Windows Integration Guide - murphy78

I do a base install on a vm, then check the kb files list from Windows Update.
Then I copy over msu files from previous month to a 2nd folder designated as a verification temporary folder
I download any new msu files as needed. There's usually a few each month; sometimes quite a few, depending on how many security hotfixes are released.
I then move the verified msu files to a 2nd folder and copy all of the verified files to a usb flash drive.
I connect the flash drive to vmware and run a msu installation script for all msu files in the folder.

After installing all of the first wave of updates, I reboot and re-check Windows Update.
For Win7 there's just one update (kb2533552) and none for win8.1 that require online (setupcomplete.cmd) integration
There's usually a few more kb files after a reboot for download. I've never ran into a 3rd pass being required.

So after checking and downloading all available msu files, I move the unused ones into a directory designated for old updates (just in case I need them somehow)
Then I move all the verified msu files to my integration directory I specify for them.

However, my method aside, you would likely be better served by doing a sysprep/capture method, slimming the capture down, and then exporting to install.esd recovery compression format.
All of the things you would want to do, you can do by simply mounting images and using various dism commands.

You might say "hey murph, isn't a captured image larger than an offline integrated image?" Well, yes; but only for the installation media.
The footprint of the install would be the same.
Example:
Offline install media might have a 900mb install.wim
sysprep/capture media might have a 1050mb install.wim

Looking at that you'd say, "Why would you want to do that then?"
Well the truth is that after install, they take up the same space. Also, captured images install much more quickly.
The major differences only occur when you include more than one index and a lot of unique identifiers start preventing good compression on captured images.

Need a better reason to use sysprep/captured images over offline integrated images?
I'll give you one. /resetbase
Say you mount your image to c:\mount
You simply run this command to reduce the winsxs folder:

Code:

dism /image:c:\mount /cleanup-image /startcomponentcleanup /resetbase

Other good ways to reduce a captured image include deleting the %windir%\softwaredistribution folder and any users folders created during sysprep (administrator, temporary users, etc)
I have a lot of this info in the first and second posts of this thread.
To reduce the size of the install media, you can use the install.esd recovery compression I mentioned before.
I also have info on that in the 2nd post.

 

I don't know what browser choice update is.
Defender updates are downloadable. You can download the exe files. You just gotta search for them. Like search for "Windows defender updates for windows 8.1 offline" or something
You then simply add the exe line to the setupcomplete.cmd in the windows\setup\scripts folder
You may need to add a -q line, it's been a while since I've used them.

 

dism is just like any other commandline utility. It just takes arguments and does things based on those arguments.
Every brute force thing you're doing can be done simply using dism commands and opening your mount folder.
Just start out simple by like mounting something, copying over a file, unmounting, and making an iso.
example:

Code:

dism /mount-wim /wimfile:c:\win81x86\sources\install.wim /index:1 /mountdir:c:\mount
(do your file mods here)
dism /unmount-wim /mountdir:c:\mount /commit
oscdimg -bc:\win81x86\boot\etfsboot.com -u1 -lYourLabelHere c:\win81x86\ c:\temp\YourOutputFile.iso

You get oscdimg in the Windows ADK tools. They're free from the ms download center if you just search for them.

 

Yah, in fact you can use dism argument /preventpending to avoid updates that set pending status.
The problem is that almost all of the updates DO set pending status, so it's not an effective way of integrating.

 

I wonder if they've fixed that yet. I notice that they fixed the 8.1 endlessly checking for updates for normal users on first boot I believe during the oct2013 rollup.

 

Same, it's my hobby and I love Microsoft.
I think it's sad that people try to turn leeching off of Microsoft into their job.
That's why I never will make any murphy78.com or something with ad revenue.
It just seems wrong. You might say, "murph aren't you on TPB sharing all these things?"
Yes I am, but I don't make a cent. It's more of just a way of publishing my hobby.
If there was a widely used publication method that didn't take in ad revenue, I'd totally use that instead.

I think you might be missing the sentiment that flip was talking about.
WSUS is like a middle-ware version of Windows Update. It updates once, then distributes through the network.
It doesn't really have any bearing on small-time integration. It's more trouble than it's worth.