An authentication error has occurred. The function requested is not supported. This could be due to CredSSP encryption oracle remediation. CVE-2018-0886

Problem:

I’ve been working furiously on some Citrix XenApp stuff recently on shiny new Server 2016 boxes.  Yesterday was a productive day and all was well.  With it also being Patch Tuesday and my machines part of the Patient Zero Device Collection targeted for updates I received May’s patches last night/this morning.

Today, when I attempted to RDP into Server 2016 boxes I received the following error:

CredSSPOracle

[Window Title]
Remote Desktop Connection

[Content]
An authentication error has occurred.
The function requested is not supported

Remote computer: <remote computer>
This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660

[OK]

Cause:

This is intentional and I urge you to direct your attention to the URL in the message: https://go.microsoft.com/fwlink/?linkid=866660

Cliff’s Notes version of the cause from the article:

  • The initial March 13, 2018, release updated the CredSSP authentication protocol but did NOT enforce the new version of the CredSSP protocol.
  • The April 17, 2018, Remote Desktop Client (RDP) update in KB 4093120 enhances the error message that is presented when an updated client fails to connect to a server that has not been updated.
  • The May 8, 2018, update makes the new updates CredSSP protocol mandatory.
    This intentional change adjusts the default setting from ‘Vulnerable’ to ‘Mitigated’.

Solution:

In reviewing the interoperability matrix there are only a few blocked scenarios:

  1. Server Patched ‘Force updated clients’ + Clients Unpatched = Blocked
  2. Server Unpatched + Clients Patched ‘Force updated clients’ = Blocked
  3. Server Unpatched + Clients Patched ‘Mitigated’ = Blocked

Well I know my client is patched so that rules out Scenario 1, making it clear our Server 2016 servers are missing KB 4103723.

Solution: Patch your servers!

Fauxlution

This is not a solution.  It’s a fake solution or as I like to call them faux-lutions.

So is there a workaround?  Sure.  So in my particular scenario, I would set the patched client(s) to ‘Vulnerable’  which means that I would then be exposing remote servers to attacks by supporting fallback to insecure versions.

Arguments can be made either way to justify this but I don’t think its wise:

  • It negatively affects our security posture
  • I’m human thus prone to forgetting things and then I’ll never undo it.

I’d rather submit an emergency change request to patch the servers.

In fact, Microsoft’s recommendation is to set AllowEncryptionOracle on clients and server computers as soon as possible to one of the following:

  • Force updated clients = 0
  • Mitigated = 1

But if you want to go down this slippery slope at your own risk, set on your patched client(s), set AllowEncryptionOracle to 2 and you’ll be able to connect to your unpatched server(s):


reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /d 2 /t reg_dword

The documentation states a reboot is required but in testing, a reboot is not required.

References:

  1. CVE-2018-0886 | CredSSP Remote Code Execution Vulnerability
  2. Windows 10 1803 May 8, 2018—KB4103721 (OS Build 17134.48)
  3. Windows 10 1709 May 8, 2018—KB4103727 (OS Build 16299.431)
  4. Windows 10 1703 May 8, 2018—KB4103731 (OS Build 15063.1088)
  5. Windows 10 1607 & Server 2016 May 8, 2018—KB4103723 (OS Build 14393.2248)

 

Whatever route you take, I bid you Good Providence!

Advertisements

Configure Network Settings Error: Enter the DNS server IP address.

Problem:

You’re imaging a machine on a network segment not serviced by a DHCP server.

On the first screen of the Task Sequence Wizard – the one that says ‘Welcome to the Task Sequence Wizard‘ – you click the ‘Configure Network Settings‘ button and enter the ‘Configure Static IP Network Settings‘ screen.

After entering everything in correctly and clicking ‘OK‘, you receive the following error:

EnterTheDNSServerIPAddress

Configure Network Settings Error: Enter the DNS server IP address.

Troubleshooting:

  • The network configuration you entered is correct.
  • You reboot, try again, same error.
  • Maybe you try another machine and it works
  • Maybe you try another machine and it doesn’t work.

Potential Cause 1:

In my limited experience, this seems happens when you’re trying to set IP details on an adapter in a VMware VM that’s not connected.  We saw this on a few VMware VM’s that were recently stood up and had adapters but not connected to any networks.  Oops.

Potential Cause 2:

This is more of a delay/timing issue: While configuring a handful of VMware VM’s, I hit my stride with entering the IP information and found that when I entered the DNS IP address, tabbed down to the domain suffix and pressed [Enter] I’d get this error.  If I tried again another 1-2 seconds after getting the error it would accept.

Because I was running into this so often I spent a little time trying to test this and anecdotally it seems that when you make modifications to the domain suffix field, something happens behind the scenes that causes this delay.  I found that if I excluded the domain suffix field I didn’t have this problem at all.  I also learned that if I entered the domain suffix first then entered the DNS IP address I didn’t have this problem either.

It’s not clear what’s going on but I just need to ‘Trust But Verify’ the VM configuration and slow down when entering the details.  (^_^)

Good Providence to you!

MDT Tutorial Part 11: Troubleshooting Part 7: Non-Fatal OSD Errors & Warnings

Living Table of Contents

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

 

[Some] Non-Fatal OSD Errors & Warnings:

  • No networking adapters found, the network drivers for your device ar enot present

  • An invalid SLShareDynamicLogging value of <path> was specified

  • Unable to Create WebService class

You made a bunch of changes to your lab environment, tested the CS.INI before imaging but after performing a B&C you see these errors/warnings:

Yikes a bunch of errors here!

Yikes a bunch of errors here!

  • No networking adapters found, The network drivers for your device are not present
  • An invalid SLShareDynamicLogging value of \\ITF1MDT01\DeploymentShare$\TSLogs\BnC-22404895 was specified.
  • 2x Unable to create WebService class

To be sure, you delete the logs for that machine, run another B&C and confirm the BDD.log was indeed present and getting populated.  But at the end of the second B&C you received the same error and inspected the BDD.log further:

Troubleshoot-031.PNG

Starting from the top of the log:

  • The”Apply Windows PE” Task Sequence step completed successfully as evidenced by “Event 41001 sent: LTIApply processing completed successfully.”
    .
  • Then the “Add mass storage drivers to sysprep.inf for XP and 2003” Task Sequence step completed successfully as evidenced by “Event 41001 sent: ZTIDrivers processing completed successfully.”
    • Furthermore, the process is able to reach and write to \\ITF1MDT01\DeploymentShare$\TSLogs\BnC-22404895 so we know it was good at this point.
      This is important!
      .
  • After that the “Execute Sysprep” Task Sequence step completed successfully as evidenced by “Event 41001 sent: LTISysprep processing completed successfully.”
    • And that process was also able to reach and write to \\ITF1MDT01\DeploymentShare$\TSLogs\BnC-22404895.
      This is also important!
      .
  • Then we get to the “Apply Windows PE (BCD)” Task Sequence Step and almost as soon as it starts we see our errors:
    • No networking adapters found, The network drivers for your device are not present
    • An invalid SLShareDynamicLogging value of \\ITF1MDT01\DeploymentShare$\TSLogs\BnC-22404895 was specified.

From here you hypothesize that it’s the sysprep process that is creating this problem.
And like a wise man frequently tells me: We gotta peel this onion!

  • Found the error text in ZTIUtility.vbs: “An invalid SLShareDynamicLogging value”
  • Just above the error code it, two functions are called:
    • ValidateConnection
    • VerifyPathExists
      .
  • ValidateConnection
    • Is what drops the “Validating connection to” text in the log
    • Calls the ValidateNetworkConnectivity function which
      • Executes the query ​select * from win32_NetworkAdapter where Installed = true and adaptertypeid = 0" and evaluates the count of the results
      • If the result count is 0, the function exits after dropping “No networking adapters found, The network drivers for your device are not present” text in the log.
        .
  • VerifyPathExists checks the path of SLShareDynamicLogging, creating the directory if missing.  We know the directory exists because the files are where we expect them to be.
    .
  • Finally, the line that generates the “An invalid SLShareDynamicLogging” log entry is part of an if block, and is generated if the directory doesn’t exist.

With a better understanding of the process, we may have a good idea as to what might be happening:

  1. everything’s fine up until sysprep
  2. sysprep might be removing the NIC drivers and thus the adapter doesn’t work
  3. when the ‘Apply Windows PE (BCD)’ Task Sequence step (LTIApply.wsf) is executed immediately after sysprep, it fails to connect to the share because of Step 2 above
  4. once in WinPE the NIC is once again fully functional so everything works as expected

But what about the two Unable to create WebService class warning?  Thinking back to the recent changes you made, one of them was enabling Monitoring.   A little sleuthing might take you to a post by Michael Niehaus on Troubleshooting MDT 2012 Monitoring via a TechNet response by Johan Arwidmark.

After going through the guide, it still doesn’t work so you disable Monitoring, reimage, and the error goes away.  You re-enable Monitoring, image again, get the same result.

The good news is you’ve confirmed Monitoring is “to blame” for those errors.

A closer inspection of the BDD.log shows it’s part of the same LTIApply step it and that’s when it clicks: If there’s no network connectivity, there’s no way for the WebService to succeed.

At the very least, this is a plausible cause.

So for these errors and warnings, it probably “is what it is” and likely not that big of a deal in the grand scheme of things.

FWIW: I can reproduce this behavior with MDT8443 & ADK 1703 on Gen 2 and Gen 1 VM’s using both the Network Adapter and Legacy Network Adapter.  : (

Is it Possible to Fix All of These Errors?

Probably – in fact I’m fairly certain I have an older lab environment where I do not have this problem.  But there’s also something to be said about the return on investment and the law of diminishing returns.

If I can consistently reproduce something, and it really does create problems, I personally believe there’s value in looking into further.  It may be a typo or faux pas on my part or perhaps a valid ‘bug’ for a certain scenarios.

If it’s a one-off, something I see one in 30, it may not be worth investing a significant amount of time & effort for so little reward.

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

MDT Tutorial Part 11: Troubleshooting Part 6: Unable to mount the WIM, so the update process cannot continue

Living Table of Contents

 

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

Unable to mount the WIM, so the update process cannot continue

When updating your deployment share it fails almost immediately with error Unable to mount the WIM, so the update process cannot continue.

This slideshow requires JavaScript.

Error Text:


=== Making sure the deployment share has the latest x86 tools ===

=== Processing LiteTouchPE (x86) boot image ===

Building requested boot image profile.
Determining if any changes have been made in the boot image configuration.
No existing boot image profile found for platform x86 so a new image will be created.
Calculating hashes for requested content.
Changes have been made, boot image will be updated.
Windows PE WIM C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\en-us\winpe.wim will be used.
Unable to mount the WIM, so the update process cannot continue.

=== Completed processing platform x86 ===

=== Making sure the deployment share has the latest x64 tools ===

=== Processing LiteTouchPE (x64) boot image ===

Building requested boot image profile.
Determining if any changes have been made in the boot image configuration.
No existing boot image profile found for platform x64 so a new image will be created.
Calculating hashes for requested content.
Changes have been made, boot image will be updated.
Windows PE WIM C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us\winpe.wim will be used.
Unable to mount the WIM, so the update process cannot continue.

=== Completed processing platform x64 ===

=== Processing complete ===

You might try a variety of things like:

  • Use DISM to get-wiminfo to confirm the WIMs are OK
  • Bounce the MDT machine
  • Perform a repair installation of the ADK
  • Use DISM to mount the WIM manually and you get an error 577

We talked about this in Part 2 : Did you remember to patch the ADK?  🙂

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

Deployment Error Invalid DeploymentType value "" specified.  The deployment will not proceed.

MDT Tutorial Part 11: Troubleshooting Part 5: Invalid DeploymentType value “” specified. The deployment will not proceed.

Living Table of Contents

 

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

Invalid DeploymentType value “” specified. The deployment will not proceed.

You enabled the Windows Updates steps in the Build & Capture Task Sequence so you can have a fully patched Windows 10 v1511 WIM.

Troubleshoot-014.PNG

And you also updated your CustomSettings.ini so that your Build & Capture VM would set all the properties/variables but not start immediately.


[Settings]
Priority=MACAddress,GetAbbrModel,Build,Default
Properties=OfficeCode,AbbrModel

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN MACADDRESS SECTION
; This is my Windows 10 v1511 build & capture VM
[00:15:5D:13:79:01]
SkipTaskSequence=NO
TaskSequenceID=BC151164ENT
SkipComputerName=NO
OSDComputerName=BnC-#UCase(Right(Replace(Replace("0000000%SERIALNUMBER%"," ","",1,-1,1),"-","",1,-1,1),8))#
SkipDomainMembership=NO
JoinWorkgroup=BnC-WrkGrp
SkipUserData=NO
SkipComputerBackup=NO
ComputerBackupLocation=NETWORK
BackupDir=Captures\%OSDComputerName%
BackupFile=%OSDComputerName%_%TaskSequenceID%_#year(date) & "-" & month(date) & "-" & day(date) & "_" & Hour(Now()) & Minute(Now())#.wim
SkipProductKey=NO
SkipLocaleSelection=NO
SkipTimeZone=NO
SkipAdminPassword=NO
SkipCapture=NO
DoCapture=YES
SkipBitLocker=NO
SkipSummary=NO

; END MACADDRESS SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN GETABBRMODEL SECTION
; Lets get the abbreviated model
[GetAbbrModel]
UserExit=jgp_GetAbbrModel.vbs
AbbrModel=#GetAbbrModel#
; END GETABBRMODEL SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN BUILD SECTION
; Set things here for use below
[Build]
OSDComputerName=%OfficeCode%-%AbbrModel%-#UCase(Right(Replace(Replace("0000000%SERIALNUMBER%"," ","",1,-1,1),"-","",1,-1,1),8))#
; END GETABBRMODEL SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN DEFAULT SECTION
[Default]
OSInstall=Y
; Skip Screen: Task Sequence
SkipTaskSequence=NO
; Skip Screen: Computer Details
SkipComputerName=NO
; Skip Screen: Computer Details
SkipDomainMembership=NO
; Skip Screen: Move Data and Settings & User Data (Restore)
SkipUserData=NO
; Skip Screen: Computer Backup
SkipComputerBackup=NO
; Skip Screen: Product Key
SkipProductKey=NO
; Skip Screen: Locale & Time
SkipLocaleSelection=NO
KeyboardLocale=en-US
UserLocale=en-US
UILanguage=en-US
; Skip Screen: Locale & Time
SkipTimeZone=NO
; https://msdn.microsoft.com/en-us/library/ms912391(v=winembedded.11).aspx
TimeZoneName=Eastern Standard Time
; Skip Screen: Administrator Password
SkipAdminPassword=NO
; Skip Screen: Capture Image
SkipCapture=NO
; Skip Screen: BitLocker
SkipBitLocker=NO
; Skip Screen: Ready to begin
SkipSummary=NO
; Skip Screen: R
SkipFinalSummary=NO
SLShare=%DeployRoot%\TSLogs
SLShareDynamicLogging=%DeployRoot%\TSLogs\%OSDComputerName%
EventService=http://ITF1MDT01:9800
; END DEFAULTSECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Having learned your lesson from last time, you test the updated CustomSettings.ini & spent a few minutes verifying the output in the console.  Feeling confident, you boot into WinPE and when the Wizard I displays, verify all the defaults are set correctly.

This slideshow requires JavaScript.

You click begin and almost immediately the process halts with an obscure error:

Deployment Error Invalid DeploymentType value

Deployment Error Invalid DeploymentType value “” specified.  The deployment will not proceed.

You’d be forgiven for thinking you’ve made a mistake and I’d be willing to bet you’d figure this out but that road wouldn’t be fun.

Fortunately Michael Niehaus himself confirmed this is a bug (SRC1, SRC2) and there are two options to fixing/working around the bug:

  1. Easiest: Update your CS.INI with SkipProductKey=YES.
  2. Hardest (and arguably unsupported?):
    1. Open DeployWiz_ProductKeyVista.vbs in the Scripts directory
    2. Find: ​if oProperties("DeploymentType") = "UPGRADE" then
    3. Replace: If Property("DeploymentType") = "UPGRADE" then
    4. Save the file and try again
Note: There appears to be a plausible explanation of what’s happening here if you’re interested.

Since you rarely need to prompt for a Product Key – especially considering you can stick it in the unattend.xml or you go down the easy path and now the image kicks off.

Troubleshoot-028.PNG

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

MDT Tutorial Part 11: Troubleshooting Part 4: Task Sequence Variable is Being Overwritten

Living Table of Contents

 

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

Task Sequence Variable is Being Overwritten – The Case of the Incorrectly Named Log Folder

After [finally] fixing your computer naming issue, you decide to take a look at the live BDD.log just to keep an eye on things.  You hop into the TSLogs directory & find 2 directories that have the same time stamp:

Troubleshoot-008

According to your CS.INI the “real” log directory should be named after the machine so how did that other one get created?  You open the BDD.log in BLD-HPV-22404895 and it’s practically empty, but you do see that the property is being set to the other directory.

Troubleshoot-009.PNG

There are some clues in the BDD that lead you to above that point to a smoking gun.

You open the BDD.log in the other directory & scroll to the top & see a familiar set of lines: The same ones you see when testing the CustomSettings.ini manually:

Troubleshoot-011

While the machine is imaging you press F8 to launch a console, fire up CMTrace, open the smsts.log (in %temp%\smstslog), scroll to the top & search downwards for ‘dyn’:

Troubleshoot-012.PNG

Ok, you’re piecing it together:

  1. Initially it’s good, points to the proper location
  2. Then at some point it changes
  3. In the first, short, BDD.log you see ‘Task Sequence’ mentioned
  4. In the second, long, BDD.log you see lines that look like it’s processing the CustomSettings.ini, something that also happens during the Task Sequence,
  5. The smsts.log shows a step that sets a variable
  6. SLShareDynamicLogging isn’t a property (or variable) that is ‘last write wins’, so it can’t be a case of a rogue CustomSettings.ini

So maybe it’s the Task Sequence?

Troubleshoot-013

Bingo was his name.

 

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

Troubleshooting the Lenovo ThinInstaller Installation

During OSD, install the Lenovo ThinInstaller, and have been doing this for quite some time.  Whenever a new build is released, we duplicate the source files and swapping out the older installer for the new.  This process worked well for several versions:

  • v1.2.0014
  • v1.2.0015
  • v1.2.0017
  • v1.2.0018

In early 2017 we updated our Lenovo ThinInstaller to v1.2.0020 and noticed that the ThinInstaller installation executable would run seemingly forever, but during OSD and in real Windows when installing manually.  We reverted back to 1.2.0018 until we could do more testing to narrow the scope of the problem.  Shortly afterwards, 1.2.0022 was released so we tried again thinking maybe it was a build-specific bug, but it too failed.

We spent a decent amount of time trying to hunt this down and confirmed it wasn’t:

  • unique to the Task Sequence
  • a model specific issue
  • an upgrade scenario (e.g.: only 1.2.0014 to 1.2.0022)
  • software that was already installed and causing a conflict
  • security software on the machine.

Again, we could reproduce at will by removing the new installer and restoring the old.

A while later we learned that Lenovo had made some changes to the ThinInstaller package, and you can read about that here:
https://thinkdeploy.blogspot.com/2017/03/changes-required-to-use-thin-installer.html

To ensure the highest rate of installation success, we took the shotgun approach:


# Unregister the DLL if it's found - update the path accordingly
if(Test-Path -Path "$envProgramFilesX86\ThinInstaller\Lenovo.PnPSignedDriverEx.dll" -PathType Leaf)
    {
        If(Test-Path -Path "$env:windir\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" -PathType Leaf)
            {
                Start-Process -FilePath "$env:windir\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" -ArgumentList "/u `"$envProgramFilesX86\ThinInstaller\Lenovo.PnPSignedDriverEx.dll`"" -PassThru -Wait
            }
        elseif(Test-Path -Path "$env:windir\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe" -PathType Leaf)
            {
                Start-Process -FilePath "$env:windir\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe" -ArgumentList "/u `"$envProgramFilesX86\ThinInstaller\Lenovo.PnPSignedDriverEx.dll`"" -PassThru -Wait
            }
    }

# Remove the existing 'installation'
Rename-Item -Path "${env:ProgramFiles(x86)}\ThinInstaller" -NewName "ThinInstaller_$(Get-Date -Format 'yyyy-MM-dd_hhmmss')"; Start-Sleep -Seconds 3

# Perform the 'install'
Start-Process -FilePath 'thin_installer_VERSION.exe' -ArgumentList "/SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG=Path\To\Install.log" -Wait

# Drop in the ThinInstaller.exe.configuration
Copy-Item -Path $(Join-Path $PSScriptRoot 'ThinInstaller.exe.configuration') -Destination "${env:ProgramFiles(x86)}\ThinInstaller\ThinInstaller.exe.configuration" -Force&lt;span 				data-mce-type="bookmark" 				id="mce_SELREST_start" 				data-mce-style="overflow:hidden;line-height:0" 				style="overflow:hidden;line-height:0" 			&gt;&amp;#65279;&lt;/span&gt;

 

Some time around ThinInstaller v1.2.0029, the Lenovo.PnPSignedDriverEx.dll as well as the .cmd files used to register/unregister said DLL, quietly disappeared suggesting they either found a better way to do what they were doing or baked that process into their installer or … ?  That said, the above code is probably no longer needed.  However, since ThinInstaller is an application that’s generally available to all Lenovo machines in Software Center, we left the code in there on the off chance someone upgrades or uninstalls/reinstalls ThinInstaller on a machine with an older build.

If you find the ThinInstaller is hanging during upgrade scenarios, try the above to see if that helps.

If you find the ThinInstaller is hanging during a fresh installation, try generating a log and review the log file to see where it’s getting hung up then troubleshoot from there.

Good Providence To You!

Title: Windows Setup Body: Windows could not parse or process unattend answer file [C:windowsPantherunattend.xml] for pass [specialize]. The answer file is invalid.

MDT Tutorial Part 11: Troubleshooting Part 3: Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize].  The answer file is invalid.

Living Table of Contents

 

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize].  The answer file is invalid.

Your last victory is short lived as the same error message appears and this time unattend.xml looks fine:

Troubleshoot-010.PNG

Stumped, you might search for ‘Microsoft-Windows-Shell-Setup’ which might lead you here:
https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup

As you review each section carefully the issue becomes clear: The computer name is more than 15 characters.

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

Title: Windows Setup Body: Windows could not parse or process unattend answer file [C:windowsPantherunattend.xml] for pass [specialize]. The answer file is invalid.

MDT Tutorial Part 11: Troubleshooting Part 2: Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize].  The answer file is invalid.

Living Table of Contents

 

What These Guides Are:
A guide to help give you some insight into the troubleshooting process in general.

What These Guides Are Not:
A guide to fix all issues you’re going to encounter.

We’re going to role-play a bunch of scenarios and try to work through them.  Remember in math where you had to show your work?  Well, what follows is like that which is why this post is [more than] a [little] lengthy.

Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize].  The answer file is invalid.

You boot your special VM, click the ‘Run the Deployment Wizard to install a new Operating System‘ button and it immediately starts.  Excellent!  It applies the OS, reboots and you’re faced with this error:

Title: Windows Setup Body: Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize].  The answer file is invalid.

Windows could not parse or process unattend answer file [C:\windows\Panther\unattend.xml] for pass [specialize]. The answer file is invalid.

Well this is strange, because you didn’t touch the unattend.xml so what gives?
Fortunately, this dialog provides some meaningful insight:

    • The unattend file is C:\Windows\Panther\unattend.xml
    • The specific area is the specialize pass

Press SHIFT+F10 here to open a command prompt and then open C:\Windows\Panther\unattend.xml with notepad

Troubleshoot-005

You search for ‘specialize’ and after taking a very close look see that your computer name is incorrect.  It should be some two or three character prefix not %OfficeCode%.

Troubleshoot-006

Since that is set via the CS.INI, you run the CustomSettings.ini test again and now you see what was missed before:

Troubleshoot-007.PNG

You review the CS.INI and find your problems

  1. You didn’t define the OfficeCode property: Wasn’t added to the Properties line
  2. You didn’t set a value for OfficeCode.

With that fixed, you run the test again, the variable is populated and as you reimage the machine, you see it is named correctly in the logs.

Copypasta Closing

Hopefully these examples will help give you an idea of the overall troubleshooting process.  Most of the time the problems you’ll encounter will be caused by a typso, order of operations or a ‘known issue’ that requires a specific process to be followed.

As you make changes to your environment, here’s what I recommend:

  • Be diligent about keeping a change log so you can easily backtrack
  • Backup your CS.INI or Bootstrap.ini before you make any changes
  • Backup your ts.xml or unattend.xml (in DeploymentShare\Control\TaskSequenceID) before you make any changes
  • Introduce small changes at time with set checkpoints in between and set milestones markers where you backup core files (e.g cs.ini bootstrap.ini ts.xml unattend.xml etc) to help minimize frustration troubleshooting.

And if when you do run into some turbulence, upload relevant logs (at least smsts.log but be prepared to submit others depending on the issue) to a file sharing service like OneDrive, post on TechNet then give a shout to your resources on Twitter.

Good Providence to you!

MDT Tutorial Part 10: CustomSettings.ini Validation Testing & Troubleshooting Part 1

Living Table of Contents

 

Today’s Agenda: Troubleshooting

  • CustomSettings.ini Validation Testing
  • Troubleshooting OSD Issues

Recommended Reading

CustomSettings.ini Validation Testing

If you haven’t already done so, go ahead and make some useful edits to your CustomSettings.ini.  Since my aim is to have a dedicated ‘build’ machine that boots and automatically images the proper Task Sequence, this is what my CS.INI looks like now:


[Settings]
Priority=MACAddress,GetAbbrModel,Build,Default
Properties=AbbrModel

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN MACADDRESS SECTION
; This is my Windows 10 v1511 build VM
[00:15:5D:13:79:01]
SkipTaskSequence=YES
TaskSequenceID=B151164ENT
SkipComputerName=YES
SkipDomainMembership=YES
JoinWorkgroup=BLD-WrkGrp
SkipUserData=YES
SkipComputerBackup=YES
SkipProductKey=YES
SkipLocaleSelection=YES
SkipTimeZone=YES
SkipAdminPassword=YES
SkipCapture=YES
SkipBitLocker=YES
SkipSummary=YES
; END MACADDRESS SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN GETABBRMODEL SECTION
; Lets get the abbreviated model
[GetAbbrModel]
UserExit=jgp_GetAbbrModel.vbs
AbbrModel=#GetAbbrModel#
; END GETABBRMODEL SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN BUILD SECTION
; Set things here for use below
[Build]
OSDComputerName=%OfficeCode%-%AbbrModel%-#UCase(Right(Replace(Replace("0000000%SERIALNUMBER%"," ","",1,-1,1),"-","",1,-1,1),8))#
; END GETABBRMODEL SECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
; BEGIN DEFAULT SECTION
[Default]
OSInstall=Y
SkipTaskSequence=NO
SkipComputerName=NO
SkipDomainMembership=NO
SkipUserData=NO
SkipComputerBackup=NO
SkipProductKey=NO
SkipLocaleSelection=NO
SkipTimeZone=NO
SkipAdminPassword=NO
SkipCapture=NO
SkipBitLocker=NO
KeyboardLocale=en-US
UserLocale=en-US
UILanguage=en-US
; https://msdn.microsoft.com/en-us/library/ms912391(v=winembedded.11).aspx
TimeZoneName=Eastern Standard Time
SLShare=%DeployRoot%\TSLogs
SLShareDynamicLogging=%DeployRoot%\TSLogs\%OSDComputerName%
; END DEFAULTSECTION
;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Following the methods outlined in the recommended reading section, set up an area for testing your CustomSettings.ini.  When I execute my test, it runs, I see a bunch of data:

There are no obvious errors, I see see some custom properties and various built-in properties getting set so it looks good.  Time to execute for real!

Troubleshooting – Part 1

Troubleshooting MDT (and SCCM) is something of an art and this is not a once-size-fits-all silver bullet post.

I ran across this post SCCM 2012 – How to catch errors in Task Sequence around the same time I started using MDT and found it greatly helped me to hone in on OSD issues.  Because it has worked well for me, I’m recommending it – and others like it – to you.

Task Sequence Setup

Take a look at the links at the top to see how others are setting up their Task Sequences and adjust to suit your needs but here’s a basic example:

Troubleshoot-041.PNG

Right now when your Task Sequence fails you see this dialog:

Troubleshoot-042.PNG

This dialog is incredibly helpful without making any adjustments and you should ge able to get an idea as to what went wrong without having to go super deep into the logs.  But once you get into a production scenario, you’ll likely suppress this dialog and I find that having the Try/Catch steps in the Task Sequence makes it easier from a log reviewing perspective, especially after the Task Sequence gets busy.

Crack open the smsts.log and immediately you see red:

Troubleshoot-043.PNG

With the Try/Catch model you can easily hone in on the offending step:

  1. Scroll to the bottom of the log
  2. Search for key text in the log
    • Option 1: Search for: Try) ignored
    • Option 2: Search for: Catch) has been

Either one will get you just a few short lines away from the failure, so scroll up a bit and it should become apparent.

Troubleshoot-044.PNG

  • The blue line above is the ‘Catch) has been‘ match.
  • The first red line above that is the ‘Try) ignored‘ line
  • Just above that we see the second red line which is the actual failure:
    Failed to run the action: This will break it.
  • Above that are the details for that specific step.

This is obviously a very simple example, but the process is the same for all errors:

  • Review the smsts.log
  • Find the actual error
  • Evaluate if it’s a problem specific to that step OR if it was caused by an environmental issue such as dependencies.
  • Review other logs as necessary based on what you’re seeing in the smsts (e.g.: domain join failure)

In Closing

I don’t expect you to be an expert at this point, but I hope it and the links in the recommended reading section have helped to get you a little more comfortable with searching the smsts.log for errors.

When doing BnC’s I like to keep my changes small and modular:

  • Test that the basic BnC works fine: OS is installed, sysprep & capture is succesful
  • Add Windows Updates into the mix & repeat the test
  • Prepare your application payload:
    • for some complex applications you’ll rely on scripts so test them outside of the Task Sequence to confirm they are syntactically correct
    • for simple installations make sure you have the correct command line arguments
    • once installed validate the installation & configuration
  • Introduce applications a few at a time doing BnC’s to ensure nothing is broken.
  • Set milestones for yourself so you don’t have to go back to square one
  • Backup files (ts.xml, unattend.xml, scripts etc) before you make any changes.

Good Providence to you!

MDT Tutorial Part 9: Logging

Living Table of Contents

 

Today’s Agenda:

  • Centralized Logging
  • Enable Logging
  • Log Locations

At some point you’re going to run into a problem with your imaging process and knowing where to look to get some answers is going to be paramount.

Recommended Reading:

Centralized Logging

I prefer to keep logs in a central location so they’re easy to find when needed, and for that, we’ll create a new share on our MDT server.  Run the below from the MDT server.


New-Item -Path "C:\DeploymentShare\TSLogs" -ItemType directory

New-SmbShare -Name "TSLogs$" -Path "C:\DeploymentShare\TSLogs" -FullAccess Administrators

Enable Logging

Open your CustomSettings.ini and find a suitable place to add the entries for SLShare and SLShareDynamicLogging depending on your preferred scenario.  Either is fine, just depends on your preference and environment.

Hard Coded Path


SLShare=\\MDTServer\TSLogs$

SLShareDynamicLogging=\\MDTServer\TSLogs$

Relative Path


SLShare=%DeployRoot%\TSLogs

SLShareDynamicLogging=%DeployRoot%\TSLogs

Set Logging via Task Sequence

Alternatively you could add steps to the Task Sequence itself to set those variables to their appropriate values, be it hard coded or relative.

Logging-001

Get Creative!

You can get pretty creative, and for automated deployments, I usually default to something like this:


SLShare=%DeployRoot%\TSLogs\%TaskSequenceID%

SLShareDynamicLogging=%DeployRoot%\TSLogs\%TaskSequenceID%\%OSDComputerName%

This way I can see what Task Sequence a particular machine ran.
But, to each their own.

SLShare vs SLShareDynamicLogging

Both values do different things:

  • When the SLShare property is set, MDT will copy the deployment logs to that location in a directory named after the computer, pulled from the %OSDComputerName% Task Sequence property (aka variable).  So if you named your machine PC-1511amd64 the full path to find the logs will be \\MDTServer\TSLogs$\PC-1511amd64.
    .
  • The SLShareDynamicLogging property is used for real-time debugging as ALL MDT logs will be written to that file during the Task Sequence.  It will create a file named BDD.log in the specified directory which means if you set SLShareDynamicLogging it to \\MDTServer\Logs you’ll find a file named BDD.log in that directory.  This obviously presents a problem if multiple machines are being imaged at the same time: they’d all be logged in the same file which might make it challenging to follow along.  This is why I recommend appending \%OSDComputerName% to the path so that the BDD.log is in the ‘correct’ directory.
    For our purposes, you can leave this property enabled, but please note this enabling SLShareDynamicLogging does add a bit of overhead, so in a production environment:

    • Only enable it when actually actively troubleshooting an issue and
    • Ideally have it log to a location close to the machine being imaged versus a remote server to avoid traversing the WAN

Putting It All Together

With the CustomSettings.ini updated, image a machine and check your log directory for a folder structure:

Logging002

  • The %OSDComputerName% directory is an artifact caused by the fact that the property (or variable) OSDComputerName wasn’t set at the time the SLShareDynamicLogging property was processed in the CustomSettings.ini.  In my production environment, I have logic in the CustomSettings.ini to properly name the machine based on specific criteria so that by the time we get to the area where SLShareDynamicLogging is assigned, the OSDComputerName property (aka variable) is set resulting in properly named directories.  However in our lab, this logic doesn’t exist (yet), hence why that directory exists.  To fix this, just add something like OSDComputerName=LAB-%SerialNumber% to your CustomSettings.ini and please note that the OSDComputerName property (variable) does not need to be declared.
    .
  • The other directory is the correct directory and it contains the BDD.log that’s actively being updated.

While a machine is imaging, open the BDD.log (in the latter directory mentioned above) with CMTrace from your MDTServer (or whatever machine you’re working on) and you will see live updates:

Logging-003

When the Task Sequence is finished go back into the log directory for that machine and you will to find the logs that were copied up by MDT:

Logging-004

Log Locations

MDT Logs can be a little challenging to locate initially so I recommend you study up those links mentioned in the recommended reading section above.

  • In WinPE & the disk is NOT partitioned:
    • X:\MININT\SMSOSD\OSDLOGS
      .
  • In WinPE & the disk IS partitioned:
    • C:\MININT\SMSOSD\OSDLOGS
    • X:\MININT\SMSOSD\OSDLOGS (very small amount)
      .
  • In WinPE & Task Sequence is running
    • smsts.log will be in X:\Windows\Temp\SMSTSLog
    • All other logs will be in their respective directories mentioned above
      .
  • In Windows & Task Sequence is running
    • smsts.log will be in C:\Users\Administrator\AppData\Local\Temp\SMSTSLog
    • C:\MININT\SMSOSD\OSDLOGS

Keep in mind there are other non-MDT logs you’ll probably need to review that are not listed here.

In Closing

You now have some historical data to dig into if something goes wrong, which will hopefully be few & far in between!

Good Providence to you!

MDT Tutorial Part 8: Unattend.xml

Living Table of Contents

 

Today’s Agenda:

  • View Unattend.xml
  • Generate Catalog
  • Edit Unattend.xml

Recommended Reading

View Unattend.xml

The unattend.xml lives in subdirectory named after your Task Sequence ID that sits in the Control directory of your Deployment Share.  For example, if your Task Sequence ID is BC151164ENT then you can find the unattend.xml in either:

  • C:\DeploymentShare\Control\BC151164ENT
  • \\MDTServer\DeploymentShare$\Control\BC151164ENT

You can edit it using your favorite text editor, but I recommend using the Windows System Image Manager (SIM).

  1. Edit your Task Sequence
  2. Go to the OS Info tab
  3. Click the Edit Unattend.xml button
  4. Go make a pizza

Generate Catalog

Doing the above will require you to generate a catalog file for the WIM you imported.  Fortunately this process happens automatically.

Unattend-003

Unfortunately this process can take a while depending on your configuration.

Once the generation is complete, you’re free to make changes to your Unattend.xml.

Also, you may want to pre-generate catalogs in a separate SIM session since it takes a while:

Unattend-010

Edit Unattend.xml

Typically my first step is to run the Validation check to see what the SIM isn’t happy about.

Unattend-011

Double click on any results to be taken right to that setting to remediate any issues.

  1. For the first four in the screenshot above, I simply revert the change by secondary mouse-clicking on the setting and selecting that option.
    .
  2. For the NetworkLocation warning, I typically leave it as-is & ignore warning.  Even though it’s officially deprecated, it still seems to work but for how long is anyone’s guess.

Since we’re already in amd64_Microsoft-Windows-Shell-Setup__neutral/OOBE, why don’t we set ProtectYourPC to 3.

Make any other necessary changes, verify the answer file, save and exit.

In Closing

You can do a lot in the unattend.xml but since I’m prone to forgetting  🙂  I try to add just the bare minimum and put the rest in a Task Sequence; It’s much easier to manage/maintain that way but there are legitimate reasons to put something in the unattend.  Do what works for you.

Good Providence to you!

MDT Tutorial Part 7: Customizing Base MDT Template & ADK WinPE Template WIM

Living Table of Contents

 

Totally Optional NOT Required!

Nothing in this post is required for following along.  It’s merely here to make you aware that this level of customization is possible.  Think of this as an extension of Part 6.

Customizing the MDT Template

When you create a new Deployment Share a set of files and folders are populated in the desired location.  This isn’t generated on the fly from thin air but rather pulled from a template which can be found here:


C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution

If for whatever reason you find yourself constantly creating deployment shares, you can modify this template to include your customizations:

  • Pre-configured CustomSettings.ini
  • Pre-configured Bootstrap.ini
  • Modifications to out-of-box scripts
    • This is a no no to be honest so I recommend avoiding that at all costs.
      If you must, make sure you backup the original file(s).
  • Including your own custom scripts

A good example of this would be making sure that DaRT was an option for any newly created deployment shares.  To do that, add the appropriate architecture DaRT .CABs into the appropriate directories below


C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64

C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x86

Once you make your changes to the ‘template’, create a new Deployment Share and you’ll see all of your customizations.

Note: Although you could include a pre-built bootable .ISO, it’s not ideal as it would be hard-coded to look at DeploymentShareA not NewDeploymentShareB requiring you to update the deployment share anyway.

Customizing WinPE Templates

Similarly you can also customize the base WinPE .WIM file by editing the winpe.wim file here:


C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us

C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\en-us

Make a copy of the existing .WIM file


Copy-Item -Path "${env:ProgramFiles(x86)}\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us\winpe.wim" -Destination "${env:ProgramFiles(x86)}\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us\winpe.wim.orig"

Create a temporary mount directory & mount the .WIM


New-Item -Path "$env:SystemDrive\tmpDISMMount" -Type Directory

dism /mount-wim /wimfile:"${env:ProgramFiles(x86)}\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us\winpe.wim" /index:1 /mountdir:$env:SystemDrive\tmpDISMMount

Make your changes to the mounted .WIM


Copy-Item -Path "\\MDTServer\DeploymentShare$\Boot\ExtraFiles\amd64" -Destination "$env:SystemDrive\tmpDISMMount" -Recurse

Commit the changes


dism /Commit-Wim /MountDir:$env:SystemDrive\tmpDISMMount

Unmount the .WIM


dism /Unmount-Wim /MountDir:C:\test\offline /commit

Repeat for the x86 architecture

Why Should I Even Bother?

Paraphrasing Stephen Owen of FoxDeploy.com: TO solve the REAL problems!  By now, you’ve probably had to use CMTrace in WinPE a few times, and each time you launch it, you have to answer that ridiculous question:

Do you want to make this program the default viewer for log files?

Mike Terrill posted some very easy to follow instructions on his site, to solve this problem that has plagued many of us.

The process is fairly easy, and I altered Mike’s instructions for the MDT audience.

  1. Create DISM Mount Directory like:
    mkdir C:\tmpDISMMount
  2. Mount your winpe.wim from an elevated command prompt:
    dism /mount-wim /wimfile:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\en-us\winpe.wim" /index:1 /mountdir:C:\tmpDISMMount
  3. Load the DEFAULT registry hive from the WinPE image:
    reg load HKU\winpe C:\tmpDISMMount\Windows\System32\config\default
  4. Create the entries needed to suppress that annoying pop up box:
    reg add HKU\winpe\Software\Classes\.lo_ /ve /d Log.File /f
    reg add HKU\winpe\Software\Classes\.log /ve /d Log.File /f
    reg add HKU\winpe\Software\Classes\Log.File\shell\open\command /ve /d "\"X:\Windows\System32\CMTrace.exe\" \"%1\"" /f
  5. Unload the WinPE registry hive:
    reg unload HKU\winpe
  6. Unmount the WIM file and commit the changes:
    dism /unmount-wim /mountdir:C:\tmpDISMMount /commit
  7. Repeat the process with the x86 media in “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\en-us\winpe.wim”

In Closing

This is a good little nugget to keep in mind.  Is this everything you can do?  No, just scratching the surface.  Remember, the objective of this tutorial is to just help you get started and get those creative juice flowing.

Just remember that every time a new MDT build or ADK is released, you’ll have to re-do these customizations for the new environment.  I’d recommend creating a script to do these customizations for you and keep good notes in the script to justify why you did it so you can easily ‘rebuild’ in the future.  But before you do anything, jump on Twitter or the TechNet forums to seek guidance; chances are someone else has already overcome the challenge you’re facing so there’s no need to recreate the wheel.

While you decide whether or not you want to do this, I bid you Good Providence!

MDT Tutorial Part 6: Customizing Boot Media

Living Table of Contents

 

Today’s Agenda:

  • Adding Files to Boot Media
  • Adding a Cool/Corporate Background
  • Adding Features to Boot Media

Although you can deploy an image with this boot media and so some basic tasks, we can add some additional, and very useful, functionality with ease.

Adding Files to Boot Media

In Part 5 we verified the changes we made to the Bootstrap.ini by not only experiencing it, as in the case of missing authentication prompt and the text customization, but also by viewing the BDD.log in notepad.  For most people that log might as well have looked like this:

If I said it would get easier with a little practice I wouldn’t be lying, but fortunately for us we can have access to a log viewer that’ll make the log viewing process a breeze.

To start, I recommend creating a folder structure to store all the files you want to add and I strongly urge you to separate between architectures.

If you’re remote:

mkdir \\MDTServer\DeploymentShare$\Boot\ExtraFiles\x64\Windows\System32
mkdir \\MDTServer\DeploymentShare$\Boot\ExtraFiles\x86\Windows\System32

If you’re on the MDT Server:

mkdir C:\DeploymentShare\Boot\ExtraFiles\x64\Windows\System32
mkdir C:\DeploymentShare\Boot\ExtraFiles\x86\Windows\System32

The reason is that the 64-bit WinPE media can only run 64-bit EXE’s and not 32-bit EXE’s.  Attempting to run a 32-bit EXE will result in an error similar to the following:

AddFiles-001

Be mindful of that when you select the files you want to bake into your boot media so you’re not bitten by the “Bitness Bug”!  Also, don’t go crazy because the more files you add, the larger the boot media.  Add just enough so you have what you need, not what you might need.

So just carve out the folder structure you want and drop the files wherever you need them to be.

CMTrace

These days CMTrace is the default go-to log viewer and is available publically:

  1. System Center 2012 R2 Configuration Manager Toolkit
  2. SCCM Evaluation ISO in
    1. SMSSETUP\TOOLS directory
    2. SMSSETUP\OSD\bin\I386
    3. SMSSETUP\OSD\bin\x64

However, as pointed out by Johan Arwidmark although the tool is ‘freely available’ it is not free as the EULA licensing states:

INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices running validly licensed copies of Microsoft System Center 2012 or later.

While disappointing, it is free to use during your evaluation.  So to quote Cathy Moya:

For anyone just using MDT, hey, install the eval copy and see what you’re missing with Config Manager. 🙂

That said once you have your eval setup you can move on with grabbing the EXE.  It’s probably easiest to grab it from the SCCM Evaluation ISO in the SMSSETUP\OSD\bin directories: I386 for x86 or 32-bit version and x64 for the 64-bit version.  If you’re using the toolkit hower:

  1. Download the MSI
  2. Run the installer (or perform an administrative installation)
  3. Copy the CMTrace.exe in the ClientTools folder
  4. Paste it in \\MDTServer\DeploymentShare$\Boot\ExtraFiles\x86\Windows\System32

This nets you the 32-bit version of CMTrace which is good for 32-bit boot media, but what about the 64-bit executable?  If you’re on a 64-bit machine you can:

  1. Run the CMTrace.exe in the ClientTools folder
  2. Open Task Manager
  3. Go to the Processes tab
  4. Sort by Apps and look for CMTrace_amd64.exe
  5. Secondary mouse click it and select ‘Open file location
  6. It will take you to %Temp% and point you to a file named TRAXXXX.tmp where XXXX are four random characters like 9644 or 1CD7.
  7. Copy the file, for example, TRA9644.tmp
  8. Paste it in \\MDTServer\DeploymentShare$\Boot\ExtraFiles\x64\Windows\System32
  9. Rename TRA9644.tmp to CMTrace.exe

Note: The above step works on Windows 10 and Server 2016; should work on Windows 8 and Server 2012 R2; if not use Process Explorer (or Process Monitor) to figure out where it’s running from.

Open the Deployment Workbench, go to your Deployment Share properties and click on the ‘Windows PE’ tab which will take you to the ‘General’ subtab.  Near the bottom look for ‘Extra directory to add’ next to an empty field where you can point to a location that contains the extra files you wish to add.  Type or browse to the path you created above and click Apply.

AddFiles-002.PNG

Once you finish with x86, at the top of the properties window just under the ‘Windows PE’ tab is a ‘Platform’ drop down.  Click it, select x64 and repeat your change there as well.

Adding a Cool/Corporate Background

While you’re on Extra Files tab, let’s add a Cool/Corporate background to the media!
This is totally optional but many do find it useful.

On the same ‘General’ subtab of the ‘Windows PE’ tab of the Deployment Share properties is a ‘Custom background bitmap file’ field that’s already filled in.  Just substitute that bitmap with one of your own.

AddBackground-001.PNG

Remember to also add the image to your x64 boot media via the ‘Platform’ drop down!

Adding Features to Boot Media

The WinPE boot media is lacking some key features we’re going to want to use so we need to fix that by adding some Optional Components.

Up until now we’ve been working in the ‘General’ subtab of the ‘Windows PE’ tab of the Deployment Share properties and we’re now going to move to the ‘Features’ subtab under the same ‘Windows PE’ tab.

AddFeatures-001

The Features available in this list are pulled from supported .CABs in

  • C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs
  • C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs
  • C:\DeploymentShare\Tools\x64
  • C:\DeploymentShare\Tools\x86

Just like before when adding files, add only what you need, and I recommend:

Software Assurance Subscribers Only

If you have an active SA subscription you can download MDOP and add DaRT to your boot media.

  1. Download the MDOP ISO
  2. Mount the ISO
  3. Go into the DaRT\DaRT 10\Installers\Language (e.g.: en-us)
  4. Go into the appropriate architecture subfolder and run the MSI (or perform an administrative installation)
  5. Go into C:\Program Files\Microsoft DaRT\v10
  6. Copy the two Tools .CAB files and place them into the appropriate architecture directory in C:\DeploymentShare\Tools (i.e.: Toolsx64.cab into C:\DeploymentShare\Tools\x64)
  7. Go back to the ‘Windows PE’ tab of your your Deployment Share properties
  8. Go into the ‘Features’ subtab and check ‘Microsoft Diagnostics and Recovery Toolkit (DaRT)’
  9. Repeat for the x64 platform

Updating Boot Media

Once you’ve finished customizing your boot media, it’s time to update the boot media, so whip out your PowerShell code you pulled from before and run it in an elevated PowerShell console or PowerShell ISE.


Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1"
New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "C:\DeploymentShare"
update-MDTDeploymentShare -path "DS001:" -Verbose

From there, boot your updated ISO and you will see all of your changes:

UpdateBootMedia-001.PNG

  1. PowerShell is present
  2. Storage cmdlets present
  3. CMTrace is present
  4. Cool Background
  5. SA Subscribers: DaRT is present

In Closing

You now have feature rich bootable media that you can leverage to your advantage for various tasks related to OSD.

Good Providence to you!