System Image Best Practices for KACE SDA
Audit the KACE SDA Before You Begin
- Maintain at least 20% free disk space on the appliance.
- Back up and remove unused images, then remove the corresponding files from the Restore Share directory.
- Remove test images and obsolete image revisions that are no longer required.
- Important: Never run Delete Unused System Image Files or delete an image while an image capture is in progress.
Start with a Clean Reference Image
- Create the golden image in a virtual machine whenever possible. This minimizes hardware-specific drivers and simplifies ongoing image maintenance.
- Do not create a golden image from a manufacturer-installed operating system. Only use Microsoft Volume Licensing media. Avoid OEM media whenever possible. See KB 135252 for information regarding Microsoft imaging rights.
- If applying updates after image capture, deploy a non-sysprepped image only back to the original hardware.
- Refresh and maintain images regularly by installing updates and performing system cleanup.
Configure the Reference Workstation
The following articles provide recommended methods for preparing operating systems for image capture. Use the appropriate article based on the system firmware type:
If you are not following the procedures outlined in the articles above, consider the following recommendations:
- If the system was previously deployed using KACE SDA, remove the KACE directory from the root of the drive and delete %ALLUSERSPROFILE%\Quest\KACE.
- If the system was previously sysprepped, delete C:\Windows\System32\Sysprep\sysprep_succeeded.tag.
- Install all required operating system updates and patches.
- Create and customize an administrator profile that will become the default user profile.
- Quest recommends maintaining a lean base image and deploying applications through post-installation tasks whenever possible. This provides greater flexibility for different departments and user groups.
- If creating a full image, avoid including software that requires frequent updates (such as browsers, Adobe Reader, or similar applications). Deploy these using post-installation tasks or through KACE SMA.
- Do not include antivirus software, encryption software, endpoint security products, virtual CD/DVD software, hardware-emulation software, or the KACE SMA Agent in the image. These applications can interfere with image deployment and imaging processes.
- For WIM-based captures, maintain at least 60% free space on each partition before capture.
Sysprep, Capture, and Deployment Best Practices
- Before running Sysprep, capture a non-sysprepped image or create a VM snapshot. This allows rapid recovery if Sysprep fails.
- Golden images created in virtual machines can leverage snapshots at various stages, including before Sysprep execution.
- If Sysprep encounters issues, restoring a non-sysprepped image to the original hardware is often faster and helps avoid rearm-related problems.
- When storing non-sysprepped images on the KACE SDA, use descriptive naming conventions that indicate whether the image is sysprepped and include version or date information.
- Use the Notes field in the KACE SDA Administrator Interface as a change and audit log.
Sysprep
- Sysprep is a Microsoft-supported requirement for deploying an image to different hardware. You can use either Microsoft's Sysprep tools or the KACE Sysprep Creator Wizard.
- If using a customized default profile, ensure CopyProfile=True is configured in the unattend.xml file. The Sysprep Creator Wizard includes an option to copy the current profile to the default profile.
- When running Sysprep manually, use:
/generalize /oobe /shutdown /unattend - Using /shutdown is recommended because it prevents missing the PXE boot process after Sysprep completes.
- To troubleshoot Sysprep failures, boot into KBE, navigate to Recovery > Command Prompt, and review:
C:\Windows\System32\Sysprep\Panther\setuperr.log
Capture
- Verify sufficient free space exists on the KACE SDA before beginning the capture.
- After capture completes, boot the sysprepped system to verify Mini-Setup executes successfully.
- Validate system functionality before releasing the image for production use.
- Capturing images across a WAN connection is not recommended. Capture images only across the local LAN where the KACE SDA resides.
Deploy
- Add the required Pre-, Mid-, and Post-Installation Tasks to the image.
Minimum task requirements:
Legacy BIOS Images: Partition Disks, Format, and MBR
UEFI Images: Create UEFI Partitions and Apply UEFI Partitions
- Always test deployments on alternate systems before production use.
- For remote offices, consider deploying a Remote Site Appliance (RSA). Image deployments across a WAN are not recommended.
Post-Installation Task Best Practices
Use consistent naming conventions to improve organization. Common prefixes include: App-, Script-, OSConfig-, and Mid-.
- Arrange tasks so prerequisites are installed before dependent applications.
- Execute VBScript files using:
cscript myscript.vbs - When creating ZIP packages, ensure the executable or installation file resides in the root of the ZIP archive.
- For MSI installations, place the
/i switch last. Example: msiexec /qn /norestart /i agent.msi
