Sunday, January 19, 2020

Create Final Windows 7 AIO ISO

Now that Windows 7 is EOL after receiving its final patches on the 14th, I went on to update my AIO (All in One) install with one that is 99% patched.  If you are unaware, it's just an Install.wim with several indexes. There are many reasons to still use Windows 7 so having it start up initially being patched already is a time saver and smart security-wise.

My Current AIO has all versions from Starter up to Enterprise however it excludes K and KN versions. I never expected to use those under any circumstances. I only installed Starter to see what it was about.


First is to update it, which Jason Sandys covers in great detail and all credit to him. He covers how to create a slipstreamed WIM that has the majority of updates injected to save a ton of time and be safer. I started down the road of a simple bat file to inject updates via DISM but Jason's script is way more intuitive and powerful.

While he wrote it in November of 2019 there are a few newer patches to apply. I just modified his script to change the KB numbers. You could also append the Jan 2020 final cumulative after applying the November 2019 one Jason covers.
  • KB4525235 -> KB4534310 (Windows 7 Cumulative)
  • KB4525106 -> KB4534251 (IE11 cumulative)
  • KB4523206 -> KB4536952 (November 12 2019 Servicing Stack update)
Or for the relevent lines with original ones commented out.

 ::SET WINDOWS7=4474419 3020369 3125574 4490628 4523206 4525235  
 SET WINDOWS7=4474419 3020369 3125574 4490628 4536952 4534310  
 ::SET IECU=4525106  
 SET IECU=4534310  

Once you have the updated WIM ready to go you can create the AIO. There are many ways to create one. I just use dism to export a single WIM into the AIO WIM but this link shows a few ways to do it. GIMAGEX is another option I like to use. For dism its pretty simple. I adapted Jasons folder structure.

 dism /Export-Image /SourceImageFile:image\Prox64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Professional Final x64" /Compress:max  
 dism /Export-Image /SourceImageFile:image\Enterprisex64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Enterprise Final x64" /Compress:max  
dism /Export-Image /SourceImageFile:image\HomePremiumx64.WIM /SourceIndex:1 /DestinationImageFile:image\install.wim /DestinationName:"Windows 7 Home Premium Final x64" /Compress:max

Some suggestions to share:

  • If you are doing both 32-Bit and 64-Bit use the 32-Bit media as the ISO source as it can install a 64-Bit OS, however, the opposite is not true. Due to this I also have a 7ZIP file with the 64-Bit ISO, minus the two WIM files, to perform an edition change and some types of repair you boot from the install media for. This is few and far between though.
  • Use something to differentiate 32-Bit and 64-Bit in the WIM using the Name attributes. It will detect which Edition and architecture it is but won't let you use the same name in the WIM. I just use 'x64' for all 64-Bit ones.
  • delete the sources\ei.cfg file. Otherwise, it will install the OS Edition stated in ei.cfg. If this file is missing then you are prompted as shown above for the edition and architecture you want.
  • My first AIO has Starter as index 1 so I have to scroll down for Professional or Ultimate when I use the AIO personally and Enterprise professionally. Rarely do I use the other Editions. I created my final AIO with the fully patched Pro and Enterprise that I use the most as index 1 and 2. Then went from unpatched (SP1 only) Enterprise down to Starter.
  • All 64-bit was first then 32-Bit. As my first AIO was from 2010 there was a lot of 32-Bit work. I have not touched 32-Bit in many years but it's still there just in case I get an old system CPU without the X86-64 instruction set.
  • To test, just take your patched one and replace USB\sources\install.wim. I did this on all modified WIMs before going through the AIO process.
Once your Final AIO WIM is ready you can create the ISO for VM use or the rare case of burning optical media. With the injected updates the WIM is over 4GB in size so it will not fit on a USB stick formatted with FAT32. I talk about this in relation to Windows 10 here and my need to use optical media for it. For USB, Windows 7 does not support a second NTFS volume however you can just split the WIM using dism. In my case this WIM is 6.7GB so I have to replace install.wim with install.swm and install2.swm. This also means I have to burn to a DVD9 (Dual layer) instead of DVD5 (single layer). You could make a 64-Bit only if you never anticipate using really old hardware.

 Dism /Split-Image /ImageFile:C:\sources\install.wim /SWMFile:C:\sources\install.swm /FileSize:4700  


I did all this on a Windows 10 Pro workstation. For the ISO file creation, you will need to install the ADK relevant to your OS. In my case the 1903 version since I am on 1909. This gives you the oscdimg.exe executable needed to generate the ISO file for your new AIO. On my 1903 ADK its located in Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\. An example command to generate an ISO file. 

 oscdimg.exe -lWindows_7_SP1_AIO_Final -m -u2 -bE:\W7AIOFinal\Boot\etfsboot.com E:\W7AIOFinal E:\Windows7_SP1_AIO_Final.ISO  

My flow is
  1. Copy Windows7_SP1_AIO.ISO from FreeNAS
  2. Extract to folder Win7AIOFinal
  3. extract relevant index to be patched
  4. run through Jasons script to patch
  5. import modified WIM into new WIM file
  6. import rest of AIO indexes into new WIM File
  7. Split install.wim to install.swm
  8. replace WinAIO7final\sources\install.wim with install.swm files
  9. Create ISO file
  10. test in ESX
  11. update Windows 7 AIO USB stick
  12. Put ISO onto FreeNAS and backup

Extras

As long as Windows 7 has been around you may also want to inject newer storage drivers into the Boot.wim so it can install Windows 7 on newer storage controllers. I touch on this while getting Windows 7 on an unsupported AM4 Ryzen 3 system personally. Several motherboard manufacturers have a tool to inject drivers needed for newer hardware into the boot.wim so you don't have to track them down. ASUS, MSI and ASROCK to name a few. You can do this yourself with dism and the add-driver switch. This is also useful for the NVMe patch as Microsoft pulled it so you can install Windows 7 to NVMe storage.If you have them, you can inject the NVMe and TPM2.0 updates into the install WIM as well. I talk about NVME and Windows 7 here.

With Microsoft charging for support past its original end, this Final may not be really the final. See what that entails!