1. Introducing Windows Image File (WIM)
Before you dive into the
benefits of how to work with WIM files, you need to look at the file
format itself. One of the biggest things that set it apart from most
other imaging formats you may have worked with previously is that it is
not a sector-based image. WIM is a file-based image, and this
implementation provides several benefits.
1.1. Exploring the benefits of WIM
Traditional images
were essentially a single binary file representing all the contents of a
hard drive or hard drive partition. While some solutions included an
image-editing tool to manipulate these images, just what you could
modify differed greatly between products and was often lacking. The
approach taken with WIM offers several benefits worth exploring:
The image is hardware independent:
Now you can create one image and apply it to dissimilar hardware, so
long as it uses the same processor architecture. For example, a 64-bit
image will not work on a 32-bit system.
More
than one image can be stored in a single WIM file, which stores only
one copy of each unique file (functioning as a single instance store):
Aside from lowering the number of potential image files you need to
manage, this also reduces the storage space needed to hold your images.
Images may be serviced offline:
Many changes can be made to an image file directly without the need to
reapply the image to a machine, make changes, and recapture the image.
Images may be applied to disk partitions of any size.
An API (WIMGAPI) is provided for developers to work with WIM files in their applications .
A
WIM image allows for nondestructive deployment by not affecting other
files on a system when a reinstallation or upgrade takes place.
In summary, WIM offers a
solution that lets you reduce the number of disk images to maintain,
and maintaining those images is much easier and requires less time.
1.2. Exploring the limitations of WIM
Nothing is perfect, so some of the limitations of the WIM format are as follows:
You cannot install applications into a WIM.
You cannot easily import registry changes to a WIM.
The command line interface can be challenging for some: To address this, you may check out some "unofficial" tools, such as GImageX.
2. Introducing Windows PE
Windows PE is a valuable
tool, and many administrators are beginning to take full advantage of
it as they begin to investigate the deployment of Windows Vista. It was
actually introduced back with the release of Windows XP, but
distribution has been very limited. If you were not an OEM or did not
have an enterprise account with Microsoft, Windows PE was not available
to you. During this time, an alternative Preinstallation environment
came to be named BartPE.
First, you need to get a good look at just what Windows PE is and what
it gets you before covering the tools you may use to customize it.
2.1. Understanding the benefits of Windows PE
Windows PE is a DOS
replacement. Although it doesn't fit on a floppy disk, you can boot to
Windows PE from CD, DVD, or USB flash drive. Windows PE offers a command
line interface and a limited number of plug-ins to expand upon the
default capabilities of this slimmed-down operating system. Windows PE
2.0 runs on a Windows Vista Kernel and therefore supports any network
drivers that would be supported by Vista.
As compared to working
with DOS, its ability to leverage the same drivers you would in Windows
is a considerable step forward. If you have ever tried to make a network
boot disk, you know it can be a frustrating process (depending largely
upon the hardware with which you are working).
Windows PE supports both
IPv4 and IPv6, but it does not support other protocols, such as
Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX).
Windows PE supports Distributed File System (DFS) name resolution only
to standalone DFS roots.
2.2. Understanding the limitations of Windows PE
Part of the reason Windows
PE was not so easy to get hold of (until the release of Windows Vista
in fact) is that there was fear of its being used as an alternative
operating system. As such, Microsoft has implemented a number of
limitations designed to keep its use on target with what it was designed
to do: provide a simple platform on which systems could be provisioned.
Windows PE provides
no support for file sharing or inbound connections, which means that it
cannot be used to run tools, such as Remote Desktop (the server service
is missing). In fact, many applications will not run in Windows PE as it
is built upon a limited subset of the files that make up a full Windows
installation. This is both to reduce the size of Windows PE as well as
to ensure it is not abused. Windows PE is designed strictly as a tool to
help with the distribution of the Windows operating system. To a lesser
extent, it may also be used as a recovery platform, but this
functionality is not provided out of the box. To ensure the freely
downloaded Windows PE is not abused:
It will reboot after 72 hours of use (up from 24 hours which was the limitation in the previous release).
Windows
on Windows (WoW) is not supported so 16-bit applications won't run in
32-bit versions of Windows PE, and 32-bit applications won't run in
64-bit versions of Windows PE.
Windows PE doesn't support the .NET Framework: It includes only a subset of the Windows Vista Win32 APIs, including I/O (disk and network) and the core Win32 APIs.
2.3. Meeting minimum requirements
The minimum requirements of Windows PE should not be a problem for any computers you support.
The computer must have a minimum of 256MB of RAM.
Windows
PE requires a Video Electronics Standards Association (VESA)-compatible
display device and will use the highest screen resolution it detects as
supported.
NOTE
If Windows PE can't detect video settings, it uses a resolution of 640 × 480 pixels.
2.4. Using the provided Windows PE image
Mostly likely, you will
want to modify a Windows PE image to somehow customize it for your own
use. This may be to automate the mapping of a network drive, to add a
command line tool, or to incorporate the automation of several desired
actions into a script. However, the Windows PE image provided in the
Windows Automated Installation Kit (WAIK) is capable of running on many
computers with no customization required.
After it loads, you may
use the provided command prompt to map network drives and run other
commands by typing them out and pressing enter just as you would by
using the command prompt window within Windows.
Doing this can be helpful
to see the value of Windows PE, but in seeing its value it is likely to
spark several ideas, from customizing the default wallpaper to match
that of your corporate design to including tools and scripts to manually
or automatically perform any number of actions.
Will
the application you want to run function in Windows PE? The best way to
find out is to try. With so much missing from Windows PE, you may find
that many applications will not run. If you find yourself wanting to run
something that cannot be run within Windows PE, it may be best to look
to alternatives. These tools are designed for expansion. You either
will find it is much easier than Windows PE to extend the capabilities
of these alternatives through your own experimentation or by using any
of the many plug-ins developed by other users of these tools.
3. Customizing Windows PE Boot Images
There are several tools available within the WAIK to
assist in the customization of WIM files. Beyond these, there are a
handful of freeware applications that can also greatly assist in
customizing Windows image files. This section discusses several such
tools:
ImageX
ImageX GUI Tools
PEImg
OSCDImg
vLite
3.1. Working with ImageX
ImageX is a command
line tool provided with the WAIK for the creation, editing, and
installation of WIM image files. As a command line tool, it is easy to
script actions using a simple batch file. For a list of supported
command line arguments, see Table 1.
Table 1. ImageX Command Line Options
| Command | Purpose |
|---|
| /Capture | Captures a volume image to a new WIM file |
| /Append | Appends a new volume image to an existing WIM file |
| /Delete | Deletes an image from a WIM file that contains multiple images |
| /Split | Splits an existing WIM file into multiple WIM files |
| /Info | Returns XML descriptions for the specified WIM file |
| /Dir | Displays a list of files and folders within a volume image |
| /Mount | Mounts an image to a specified directory (read-only) |
| /MountRW | Mounts an image to a specified directory (read-write enabled) |
| /UnMount | Unmounts the image from the specified directory where it was mounted |
| /Export | Transfers an image from one WIM file to another |
| /Apply | Applies a volume image to a specified drive |
| /? | lList of command line help for any of the above specified commands |
In the following section,
each of the commands available and their options are covered along with
an example of its use. This is meant as a reference or to quickly
familiarize you with what is possible using ImageX.
NOTE
In the early days of Microsoft's foray into Windows Imaging, ImageX was sometimes referred to as XImage.
Although you may still find older references online, don't be confused,
the name was simply changed to ImageX for its final release. This was
for legal reasons, as Ximage was already the name of a tool used by Dell for their own standard image process they perform for their customers.
NOTE
Although many of
the commands and flags are shown here in upper- and lowercase
characters, this is only to help for readability — commands, flags, and
arguments passed to ImageX are not case sensitive.
Using the Capture command
The Capture command does
just what you would expect: it captures an image of the specified
volume and produces a WIM file based on its contents. Less known is the
fact that you may use the Capture command to specify a directory. One
thing to keep in mind is that you can use the Capture command just once
per WIM file. If you want to include another capture in a WIM file, you
must use the Append command.
The syntax for the ImageX Capture command is as follows:
ImageX [Flags] /Capture ImagePath ImageFile "ImageName" ["Description"]
The flags and other parameters shown here are described as:
Flags:
Several optional flags may be specified to control the actions of the
Capture command. (For a list and brief description of each, see Table 2.)
ImagePath:
The path to the volume image to be captured. This may also be a
subfolder path to capture a directory instead of an entire volume
(required).
ImageFile: The path of the new WIM file (required).
ImageName: The unique name for the image being captured (required).
Description: Optional text used to provide additional reference information for the image.
Table 2. Flags Supported by the ImageX Capture Command
| Flag | Purpose |
|---|
| /Boot | Marks a volume image as bootable. Available for Windows PE images only. |
| /Check | Enables WIM in egrity checking. Flag must be supplied during updates |
| /Compress | Specifies the type of compression used for the initial capture operation. Valid options are "maximum," "fast," or "none." |
| /Config | Enables
use of a configuration file for exclusion and compression options. The
Config flag is to be followed by the path and filename of a
configuration file. |
| /NoRPFix | Disables
reparse point tag fix up. If not provided, reparse points that resolve
to paths outside of image_path will not be captured. |
| /Scroll | Scrolls output for redirection. |
| /Verify | Enables file resource verification. |
For example:
imagex /capture c: c:\imaging\data.wim "Drive C"
The above example
captures the contents of the C volume of the drive and stores its
contents in a WIM file named "data.wim" at the specified path. Finally,
the optional description for this image in the WIM is specified as Drive
C.
Using the Append command
After you have a WIM file
with an image included, adding additional images to the WIM file is
performed by using the Append command. As a single instance store, only
files not already included in the image are actually appended to the WIM
file. Those that already exist in the WIM file are simply added as
pointers in the metadata in the existing WIM file.
The syntax for the ImageX Append command is as follows:
ImageX [Flags] /Append ImagePath ImageFile "ImageName" ["Description"]
The flags and other parameters shown here are described as:
Flags:
The optional flags that may be specified to control the actions of the
Append command are similar to that of the Capture command. For a list
and brief description of each, see Table 3.
ImagePath: The path to the volume image to be captured (required).
ImageFile: The path of the new WIM file (required).
ImageName: The unique name for the image being captured (required).
Description: Optional text used to provide additional reference information for the image.
Table 3. Flags Supported by the ImageX Append Command
| Flag | Purpose |
|---|
| /Check | Enables WIM integrity checking before applying the additional image. |
| /Ref <wimfile.swm> | Enables
the reference of split .wim files (SWMs). wimfile.swm represents the
name and location of additional split files. Wildcards are accepted. |
| /Scroll | Scrolls output for redirection. |
| /Verify | Enables file resource verification. |
For example:
imagex /append d: c:\imaging\data.wim "Drive D"
The above example
would capture the contents of the D volume of the drive and add its
contents as an additional image stored in the existing WIM file named
"data.wim" at the specified path. Finally, the optional description for
this image in the WIM is specified as Drive D.
Using the Delete command
The Delete command
may be used to remove the reference to a specific volume image. However,
it does not actually remove the data from the image. So if you are
looking to reduce the size of a WIM file by removing the data from an
image you may export it to create a new WIM file (see the section "Using
the Export Command"), or if you are prepared to release the image, you
may use the Prep command. There must always be at least one volume image
in a .WIM file, so you can delete a volume image only if more than one
image exists.
The syntax for the ImageX Delete command is as follows:
ImageX [Flags] /delete ImageFile ImageNumber | ImageName
The flags and other parameters shown here are described as:
Flags: The only accepted flag for the Delete command is /Check which may be specified in order to enable WIM integrity checking.
ImageFile: The path of the WIM file containing the image to be deleted (required).
ImageNumber or ImageName:
Either you may specify the number that identifies the image within the
WIM file or the name of the image within the WIM file (required).
For example:
imagex /delete c:\imaging\data.wim 2
The above example would remove the reference to the second image in the WIM file named data.wim at the specified path.
Using the Split command
The Split command may be
used to split an existing WIM file into multiple read-only split files
(SWM files). This can be helpful when storing images on removable media,
or when you need to move very large images across a network.
The syntax for the ImageX Split command is as follows:
ImageX [Flags] /split OriginalImageFile DestinationImageFile FileSize
The flags and other parameters shown here are described as:
Flags: The only accepted flag for the Delete command is /Check which may be specified in order to enable WIM integrity checking.
OriginalImageFile: The path and filename of the image file that is to be split (required).
DestinationImageFile: The path and initial filename for the split files (required).
FileSize:
The maximum size (in megabytes) for each split file to be created. Note
this is a maximum; the files created will not be larger than this but
will often be of varying, slightly smaller size (required).
For example:
imagex /split c:\imaging\data.wim c:\imaging\datafiles.swm 750
This example splits the
file data.wim into multiple read-only files of no more than 750MB; the
files would be based on the name datafiles.swm (datafiles.swm,
datafiles2.swm, datafiles3.swm, for example).
Using the Info command
The Info command will
display the details of a specified WIM file. Among other details, it
lists the GUID, number of images, and the compression algorithm used. It
also identifies what part of a split image file you are dealing with
(it will indicate "1/1" if the full image is included). There is a lot
more information here too, including an XML formatted look at each image
with details like size, name, description, language, version, number of
files and directories, as well as the time it was created and last
modified. For an example of the details provided for the default Windows
PE image, see Figure 1.
NOTE
There are
several commands that require an image number or name in order to
specify which image within a file is to be addressed. The ImageX Info
command is a quick and easy way to determine both.
The syntax for the ImageX Info command is as follows:
ImageX [Flags] /info ImageFile [ImageNumber | ImageName] [NewImageName]
[NewImageDescription]
The flags and other parameters shown here are described as:
Flags: One or more optional flags may be specified. For a list and brief description of each, see Table 4.
ImageFile: The path and filename of the image for which you to review information (required).
ImageNumber or ImageName:
Particularly when there is more than one image in the WIM, you may
specify either the number that identifies the image within the WIM file
or the name of the image within the WIM file (optional).
NewImageName: The new unique name for the specified image (optional).
NewImageDescription: The new description for the specified image (optional).
Table 4. Flags Supported by the ImageX Info Command
| Flag | Purpose |
|---|
| /Boot | Marks a volume image as bootable. Available for Windows PE images only. |
| /Check | Enables WIM integrity checking. |
| /XML | Returns the output as well-formed XML. |
For example:
imagex /xml /info c:\imaging\data.wim 1 "My Image" "This is my image file"
>data_wim_details.xml
This example generates
information about the first image in the file data.wim as well-formed
XML and pipes that information to create (or overwrite) a new file named
data_wim_details.xml. It also updates the name of the image to "My Image" and changes the description of the image to "This is my image file."
Using the Dir command
As you might
expect, the ImageX Dir command returns a list of files and folders
within a specified volume image. Of course, you can always mount the
image to view it as a browsing directory structure, but using this
method can be more helpful for use when scripting. This command can also
be helpful in quickly determining if a file you added to an image was
successfully performed.
The syntax for the ImageX Dir command is as follows:
ImageX /dir ImageFile ImageNumber =>
ImageName
These parameters are described as (no flags are accepted by this command):
ImageFile: The path and filename of the image for which you want to review information (required).
ImageNumber or ImageName:
Either you may specify the number that identifies the image within the
WIM file or the name of the image within the WIM file (required).
For example:
imagex /dir c:\imaging\data.wim 1 >data_wim_contents.txt
This creates a text file
named "data_wim_contents.txt" that lists the files and folders
contained in the first (or only) image contained in the file data.wim
file at the specified path.
Using the Mount and MountRW commands
The Mount command is used
to load a WIM file as a directory structure. To view the contents of an
image, you can use the Mount command to create a folder structure, which
you may then browse. To make changes, you must mount the image using
the MountRW command. Doing this establishes a directory structure ready
for changes. Once loaded, you may modify the image just as you do for
any file or folder on the file system. A mounted image may also be
manipulated with the PEImg tool (discussed later). Changes made to an
image do not take place right away but are cached until you use the
ImageX UnMount command with the Commit option.
Like the Delete command,
you'll need to export the image in order to completely clean the WIM of
the older files or changes. This is because the changes made are
appended to the end of the WIM file and the earlier reference to the
change is replaced with the updated data.
You may mount more than
one image at a time only in read only mode (using the Mount command).
This is to ensure proper locking and safe updating of the file when it
is unmounted. Mount images you wish to change in read-write mode and
when you are done making any desired changes, you may simply unmount the
image with the commit argument to commit the changes back to the WIM
file (or without the commit argument to discard the changes). All
changes are committed or they are not, there is no ability to commit
changes to an image partially.
The syntax for the ImageX Mount and MountRW commands are as follows:
ImageX [Flags] /Mount ImageFile ImageNumber | ImageName ImagePath
ImageX [Flags] /MountRW ImageFile ImageNumber | ImageName ImagePath
These flags and other parameters are described in the following list:
Flags:
The only accepted flag for the Mount and MountRW commands is /Check
which may be specified in order to enable WIM integrity checking.
ImageFile: The path and filename of the image file to be mounted (required).
ImageNumber or ImageName: As with many of the other commands, you may identify the image within the file by number or by name.
ImagePath: Identifies the target directory where the image is to be mounted.
For example:
imagex /mountrw c:\imaging\data.wim 1 c:\imaging\mount
This example loads the
contents of the first (or only) image in the file data.wim into a
directory structure with a root of C:\Imaging\Mount. It would do so in a
read-write state so that changes can be made and then optionally
committed to the image with the UnMount command.
Using the UnMount command
When an image has
been mounted, this command unmounts the image while optionally
committing any changes that have been applied while it was mounted.
The syntax for the UnMount command is as follows:
ImageX /UnMount [/Commit] [ImagePath]
The parameters are described in the following list (no flags are accepted by this command).
Commit:
Specify the optional commit argument in order to integrate any changes
made to the image while it was mounted. If this argument is not
specified, the image will be unmounted and any changes will be
disregarded (optional).
ImagePath:
Identifies the target directory where the image is currently mounted.
To actually unmount an image, this value is required. If the image path
is not specified, a list of mounted images will be returned detailing
the location and name of the mounted image (optional).
For example:
imagex /unmount /commit c:\imaging\mount
This example moves the
contents of the c:\imaging\mount folder back into the WIM file from
which it was mounted. Because the commit argument is specified, any
changes that were made to the mounted files and folders are written back
into the WIM file as changes.
Using the Export command
The Export command exports
the contents of a WIM file into another WIM file. It is often used to
essentially defragment or clean up a WIM file. Edits to a WIM file,
including the deletion of an entire volume image, only result in the
removal of references to those files, so the files are not physically
removed. When exporting the contents of a WIM file from one to another,
only the files with active references are included in the process.
NOTE
When working
with Windows PE images, you can make use of the PeImg Prep command to
optimize an image for file size.
The syntax for the ImageX Export command is as follows:
ImageX [Flags] /Export SourceImageFile SourceImageNumber | SourceImageName
DestinationFile DestinationName
The flags and other parameters shown here are described as:
Flags:
The optional flags that may be specified to control the actions of the
Export command are similar to that of the Capture command. For a list
and brief description of each, see Table 5.
SourceImageFile: The path to the WIM file that contains the image to be exported (required).
SourceImageNumber or SourceImageName: As with many of the other commands, you may identify the image within the file by number or by name (required).
DestinationFile: The path of the WIM file that will receive the image copy (required).
DestinationName: The unique name for the image in the destination WIM file (required).
Table 5. Flags Supported by the ImageX Export Command
| Flag | Purpose |
|---|
| /Boot | Marks a volume image as bootable. Available for Windows PE images only. |
| /Check | Enables WIM integrity checking. Flag must be supplied during updates. |
| /Compress | Specifies the type of compression used for the initial capture operation. Valid options are "maximum," "fast," or "none." |
| /Ref <wimfile.swm> | Enables
the reference of split .wim files (SWMs). wimfile.swm represents the
name and location of additional split files. Wildcards are accepted. |
For example:
imagex /export c:\imaging\data.wim 1 c:\imageing\newdata.wim "My Clean Image"
The above example would
take the first image in the data.wim file and copy it to an image named
"My Clean Image" in the specified newdata.wim file.
Using the Apply Command
Also very
straightforward, the Apply command may be used to apply an image to a
volume. You can also apply an image to a directory (even when a full
volume has been included in the WIM file).
The syntax for the Apply command is as follows:
ImageX [Flags] /apply ImageFile ImageNumber | ImageName ImagePath
The flags and other parameters shown here are described in the following list:
Flags: One or more optional flags may be specified. For a list and brief description of each, see Table 6.
ImageFile: The path and filename of the WIM file that contains the image you wish to apply (required).
ImageNumber or ImageName:
To identify which image in the WIM file you wish to apply, you may
specify either the number that identifies the image or the name of the
image (required).
ImagePath: Identifies the target drive (and optional directory) where the image is to be applied.
Table 6. Flags Supported by the ImageX Apply Command
| Flag | Purpose |
|---|
| /Check | Enables WIM integrity checking. Flag must be supplied during updates. |
| /Ref <wimfile.swm> | Enables
the reference of split .wim files (SWMs). wimfile.swm represents the
name and location of additional split files. Wildcards are accepted. |
| /Scroll | Scrolls output for redirection. |
| /Verify | Enables file resource verification. |
For example:
imagex /apply c:\imaging\data.wim 2 d:
This example applies the contents of the second image contained in data.wim to the D drive of the computer.
