Sunday, January 19, 2020

Create Final Windows 7 AIO ISO

Now that Windows 7 is EOL after receiving its final patches on the 14th, I went on to update my AIO (All in One) install with one that is 99% patched.  If you are unaware, it's just an Install.wim with several indexes. There are many reasons to still use Windows 7 so having it start up initially being patched already is a time saver and smart security-wise.

My Current AIO has all versions from Starter up to Enterprise however it excludes K and KN versions. I never expected to use those under any circumstances. I only installed Starter to see what it was about.

First is to update it, which Jason Sandys covers in great detail and all credit to him. He covers how to create a slipstreamed WIM that has the majority of updates injected to save a ton of time and be safer. I started down the road of a simple bat file to inject updates via DISM but Jason's script is way more intuitive and powerful.

While he wrote it in November of 2019 there are a few newer patches to apply. I just modified his script to change the KB numbers. You could also append the Jan 2020 final cumulative after applying the November 2019 one Jason covers.
  • KB4525235 -> KB4534310 (Windows 7 Cumulative)
  • KB4525106 -> KB4534251 (IE11 cumulative)
  • KB4523206 -> KB4536952 (November 12 2019 Servicing Stack update)
Or for the relevent lines with original ones commented out.

 ::SET WINDOWS7=4474419 3020369 3125574 4490628 4523206 4525235  
 SET WINDOWS7=4474419 3020369 3125574 4490628 4536952 4534310  
 ::SET IECU=4525106  
 SET IECU=4534251  

Once you have the updated WIM ready to go you can create the AIO. There are many ways to create one. I just use dism to export a single WIM into the AIO WIM but this link shows a few ways to do it. GIMAGEX is another option I like to use. For dism its pretty simple. I adapted Jasons folder structure.

 dism /Export-Image /SourceImageFile:image\Prox64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Professional Final x64" /Compress:max  
 dism /Export-Image /SourceImageFile:image\Enterprisex64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Enterprise Final x64" /Compress:max  
dism /Export-Image /SourceImageFile:image\HomePremiumx64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Home Premium Final x64" /Compress:max

Some suggestions to share:

  • If you are doing both 32-Bit and 64-Bit use the 32-Bit media as the ISO source as it can install a 64-Bit OS, however, the opposite is not true. Due to this I also have a 7ZIP file with the 64-Bit ISO, minus the two WIM files, to perform an edition change and some types of repair you boot from the install media for. This is few and far between though.
  • Use something to differentiate 32-Bit and 64-Bit in the WIM using the Name attributes. It will detect which Edition and architecture it is but won't let you use the same name in the WIM. I just use 'x64' for all 64-Bit ones.
  • delete the sources\ei.cfg file. Otherwise, it will install the OS Edition stated in ei.cfg. If this file is missing then you are prompted as shown above for the edition and architecture you want.
  • My first AIO has Starter as index 1 so I have to scroll down for Professional or Ultimate when I use the AIO personally and Enterprise professionally. Rarely do I use the other Editions. I created my final AIO with the fully patched Pro and Enterprise that I use the most as index 1 and 2. Then went from unpatched (SP1 only) Enterprise down to Starter.
  • All 64-bit was first then 32-Bit. As my first AIO was from 2010 there was a lot of 32-Bit work. I have not touched 32-Bit in many years but it's still there just in case I get an old system CPU without the X86-64 instruction set.
  • To test, just take your patched one and replace USB\sources\install.wim. I did this on all modified WIMs before going through the AIO process.
Once your Final AIO WIM is ready you can create the ISO for VM use or the rare case of burning optical media. With the injected updates the WIM is over 4GB in size so it will not fit on a USB stick formatted with FAT32. I talk about this in relation to Windows 10 here and my need to use optical media for it. For USB, Windows 7 does not support a second NTFS volume however you can just split the WIM using dism. In my case this WIM is 6.7GB so I have to replace install.wim with install.swm and install2.swm. This also means I have to burn to a DVD9 (Dual layer) instead of DVD5 (single layer). You could make a 64-Bit only if you never anticipate using really old hardware.

 Dism /Split-Image /ImageFile:C:\sources\install.wim /SWMFile:C:\sources\install.swm /FileSize:4700  

I did all this on a Windows 10 Pro workstation. For the ISO file creation, you will need to install the ADK relevant to your OS. In my case the 1903 version since I am on 1909. This gives you the oscdimg.exe executable needed to generate the ISO file for your new AIO. On my 1903 ADK its located in Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\. An example command to generate an ISO file. 

 oscdimg.exe -lWindows_7_SP1_AIO_Final -m -u2 -bE:\W7AIOFinal\Boot\ E:\W7AIOFinal E:\Windows7_SP1_AIO_Final.ISO  

My flow is
  1. Copy Windows7_SP1_AIO.ISO from FreeNAS
  2. Extract to folder Win7AIOFinal
  3. extract relevant index to be patched
  4. run through Jasons script to patch
  5. import modified WIM into new WIM file
  6. import rest of AIO indexes into new WIM File
  7. Split install.wim to install.swm
  8. replace WinAIO7final\sources\install.wim with install.swm files
  9. Create ISO file
  10. test in ESX
  11. update Windows 7 AIO USB stick
  12. Put ISO onto FreeNAS and backup


As long as Windows 7 has been around you may also want to inject newer storage drivers into the Boot.wim so it can install Windows 7 on newer storage controllers. I touch on this while getting Windows 7 on an unsupported AM4 Ryzen 3 system personally. Several motherboard manufacturers have a tool to inject drivers needed for newer hardware into the boot.wim so you don't have to track them down. ASUS, MSI and ASROCK to name a few. You can do this yourself with dism and the add-driver switch. This is also useful for the NVMe and/or TPM 2.0 patch as Microsoft pulled it so you can install Windows 7 to NVMe storage.If you have them, you can inject the NVMe and TPM 2.0 updates into the install WIM as well. I talk about NVME and Windows 7 here.

With Microsoft charging for support past its original end, this Final may not be really the final. See what that entails!

This script is provided as-is; no warranty is provided or implied. The author is NOT responsible for any damages or data loss that may occur through the use of this script.  Always test, test, test before rolling anything into a production environment.

I created a script to do all the work you can use. Not very pretty but it will get the job done and can be easily modified. It will perform the following:

  • export all WIMs from the AIO
  • run Jasons script against a few
  • Create New WIM
  • Split the WIM into SWM files
  • Create ISO

Wednesday, December 11, 2019

Windows 10 Install.WIM too big for USB

I've developed methods to image one-off devices with the corporate image, however, there are times when I need to use a vanilla install to test something or prove it’s not a problem with the image. While I used to have a vanilla TS in ConfigMgr and MDT, I had several cases where I needed to go even more vanilla without drivers being injected. Therefore, I have a USB stick with the latest Windows install from VLSC. Sometimes I also DISM in the Home edition for All-In-One (AIO) use. A friend wanted to know how I made it since the install.wim is > 4GB since about 1709 I believe.

Why the limit? 

The 4 GB barrier is a hard limit of FAT32: the file system uses a 32-bit field to store the file size in bytes, and 2^32 bytes = 4 GB (actually, the real limit is 4 GB minus one byte, or 4,294,967,295 bytes, because you can have files of zero length). This means that you cannot copy a file that is larger than 4 GB to any plain-FAT volume.


You can use exFAT or NTFS, however these are not always bootable across devices.

You can use Rufus to burn the ISO, however it creates its own bootloader that only works with UEFI and I sometimes have a need for MBR. The stock Windows ISO just works so I wanted that functionality.

The consumer Windows ISO gets around this by compressing the WIM to an ESD as well as not including editions such as Enterprise that have additional files. I did this at first, however it was barely under the 4GB limit so would not scale. So I went even more simple. Create two partitions; that’s it –  one FAT32 the other NTFS.


I use diskpart, however you can also do this via the GUI using Disk Management and format dialogs. However it takes longer then diskpart. You can proceed through this in just a few minutes. It took me longer to write about it then to actually do it! First is to identify the disk so you don’t break something else. In this example I have an 8GB stick that is disk 6.

DISKPART> lis dis

  Disk ###  Status         Size     Free     Dyn  Gpt

  --------  -------------  -------  -------  ---  ---
  Disk 0    Online         1863 GB   350 MB        *  
  Disk 1    Online          476 GB  1024 KB        *
  Disk 2    No Media           0 B      0 B
  Disk 3    No Media           0 B      0 B
  Disk 4    No Media           0 B      0 B
  Disk 5    No Media           0 B      0 B
  Disk 6    Online         7810 MB      0 B

DISKPART> sel dis 6

Disk 6 is now the selected disk.

Then do a clean to remove any formatting on the stick.


DiskPart succeeded in cleaning the disk.

Create the first partition and format it as FAT32. You only need about 600MB but I do a GB for future use.

DISKPART> create partition primary size=1000

DiskPart succeeded in creating the specified partition.

DISKPART> format fs=fat32 quick

  100 percent completed

DiskPart successfully formatted the volume.

Set to active so it boots, and assign a drive letter

DISKPART> active

DiskPart marked the current partition as active.

DISKPART> assign

DiskPart successfully assigned the drive letter or mount point.

Create a second volume using the remaining space. If you have a large stick and want to use it for other stuff, you can create about 5GB NTFS and create a third volume for file storage, but I just use a folder on this volume if I need NIC drivers to install later, for example.

DISKPART> create partition primary

DiskPart succeeded in creating the specified partition.

Format it as NTFS

DISKPART> format fs=ntfs quick

  100 percent completed

DiskPart successfully formatted the volume.

Finally, assign it a drive letter. (Do not make it active.)

DISKPART> assign

DiskPart successfully assigned the drive letter or mount point.

Now that the two volumes are created, you copy all the files from the Windows ISO to the FAT32 volume minus the sources folder. Then create a sources folder on the FAT32 volume and copy boot.wim to it from the ISO. Finally, copy the sources folder to the NTFS volume.

All done. This USB stick will boot on any system the ISO will. As new Windows 10 releases come out, I just copy the ISO contents to these two volumes.

I didn't have the heart to tell my friend about my multiboot USB that I keep on my key-ring with all sorts of ISOs including the Windows installs, my AdminPE, and Disk Sanitizer ISOs. I'll share that setup sometime.


Mike Terrill talked about this as well a bit ago.


Sunday, November 24, 2019

Windows 7 on Ryzen 3000

My kids’ gaming PC died in early 2019. The motherboard or CPU fried and took the other with it.  It was an FX-8370 (AM3+) based MSI system with R9 270X Video Card. I gave them a choice: I build a new one around Ryzen 2, or they wait for Ryzen 3 and get more. I am happy they chose the latter, so we waited until Ryzen 3 came out. I decided to wait more for the MSI MAX boards which have a larger firmware (BIOS) chip. I finally got tired of waiting and was going to get an ASRock Steel Legend and found the MAX on NewEgg when I started ordering. I went with this config:
I already had the power supply, GPU, and storage from the old one to reuse. After assembly, I was pleased it came up on first try. I put Windows 10 and let my youngest play FortNite on it for a few hours. Who needs CPUBurn when you have a gaming kid...!

Before it went into "production" I wanted to get Windows 7 on it for ... Reasons. MSI, AMD, and other sites only say Windows 7 is supported on these Ryzen processors:
  • Bristol Ridge (APU)
  • Summit Ridge (Ryzen 1)
  • Pinnacle Ridge (Ryzen 2)
Since mine is a Ryzen 3000, its code name is Matisse and therefore unsupported. Which is fine really, as Windows 7 goes EOL in a very short few months. This motherboard is B450 based so it should have some support compared to the newer X570 chipset. As I've proven many times over with my deployment work, just because it’s unsupported doesn't mean it won't work. So away I went!

I put a 250GB SSD I keep as a spare on port 1 of the mobo and boot off my Windows 7 AIO USB. It also includes the NVMe, TPM2, and Post SP1 rollup on it. Get to the welcome screen, and nothing. Keyboard and mouse are dead. Try a couple other ports and even the "slow" ones by the NIC used for keyboard and mouse compatibility. NOTHING. Change some USB compatibility settings in the BIOS. STILL NOTHING. Unable to interact with the wizard makes it real hard to inject drivers. It might be a short trip. Instead, I swing by my dad’s and grab an old HP PS2 keyboard since this is a gaming board. Works! Get through the wizard to where it asks what partition to install onto and it wants drivers since it cannot see the storage.

Next problem. l pull a trick from ConfigMgr and MDT: inject drivers. I grab the MSI Windows 7 drivers as well as AMD's all-in-one and inject those drivers into the boot.wim on the AIO USB and reboot. No luck. I then mount the Windows PE BOOT.WIM and put the drivers on it in a folder so I can browse them in the wizard. Still no luck. Note to self: The installer's main volume is index 2 of BOOT.WIM and this is what you could browse. I also try the Windows 10 BOOT.WIM and it errors out in fantastic ways I need to revisit.

I then decide to use an older storage controller but don’t have any available so order one and got this ASM1061-based one which I know uses built-in drivers in at least Vista, and it says it is supported back to even XP. After installing it into the machine I get to the same spot, however, I can now browse the SSD as it had a single NTFS partition on it. But I still cannot proceed.

Next problem. I attach the SSD to a Linux VM and copy the MSI and AMD drivers along with others that I think might work as I did not have to mess with the BOOT.WIM since I reverted back to the original sealed one. The error dialog changes slightly from before and hints it could not find the install media. PE will use higher performance drivers. I burn the Windows 7 AIO to a DVD and hook up a BluRay player and SUCCESS!  It did not work off the motherboard but does work off the PCIe controller I got above. Windows 7 got installed!

After boot-up I still have chipset/USB issues as only the PS2 keyboard worked, so I open a shell and install the AMD all-in-one and got USB mouse and keyboard. I also install the NIC and Audio drivers. Out of curiosity, I move the SSD to the internal controller and it boots up fine now that it had the right drivers. It was happy and I could have used it after applying patches.

Now that I got what I wanted out of Windows 7, I move the (Windows 10) SSD and hard drive from the fried system to it and give it to the kids so they can run that for a while. I will keep an eye on sales over the holidays though. I do want to get this system over to M.2 NVMe. So told the kids it will get rebuilt from scratch when I obtain those. This instance of Windows has been in about 5 or 6 different PCs. Additionally, my FX-8350 system is showing its age so I'll move to Ryzen in a few months and hand this down to my backup server. Maybe I'll have to do this again or just move the kids to a 3950X and X570 system while I take the guts from this one. Their games push a system more than my work does.