
::                                                                                                     ::
:: If located elsewhere, substitute the correct location of the install.wim file in the above command. ::
::                                                                                                     ::
:: This utility will perform the updates THE RIGHT WAY by updating all elements of the image           ::
:: including not only the cumulative update, but also the SSU (Servicing Stack Update), Safe           ::
:: OS Dynamic Update, Setup Dynamic Update, other updates such as .NET updates and Microcode           ::
:: updates, and will even allow you to add custom scripts to the Windows PE image. However,            ::
:: if you want to update only one item, such as the cumulative update, you can do that as well.        ::
::                                                                                                     ::
:: IMPORTANT: As noted, this script will only update one edition of Windows from an image. If          ::
:: you want to update multiple editions and combine them all into a single image, please               ::
:: message me as noted above. I can provide to you a tool that will allow you to update many           ::
:: Windows editions and combine them into a single image. That same tool also has many other           ::
:: features such as being able to inject drivers into an image, create bootable media, and many        ::
:: other tasks related to Windows Image Management.                                                    ::
::                                                                                                     ::
:: Please note that it is possible to also add updates such as language packs and other language       ::
:: related components to Windows images. This batch file does not apply those updates, however         ::
:: I can provide information regarding how to update those components if you need to do so.            ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::                                                                                                                 ::
:: SUMMARY OF INSTRUCTIONS                                                                                         ::
::                                                                                                                 ::
::                                                                                                                 ::
:: 1) Read the instructions below to learn how to organize the folders that this project needs.                    ::
::                                                                                                                 ::
:: 2) Review the "User defined variables" section below and modify as needed.                                      ::
::                                                                                                                 ::
:: 3) Make sure that you have the Windows ADK installed. Only the Deployment Tools from the                        ::
::    ADK need to be installed.                                                                                    ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::                                                                                                                 ::
:: DETAILED INSTRUCTIONS                                                                                           ::
::                                                                                                                 ::
:: Create the following folders before you run this batch file.                                                    ::
::                                                                                                                 ::
:: NOTE: The paths below assume the default settings of user defined variables. If you change those variables,     ::
:: Please alter the below paths accordingly.                                                                       ::
::                                                                                                                 ::
:: Do either one of the following:                                                                                 ::
::                                                                                                                 ::
:: 1) Create a folder and copy the contents of your Windows ISO image that you want to update to it.               ::
::                                                                                                                 ::
:: OR                                                                                                              ::
::                                                                                                                 ::
:: 2) Mount the ISO image by double-clicking it.                                                                   ::
::                                                                                                                 ::
:: For whichever of the above options you choose, note the location as the batch file will ask you for that        ::
:: location when you run it.                                                                                       ::
::                                                                                                                 ::
:: Create a folder under which you will place the Windows updates to be installed.                                 ::
::                                                                                                                 ::
:: NOTE: This location can be changed using the user defined variables below. In this example, we assume that      ::
:: location will be "C:\WinUpdates". Beneath that folder, create all of the following folders and place the        ::
:: updates described into that folder. All of these updates can be downloaded from the "Microsoft Update Catalog". ::
::                                                                                                                 ::
:: NOTE: All items are optional. For example, if you do not have a Safe OS Dynamic Update, simply leave that       ::
:: folder empty.                                                                                                   ::
::                                                                                                                 ::
:: The "PE_Files" folder can be used to place files that you want to copy to Windows setup. For example, I have a  ::
:: couple of scripts that I want to be available to Windows setup. Any files that you place here will be available ::
:: on drive X: during windows setup. Note that X: is the RAM Drive that Windows creates during setup. Since this   ::
:: is just about the first thing setup does, these files will be available very early in setup. IT IS EXTREMEMELY  ::
:: UNLIKELY that you will ever put anything in this folder unless you have a very specific reason for doing so. As ::
:: a result, you will typically leave this folder empty.                                                           ::
::                                                                                                                 ::
:: If you wish to DELETE files from Windows PE, for example, scripts that you previously added as described in the ::
:: above paragragh, please search this batch file for the text "delete files from WinPE" and follow the            ::
:: instructions found there. Once again, IT IS EXTREMEMELY UNLIKELY that you will need to do this.                 ::
::                                                                                                                 ::
:: When downloading updates from the Microsoft Update Catalog, please note that the "Safe OS Dynamic Update"       ::
:: will include "Windows Safe OS Dysnamic Update" in the "Products" column. The "Setup Dynamic Update" will        ::
:: simply be called a "Dynamic Update" in this same column.                                                        ::
::                                                                                                                 ::
:: Once again, note that the "C:\WinUpdates" portion of the paths below can be chaned using the user defined       ::
:: variables that are described below.                                                                             ::
::                                                                                                                 ::
:: C:\WinUpdates\LCU       <--- Place Latest Cumulative Update in this folder. DON'T use a DYNAMIC version         ::
:: C:\WinUpdates\Other     <--- Place other updates (for example .NET Updates) in this folder                      ::
:: C:\WinUpdates\SafeOS_DU <--- Place the latest Safe OS Dynamic Update in this folder                             ::
:: C:\WinUpdates\Setup_DU  <--- Place the latest Setup Dynamic Update in this folder                               ::
:: C:\WinUpdates\PE_Files  <--- Place any files such as scripts that you want copied to WinPE here.                ::
::                                                                                                                 ::
:: IMPORTANT: Please be aware that sometimes Microsoft does some odd things that you may need to watch for. As an  ::
:: example, the .NET Framework updates, which you would place in the "Other" folder, are normally cumulative       ::
:: updates. However, in January of 2023, Microsoft also released a non-cumulative out-of-band update for .NET      ::
:: Framework. In this instance, you should place BOTH the cumulative and non-cumulative updates into the "Other"   ::
:: folder.                                                                                                         ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::                                                                                                                     ::
:: USER DEFINED VARIABLES                                                                                              ::
::                                                                                                                     ::
:: Below you will find a description of variables that you can set. You should check each one to make sure that it     ::
:: fits your needs. The actual variables are found below the description section. Please note that spaces in path      ::
:: names or file names are perfectly fine. you should NOT use quotes to enclose file names or paths even if there      ::
:: are spaces in the names.                                                                                            ::
::                                                                                                                     ::
:: IndexNum - Set "IndexNum" to the index number corresponding to the Windows edition you want to update. By default   ::
::    we have this set to "6" which corresponds to Windows 10 or 11 Pro when using the standard retail edition ISO     ::
::    image from Microsoft. To get a list of Windows editions and the index number associated with each edition, you   ::
::    can run this command:                                                                                            ::
::                                                                                                                     ::
::       dism /Get-WimInfo /WimFile:C:\Project\ISO_Files\Sources\install.wim                                           ::
::                                                                                                                     ::
::    If located elsewhere, substitute the correct location of the install.wim file in the above command.              ::
::                                                                                                                     ::
:: ProjectFolder - Set "ProjectFolder" to the location where the project will be created. The batch file will create   ::
::    a number of folders under the project folder. Many of the files here are temporary files. Be aware that there    ::
::    will be a lot files. You can easily need 20GB or more of space in this location.                                 ::
::                                                                                                                     ::
:: WinUpdates - Set "WinUpdates" to the location of the Windows update files. Under this folder, you should create the ::
::    folder structure that is desribed above in the "DETAILED INSTRUCTIONS" section.                                  ::
::                                                                                                                     ::
:: EnableLogs - If you want logging to show what updates actually got installed into your WinRE.WIM, BOOT.WIM, and     ::
::    INSTALL.WIM files, set "EnableLogs" to "1". Otherwise, set it "0". This will cause two text files for each WIM   ::
::    to be created. The first is created after updates are applied, but before the cleanup of the image is performed. ::
::    The second is created after cleanup. As an example, after a combined LCU / SSU package is applied, you may see   ::
::    more than one SSU package in the log prior to the cleanup, however, after the cleanup, the older SSU should have ::
::    been removed. Note that for WinPE four files are created because a pair is created for each of the two indicies  ::
::    that get updated. The files are created in the same folder from which the batch file is run. You can normally    ::
::    leave this set to "0".                                                                                           ::
::                                                                                                                     ::
:: NewImageFileName - Set "NewImageFileName" to the name you want to use for the final ISO image to be created. Make   ::
::    sure to include the .ISO file extension. Spaces in the file name are okay.                                       ::
::                                                                                                                     ::
:: ADK_Location - Set this variable to the location of the "Deployment Tools" folder within the Windows ADK. You       ::
::    should only need to change this if you did not install to the default location.                                  ::
::                                                                                                                     ::
:: SaveWinRE - Set this to "1" if you wish to save a copy of the WinRE.wim file after it is updated. This can be       ::
::    helpful if you need to replace the WinRE.wim file in your Recovery Partition. This file could otherwise be       ::
::    difficult to obtain because it is located within another WIM file (the install.wim) so saving a copy after       ::
::    updating can be helpful. Setting this to "0" (or anything other than "1") will cause a copy of the file to       ::
::    not be saved.                                                                                                    ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


set IndexNum=6
set ProjectFolder=D:\Project
set WinUpdates=Z:\Data\Windows\Windows Updates\Win 11 22H2\Win 11 Jan 10 2023 Updates\x64
set EnableLogs=1
set NewImageFileName=Windows.ISO
set ADK_Location=C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools
set SaveWinRE=1

:::::::::::::::::::::::::::::::::::
:: End of user defined variables ::
:::::::::::::::::::::::::::::::::::


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Check to see if this batch file is being run as Administrator. If it is not, then rerun the batch file ::
:: automatically as admin and terminate the initial instance of the batch file.                           ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


(Fsutil Dirty Query %SystemDrive%>Nul)||(PowerShell start """%~f0""" -verb RunAs & Exit /B) > NUL 2>&1


::::::::::::::::::::::::::::::::::::::::::::::::
:: End Routine to check if being run as Admin ::
::::::::::::::::::::::::::::::::::::::::::::::::


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Change the console mode to 120 columns wide by 25 lines high ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


mode con: cols=120 lines=25


:::::::::::::::::::::::::::::::::::
:: Display introductory comments ::
:::::::::::::::::::::::::::::::::::


echo It is VERY IMPORTANT that prior to running this batch file, you open it in an editor such as notepad and read the
echo following sections: PURPOSE OF THIS SCRIPT, SUMMARY OF INSTRUCTIONS, DETAILED INSTRUCTIONS. Make certain to set the
echo user defined variables as instructed.
echo.
echo If you have not done so, please press CTRL + C to terminate this batch file, and then run it again after you perform
echo the above steps.
echo.
pause


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Save the current location where this batch file is being run, then run the the "DandISetEnv.bat" file  ::
:: which sets environment variables for the ADK. This also changes the current directory, which we do NOT ::
:: want, so we will change it back to the current directory.                                              ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


pushd %~dp0
call "%ADK_Location%\DandISetEnv.bat"
popd


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Ask user for location of mounted ISO image or the directory containing the Windows files ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


:GetSourcePath

cls
echo Enter the path to the SOURCE where your Windows files are located below.
echo.
echo Note that these files can be located in a folder on your HDD, SSD, flash drive, etc. or they can be located on an ISO
echo image that you have mounted.
echo.
echo Tip: The path can end with or without a backslash (\). D:, D:\, D:\ISO_Files, D:\ISO_Files\ are all valid paths.
echo.

:GetSourcePath

set /p SourcePath="Enter source path: "

:: Add a trailing backslash (\) if one does not exist

IF NOT "%SourcePath:~-1%"=="\" (
set SourcePath=%SourcePath%\
)


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Any valid Windows boot media will have a file called "boot\bootfix.bin" on the drive. This is true for both ::
:: single architecture images (x64 or x86) or for images with dual architectures. We will do a simple check to ::
:: see if such a file exists as a basic test for a valid source image location.                                ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


if NOT EXIST "%SourcePath%boot\bootfix.bin" (
cls
echo The location that you specified does not contain a valid Windows image. Please try another location. If you are
echo specifying a location on disk, please be sure to specify the location to the root of the Windows image. If you
echo are using an ISO image, you should double-click the ISO image to mount it and note the drive letter to which it
echo was mounted.
echo.
pause
goto GetSourcePath
)

:: Finally, all preparation is done. We can now begin the update process.

cls
echo ***************************************************************
echo ***************************************************************
echo **                                                           **
echo ** PLEASE BE PATIENT! Applying updates is a lengthy process. **
echo **                                                           **
echo ***************************************************************
echo ***************************************************************
echo.

:: Create the initial directory structure for this project

md "%ProjectFolder%\Mount" > NUL 2>&1
md "%ProjectFolder%\WinRE" > NUL 2>&1
md "%ProjectFolder%\WinRE_Mount" > NUL 2>&1
md "%ProjectFolder%\WinPE" > NUL 2>&1
md "%ProjectFolder%\WinPE_Mount" > NUL 2>&1
md "%ProjectFolder%\Assets" > NUL 2>&1
md "%ProjectFolder%\Temp" > NUL 2>&1
md "%ProjectFolder%\Base" > NUL 2>&1
md "%ProjectFolder%\SSU" > NUL 2>&1

:: Copy the ISO image files to base folder

echo ****************************************
echo * Copy Windows files to working folder *
echo ****************************************
echo.


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Note: Because the source path end with a backslash, and this is seen as an escape    ::
:: when followed by the double quotes, we have to add a space before the double quotes. ::
:: Also, we need to make sure that the files we are working with are accessible, so     ::
:: we are stripping the read-only, hidden, and system attributes from the files.        ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


robocopy "%SourcePath% " "%ProjectFolder%\Base" /mir /a-:HSR > NUL

:: Mount the install.wim file

echo ****************************************
echo * Mounting main OS image (install.wim) *
echo ****************************************
echo.

DISM /mount-image /imagefile:"%ProjectFolder%\Base\sources\install.wim" /index:%IndexNum% /mountdir:"%ProjectFolder%\Mount" > NUL

:: Update Win RE

echo ******************************
echo * Updating WinRE (winre.wim) *
echo ******************************
echo.
echo    ****************
echo    * Applying SSU *
echo    ****************
echo.

copy /B "%ProjectFolder%\Mount\Windows\System32\Recovery\WinRE.wim" "%ProjectFolder%\WinRE" > NUL
DISM /mount-image /imagefile:"%ProjectFolder%\WinRE\WinRE.wim" /index:1 /mountdir:"%ProjectFolder%\WinRE_Mount" > NUL


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: We are now applying the SSU from the combined SSU / LCU package. Note that since the SSU is contained within ::
:: the combined SSU / LCU package, we first need to extract the SSU from that package. Once we have extracted   ::
:: the SSU package, we can use it here and later when we also apply the SSU to WinPE (boot.wim) and the main    ::
:: Windows image (install.wim). We will not need to extract the SSU again since we are already doing so here.   ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


expand "%WinUpdates%\LCU\*.msu" /f:SSU*.cab "%ProjectFolder%\SSU" > NUL
DISM /Add-Package /Image:"%ProjectFolder%\WinRE_Mount" /PackagePath="%ProjectFolder%\SSU" > NUL


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Microsoft documentation indicates that the LCU package does NOT get applied to the WinRE.wim. However,   ::
:: testing related to a Windows vulnerability in Jan of 2023 reveals that it is necessary to apply the LCU. ::
:: As a result, this batch file has been updated as of Jan 2023 to apply the SSU, LCU, and Safe OS Dynamic  ::
:: Updates.                                                                                                 ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


echo    ****************
echo    * Applying LCU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinRE_Mount" /PackagePath="%WinUpdates%\LCU" > NUL

echo    ***********************************
echo    * Applying Safe OS Dynamic Update *
echo    ***********************************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinRE_Mount" /PackagePath="%WinUpdates%\SafeOS_DU" > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinRE_Mount" > WinRE_Before_Cleanup.txt
)

echo    ************************************
echo    * Cleaning up old files from image *
echo    ************************************
echo.

DISM /Cleanup-Image /Image:"%ProjectFolder%\WinRE_Mount" /StartComponentCleanup > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinRE_Mount" > WinRE_After_Cleanup.txt
)

echo    ********************
echo    * Unmounting image *
echo    ********************
echo.

DISM /Unmount-Image /MountDir:"%ProjectFolder%\WinRE_Mount" /Commit > NUL

echo    *************************
echo    * Exporting WinRE image *
echo    *************************
echo.

DISM /Export-Image /SourceImageFile:"%ProjectFolder%\WinRE\WinRE.wim" /SourceIndex:1 /DestinationImageFile:"%ProjectFolder%\Assets\WinRE.wim" > NUL


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: It is possible that the user may wish to save a copy of the WinRE.wim file. As an example, in Jan 2023 a vulnerability required ::
:: that the WinRE on a running system be updated to avoid an exploit that could allow access to a BitLocker encrypted OS volume    ::
:: from the Recovery Environment. Unfortunatley, there may not be enough room on the Recovery volume to update this file in place. ::
:: If the users chooses to save the WinRE.wim, we will save a copy to the same place where the final ISO image is saved.           ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


if %SaveWinRE%==1 (
copy /B /Y "%ProjectFolder%\Assets\WinRE.wim" "%ProjectFolder%" > NUL
)

echo **************************************
echo * Updating WinPE (boot.wim), index 1 *
echo **************************************
echo.

copy /B "%ProjectFolder%\Base\sources\boot.wim" "%ProjectFolder%\WinPE" > NUL
DISM /mount-image /imagefile:"%ProjectFolder%\WinPE\boot.wim" /index:1 /mountdir:"%ProjectFolder%\WinPE_Mount" > NUL

echo    ****************
echo    * Applying SSU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinPE_Mount" /PackagePath="%ProjectFolder%\SSU" > NUL

echo    ****************
echo    * Applying LCU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinPE_Mount" /PackagePath="%WinUpdates%\LCU" > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinPE_Mount" > WinPE_Index1_Before_Cleanup.txt
)

echo    ************************************
echo    * Cleaning up old files from image *
echo    ************************************
echo.

DISM /Cleanup-Image /Image:"%ProjectFolder%\WinPE_Mount" /StartComponentCleanup > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinPE_Mount" > WinPE_Index1_After_Cleanup.txt
)

echo    ********************
echo    * Unmounting image *
echo    ********************
echo.

DISM /Unmount-Image /MountDir:"%ProjectFolder%\WinPE_Mount" /Commit > NUL

echo    **********************************
echo    * Exporting WinPE image, index 1 *
echo    **********************************
echo.

DISM /Export-Image /SourceImageFile:"%ProjectFolder%\WinPE\boot.wim" /SourceIndex:1 /DestinationImageFile:"%ProjectFolder%\Assets\boot.wim" > NUL

echo **************************************
echo * Updating WinPE (boot.wim), index 2 *
echo **************************************
echo.

DISM /mount-image /imagefile:"%ProjectFolder%\WinPE\boot.wim" /index:2 /mountdir:"%ProjectFolder%\WinPE_Mount" > NUL

echo    ****************
echo    * Applying SSU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinPE_Mount" /PackagePath="%ProjectFolder%\SSU" > NUL

echo    ****************
echo    * Applying LCU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\WinPE_Mount" /PackagePath="%WinUpdates%\LCU" > NUL

echo    **************************************
echo    * Copy any user files to WinPE image *
echo    **************************************
echo.

robocopy "%ProjectFolder%\PE_Files" "%ProjectFolder%\WinPE_Mount" *.* /E > NUL

:: If you want to delete files from WinPE, such as scripts you may have added previously, uncommet the
:: line below and change the filename to the name of the file you want to delete. Add additional lines using
:: the same format if needed.

:: del "%ProjectFolder%\WinPE_Mount\MyScript.bat" /Q > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinPE_Mount" > WinPE_Index2_Before_Cleanup.txt
)

echo    ************************************
echo    * Cleaning up old files from image *
echo    ************************************
echo.

DISM /Cleanup-Image /Image:"%ProjectFolder%\WinPE_Mount" /StartComponentCleanup > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\WinPE_Mount" > WinPE_Index2_After_Cleanup.txt
)


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: We are going to delay exporting of the boot.wim index 2 until later so that we can copy files while ::
:: it is still mounted to the main media. We could this right now, but by delaying it until after the  ::
:: Setup Dynamic Update is applied, we can demonstrate that there are files that are out of sync after ::
:: all updates, including the Setup Dynamic Update, have been applied.                                 ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


echo **********************************
echo * Updating main OS (install.wim) *
echo **********************************
echo.

echo    ****************
echo    * Applying SSU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\Mount" /PackagePath="%ProjectFolder%\SSU" > NUL

echo    ****************
echo    * Applying LCU *
echo    ****************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\Mount" /PackagePath="%WinUpdates%\LCU" > NUL

echo    ********************************************************
echo    * Move updated winre.wim back into mounted install.wim *
echo    ********************************************************
echo.

move /Y "%ProjectFolder%\Assets\WinRE.wim" "%ProjectFolder%\Mount\Windows\System32\Recovery" > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\Mount" > MainOS_Before_Cleanup.txt
)

echo    ************************************
echo    * Cleaning up old files from image *
echo    ************************************
echo.

DISM /Cleanup-Image /Image:"%ProjectFolder%\Mount" /StartComponentCleanup /ResetBase /ScratchDir:"%ProjectFolder%\Temp" > NUL

if %EnableLogs%==1 (
DISM /Get-Packages /image:"%ProjectFolder%\Mount" > MainOS_After_Cleanup.txt
)

echo    ****************************************
echo    * Install "Other" updates such as .NET *
echo    * to main OS image (install.wim)       *
echo    ****************************************
echo.

DISM /Add-Package /Image:"%ProjectFolder%\Mount" /PackagePath="%WinUpdates%\Other" > NUL


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: We could copy files from the mounted install.wim now but just as with the boot.wim we will delay doing so ::
:: until after the Setup Dynamic Update has been applied.                                                    ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


echo ******************************
echo * Apply Setup Dynamic Update *
echo ******************************
echo.

Expand "%WinUpdates%\Setup_DU\*" -F:* "%ProjectFolder%\Base\Sources" > NUL

echo **************************************************
echo * Copy mismatched files to appropriate locations *
echo **************************************************
echo.


:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: The 4 robocopy commands below work around a problem with the Windows update process. Files in the boot.wim have exact duplicate ::
:: files in other locations on the media. The problem is that the files in the boot.wim get updated, but the other copy of these   ::
:: files do not. This leads to media which may not function properly and from which it may not be possible to install Windows. The ::
:: robocopy commands below resolve this issue by taking files in the boot.wim that are newer than the duplicates and copying them  ::
:: over the files that were not updated.                                                                                           ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Technical Note: If you would like to log the output of the robocopy commands below, replace the "> NUL" with "> filename" on the ::
:: first line. On the remaining three lines, use ">> filename". Note that "filename" is the name of the file to which the robocopy  ::
:: output will be saved. The ">" indicates that the file should be created, or overwritten if it already exists. The ">>" on the    ::
:: remaining lines appends output to that same file.                                                                                ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


robocopy "%ProjectFolder%\winpe_mount" "%ProjectFolder%\Base" setup.exe /xo /xx /xl /r:0 /w:0 > NUL
robocopy "%ProjectFolder%\winpe_mount\sources" "%ProjectFolder%\Base\sources" setup.exe /xo /xx /xl /r:0 /w:0 > NUL
robocopy "%ProjectFolder%\winpe_mount\windows\system32" "%ProjectFolder%\Base\sources" *.* /e /ndl /xo /xx /xl /np /r:0 /w:0 > NUL
robocopy "%ProjectFolder%\mount\windows\system32" "%ProjectFolder%\Base\sources" *.* /e /ndl /xo /xx /xl /np /r:0 /w:0 > NUL

echo ******************************************
echo * Unmounting index 2 of WinPE (boot.wim) *
echo ******************************************
echo.

DISM /Unmount-Image /MountDir:"%ProjectFolder%\WinPE_Mount" /Commit > NUL

echo    **********************************
echo    * Exporting WinPE Image, Index 2 *
echo    **********************************
echo.

DISM /Export-Image /Bootable /SourceImageFile:"%ProjectFolder%\WinPE\boot.wim" /SourceIndex:2 /DestinationImageFile:"%ProjectFolder%\Assets\boot.wim" > NUL

echo ****************************************
echo * Unmounting the Main OS (install.wim) *
echo ****************************************
echo.

DISM /Unmount-Image /MountDir:"%ProjectFolder%\Mount" /Commit > NUL

echo ***************************************
echo * Exporting the Main OS (install.wim) *
echo ***************************************
echo.

DISM /Export-Image /SourceImageFile:"%ProjectFolder%\Base\sources\install.wim" /SourceIndex:%IndexNum% /DestinationImageFile:"%ProjectFolder%\Assets\install.wim" > NUL

echo ******************************************************
echo * Move updated boot.wim and install.wim image folder *
echo * to replace the original files                      *
echo ******************************************************
echo.

move /Y "%ProjectFolder%\Assets\boot.wim" "%ProjectFolder%\Base\Sources" > NUL
move /Y "%ProjectFolder%\Assets\install.wim" "%ProjectFolder%\Base\Sources" > NUL

echo ******************************
echo * Create the final ISO image *
echo ******************************
echo.

oscdimg.exe -m -o -u2 -udfver102 -bootdata:2#p0,e,b"%ProjectFolder%\Base\boot\etfsboot.com"#pEF,e,b"%ProjectFolder%\Base\efi\microsoft\boot\efisys.bin" "%ProjectFolder%\Base" "%ProjectFolder%\%NewImageFileName%" > NUL 2>&1

:: Cleanup the temporary folders.

rd "%ProjectFolder%\Mount" /s /q > NUL
rd "%ProjectFolder%\winre" /s /q > NUL
rd "%ProjectFolder%\winre_mount" /s /q > NUL
rd "%ProjectFolder%\winpe" /s /q > NUL
rd "%ProjectFolder%\winpe_mount" /s /q > NUL
rd "%ProjectFolder%\assets" /s /q > NUL
rd "%ProjectFolder%\temp" /s /q > NUL
rd "%ProjectFolder%\Base" /s /q > NUL
rd "%ProjectFolder%\SSU" /s /q > NUL

echo Done! The ISO image has been saved as "%ProjectFolder%\%NewImageFileName%.iso"
echo.
pause

If you have any questions at all, please do let me know. I realize that there is a lot to this topic, so even if you have 100 questions, please bring them on!

Interesting, @hsehestedt! Have you thought about writing a book?

I do, indeed, have a few immediate questions, if I could pick your wisdom. Keep in mind my context, here. These OS images will be separately, specially created for clients, and will become part of an embedded software environment where (in expected circumstances), there will typically never be a desktop logon once it leaves the factory.

The end game (for a given client/project) is to have an image that can be installed (either via Clonezilla or dism) on many identical devices, and easily (as hands-free/automated as possible) configured so that the device becomes a kiosk running product-specific application software.

I'm not sure whether this effects answers to any of my questions, but it's good to have context up front.

OK, so here are the questions I have:

1. These devices will NEVER go through a Windows recovery event. If there would ever be a need to do so, the device would be returned to the factory for re-imaging. Given that, is there any reason at all to worry about updating the WinRE image?

2. The installation itself will only ever be performed by me (the developer), and then only by way of getting to a final image that can be sysprep'ed then backed up with Clonezilla or dism /Capture-Ffu. As long as the install.wim is updated, is there any reason at all for the WinPE image (boot.wim) to get updated?

Note: I say "by me." What I mean is by a developer at my company. It could be a different developer for each project. My plan, here, is to have a baseline image with a lot of setup (including Windows updates) complete. The developer just goes through the steps of install, customize, sysprep, and then capture. We'll never send an installation ISO/WinPE-based process to a client's manufacturing team, which is why I'm asking the question above.

3. Does Microsoft create a new KB number for each version of the same kind of update? For example, the SSU/LCU KB number today is 5022282. Will the one coming out on Tuesday be different?

4. Right now, the only way I know, for figuring out which update files I need, is to do the following:

- Install
- Perform updates
- Look at update history, and write down the KB #'s
- Go to the MS update catalog and search those numbers, downloading the appropriately-designated versions of the files

Is there a better way? Something standardized?

5. I notice that some of the KB updates from the catalog are .msu (I know what to do with those) while others are just .exe files. Can the .exe files also be applied with dism /Add-Package? Is there some other way to apply those offline? What about mpam-fe.exe - is there a way to apply that offline while I'm doing the other updates?

Thanks, again, for all of your help and for your willingness to share the benefit of a long process of learning!

(And I apologize if any of these would have been answered by reading your batch file - I skimmed it but did not read it in detail.)

I want to do justice in my answers to you without glossing over the details, but I just don't have the time to give a detailed response right now.

I'll respond either late tonight or first thing in the morning.

I just wanted to send a quick message now so that you don't think that I am ignoring you

Continuing to explore and read, I came across this from Microsoft:

You can obtain Dynamic Update packages from the Microsoft Update Catalog. At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. For example, you could enter 1809 Dynamic Update x64, which would return results like this:

<Image of a table showing search results in the update catalog>

The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in bold the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the Title column of the search results.

Is Microsoft's update management really this jenky? Or is this old info?