Automating updates during MDT 2013 Lite-Touch deployments
I use Microsofts Deployment Toolkit (MDT) in my lab to deploy Windows VMs with Windows Server 2008 and Windows Server 2012. I described the installation and configuration of MDT in a small blog post series. Take a look into the intro post, if you’re a new to MDT. But the OS installation isn’t the time consuming part of a deployment: It’s the installation of patches. Because of this, I decided to automate the patch installation and make it part of the OS installation.
The requirements
To automate the installation of patches, we need
To save resources, I’ve installed WSUS on the server I also use for MDT. In Windows Server 2008 R2 and Server 2012 (R2) WSUS is a installable role. Because I use a Windows 2008 R2 host for MDT, I could simply add the role to the server. I will not describe the installation of the WSUS role, because this is really easy.
Configuration of MDT 2013
In principle, there are two changes:
- Enableing Windows update in the task sequence
- Adding WSUS server to the CustomSettings.ini file
First of all you need to enable the Windows update part in the task sequence. Start the Deployment Workbench and navigate to the task sequences. Go into the properties, switch to the “Task Sequence” tab and enable the “Windows Update (Post-Application Installation)” task by unchecking the “Disable this step” box on the “Options” tab.
Patrick Terlisten/ vcloudnine.de/ Creative Commons CC0
Click “OK” and switch to the deployment share. Go into the “Control” directory and open the CustomSettings.ini. Add this line to the end of the [Default] section:
WSUSServer=http://FQDN:8530
Make sure that you change the FQDN to your WSUS host and save the file.
If everything went fine, you should see this during the deployment process:
Patrick Terlisten/ vcloudnine.de/ Creative Commons CC0
The host, that is currently deployed, should also appear in the WSUS console.
Patrick Terlisten/ vcloudnine.de/ Creative Commons CC0
How it works
During the deployment process the script ZTIWindowsUpdate.wsf is called. This script connects to the WSUS server and installs all appropriate updates, servicepacks etc. This includes the latest version of the Windows Update API and the Microsoft Update binaries. Because the script install ALL appropriate updates, service packs etc., there is no way to exclude updates from being installed. Really no way? However, there is a way. You can use the WUMU_ExcludeKB switch in the CustomSettings.ini to exclude updates. Simply add one line for each KB that you want to suppress.
WUMU\_ExcludeKB1=47110214
WUMU\_ExcludeKB2=47110215