{"id":9033,"date":"2024-02-01T13:07:54","date_gmt":"2024-02-01T13:07:54","guid":{"rendered":"https:\/\/cheapwindowsvps.com\/blog\/step-by-step-guide-on-inserting-offline-msu-updates-into-windows-wim-images\/"},"modified":"2025-01-20T11:30:47","modified_gmt":"2025-01-20T11:30:47","slug":"step-by-step-guide-on-inserting-offline-msu-updates-into-windows-wim-images","status":"publish","type":"post","link":"https:\/\/cheapwindowsvps.com\/blog\/step-by-step-guide-on-inserting-offline-msu-updates-into-windows-wim-images\/","title":{"rendered":"Step-by-Step Guide on Inserting Offline .MSU Updates into Windows .WIM Images"},"content":{"rendered":"
Before deployment, Microsoft ISO’s install .wim or custom images should be updated. With the DISM module in PowerShell, you can add .msu updates, apps, and drivers to a Windows image offline without the need to boot it up.<\/div>\n

In principle, you can roll out outdated WIM archives because Windows Update subsequently downloads the patches to the live system. This occurs by default during installation unless setup.exe<\/em> is called with the \/dynamicupdate disable<\/em> switch or configured accordingly via setupconfig.ini<\/a>.<\/p>\n

Delaying the update of Windows until after deployment or even later has several drawbacks. It increases the time needed for the OS installation or – if you wait until after the setup is complete – the computers are initially not protected by the latest patches. In addition, users must restart their PCs after applying the updates.<\/p>\n

Extracting a WIM archive<\/h2>\n

We utilize an unaltered install.wim<\/em> in our example, nonetheless, this process applies to all WIM archives. The file can be located in the sources<\/em> directory of Microsoft’s ISO. After mounting the ISO as a virtual DVD drive, it’s advisable to copy it to a usable directory:<\/p>\n

Mount-DiskImage C:Usersmeen-us_windows_11_business_editions_version_23h2_x64_dvd_a9092734.iso<\/pre>\n
Read index of images from WIM archive<\/h2>\n
For offline image servicing, DISM or the cmdlets from the equivalent PowerShell module are suggested. Compared to the legacy utility, with its uneven syntax, the latter is considerably easier to use.<\/p>\n
The initial step is to show the contents of the WIM archive. This is important because it can contain multiple images, and you need the index of the image you want to mount:<\/p>\n
Get-WindowsImage -ImagePath .install.wim | select ImageName, ImageIndex<\/pre>\n
Display the contents of a WIM archive with Get-WindowsImage.<\/p>\n
Mount image<\/h2>\n
Once you have determined the index, you can mount the image for offline servicing with this command:<\/p>\n
Mount-WindowsImage -Path .image -ImagePath .install.wim -Index 5 -CheckIntegrity<\/pre>\n
This mounts the image with index 5 (Windows 11 Pro) into the subdirectory .image<\/em> and checks its integrity. If you have just extracted the WIM file from the installation media, you may encounter the following error message:<\/p>\n
Mount-WindowsImage: You do not have permissions to mount and modify this image.<\/em> Verify that you have Read\/Write<\/em> permissions or mount the image using the \/ReadOnly<\/em> option.<\/p>\n
Mounting install.wim fails due to the read-only attribute of the file.<\/a><\/div>\n
Mounting install.wim fails due to the read-only attribute of the file.<\/div>\n
The error message is misleading because insufficient permissions do not cause the issue. Instead, the WIM file’s read-only attribute is the culprit. You can remove this attribute with this command:<\/p>\n
attrib -r install.wim<\/pre>\n
After successfully mounting the image, you can start installing the updates. These are usually downloaded in .msu<\/em> or .cab<\/em> format from the Update Catalog<\/em>.<\/p>\n
Download missing patches from the Microsoft Update Catalog.<\/a><\/div>\n
Integrate updates into the image<\/h2>\n
Our example deals with the latest cumulative update for Windows 11 x64. Use the following command to add it to the image:<\/p>\n
Add-WindowsPackage -PackagePath .windows11.0-kb5031455-x64_[\u2026].msu -Path .image -LogLevel 3<\/pre>\n
This command incorporates the pathway to the update along with the directory where the image has been mounted. When a directory is specified instead of a file for the PackagePath<\/em> parameter, it adds all .msu<\/em> and .cab <\/em>files stored in that directory to the image.<\/p>\n
A LogLevel<\/em> of 3 logs errors, warnings, and info into the log file which by default is %WINDIR%LogsDismdism.log<\/em>.<\/p>\n
You can also add updates using Add-WindowsCapability<\/a> and Add-WindowsDriver<\/a> for the installation of optional features or drivers in the image. Likewise, for adding store apps that will be automatically installed for each new user on the computer, use Add-AppxProvisionedPackage<\/a>.<\/p>\n
To conclude, you can check if all desired packages are included in the image:<\/p>\n
Get-WindowsPackage -Path .image | sort InstallTime -Descending | more<\/pre>\n
This command sorts the installed packages by installation date in descending order, displaying the most recently added packages first.<\/p>\n
Unmount the image<\/h2>\n
Finally, you can save the updated image. To do this, either use Save-WindowsImage<\/a> before you unmount the image or dismount it immediately and save it at the same time:<\/p>\n
Dismount-WindowsImage -Path .image -Save -CheckIntegrity<\/pre>\n
In both cases, you can use the CheckIntegrity switch to verify the integrity of the image.<\/p>\n
Summary<\/h2>\n
The cmdlets from the DISM module make it relatively straightforward to integrate updates, drivers, or apps into an installation image. Hence, it is unnecessary to boot the image, update it, and then generalize it again with Sysprep<\/em>. Instead, these tasks can be performed offline by mounting the image.<\/p>\n","protected":false},"excerpt":{"rendered":"
Before deployment, Microsoft ISO’s install .wim or custom images should be updated. With the DISM module in PowerShell, you can add .msu updates, apps, and drivers to a Windows image offline without the need to boot it up. In principle, you can roll out outdated WIM archives because Windows Update subsequently downloads the patches to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9033","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9033","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=9033"}],"version-history":[{"count":2,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9033\/revisions"}],"predecessor-version":[{"id":10440,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9033\/revisions\/10440"}],"wp:attachment":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=9033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=9033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=9033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}