How to Create a WIM System Image Using WindowsAIK and WindowsPE

WIM System Image File Overview

A system image is a single file that contains the entire operating system and all of the files, programs, and settings of an installed computer system. Network administrators use system images to deploy the Windows 7 operating system to many computers in a Windows network. Besides just deploying operating systems across a large network, a system image is also be a useful backup tool for re-imaging corrupted systems. A Windows 7 system image file is called a WIM file, it has a .wim file extension. A WIM file can be created in such a way (generalized) that it can be deployed to any computer independent of the particular hardware or drivers.

In this tutorial, I attempt to simplify the process of creating a Windows system image or WIM file, into easy to understand, step-by-step instructions. I hope you find the tutorial helpful and the process interesting! I have also added video tutorials showing how to do the entire process using a VMware Windows 7 virtual machine as the reference computer.

The tools you will need:

  • The Reference Computer – A computer with Windows 7 installed. This is the source computer that the image file will be created from. In my example, I used a fresh install of Windows 7 on an extra computer, then I ran updates, installed a couple programs, changed the desktop and the homepage, and took a screenshot (see below). Important! The first time you do this, I do not recommend using the Windows 7 home computer that you use on a daily basis, as the reference computer. This process will involve a generalizing of the system (sysprep) which will strip it of drivers, as well as the System ID. Though everything will be put back to normal, I do not recommend using a machine that you rely on the first time you do this exercise. I am also in the process of showing how this entire lab can be done using virtual machines.

    wim-reference-computer
    This is a screenshot of the system I am going to image.

  • The Technician Computer – In my case running Windows 7. This is the computer with Windows AIK installed.
  • A USB flash drive or CD – To hold your bootable WinPE image.
  • A USB external drive or flash drive – To store your WIM system image files (Note: a WIM file can be as large as the hard drive your imaging){loadposition adposition6}
  • Windows Automated Installation Kit (Windows AIK) – Used to create and maintain Windows system images or WIM files. Windows AIK is a free download from Microsoft that you will need to burn to DVD and then install. Windows AIK includes the following tools:
    • Windows PE – The Windows preinstallation environment is a thin version
      of Windows 7 based on the Windows 7 kernel. Windows PE is like a Windows
      7 Boot Disk. It can be used to fix Windows 7 installations.
    • Windows SIM – Windows System Image Manager creates ‘answer files’ that are used to automate the Windows installation (This is optional, I do not use this tool in this tutorial).
    • SysPrep Tool – The System Preparation Tool is used to generalize the system image for installation by removing specific computer system information. (The SysPrep tool is included in Windows 7)
    • ImageX – Command line tool that creates the image file. In this tutorial, we will copy the ImageX.exe file to the root of the USB WindowsPE boot drive, for easy access.

Initial Steps

In this tutorial you want to pay close attention to the syntax of the commands (eg. the spaces between words or characters)

  1. Set up the ‘Reference Computer’ with Windows 7. This is the computer I will use to create my “golden image. (see above recommendations)
  2. Download the Windows Automated Installation Kit for Windows 7 iso file. You can download it here: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=696dd665-9f76-4177-a811-39c26d3b3b34&displaylang=en. Once you have it downloaded you will need to burn it to a DVD. Now install WindowAIK from the DVD (If it does not start by itself run the StartCD.exe file located on the DVD)
  3. For good online instructions I recommend going to TechNet.Microsoft.com. This is my starting point for this tutorial: http://technet.microsoft.com/en-us/library/dd349343(WS.10).aspx

Create a Windows PE Boot Disk (USB Flash Drive or CD)

  1. Next, you need to make a Windows pre-installation environment, Windows PE boot disk. You can do this on a CD-ROM or a USB flash drive, I show both ways in the steps below . You can also find more information on how to create WindowsPE boot disks at the Microsoft TechNet website: http://technet.microsoft.com/en-us/library/dd744530(WS.10).aspx. I have also included a video tutorial on how to create a WindowsPE boot CD below.
  2. On your technician computer (computer with AIK installed), click:
    Start > All
    Programs > Microsoft Windows AIK
    , right-click Deployment Tools Command
    Prompt
    , and then select Run as administrator.
  3. At the command prompt, run the Copype.cmd script. The script requires two additional parameters: hardware architecture and destination location.
    copype.cmd <arch> <destination>
    <arch> can be x86, amd64, or ia64 and <destination> is a path to local directory. For example, I typed in the following command:
    copype.cmd x86 c:\winpe_x86 (the directory winpe_x86 will be created by the command)
  4. Next, run the following command to copy and rename the winpe.wim file:
    copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim
  5. Add ImageX.exe to your WinPE image (optional but recommended). Type the following command:
    copy c:\<the path to WindowsAIK>\tools\x86\imagex.exe c:\winpe_x86\iso\
    On my computer, I installed AIK directly to the c: drive in a folder named “WindowsAIK” instead of the “Program Files” folder so my command looked like this:
    copy c:\WindowsAIK\tools\x86\imagex.exe c:\winpe_x86\iso\
  6. Now you need to decide if you want to prepare a USB flash drive or a CD for accepting WindowsPE. If you want to prepare for burning a CD, you can skip to step 9, otherwise continue on. Now you need to prepare your USB Flash Drive. Insert your flash drive. Open a command prompt and type in the following command:
    diskpart (opens the diskpartition command line utility)
    When you see the prompt “DISKPART>” type in the following command to verify which disk is your USB Flash Drive:
    list disk (you should see a listing of disks based on size)
    Type in the following commands (Important: this assumes your USB drive was listed as “Disk 1” you don’t want to format the wrong disk)
    select disk 1
    clean
    create partition primary
    select partition 1
    active
    format quick fs=fat32
    assign
    exit

    Now your USB flash drive should be formatted with fat32.
  7. Copy the iso directory in your c:\winpe_x86 folder to your Flash drive. Type in the following commands:
    xcopy C:\winpe_x86\iso\*.* /e F:\
    the above command assumes your f: drive is your USB drive, else adjust accordingly
  8. Congratulations! You just created your Windows PE Boot Flash Drive. Now you need to capture a generalized image for deployment.
  9. If you would like to burn
    WindowsPE to a CD instead of a USB thumb drive. The following command will copy all of the files necessary to create a WindowsPE boot disc into an ISO image file. Then you can burn the image file to a CD to create a bootable WindowsPE CD. In the command below the ISO image file that you will want to burn is winpex86.iso
    Oscdimg -n -bC:\winpe_x86\Etfsboot.com C:\winpe_x86\ISO C:\winpe_x86\winpex86.iso
  10. Now burn the ISO image file winpex86.iso to a CD as a bootable image disc and you are finished! You can find more
    information on how to do it from the Microsoft Technet site here: http://technet.microsoft.com/en-us/library/dd799303%28v=ws.10%29.aspx .
  11. Congratulations! You just created your Windows PE Boot CD. Now you need to capture a generalized image for deployment.

How to Create a WindowsPE boot cd using Windows AIK

Generalize your Windows 7 Reference Computer with SysPrep

  1. Generalize your image with the SysPrep utility.
  2. On the reference computer. Click Start > All Programs > Accessories > Right Click the Command Prompt. Opens the command prompt in administrative mode. Type in the following command to run sysprep:
    c:\windows\system32\sysprep\sysprep.exe
  3. In the sysprep dialogue box choose the OOBE, generalize, and shutdown options and click “ok”.
  4. Sysprep will prepare your system for imaging by stripping it of hardware specific settings and will then shutdown.

Generalize the reference system using the SysPrep utility

Capture an Image for Deployment (Generalized Golden Image) with ImageX

  1. Now that you have generalized your Windows 7 Reference System you need to boot the reference computer to your WindowsPE Boot Disk (USB or CD). If you are doing the lab on a VMware virtual machine you can configure the virtual CD/DVD drive to boot directly to the WindowsPE .iso file. You will still need to tell the virtual machine to boot the CD/DVD drive by quickly clicking inside the VM as it boots and hitting the escape key on the keyboard in order to get to the boot menu. Working from a physical computer, you need to press the F12 key while starting the computer in order to bring up a one-time boot menu, and set the computer to boot to the CD/DVD or USB flash drive instead of the hard drive.
    Note: If you boot to the hard drive instead of your WindowsPE USB then your computer will begin the Windows setup procedure and load pnp drivers, and you will need to do sysprep all over again to generalize your system.
  2. In the WinPE command prompt run diskpartition by typing in the command: diskpart (and hitting enter)
  3. Type in the following command: list disk (to see your recognized disks)
    I showed 3 hard disk drives listed:disk0 = my hard drivedisk1 = my USB flash drivedisk2 = my larger external USB drive where I plan on saving my image file
  4. Type in the command: exit to exit disk partition
  5. Now I recommend figuring out which disks are under which drive letters. You can do this by executing the following commands:
    c:\ (switching to the c drive I found “Volume in drive C is System reserved”)
    d:\ (switching to the d drive I found the files and folders of a WindowsOS, i.e Program Files, Users, Windows, autoexec.bat, etc.)
    e:\ (depending on whether you are using a WindowsPE CD or a USB boot drive, switching to the e:\ drive you may find the contents of the WindowsPE drive or a “The device is not ready” message)
    f:\ (under the f drive I found the WindowsPE drive and the imagex.exe file)
    g:\ (under the g drive I found my USB external hard drive where I am going to store my image file)
  6. Once you know where imagex.exe is located (USB WinPE drive) you can run it on your generalized Win7 drive and save the image an external storage device. My final command to create the image and save it to an external hard drive was:
    f:\imagex /capture d:\ g:\my-windows-image.wim “myImage” (make sure you put the quotation marks)
    Explanation of command above: after using the cd and dir commands to search around the disks and directiories I found the imagex.exe file in the F:\ drive. The separate pieces of the command are as follows:
    f:\imagex (is where imagex.exe was located)
    /capture (the argument that tells imagex to capture the image)
    d:\ (location of the drive with the generalized Windows 7 OS)
    g:\my-windows-image.wim “myImage” (location of drive to save the image file (in this case an external USB drive), the file name to give it, and a label name)
  7. Now check to see if the image successfully copied to your external USB drive. You should see a .wim file. If you did, congratulations, you now have an image file of your entire Window 7 operating system, which includes installed programs, documents, and configurations! You can now install that image on a different computer, the same computer, or you could open that image file with the Windows AIK program and mount the image like an external hard drive. A mounted wim file can be browsed, edited or added to.

Capture the WIM from WindowsPE, using ImageX

Installing/Deploying your WIM Image to a Computer or Network with ImageX

  1. Now that you have your image file you can install it to another computer using ImageX!
  2. Boot a computer to your USB WindowsPE boot drive.
  3. Attach the USB external drive with your wim file.
  4. Format the drive using Diskpartition. After typing diskpart you will need to search the drives to verify which letters correspond with which drives. Here are the commands:
    diskpart (starts Disk Partition)
    list disk (lists the mounted disks, note which one is which by comparing sizes)
    select disk 0 (select the disk that corresponds with your hard drive where you want to install your image)
    clean
    create partition primary
    select partition 1
    active
    format quick fs=ntfs label=OS
    (Important: NTFS not fat32, label is optional)
    assign letter=C (Important: you want it to be the C drive)
    exit
    Now run the command to apply the image to the hard drive:
    f:\imagex.exe /apply e:\my-windows-image.wim 1 c:\
    Explanation:
    /apply (apply instead of capture)
    e:\my-windows-image.wim 1 (Important: the 1 is the index of the first wim. Each wim can have multiple versions)
    c:\ (where you will install the wim)
    Once the image is done you can try restarting and seeing if the system boots normally. If it doesn’t you will need to set up the boot configuration location. In WindowsPE type the following commands:
    c: (to switch to the c drive)
    cd windows\system32
    dir bcd* (list all the files beginning with bcd)
    bcdedit.exe (looks for boot files)
    bcdboot c:\windows /s c: (sets the system boot boot directory)
  5. Restart your computer and go to Windows setup mode. You will need to add a new user in setup mode which you can delete later. Log off and log back into your original user account and you should see all your programs, documents and settings! Image is restored!

How to use Internet Connection Sharing with Wireless

Overview

I have always found Internet Connection Sharing (ICS) to be a valuable exercise for networking students. Why? By turning on ICS you turn your laptop or desktop into:

  1. a router with NAT services which routes traffic to and from the connected clients that you are sharing internet with
  2. a DHCP server that gives out ip addresses, subnet mask, gateway address, and DNS address,
  3. a DNS Proxy to forward dns lookups to the DNS server all in one shot.

What does that mean? It means there are a lot of networking fundamentals that can be addressed by understanding ICS and what it is doing. It means that your laptop is auto configuring all of those networking services in order to make your laptop function like a router and share internet with other computers. It means people can get to the internet by accessing your laptop like they would a Linksys wireless router. Look at my diagram below.

Lets say you have a laptop with a USB cellular card, so you pretty much have internet everywhere your go, but you decide to go to Starbucks where your friends do not want to pay for wireless internet access because all they have is regular wireless ethernet NICS and the wireless in Starbucks is not free. So you decide you want to share your internet connection with your friends. This is normally done with Windows ICS or Internet Connection Sharing. To enable ICS you need 2 network cards, one that will act as the WAN where the internet comes into your laptop (in this case your cellular connection) and the other that will act as the LAN where the internet gets shared out of (in this case your Wireless NIC or your Wired ethernet port). If you use the standard Windows ICS you will find that only the wired connection will work in this scenario so you will be stuck with a situation like either one below:

The problem with the ICS scenarios above are that the first requires a crossover cable which most people do not have, and the situation on the right requires two straight through ethernet cables and a hub or a switch to share the connection which people usually do not carry around with them. The easiest solution is the one on top where you would share out of your wireless connection effectively turning your laptop into a wireless router. There happens to be a very nice and free application called VirtualRouter, currently in Beta, that will allow you to do just that. Go to http://virtualrouter.codeplex.com and download the .msi installer. The program is very easy to use. Essentially, VirtualRouter turns on ICS for you, but allows you to put in a SSID for clients to connect to wirelessly. It even allows you to password protect the shared connection with WPA2 security. It is easy to install and use, but one downside is that it will not work with all wireless cards, and it will only work with Windows 7 or Server 2008R2. See my video demonstration below:

Typically to use internet connection sharing you need two network cards. To use VirtualRouter you will need a Windows 7 computer with either two network cards (a wireless ethernet card and an ethernet card) or at least one wireless ethernet card. In the video tutorial below, I only use my laptop’s one wireless card, for both the WAN input and the LAN output. You may need to get creative with how you go about this with your own computer. If your Windows 7 machine does not have a wireless card then either borrow someone’s Windows 7 laptop or hopefully you have two ethernet NICS on your tower with which to demonstrate the procedure.

Video Tutorial

In this demonstration, I show how to use VirtualRouter to share an Internet connection through wireless

Mounting a Backup WIM Image Using Windows AIK

Overview

If you have a Windows system image file or WIM you can mount the file just like you would an external hard drive. Once you mount the WIM you can browse through all of the files and directories just like a running dive. This enables you to run virus scans on the WIM and even add new files modifying the WIM before unmounting it. All you need to be able to do this is a WIM file and Windows AIK.

Steps (If you already have AIK installed go to step 3)

  1. Download the Windows Automated Installation Kit (AIK) ISO and burn it to a CD.
  2. Install AIK from the CD you just created.
  3. Make a directory on your C:\ drive call it something like images (Example: C:\images).
  4. Launch the Windows PE Deployment Tools Command prompt from the Program menu (Start > All Programs > Microsoft Windows AIK — Deployment Tools Command Prompt).
  5. Run “imagex /mountrw <path to WIM file> 1 C:\images”
    Example:
    imagex /mountrw D:\test.wim 1 C:\images
    Note: The number 1 indicates the WIM’s index number. Each WIM can have multiple instances or indexes.
  6. Now you can navigate to C:\images and see all the mounted user data. Another nice thing is your can run an antivirus scan against the directory if you suspect a root-kit or other breach.
  7. Once you have finished you will unmount the image and commit any changes
    Example:
    imagex /unmount c:\images /commit
    Note: If you are not going to change the WIM skip the /commit
    imagex /unmount c:\images