Since Microsoft don't officially support Windows 11 Deployments with MDT, nor supporting any Windows ADK version newer than Windows ADK for Windows 10, version 1809 (build 17763), it's up to the OSD community to make it work. On the good side, with millions of MDT downloads during the years, you're not exactly alone 🙂
NOTE: The 25398 build of the ADK should not be used. Microsoft already dropped support for it from ConfigMgr for a reason. Use the original 22H2 ADK build instead (22621). Build 26100 (24H2 ADK) also works with MDT but has known PowerShell and servicing bugs. For now, I recommend sticking with ADK 22H2 build 22621.
Food for thought
As of this writing, the by Microsoft only supported deployment solution for Windows 11 is ConfigMgr, but if you don't mind a few tweaks, you can absolutely make MDT work for Windows 11, and even use the latest Windows ADK (Windows ADK for Windows 11 23H2). In general, I don't recommend using the latest ADK due to the fact it's built on Windows, Server 23H2 instead of Windows 11, but sure, if you absolutely want to, you can.
Fun fact: You can deploy Windows 11 just fine with an older ADK version too, but you will find that the native driver and chipset support is not the best. I recommending using at least Windows ADK for Windows 11 22H2 (Build 22621).
Issue #1 – VBScript is Broken
While VBScript is announced to be deprecated it's going to be around for a good while longer. You'll be surprised how many scripts, and installers using it. VBScript was not removed from the latest ADK, Microsoft accidentally broke it, and issued a fix for that quite quickly. Here is a post on how to fix VBScript in the latest ADK: https://www.deploymentresearch.com/fixing-vbscript-support-in-windows-adk-sep-2023-update-build-25398
Issue #2 – WinPE x86 is Missing
The fact that Microsoft no longer includes the 32-bit (x86) version of WinPE is not exactly new, it was removed already in Windows ADK for Windows 11 22H2 (Build 22621), but MDT expects to find an x86\WinPE_OCs folder structure in the Windows ADK installation folder. If MDT can't find that, the console crashes with an exception:
System.IO.DirectoryNotFoundException. Could not find a part of the path 'C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\WinPE_OCs'.
Solution: Create an empty x86\WinPE_OCs folder structure in the Windows ADK folder. MDT don't care about the content; it just looks for the folder 🙂
Issue #3 – Generating Catalog Files will Fail
If you try generating a catalog for a WIM image using the latest Windows ADK, MDT will crash with this lovely error message:
Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.ComponentStudio.ComponentPlatformInterface, Version=6.2.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
This is due to the fact that the latest Windows ADK is the first version to include architecture specific versions of Windows System Image Manager (WSIM). Earlier versions only had x86 versions.
Solution: Edit the C:\Program Files\Microsoft Deployment Toolkit\Bin\DeploymentTools.xml file and provide the %RealPlatform% value for the imgmgr.exe tool. Thank you L. Ozon for providing this elegant workaround. Below is what the edited line should look like:
<tool name="imgmgr.exe">%ADKPath%\Deployment Tools\WSIM\%RealPlatform%</tool>
Hi,
iam facing Verify BcdBootfix Error on a Laptop having both SSD and HDD ,The MDT offline image i created works on a Single Disk Laptop but fails on combined one, can you Please help
You have to write a custom script that provides better disk detection. For the PSD extension to MDT, we wrote a GUI that lets you select the disk.
Hi ,
Have created powershell and winforms based script that solves this problem now .
I have another issue if old boot partition are present on disk 0 and we select disk 1 it fails after Os installation phase with 5616 error,
When i clean both drives and restart deployment it works.
Existing partitions can certainly cause issues. It's a good practice to wipe the disk early in the process.
this is fire! Thank you 🙂
Thanks for providing support where Microsoft doesn't. Everyone keep saying to switch to InTune and such, but nobody seem to understand that some fields are forced to use air gapped network and these new solutions are not going to work in these situation. We also tried FOG project, and got it working, but the lack of support for secure boot and the complexity to set it up to properly deploy to multiple type of hardware make it less than ideal.
Im running the adk for windows 11 22h2 and the windows pe adk for the same ive added the x86 directories for some reason when i boot a vm to test with i get a windows deployment services error error code 0xc0000704
That error usually indicates an issue either with the boot image or WDS itself. Try adding a native boot image from ADK into WDS to rule out any issues with the boot image from MDT.
Thank you for sharing
Hi, image capturing is keep failing for me when MDT is about to start creating Wim file any Idea? error in DISM logs: 2024-12-02 15:46:04, Error DISM DISM WIM Provider: PID=636 TID=1128 onecore\base\ntsetup\opktools\dism\providers\wimprovider\dll\wimmanager.cpp:1107 – CWimManager::Capture(hr:0x8007000d) 2024-12-02 15:46:04, Error DISM DISM WIM Provider: PID=636 TID=1128 onecore\base\ntsetup\opktools\dism\providers\wimprovider\dll\wimmanager.cpp:4495 – CWimManager::InternalCmdCaptureBase(hr:0x8007000d) 2024-12-02 15:46:04, Error DISM DISM WIM Provider: PID=636 TID=1128 "Error executing command" – CWimManager::InternalExecuteCmd(hr:0x8007000d) 2024-12-02 15:46:04, Error DISM DISM WIM Provider: PID=636 TID=1128 onecore\base\ntsetup\opktools\dism\providers\wimprovider\dll\wimmanager.cpp:2128 – CWimManager::ExecuteCmdLine(hr:0x8007000d) 2024-12-02 15:46:04, Error DISM DISM.EXE: WimManager processed the command line but failed. HRESULT=8007000D And the following in Bdd log Console > Error: 13 ZTIBackup 12/2/2024 3:04:29 PM 0 (0x0000) Console > The data is invalid. ZTIBackup 12/2/2024… Read more »
Nothing that rings a bell
Hi Johan, I am using MDT server and was able to Capture ( Litetouch.vbs )Win11 back in March/April 2024. Now with the latest patches I get the following errors: When running capture with Litetouch.vbs the following errors occurr: 2019-03-06 11:38:14, Error SYSPRP Package Microsoft.RemoteDesktop_10.1.1088.0_x86__8wekyb3d8bbwe was installed for a user, but not provisioned for all users. This package will not function properly in the sysprep image. 2019-03-06 11:38:14, Error SYSPRP Failed to remove apps for the current user: 0x80073cf2. 2019-03-06 11:38:14, Error SYSPRP Exit code of RemoveAllApps thread was 0x3cf2. 2019-03-06 11:38:14, Error SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'SysprepGeneralizeValidate' from C:\Windows\System32\AppxSysprep.dll; dwRet = 0x3cf2… Read more »
No need to update the server, but make sure the reference build VM does not have Internet access during build and capture.
Hi Johan, Have you had any issues with Windows 11 24H2 Build & Capture (B&C) Task Sequences using ADK 22621? I'm currently testing a Windows 11 24H2 B&C using ConfigMgr 2309, MDT (latest version) and ADK 10.1.26100.1 installed. After capturing the build, a blue restart screen is displayed requiring you to click next to restart the machine. The same screen is displayed on machines built using the WIM file. The blue restart screen does not occur with Windows 11 23H2. After repeated testing, if I skip the sysprep and capture stage, the blue restart screen is not displayed and the… Read more »
Not since the November media, see this post: https://www.deploymentresearch.com/building-a-windows-11-24h2-reference-image-using-microsoft-deployment-toolkit-mdt/
Hi. I can't seem to get MDT to sysprep my Windows 11 image unless i change the registry key state in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State to IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE. Is there any other way to overcome this sysprep issue?
Yes, simply prevent the VM from having Internet access during Build and Capture
Eh how can I achieve this to block Internet access? Is it in your article titled “Block Internet Access to a Hyper-V VM”? What if my machine is a physical one?
See my Block Internet Access to a Hyper-V VM post: https://www.deploymentresearch.com/block-internet-access-to-a-hyper-v-vm/
Hi Johan, what do you think about the latest version of the ADKs ADK 10.1.26100.1 (May 2024), (10.1.26100.1) in combination with SCCM 2309? Do you already have experience with this version?
I would like to install this version to close the Black Lotus security gap in the WInPEs.
At the moment I am using ADK version 10.1.22621.1. I don't have any problems with it, but I want to avoid closing the Black Lotus security gap with any scripts. What do you think about this topic?
with kind regards
Stanislaw
I only recommend adding ADK 24H2 (build 26100) boot images if you need to do ARM64 deployments. For everything else, use ADK 22H2 (build 22621) boot images.
Hello Johan, thank you so much for your feedback. I don't have the need to use the latest ADK version, but I need to close the Black Lotus vulnerability (CVE-2023-24932). Do you have any experience how to close the CVE in ADK 22H2 (build 22621)?
We've done a bit of testing by updating the boot image with the latest CU, and copy the new EFI files. Worked booting on mitigated devices, but will fail on non-mitigated devices, and also break your PXE (unless using third party PXE already updated). For now, I recommend waiting.
I followed the steps above completely but cannot generate a catalog file. I get the following error: non-zero return code from catalog utility, rc = -532462766
Do you have any solution? I used the 22H2 ADK and WinPE environment and have a 23H2 image.
Thank you in advance for your reply.
You rarely need a catalog file, but if you need one, you can always generate one on another computer and copy over.
Had any luck with DaRT on 24h2 ADK? Got it copied on mine, and when I run remoterecovery.exe it doesn't actually open the app/dialog, not is it listed in task manager.
Yes, DaRT is working fine for me in Windows ADK for Windows 11 24H2 (26100). I use the native DaRT integration with MDT to add it.
Very strange. And running the remoterecovery works as normal? Wonder why it doesn't launch on mine.
I tried Using MDT 8456 with Windows ADK 24H2 (Build 10.1.26100.1 – May 2024), for some reason, and go figure: the failed sysprep problems seem to be back, although I do have the scripts to pauze Store updates.I guess I should have known better.
So far, the testing with ADK 26100 has been promising, but there is no requirement on that version to deploy Windows 11 23H2 (or 24H2).
Hi, Couple of questions: Instead of the kb5032202, can we use the latest – 2024-04 Cumulative Update for Microsoft server operating system version 23H2 for x64-based Systems (KB5036910) to update ADK winpe.wim (ADK 23H2 (Build 25398) with your script "Update-ADK25398BootImageInstallFolderWithCU.ps1" (where the contents are modified as needed)? Is "step-1: enough to fix the scripting support issues If I recall correctly, ADK winpe.wim is used to create the LiteTouch.wim, when in MDT-Workbench you issue "Update\regenerate boot images" for the deployment share, so it should create an up-to-date LiteTouchPE.wim file, correct? In short, the resulting deployment set should be able to boot… Read more »
1. I haven't tried later updates for this issue, but they should work.
2. For VBS support in WinPE, yes. For MDT you may have to update the Unattend_PE_x64.xml too as described in https://github.com/MicrosoftDocs/memdocs/blob/main/memdocs/configmgr/mdt/known-issues.md
3. Correct
Thank you for the tip on item-2. Yes indeed. I missed that. Here's another annoyance I came across.. When WinRE.wim is created, it is usually larger than the WinRe partition, depending on the drivers, and other items included in WinRE.wim. So, I may end up with 2 scenarios: 2 WinRe partitions are created: 499 MB which is not used, and a larger WinRE partition where winRE.wim is placed. or WinRE.wim is placed on the OS Disk (C-drive). Solution: For new Deployment shares, edit the "..\Microsoft Deployment Toolkit\Templates\Distribution\Scripts\ZTIDiskpart.wsf" file: find and change the size of: Const WINRE_DRIVE_SIZE = 499 (to 999 or… Read more »
Thanks for the info. I tested deploying Windows 11 23H2 in a machine with 80 GB disk, and a machine with 240 GB disk. In both cases, the 665 MB WinRE.wim file was added to the recovery partition.
Ahh, but the point is, if the large Winre.wim file is added to WinRE partition, then you probably have 2 WinRE partitions: 1 small at 499MB (which is not used), and another larger (which actually contains the WinRE.wim).
Worth double checking… 🙂
Hello, There's an easier fix for WSIM_x64 than copying files for MDT. The file (at "..\Microsoft Deployment Toolkit\Bin\DeploymentTools.xml) contains the various tools and their paths. <tool name="imgmgr.exe">%ADKPath%\Deployment Tools\WSIM</tool> indicates it has to use the x86 version of WSIM. If you look at other tool specs in the file, you'll notice it is using a var %RealPlatform%. So, if you modify the WSIM specs as: <tool name="imgmgr.exe">%ADKPath%\Deployment Tools\WSIM\%RealPlatform%\</tool> Then, when you start workbench, open Deployment Share, locate the Task object, and open unattend via the edit unattend file, it will use WSIM_x64 to open the unattend, and will successfully create Catalog… Read more »
Thanks for the tip, I will update the blog post with this info
Thanks Johan for sharing the informative article,
I have a question regarding your recommendations about using at least Windows ADK for Windows 11 22H2 (Build 22621), does this version support DART integration tool, also does it will work fine for deploying Windows 11 23H2 and Windows 10 22h2?
Thanks,
Hi Ahmed, DaRT still works in WinPE build 22621, and that version can deploy images of Windows 11 23H2 and Windows 10 22H2 just fine.
Got the same and googled a bit and found this article. This made Catalog to work
dart also works with adk 24h2 boot image the fmapi error is fixed.
I'm glad to hear