WinPE and ImageX and SysPrep
A summary of the Mark Minasi newsletter technical articles:
Back to ITPlus.

Page is under construction: early March, 2007.

Windows Pre-Installation Boot Environment (WinPE) aka Vista Junior
Windows System Image Manager (WSIM)

Get and Install the Windows Automated Installation Toolkit (WAIK) on a "Technician Machine"

As an OS, WinPE has limited functionality, but you can do things like partition and format hard drives. It also contains a small set of utilities, things like netstat, ping, ipconfig, chkdsk and netsh. 
WinPE is a simple OS, but it's the basis of most deployment scenarios as well as the platform for many recovery tools. 

First, you'll need a "technician machine", Microsoft's name for a system that can create WinPE images. A machine running Vista, XP SP2 or Server 2003 SP1/R2 will work just fine.

You will need to install the Business Desktop Development tool (BDD 2007) and then the Windows Automated Installation Kit (WAIK). The BDD is really just a shell for Vista's new deployment tools. You will need to ensure that .NET Framework 2.0 and MSXML 6.0 are installed on your technician machine (both can be found in either the BDD or the WAIK) if that technician machine is XP or 2003.  No need to add those to a Vista machine, as they're built into it.

Important note: as for the BDD, in X:\BDD where X is any particular drive on your machine, when WAIK's setup program asks where to install the WAIK, do not use the default.  Instead, have the setup program put it in x:\waik.  That'll make typing some command lines a whole lot easier than if you install the WAIK into Program Files.

Set up the Technician Machine for WinPE Development

Once the WAIK is installed, open the Windows PE Tools Command Prompt by clicking on Start -> All Programs -> Microsoft Windows AIK -> Windows PE Tools Command Prompt.  If you're running this from Vista, then be sure to elevate the command prompt—don't click it, but right-click it and choose "Run as administrator."  Why not just use the Windows command prompt?  Choosing Windows PE Tools Command Prompt ensures that your PATH environment variable points to everything that you'll need to create a WinPE image: some apps we'll soon use, named copype.cmd, imagex.exe, peimg.exe and oscdimg.exe will be included in the path. All commands must be typed in this command prompt.

Create a simple WinPE Image and Burn it to CD

Next, you'll create your WinPE build environment in a new folder. Type the following command in your Windows PE Tools Command Prompt:

                        copype architecture (x86, ia64 or amd64) X:\foldername

                       copype x86 X:\WinPE

Your new WinPE build environment will contain the following three folders:

• \winpe - contains ETFSBoot.com, the WinPE CD's bootstrap loader, and winpe.wim, a pre-built basic WinPE.
• \winpe\ISO - contains all the necessary files to create the WinPE ISO.
• \winpe\mount - this is the folder we will mount our windows image file to in order to work with it.  NOTE: by default this is an empty folder.

            oscdimg -n -h -betfsboot.com iso winpe.iso

Running Your First WinPE Image

That command created the file "winpe.iso," which is a standard ISO that'll fit easily on a CD.  Burn it to a CD and boot it on a computer with at least 256 MB of RAM, and you'll see a screen like this one:

Look familiar? It kind of looks like a Vista desktop with just a command prompt window.  But there's no Start menu, no taskbar, and pretty much no GUI.  (Regedit does work, however.)  That's the main barrier to using WinPE—you've got to be somewhat comfortable with the command prompt to get anything done in WinPE.  Nevertheless, it's a nice basic OS for doing a lot of things.

The WAIK includes a tool named imagex.exe that is fundamental to most WinPE-related deployment scenarios, so I was a bit puzzled that imagex.exe wasn't already installed on the basic WinPE, but it wasn't, so let's see how to add imagex.exe to WinPE.

• How to examine the default configuration by "mounting" the default WinPE image to a folder
• How to add imagex.exe to the system32 directory of that image
• How to add—"inject" is Microsoft's term—the vmxnet drivers to that image
• How to take that modified WinPE image and make it into an ISO.

When this stuff was run on a VMWare Workstation 5.3.3 virtual machine it booted up fine—that's where the screen shot came from—but after checking the network status by typing ipconfig, the result was just "Windows IP Configuration" and no NICs.  A quick try of the WinPE CD on a notebook yielded an ipconfig output that had NICs, so clearly there was a driver problem.  VMWare's virtual machines have virtual NICs, and those NICs don't reflect any actual NICs; instead, they run an imaginary NIC called a "vmxnet" NIC.  Installing VMWare Tools on a virtual machine results in a folder c:\program files\vmware\vmware tools\drivers\vmxnet that contains the drivers for this imaginary vmxnet NIC... but how to get WinPE to recognize those drivers, particularly as trying to install VMWare Tools on a WinPE VM failed? Do what comes next, and while we're modifying our WinPE image, let's add a program to it. 

Mounting a WinPE Image With Imagex

A look in the x:\winpe folder shows a large file called "winpe.wim."  That single file is of a new type called a "Windows image" file, which as you can see has the extension .wim. 

WIM files are sort of Microsoft's answer to Ghost files, a method of capturing and storing an entire OS image to a single file, which can be deployed with a number of tools.  The winpe.wim image that the WAIK supplies is the all-in-one-file version of the WinPE CD that you've already built.  To change that image, though, we'll need to "unlock" it and expose the files inside of it.  The imagex.exe program that I mentioned earlier will let us do that by letting us "mount" the image to a folder.  Notice that the x:\winpe folder contains a folder called "mount;" it's empty and should stay empty.  Its only job is to provide a kind of "alias" that lets us look into the winpe.wim image through the mount folder.  That'll be a bit clearer once we do it.

Return to your technician machine and the Windows PE Command Prompt, which should be at x:\winpe; if not, then cd \winpe to get there.  Mount winpe.wim to the mount folder by typing

            x:\waik\tools\x86\imagex /mountrw winpe.wim 1 mount

Imagex is a topic explained further in 0702 below, but briefly here's what you've typed: 
"/mountrw" is the switch used to mount the winpe.wim file in a read/write format—if you forget to add the rw to the end of the mount statement, you won't be able to edit the image file.
The winpe.wim is the .wim file you would like to mount.
The number 1 is the image index number. The image index number is important because Microsoft's new imaging technology allows you to store multiple images in a single .wim file. The index number identifies the image within the .wim file that you want to work with. The default winpe.wim only has one index but you still need to include the number 1 in the mount command or it won't work.
To find out how many images a .wim contains, type the following:

            imagex /info x:\winpe\winpe.wim 

Your available image choices will be listed, <IMAGE INDEX=1> is the image we are working with in this example.  Finally, mount is the folder you are going to mount your winpe.wim image to.

Assuming that all went well, try looking in the x:\winpe\mount folder.  What was once empty now has folders named Users, Windows and more but, again, they aren't really in the mount folder—imagex just lets us essentially put on "WIM goggles" and see inside winpe.wim through the mount folder.  Now that winpe.wim's mounted, we can use a few tools to add things to the winpe.wim image so that we can then make and ISO and a boot CD of that image.

Adding Packages to WinPE

WAIK lets you load any "packages" that provide additional functionality. More specifically, if you would like to include support for running HTML, WMI, XML or WSH scripts, you will need to add one or more of the available packages. There are 15 packages by default to choose from. To view the list of packages type the following:

            peimg /list /image=x:\winpe\mount

You will see a listing of packages that look like this:

                peimg /install=WinPE-XML-Package x:\WinPE\mount\windows

OR you can use wildcards (*) for less typing:

                peimg /install=*XML* x:\WinPE\mount\windows

To confirm that your package has been added to your winpe.wim, run the “peimg /list /image=x:\winpe\mount” command again, the packages you added should have a + sign in the Ins column, like this:

Adding ("Injecting") WinPE Drivers

We're ready now to add those vmxnet drivers to our WinPE image.  First, you'll need to get the drivers; here's how.  Create a new virtual Vista machine from the Vista product DVD using VMWare Workstation 5.5.3.  By default your virtual Vista machine will not have networking, but installing the VMWare tools into your virtual Vista machine will load network drivers, so go ahead and install the VMWare tools (from the VMWare menu click on VM and then choose "Install VMware Tools"). Now, after installing the VMware tools you should have networking on your virtual Vista machine, you can check this by typing /ipconfig at a command prompt -- if you have an IP address, you have networking. Next, from the virtual Vista machine that you just installed the VMware tools on, copy the entire contents of the C:\Program Files\VMWare\VMWare Tools\Drivers\vmxnet folder to a folder named C:\Drivers on your technician machine.  To inject the VMware network drivers into your winpe.wim type the following two commands in your Windows PE Tools Command Prompt:

            peimg /inf=c:\drivers\vmxnet.inf x:\winpe\mount\windows

            peimg /inf=c:\drivers\vmware-nic.inf x:\winpe\mount\windows

OR, remember that wildcards (*) work, so typing the following works as well:

            peimg /inf=c:\drivers\vm*.inf x:\winpe\mount\windows or peimg /inf=c:\drivers\vm*.* x:\winpe\mount\windows

Adding Imagex to Your WinPE Image

As I suggested earlier, we'll want imagex.exe on our WinPE image.  That's because imagex is a powerful command line tool that allows you to capture and apply images and, again, for some reason imagex is not included in a WinPE by default (which is why we have to add it).

As for getting imagex.exe into your WinPE, a simple copy is all that's needed. Imagex.exe is installed by default when you install the Windows AIK. You could choose to use Windows Explorer and browse to image.exe by launching Windows Explorer and expanding x:\waik\tools, where you'll see folders named x86, amd64 and ia64—there's an imagex for standard 32-bit systems, x64 systems, and Itanium systems.  We'll copy the x86 version with this command:

                        Copy X:\WAIK\Tools\x86\imagex.exe x:\winpe\mount\windows\system32

That just copied the file to the system32 folder of our winpe.wim image, where it'll always be on the path and easily available from the command line.

Saving the Changes:  Unmounting

Now that we've finished our changes, let's save them to our winpe.wim by typing:

            imagex /unmount x:\winpe\mount /commit

The /commit switch saves your changes.  If you forget to type the /commit, your changes will not be saved.

Place the winpe.wim in the ISO Folder

Now our changes are in the winpe.wim file, as a look at its "last modified" date and time will confirm. But, don't re-type the oscdimg command that we did before—there's another step we've got to do to see that winpe.wim's image ends up as an ISO.  The oscdimg command that we did before took the files in the folder named "ISO" and assembled them into an ISO file.  A look inside the ISO folder shows that there's a folder named "Sources" and, inside that, a large file named boot.wim.  That is the WIM that is the WinPE image we'll create, not winpe.wim, so we need to overwrite that boot.wim with our customized winpe.wim to get our desired image on that ISO.  Do that by typing

            xcopy x:\winpe\winpe.wim x:\winpe\iso\sources\boot.wim /y

Create the ISO

Now we're ready to make our final customized ISO.  Type the following:

The oscdimg.exe is the command line utility that tells etfsboot.com to look in the x:\winpe\iso folder for a file named boot.wim, and when found convert the boot.wim to an ISO named winpe.iso and put it in the WinPE folder. The -n option allows for long file names and the -b option makes it bootable or El-Torito compliant. If you are creating a bootable ISO for an ia64 architecture, replace etfsboot.com with efisys.bin.  -h says to write any hidden files or folders.

You now have a bootable WinPE ISO called winpe.iso.  Burn that to a CD, fire it up and you'll see that ipconfig yields good news, and the imagex command works. 

Congratulations, you've built your first custom WinPE system. You could now choose to connect to a server that has a Vista installation image using the net use V: \\servername\sharename command and download a Vista installation image, repartion the system's drive—WinPE is running now from a RAM disk and you can remove the CD if you like without crashing the system—or do any of a number of things.  You've completed the first real task in building your deployment toolkit.

All of the above is in the 0701 newsletter.
Now should come the second one: however, the 0701a newsletter technical section is indeed complicated, but is actually clear in itself.

So, now to the 0702 newsletter, and remember that the WinPE CD can be used for XP, Win2k and 2003:

Imaging Comes to Microsoft:  Working with ImageX and Windows Image Files

Microsoft's finally given the popular image tools—Acronis Snap Deploy, Ghost, Drive Image and the like—a run for their money with a tool that lets you take an entire operating system drive with all of its files, folders, settings and installed applications and crunch it down to one large file called a "Windows Image" or "WIM" file.  (The file extension of Windows Image files is ".wim," which is where the short name comes from.)  This article will show you how to take a working Vista system and make—"capture" is the WIM terminology—that system into a single WIM file.  Then we'll see how to take that image file and transfer ("apply" in WIMspeak) it to another computer.  The tool we'll use to both capture and apply is the same program: ImageX.

You'll also need

• A working Vista system (or Win2k, XP, Win2003) so that you've got something to image.  It needn't be activated, nor does it need to run on a particularly powerful system, as we're just running ImageX through its paces. 
• Finally, you'll need a place to store the image.  Basic Vista images run in the 2.4-4 GB size.  The two places that I've most frequently used to save a WIM file when imaging a system are either a network share, or an external USB drive.

Getting Ready

First, you'll need to review some things covered in our previous newsletter 0701.  In it, we covered

• Downloading and installing the Windows Automated Installation Kit (WAIK), the 800+ MB ISO file that, when burned to a DVD and installed, puts Vista's deployment tools on your computer.  The WAIK can be installed on XP SP2, 2003 SP1/R2, or Vista.  Installing on XP or 2003 requires .NET 2.0 (it needed .NET 3.0 to work on x64) and the MSXML parser, which is on the WAIK.  You'll need the WAIK to try out the examples in this article. In particular, you need for your WinPE CD-ROM to contain the file imagex.exe in its windows\system32 folder.
• Creating and configuring Windows PE (WinPE) CD-ROM images.  WinPE is a simplified, reduced-function version of Vista that you can use to do imaging and other tasks.  It lacks anything but the most rudimentary GUI and is largely controlled via command-line tools.  Its beauty lies in the fact that it is much smaller than Vista—usually under 200MB, so it fits nicely on a CD-ROM—but it still knows how to work with modern storage devices and formats like NTFS (something that bootable DOS floppies, the tool of choice for imagers pre-Vista, lacks), and it knows how to load a network stack and connect to Microsoft shares (something that DOS floppies are also pretty weak at).   You'll need a WinPE CD-ROM if you'd like to try out the examples in this article, so if you've not already created one then I recommend that you go back and create one, as is shown above.

Using ImageX To Create A WIM

Enough theory; let's try this stuff out by making a working Vista box into a .WIM file.  For this example, I'll have, as suggested before,

• A working WinPE CD-ROM with imagex.exe in its \windows\system32 folder
• A working test PC which has Vista running on it.  To save the need for another test machine, I'm just going to create the WIM image of the computer, then I'll wipe that computer's hard disk clean, and then I'll deploy the WIM to the newly-cleared PC.
• An external USB hard disk, which has drive letter F:, or a network share mapped to F:

Start out by doing this:

1. Plug the external hard disk into your PC and verify that Vista can indeed read and write the drive.  If it doesn't work out to have drive letter F:, don't worry about it — just remember to substitute that letter whenever I use an "f:" in these examples.  Again, a network share works just as well, although it's a trifle slower because imagex insists on doing image verification when saved to a network share. 
2. Once you're sure that the drive's ready to work, then slip the WinPE CD into the PC's optical drive and reboot the computer using the WinPE disc.  You've got to do this because it's quite hard to copy all of an operating system's files while that operating system's running.  So, by booting from WinPE's very simple—but complete enough for our purposes—operating system, then we allow all of your Vista box's files to remain safely asleep while we copy them to the new WIM file.
3. Once WinPE's booted then you'll see the simple interface that we met before in the 0701 newsletter WinPE article:

4. If you're not using an external hard disk and are instead using a network share, then now's the time to do the net use command to map that network share to F:.
5. Type

           imagex /capture c: f:\ntest.wim "Newsletter test" /compress none

While you're waiting the half-hour or so for ImageX to pack up your system into a WIM file, let's look at those options.  First, there's the "/capture" option; that's the one that says to put a computer's operating system in cold storage.  ImageX is supposedly able to do this not only with computers running the Vista OS, but also XP, 2003 and 2000, although honestly I've never had time to try those options.

The "c:" and "f:\ntest.wim" tell ImageX what drive the OS to image is on, and where to store the resulting WIM file, as well as what to name it.  One of the neat side effects of working with an image technology that works on files and folders rather than sectors is that you could, if you wanted to, have typed

           imagex /capture c: c:\ntest.wim "Newsletter test" /compress none

Notice the difference:  in that case, we'd actually be telling ImageX to image the C: drive onto itself!  The "Newsletter test" is required and is a descriptive blurb about the image.  You can see that information by typing (once the imaging's done)

                        imagex /info f:/ntest.wim

That will cause ImageX to spit out a bunch of XML describing the image, one of the first parts of which will be

            <NAME>Newsletter test</NAME>

Finally, the /compress none says not to apply any compression algorithms to the WIM, something that I did mainly to speed up the whole process.  You can also specify fast and maximum instead of none.

Using ImageX To Apply a WIM

Congratulations, you've created your first WIM!  But where to deploy it?  Well, inasmuch as I don't have another test machine around, I'm just going to wipe my test machine's hard disk clean, which will enable it to look pretty much like an empty test machine.

You'll still have that WinPE command prompt window open—if not, then just re-boot the test machine from the WinPE CD-ROM—so you need only type

            format c: /q /y

And press Enter, and in a minute or two your test machine's hard disk will be wiped clean.  Or, just for the sake of completeness, let's do what we'd normally do with a new system that we were about to wipe and re-image.  Again, we'd start from WinPE, but now let's re-partition and format.  (Let me repeat that.  We're about to wipe all of the data off of the hard disk of your test machine or, rather, make that data very, very hard to recover.  If you've got some information on there that you can't part with, then please either back it up and then do this, or just wait until you've got a hard disk that you don't mind nuking.)  With the WinPE command prompt up, type

diskpart
select disk 0
clean
create partition primary
assign letter=c:
active
exit
format c: /q /y

Diskpart is the Vista version of what used to be FDISK and appeared, if memory serves, back in Windows 2000.  You must select a disk even if it's the only one that you have.  "Clean" wipes the master boot record, deleting any pointers to any existing partitions and making getting to any data that was on the hard disk very, very hard to do.  "Create partition primary" and "assign letter=c:" should be self-explanatory.  "Active" marks the new partition as the one to boot from, and "exit" exits Diskpart and returns us to the C:\> prompt.  Once there, we can format the newly-partitioned drive C:.

Once that's done, we can then move our ntest.wim image onto our newly-cleaned C: drive with this command:

            imagex /apply f:\ntest.wim 1 c:\

After about 10 minutes and some very interesting messages—my favorite is "SACL is going away"—the command prompt will return.  You can then reboot the system and your machine now runs Vista once again.

We've seen, then, how to use imagex to create ("capture") and deploy ("apply") Windows images.  ImageX works well, but clearly there's more to the story.  We wouldn't be very successful deploying ntest.wim to more than one computer because we'd end up with a lot of computers all bearing the same SIDs.  How to address that?

The answer is to add a step before imaging the computer, one familiar to anyone who's done sizeable rollouts before:  Sysprep.  As with earlier versions of Windows, Sysprep rips off the SIDs, machine name and similar attributes of an operating system, leaving one that has been (in Sysprep terms) "generalized."  Once generalized, we can then ImageX the computer and deploy that generalized WIM to any number of machines.  There are, however, a few wrinkles in making that work.  In the next newsletter, 0702a, comes instructions about the latest Sysprep—which hasn't changed all that much from XP SP2's Sysprep—and how to automate the "mini-Setup" that Sysprepped machines require—which has changed quite a bit. 

Editor comments:

A SysPrep précis will not appear here unless there is a request. I found that because I won't use Vista for some time I cannot test some of the operations shown in the newsletter.

If you visit the Time Line section on this site, mention is made there of an attempt to clone an XP Pro hard drive. It worked to a certain extent, except that I did not use Diskpart properly. This screwed up the drive letter allocation. I know now that it would prove easier to place the wim on the drive I want to apply it to, and ensure that it is C: and active. Then it should all work.