Create WIM from installed system

Discussion in 'Windows 10' started by tavrez, Apr 11, 2018.

  1. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    47,027
    93,867
    450
    If you mean me by that one member, you know what the result is ;):D
     
  2. BlueScoop

    BlueScoop MDL Novice

    Apr 7, 2018
    31
    5
    0
    Thnx for the detailed explanation and example. Makes sense now :)...
     
  3. Atari800XL

    Atari800XL MDL Addicted

    Apr 3, 2011
    954
    1,673
    30
    No, I was thinking of somebody else, let me see if I can find the name...
     
  4. adric

    adric MDL Expert

    Jul 30, 2009
    1,244
    1,303
    60
    #24 adric, Apr 25, 2018
    Last edited: Apr 25, 2018
    Can this list also be used for Win7?
    Also, shouldn't \EFI also be removed?
     
  5. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,141
    84,319
    340
    Yes, with one exception, this should be excluded instead FontCache-S-1-5-21-*.dat
    Code:
    \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-FontFace.dat
    i don't do uefi installs to check
    but isn't efi have its own partition?
     
  6. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    18,682
    18,581
    340
  7. xinso

    xinso MDL Guru

    Mar 5, 2009
    12,531
    13,522
    340
    Solutions I prefer:
    Option 1. Use Dism++ for Hot backup
    Option 2: ELM + UWF

    Or both.
     
  8. medhat258

    medhat258 MDL Novice

    Mar 25, 2018
    13
    2
    0
    Use this command
    recimg /createimage E:\custom.refresh.image
    It is a Windows version that you can restore
    Anytime
    To know if you have a point of recovery or refreshing (recimg /showcurrent)
    To register a copy of its agent before (recimg /setcurrent "E:\custom.install.image")
     
  9. Wazoo

    Wazoo MDL Addicted

    Nov 5, 2013
    513
    273
    30
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. MrTweek

    MrTweek MDL Junior Member

    Apr 13, 2010
    55
    19
    0
  11. GodHand

    GodHand MDL Addicted

    Jul 15, 2016
    534
    926
    30
    Here's my PowerShell function I use to capture images.

    Code:
    Function New-ImageCapture {
        <#
            .SYNOPSIS
                Creates image (WIM) captures of both data directories and partitions.
           
            .DESCRIPTION
                Creates data image captures that can be used in unattend.xml answer files, or just to back up important files and directories to a WIM file.
                Creates full OS partition image captures that can then be used with the Expand-Image function to apply it to a virtual or physical drive.
                Supports full WinPE image capturing that can be used to capture custom WinPE builds and are marked as bootable.
           
            .PARAMETER CapturePath
                The full path to the data or drive to be captured.
           
            .PARAMETER ImagePath
                The full path to the directory where the captured image will be saved to.
           
            .PARAMETER ImageName
                Sets the name of the captured image.
           
            .PARAMETER Compression
                The type of compression to use when capturing.
           
            .PARAMETER Bootable
                Marks the volume as bootable. This is only applicable to WinPE captures.
           
            .PARAMETER SysPrepped
                Changes the WimScript.ini to one that incorporates more exclusions to include files and folders that may have been created during the System Preperation process.
           
            .PARAMETER Force
                Overwrites an existing image of the same name.
           
            .EXAMPLE
                PS C:\> D:\Important Docs | New-ImageCapture
           
            .EXAMPLE
                PS C:\> H: | New-ImageCapture
           
            .EXAMPLE
                PS C:\> New-ImageCapture -CapturePath "C:\Tools and Utilities" -ImagePath D:\Captures\MyNewCapture -ImageName "Custom Tools and Utilities"
           
            .EXAMPLE
                PS C:\> New-ImageCapture -CapturePath C:\WinPE_Build -ImagePath "C:\Custom WinPE" -ImageName "Custom WinPE" -Compression Maximum -Bootable
           
            .EXAMPLE
                PS C:\> New-ImageCapture -CapturePath H: -ImagePath "D:\Windows Captures\Windows10Pro" -ImageName "Windows 10 Pro Capture" -Compression Fast -SysPrepped
           
            .NOTES
                Accepts pipeline arguments so the end-user can quickly create a data or partition capture. These captures are saved to the default Temp directory ($Env:TEMP).
                Image capture default names are created by formatting the Get-Date output to a string value, which prevents the chances of any image name already existing during the capture of a new image.
        #>
        [CmdletBinding()]
        [OutputType([System.Object])]
        Param
        (
            [Parameter(Mandatory = $true,
                ValueFromPipeline = $true,
                ValueFromPipelineByPropertyName = $true,
                Position = 0,
                HelpMessage = 'The full path to the data or drive to be captured.')]
            [ValidateScript( {
                    If (Test-Path $(Resolve-Path $_) -Pathtype Container) { $_ }
                    Else { Throw "$_ is not a resolvable path." }
                })]
            [ValidateNotNullOrEmpty()]
            [string]$CapturePath,
            [Parameter(Mandatory = $false,
                Position = 1,
                HelpMessage = 'The full path to the directory where the captured image will be saved to.')]
            [ValidateNotNullOrEmpty()]
            [string]$ImagePath = "$Env:TEMP\ImageCapture_$((Get-Date).ToString('MMddyyyy-hhmmss'))",
            [Parameter(Mandatory = $false,
                HelpMessage = 'Sets the name of the captured image.')]
            [string]$ImageName = "ImageCapture_$((Get-Date).ToString('MMddyyyy-hhmmss'))",
            [Parameter(HelpMessage = 'The type of compression to use when capturing.')]
            [ValidateSet('Fast', 'Maximum', 'None')]
            [string]$Compression = 'Fast',
            [Parameter(HelpMessage = 'Marks the volume as bootable. This is only applicable to WinPE captures')]
            [switch]$Bootable,
            [Parameter(HelpMessage = 'Uses a WimScript.ini that incorporates more exclusions.')]
            [switch]$SysPrepped,
            [Parameter(HelpMessage = 'Overwrites an existing image of the same name.')]
            [switch]$Force
        )
       
        Begin {
            If (!([IO.FileInfo]$ImagePath).Extension) {
                $ImagePath = ([System.IO.Path]::ChangeExtension($ImagePath, ".wim"))
            }
            ElseIf (([IO.FileInfo]$ImagePath).Extension -eq ".WIM") {
                $ImagePath = ([System.IO.Path]::ChangeExtension($ImagePath, ([System.IO.Path]::GetExtension($ImagePath)).ToString().ToLower()))
            }
            Else {
                $GetExtension = ([System.IO.Path]::GetExtension($ImagePath))
                Write-Host "Unsupported extension: '${GetExtension}'" -ForegroundColor Red
                Break
            }
            If ((Test-Path -Path ${ImagePath} -PathType Leaf) -and (!$Force)) {
                Write-Host "${ImagePath} already exists. The -Force switch must be used to overwrite it." -ForegroundColor Red
                Break
            }
            ElseIf ((Test-Path -Path ${ImagePath} -PathType Leaf) -and ($Force)) {
                Remove-Item -Path ${ImagePath} -Confirm:$false -Force
            }
            $Timer = New-Object System.Diagnostics.Stopwatch
            If ($SysPrepped) {
                $WimScript = @'
    [ExclusionList]
    \hiberfil.sys
    \pagefile.sys
    \swapfile.sys
    \System Volume Information
    \$Recycle.Bin\*
    \Recycler
    \Recycled
    \Windows\CSC
    \winpepge.sys
    \$windows.~ls
    \$windows.~bt
    \Boot
    \Recovery
    \Recovery.txt
    \bootsect.bak
    \ProgramData\Microsoft\Diagnosis\ETLLogs\*
    \ProgramData\Microsoft\Network\Downloader\*
    \ProgramData\Microsoft\Windows\SQM
    \Users\Administrator
    \Users\*\NTUSER.DAT*.TM.blf
    \Users\*\NTUSER.DAT*.regtrans-ms
    \Users\*\NTUSER.DAT*.log*
    \Users\*\AppData\Local\Microsoft\Windows\Explorer\*.etl
    \Users\*\AppData\Local\Microsoft\Windows\INetCache\IE\*
    \Users\*\AppData\Local\Microsoft\Windows\WebCache\*
    \Users\*\AppData\Local\Microsoft\Terminal Server Client\Cache\*
    \Windows\AppCompat\Programs\Amcache.hve*.TM.blf
    \Windows\AppCompat\Programs\Amcache.hve*.regtrans-ms
    \Windows\AppCompat\Programs\Amcache.hve*.log*
    \Windows\CSC
    \Windows\Debug\*
    \Windows\inf\*.etl
    \Windows\inf\*.ev*
    \Windows\inf\*.log
    \Windows\Logs\CBS\*
    \Windows\Logs\DISM
    \Windows\Logs\DPX
    \Windows\Logs\dosvc\*
    \Windows\Logs\WindowsUpdate\*
    \Windows\Logs\PBR
    \Windows\Logs\*.log
    \Windows\Microsoft.NET\Framework\v2.0.50727\*.log
    \Windows\Microsoft.NET\Framework\v4.0.30319\*.log
    \Windows\Microsoft.NET\Framework64\v2.0.50727\*.log
    \Windows\Microsoft.NET\Framework64\v4.0.30319\*.log
    \Windows\Panther\*.etl
    \Windows\Panther\*.log
    \Windows\Panther\FastCleanup
    \Windows\Panther\img
    \Windows\Panther\Licenses
    \Windows\Panther\MigLog*.xml
    \Windows\Panther\Resources
    \Windows\Panther\Rollback
    \Windows\Panther\Setup*
    \Windows\Panther\UnattendGC
    \Windows\Panther\upgradematrix
    \Windows\Prefetch\*
    \Windows\security\database\*.chk
    \Windows\security\database\*.log
    \Windows\security\database\*.jrs
    \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-*.dat
    \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.TM.blf
    \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.regtrans-ms
    \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.log*
    \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.TM.blf
    \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.regtrans-ms
    \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.log*
    \Windows\servicing\Packages\wuindex.xml
    \Windows\servicing\Sessions\*_*.xml
    \Windows\servicing\Sessions\Sessions.back.xml
    \Windows\SoftwareDistribution
    \Windows\System32\catroot2\*.txt
    \Windows\System32\catroot2\*.chk
    \Windows\System32\catroot2\*.log
    \Windows\System32\catroot2\*.jrs
    \Windows\System32\config\*.TM.blf
    \Windows\System32\config\*.regtrans-ms
    \Windows\System32\config\*.log*
    \Windows\System32\config\RegBack\*
    \Windows\System32\config\systemprofile\*.TM.blf
    \Windows\System32\config\systemprofile\*.regtrans-ms
    \Windows\System32\config\systemprofile\*.log*
    \Windows\System32\config\TxR\*.blf
    \Windows\System32\config\TxR\*.regtrans-ms
    \Windows\System32\CodeIntegrity\bootcat.cache
    \Windows\System32\LogFiles\AIT\*
    \Windows\System32\LogFiles\SQM\*
    \Windows\System32\LogFiles\WMI\RtBackup\*.etl
    \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.TM.blf
    \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.regtrans-ms
    \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.log*
    \Windows\System32\Sysprep\Panther
    \Windows\System32\Sysprep\Sysprep_succeeded.tag
    \Windows\System32\wdi\LogFiles\*
    \Windows\System32\wfp\*.etl
    \Windows\System32\winevt\Logs\*
    \Windows\System32\winevt\TraceFormat\*
    \Windows\Temp\*
    \Windows\WinSxS\ManifestCache\*
    \Windows\WinSxS\Temp\*
    \Windows\*.log
    
    [CompressionExclusionList]
    *.mp3
    *.zip
    *.cab
    *.wmv
    *.wma
    *.wim
    *.swm
    *.dvr-ms
    \windows\inf\*.pnf
    *.rar
    *.7z
    '@
                $ScriptPath = Join-Path -Path $Env:TEMP -ChildPath "WimScript.ini"
                Set-Content -Path $ScriptPath -Value $WimScript -Encoding UTF8 -Force
                $WimConfig = "$Env:TEMP\WimScript.ini"
            }
            Else {
                $WimScript = @'
    [ExclusionList]
    \$WINDOWS.~BT
    \$WINDOWS.~LS
    \WINPEPGE.SYS
    \$NTFS.LOG
    \WINDOWS\CSC
    \RECYCLED
    \RECYCLER
    \$RECYCLE.BIN\*
    \SYSTEM VOLUME INFORMATION
    \SWAPFILE.SYS
    \PAGEFILE.SYS
    \HIBERFIL.SYS
       
    [CompressionExclusionList]
    *.MP3
    *.ZIP
    *.CAB
    *.RAR
    *.7Z
    *.PNF
    *.WIM
    '@
                $ScriptPath = Join-Path -Path $Env:TEMP -ChildPath "WimScript.ini"
                Set-Content -Path $ScriptPath -Value $WimScript -Encoding UTF8 -Force
                $WimConfig = "$Env:TEMP\WimScript.ini"
            }
            Switch ($Compression) {
                'Fast' {
                    $CompressType = "Fast"
                }
                'Maximum' {
                    $CompressType = "Maximum"
                }
                'None' {
                    $CompressType = "None"
                }
            }
        }
        Process {
            If ($Bootable) {
                $BootableCapture = @{
                    CapturePath           = ${CapturePath}
                    ImagePath              = ${ImagePath}
                    Name                      = ${ImageName}
                    CheckIntegrity        = $true
                    CompressionType  = ${CompressType}
                    ConfigFilePath       = ${WimConfig}
                    Setbootable           = $true
                    Verify                     = $true
                }
                Write-Host ('Capturing {0} using {1} compression.' -f $CapturePath, $CompressType) -ForegroundColor Cyan
                $Timer.Start()
                $HOST.UI.RawUI.WindowTitle = "Capturing new image."
                [void](New-WindowsImage @BootableCapture)
                Write-Host ('{0} has been captured to {1} and marked as bootable.' -f $CapturePath, $ImagePath) -ForegroundColor Cyan
                $Timer.Stop()
                Write-Host "Completed in: [$($Timer.Elapsed.ToString())]" -ForegroundColor Yellow
            }
            Else {
                $NonBootableCapture = @{
                    CapturePath           = ${CapturePath}
                    ImagePath              = ${ImagePath}
                    Name                      = ${ImageName}
                    CheckIntegrity        = $true
                    CompressionType  = ${CompressType}
                    ConfigFilePath       = ${WimConfig}
                    Verify                     = $true
                }
                Write-Host ('Capturing {0} using {1} compression.' -f $CapturePath, $CompressType) -ForegroundColor Cyan
                $Timer.Start()
                $HOST.UI.RawUI.WindowTitle = "Capturing new image."
                [void](New-WindowsImage @NonBootableCapture)
                Write-Host ('{0} has been captured to {1}' -f $CapturePath, $ImagePath) -ForegroundColor Cyan
                $Timer.Stop()
                Write-Host "Completed in: [$($Timer.Elapsed.ToString())]" -ForegroundColor Yellow
            }
        }
        End {
            If (Test-Path -Path $WimConfig) {
                Remove-Item -Path $WimConfig -Force
            }
        }
    }
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. MrTweek

    MrTweek MDL Junior Member

    Apr 13, 2010
    55
    19
    0
    #32 MrTweek, May 5, 2018
    Last edited: May 6, 2018
    Thanks, for the script output... I updated my wimscript.ini.. and recapturing my image...
    Edit:
    I tested your wimscript.entries in the powershell script. Some of the Points are that the Features which was enabled, are now disabled.(Like Hyper-V)

    Code:
    WIM Information:
    ---------------------
    GUID:        {3A908422-CD51-45D6-BB49-97525403C03C}
    Image Count:    1
    Compression:    LZX
    Part Number:    1/1
    Attributes:    0x8
            RP_FIX
    
    Image Index: 1
    -------------------
    Name:        Windows 10 Enterprise LTSB (x64) - System
    Description:    Windows 10 Enterprise LTSB (x64) - System
    Flags:        ENTERPRISES
    Files:        243146
    Folders:        60393
    Expanded Size:    38997 MB
    
    
    WIM XML Information:
    ---------------------------
    <WIM>
      <TOTALBYTES>13815185407</TOTALBYTES>
      <IMAGE INDEX="1">
        <FLAGS>ENTERPRISES</FLAGS>
        <DIRCOUNT>60393</DIRCOUNT>
        <FILECOUNT>243146</FILECOUNT>
        <TOTALBYTES>40891589741</TOTALBYTES>
        <HARDLINKBYTES>6245806960</HARDLINKBYTES>
        <CREATIONTIME>
          <HIGHPART>0x01D3E4F3</HIGHPART>
          <LOWPART>0x189FDEAF</LOWPART>
        </CREATIONTIME>
        <LASTMODIFICATIONTIME>
          <HIGHPART>0x01D3E4F3</HIGHPART>
          <LOWPART>0x1E2A18F1</LOWPART>
        </LASTMODIFICATIONTIME>
        <WIMBOOT>0</WIMBOOT>
        <WINDOWS>
          <ARCH>9</ARCH>
          <PRODUCTNAME>Betriebssystem Microsoft® Windows®</PRODUCTNAME>
          <EDITIONID>EnterpriseS</EDITIONID>
          <INSTALLATIONTYPE>Client</INSTALLATIONTYPE>
          <SERVICINGDATA>
            <GDRDUREVISION>0</GDRDUREVISION>
            <PKEYCONFIGVERSION>10.0.14393.576;2016-01-01T00:00:00Z</PKEYCONFIGVERSION>
          </SERVICINGDATA>
          <HAL>acpiapic</HAL>
          <PRODUCTTYPE>WinNT</PRODUCTTYPE>
          <PRODUCTSUITE>Terminal Server</PRODUCTSUITE>
          <LANGUAGES>
            <LANGUAGE>de-DE</LANGUAGE>
            <FALLBACK LANGUAGE="de-DE">en-US</FALLBACK>
            <DEFAULT>de-DE</DEFAULT>
          </LANGUAGES>
          <VERSION>
            <MAJOR>10</MAJOR>
            <MINOR>0</MINOR>
            <BUILD>14393</BUILD>
            <SPBUILD>2214</SPBUILD>
            <SPLEVEL>0</SPLEVEL>
          </VERSION>
          <SYSTEMROOT>WINDOWS</SYSTEMROOT>
        </WINDOWS>
        <NAME>Windows 10 Enterprise LTSB (x64) - System</NAME>
        <DESCRIPTION>Windows 10 Enterprise LTSB (x64) - System</DESCRIPTION>
        <DISPLAYNAME>Windows 10 Enterprise LTSB (x64) - System</DISPLAYNAME>
        <DISPLAYDESCRIPTION>Windows 10 Enterprise LTSB (x64) - System</DISPLAYDESCRIPTION>
      </IMAGE>
    </WIM>
    
     
  13. taviruni

    taviruni MDL Senior Member

    May 8, 2010
    261
    248
    10
    #34 taviruni, May 7, 2018
    Last edited: May 7, 2018
    @tavrez

    If the problem is just make your sister PC boot again when she desconfigure it, you really do not need to sysprep the OS, you only need to install everything and get a good free backup program and make a backup image with it.
    Backup image can be located on a partition of your HDD or on a external device. Then when needed only restore the image made and problem solved.

    I also saw you are asking what is a WinPE, if you want to learn a few more about WinPE's I think you may start looking this thread, there is very good info and documents on the downloads on it: https://forums.mydigitallife.net/threads/chrispe-a-pebakery-team-release.76569/

    taviruni
     
  14. AeonX

    AeonX MDL Addicted

    May 24, 2013
    793
    719
    30
    And for Windows 8.1? Both files exist before (original install.wim) and after capture.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,141
    84,319
    340
    8.1 same as 10, FontCache-S-1-5-21-*.dat to be excluded

    recent W10 builds also need this for exclusion
    Code:
    \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\*
     
  16. AeonX

    AeonX MDL Addicted

    May 24, 2013
    793
    719
    30
    I was referring to FontCache-FontFace.dat as well. I am thinking of exclude FontCache-FontFace.dat and FontCache-S-1-5-21-*.dat and only use a wimscript.ini for Win7, 8.1 and 10.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,141
    84,319
    340
    FontCache-FontFace.dat is RTM inbox in Windows 8.1
     
  18. AeonX

    AeonX MDL Addicted

    May 24, 2013
    793
    719
    30
    Ok, thanks!!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  19. colinzim

    colinzim MDL Senior Member

    May 14, 2007
    461
    114
    10
    deleted