Jump to content











- - - - -

How to capture Windows (10) to an install.wim, then boot that wim?


  • Please log in to reply
20 replies to this topic

#1 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 07 May 2021 - 09:55 AM

I've recently decided to ditch BestCrypt Volume Encryption and return to my old favorite FDE solution, DiskCryptor. After years of development inactivity, it has recently been taken over and updated (some months ago) by a guy named David Xanatos, and now it includes full UEFI/GPT support as well, even Secure Boot if you're willing to use a Linux-based intermediary shim loader. And it has a fully portable bootloader that doesn't have to reside in any MBR (ISO boot). Furthermore, it is fully compatible with dualboot scenarios. I just had too much trouble getting a BCVEed Windows 10 to boot within a G4D/SVBus-controlled VHD, and I was never able to get BCVE to stop overwriting GRUB4DOS.

 

However, I don't want to fully commit to it yet. Anyone that has used an FDE solution in the past, already knows the importance of having a sound backup/recovery strategy. Without those, you're fucked if and when the shit hits the fan. As the old adage goes, anything that can go wrong, eventually will.

 

Getting to it, I now need to devise some kind of personalized recovery solution that I can boot in an emergency. I've considered WinPE, BartPE, WinBuilder, probably I missed something along the way.

 

I've gradually come to the conclusion that having a portable, fully deployed and ready-to-use alternate Windows 10 is the way I want to go. It would essentially act as an onboard recovery solution. Ideally contained within an ISO, WIM file, or VHD/IMG, which I could boot either as a filedisk or ramdisk with G4D/SVBus. I would want to have this stored in a separate partition on disk for fastest booting, I have 3 NVMe SSDs and 2 SATA SSDs, all internal. Booting externally from USB is just going to slow down the booting process, they (external HDDs or flash drives) cant compete with an SSD's disk access speed/boot speed.

 

So the plan is this (not yet finalized and open to revision):

1. Customize a Windows 10 ISO with something like NTLite or MSMG Toolkit, to strip out as much as much unnecessary BS as possible

2. Deploy this customized ISO into a VM

3. Install all the essential softwares I would need, to be able to recover my primary Windows installation. DiskCryptor, like pretty much every FDE solution out there, requires a disk filter driver to be installed, and this driver needs a reboot to take effect. Without it being integrated, I can't encrypt/decrypt other volumes.

4. Capture this VM installation into an ISO/WIM/VHD

5. Use an external bootloader like G4D to boot this recovery environment, which is actually a fully installed Windows, but portable and self-contained

 

That's pretty much what I'm aiming at, but I need ideas on how to proceed.



#2 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 07 May 2021 - 11:09 AM

You can't make a bootable WIM file from a captured image of a OS and use it as a WinPE.

 

Best option is boot from a VHD, but you have several options to make it, take a look to this topics and select your prefered option:

 

Making the smallest Win10 install (Wimboot mode) on 512 MB VHD

 

Compact mode installs

 

Reducing OS footprint

 

VHD_WIMBOOT - Apply and Capture of WIM Files for OS in VHD

 

alacran


  • wimb likes this

#3 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 07 May 2021 - 12:15 PM

As to your 1st statement...WHY NOT?...explain. I just love it when people make statements but then don't bother providing an explanation to back up their statement. I have searched Google and seen reports of people booting an install.wim. And I could swear reading elsewhere that W10 actually supports this. And if I'm not mistaken, doesn't Windows To Go (now unsupported) just take an install.wim and make it bootable from external media? And, the name of the wimboot program itself would seem to imply that it's possible to boot an install.wim.

Can someone else independently confirm that there either is or isn't an official or unofficial way to boot an install.wim?

In any case, you're probably right about a VHD/img being a better. Now theoretically, even if it were possible to boot install.wim, I would still have to go through the process of ripping out BS, integrating components, then rebuilding the wim every time I want to add something.

With a VHD, I can boot an already installed/configured portable Windows, that isn't a PE at all. If I want the VHD to stay as is, I would boot it as a ramdisk, knowing that any changes I make inside it will be gone after a reboot. Or I could boot it in filedisk mode if I need to add stuff/make changes. No need to rebuild the VHD when I want to add stuff.

A PE isn't necessarily what I'm after anyway. When it say it will be used as a recovery environment, I don't mean strictly in the definition of a PE, but just as a means of recovering my primary Windows. I don't give a shit what category my environment falls into, as long as it is small and serves its' purpose.

Anyway, I've been using MSMG Toolkit for awhile to customize my ISOs. But a few weeks ago I bought a home license for NTLite. Would you say it would be safe to use it to strip my ISO before following the tutorials in the links you have posted? I just want to establish a minimal baseline, then work from there.

Edit: My "recovery environment" will be based on LTSB or LTSC. Mainly for the reason that it is mostly debloated in it's pure default state, without additional changes. Of course, I would like to reduce it further. I will continue using 10 Enterprise 20H2 as my primary W10. Ever since upgrading my ram to 64GB, I had initially considering running my primary W10 as a ramdisk. But I don't think that the insane speed is worth the extra headache of a ramdisk setup, especially at the cost of potential added instability. I can think of better ways to put all that ram to good use anyway. But for a recovery, a ramdisk would be useful.

#4 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 07 May 2021 - 01:39 PM

As to your 1st statement...WHY NOT?...explain. I just love it when people make statements but then don't bother providing an explanation to back up their statement. I have searched Google and seen reports of people booting an install.wim. And I could swear reading elsewhere that W10 actually supports this. And if I'm not mistaken, doesn't Windows To Go (now unsupported) just take an install.wim and make it bootable from external media? And, the name of the wimboot program itself would seem to imply that it's possible to boot an install.wim.

Can someone else independently confirm that there either is or isn't an official or unofficial way to boot an install.wim?

.......

 

Anyway, I've been using MSMG Toolkit for awhile to customize my ISOs. But a few weeks ago I bought a home license for NTLite. Would you say it would be safe to use it to strip my ISO before following the tutorials in the links you have posted? I just want to establish a minimal baseline, then work from there.

 

My first statement is based on my own experiments trying to boot as a WinPE a WIM file made from a captured OS, see my posts about this subject, and you will learn why it is not possible because of very big differences on the registry:

 

http://reboot.pro/in...e=3#entry216517
http://reboot.pro/in...e=5#entry216627
http://reboot.pro/in...e=4#entry216558

 

But on the other hand I have being able to boot from Win10XPE_x64 installed on a VHD, see my experiments on this topic:

 

Install Win10XPE_x64 Flat or Compact Mode on VHD

 

It's something in between a PE and a standard VHD, with some benefits compared to a WinPE, it is capable to keep changes (but all changes on the registry are volatile), as an example it lets you add all internal (into the VHD), or external portables you want and create desktop shorcuts, and if some .dll is requiered, you can just copy/extact it with 7-zip from same install.wim index of the DVD used to build the WinPE, or the OS installed on your PC (if same version, to be version consistent) to same location on the VHD, without the need to rebuild as in the case of a WinPE

 

About NTLite, on MDL forum (original home of MSMG Toolkit topic) I read several post on that topic from reputable members saying they get better results using only MSMG Toolkit.

 

Also take a look to this very good and helpful topic on MDL forum (you will need to become a member to open it):

 

Multi-OEM/Retail Project {MRP} - Mk3

 

alacran



#5 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 07 May 2021 - 08:11 PM

I'm an infrequent poster at MDL, I've participated in the MSMG topic there. They have some quite useful tools that aren't available anywhere else. I'll try using MSMG and NTLite. I mainly bought NTLite because it has live editing of the running OS, something MSMG doesn't have. And because I wanted to try a different tool that is similar to MSMG. I'm liking what I'm seeing so far, still have more research to do.

Edit: Now that I think of it, another reason I would prefer a fully installed Windows instead of a PE, is because by default x64 PE only runs x64 softwares. Many of the tools I will be using are 32 bit only. An installed-Windows-as-recovery will allow me to run the full selection of tools that I can run in my primary Windows.

#6 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 07 May 2021 - 08:47 PM

Edit: Now that I think of it, another reason I would prefer a fully installed Windows instead of a PE, is because by default x64 PE only runs x64 softwares. Many of the tools I will be using are 32 bit only.

 

Wrong, that was very long time ago, but now any good WinPE x64 already has Windows\SysWOW64 and is capable to run many (if not all) 32 bits (x86) programs, you should test new WinPEs x64 making a build of Win10XPE_x64 (just google for it), it is also a very good tool for recovery, but I personally prefer my 2 GB Mini10x64.vhd, nevertheless I have and use both tools.

 

alacran



#7 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 07 May 2021 - 09:08 PM

I mainly bought NTLite because it has live editing of the running OS, something MSMG doesn't have.

 

If you open the third link mentioned on post No. 2, you will find on its first post a free tool developed here on reboot.pro forum, made with the colaboration of several of us with new ideas and testing to reduce the OS foot print, and wimb was able to include all this ideas and findings and create his program Win_Reduce_Trusted making use of his great skills in Autoit, also our fellow wimb is always adding all recent new ideas and findings on every new version.

 

I'm quite sure no other tool can reduce so much an installed system (from 7 to 10) on a real or a virtual drive (VHD), and all work is done (offline) in a couple of minutes.

 

alacran


  • wimb likes this

#8 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 08 May 2021 - 09:35 PM

I forgot to ask this earlier, but preventing my "recovery environment" from auto installing updates is a serious concern. Is there any 100% effective way to stop this from happening?

In the past I've used Group Policy, Registry edits, a firewall, hosts file edits, etc in attempts to prevent auto updates, but only ever had limited success. Sometimes I will need to connect my recovery to wifi or LAN, I know that Windows will try to update as soon as I do.

In addition, simply switching off the update service doesn't work for long, it eventually gets reenabled somehow. There is an entry for updates in Task Scheduler that I think is responsible for this, but deleting or disabling the task causes sfc to find corrupt files.

#9 antonino61

antonino61

    Gold Member

  • Advanced user
  • 1525 posts
  •  
    Italy

Posted 08 May 2021 - 10:43 PM

send your update directories to a ramdisk (that means to nothing) and it simply will not install any updates. delete any instances of "windowsupdate" and "windows update" from your c:\ drive and disable all windows update services and u will see that nothing will change on c:\. for the purpose, check the "get-alladafluff-out" thread here in reboot.pro. u will find a wellspring of info as to all that u can take out if u do not use it.



#10 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 08 May 2021 - 10:59 PM

@antonino61: Your suggestion is good, but not acceptable to me. I need a solution that prevents updates from downloading AT ALL when I need to go online in my recovery. It's not acceptable for them to be downloaded, then to repeatedly try to install and fail. This will still use unnecessary RAM/CPU cycles.

#11 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 09 May 2021 - 12:03 AM

I forgot to ask this earlier, but preventing my "recovery environment" from auto installing updates is a serious concern. Is there any 100% effective way to stop this from happening?.

 

I use Firewall App Blocker (Fab) v1.7

 

Before connecting for the first time open the program and select to use the White List and only allow your prefered browser to connect to Internet, this works fantastic blocking any other connections to Internet, and will block all Windows updates.

 

After doing it you can connect to Internet and unless you dissable the White List, all other programs will be permanently blocked, including Windows.

 

Of course if you want you can also allow other programs on your White List, at any time.

 

alacran



#12 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 09 May 2021 - 03:35 AM

@alacran: So a firewall and maybe hosts file edits are the only way? You don't know of any specific Registry/Group Policy/others changes that would achieve the same purpose?

 

I was thinking that it might also be possible to delete the WU/WU Medic services with the "sc delete" command. It would probably work, but I bet that sfc would find corrupt files. And if course, without these services I wouldn't be able to add features offline if I needed them. But there is probably a way to put them back.



#13 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 09 May 2021 - 04:44 AM

On 10 almost all the links to Windows servers are hard coded into it, and they are loaded directly and don't make use of the hosts file, anyway they are hundreds if not thousands of server links.

 

Just try the program I recommended you, it is a portable program about 1.3 MB, it do not installs anything, and all can be reverted in only one click just disabling or enabling the White List, it uses the Windows firewall itself to work, and it works fantastic.

 

Only other way that works if using WIFI is change yor connection to metered, and set to not download updates on metered connections. But you have to be connected to make this changes, and there is always a little time it takes you to make this changes, and things can happed during this time.

 

But you can make all (even wired) connection metered (in advance) if you use: Multi-OEM/Retail Project {MRP} - Mk3, to know how to use it open the third link on post No. 2 of this topic, and once there go to the post No. 3, there you will find pictures with samples of my usual settings, pictures are not fully updated to the very last version of the program, but they are a good guidance.

 

I think you should start reading all the links in post No. 2 of this topic, and you will find on them all the answers to your questions, and a lot of good info and guidance, I think the only way of learning is reading, and making tests once you have enought idea of the subject, so better start reading.

 

Then once you have a full idea of each VHD version you can build and select your prefered way, on the fourth link you have a wimb's program that can help you to make almost all automatically, it also includes a PDF file with very clear  instructions, but you need to know first what fits better yor needs/preferences.

 

alacran



#14 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 20 May 2021 - 07:57 PM

After a few days of being busy with other stuff, i decided to get back to my project. This morning I did a MSMG removal run on an LTSC ISO, just to test. I just went full Rambo mode, removing everything the tool offers in its' GUI, and integrated nothing. I also followed the steps for Redstone 5 in the readme, since LTSC is pre-1903, which makes it RS5.

At the end of the steps, i built the ISO. There is an ISO in the ISO folder, but it seems to be missing a setup.exe. And the sources folder is mostly empty, compared to sources in the original ISO. But there is an install.wim, and it is a few hundred MB smaller than the original. Original WIM also has 2 editions (regular LTSC, and an N version), i used dism to extract the one I wanted, and used that with MSMG.

The bottom line is that install.wim seems OK, but the ISO is unbootable. It doesnt matter if i use it in a VM, with E2B, or on my iODD, it just doesnt boot.

I havent reported this in the MSMG thread yet. Again, i believe the WIM is fine, but i dont know of a way to install it in a VM without a bootable ISO. I'm pretty sure this is just a bug in MSMG in regards to how it builds ISOs in certain scenarios/circumstances, or with certain editions.

#15 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 21 May 2021 - 07:10 AM

Maybe you did something wrong:

 

Usually you should mount the Iso and run MSMG program, it has an option to extract all from the ISO, and then after you finish your cuts and additions, all required is available to rebuild the ISO.

 

You could try this:

  • Keep your modded install .wim (and boot.wim if you also changed something into it), on another location.
  • Mount the original ISO and run MSMG program.
  • Select the option to extract all from the ISO.
  • Go to the sources folder and just replace the install .wim (and boot.wim if required) with the previously made.
  • Rebuild the ISO.

 

alacran



#16 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 21 May 2021 - 07:24 AM

You can use WinNTSetup to install from your *.wim file.

 

You could also use VHD_WIMBOOT to create a VHD and use your install.wim to make the installation into the VHD.

 

Both programs also make and entry for it on BCD to let you select it during booting your PC.

 

Then you don't need an ISO.

 

alacran


  • antonino61 likes this

#17 relynx

relynx

    Newbie

  • Members
  • 10 posts
  •  
    Germany

Posted 21 May 2021 - 04:53 PM

...

I just went full Rambo mode, removing everything the tool offers in its' GUI, ...

Done that several times with mixed results because some components at some times have to break because of missing dependencies. Now I only carefully remove components which are safe to be removed and don't potentially interfere with features I might need.

As the developers of MSMG and MRP states they don't support pre-customized sources. I wanted to test it out. The customization process done by the tools went through without an error.

At the end I installed the resulting install.wim with WinNTSetup by JFX into a VHD.

It boots fine on VirtualBox and by direct booting via Ventoy and GrubFM.

Bare metal install: around 8 Gb.

 

My road to debloating:

  1. Optimize-Offline Guide - Windows Debloating Tool
     
  2. MSMG ToolKit
     
  3. Multi-OEM/Retail Project {MRP} - Mk3 (I only used MRP)
     
  4. with GUI software: WPD.app and O&O ShutUp10

 

Regarding disabling Windows updates: done in MRP. Would like to share with you a picture where it is configured but I can't find the right button to do that. ... :)



#18 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 21 May 2021 - 05:05 PM

Well, my steps were (before you posted):
1. Mount ISO and manually copy all files into MSMG's DVD folder. This is exactly what MSMG would do, but automatically
2. Use dism to extract edition from wim
3. Replace install.wim with my single edition wim (i dont need the N version, and figured that keeping it would make wim bigger)
4. Do removals with MSMG, build ISO

And what it gave me was as described in last post.

Your suggestion worked though. I extracted the ISO contents into ISO folder, then replaced install.wim with the one that MSMG had previously built. On the 2nd run i skipped all removals and jumped straight to building. The 2nd ISO seems fine, it boots in a VM. The setup went OK, i was able to make it to the desktop. Everything i specified for removal seems gone. The 1st sfc scannow finds corrupt files, but all runs after that pass. Without a page file, Windows Explorer says that 5.72GB is in use, out of 20GB total.

#19 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 21 May 2021 - 09:34 PM

Your suggestion worked though. I extracted the ISO contents into ISO folder, then replaced install.wim with the one that MSMG had previously built. On the 2nd run i skipped all removals and jumped straight to building. The 2nd ISO seems fine, it boots in a VM. The setup went OK, i was able to make it to the desktop. Everything i specified for removal seems gone. The 1st sfc scannow finds corrupt files, but all runs after that pass. Without a page file, Windows Explorer says that 5.72GB is in use, out of 20GB total.

 

Fine, this is a good start, now it is up to you how far you want to go, my Compact LZX installation fits into a 2 (low free espace remaining) or 2.3 GB VHD and my Wimboot installation fits into a 1 GB VHD and both are capable to run LibreOfficePortable, FireFox Portable and a lot of other portable programs located on a partition/drive (external to the VHD).

 

Both are capable to boot on Bios and UEFI environments, and run very fine from a USB 3.0 device in all machines I have tested. 

 

If the machine has USB 3.0 ports and a good size Ram, Ramboot or Wimboot are good options, If the machine is low Ram or only has USB 2.0 ports better do not try Ramboot or Wimboot, and try only filedisk booting.

 

alacran



#20 Guest_AnonVendetta_*

Guest_AnonVendetta_*
  • Guests

Posted 21 May 2021 - 09:54 PM

I would probably want my VHD to have a size of 5-10GB. To have space to install needed software, i want it all contained within the VHD. I have no need to run MS/Libre Office in this VHD, just tools to recover my primary Windows. Being able to run 32 bit softwares is a must.

I think i have solved the updates issue with W10Privacy, no firewall needed. I just set up a fake WSUS server with this software, then left my VM continuously connected to Internet for hours. The SoftwareDistribution folder is present but empty, used space hasnt increased, and I cant find any indication that updates were ever installed. And i didnt manually configure any updates settings in Group Policy or the Registry. I may still use a firewall as a failsafe, but it wont be anything that makes use of Windows Firewall to do the blocking. I dont trust MS's own solution to effectively block updates, considering that they revert settings behind the backs of users.

How can i shrink my used space down even smaller? I mean, before applying compact LZX or wimboot stuff?

#21 alacran

alacran

    Platinum Member

  • .script developer
  • 2710 posts
  •  
    Mexico

Posted 21 May 2021 - 10:15 PM

W10Privacy does not work fine in modern versions of 10 to block updates, it works for you because you are using an old 10 version.

 

I know this because I was using it before, until in recent versions of 10 it started having problems to block updates, then I found Firewall App Blocker and this is the perfect solution to control updates and also to avoid (or at least reduce even more) telemetry in all cases from 7 to 10. But of course you will do it as you prefer.

 

 

How can i shrink my used space down even smaller? I mean, before applying compact LZX or wimboot stuff?

 

Reducing OS footprint

 

alacran






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users