Yes, with one exception, this should be excluded instead FontCache-S-1-5-21-*.dat Code: \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-FontFace.dat i don't do uefi installs to check but isn't efi have its own partition?
Use this command recimg /createimage E:\custom.refresh.image It is a Windows version that you can restore Anytime To know if you have a point of recovery or refreshing (recimg /showcurrent) To register a copy of its agent before (recimg /setcurrent "E:\custom.install.image")
Here's my PowerShell function I use to capture images. Code: Function New-ImageCapture { <# .SYNOPSIS Creates image (WIM) captures of both data directories and partitions. .DESCRIPTION Creates data image captures that can be used in unattend.xml answer files, or just to back up important files and directories to a WIM file. Creates full OS partition image captures that can then be used with the Expand-Image function to apply it to a virtual or physical drive. Supports full WinPE image capturing that can be used to capture custom WinPE builds and are marked as bootable. .PARAMETER CapturePath The full path to the data or drive to be captured. .PARAMETER ImagePath The full path to the directory where the captured image will be saved to. .PARAMETER ImageName Sets the name of the captured image. .PARAMETER Compression The type of compression to use when capturing. .PARAMETER Bootable Marks the volume as bootable. This is only applicable to WinPE captures. .PARAMETER SysPrepped Changes the WimScript.ini to one that incorporates more exclusions to include files and folders that may have been created during the System Preperation process. .PARAMETER Force Overwrites an existing image of the same name. .EXAMPLE PS C:\> D:\Important Docs | New-ImageCapture .EXAMPLE PS C:\> H: | New-ImageCapture .EXAMPLE PS C:\> New-ImageCapture -CapturePath "C:\Tools and Utilities" -ImagePath D:\Captures\MyNewCapture -ImageName "Custom Tools and Utilities" .EXAMPLE PS C:\> New-ImageCapture -CapturePath C:\WinPE_Build -ImagePath "C:\Custom WinPE" -ImageName "Custom WinPE" -Compression Maximum -Bootable .EXAMPLE PS C:\> New-ImageCapture -CapturePath H: -ImagePath "D:\Windows Captures\Windows10Pro" -ImageName "Windows 10 Pro Capture" -Compression Fast -SysPrepped .NOTES Accepts pipeline arguments so the end-user can quickly create a data or partition capture. These captures are saved to the default Temp directory ($Env:TEMP). Image capture default names are created by formatting the Get-Date output to a string value, which prevents the chances of any image name already existing during the capture of a new image. #> [CmdletBinding()] [OutputType([System.Object])] Param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, Position = 0, HelpMessage = 'The full path to the data or drive to be captured.')] [ValidateScript( { If (Test-Path $(Resolve-Path $_) -Pathtype Container) { $_ } Else { Throw "$_ is not a resolvable path." } })] [ValidateNotNullOrEmpty()] [string]$CapturePath, [Parameter(Mandatory = $false, Position = 1, HelpMessage = 'The full path to the directory where the captured image will be saved to.')] [ValidateNotNullOrEmpty()] [string]$ImagePath = "$Env:TEMP\ImageCapture_$((Get-Date).ToString('MMddyyyy-hhmmss'))", [Parameter(Mandatory = $false, HelpMessage = 'Sets the name of the captured image.')] [string]$ImageName = "ImageCapture_$((Get-Date).ToString('MMddyyyy-hhmmss'))", [Parameter(HelpMessage = 'The type of compression to use when capturing.')] [ValidateSet('Fast', 'Maximum', 'None')] [string]$Compression = 'Fast', [Parameter(HelpMessage = 'Marks the volume as bootable. This is only applicable to WinPE captures')] [switch]$Bootable, [Parameter(HelpMessage = 'Uses a WimScript.ini that incorporates more exclusions.')] [switch]$SysPrepped, [Parameter(HelpMessage = 'Overwrites an existing image of the same name.')] [switch]$Force ) Begin { If (!([IO.FileInfo]$ImagePath).Extension) { $ImagePath = ([System.IO.Path]::ChangeExtension($ImagePath, ".wim")) } ElseIf (([IO.FileInfo]$ImagePath).Extension -eq ".WIM") { $ImagePath = ([System.IO.Path]::ChangeExtension($ImagePath, ([System.IO.Path]::GetExtension($ImagePath)).ToString().ToLower())) } Else { $GetExtension = ([System.IO.Path]::GetExtension($ImagePath)) Write-Host "Unsupported extension: '${GetExtension}'" -ForegroundColor Red Break } If ((Test-Path -Path ${ImagePath} -PathType Leaf) -and (!$Force)) { Write-Host "${ImagePath} already exists. The -Force switch must be used to overwrite it." -ForegroundColor Red Break } ElseIf ((Test-Path -Path ${ImagePath} -PathType Leaf) -and ($Force)) { Remove-Item -Path ${ImagePath} -Confirm:$false -Force } $Timer = New-Object System.Diagnostics.Stopwatch If ($SysPrepped) { $WimScript = @' [ExclusionList] \hiberfil.sys \pagefile.sys \swapfile.sys \System Volume Information \$Recycle.Bin\* \Recycler \Recycled \Windows\CSC \winpepge.sys \$windows.~ls \$windows.~bt \Boot \Recovery \Recovery.txt \bootsect.bak \ProgramData\Microsoft\Diagnosis\ETLLogs\* \ProgramData\Microsoft\Network\Downloader\* \ProgramData\Microsoft\Windows\SQM \Users\Administrator \Users\*\NTUSER.DAT*.TM.blf \Users\*\NTUSER.DAT*.regtrans-ms \Users\*\NTUSER.DAT*.log* \Users\*\AppData\Local\Microsoft\Windows\Explorer\*.etl \Users\*\AppData\Local\Microsoft\Windows\INetCache\IE\* \Users\*\AppData\Local\Microsoft\Windows\WebCache\* \Users\*\AppData\Local\Microsoft\Terminal Server Client\Cache\* \Windows\AppCompat\Programs\Amcache.hve*.TM.blf \Windows\AppCompat\Programs\Amcache.hve*.regtrans-ms \Windows\AppCompat\Programs\Amcache.hve*.log* \Windows\CSC \Windows\Debug\* \Windows\inf\*.etl \Windows\inf\*.ev* \Windows\inf\*.log \Windows\Logs\CBS\* \Windows\Logs\DISM \Windows\Logs\DPX \Windows\Logs\dosvc\* \Windows\Logs\WindowsUpdate\* \Windows\Logs\PBR \Windows\Logs\*.log \Windows\Microsoft.NET\Framework\v2.0.50727\*.log \Windows\Microsoft.NET\Framework\v4.0.30319\*.log \Windows\Microsoft.NET\Framework64\v2.0.50727\*.log \Windows\Microsoft.NET\Framework64\v4.0.30319\*.log \Windows\Panther\*.etl \Windows\Panther\*.log \Windows\Panther\FastCleanup \Windows\Panther\img \Windows\Panther\Licenses \Windows\Panther\MigLog*.xml \Windows\Panther\Resources \Windows\Panther\Rollback \Windows\Panther\Setup* \Windows\Panther\UnattendGC \Windows\Panther\upgradematrix \Windows\Prefetch\* \Windows\security\database\*.chk \Windows\security\database\*.log \Windows\security\database\*.jrs \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-*.dat \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.TM.blf \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.regtrans-ms \Windows\ServiceProfiles\LocalService\NTUSER.DAT*.log* \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.TM.blf \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.regtrans-ms \Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.log* \Windows\servicing\Packages\wuindex.xml \Windows\servicing\Sessions\*_*.xml \Windows\servicing\Sessions\Sessions.back.xml \Windows\SoftwareDistribution \Windows\System32\catroot2\*.txt \Windows\System32\catroot2\*.chk \Windows\System32\catroot2\*.log \Windows\System32\catroot2\*.jrs \Windows\System32\config\*.TM.blf \Windows\System32\config\*.regtrans-ms \Windows\System32\config\*.log* \Windows\System32\config\RegBack\* \Windows\System32\config\systemprofile\*.TM.blf \Windows\System32\config\systemprofile\*.regtrans-ms \Windows\System32\config\systemprofile\*.log* \Windows\System32\config\TxR\*.blf \Windows\System32\config\TxR\*.regtrans-ms \Windows\System32\CodeIntegrity\bootcat.cache \Windows\System32\LogFiles\AIT\* \Windows\System32\LogFiles\SQM\* \Windows\System32\LogFiles\WMI\RtBackup\*.etl \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.TM.blf \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.regtrans-ms \Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.log* \Windows\System32\Sysprep\Panther \Windows\System32\Sysprep\Sysprep_succeeded.tag \Windows\System32\wdi\LogFiles\* \Windows\System32\wfp\*.etl \Windows\System32\winevt\Logs\* \Windows\System32\winevt\TraceFormat\* \Windows\Temp\* \Windows\WinSxS\ManifestCache\* \Windows\WinSxS\Temp\* \Windows\*.log [CompressionExclusionList] *.mp3 *.zip *.cab *.wmv *.wma *.wim *.swm *.dvr-ms \windows\inf\*.pnf *.rar *.7z '@ $ScriptPath = Join-Path -Path $Env:TEMP -ChildPath "WimScript.ini" Set-Content -Path $ScriptPath -Value $WimScript -Encoding UTF8 -Force $WimConfig = "$Env:TEMP\WimScript.ini" } Else { $WimScript = @' [ExclusionList] \$WINDOWS.~BT \$WINDOWS.~LS \WINPEPGE.SYS \$NTFS.LOG \WINDOWS\CSC \RECYCLED \RECYCLER \$RECYCLE.BIN\* \SYSTEM VOLUME INFORMATION \SWAPFILE.SYS \PAGEFILE.SYS \HIBERFIL.SYS [CompressionExclusionList] *.MP3 *.ZIP *.CAB *.RAR *.7Z *.PNF *.WIM '@ $ScriptPath = Join-Path -Path $Env:TEMP -ChildPath "WimScript.ini" Set-Content -Path $ScriptPath -Value $WimScript -Encoding UTF8 -Force $WimConfig = "$Env:TEMP\WimScript.ini" } Switch ($Compression) { 'Fast' { $CompressType = "Fast" } 'Maximum' { $CompressType = "Maximum" } 'None' { $CompressType = "None" } } } Process { If ($Bootable) { $BootableCapture = @{ CapturePath = ${CapturePath} ImagePath = ${ImagePath} Name = ${ImageName} CheckIntegrity = $true CompressionType = ${CompressType} ConfigFilePath = ${WimConfig} Setbootable = $true Verify = $true } Write-Host ('Capturing {0} using {1} compression.' -f $CapturePath, $CompressType) -ForegroundColor Cyan $Timer.Start() $HOST.UI.RawUI.WindowTitle = "Capturing new image." [void](New-WindowsImage @BootableCapture) Write-Host ('{0} has been captured to {1} and marked as bootable.' -f $CapturePath, $ImagePath) -ForegroundColor Cyan $Timer.Stop() Write-Host "Completed in: [$($Timer.Elapsed.ToString())]" -ForegroundColor Yellow } Else { $NonBootableCapture = @{ CapturePath = ${CapturePath} ImagePath = ${ImagePath} Name = ${ImageName} CheckIntegrity = $true CompressionType = ${CompressType} ConfigFilePath = ${WimConfig} Verify = $true } Write-Host ('Capturing {0} using {1} compression.' -f $CapturePath, $CompressType) -ForegroundColor Cyan $Timer.Start() $HOST.UI.RawUI.WindowTitle = "Capturing new image." [void](New-WindowsImage @NonBootableCapture) Write-Host ('{0} has been captured to {1}' -f $CapturePath, $ImagePath) -ForegroundColor Cyan $Timer.Stop() Write-Host "Completed in: [$($Timer.Elapsed.ToString())]" -ForegroundColor Yellow } } End { If (Test-Path -Path $WimConfig) { Remove-Item -Path $WimConfig -Force } } }
Thanks, for the script output... I updated my wimscript.ini.. and recapturing my image... Edit: I tested your wimscript.entries in the powershell script. Some of the Points are that the Features which was enabled, are now disabled.(Like Hyper-V) Code: WIM Information: --------------------- GUID: {3A908422-CD51-45D6-BB49-97525403C03C} Image Count: 1 Compression: LZX Part Number: 1/1 Attributes: 0x8 RP_FIX Image Index: 1 ------------------- Name: Windows 10 Enterprise LTSB (x64) - System Description: Windows 10 Enterprise LTSB (x64) - System Flags: ENTERPRISES Files: 243146 Folders: 60393 Expanded Size: 38997 MB WIM XML Information: --------------------------- <WIM> <TOTALBYTES>13815185407</TOTALBYTES> <IMAGE INDEX="1"> <FLAGS>ENTERPRISES</FLAGS> <DIRCOUNT>60393</DIRCOUNT> <FILECOUNT>243146</FILECOUNT> <TOTALBYTES>40891589741</TOTALBYTES> <HARDLINKBYTES>6245806960</HARDLINKBYTES> <CREATIONTIME> <HIGHPART>0x01D3E4F3</HIGHPART> <LOWPART>0x189FDEAF</LOWPART> </CREATIONTIME> <LASTMODIFICATIONTIME> <HIGHPART>0x01D3E4F3</HIGHPART> <LOWPART>0x1E2A18F1</LOWPART> </LASTMODIFICATIONTIME> <WIMBOOT>0</WIMBOOT> <WINDOWS> <ARCH>9</ARCH> <PRODUCTNAME>Betriebssystem Microsoft® Windows®</PRODUCTNAME> <EDITIONID>EnterpriseS</EDITIONID> <INSTALLATIONTYPE>Client</INSTALLATIONTYPE> <SERVICINGDATA> <GDRDUREVISION>0</GDRDUREVISION> <PKEYCONFIGVERSION>10.0.14393.576;2016-01-01T00:00:00Z</PKEYCONFIGVERSION> </SERVICINGDATA> <HAL>acpiapic</HAL> <PRODUCTTYPE>WinNT</PRODUCTTYPE> <PRODUCTSUITE>Terminal Server</PRODUCTSUITE> <LANGUAGES> <LANGUAGE>de-DE</LANGUAGE> <FALLBACK LANGUAGE="de-DE">en-US</FALLBACK> <DEFAULT>de-DE</DEFAULT> </LANGUAGES> <VERSION> <MAJOR>10</MAJOR> <MINOR>0</MINOR> <BUILD>14393</BUILD> <SPBUILD>2214</SPBUILD> <SPLEVEL>0</SPLEVEL> </VERSION> <SYSTEMROOT>WINDOWS</SYSTEMROOT> </WINDOWS> <NAME>Windows 10 Enterprise LTSB (x64) - System</NAME> <DESCRIPTION>Windows 10 Enterprise LTSB (x64) - System</DESCRIPTION> <DISPLAYNAME>Windows 10 Enterprise LTSB (x64) - System</DISPLAYNAME> <DISPLAYDESCRIPTION>Windows 10 Enterprise LTSB (x64) - System</DISPLAYDESCRIPTION> </IMAGE> </WIM>
@tavrez If the problem is just make your sister PC boot again when she desconfigure it, you really do not need to sysprep the OS, you only need to install everything and get a good free backup program and make a backup image with it. Backup image can be located on a partition of your HDD or on a external device. Then when needed only restore the image made and problem solved. I also saw you are asking what is a WinPE, if you want to learn a few more about WinPE's I think you may start looking this thread, there is very good info and documents on the downloads on it: https://forums.mydigitallife.net/threads/chrispe-a-pebakery-team-release.76569/ taviruni
8.1 same as 10, FontCache-S-1-5-21-*.dat to be excluded recent W10 builds also need this for exclusion Code: \Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\*
I was referring to FontCache-FontFace.dat as well. I am thinking of exclude FontCache-FontFace.dat and FontCache-S-1-5-21-*.dat and only use a wimscript.ini for Win7, 8.1 and 10.