Windows 7 Enterprise Deployment & WSUS

Clownstyle · 20 Mar 2015

Hi all,

I've recently started in a new job as an ICT technician. I'm working with a system admin at a local school.

In previous jobs I've always used a "gold image" to deploy out to machines. In the new job there is no such thing unfortunately, making new installs a long drawn out affair (lots of additional software installs. Office, Visio, custom programs etc)

I have some spare time on my hands soon, so was thinking of creating a standard image that I can deploy (just via USB) to new machines that need to be imaged.

I already have a WinPE boot disk and understand the concept of sysprep and configuring in audit mode after a clean install (this will be my approach) I will probably then use CloneZilla to image the final product and deploy onto single machines where needed.

... I have a few questions!

1. How should I handle Windows updates? These are normally pushed out via WSUS - Some things should *not be installed* latest IE for example. WSUS is only pushing out IE9 due to some compatibility issues with sites that are currently used (there may be other updates that are not installed, but I'm not 100%) - What would be the best approach here? Not using the standard Windows update before I sysprep, or joining the domain, installing updates via wsus, then leaving the domain and running a sysprep?

2. Being as all the machines will be the same make and model, would it be worth including drivers into the mix, or will they be removed with sysprep? I believe this step may be optional.

3. Will local user accounts be kept after the sysprep? I need to set a specific local admin account if possible. No biggie if I can't.

Thanks in advance for your suggestions. This would save me hours, possibly days over the coming weeks

logicearth · 24 Mar 2015

Don't have time to answer all your questions, but I can tell you that you do not need to join the domain to use WSUS, just configure the proper settings either in Group Policy or in the registry directly. Having them part of the domain only aids in mass configuration.

AddRAM · 24 Mar 2015

If all the machines are the same, the image should be pushed over the network, not through usb. But whatever, usb will be faster due to congestion on the network, but then again machines should be imaged during non work hours anyway. I image 5 to 10 machines at a time, so it`s no big deal either way.

All updates should be in the image and handled by your IT Admin. If you can only use IE9 then that`s all you can use.