Fixing VBScript Support in Windows ADK SEP 2023 Update (Build 25398)

For those that tried out the latest Windows ADK for Windows 11 22H2, build 25398, you quickly learned that Microsoft overlooked testing a bit. The VBScript component had been removed, breaking deployment solutions like MDT, or ConfigMgr (when using VBScripts). This post covers a temporary workaround until Microsoft releases an official fix.

NOTE: The 25398 ADK build should not be used. Microsoft already dropped support for it from ConfigMgr for a reason. Use the 22H2 ADK build instead (22621) or one of the 24H2 ADK versions (May or Dec).

Update November 20, 2023: This issue is now fixed using the latest LCU KB5031373 or newer for Server Operating Systems. More details here: https://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools?source=recommendations#windows-pe-known-issues

Update December 9, 2023: Created some useful PowerShell scripts:

Useful PowerShell scripts

Apply the official fix to an existing MDT Lite Touch boot image:
https://github.com/DeploymentResearch/DRFiles/blob/master/Scripts/Update-ADK25398BootImageWithCU.ps1

Apply the official fix to the default ADK boot image:
https://github.com/DeploymentResearch/DRFiles/blob/master/Scripts/MDTVBScript/Update-ADK25398BootImageInstallFolderWithCU.ps1

———- I kept the old workaround (below) as a reference, thank you everyone that helped ——-

Old Article and Background Information

Credits: Big thanks to Avi Kroparo for pointing me to using FODs from Azure Stack HCI media (build 25398), sending me on the right path!

This workaround also takes care of the error message if upgrading an MDT solution to the latest build, or when using the MDT Integration with ConfigMgr (or any other VBScripts). See the specific MDT and ConfigMgr instructions further down this post:

Error: The value for the attribute is not valid : language

Why Upgrading Then?

The main reason for using the new ADK was that it included the hotfix for the Secure Boot security issue covered in CVE-2023-24932, and that would eliminate the somewhat painful process of patching the older WinPE media (Build 22621) due to its relation to optional components added later and having to apply the latest cumulative update (LCU) afterwards.

Inside Windows ADK SEP 2023 Update

A fun fact about the latest Windows ADK for Windows 11 22H2 is that it's actually built from Windows 11 23H2 Media, build 25398, with has the codename Zinc. Anyway, in Windows 11 23H2, VBScript is FOD (Feature-On-Demand), and that can be downloaded and added to the new WinPE version. If you are curious, you can list available FODs by running the following command on any Windows 10 or Windows 11 OS:

DISM /online /get-capabilities

Download the VBScript FOD for WinPE 25398

To download a working VBScript component for WinPE 25398, you can install the latest Insider Preview (currently build 25951) on a VM, and copy the FODs from that one. However, to get them from the OS you have to be quick.

Note: As mentioned earlier, you can also get the VBScript FODs from Windows Server, version 23H2 (Build 25398).

First, on your Windows 11 Insider VM, remove the existing VBScript FOD by running this command:

DISM /online /remove-capability /capabilityname:VBSCRIPT~~~~

Then, add it back again by running this command:

DISM /online /add-capability /capabilityname:VBSCRIPT~~~~

Finally when the FOD install is about 60-70%, head over to the C:\Windows\SoftwareDistribution\Download folder, and copy what's created there to a temporary folder. Please note that you have to be quick, because the files are deleted after the install is completed.

Note: To avoid stress, you can temporarily apply a "Deny Delete" ACL for SYSTEM on the C:\Windows\SoftwareDistribution\Download folder. Thank you Steven Yarnot (@YarnoSG) for the tip!

Fixing MDT 8456

In addition to making the usual new-ADK-fix:  To make MDT "think" you have an x86 version of WinPE optional components, run the below PowerShell snippet:

# Create empty folder for x86 components (not used, but MDT looks for the folder)
$x86Folder = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs"
New-Item -Path $x86Folder -ItemType Directory -Force

Then, you need to copy the newly downloaded FODs.

• Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~~.cab
• Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~amd64~en-us~.cab
• Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~wow64~~.cab
• Microsoft-Windows-VBSCRIPT-FoD-Package~31bf3856ad364e35~wow64~en-us~.cab

Copy the non-en-us named files to C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs.

Copy the en-us named files to C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us.

Finally, in the deployment share properties, select the added optional components, and then update your deployment share.

Add the VBScript FOD to a ConfigMgr Boot image

Here is a PowerShell script you can use that adds the VBScript FOD to a ConfigMgr Boot image

https://github.com/DeploymentResearch/DRFiles/blob/master/Scripts/Add-VBScriptForWinPE25398ToConfigMgrBootImage.ps1

Add the VBScript FOD to any WinPE 25398

FODs can be added to WinPE boot image like any other package via dism.exe, the syntax is:

dism.exe /Image:<mount folder> /Add-Package /PackagePath:<path to package.cab>

If you prefer a ready-made PowerShell script, I made one for you here: https://github.com/DeploymentResearch/DRFiles/blob/master/Scripts/New-WinPE23H2WithPowerShellAndVBScript.ps1

Beyond the Blog Post – Let's Meet

If you liked this post, I would love to get your feedback. Comments are open, and I have no plans to ever close them 🙂 Also, if you want to learn more, I'm presenting deployment training regularly on the ViaMonstra Online Academy, check it out: https://academy.viamonstra.com