How To Create a Universal Ghost Image Using Sysprep and Mysysprep

How To Create a Universal Ghost Image.
This is my guide to building a "Universal" (compatible with most HALs) Ghost Image. I will revise as needed.

Hopefully this will cover everything you need to create your own Universal Image. I have tried to cover all the issues I have run into. With the use of "MYSYSPREP", my image names the PC via it's serial cnumber and switches the HAL based on the model.

If you have any questions or suggestions please feel free to comment.

Note*: You need to make sure you are using the Corporate version of Windows XP. If you are using a regular OEM copy of Windows you will have issues using SYSPREP. I believe after you SYSPREP an image twice it requires you to re-validate or something.

Note*: Make sure you do not install "Windows Genuine Advantage". If you have, remove it. Here are the instructions on how to... http://support.microsoft.com/kb/921914

Okay, so lets get started..

1. Do a clean install of Windows XP.

• I usually start building the image on my slowest model PC. I have found that this really does not matter as long you change the HAL to ACPI.
• Try to avoid installing any unnecessary drivers and make sure to utilize the ".inf" for the drivers that are required.
• Optional: I usually create a backup image right after I install windows. This saves me time if I have to start from scratch

2. Change the HAL to ACPI.

1. Open the I386 folder located on your XP SP2 cd.
2. Open the SP2.CAB.
3. Extract halacpi.dll (not halaacpi.dll) to a temporary folder and rename it to hal.dll.
4. Extract ntkrnlpa.exe and ntoskrnl.exe to the same temporary folder.
5. Move all three files to the system32 folder under your windows directory. Say yes to replace files.
6. Reboot
   

You have now switched your PC to ACPI!

3. Apply all critical patches released by Microsoft. Again, avoid installing Windows Genuine Advantage.

4. Create a configuration checklist and follow it.

• Note*: One of the interesting features they added to XP SP2 is the fact that when you SYSPREP your image it will copy the local admin profile to the default profile. I have mixed feeling about this but I have made it work for me. There is a patch to get around it if you need it
• Here is a generic checklist. Add or remove details as needed...

1. _Clear take a tour
2. _Clear .net passport
3. _Remove MSN Explorer
4. _Remover Internet Messenger
5. _Display Setting
6. _1024 x 768
7. _Windows Classic Theme
8. _Set wall paper
9. _Set screen Saver
10. _Set power scheme
11. _Disable hibernation
12. _Set Taskbar settings
13. _Set internet option
14. _Empty Recycle Bin
15. etc...

5. Install and configure necessary software.

• I try to document whatever I have installed in a change log. That way we can keep track of changes.

6. Download the latest version of SYSPREP. You can find it at... http://support.microsoft.com/?kbid=838080

• Extract "deploy.cab" to "C:\sysprep" on your image machine.

7. Download "MYSYSPREP" from here... http://jimtsay.googlepages.com/mysysprep

• extract it into the "c:\sysprep" folder.
• This is a hacked version of SYSPREP. Read the full description of it via the link. It works side-by-side with sysprep to add more robust features.

8. Create the following folder "c:\drivers". Make a subfolder for each of the required drivers for all your PCs.

Example.
c:\drivers\vid7600
c:\drivers\snd7600
c:\drivers\vid350

Make sure to trim your drivers down. Anytime you download drivers they usually contain a folder with what is required for windows... files with the .inf extension. Here is a screen shot of an audio driver I have.




9. You can create your own sysprep.inf by running c:\sysprep\setupmgr.exe. It will ask you a series of questions related to what you want sysprep to do. Or you can use the sysprep.inf below.

Note*: Anything I put in bold and red do not include in your sysprep.inf.

[Unattended]
;This tell sysprep to do an unattended setup.
unattendedMode=FullUnattended
OemSkipEula=Yes
;OemPnPDrivers refers to the "C:\drivers" folder you created. I trimmed this down a bit.
OemPnPDriversPath=Drivers\Snd64;Drivers\Vid6400;Drivers\Vid62;Drivers\Vid6;Drivers\mdm62;Drivers\mdm6;Drivers\snd62;Drivers\MD64;Drivers\Modem64;Drivers\TPM;Drivers\QL64;Drivers\FING;Drivers\SATA
;InstallFilesPath refers to the root in which you store everything... drivers etc...
InstallFilesPath=C:\
ConfirmHardware=No
OverwriteOemFilesOnupgrade=No
DriverSigningPolicy = Ignore
oempreinstall=yes
updateInstalledDrivers=Yes

[GuiUnattended]
;Set your local admin password here
AdminPassword=******
AutoLogon=No
AutoLogonCount=0
OEMSkipRegional=1
TimeZone=35
OemSkipWelcome=1s

[UserData]
;Put your Product Key here.
ProductKey=xxxx-xxxx-xxxx-xxxx-xxxx
FullName="xxx"
OrgName="xxx"
;This is a special added feature that comes with MYSYSPREP. ;You can have your PC named by it serial number. ;Below you see that I have it type out JAX in front of the Serial Number
ComputerName=JAX%SerialNo%

[Display]
BitsPerPel=32
Xresolution=1024
YResolution=768

[SetupMgr]
DistFolder=C:\sysprep\i386
DistShare=windist

[Identification]
;Here you can have the computer join the domain. ;Enter the crudentials of a user that has rights to do this. JoinDomain=xxx
DomainAdmin=xxx
DomainAdminPassword=xxxx

[Networking]
InstallDefaultComponents=Yes

[Sysprep]
BuildMassStorageSection=No

[SysprepMassStorage]
PCI\VEN_8086&DEV_27C1&CC_0106 = %systemdrive%\drivers\sata\iaahci.inf ; Intel(R) 82801GR/GH SATA AHCI Controller (Desktop ICH7R/DH)
PCI\VEN_8086&DEV_27C5&CC_0106 = %systemdrive%\drivers\sata\iaahci.inf ; Intel(R) 82801GBM SATA AHCI Controller (Mobile ICH7M)
PCI\VEN_8086&DEV_2652&CC_0106 = %systemdrive%\drivers\sata\iaahci.inf ; Intel(R) 82801FR SATA AHCI Controller (Desktop ICH6R)
PCI\VEN_8086&DEV_2653&CC_0106 = %systemdrive%\drivers\sata\iaahci.inf ; Intel(R) 82801FBM SATA AHCI Controller (Mobile ICH6M)
PCI\VEN_8086&DEV_27C3&CC_0104 = %systemdrive%\drivers\sata\iastor.inf ; Intel(R) 82801GR/GH SATA RAID Controller (Desktop ICH7R/DH)
PCI\VEN_8086&DEV_24DF&CC_0104 = %systemdrive%\drivers\sata\iastor.inf ; Intel(R) 82801ER SATA RAID Controller (Desktop ICH5R)
PCI\VEN_8086&DEV_25B0&CC_0104 = %systemdrive%\drivers\sata\iastor.inf ; Intel(R) 6300ESB SATA RAID Controller
PCI\VEN_8086&DEV_2652&CC_0104 = %systemdrive%\drivers\sata\iastor.inf ; Intel(R) 82801FR SATA RAID Controller (Desktop ICH6R)

Note*: I have "BuildMassStorageSection=No". This is only because I know exactly which mass storage drivers I need. If you change this option to "Yes" it will populate a huge list of storage drivers. This will make it more compatible across different hardware, but it adds a good 30 minutes to the SYSPREP process. Note*: I have included custum mass stroage drivers. This is for my Compaq laptops.

10. Once you have your sysprep.inf in place it is time to look at the "c:\sysprep\mysysprep.inf".
This files contain the information needed to switch the HAL before mini setup.

Here is an example:

[Manufacturer]
;Manufacturer Name=mfg.inf

[Model]
;Model Name=model.inf
;MP model=mp.inf
;UP model=up.inf
hp Compaq nc6000 (DD522AV)=up.inf
HP Compaq nc6230 (PU985AA#ABA)=up.inf
HP Compaq dc7600 Small Form Factor=mp.inf
HP Compaq dc7100 SFF(DX878AV)=mp.inf
HP d530 USDT(DG009A)=mp.inf HP d530 CMT(PB600A)=mp.inf
HP Compaq nc6400 (RA263AT#ABA)=mp.inf
[SerialNo]
;Serial No=serial.inf

Notice you have a couple of different ways to specify the HAL. I do mine by model. You can get the model info by typing "c:\sysprep\mysysprep /smbios" from the command prompt.

Note*: Make sure you have up.inf and mp.inf in your sysprep folder.

11. Now lets backup our base image in case we need to make changes in the future. I just create an image and call it by "Something Descriptive"base. Make sure to keep a changelog and always hold onto a couple older versions of the image.

12. Time to sysprep the image. Go ahead and clean out any Temp folders and those windows update unistall etc... Make sure to clear out your recycle bin.

Go to your "c:\sysprep" and run mysysprep.exe. Hit OK past the warning. You should see something like this...


Go ahead and check the Use Mini-Setup box and click Reseal. Once SYSPREP is done it will shut down your PC.

13. As soon as you turn on your PC back on boot it to a Pre-Environment or use a ghost boot disk. Create an image of your machine and you should be all set.

14. Push the SYSPREP'd image to a new machine. See if it works!

Note*: SYSPREP will automatically delete itself when it completes!

Errors and what they mean.

Laptops can be the trickiest to image. Make sure you are using the proper HAL and Mass stroage drivers.

I have found that when safe mode stops at agp440.sys it is the HAL.
When it stops at mup.sys it is the mass storage drivers.

"Helpful Links"

Adding Drivers to your image.
http://www.microsoft.com/technet/technetmag/issues/2006/05/UtilitySpotlight/default.aspx

click start

settings

control panel

administrative tools

domain controller security policy

now follow thse steps and your ready to ghost!

2. Open the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options folder.
3. Locate the Microsoft network server: Digitally sign communications (always) policy setting, and then click Disabled or Do Not Configure.

This past weekend lauries family put on a baby shower for her. She recieved alot of nice stuff. I honstly do not have a clue what 95% of it is for but hey how hard could it be! I mean you put food in one end and clean the other end when it comes out seems pretty simple right?  We also had a 8 hour lamaz class. Now maybe I should classify this as a rant but I think lamaz training is a reserved for the 7th circle of hell. By the end of the day of watching gross videos and breathing techniques I wanted to stop breathing myself! Guys if you can avoid the lamaz class do so at all costs! If you cant get out of itdo the 2 hour classes at least the agony will be shorter durations.

The babys room is all finished i painted it about a month ago wanted the fumes to be long gone before the new resident arrives. We picked out a nice set at babys r us and got that in and all put together. I installed some nice shelves above the windows to put stuff on. I want to track down some wall mount corner shelves which is not as easy as it sounds but I am hitting the stores tomorow for those. We also ordered a night stand for the room from walmart.com so that should be in soon and the room will be complete. The in will be the filling of the room!

edit the my new print server field with the name of your new print server and as long as your share names are all the same run this script in a users login script and you are done no fuss no muss and it will even keep the users default printer! Good luck hope this helps someone out!

On Error Resume Next
Function GetDefaultPrinter()
sRegVal = "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device"
sDefault = ""
On Error Resume Next
sDefault = objShell.RegRead(sRegVal)
sDefault = Left(sDefault ,InStr(sDefault, ",") - 1)
On Error Goto 0
GetDefaultPrinter = sDefault
End Function

Set objNetwork = CreateObject ("Wscript.Network")
Set objShell = CreateObject ("WScript.Shell")
Set objFSO = CreateObject ("Scripting.FileSystemObject")

LogonServer = objShell.ExpandEnvironmentStrings("%logonserver%")
UserName = objShell.ExpandEnvironmentStrings("%username%")

strComputer = "."
PrintServer = "MYNEWPRINTERSERVER"
PrintServer = LCase (PrintServer)

Err.Clear
Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2")

If Err.Number Then
wscript.echo ("Error : " & Err.Number & ": " & Err.Description & VbCrLf)
Err.Clear

Else
ImpDefault = GetDefaultPrinter
Set colInstalledPrinters = objWMIService.ExecQuery _
("SELECT * FROM Win32_Printer")
For Each objPrinter in colInstalledPrinters
PrinterArray = Split (objPrinter.Name , "\")

If (LCase(objPrinter.ServerName) <> "") and (LCase(objPrinter.ServerName) <> "\\" & PrintServer) then

On Error Resume Next
Function GetDefaultPrinter()
sRegVal = "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device"
sDefault = ""
On Error Resume Next
sDefault = objShell.RegRead(sRegVal)
sDefault = Left(sDefault ,InStr(sDefault, ",") - 1)
On Error Goto 0
GetDefaultPrinter = sDefault
End Function

Set objNetwork = CreateObject ("Wscript.Network")
Set objShell = CreateObject ("WScript.Shell")
Set objFSO = CreateObject ("Scripting.FileSystemObject")

LogonServer = objShell.ExpandEnvironmentStrings("%logonserver%")
UserName = objShell.ExpandEnvironmentStrings("%username%")

strComputer = "."
PrintServer = "MYNEWPRINTERSERVER"
PrintServer = LCase (PrintServer)

Err.Clear
Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=Impersonate}!\\" & strComputer & "\root\cimv2")

If Err.Number Then
wscript.echo ("Error : " & Err.Number & ": " & Err.Description & VbCrLf)
Err.Clear

Else
ImpDefault = GetDefaultPrinter
Set colInstalledPrinters = objWMIService.ExecQuery _
("SELECT * FROM Win32_Printer")
For Each objPrinter in colInstalledPrinters
PrinterArray = Split (objPrinter.Name , "\")

If (LCase(objPrinter.ServerName) <> "") and (LCase(objPrinter.ServerName) <> "\\" & PrintServer) then

objNetwork.AddWindowsPrinterConnection "\\" & PrintServer & "\" & PrinterArray(3)
If Err.Number Then
wscript.echo ("Error : " & Err.Number & ": " & Err.Description & VbCrLf)
Err.Clear
End If

If ImpDefault = objPrinter.Name then
objNetwork.SetDefaultPrinter ("\\" & PrintServer & "\" & PrinterArray(3))
End If

objNetwork.RemovePrinterConnection objPrinter.Name
End If
Next
End If

objNetwork.AddWindowsPrinterConnection "\\" & PrintServer & "\" & PrinterArray(3)
If Err.Number Then
wscript.echo ("Error : " & Err.Number & ": " & Err.Description & VbCrLf)
Err.Clear
End If

If ImpDefault = objPrinter.Name then
objNetwork.SetDefaultPrinter ("\\" & PrintServer & "\" & PrinterArray(3))
End If

objNetwork.RemovePrinterConnection objPrinter.Name
End If
Next
End If

• Do a clean install of windows 2003 on your new server install all drivers and windows updates. (always best to begin working with a stable updated platform)
• Assign the new machine an Ip and subnet in the current domains subnet make sure that the DNS points to the 2000 domains current DNS servers
• Join the server that will be the future domain controller to the 2000 domain as a member server
• Do you currently run an exchange 2000 server?

• Now we can Prepare the domain for the new 2003 server

• You are now ready to install active directory. The easiest way to accomplish this is to ad a role to your server. To make it a domain controller and follow through the wizard the installer will do the rest.
• If you are going to run you dhcp server off of this machine you will want to transfer it by using this how to http://articles.techrepublic.com.com/5100-6345_11-5034284.html
• Now you must transfer you’re your primary domain controller roles to your new 2003 server here is an exact how to to do this http://www.petri.co.il/transferring_fsmo_roles.htm
• If you want to migrate user drives or other network shares I suggest Hyena as it will migrate the shares the permissions and everything from one server to the next or you can accomplish this by doing the following

• Now it is time to test the new DC shut down the old one and see how the new domain controller handles everything. If all is well move on to the next step
• Boot up the old domain controller run dcpromo and demote the old 2000 domain controller and uninstall active directory and walla you are done!

anyone can use the code in this script with their windows domain login scripts just copy and paste it in. The only change you will need to make to the code is the server and share  where the info will be stored.

for /f "tokens=1-3 delims=: "  %%i in ('time /t') do set datime=%%i:%%j %%k
FOR /F "Delims=:  Tokens=2" %%a in ('IPCONFIG^|FINDSTR /I IP') DO FOR /F "Delims=. Tokens=1-4" %%f in ('ECHO %%a') DO set IP=%%f.%%g.%%h.%%i
for /f "tokens=1-4 delims=/- " %%i in ('date /t') do echo %computername%,%IP%,%username%,%datime% >>\\server\loginlogs$\%%j-%%k-%%l.txt

first step is create a share on one of your servers with modify access to everyone. I prefer to use a hidden share in this to keep prying eyes out of the logs.

a new text file will be created every day in the share with the date as the name.

for example  04-04-2008.txt

the output from the script will look exactly lke this

machine name, IP address, username, exact time

computer, 10.1.1.5,joemomma,04:16 PM

you could use utilities to then import this data into a database. this is a very basic first step but will help you keep tabs on those naughty users........

Okay, not for nothing, and mind you yes I am pregnant and yes my emotions and hormones are running crazy, but seriously, is this guy the biggest idiot around?  So maybe breast feeding isn't life or death, and there are other options (such as pumping and formula), but I do believe she has a valid reason for postponement.  But Chemo and Dialysis? How can this man sit there and state those are not valid reasons to postpone your duties?  Is the juror's life worth so little? Exposing a cancer patient, whose immune system obviously is not working correctly, to all the germs and people in the court house .. what the hell!! And dialysis? 'I'm sorry madame juror, I understand your kidneys are not working, and yes you are swelling up before my eyes, but hey, that's no excuse now sit down and I expect you to have a clear and unbiased mind as you hear this case.'   Somebody needs to knock some sense into Mr Brian Fosh, and I hope that someday he doesn't need to post pone his jury duty!!