Best practices for creating Windows system images

This topic provides information about KACE-recommended best practices for creating a Windows Golden System Image.

Audit the appliance before beginning

•	Keep 20 percent of available space (or more) on the appliance.

•	Back up and remove un-used images, then copy and remove those images from the restore share directory.

•	Remove test images, or images that have been updated. (Updated or outdated.)

CAUTION: Never run a "Delete Unused System Images Files" or delete an image while capturing an image.

Start fresh

•	Create the golden image in a virtual machine to keep it clean of extra drivers. This also is helpful in updating the image on a regular basis.

•	Do not image or create a golden master image of a machine that comes directly from the manufacturer. Only use volume license media. Avoid using OEM Media. For more information see https://support.quest.com/kb/135252.

•	If applying updates that occurred after capturing the image, only deploy a non-sysprepped image back to original machine.

•	Update images every couple of months and run a cleanup on the images.

Configure the workstation

The following KB articles are recommended best practice methods for creating the base OS installation for System Image capture. If using a Legacy enabled BIOS, use the Single Partition Golden Image KB. If the BIOS is in UEFI mode, use the UEFI KB. Kace highly recommends minimal partitions on your base OS.

•	UEFI vs. Legacy BIOS Imaging: https://support.quest.com/kb/190265

•	Single Partition Golden Image: https://support.quest.com/kb/187971

•	UEFI Imaging: https://support.quest.com/kb/186950

•	Understanding Imaging, KKE Videos: https://support.quest.com/kb/video-articles?k=understanding%20imaging

If not following the above KB articles, use the following guidelines:

•	If working from a machine that was deployed with the appliance (Scripted Install or Image), make sure to delete the KACE directory on the root of the drive and delete %allusersprofile%\quest\kace.

•	If working with a machine that had previously been sysprepped, make sure to delete sysprep_succeeded.tag from windows\system32\sysprep.

•	Install all patches and updates.

•	Create an administrator profile and customize the profile that is to be set up as default.

•	KACE recommends creating a base image, and using post-installation tasks to deploy your software at a later time. This will make your images more flexible when having to deploy to numerous departments, or different types of users.

•	If creating a "full" image, avoid installing software that is updated regularly (flash, reader, and so on), make these into post-install tasks and leverage the KACE Systems Management Appliance for updates.

CAUTION: It is NOT recommended to install applications such as anti-virus, encryption (such as Dell™ Data Protection), security, virtual CD software, any software that emulates hardware, or the KACE Agent in the image. These can often interfere with the image deployment process.

If the image is captured in WIM format, keep at least 60% of the drive space on each partition as free/available.

Sysprep, capture and deployment guidelines

•	Capture the image without sysprepping OR if using a virtual machine (VM): use the snapshot feature to have a copy of the non-sysprepped OS and customizations. If capturing a non-sysprepped image, remember this must be deployed back to the exact same hardware.

NOTE: Creating a golden master on a virtual machine leverages creating snapshots at different stages, such as prior to sysprepping. This allows a restore to a previous snapshot much quicker than re-deploying a system. This also allows for easy testing of deployments to another virtual machine. Testing driver injection would require deployment to specific models.

•	If there is an issue with sysprep, and these happen often, it is best to restore a non-sysprepped image to the original machine, which will also avoid rearm issues. With the VM option, reverting back to a snapshot will allow updates to the system.

•	If capturing the non-sysprepped image to the appliance, be descriptive in your naming of captured images; include whether the machine is sysprepped, and include the version or date of the capture.

•	Descriptive names enable system administrators to choose the correct image to deploy from the drop-down list in KBE.

•	Use the notes field in the appliance Administrator Interface as a change and audit log.

Sysprep

•	Sysprep is a Microsoft tool that they require for capturing an OS image to deploy to a different system. You can either use the Microsoft Sysprep tools and command line or use the KACE Sysprep Creator Wizard if you do not have an unattend.xml file.

•	If you configured a "default" account, ensure to set it to True in the unattend.xml file. The sysprep creator wizard has an option to copy the current profile to the default profile.

•	When running sysprep by command line and not the Sysprep Creator/Executor, use the /generalize, /oobe, /shutdown, and the /unattend switches.

•	Shutdown is preferred so that the PXE boot isn't missed on a reboot. If using the option, sysprep must be run from the customized account.

Capture

•	Verify that enough space is available on the appliance and then capture the sysprepped image.

•	After the capture, reboot the sysprepped machine to verify that mini setup runs correctly.

•	Test to make sure everything in the image works as desired.

•	Capturing an image across the WAN is not recommended. Please limit image capturing to only the local LAN where the appliance is physically located.

Deploy

•	Add Pre/Mid/Post Installation tasks to your image on the appliance.

•	Test your deployment on a different workstation for verification.

•	If deploying an image to a remote location, please consider using a Remote Site Appliance (RSA) for best performance. Deploying an image across the WAN is not recommended.

Post-installation tasks

•	Be consistent with naming tasks. Adding prefixes such as "App-" or "Script-", "OSConfig-" "Mid-" helps to keep tasks organized.

•	Consider the ordering of your post-installation tasks in terms of placing prerequisites before the applications that require them.

•	Use cscript with VB scripts. For example: cscript myscript.vbs

•	When creating a ZIP file for an application task, select the contents to archive so that the file you call is in the root of the ZIP file.

•	For .msi deployments, use the install switch last. For example: msiexec /qn /norestart /i agent.msi

•	Use CLONEPREP=1 on the .msi Agent install if it is not intended to have the Agent to -check in, and create a KUID until the next reboot. For example: msiexec /i agent.msi HOST=blah CLONEPREP=1

•	If using 3.5 SP1 or earlier:

◦	Use the start /wait command when deploying software through appliance post-installation tasks.

◦	Use call when using .bat scripts in application tasks. For example: call myscript.bat