Good-old "ghosting" with SCCM

-

Little ghost
You can actually use SCCM as we old people used Norton Ghost (unfortunately Symantec later on) console once upon a time:
make an image of a reference machine and deploy captured image on the same or similar model with all programs, settings and ready-to-use accounts. You can even download my Powershell script which will do the same things as the GhostWalker did long time ago (except changing computers SID, newer Windows will do it automatically).
The script will change computer name offline before it boots up for the first time.

Do you remember this beauty? I could reinstall 120 (I never tested 254) school computers all at once under 15 minutes!

The power of MULTICAST!


A difference between standard SCCM deployment and this approach is in the type of capture: WIM type of image are just like usual Windows OS install type: small in size, deduplicated, not emulating disk placement, similar to a simple ZIP-file that expands to the free partition and gets some boot commands at the end.
FFU (Full Flash Update) image are more like a DD-type of image or forensic ones, 1:1 clones, you cannot use this type of image on the disk that is smaller than the captured one.

Yuo can read more here about difference between WIM and FFU.

Some good stuff occured from 1903:

Starting with Windows 10, version 1903, you can optimize your FFUs into new portable FFUs where:

  • The drive that an FFU is applied to can be smaller than the drive it is captured from.
  • You can choose a partition to dynamically expand or shrink based on the size of the new drive.
  • You no longer have to manage the recovery partition separately for differently-sized drives.

Steps to start "ghosting" with SCCM:

  • Find a dedicated network share with enough free space, images of this type can be really big, sometimes as big as installed drives occupied space is.
  • Create Task Sequence för capture of image
  • Create Task Sequence för deployment of image you did in step before
Here are my 2 task sequences for ghost-like management.

Capture

Things under points 1-3 should be changed to match your own environment (don't forget to change drive letter in commands if you change it here):


Just för safety, delete pagefile.sys
del /A:H C:\pagefile.sys



To capture image you can use following command (this one is compressing image):
dism /capture-ffu /imagefile=T:\\MYIMAGE.ffu /capturedrive=\\.\PhysicalDrive0 /name:WIN10_22H13 /Compress:maximum


Deploying image

To deploy image you can use the following command:
DISM /apply-ffu /ImageFile=T:\MYIMAGE.ffu /ApplyDrive:\\.\PhysicalDrive0


A good idea is to run chkdsk after deplyment:
cmd.exe /c x:\windows\system32\chkdsk c: /R

REBOOT
ENJOY

Comments

Post a Comment