WinPE and ImageX and SysPrep
A summary of the Mark Minasi newsletter technical articles:
Page is under construction: early March,
Windows Pre-Installation Boot Environment (WinPE)
aka Vista Junior
Windows System Image Manager (WSIM)
Get and Install the Windows Automated Installation
Toolkit (WAIK) on a "Technician Machine"
As an OS, WinPE has limited functionality, but you
can do things like partition and format hard drives. It also
contains a small set of utilities, things like netstat, ping,
ipconfig, chkdsk and netsh.
WinPE is a simple OS, but it's the basis of most deployment
scenarios as well as the platform for many recovery tools.
First, you'll need a "technician machine",
Microsoft's name for a system that can create WinPE images. A
machine running Vista, XP SP2 or Server 2003 SP1/R2 will work just
You will need to install the Business Desktop
Development tool (BDD 2007) and then the Windows Automated
Installation Kit (WAIK). The BDD is really just a shell for Vista's
new deployment tools. You will need to ensure that .NET Framework
2.0 and MSXML 6.0 are installed on your technician machine (both can
be found in either the BDD or the WAIK) if that technician machine
is XP or 2003. No need to add those to a Vista machine, as they're
built into it.
Important note: as for the BDD, in X:\BDD where X is
any particular drive on your machine, when WAIK's setup program asks
where to install the WAIK, do not use the default. Instead, have
the setup program put it in x:\waik. That'll make typing some
command lines a whole lot easier than if you install the WAIK into
Set up the Technician Machine for WinPE Development
Once the WAIK is installed, open the Windows PE Tools Command
Prompt by clicking on Start -> All Programs -> Microsoft Windows
AIK -> Windows PE Tools Command Prompt. If you're running this from
Vista, then be sure to elevate the command prompt—don't click it,
but right-click it and choose "Run as administrator." Why not just
use the Windows command prompt? Choosing Windows PE Tools
Command Prompt ensures that your PATH environment variable
points to everything that you'll need to create a WinPE image: some
apps we'll soon use, named copype.cmd, imagex.exe, peimg.exe and
oscdimg.exe will be included in the path. All commands must be
typed in this command prompt.
Create a simple WinPE Image and Burn it to CD
Next, you'll create your WinPE build environment in a new folder.
Type the following command in your Windows PE Tools Command Prompt:
copype architecture (x86, ia64 or amd64) X:\foldername
For example, to create a WinPE build environment for an x86 machine
into a folder named WinPE, type the following:
copype x86 X:\WinPE
Your new WinPE build environment will contain the following three
Your command prompt should now look like "X:\WinPE." Create your
first WinPE ISO by typing
- contains ETFSBoot.com, the WinPE CD's bootstrap loader, and
winpe.wim, a pre-built basic WinPE.
- contains all the necessary files to create the WinPE ISO.
- this is the folder we will mount our windows image file to in
order to work with it. NOTE: by default this is an empty
oscdimg -n -h -betfsboot.com iso winpe.iso
Running Your First WinPE Image
That command created the file "winpe.iso," which is
a standard ISO that'll fit easily on a CD. Burn it to a CD and boot
it on a computer with at least 256 MB of RAM, and you'll see a
screen like this one:
Look familiar? It kind of looks like a Vista desktop
with just a command prompt window. But there's no Start menu, no
taskbar, and pretty much no GUI. (Regedit does work,
however.) That's the main barrier to using WinPE—you've got to be
somewhat comfortable with the command prompt to get anything done in
WinPE. Nevertheless, it's a nice basic OS for doing a lot of
The WAIK includes a tool named imagex.exe that is
fundamental to most WinPE-related deployment scenarios, so I was a
bit puzzled that imagex.exe wasn't already installed on the basic
WinPE, but it wasn't, so let's see how to add imagex.exe to WinPE.
When we created that first WinPE ISO, it was the default
configuration supplied from the WAIK. To add things to that
configuration and create a new WinPE image, we'll have to learn a
to examine the default configuration by "mounting" the default
WinPE image to a folder
to add imagex.exe to the system32 directory of that image
to add—"inject" is Microsoft's term—the vmxnet drivers to that
to take that modified WinPE image and make it into an ISO.
When this stuff was run on a VMWare Workstation 5.3.3 virtual
machine it booted up fine—that's where the screen shot came from—but
after checking the network status by typing ipconfig, the result was
just "Windows IP Configuration" and no NICs. A quick try of the
WinPE CD on a notebook yielded an ipconfig output that had
NICs, so clearly there was a driver problem. VMWare's virtual
machines have virtual NICs, and those NICs don't reflect any actual
NICs; instead, they run an imaginary NIC called a "vmxnet" NIC.
Installing VMWare Tools on a virtual machine results in a folder
c:\program files\vmware\vmware tools\drivers\vmxnet that contains
the drivers for this imaginary vmxnet NIC... but how to get WinPE to
recognize those drivers, particularly as trying to install VMWare
Tools on a WinPE VM failed? Do what comes next, and while we're
modifying our WinPE image, let's add a program to it.
Mounting a WinPE Image With Imagex
A look in the x:\winpe folder shows a large file called "winpe.wim."
That single file is of a new type called a "Windows image" file,
which as you can see has the extension .wim.
WIM files are sort of Microsoft's answer to Ghost files, a method
of capturing and storing an entire OS image to a single file, which
can be deployed with a number of tools. The winpe.wim image that
the WAIK supplies is the all-in-one-file version of the WinPE CD
that you've already built. To change that image, though, we'll need
to "unlock" it and expose the files inside of it. The imagex.exe
program that I mentioned earlier will let us do that by letting us
"mount" the image to a folder. Notice that the x:\winpe folder
contains a folder called "mount;" it's empty and should stay empty.
Its only job is to provide a kind of "alias" that lets us look into
the winpe.wim image through the mount folder. That'll be a
bit clearer once we do it.
Return to your technician machine and the Windows PE Command
Prompt, which should be at x:\winpe; if not, then cd \winpe to get
there. Mount winpe.wim to the mount folder by typing
x:\waik\tools\x86\imagex /mountrw winpe.wim 1 mount
Imagex is a topic explained further in
0702 below, but briefly here's what you've typed:
"/mountrw" is the switch used to mount the winpe.wim file in a
read/write format—if you forget to add the rw to the end of the
mount statement, you won't be able to edit the image file.
The winpe.wim is the .wim file you would like to mount.
The number 1 is the image index number. The image index number is
important because Microsoft's new imaging technology allows you to
store multiple images in a single .wim file. The index number
identifies the image within the .wim file that you want to work
with. The default winpe.wim only has one index but you still need to
include the number 1 in the mount command or it won't work.
To find out how many images a .wim contains, type the following:
imagex /info x:\winpe\winpe.wim
Your available image choices will be listed, <IMAGE INDEX=1> is
the image we are working with in this example. Finally, mount is
the folder you are going to mount your winpe.wim image to.
Assuming that all went well, try looking in the x:\winpe\mount
folder. What was once empty now has folders named Users, Windows
and more but, again, they aren't really in the mount folder—imagex
just lets us essentially put on "WIM goggles" and see inside
winpe.wim through the mount folder. Now that winpe.wim's mounted,
we can use a few tools to add things to the winpe.wim image so that
we can then make and ISO and a boot CD of that image.
Adding Packages to WinPE
WAIK lets you load any "packages" that provide additional
functionality. More specifically, if you would like to include
support for running HTML, WMI, XML or WSH scripts, you will need to
add one or more of the available packages. There are 15 packages by
default to choose from. To view the list of packages type the
peimg /list /image=x:\winpe\mount
You will see a listing of packages that look like this:
To add a package, say the XML parser support package (so you can run
XML scripts in your WinPE) you would type the following:
peimg /install=WinPE-XML-Package x:\WinPE\mount\windows
OR you can use wildcards (*) for less typing:
peimg /install=*XML* x:\WinPE\mount\windows
To confirm that your package has been added to your winpe.wim,
run the “peimg /list /image=x:\winpe\mount” command again, the
packages you added should have a + sign in the Ins column, like
Adding ("Injecting") WinPE Drivers
We're ready now to add those vmxnet drivers to our WinPE image.
First, you'll need to get the drivers; here's how. Create a new
virtual Vista machine from the Vista product DVD using VMWare
Workstation 5.5.3. By default your virtual Vista machine will not
have networking, but installing the VMWare tools into your virtual
Vista machine will load network drivers, so go ahead and install the
VMWare tools (from the VMWare menu click on VM and then choose
"Install VMware Tools"). Now, after installing the VMware tools you
should have networking on your virtual Vista machine, you can check
this by typing /ipconfig at a command prompt -- if you have an IP
address, you have networking. Next, from the virtual Vista machine
that you just installed the VMware tools on, copy the entire
contents of the C:\Program Files\VMWare\VMWare Tools\Drivers\vmxnet
folder to a folder named C:\Drivers on your technician machine. To
inject the VMware network drivers into your winpe.wim type the
following two commands in your Windows PE Tools Command Prompt:
peimg /inf=c:\drivers\vmxnet.inf x:\winpe\mount\windows
peimg /inf=c:\drivers\vmware-nic.inf x:\winpe\mount\windows
OR, remember that wildcards (*) work, so typing the following
works as well:
peimg /inf=c:\drivers\vm*.inf x:\winpe\mount\windows or peimg /inf=c:\drivers\vm*.* x:\winpe\mount\windows
Adding Imagex to Your WinPE Image
As I suggested earlier, we'll want imagex.exe on our WinPE
image. That's because imagex is a powerful command line tool that
allows you to capture and apply images and, again, for some reason
imagex is not included in a WinPE by default (which is why we have
to add it).
As for getting imagex.exe into your WinPE, a simple copy is all
that's needed. Imagex.exe is installed by default when you install
the Windows AIK. You could choose to use Windows Explorer and browse
to image.exe by launching Windows Explorer and expanding x:\waik\tools,
where you'll see folders named x86, amd64 and ia64—there's an imagex
for standard 32-bit systems, x64 systems, and Itanium systems.
We'll copy the x86 version with this command:
Copy X:\WAIK\Tools\x86\imagex.exe x:\winpe\mount\windows\system32
That just copied the file to the system32 folder of our winpe.wim
image, where it'll always be on the path and easily available from
the command line.
Saving the Changes: Unmounting
Now that we've finished our changes, let's save them to our
winpe.wim by typing:
imagex /unmount x:\winpe\mount /commit
The /commit switch saves your changes. If you forget to type the
/commit, your changes will not be saved.
Place the winpe.wim in the ISO Folder
Now our changes are in the winpe.wim file, as a look at its "last
modified" date and time will confirm. But, don't re-type the oscdimg
command that we did before—there's another step we've got to do to
see that winpe.wim's image ends up as an ISO. The oscdimg command
that we did before took the files in the folder named "ISO" and
assembled them into an ISO file. A look inside the ISO folder shows
that there's a folder named "Sources" and, inside that, a large file
named boot.wim. That is the WIM that is the WinPE
image we'll create, not winpe.wim, so we need to
overwrite that boot.wim with our customized winpe.wim to get our
desired image on that ISO. Do that by typing
xcopy x:\winpe\winpe.wim x:\winpe\iso\sources\boot.wim /y
Create the ISO
Now we're ready to make our final customized ISO. Type the
oscdimg -n -h -bx:\winpe\etfsboot.com x:\winpe\iso x:\winpe\winpe.iso
The oscdimg.exe is the command line utility that tells
etfsboot.com to look in the x:\winpe\iso folder for a file named
boot.wim, and when found convert the boot.wim to an ISO named
winpe.iso and put it in the WinPE folder. The -n option allows for
long file names and the -b option makes it bootable or El-Torito
compliant. If you are creating a bootable ISO for an ia64
architecture, replace etfsboot.com with efisys.bin. -h says to
write any hidden files or folders.
You now have a bootable WinPE ISO called winpe.iso. Burn that to
a CD, fire it up and you'll see that ipconfig yields good news, and
the imagex command works.
Congratulations, you've built your first custom WinPE system. You
could now choose to connect to a server that has a Vista
installation image using the net use V: \\servername\sharename
command and download a Vista installation image, repartion the
system's drive—WinPE is running now from a RAM disk and you can
remove the CD if you like without crashing the system—or do any of a
number of things. You've completed the first real task in building
your deployment toolkit.
All of the above is in the 0701
Now should come the second one: however, the
0701a newsletter technical section
is indeed complicated, but is actually clear in itself.
So, now to the 0702
newsletter, and remember that the WinPE CD can be used for XP, Win2k
Imaging Comes to Microsoft: Working with ImageX and Windows
Microsoft's finally given the popular image tools—Acronis Snap
Deploy, Ghost, Drive Image and the like—a run for their money with a
tool that lets you take an entire operating system drive with all of
its files, folders, settings and installed applications and crunch
it down to one large file called a "Windows Image" or "WIM" file.
(The file extension of Windows Image files is ".wim," which is where
the short name comes from.) This article will show you how to take
a working Vista system and make—"capture" is the WIM
terminology—that system into a single WIM file. Then we'll see how
to take that image file and transfer ("apply" in WIMspeak) it to
another computer. The tool we'll use to both capture and apply is
the same program: ImageX.
You'll also need
working Vista system (or Win2k, XP, Win2003) so that
you've got something to image. It needn't be activated, nor
does it need to run on a particularly powerful system, as we're
just running ImageX through its paces.
- Finally, you'll need a place to store the image. Basic Vista
images run in the 2.4-4 GB size. The two places that I've most
frequently used to save a WIM file when imaging a system are
either a network share, or an external USB drive.
First, you'll need to review some things covered in our previous
newsletter 0701. In it, we
- Downloading and installing the Windows Automated Installation
Kit (WAIK), the 800+ MB ISO file that, when burned to a DVD and
installed, puts Vista's deployment tools on your computer. The
WAIK can be installed on XP SP2, 2003 SP1/R2, or Vista.
Installing on XP or 2003 requires .NET 2.0 (it needed .NET 3.0
to work on x64) and the MSXML parser, which is on the WAIK.
You'll need the WAIK to try out the examples in this article.
In particular, you need for your WinPE CD-ROM to contain the
file imagex.exe in its windows\system32 folder.
- Creating and configuring Windows PE (WinPE) CD-ROM images.
WinPE is a simplified, reduced-function version of Vista that
you can use to do imaging and other tasks. It lacks anything
but the most rudimentary GUI and is largely controlled via
command-line tools. Its beauty lies in the fact that it is much
smaller than Vista—usually under 200MB, so it fits nicely on a
CD-ROM—but it still knows how to work with modern storage
devices and formats like NTFS (something that bootable DOS
floppies, the tool of choice for imagers pre-Vista, lacks), and
it knows how to load a network stack and connect to Microsoft
shares (something that DOS floppies are also pretty weak at).
You'll need a WinPE CD-ROM if you'd like to try out the
examples in this article, so if you've not already created
one then I recommend that you go back and create one, as is
Using ImageX To Create A WIM
Enough theory; let's try this stuff out by making a working Vista
box into a .WIM file. For this example, I'll have, as suggested
working WinPE CD-ROM with imagex.exe in its \windows\system32
working test PC which has Vista running on it. To save the need
for another test machine, I'm just going to create the WIM image
of the computer, then I'll wipe that computer's hard disk clean,
and then I'll deploy the WIM to the newly-cleared PC.
external USB hard disk, which has drive letter F:, or a network
share mapped to F:
Start out by doing this:
the external hard disk into your PC and verify that Vista can
indeed read and write the drive. If it doesn't work out to have
drive letter F:, don't worry about it — just remember to
substitute that letter whenever I use an "f:" in these
examples. Again, a network share works just as well, although
it's a trifle slower because imagex insists on doing image
verification when saved to a network share.
you're sure that the drive's ready to work, then slip the WinPE
CD into the PC's optical drive and reboot the computer using the
WinPE disc. You've got to do this because it's quite hard to
copy all of an operating system's files while that operating
system's running. So, by booting from WinPE's very simple—but
complete enough for our purposes—operating system, then we allow
all of your Vista box's files to remain safely asleep while we
copy them to the new WIM file.
WinPE's booted then you'll see the simple interface that we met
before in the 0701 newsletter WinPE article:
you're not using an external hard disk and are instead using a
network share, then now's the time to do the net use
command to map that network share to F:.
imagex /capture c: f:\ntest.wim "Newsletter test" /compress none
While you're waiting the half-hour or so for ImageX to pack up
your system into a WIM file, let's look at those options. First,
there's the "/capture" option; that's the one that says to put a
computer's operating system in cold storage. ImageX is supposedly
able to do this not only with computers running the Vista OS, but
also XP, 2003 and 2000, although honestly I've never had time to try
The "c:" and "f:\ntest.wim" tell ImageX what drive the OS to
image is on, and where to store the resulting WIM file, as well as
what to name it. One of the neat side effects of working with an
image technology that works on files and folders rather than sectors
is that you could, if you wanted to, have typed
imagex /capture c: c:\ntest.wim "Newsletter test" /compress none
Notice the difference: in that case, we'd actually be telling
ImageX to image the C: drive onto itself! The "Newsletter test" is
required and is a descriptive blurb about the image. You can see
that information by typing (once the imaging's done)
imagex /info f:/ntest.wim
That will cause ImageX to spit out a bunch of XML describing the
image, one of the first parts of which will be
Finally, the /compress none says not to apply any
compression algorithms to the WIM, something that I did mainly to
speed up the whole process. You can also specify fast and
maximum instead of none.
Using ImageX To Apply a WIM
Congratulations, you've created your first WIM! But where to
deploy it? Well, inasmuch as I don't have another test machine
around, I'm just going to wipe my test machine's hard disk clean,
which will enable it to look pretty much like an empty test machine.
You'll still have that WinPE command prompt window open—if not,
then just re-boot the test machine from the WinPE CD-ROM—so you need
format c: /q /y
And press Enter, and in a minute or two your test machine's hard
disk will be wiped clean. Or, just for the sake of completeness,
let's do what we'd normally do with a new system that we were about
to wipe and re-image. Again, we'd start from WinPE, but now let's
re-partition and format. (Let me repeat that. We're about to
wipe all of the data off of the hard disk of your test machine or,
rather, make that data very, very hard to recover. If you've got
some information on there that you can't part with, then please
either back it up and then do this, or just wait until you've got a
hard disk that you don't mind nuking.) With the WinPE command
prompt up, type
select disk 0
create partition primary
format c: /q /y
Diskpart is the Vista version of what used to be FDISK and
appeared, if memory serves, back in Windows 2000. You must select a
disk even if it's the only one that you have. "Clean" wipes the
master boot record, deleting any pointers to any existing partitions
and making getting to any data that was on the hard disk
very, very hard to do. "Create partition primary" and "assign
letter=c:" should be self-explanatory. "Active" marks the new
partition as the one to boot from, and "exit" exits Diskpart and
returns us to the C:\> prompt. Once there, we can format the
newly-partitioned drive C:.
Once that's done, we can then move our ntest.wim image onto our
newly-cleaned C: drive with this command:
imagex /apply f:\ntest.wim 1 c:\
After about 10 minutes and some very interesting messages—my
favorite is "SACL is going away"—the command prompt will
return. You can then reboot the system and your machine now runs
Vista once again.
We've seen, then, how to use imagex to create ("capture") and
deploy ("apply") Windows images. ImageX works well, but clearly
there's more to the story. We wouldn't be very successful deploying
ntest.wim to more than one computer because we'd end up with a lot
of computers all bearing the same SIDs. How to address that?
The answer is to add a step before imaging the computer, one
familiar to anyone who's done sizeable rollouts before: Sysprep.
As with earlier versions of Windows, Sysprep rips off the SIDs,
machine name and similar attributes of an operating system, leaving
one that has been (in Sysprep terms) "generalized." Once
generalized, we can then ImageX the computer and deploy that
generalized WIM to any number of machines. There are, however, a
few wrinkles in making that work. In the next newsletter,
0702a, comes instructions about the latest Sysprep—which hasn't changed all
that much from XP SP2's Sysprep—and how to automate the "mini-Setup"
that Sysprepped machines require—which has changed quite a
A SysPrep précis will not appear here unless there is a request. I
found that because I won't use Vista for some time I cannot test
some of the
operations shown in the newsletter.
If you visit the Time Line section on this site, mention is made
there of an attempt to clone an XP Pro hard drive. It worked to a
certain extent, except that I did not use Diskpart properly. This
screwed up the drive letter allocation. I know now that it would
prove easier to place the wim on the drive I want to apply it to,
and ensure that it is C: and active. Then it should all work.