MSMG ToolKit

Hi @JeepWillys58,

I suppose I could publish it, but perhaps GitHub is not the best place to put it to (in the sense that I am not certain if there would be any implications).
Perhaps I open a new topic here.
While it is pretty much production ready (need to add one more thing for which I haven't decided which route to take yet), I have been only using it on Virtual Machines and stopped working on it some months back when I discovered the issue I reported above.
The updates are being applied successfully and no breakage of the system was detected in the latest revisions.
(Technically speaking I could "patch everything" on my end, but I prefer having the issue resolved at the source of origin - so here - and not to build up countless workarounds that may show up later as well).
The usage of the script (PowerShell) is super simple, but I still need to create a proper documentation so anyone can understand what is going on, because there is quite a lot actually.
One or two weeks should be enough, I suppose, if there is a real interest.[/QUOTE]

hello again my dear @tempdrive1

How cool would it be if you came to share this with us, absolutely on my part and I believe that many people are really interested in this, I personally don't have much knowledge in developing codes, but I am available and I propose to test it with absolute certainty.

I look forward to your contact, be it open or by PM.

A big hug and much success in everything you do, I'm sure "He" is always ahead illuminating your paths and your thoughts.

Kind Regards,
@JeepWillys58

 

Hi @MSMG,

Thank you so much for your attention, I understand exactly how much time and effort it takes to go after such issues, so I highly appreciate it along with all your work on this tool.

A small clarification with regards to my script that is intended to mimic your tool's actions on a live system: it does not modify the system's internal updating behavior in any way.
What it exactly does is working with pending.xml, migration.xml (sysprep.xml and others are yet to be looked after), Registry keys, and some files prepared/allocated by the update itself, and in its current state it does not touch things that were there prior calling the update.
Once the changes are undone/removed, the windows update process will try to work with the remaining parts and proceed as if the rest (that my script was touching) never existed.

I have returned to my scripts only recently, and also migrated to a new machine, so I will rebuild the base and do the testing again.
This should be done within the next 2 days, but before I do so, I would like to draw your attention to the following:

I think I noticed some misunderstanding on your end for the tests you have performed, which I believe would be the reason for the errors that you were encountering.
I have played with these Registry entries more than I would like admit - though only on a live system, not on the base image in an offline state while using your tool to answer your question -, and thus managed to build up my confidence to make these posts.
From what I understand based on your reply, you remove the values "i!CBS*" under the keys referenced, but it is crucial that the whole key is removed instead, e.g. [HKEY_LOCAL_MACHINE\components\CanonicalData\Deployments\dual_percep..nsixdof.inf_31bf3856ad364e35_10.0.19041.1_f4ec94a67cd216ca]
This may solve the trouble that you are facing with DISM and SFC.

To be more specific, you need to focus on these Registry paths:

MixedReality:
HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\dual_percep..nsixdof.inf_31bf3856ad364e35_10.0.19041.1_f4ec94a67cd216ca
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_dual_perceptionsimulationsixdof.inf_31bf3856ad364e35_10.0.19041.1_none_f4ec94a67cd216ca

Tsprint:
HKEY_LOCAL_MACHINE\COMPONENTS\CanonicalData\Deployments\dual_tsprint.inf_31bf3856ad364e35_10.0.19041.153_356ebfa943b1edf9
HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_dual_tsprint.inf_31bf3856ad364e35_10.0.19041.153_none_356ebfa943b1edf9

The highlighted key names are the folders you will find in WinSxS.
Though these components do have more folders and keys, these was the bare minimum to remove in order to solve the terminating error for /ScanHealth.

I did see some SFC fixing attempts, but they are these generic entries:

2023-02-23 18:52:10, Info CSI 0000005b [SR] Verifying 100 components
2023-02-23 18:52:10, Info CSI 0000005c [SR] Beginning Verify and Repair transaction
2023-02-23 18:52:11, Info CSI 0000005d [SR] Verify complete

After calling SFC again, they will not appear anymore.
I suppose this may be the ghost error everyone talks about.

Needless to say, this makes no difference as I have noticed during my latest tests, but I perform SFC check to be certain that no error left on the system nevertheless.

As for ResetBase: I did not disable ResetBase by applying DisableResetbase"=dword:00000000", and I intentionally called DISM /Cleanup-Image /StartComponentCleanup with the /Resetbase switch.
I would like to disclose a few things regarding this:
- scenario 1: on a system, where you do a normal windows update, which restores the removed components, ResetBase will not cause any issues
- scenario 2: on a system, where I cleanup MixedReality and tsprint leftovers (by removing the full registry keys and winsxs files) and I perform the partial update (excluding the removed components), I did not notice any issues
- in case both of the above (scenario 1 and scenario 2), /ResetBase and /ScanHealth completes successfully
- scenario 3: on a system that I deploy partial update (excluding the removed components) but do not take manual actions (by removing the above specified full registry keys and winsxs files) to cleanup MixedReality and tsprint leftovers, /ResetBase still completes, but /ScanHealth will break down
- SFC did not fail in any scenarios, but it did mostly the invisible fixes (normally it would list in the CBS.log what it did fix, and for my own earlier failed update attempts it was actually fixing a lot of things)


More technical details with regards to scenario 3, just focusing on MixedReality this time:
c:\Windows\WinSxS\amd64_dual_perceptionsimulationsixdof.inf_31bf3856ad364e35_10.0.19041.1_none_f4ec94a67cd216ca has inf file(s) with human readable content by default.
When /ResetBase is used with my custom update deployment, the content of these files will be "restored" to some encrypted (or perhaps corrupted) format, where it is not readable anymore.
It may have to do something with the encryption applied to manifest files (c:\Windows\WinSxS\Manifests), but I am unsure to be honest.
So when /ScanHealth is called, CBS.log will show the follwing error that will terminate the process: STATUS_OBJECT_PATH_NOT_FOUND for '\SystemRoot\WinSxS\Temp\InFlight\201809f9b047d901180100006815a806\3803E232ACAB2476E81BC8A88D5B231A677DA3BC\PerceptionSimulationSixDof.inf'
The file c:\Windows\WinSxS\amd64_dual_perceptionsimulationsixdof.inf_31bf3856ad364e35_10.0.19041.1_none_f4ec94a67cd216ca\3803E232ACAB2476E81BC8A88D5B231A677DA3BC\PerceptionSimulationSixDof.inf will be there, however, and I think the reason behind the error is the corrupted file.
This is nothing but a pure guess at this point.
When an update is deployed in a standard way (Windows Update, .msu, .cab of the .msu) the system will restore the parts that were removed by your tool (sorry for repaiting myself, but it this part must be emphasized), hence this corruption will not appear, and this is the reason why people are not facing errors, since the system will "heal" itself.
I have to say, it is a nice way to standardize systems and minimize errors coming from discrepancies, but given that we don't like the system components, we are trying our best to "destroy" this process, and this is why it would be important to do it in the safest, most stable way possible.

Reminder: for you to reproduce my custom update, all you have to do is to remove the .cat and .mum files from the .cab files in the .msu, repackage the .cab file and deploy it with DISM.
Do this for MixedReality, because it is the easiest to achieve and will verified before tsprint anyway.
The error for tspint will only show up once MixedReality is resolved as the "missing files" (which aren't actually missing as stated just above) are terminating errors.

How I perform health checks (I rename the CBS.log and dism.log files after each step so it is very easy to review them):
0. I create the image with your tool, make sure MixedReality is not there, and install it (right after installing DISM /ResetBase and /Scanhealth with not do much, as the image I create was done with /ResetBase already)
1. install the partial update (use the .cab file without MixedReality component .cat and .mum files - you know, the Holographic* stuff) and reboot the machine so the deployment completes
2. wait about 5 minutes or so in order to let the post-update processes finish (you can see the marks for it in CBS.log) and perform SFC /SCANNOW and Dism.exe /Online /Cleanup-Image /ScanHealth
SFC will fix the ghost errors along with complaining about double owned directories, and I tend to see *_microsoft-windows-mediaplayer-skins_31bf3856ad364e35_10.0.19041.1_none_* related errors for /ScanHealth, which I thought for a very long time were the reason behind the final failure. This error is silent and does not terminate /ScanHealth
3. Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
This will complete without trouble. There are pretty much errors all the time regardless what you are doing, thanks to the advanced engineering performed on our favorite vendor's side, but they will be irrelevant if you look after them in CBS.log or dism.log
4. wait about 5 minutes or so in order to let the post-update processes finish (you can see the marks for it in CBS.log) and perform SFC /SCANNOW and Dism.exe /Online /Cleanup-Image /ScanHealth
SFC will again do the ghost errors along with complaining about double owned directories, but /ScanHealth will terminate with STATUS_OBJECT_PATH_NOT_FOUND #159450# from Windows::Rtl::SystemImplementation: DirectFileSystemProvider::SysCreateFile(flags = 0, handle = {provider=NULL, handle=0, name= ("null")}, da = (FILE_GENERIC_READ|FILE_WRITE_ATTRIBUTES|FILE_WRITE_EA|FILE_APPEND_DATA|FILE_WRITE_DATA), oa = @0x28f4b7b848->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[137]'\SystemRoot\WinSxS\Temp\InFlight\201809f9b047d901180100006815a806\3803E232ACAB2476E81BC8A88D5B231A677DA3BC\PerceptionSimulationSixDof.inf'; a OBJ_CASE_INSENS[gle=0xd000003a]
On the console it will display DISM Error 3.
Do note that /ScanHealth does restore files in the \WinSxS\Temp\InFlight folder, and whenever it gets terminated, it will not remove them and the space consumed will increate notably.
You can call /ScanHealth as many times as you want, the previous folders have no impact on it as they seem to be randomly (maybe seeded) regenerated.

Again, I would like to point out that even though I remove almost everything with your tool (I only keep Notepad, AppResolverUX, pretty much), once the tsprint and MixedReality issues are resolved, the errors are gone and no other component needs any of these workarounds, therefore I trust myself that what I am doing is not entirely wrong.
Also, do note that for the above steps you would not need to involve my script at all - you did a pretty much preventive approch by not letting windows update find anything to deploy for MixedReality.
It could be that this is still a flawled approach.
Technially speaking you must trigger something that the system recognizes as changes to it base state, and this would be one of them.
Calling /Resetbase on an system that has a resetbase performed already will not do anything, it finishes almost immediately.
The goal is still fixed nonetheless: remove components with your tool, and make sure they won't come back, while updating everything that was left there.

It is important to note that my last attempts were months ago, so I may not recall all details exactly even with my notes taken.
You can see from the log entries from above that they were lastly performed in February.
I can do any kind and amout of testing in a relatively short time, but only after this weekend.

Thank you for the clarification with regards to the Internet Explorer parts.
Given that the eventually old GPUs will be phased out, and security related aspects as well, could you perhaps include a separate option in the tool to remove everything that is not covered by the other option(s), so ie9props.propdesc, iernonce.dll, iertutil.dll, and anything else that was not covered but you are aware of?
I am certain that others would be interested in this as well, and it would greatly benefit my update script, too, along with reduced security risk on a live system (fewer executables and .dlls = less exploitable system) that it would bring.
I will perform tests for Windows Search part I am going to test what kind of impact it has on when I remove the file ie9props.propdesc, because I did remove it myself for a couple tests, but don't recall any notable side effects from it.
Feel free to be more specific what I should be looking for.

I kindly ask you to perform another test which resembles my steps provided in this response as identical as possible, and do let me know if there are mistakes made on my end.
If you don't mind, I will wait with additional testing until you confirm that it still does not work or have other concerns and need me to perform specific tests.
Either way, I am waiting for your next feedback.

 

Hi @MSMG,

I have a seperate bug report for Remove System Apps Menu.

Whenever I apply modifications entering the numbers there, Narrator Quick Start - QuickStart Guide for Narrator | Depends on: SpeechRecognition will be restored to "+" after it was displayed as "-".
Each time I set it to "-", it will be restored to "+" when I modify other entries.

This is the only place and option I have seen this behavior for, and it does not matter what base image I am using.
The Toolkit's version is 13.4, but I vaguely remember seeing this earlier already.
Given that it is in the latest version, I must assume it was not reported earlier.

Note: I have disabled everything in the other Remove menus, so I think it is not based on another entry which I should have turned off for this to work as intended.

 

You need to login to view this posts content.

 

@MSMG

There seems to be also a bug with Remove Multimedia Components Menu.
Disable Speech Recognition | Needed for: Cortana, Ease of Access, Narrator & Narrator Quick Start
Go Back, then to Remove System Apps Menu and immediately back to Remove Multimedia Components Menu.
Speech Recognition | Needed for: Cortana, Ease of Access, Narrator & Narrator Quick Start is reactivated again.

If it is relevant, encountered with Windows 10 22H2 19045.2965.

 

Hi @MSMG,

Thank you for the quick fix for the last reported bug (I would have never thought that such a "typo" would be causing this behavior).

I started performing tests as your previous post did raise some valid concerns.
It turns out that while the system is fine handling the adjustments I suggested, the updates, on the other hand, with explicit reference in the .mum files (from what I understand) will fail with a terminating ERROR_SXS_ASSEMBLY_MISSING error.
I was playing around with WinSxS and Registry combinations, and the only difference so far was whether the update was aborted or it was hanging forever, while still showing the same error in CBS.log.

I have some ideas and I wish to say that I already made progress, but it is a bit early to conclude and I also need to make some adjustments pending from earlier and adaptation based on some current results for my script, not to mention that I have learnt my lessons from early conclusions.
I do have some test scenarios in my mind (for both the normal user updating path and mine), but it will take some days to go through them at best.

I just wanted to give you a heads up that unfortunately this issue is a little more complex than I anticipated based on my initial success.
If you are holding back 13.4 because you are looking into this, I suggest you just release it as soon you can, and we make here progress whenever we can, hopefully together.

I wish to share some very personal opinion with regards to Windows 11 (if anyone does not like it, just ignore it, I don't intend to have an ongoing discussion about it, but I feel the need for drawing attention to certain things):

Spoiler: Windows 11 major issues

Over the weekend I had my very first experience with Windows 11 (22H2) based on a request that I was fulfilling - you can call me an absolute beginner in that regards.
The experience was more terrible than I expected, and I am concerned - if I may say that - that people are actually using this "state of the art system".
To keep it short, I am not going to go into deep details how much of a botched system it is, even though it had several releases already, I am sure that what had to be discussed about it was already discussed, I am just late to the party.
I do understand that it comes along with newly released hardware, however, it is just a mess, and there are no excuses for it.

Now, the biggest, and seeming unmanageable issue with Windows 11 is how the updating of system has been reworked and it is impacting the users of this tool without a doubt.
I did perform several component removal with the toolkit (pre-release of 13.4) successfully, however, if I removed anything aside from the options listed under [8] Windows Apps, and I do mean anything, no matter how carefully I have been slimming the images, if components were removed from [1] Internet, [2] Multimedia, [3] Network [4] Privacy, [5] Remoting, [6] System, [7] System Apps, didn't matter which combinations, I was not able to update the system via .msu deployment or even online Windows Update successfully, and the CBS logs were always full with terminating errors for missing components.
I had limited amount of time on hands, but don't think the effort would be paying of if more than half of the options cannot be removed without such an impact.
Essentially it has come to the point where you have to decide if you want a privacy-friendly or a secured system.
At this point I just wonder what is the benefit of having the Toolkit supporting Windows 11.
It seems to be too much effort for nothing (while Windows 10 support still has potential for improvements).
If anyone is willing to sacrifice security for removed parts will suffer from the consequences eventually.
These days are all about system exploitation.
One more thing to add here is that I did disable driver installation from Windows Update, yet it was still doing it.

Furthermore, while performing tests on VirtualBox (last office release and the latest test snapshot), after having Guest Additions installed, no matter if I was working with a modified or an untouched image, the guest system froze after minutes, rendering all my planned tests incomplete.
The only way to work with it was to remove the Guest Additions, losing the communication (shared clipboard and file transfer) between the host and guest system, again restricting the type of performable activities.

My advice would be to acquire cheap Win10 keys - there are legal opportunities for such - and just stick to it for as long as you can - I already made a reference about a possibility to install updates till 2032, in which case it should be worth it, and by then maybe we have some better options.
The only reason - ideally - for using the latest system is to maximize the performance of the latest top-tier hardware on the market for tasks which require vast amount of computation (far beyond gaming), but I fail to see how it would leave a well-prepared Windows 10 in the dust.

 

hi @tempdrive1 About the Issues of Windows 11, I have been editing Windows Image without any issues and also I can update windows safely. The problem you could be facing is that you're removing the components, which is a totally wrong step if you want integrate updates. First, you need to integrate the updates and them remove the components. Also, this advice is given by Tech Yes City on MSMG toolkit video 2-3 years ago. About the guest edition or something you're doing, is a specific case with is not totally something about @MSMG toolkit but yes with Windows and should be address to Feedback Hub app to Microsoft take a look into this.

 

You need to login to view this posts content.

 

This has been fixed on Toolkit.cmd from 2023-06-03.

 

@MSMG I made a change about adding the Administrator Account. I went to test it, because it's been a while since I've tested it, and adding multiple accounts isn't working.

In this case I removed the option and made other corrections. In the AutoUnattend block.
I changed some details in the Language Fallback scheme.
Because if it becomes empty, removing the initial empty space will add "~1" as a value in the variable.

I like the change in the "Installation Notes" part and make the IMCK Changes to "Unattended". In IMCK I keep the :AutoUnattendXML outfile block as it is. Thnks!

Follow the new file.

 

Hi @DennyAmaro,

Thank you for your feedback.

I never integrate updates, I find it pointless we you get 2 updates a month these days.
All I did was using the component removal option and adding the Registry tweaks.
Never faced any issues doing the same for Windows 10, though that is an entirely different system.

So after removing the components, applying the registry tweaks, saving the image, installing the system, the first thing I tried was to use the Momentum 3 update (KB026446) from the .msu file (preparation for the update, when it extracts the files, takes way longer than for Windows 10!), and it failed.
I went online, tried Windows Update, failed again.
Then I also tried the online update for May, failed again.
CBS.logs were 100-400 MB each time, which is insane amount of data, a lot of complaints about components not being accessible.
And of course, no (terminating) errors were encountered for an untouched image.

Is there anything special required for Windows 11 after components have been removed?
Honestly, I am not aware, but things should not be over complicated in any case.

 

Hi @tempdrive1 about Windows 11, is not complicated and is basically like Windows 10 except for the difference between applications names and new features in the system. Maybe you could share your "preset" (Things you remove) so we can better assist you. But, keep in mind that MSMG toolkit has everything detailed and the team behind or the developer behind @MSMG try to provide all the possible informations for every component available in the toolkit.

Also you're using only MSMG toolkit? or you use MSMG and them another software, like NTLite?

 

Maybe if you share the registry tweaks that you apply we can check what is happening and better understanding the scenario you're facing. And if has a bug inside a registry tweak we can simply provide to you and them send to @MSMG to update in the next version of the toolkit.

 

@DennyAmaro,

I know this toolkit since 2019 or so, and I have been reading many of the posts here since.
I don't use other tools (I played around with NTLite many years ago) and I don't use Registry tweaks which are not part of the toolkit for creating the image.
I never use anything but what is listed as selectable in the menus for removal, and I never integrate updates.
I usually create once modified image, test it quickly, and (re-)use it as a base until I need to move to a new major version.
Started with 1803 (very-very easy-to-manage and stable system), which I was able to update until the very last release (05/2021), and only after that I moved on straight to 21H1, and now stuck with 21H2 "forever", so I have been using the toolkit a little more lately.
Nothing special was done, really, I was initially doing the same thing like for Windows 10: remove all the components listed in the remove menu, except for Windows Update, AppresolverUX and Notepad.
Works fine for Windows 10, did not work for Windows 11.
So, when installation of the .msu failed, I created another image, this time skipping everything that sounded to complex or had a dependency or was listed as being a dependency.
So pretty much Firewall, Linux Subsystem, Edge, Speech Recognition, Game Explorer, Narrator, System Backup, Windows Update etc. were kept, but even so, it did not work.
I had time for 4 tries as I had to hand over the (low effort) work, and for the 3rd try I only went for selecting everything from [8] Windows Apps.
This was the only success I managed to have, even though I did one more try after this, but it was unusable once again.
Registry Tweaks: from Customize menu, [8] Apply Tweaks, almost everything.
I specifically selected no drivers from online, and yet every driver was updated through Windows Update.

This is the base image I was using: en-us_windows_11_consumer_editions_version_22h2_updated_sep_2022_x64_dvd_f408dad5.iso, version 22621.525

I honestly don't think there was much room for errors, yet no major component could be removed for having a successful update installed afterwards.

Based on this experience, I would pretty much need to test it by removing each and every component individually to see which actually break the update behavior, and that is about 3-5 days of effort, creating 30+ images, deploying them, trying to update them.

 

Did you try with a more recent SO @tempdrive1 ? Microsoft update their ISO and also could fix your problem. I usually download ISOs from UUPdump and no issues

 

Well, technically speaking what we are doing here is not what they intend us to do by any means.
The untouched software is updatable, I was facing no issues at all with it, and that's what they are providing support for anyway.

I must assume that this system has more severe core differences beyond the new design, which seems to be affecting such in-depth customizations.
(To me it feels like it was developed by well-taught, but young, freshly out-of-school developers, who only used mobile phones or tables in their lives - you all know exactly which core features are missing compared to Windows 10.)
Honestly, I would be surprised if it would be better with any of the latest releases, assuming this is a solid base for how it should work, and I hardly think they are going to undo something like that rather than keeping it as a new baseline.
And it's not like it's the initial release (of Windows 11), so changes they did must be intentional and for their own (support related) benefits.
If, however, this is how it is going to work going forward, you will not be able to update your systems, or at least not in an easy way.
All of the errors that I was seeing when briefly checking on the logs were about missing system parts.
And unless they allow the system to have missing parts (which again contradicts the intended designed as per my guess), later releases will behave the same.

I will try to stay away from it, mostly because I do not need any of these new features, while everything is quite stable and predictable with Windows 10.
The task I was assigned has been completed, and the user knows very little about computers anyway, I just wanted to make the most out of it, but this is the system that was forced on a relatively new hardware, being the new standard.

I'm curious if anyone else is going face such issues.

If the rumored Windows 12, that should be released in about a year's time, is going to similar to this, it is not going to be a good situation for us.
One thing people tend to overlook whenever a "downgrade" surfaces is that the younger generations, who have no exposure to former experience, will have nothing to compare to, and believe it is as good as it gets, and as such there will always be users for it, no matter how terrible things get.

I appreciate the effort you put into helping me.