Mark Minasi's Windows Networking Tech Page
Issue #65 September 2007

What's Inside

News
- New one-day "Windows Server 2008 Preview: Good News, Bad News" seminar comes to DC NEXT WEEK
- Our two-day seminar Supporting Vista comes to DC NEXT WEEK
Tech Section
- Getting Hotfixes Onto A Windows Image the Easy (and Free) Way
Conferences
Bring a Seminar to Your Site
To Subscribe, Unsubscribe, Read Old Newsletters or Change Your Email Address

News

Hi all —

For some time now, Microsoft has been touting a neat feature of their Ghost-like "WIM" file format: offline hotfix installs. A new hotfix appears, you need to deploy it to your WIMs, but don't want to have to first apply them all to a machine, get the machine started up, apply the hotfix, and then re-image the machines. Instead, in just a few commands, the hotfix is incorporated into the WIM. It all sounded neat... until I tried to make it work. As it turns out, you can indeed install hotfixes to a WIM offline -- it's just that finding those few commands turned out to be a bit difficult. In this newsletter, I'll show you the shortest path to getting your WIMs hot or, at least, hotfixed! But first, a word from our sponsor...

New One-Day Seminar Windows Server 2008 Preview: Good News, Bad News Comes to DC Next Wednesday

Server 2008's not due until February 27, but I just can't wait until February to talk about it, so I'm doing a one-day class about 2008 in the DC area (near Dulles) this 26 September. We've all got to start planning for 2008, so why wade through a mountain of white papers or spend weeks testing when you can get the whole story in just one day, and maybe even get a chuckle or two in the process? You can find out more about it at http://www.minasi.com/2k8prev/2k8prev.htm. This is the only public 2008 session I've currently got scheduled in this country, so come on down!

Our Supporting Vista Seminar Returns to the DC area Next Monday/Tuesday

The two-day Supporting Vista class was very popular in the winter and early spring and many of you have been emailing me asking when we'll do another. I truly appreciate your kind requests for another session and I apologize for only having time to do one, so I'm very happy to announce that I'll be coming to the DC area (near Dulles) on September 24/25 with another session of "Vista Support for Support Professionals." You can read more about it at www.minasi.com/vista/vsupport.htm. I hope to see you there!

Tech Section: Getting Hotfixes Onto A Windows Image the Easy (and Free) Way

In Newsletter #61 (http://www.minasi.com/newsletters/nws0702.htm), I showed you how to use ImageX, Microsoft's Ghost-like tool that lets you take a working computer and reduce it to a "WIM," a Windows Image file, which is something like a Ghost image. In that newsletter, I mentioned in passing that one of the neat things about WIM files was that you can apply hotfixes to a WIM directly. In contrast, image technologies like Ghost require you to apply the image to a physical machine, start the machine up, apply the hotfix to that machine, and then Sysprep the machine and re-image it. Clearly, then, WIM files can save you some serious time on your monthly image maintenance. (Yes, I know, the Altiris technology's catching up on this, but, again, WIMs are free. I like free.) So this month, I'll offer a set of step-by-steps that you can use to put a hotfix onto a WIM without having to first apply it to a machine.

In brief, you need to:

Download each month’s patches
Expand them into their .msu package files, using the Windows expand command
Mount the WIM that needs the hotfix to a folder, using ImageX's /mountrw command
Run the peimg command (which you'll find in the Windows Automated Installation Toolkit) twice on the .msu files
Unmount the image with ImageX /commit /unmount

Getting Started

I'll explain this through a worked-out example. With that in mind, please set up your test system like so:

First, set up a new Vista system without any patches.
Do not install updates on that system.
Use ImageX to image the system to a file called test.wim. Again, refer to Newsletter #61 for exact steps on how to do this.
You will need another system, which I'll call "VM1" which contains the WAIK.
Connect VM1 to the file share, external hard disk or whatever holds the image file. On my system, that turns out to be drive F:, and thus I access test.wim as f:test.wim. Other drive letters will work -- just be sure to substitute whatever drive letter holds your test.wim for f:.

Summarizing, so far we have a system named VM1 upon which the WAIK has been installed, and VM1 is connected to a drive F: that contains an unpatched Vista image called test.wim.

Get the KB 931213 Hotfix

Next, we'll need a hotfix. In my tests, I used a July 2007 patch, the one associated with KB article 931213. Any Vista hotfix should do fine, but if you'd like to match exactly what I'm doing then you can find that July 2007 patch at this page:

http://www.microsoft.com/technet/security/bulletin/ms07-032.mspx

I did my tests on a 32-bit VM1 system, but I can't think of a reason why a 64-bit one would work differently. You'll end up downloading a file named Windows6.0-KB931213-x86.msu. I'll assume that you download this file to a folder called c:\downloads to your VM1 system. Also, please create two new folders on VM1:

c:\unpacked, which will contain the unpacked hotfix files, and
c:\mount, where we'll mount the WIM file.

Additionally, open an elevated Windows PE Tools Command Prompt. (We covered Windows PE and the Windows PE Tools Command Prompt in Newsletter #59.)

Expand the Patch

Expand the patch by typing

expand c:\downloads\*.msu c:\unpacked –f:*

The *.msu means to unpack any and all patches in the folder; “unpacked” just names the folder to put the patches in. There are multiple files packed in the .msu file, and expand.exe needs to know which files to unpack – the “-f:*” option means to unpack all files, and does not refer to a drive "f:."

Now take a look inside c:\unpacked. Every patch comes with some information for WSUS that we don’t need, so delete it:

erase unpacked\wsuss*

Mount the WIM

Next, mount the WIM to the “mount” folder that we created earlier:

imagex /mountrw f:test.wim 1 c:\mount

You should get some text accompanied by the words “Successfully mounted image (RW).”

Import and Install the Package

A look back to Newsletter #59 will remind you of a tool "peimg." We used it to inspect the packages both installed and installable on a Windows PE system, as well as to load new network drivers. We'll see in this example that it also lets us install hotfixes on a WIM.

To do that, we use peimg twice to make the patch useful. The first time, we’re using peimg to analyze the hotfix and import it into the WIM as a new peimg-recognizable package. The second time we’ll use peimg to install the newly-imported package. To import the hotfix and make it a package, type

peimg /import=c:\unpacked\*.cab /image=c:\mount\windows

That just tells peimg to look in the “unpacked” folder for any .cab files and then to import them to the copy of Windows encapsulated in the WIM that is currently mounted at folder “mount.” Double-check that there is now a package corresponding to the hotfix by typing

peimg /list /image=mount\windows

You should see that one of the packages – one that is not installed yet, as evidenced by the dash rather than a plus in front of it – refers to the KB article 931213. Time to install it! From the command prompt, install the patch by typing

peimg /install=*Package* mount\windows

The “*Package* refers to any installable packages whose names actually contain the word “Package.” (Look back at the list of packages to see that this hotfix does indeed include that in its name.) You’ll see a crude text animation as it imports the package and ends with the messages

Installed 1 package(s). PEIMG completed the operation successfully.

Make the Change Permanent

Unmount the WIM like so:

imagex /unmount /commit mount

See the Patch’s Effect

But what really happened? We can see the patch’s effect in two ways:

Build a new catalog in WSIM and examine the “Packages” part of WSIM.
Apply the image to a clean machine and look in Control Panel at the list of installed hotfixes.

As we did in Newsletter #60, fire up Windows' answer file-writing tool, the Windows System Image Manager (WSIM) and use it to open f:\test.wim. It will want to create a new catalog; let it. Then open the Packages icon in the lower left-hand corner. You'll see an object corresponding to that patch. The other way to see that we've got the patch is to apply the newly-updated image to a machine (or, better, a virtual machine), boot up the newly-imaged Vista box, and open Control Panel / Uninstall Programs, and then click “See installed updates.” KB931213 will be there.

Conclusion

When I first read the Microsoft literature saying that hotfixes could be applied to WIMs offline, I thought that was a pretty neat feature... until I tried to use it. A bunch of trial and error went into figuring this out -- I hope it's useful to you!

Conferences

I'm speaking at lots of conferences this fall, in both the US (well, Las Vegas) and Europe. If you can't make to my September seminars, please join me at...

TechTarget Vista Road Shows in Atlanta, Boston, Dallas

TechTarget has been kind enough to ask me back for three more of the one-day Vista road shows that were SRO last spring. This October we're in Waltham, MA (3 October), Atlanta (23 October), and Dallas (25 October). It's free so how can you go wrong (unless you don't sign up before all of the seats are gone)? More info at http://events.techtarget.com/vista/.

TechMentor In Vegas the Week of 15 October

Techmentor returns to the Rio for their Fall show and I'm doing my general session on Server 2008 as well as my Vista Security Crash Course and more. Info at http://events.techtarget.com/vista/. I've not been a big fan of Vegas over the years -- I like my lungs clean and smoke-free -- but they've got a great new no-smoking-in-restaurants law so who knows, Vegas might become a real treat.

Windows Connections in Vegas the Week of 5 November

Once again, Penton -- the folks who put out the magazine that I write for -- has assembled their "mega-show" that co-locates their techie shows on Windows, Exchange, SharePoint, SQL, and all kinds of developer stuff, all in the same week. Like TechMentor, they're returning to their last year's hotel, the Mandalay Bay, and with hope the hotel will have fixed their pool by then. Meanwhile, I'll be keynoting and presenting technical sessions, as will many of my techie buddies. Information at www.winconnections.com.

TechEd Europe and Brazil

If you're going to TechEd Europe in Barcelona this November, please plan to stop by either for my Server 2008 overview talk or my "Server 2008 Name Resolution Changes" talk. More info at... ah, heck, you know where to find Microsoft stuff.<g> Meanwhile, I'll also be in Brazil the first week of December at TechEd Brazil, so if Sao Paulo is nearby, then come on by!

Bring Mark to your site to teach

I'm keeping busy doing Vista seminars and writing, but I've still got time to visit your firm. In just two days, I'll make your current NT techies into 2008, Vista, security, XP, Active Directory or 2003 experts. (And better yet they won't have to sit through any Redmondian propaganda.) To join the large educational, pharmaceutical, agricultural, aerospace, utility, banking, government, telecommunication, law enforcement, publishing, transportation, military and other organizations that I've assisted, either take a peek at the course outlines at www.minasi.com/presentations.htm, mail our assistant Jean Snead at Assistant@Minasi.com, or call her at (757) 426-1431 (only between noon-5 Eastern time, weekdays, please).

Until Next Month...

Have a quiet and safe month.

Please share this newsletter; I hope that it is a useful source of Windows technical information. Please forward it to any associates who might find it helpful, and accept my thanks. We are now at over 45,000 subscribers and I hope to use this to get information to every one of my readers. Many, many thanks to the readers who have mailed me to offer suggestions, errata, and those kind reviews. As always, I'm at http://www.minasi.com/gethelp and please join us at the Forum with technical questions at www.minasi.com/forum. Thanks for letting me visit with you, and take care.

To Subscribe/Unsubscribe, Read Old Newsletters or Change Your Email Address

To subscribe, visit http://www.minasi.com/nwsreg.htm. To change e-mail or other info, link to http://www.minasi.com/edit-newsletter-record.htm. To unsubscribe, link to http://www.minasi.com/unsubs.htm. Visit the Archives at http://www.minasi.com/archive.htm. Please do not reply to this mail; for comments, please link to http://www.minasi.com/gethelp.

Mark Minasi's Windows Networking Tech Page Issue #65 September 2007