PXE/BINL - AN05: Windows Network Image Capture & Deploy on ARM ARM64

Starting an automated network image Capture and Deploy of WDS OSs on ARM/ARM64, taking no more than 15 minutes and a ~4 MB download.

The objective of this document is to show you how to network image a PC installed with a WDS ARM/ARM64 OS and later network deploy it. It is all based on Serva's new Task Sequence Engine (TSE) and ARM/ARM64 support not requiring to follow cryptic procedures nor being dependant on Microsoft’s WDS/MDT/SCCM or ADK suites.

Procedures described in this document require Serva "Pro"

Serva PXE/BINL - Application Note Set
PXE/BINL - AN01: Windows Network Install - Basis
PXE/BINL - AN01.1: Windows Network Install - WDS OSs
PXE/BINL - AN01.2: Windows Network Install - RIS OSs
PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
PXE/BINL - AN03: Non-Windows Network Boot/Install
PXE/BINL - AN04: Custom menu
PXE/BINL - AN05: Windows Network Image Capture & Deploy
PXE/BINL - AN06: Windows Network Image Capture & Deploy on ARM


0 Index

  1. Requirements
  2. Overview
  3. Sysprep
  4. Windows PE
  5. Capture & Deploy
  6. Automation
  7. Advanced
  8. Installing Windows 10 ARM from ISO
  9. Troubleshooting
  10. Final Words

 

1 Requirements

1.1 Required Software
1.1.1 Microsoft Windows Serva 4.4.0 "Pro" or higher.
1.1.2 Reference PC ARM/ARM64 based i.e. Surface Pro X

1.2 Assumed knowledge
1.2.1 PXE/BINL - AN01: Windows Network Install - Basis
1.2.2 PXE/BINL - AN01.1: Windows Network Install - WDS OSs
1.2.3 PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
1.2.4 PXE/BINL - AN05: Windows Network Image Capture & Deploy

 

2 Overview

Before v4.4.0 Serva was able to provide network boot services to the booting architectures defined by DHCP Option 93 (see RFC 4578). Serva's BINL specifically supported:

DHCP Option 93 Client's pre-OS runtime
0 Intel x86PC
6 EFI IA32
7 EFI x86-64
9 EFI BC

Since v4.4.0 Serva is able to provide network boot services to the booting architectures now defined by the DHCPV6 Processor Architecture Types. Serva's BINL now adds ARM UEFI support:

DHCP Option 93 Client's pre-OS runtime
0 x86 BIOS
6 x86 UEFI
7 x64 UEFI
9 EBC
10 ARM 32-bit UEFI
11 ARM 64-bit UEFI

Warning !
Currently Serva will be able to Net Boot ARM 32/64-bit UEFI assets by using Microsoft Boot Managers, therefore we must accordingly set at Serva's DHCP Setting tab the Boot Manager mode; BINL BM_Mode=3, otherwise ARM/ARM64 clients will not be able to net boot!

BMM BIOS Client EFI64 Client EFI32 Client EFIARM64 Client EFIARM32 Client
1 pxeserva.0 pxeserva.efi pxeserva.efi - -
[3] pxeserva.0 bootmgfw.efi bootmgfw.efi bootmgfw.efi bootmgfw.efi


Since v4.4.0 Serva Pro also includes the ARM/ARM64 native versions of ServaPENet.


2.1 Procedure:

Warning !
From this point on, this Application Note uses as target a Microsoft Surface Pro X SQ1 (ARM64) with an Ethernet adapter provided either by the Microsoft Surface Dock / 2 or Microsoft Surface USB-C Ethernet and USB 3.0 adapter. The methods and scripts presented here might need to be adapted if used with different target devices.

MS Surface Pro X -- Surface Dock 2 -- Surface USB-C/Ethernet/USB-3.0 -- Surface Travel Hub

Stop !
Before attempting any network capture or deployment on a Microsoft Surface device always download the Recovery Image and create the corresponding recovery pen drive first.

Let's consider you have a reference PC that has been customized with software and settings, and you would like to take an image of this PC and later apply it to other PCs. The Reference system must be first generalized using Sysprep by removing computer-specific information such as installed drivers and computer security identifier (SID), etc. Next you should net capture the image of the Reference PC into a WIM file which will be stored in Serva repository. Later on this image can be offered for network deployment to different target PC systems.

3 Sysprep

To capture a Windows image, you have to first generalize the installed image. Even if you're capturing an image that's going to be deployed to a PC with similar/identical hardware, you still have to generalize the Windows installation to remove unique PC-specific information from a Windows installation, which allows you to safely reuse your image.
When you generalize an image, Windows replaces the computer SID only on the operating system volume where you ran Sysprep. If a single computer has multiple operating systems, you must run Sysprep on each image individually.

Please generalize your reference PC as explained here:
Sysprep (Generalize) a Windows installation

 

4 Windows PE

4.1 Auxiliary network bootable executive: Windows PE.

The process of network capturing and network deploying a PC image with Serva will require network booting a Windows PE executive.

4.1.1 Creating a Windows PE executive.
The Windows Assessment and Deployment Kit (ADK) includes the CopyPE and MakeWinPEMedia command line utilities. When run from the Deployment and Imaging Tools Environment, CopyPE creates a working set of WinPE files that MakeWinPEMedia can later use to create bootable WinPE media. MakeWinPEMedia creates bootable WinPE ISOs containing the required Windows PE executive (boot.wim).

>copype ARM64 C:\WinPE_ARM64
 
>MakeWinPEMedia /ISO C:\WinPE_ARM64 C:\WinPE_ARM64\WinPE_ARM64.iso

After creating WinPE_amd64.iso you can mount it or open it with 7zip and extract the Windows PE executive file \sources\boot.wim

When booting the created Boot.wim on a Microsoft Surface Pro X SQ1/SQ2 the Network driver and the part of the disk driver (EhStorClass.sys) are missing

Warning !
When booting the created Boot.wim on a Microsoft Surface Pro X SQ1 the Network driver and a component of the disk driver (EhStorClass.sys) were missing

4.1.2 Repurposing a Windows PE executive
Instead of creating your own boot.wim as described in 4.1.1 you can easily repurpose one taking it from the Surface Pro X "recovery image", you can download it from Microsoft here. i.e. SurfaceProX_BMR_16_128.5.0.zip corresponding to a Surface Pro X - SQ1/8/128 M1501 - Windows 10 Pro Version 1903.
The needed Windows PE executive can be found at \sources\boot.wim.

The downloaded WIMs did not include the NIC driver corresponding to the Microsoft Surface Dock /2 or Microsoft Surface USB-C Ethernet and USB 3.0 adapter then we injected its components with Serva as explained in PXE/BINL - AN01.1: Windows Network Install - WDS OSs

Driver components:

 msuarm64w10.cat 
 msuarm64w10.INF 
 msuarm64w10.PNF 
 msuarm64w10.sys 

The last versions of these files can be found in the Surface Pro X at C:\Windows\WinSxS\


4.2 Network Booting the Windows PE executive.

Please proceed as explained in PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
i.e. creating the \WinPE_ARM64 Head Directory and copying the following files:

C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\boot.wim
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\boot.sid
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\ServaAsset.inf

[PXESERVA_MENU_ENTRY]
asset = Catpure & Deploy Surface Pro X

[SERVAPENET]
EndProcess = *TaskSeqSelector 

Since Serva 4.0.0 ServaAsset.inf is also parsed for WDS assets. Now we can define not only the name of the WDS asset displayed on Serva's menu but also trigger the injection of ServaPENet when booting stand-alone Windows PE executives. In this case when ServaPENet finishes its job is able to launch an external or internal command. In the example above ServaPENet is instructed to finish by executing an internal command (*TaskSeqSelector) that will display a Task Sequence Selector at the net booting PC.

Now when restarting Serva its BINL service will:

  1. Parse \WDS\WinPE_ARM64 detecting that you are offering for network boot a stand-alone Windows PE executive (boot.wim).
  2. Parse ServaAsset.inf knowing that:
    1. You defined the asset name.
    2. ServaPENet must be injected into boot.wim.
    3. ServaPENet must end its job at the booting client by invoking its "Task Sequence Selector"

When Serva's BINL service finishes you should see:

Open All | Close All

WinPE_ARM64 head directory process

In the previous directory structure we see:

  1. \$OEM$ directory ready to hold OEM drivers and custom components being injected into boow.wim. Identical to the one used in PXE/BINL - AN01.1: Windows Network Install - WDS OSs
  2. \Images directory ready to hold your captured and/or offered PC images (usually WIM or FFU files).
  3. \Logs directory ready to hold Log files from remote PCs being captured or imaged.
  4. \TaskSequences directory ready to hold your set of Task Sequence command (*.cmd) and/or powershell (*.ps1) files and associated components if any.
Notes
  1. ADL created Windows PE executives do not include PowerShell support by default. If needed please read:
    WinPE: Adding Windows PowerShell support to Windows PE.
  2. PowerShell Task sequences will be listed only if PowerShell support is included in the booted Windows PE executive.

 

5 Capture & Deploy

Windows 10 on Microsoft Surface Pro X (and many more) presents the classic 4 partition type schema. System - Reserved - Primary - Recovery :

Fig 1: System (UEFI) - Reserved - Primary (Windows) - Recovery (winre.wim).


5.1 Multi Partition Capture & Deploy

This method will individually capture & deploy the System, Primary, and Recovery partition types.
this method allows:
1) Deploy to different sizes of hard drives and the Windows partition will expand/contract accordingly to the destination disk size.
2) Modify the captured images with Dism.exe

5.1.1 Capture Task Sequence.
Let's write a Capture Task Sequence in a command file i.e.:

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Capture
ECHO [TS] Capture_SurfaceProX.cmd - v1.0 - Demo purposes 
:: NOTE: ServaPENet login with R/W rights on WIA_WDS_SHARE required!
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END :: ===== The Script begins here ===\\ :: -- Task Sequence Variables --\ :: DISKPART TARGET DISK SET TARGET_DISK=0 :: SET THE LABEL OF THE WINDOWS VOLUME BEING CAPTURED HERE :: Surface Pro X default = "Local Disk" SET WINVOLUMELABEL="Local Disk" :: SET THE BASE NAME OF THE IMAGES BEING CAPTURED HERE SET IMG_FILE=Windows10_SPX SET IMG_NAME="Windows_10_ARM64" :: -- Task Sequence Variables --/ :: :: :: :: Environment variables defined by ServaPENet :: Variable: Local Content: Pointing to Serva Repository: :: DEV_NAME P: WIA_WDS_SHARE\<Head_Directory> :: TS_DIR P:\TaskSequences WIA_WDS_SHARE\<Head_Directory>\TaskSequences :: IMG_DIR P:\Images WIA_WDS_SHARE\<Head_Directory>\Images :: LOG_DIR P:\Logs WIA_WDS_SHARE\<Head_Directory>\Logs :: :: :: :: == Check Serva repository R/W access == CALL :ReadOnlyDir %IMG_DIR% IF %ERRORLEVEL% NEQ 0 ( ECHO [TS] ERROR: User does not have Writing Rights in Serva's repository. PAUSE GOTO END ) :: 1) :: ==== "Primary" partition (Windows OS Partition) ==== :: == Find Windows volume letter == CALL :GetVolumeLetter WINVOLUMELETTER %TARGET_DISK% %WINVOLUMELABEL% IF %ERRORLEVEL% NEQ 0 ( ECHO [TS] ERROR: Couldn't find OS Volume labeled %WINVOLUMELABEL%. PAUSE GOTO END ) :: Alternative Manual definition ::SET WINVOLUMELETTER=C :: == Optimize the image to reduce booting time of the applied image (Optional) == :: ECHO Starting image optimization... :: Dism /image:%WINVOLUMELETTER%:\ /optimize-image /boot :: == Capture the Primary partition (Windows OS) == IF NOT EXIST %IMG_DIR%\%IMG_FILE%_Primary.wim GOTO STARTCAPTURE_PRIMARY ECHO [TS] Warning: File %IMG_FILE%_Primary.wim exists SET /P OVERWRT="Overwrite (y/n):" IF "%OVERWRT%" NEQ "y" GOTO END :STARTCAPTURE_PRIMARY ECHO [TS] Starting capture: Primary partition... Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Primary.wim" /CaptureDir:%WINVOLUMELETTER%:\ /Description:"%IMG_NAME%_Primary" /Name:"%IMG_NAME%_Primary" :: 2) :: ==== "System" partition (EFI System Partition) ==== :: == Find System partition number == CALL :GetPartitionNumber PARTNUMBER %TARGET_DISK% System IF %ERRORLEVEL% NEQ 0 ( ECHO [TS] ERROR: Couldn't find number of partition type: System. PAUSE GOTO END ) ( ECHO select disk %TARGET_DISK% ECHO select partition=%PARTNUMBER%
ECHO assign letter=S ECHO exit ) | diskpart :: == Capture the System partition (EFI System Partition) == IF NOT EXIST %IMG_DIR%\%IMG_FILE%_System.wim GOTO STARTCAPTURE_SYSTEM ECHO [TS] Warning: File %IMG_FILE%_System.wim exists SET /P OVERWRT="Overwrite (y/n):" IF "%OVERWRT%" NEQ "y" GOTO END :STARTCAPTURE_SYSTEM ECHO [TS] Starting capture: System partition... Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_System.wim" /CaptureDir:S:\ /Description:"%IMG_NAME%_System" /Name:"%IMG_NAME%_System" :: 3) :: ==== "Recovery" partition ==== :: == Find System partition number == CALL :GetPartitionNumber PARTNUMBER %TARGET_DISK% Recovery IF %ERRORLEVEL% NEQ 0 ( ECHO [TS] ERROR: Couldn't find number of partition type: Recovery. PAUSE GOTO END ) ( ECHO select disk %TARGET_DISK% ECHO select partition=%PARTNUMBER%
ECHO assign letter=R ECHO exit ) | diskpart :: == Capture the Recovery partition == IF NOT EXIST %IMG_DIR%\%IMG_FILE%_Recovery.wim GOTO STARTCAPTURE_RECOVERY ECHO [TS] Warning: File %IMG_FILE%_Recovery.wim exists SET /P OVERWRT="Overwrite (y/n):" IF "%OVERWRT%" NEQ "y" GOTO END :STARTCAPTURE_RECOVERY ECHO [TS] Starting capture: Recovery partition... Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Recovery.wim" /CaptureDir:R:\ /Description:"%IMG_NAME%_Recovery" /Name:"%IMG_NAME%_Recovery" :END ECHO [TS] Shuting down in CALL :Delay 5 Wpeutil Shutdown EXIT /B %ERRORLEVEL% :: ===== The Script ends here ===// :::::::::: LIBRARY FUNCTIONS ::::::::::::::::::: ::: GetPartitionNumber <OUT_PARTNUMBER> <IN_TARGET_DISK> <IN_PARTTYPE> ::::\\ :: It returns the number of the first matching partition type found :GetPartitionNumber
FOR /F "tokens=2,3" %%A IN ('^( ECHO select disk %~2 ^& ECHO list partition ^) ^| diskpart ^| find ^"%~3^"') DO (
SET %~1=%%A
EXIT /B 0
) EXIT /B 1 ::: GetPartitionNumber <OUT_PARTNUMBER> <IN_TARGET_DISK> <IN_PARTTYPE> ::::// ::: GetVolumeLetter <OUT_VOLUMELETTER> <IN_TARGET_DISK> <IN_VOLUMELABEL> ::::\\ :: It returns the letter of the first Volume found :GetVolumeLetter
FOR /F "tokens=3,4" %%A IN ('^( ECHO select disk %~2 ^& ECHO list volume ^) ^| diskpart ^| find ^"%~3^"') DO (
SET %~1=%%A
EXIT /B 0
) EXIT /B 1 ::: GetVolumeLetter <OUT_VOLUMELETTER> <IN_TARGET_DISK> <IN_VOLUMELABEL> ::::// ::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::\\ :: It returns %ERRORLEVEL% == 0 if IN_DIR is R/O :ReadOnlyDir 2>nul rename %~1 %~nx1 EXIT /B %ERRORLEVEL% ::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::// ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::::::::::::::::::::\\ :Delay IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER timeout /t %~1 EXIT /B 0 :STARTCMDTIMER SETLOCAL EnableDelayedExpansion SET /A delay=%~1-1 FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a" FOR /L %%i IN (%delay%,-1,0) DO ( SET /p "= Delay !Newline!" <NUL SET /p "= Delay %%is!Newline!" <NUL ping -n 1 -w 1000 192.168.255.0 > NUL ) ECHO: SETLOCAL DisableDelayedExpansion EXIT /B 0 ::: Delay <IN_SECS> ::::::::::::::::::::::::::::::::::::::::::::::::://

Note
For capturing system with customized partitions please read Capture and apply Windows, system, and recovery partitions then create the corresponding Image Capture task sequence

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_SurfaceProX.cmd

5.1.2 Deploy Task Sequence
Let's write a Deploy Task Sequence in a command file i.e.:

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Deployment
ECHO [TS] Deployment_SurfaceProX.cmd - v1.0 - Demo purposes 
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END :: ===== The Script begins here ===\\ :: -- Task Sequence Variables --\ :: SET THE BASE NAME OF THE IMAGES TO DEPLOY HERE SET IMG_FILE=Windows10_SPX :: DISKPART TARGET DISK SET TARGET_DISK=0 :: -- Task Sequence Variables --/ :: :: :: :: Environment variables defined by ServaPENet :: Variable: Local Content: Pointing to Serva Repository: :: DEV_NAME P: WIA_WDS_SHARE\<Head_Directory> :: TS_DIR P:\TaskSequences WIA_WDS_SHARE\<Head_Directory>\TaskSequences :: IMG_DIR P:\Images WIA_WDS_SHARE\<Head_Directory>\Images :: LOG_DIR P:\Logs WIA_WDS_SHARE\<Head_Directory>\Logs :: :: :: :: == Script protection == :: We protect Task Sequences that call "diskpart" from accidentally being run on not Windows PE systems CALL :IsWinPE IF %ERRORLEVEL% EQU 0 ( ECHO [TS] ERROR: This Task Sequence must be run under Windows PE. PAUSE GOTO END ) :: == Create partitions == :: Windows 10 SPX UEFI ARM64 target ( ECHO select disk %TARGET_DISK%
ECHO clean :: Following commands are used with DiskPart to create four partitions ^ for a UEFI/GPT-based Surface PRO X. ^ Found at SurfaceProX_BMR_16_128.5.0.zip/sources\CreatePartitions-UEFI.txt ECHO convert gpt
ECHO create partition efi size=260
ECHO format quick fs=fat32 label="System"
ECHO assign letter=S
ECHO create partition msr size=128
ECHO create partition primary
ECHO shrink minimum=410
ECHO gpt attributes=0x0000000000000000
ECHO format quick fs=ntfs label="Local Disk"
ECHO assign letter=W
ECHO create partition primary size=410
ECHO set id=DE94BBA4-06D1-4D40-A16A-BFD50179D6AC
ECHO gpt attributes=0x8000000000000001
ECHO format quick fs=ntfs label="Windows RE tools"
ECHO assign letter=T
ECHO rescan
ECHO exit ) | diskpart :: We must implement a delay of 15 sec after diskpart CALL :Delay 15 :: == Set high-performance power scheme to speed deployment == CALL powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c :: == Apply the image to the "Primary" partition (Windows OS) == ECHO [TS] Starting deployment: Primary partition... dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Primary.wim" /Index:1 /ApplyDir:W:\ :: == Copy boot files to the System partition == :: W:\Windows\System32\bcdboot W:\Windows /s S: :: or apply the captured System partition ECHO [TS] Starting deployment: System partition... dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_System.wim" /Index:1 /ApplyDir:S:\ :: == Copy the Windows RE image to the :: Windows RE Tools partition == :: md R:\Recovery\WindowsRE :: xcopy /h W:\Windows\System32\Recovery\Winre.wim R:\Recovery\WindowsRE\ :: or apply the captured Recovery partition ECHO [TS] Starting deployment: Recovery partition... dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Recovery.wim" /Index:1 /ApplyDir:T:\ :: == Make the BCD to point to the correct Disk after diskpart clean bcdedit /set {default} device partition=W:
bcdedit /set {default} osdevice partition=W:
bcdedit /set {bootmgr} device partition=W: :: == Register the location of the recovery tools == W:\Windows\System32\Reagentc /Setreimage /Path R:\Recovery\WindowsRE /Target W:\Windows :: == Verify the configuration status of the images. == W:\Windows\System32\Reagentc /Info /Target W:\Windows :END ECHO [TS] Restarting in... :: timeout /t 15 CALL :Delay 15 Wpeutil Reboot EXIT /B %ERRORLEVEL% :: ===== The Script ends here ===// :::::::::: LIBRARY FUNCTIONS ::::::::::::::::::: ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::\\ :Delay IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER timeout /t %~1 EXIT /B 0 :STARTCMDTIMER SETLOCAL EnableDelayedExpansion SET /A delay=%~1-1 FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a" FOR /L %%i IN (%delay%,-1,0) DO ( SET /p "= Delay !Newline!" <NUL SET /p "= Delay %%is!Newline!" <NUL ping -n 1 -w 1000 192.168.255.0 > NUL ) ECHO: SETLOCAL DisableDelayedExpansion EXIT /B 0 ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::// ::: IsWinPE <> :::::::::::::::::::::::::::::::::::\\ :IsWinPE REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT\ > NULL 2>&1 IF %ERRORLEVEL% NEQ 0 ( EXIT /B 0 ) ECHO: EXIT /B 1 ::: IsWinPE <> ::::::::::::::::::::::::::::::::::://

Warning !
The former script uses diskpart which could potentially wipe a disk without requiring any confirmation. The script prevents being run in other than Windows PE environments but you still must be extremely cautious if you decide to edit/debug etc.

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_SurfaceProX.cmd

 

5.2 Full Flash Update (FFU) Capture & Deploy

DISM in Windows 10 version 1709 and up supports the Full Flash Update (.FFU) format. Unlike the file-based WIM format, FFU is a sector-based file container that stores a whole disk. When using FFU images files you can capture and deploy a single file image of a physical drive, including Windows, Recovery, and System partition information all at once.
This method allows:
1) Deploy an image to different size of hard drive but always larger or equal than the drive it is captured from. All partition sizes will be kept unaltered.
2) Reliable deployments; a hash table is generated during capture, and validated when applying the image.
3) Modify the captured images with Dism.exe
4) Fast process (really fast); ideal for capturing and deploying Windows on a factory floor.
5) It creates larger images (about +25%)

5.2.1 Capture Task Sequence (FFU)
Let's write a Capture Task Sequence in a command file i.e.:

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Capture
ECHO [TS] Capture_ffu_SurfaceProX.cmd - v1.0 - Demo purposes 
ECHO [TS] NOTE: ServaPENet login with R/W rights on WIA_WDS_SHARE required!
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END :: ===== The Script begins here ===\\ :: -- Task Sequence Variables --\ :: DISKPART TARGET DISK SET TARGET_DISK=0 :: SET THE NAME OF THE IMAGE BEING CAPTURED HERE SET IMG_FILE=Windows10_SPX.ffu SET IMG_NAME="Windows_10_ARM64_ffu" :: -- Task Sequence Variables --/ :: :: :: :: Environment variables defined by ServaPENet :: Variable: Local Content: Pointing to Serva Repository: :: DEV_NAME P: WIA_WDS_SHARE\<Head_Directory> :: TS_DIR P:\TaskSequences WIA_WDS_SHARE\<Head_Directory>\TaskSequences :: IMG_DIR P:\Images WIA_WDS_SHARE\<Head_Directory>\Images :: LOG_DIR P:\Logs WIA_WDS_SHARE\<Head_Directory>\Logs :: :: :: :: == Check Serva repository R/W access == CALL :ReadOnlyDir %IMG_DIR% IF %ERRORLEVEL% NEQ 0 ( ECHO [TS] ERROR: User does not have Writing Rights in Serva's repository. PAUSE GOTO END ) :: == Capture Disk image == IF NOT EXIST %IMG_DIR%\%IMG_FILE% GOTO STARTCAPTURE ECHO [TS] Warning: File %IMG_FILE% exists SET /P OVERWRT="Overwrite (y/n):" IF "%OVERWRT%" NEQ "y" GOTO END :STARTCAPTURE ECHO [TS] Starting capture: Hard Disk %TARGET_DISK% ... dism /capture-ffu /imagefile=%IMG_DIR%\%IMG_FILE% /capturedrive=\\.\PhysicalDrive%TARGET_DISK% /name:disk%TARGET_DISK% /description:"%IMG_NAME% :END ECHO [TS] Shuting down in CALL :Delay 5 Wpeutil Shutdown EXIT /B %ERRORLEVEL% :: ===== The Script ends here ===// ::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::\\ :: It returns %ERRORLEVEL% == 0 if IN_DIR is R/O :ReadOnlyDir 2>nul rename %~1 %~nx1 EXIT /B %ERRORLEVEL% ::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::// ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::::::::::::::::::::\\ :Delay IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER timeout /t %~1 EXIT /B 0 :STARTCMDTIMER SETLOCAL EnableDelayedExpansion SET /A delay=%~1-1 FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a" FOR /L %%i IN (%delay%,-1,0) DO ( SET /p "= Delay !Newline!" <NUL SET /p "= Delay %%is!Newline!" <NUL ping -n 1 -w 1000 192.168.255.0 > NUL ) ECHO: SETLOCAL DisableDelayedExpansion EXIT /B 0 ::: Delay <IN_SECS> ::::::::::::::::::::::::::::::::::::::::::::::::://

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_ffu_SurfaceProX.cmd

5.2.2 Deploy Task Sequence (FFU)
Let's write a Deploy Task Sequence in a command file i.e.:

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Deployment
ECHO [TS] Deployment_ffu_SurfaceProX.cmd - v1.0 - Demo purposes 
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END :: ===== The Script begins here ===\\ :: -- Task Sequence Variables --\ :: SET THE NAME OF THE IMAGES TO DEPLOY HERE SET IMG_FILE=Windows10_SPX.ffu :: DISKPART TARGET DISK SET TARGET_DISK=0 :: -- Task Sequence Variables --/ :: :: :: :: Environment variables defined by ServaPENet :: Variable: Local Content: Pointing to Serva Repository: :: DEV_NAME P: WIA_WDS_SHARE\<Head_Directory> :: TS_DIR P:\TaskSequences WIA_WDS_SHARE\<Head_Directory>\TaskSequences :: IMG_DIR P:\Images WIA_WDS_SHARE\<Head_Directory>\Images :: LOG_DIR P:\Logs WIA_WDS_SHARE\<Head_Directory>\Logs :: :: :: :: == Script protection == :: We protect Task Sequences that call "diskpart" from accidentally being run on not Windows PE systems CALL :IsWinPE IF %ERRORLEVEL% EQU 0 ( ECHO [TS] ERROR: This Task Sequence must be run under Windows PE. PAUSE GOTO END ) :: == Set high-performance power scheme to speed deployment == CALL powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c :: == Apply the image to the Hard Disk == ECHO [TS] Starting deployment: Hard Disk %TARGET_DISK% dism /apply-ffu /ImageFile=%IMG_DIR%\%IMG_FILE% /ApplyDrive:\\.\PhysicalDrive%TARGET_DISK% :END ECHO [TS] Restarting in... :: timeout /t 15 CALL :Delay 15 Wpeutil Reboot EXIT /B %ERRORLEVEL% :: ===== The Script ends here ===// :::::::::: LIBRARY FUNCTIONS ::::::::::::::::::: ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::\\ :Delay IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER timeout /t %~1 EXIT /B 0 :STARTCMDTIMER SETLOCAL EnableDelayedExpansion SET /A delay=%~1-1 FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a" FOR /L %%i IN (%delay%,-1,0) DO ( SET /p "= Delay !Newline!" <NUL SET /p "= Delay %%is!Newline!" <NUL ping -n 1 -w 1000 192.168.255.0 > NUL ) ECHO: SETLOCAL DisableDelayedExpansion EXIT /B 0 ::: Delay <IN_SECS> :::::::::::::::::::::::::::::::// ::: IsWinPE <> :::::::::::::::::::::::::::::::::::\\ :IsWinPE REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT\ > NULL 2>&1 IF %ERRORLEVEL% NEQ 0 ( EXIT /B 0 ) ECHO: EXIT /B 1 ::: IsWinPE <> ::::::::::::::::::::::::::::::::::://


5.3 Netboot a client

To start a Network Boot on a Surface Pro X while keeping pressed the VOLUME-LOW button pulse the POWER button and only release the VOLUME-LOW button when the Network Boot sequence displays its first lines on the screen.

5.3.1 Image Capture:
Netboot a Reference PC (which must be previously sysprep'ed), start our "Capture & Deploy" asset from Serva's menu, and run the Capture_SurfaceProX.cmd task sequence.

Note
If you plan to deploy only targeting the reference PC you can skip Sysprep.

5.3.2 Image Deploy:
Netboot the target PC, start our "Capture & Deploy" asset from Serva's menu, and run one of the deployment task sequences i.e. Deployment_SurfaceProX.cmd task sequence.

 

Fig 1: ServaPENet login to Serva's WIA repository

 

Fig 2: ServaPENet Task Sequence Manager


Notes
  1. In case you want to temporarily stop offering one of the task sequences but you do not really want to erase it from the repository, you can just prepend its file name with off_ . ServaPENet Task Sequence Engine will "ignore" task sequences when their name begin with "off_" i.e. off_Deployment_SurfaceProX.cmd. If you want it back on just remove "off_" from its file name name.
  2. If the Task Sequence that you are planing to run needs to "write" to Serva's repository (i.e. a captured WIM image file, redirected Log files, etc.) then the user/password used to login on ServaPENet must correspond to a Serva PC user having R/W permissions on WIA_WDS_SHARE; using an user with Read Only permissions in this case will trigger an error when the task sequence runs.


5.4 Comparing The different Capture & Deploy methods.

Area Windows image (.WIM) Virtual Hard Disk (.VHD/VHDX) Full Flash Update (.FFU)
Common uses Fastest for testing and modifying Windows images.
Can store multiple image variations in the same .WIM file, often with little additional storage required.
Easiest for deploying Windows to virtual PCs.
You can boot a new device directly from a single VHD/VHDX file.
Fastest for capturing and deploying Windows on a factory floor.
Imaging style File-based Sector-based Sector-based
Compression Supports multiple types of compression None Xpress-Huffman is used by default when an FFU is captured with DISM
What does it capture? A set of files, up to an entire partition. Captures the full set of drive information, including partitions. Captures the full set of drive information, including partitions.
When I apply the image, what happens? Adds the files and folders to the partition.
If there are existing files and folders with the same names, they're replaced. Otherwise, the existing files are kept.
Cleans the entire drive. Cleans the entire drive.
Can I deploy to different sizes of hard drives? Yes. Yes, though the new drive must be the same size or larger than the original. Yes, though the new drive must be the same size or larger than the original.
Can I modify the images? Yes. With tools like DISM, you can mount, modify, and unmount the image. Yes, you can mount a VHD/VHDX as if it were removable media, and modify the files. Yes. With tools like DISM, you can mount, modify, and unmount the image.
Reliability Includes a catalog and hash table to validate a signature upfront before flashing onto a device. The hash table is generated during capture, and validated when applying the image.

WIM vs. VHD vs. FFU: comparing image file formats (source: Microsoft)

In this Application Note we have implemented the Windows Image (.wim) and the Full Flash Update (.ffu) methods.

When capturing and deploying an empty Surface Pro X SQ1 8GB RAM 128GB SSD the results were:

Windows Image (.wim)
Windows10_SPX_Primary.wim 12GB
Windows10_SPX_Recovery.wim 326MB
Windows10_SPX_System.wim 11MB
Slowest overall process (capture & deploy)

Full Flash Update (.ffu)
Windows10_SPX.ffu 15GB
Fastest overall process (capture & deploy)
The required scripts are very simple


5.5 Additional Reading:
Capture and Deployment tasks are strongly dependent on Dism.exe. A clear understanding of this Microsoft tool is a must if we really want to excel at this topic.

Dism Overview

DISM Unattended Servicing Command-Line Options

Learn How to Sysprep Capture Windows 10 Image using DISM

 

6 Automation

6.1 Automating repository login in ServaPENet can done i.e. by creating

C:\SERVA_REPO\WIA_WDS\WinPE_ARM64\$OEM$\$Boot$\$1\Unattend.ini

as explained in PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot


6.2 Automating ServaPENet Task Sequence selection can be done by editing ServaAsset.inf and defining the EndProcess variable as the path to the task sequence to be automatically run i.e.

[PXESERVA_MENU_ENTRY]
asset = Capture & Deploy 

[SERVAPENET]
EndProcess = P:\TaskSequences\Deployment_ffu_SurfaceProX.cmd

In this case after login the Task Sequence Menu is not displayed and the indicated task sequence will start running immediately. This is very useful when you have to deploy a big number of identical PCs.

 

7 Advanced

So far we have learned how to Capture & Deploy a Surface Pro X image by net booting with Serva a Windows PE executive. Serva sorts things in a way that when the Windows PE boots up will automatically:

  1. Launch ServaPENet
    1. Activate network services
    2. Connect to Serva repository
    3. Map the booted asset's Head Directory to the Windows PE drive P:
    4. Run the Task Sequence Manager as the End Process
  2. The user then can select and run one of the available task sequences.

All of the above can be done by just adding the following stanza to the [SERVAPENET] section of the corresponding ServaAsset.inf

[SERVAPENET]
EndProcess = *TaskSeqSelector

But we can also do more things:

7.1 An application might need a different letter than P: pointing to the asset's Head Directory i.e.

[SERVAPENET]
DeviceName = G:


7.2 Running a local executable i.e.

[SERVAPENET]
EndProcess = X:\Windows\System32\Notepad.exe
EndProcessParams = X:\Serva.txt   
Note
On the net booted Windows PE X: points to the root of the booted Windows PE Environment.



7.3 Running a remote executable i.e.

[SERVAPENET]
EndProcess = P:\Bin\xxxx.exe
EndProcessParams = -x -y -z
Note
On the net booted Windows PE P: (by default) points to the net booted asset Head Directory on Serva's repository.

7.2 and 7.3 can be used for net booting non-PXE friendly Windows PE based tools even if they use external components.


7.4 Preventing ServaPENet login errors 0x4CF, 0x35, etc. These errors are sometimes related to network drivers not signaling that they are not ready to use when Serva attempts the repository login. ServaPENet 4.0.0 implements a small default delay before login but some drivers might need a longer value. defaults:

[SERVAPENET]
#default values in mS
BIOS_LoginDelay = 800
UEFI_LoginDelay = 1200
BIOS_UnattendLoginDelay = 2200
UEFI_UnattendLoginDelay = 4200

 

8 Instaling Windows 10 Enterprise ARM from ISO

Serva can also install ARM ISOs from MSDN like i.e.

en_windows_10_iot_enterprise_version_20h2_updated_nov_2020_arm64_dvd_39b08b3b.iso

we proceed as usual with an ISO install as explained in:
PXE/BINL - AN01.1: Windows Network Install - WDS OSs

This particular ISO requieres the Serva injection of both network and disk drivers for a full overwrite mode install on Surface Pro X and network driver injection for the upgrade mode install.
For installation on different ARM hardware the requierements will vary.

 

9 Troubleshooting

8.1 Troubleshooting Capture task sequence errors (Image_Capture.cmd).

8.1.1 [TS] ERROR: User does not have Writing Rights in Serva's repository.
Capture task sequences are meant to save the captured image file/s at Serva's repository, for that reason when we login with ServaPENet we must use an user with Writing Rights on WIA_WDS_SHARE.

8.1.2 [TS] ERROR: Couldn't find OS Volume labeled "Local Disk"
Our capture task sequence example (Capture_SurfaceProX.cmd) expects to find the Windows volume being captured labeled as "Local Disk"; this is the default for a Surface Pro X. If your Windows partition being captured is labeled differently in your reference PC (i.e. "XXX YYY") please edit the task sequence variable WINVOLUMELABEL accordingly:

:: -- Task Sequence Variables --\
:: SET THE LABEL OF THE WINDOWS PARTITION BEING CAPTURED HERE
SET WINVOLUMELABEL="Local Disk""
:: -- Task Sequence Variables --\
:: SET THE LABEL OF THE WINDOWS PARTITION BEING CAPTURED HERE
SET WINVOLUMELABEL="XXX YYY"

In order to know the Label of the OS volume on a target PC we can just open a console as soon as the client is booted and ServaPENet is active then type:

X:> diskpart
DISKPART> set disk 0
DISKPART> list volume
Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- -------- ------- Volume 0 C Local Disk NTFS Partition 118 GB Healthy Volume 1 Windows RE NTFS Partition 410 MB Healthy Volume 2 SYSTEM FAT32 Partition 260 MB Healthy Hidden
DISKPART> exit X:>

In this example (MS Surface Pro X 128GB) the volume containing the OS is labeled "Local Disk".

8.2 Troubleshooting Deployment task sequence errors (Image_Deployment.cmd).

8.2.1 [TS] ECHO ERROR: This Task Sequence must be run under Windows PE.
The Deployment task sequence uses diskpart which could potentially wipe a disk without requiring any confirmation. The script prevents being run in other than Windows PE environments.

8.2.2 Target PC does not properly boot after a deployment without errors

  1. Please verify that the captured image correspond to a bootable Windows partition, you can do that by i.e. opening the image WIM file with 7-zip and see the image content.
    If the image was captured using our Image_Capture.cmd remember this task sequence expects to find the Windows partition being captured labeled as "Windows"; If your Windows partition being captured is labeled differently please read 8.1.2

  2. The deployment task sequence Image_Deployment.cmd by default sets the target hard disk in GPT mode, if later the target PC is booted in Legacy mode it won't be able to boot. In this case booting the target in UEFI mode solves the problem.

 

10 Final words

The discussed Serva PXE/BINL advanced techniques represent one more step in the road to master the different Microsoft Windows network boot/install/capture/deploy scenarios. Users can now easily perform Capture and Deployment of Windows ARM OS images.

If you are a Serva Community user and you find it useful please consider purchasing Serva Pro. Non-personal or commercial use of Serva always requires a Serva Pro license (see Serva's download page for further details).

Serva bugs, comments, or ideas on how to improve the information contained in this document please contact us here.

Updated 02/20/2021
Originally published 02/18/2021