PXE/BINL - AN06: Windows Network Image Capture & Deploy on ARM ARM64

Starting an automated network image Capture and Deploy of WDS OSs on ARM/ARM64, taking no more than 15 minutes and a ~4 MB download.

The objective of this document is to show you how to network image a PC installed with a WDS ARM/ARM64 OS and later network deploy it. It is all based on Serva's new Task Sequence Engine (TSE) and ARM/ARM64 support not requiring to follow cryptic procedures nor being dependant on Microsoft’s WDS/MDT/SCCM or ADK suites.

Procedures described in this document require Serva "Pro"

Serva PXE/BINL - Application Note Set
PXE/BINL - AN01: Windows Network Install - Basis
PXE/BINL - AN01.1: Windows Network Install - WDS OSs
PXE/BINL - AN01.2: Windows Network Install - RIS OSs
PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
PXE/BINL - AN03: Non-Windows Network Boot/Install
PXE/BINL - AN04: Custom menu
PXE/BINL - AN05: Windows Network Image Capture & Deploy
PXE/BINL - AN06: Windows Network Image Capture & Deploy on ARM

1 Requirements

1.1 Required Software
1.1.1 Microsoft Windows Serva 5.0.0 "Pro" or higher.
1.1.2 Reference PC ARM/ARM64 based i.e. Surface Pro X

1.2 Assumed knowledge
1.2.1 PXE/BINL - AN01: Windows Network Install - Basis
1.2.2 PXE/BINL - AN01.1: Windows Network Install - WDS OSs
1.2.3 PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
1.2.4 PXE/BINL - AN05: Windows Network Image Capture & Deploy

2 Overview

Before v4.4.0 Serva was able to provide network boot services to the booting architectures defined by DHCP Option 93 (see RFC 4578). Serva's BINL specifically supported:

DHCP Option 93	Client's pre-OS runtime
0	Intel x86PC
6	EFI IA32
7	EFI x86-64
9	EFI BC

Since v4.4.0 Serva is able to provide network boot services to the booting architectures now defined by the DHCPV6 Processor Architecture Types. Serva's BINL now adds ARM UEFI support:

DHCP Option 93	Client's pre-OS runtime
0	x86 BIOS
6	x86 UEFI
7	x64 UEFI
9	EBC
10	ARM 32-bit UEFI
11	ARM 64-bit UEFI

Warning !
Currently Serva will be able to Net Boot ARM 32/64-bit UEFI assets by using Microsoft Boot Managers, therefore we must accordingly set at Serva's DHCP Setting tab the Boot Manager mode; BINL BM_Mode=3, otherwise ARM/ARM64 clients will not be able to net boot!

BMM	BIOS Client	EFI64 Client	EFI32 Client	EFIARM64 Client	EFIARM32 Client
1	pxeserva.0	pxeserva.efi	pxeserva.efi	-	-
[3]	pxeserva.0	bootmgfw.efi	bootmgfw.efi	bootmgfw.efi	bootmgfw.efi

Since v4.4.0 Serva Pro also includes the ARM/ARM64 native versions of ServaPENet.

2.1 Procedure:

Warning !
From this point on, this Application Note uses as target a Microsoft Surface Pro X SQ1 (ARM64) with an Ethernet adapter provided either by the Microsoft Surface Dock / 2 or Microsoft Surface USB-C Ethernet and USB 3.0 adapter. The methods and scripts presented here might need to be adapted if used with different target devices.

MS Surface Pro X -- Surface Dock 2 -- Surface USB-C/Ethernet/USB-3.0 -- Surface Travel Hub

Stop !
Before attempting any network capture or deployment on a Microsoft Surface device always download the Recovery Image and create the corresponding recovery pen drive first.

Let's consider you have a reference PC that has been customized with software and settings, and you would like to take an image of this PC and later apply it to other PCs. The Reference system must be first generalized using Sysprep by removing computer-specific information such as installed drivers and computer security identifier (SID), etc. Next you should net capture the image of the Reference PC into a WIM file which will be stored in Serva repository. Later on this image can be offered for network deployment to different target PC systems.

3 Sysprep

To capture a Windows image, you have to first generalize the installed image. Even if you're capturing an image that's going to be deployed to a PC with similar/identical hardware, you still have to generalize the Windows installation to remove unique PC-specific information from a Windows installation, which allows you to safely reuse your image.
When you generalize an image, Windows replaces the computer SID only on the operating system volume where you ran Sysprep. If a single computer has multiple operating systems, you must run Sysprep on each image individually.

Please generalize your reference PC as explained here:
Sysprep (Generalize) a Windows installation

4 Windows PE

4.1 Auxiliary network bootable executive: Windows PE.

The process of network capturing and network deploying a PC image with Serva will require network booting a Windows PE executive.

4.1.1 Creating a Windows PE executive.
The Windows Assessment and Deployment Kit (ADK) includes the CopyPE and MakeWinPEMedia command line utilities. When run from the Deployment and Imaging Tools Environment, CopyPE creates a working set of WinPE files that MakeWinPEMedia can later use to create bootable WinPE media. MakeWinPEMedia creates bootable WinPE ISOs containing the required Windows PE executive (boot.wim).

>copype ARM64 C:\WinPE_ARM64
 
>MakeWinPEMedia /ISO C:\WinPE_ARM64 C:\WinPE_ARM64\WinPE_ARM64.iso

After creating WinPE_ARM64.iso you can mount it or open it with 7zip and extract the Windows PE executive file \sources\boot.wim

When booting the created Boot.wim on a Microsoft Surface Pro X SQ1/SQ2 the Network driver and the part of the disk driver (EhStorClass.sys) are missing

Warning !
When booting the created Boot.wim on a Microsoft Surface Pro X SQ1 the Network driver and a component of the disk driver (EhStorClass.sys) were missing

4.1.2 Repurposing a Windows PE executive
Instead of creating your own boot.wim as described in 4.1.1 you can easily repurpose one taking it from the Surface Pro X "recovery image", you can download it from Microsoft here. i.e. SurfaceProX_BMR_16_128.5.0.zip corresponding to a Surface Pro X - SQ1/8/128 M1501 - Windows 10 Pro Version 1903.
The needed Windows PE executive can be found at \sources\boot.wim.

The downloaded WIMs did not include the NIC driver corresponding to the Microsoft Surface Dock /2 or Microsoft Surface USB-C Ethernet and USB 3.0 adapter then we injected its components with Serva as explained in PXE/BINL - AN01.1: Windows Network Install - WDS OSs

Driver components:

 msuarm64w10.cat 
 msuarm64w10.INF 
 msuarm64w10.PNF 
 msuarm64w10.sys

The last versions of these files can be found in the Surface Pro X at C:\Windows\WinSxS\

4.2 Network Booting the Windows PE executive.

Please proceed as explained in PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot
i.e. creating the \WinPE_ARM64 Head Directory and copying the following files:

C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\boot.wim
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\boot.sid
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\ServaAsset.inf

ServaAsset.inf

[PXESERVA_MENU_ENTRY]
asset = Catpure & Deploy Surface Pro X

[SERVAPENET]
EndProcess = *TaskSeqSelector

Since Serva 4.0.0 ServaAsset.inf is also parsed for WDS assets. Now we can define not only the name of the WDS asset displayed on Serva's menu but also trigger the injection of ServaPENet when booting stand-alone Windows PE executives. In this case when ServaPENet finishes its job is able to launch an external or internal command. In the example above ServaPENet is instructed to finish by executing an internal command (*TaskSeqSelector) that will display a Task Sequence Selector at the net booting PC.

Now when restarting Serva its BINL service will:

Parse \WDS\WinPE_ARM64 detecting that you are offering for network boot a stand-alone Windows PE executive (boot.wim).
Parse ServaAsset.inf knowing that:

You defined the asset name.
ServaPENet must be injected into boot.wim.
ServaPENet must end its job at the booting client by invoking its "Task Sequence Selector"

When Serva's BINL service finishes you should see:

Open All | Close All

WinPE_ARM64 head directory process

In the previous directory structure we see:

\$OEM$ directory ready to hold OEM drivers and custom components being injected into boow.wim. Identical to the one used in PXE/BINL - AN01.1: Windows Network Install - WDS OSs
\Images directory ready to hold your captured and/or offered PC images (usually WIM or FFU files).
\Logs directory ready to hold Log files from remote PCs being captured or imaged.
\TaskSequences directory ready to hold your set of Task Sequence command (*.cmd) and/or powershell (*.ps1) files and associated components if any.

Notes
ADL created Windows PE executives do not include PowerShell support by default. If needed please read: WinPE: Adding Windows PowerShell support to Windows PE. PowerShell Task sequences will be listed only if PowerShell support is included in the booted Windows PE executive.

5 Capture & Deploy

Windows 10 on Microsoft Surface Pro X (and many more) presents the classic 4 partition type schema. System - Reserved - Primary - Recovery :

Fig 1: System (UEFI) - Reserved - Primary (Windows) - Recovery (winre.wim).

5.1 Multi Partition Capture & Deploy

This method will individually capture & deploy the System, Primary, and Recovery partition types.
this method allows:
1) Deploy to different sizes of hard drives and the Windows partition will expand/contract accordingly to the destination disk size.
2) Modify the captured images with Dism.exe

5.1.1 Capture Task Sequence.
Let's write a Capture Task Sequence in a command file i.e.:

Capture_SurfaceProX.cmd

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Capture
ECHO [TS] Capture_SurfaceProX.cmd - v1.0 - Demo purposes 
:: NOTE: ServaPENet login with R/W rights on WIA_WDS_SHARE required!
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END

:: ===== The Script begins here ===\\

:: -- Task Sequence Variables --\
:: DISKPART TARGET DISK 
SET TARGET_DISK=0

:: SET THE LABEL OF THE WINDOWS VOLUME BEING CAPTURED HERE
:: Surface Pro X default = "Local Disk"  
SET WINVOLUMELABEL="Local Disk"

:: SET THE BASE NAME OF THE IMAGES BEING CAPTURED HERE
SET IMG_FILE=Windows10_SPX
SET IMG_NAME="Windows_10_ARM64" 
:: -- Task Sequence Variables --/

:: :: ::
:: Environment variables defined by ServaPENet
:: Variable:  Local Content:     Pointing to Serva Repository:
:: DEV_NAME   P:                 WIA_WDS_SHARE\<Head_Directory>		
:: TS_DIR     P:\TaskSequences   WIA_WDS_SHARE\<Head_Directory>\TaskSequences
:: IMG_DIR    P:\Images          WIA_WDS_SHARE\<Head_Directory>\Images
:: LOG_DIR    P:\Logs            WIA_WDS_SHARE\<Head_Directory>\Logs
:: :: ::

:: == Check Serva repository R/W access ==
CALL :ReadOnlyDir %IMG_DIR%
IF %ERRORLEVEL% NEQ 0 (
ECHO [TS] ERROR: User does not have Writing Rights in Serva's repository.
PAUSE
GOTO END
)


:: 1)
:: ==== "Primary" partition (Windows OS Partition) ====

:: == Find Windows volume letter ==
CALL :GetVolumeLetter WINVOLUMELETTER %TARGET_DISK% %WINVOLUMELABEL%
IF %ERRORLEVEL% NEQ 0 (
ECHO [TS] ERROR: Couldn't find OS Volume labeled %WINVOLUMELABEL%.
PAUSE
GOTO END
)
:: Alternative Manual definition
::SET WINVOLUMELETTER=C

:: == Optimize the image to reduce booting time of the applied image  (Optional) ==
:: ECHO Starting image optimization...
:: Dism /image:%WINVOLUMELETTER%:\ /optimize-image /boot

:: == Capture the Primary partition (Windows OS) ==
IF NOT EXIST %IMG_DIR%\%IMG_FILE%_Primary.wim GOTO STARTCAPTURE_PRIMARY
ECHO [TS] Warning: File %IMG_FILE%_Primary.wim exists
SET /P OVERWRT="Overwrite (y/n):"
IF "%OVERWRT%" NEQ "y" GOTO END

:STARTCAPTURE_PRIMARY
ECHO [TS] Starting capture: Primary partition...
Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Primary.wim" /CaptureDir:%WINVOLUMELETTER%:\ /Description:"%IMG_NAME%_Primary" /Name:"%IMG_NAME%_Primary"



:: 2)
:: ==== "System" partition (EFI System Partition) ====

:: == Find System partition number ==
CALL :GetPartitionNumber PARTNUMBER %TARGET_DISK% System 
IF %ERRORLEVEL% NEQ 0 (
ECHO [TS] ERROR: Couldn't find number of partition type: System.
PAUSE
GOTO END
)

(
ECHO select disk %TARGET_DISK%
ECHO select partition=%PARTNUMBER%
ECHO assign letter=S
ECHO exit
) | diskpart

:: == Capture the System partition (EFI System Partition) ==
IF NOT EXIST %IMG_DIR%\%IMG_FILE%_System.wim GOTO STARTCAPTURE_SYSTEM
ECHO [TS] Warning: File %IMG_FILE%_System.wim exists
SET /P OVERWRT="Overwrite (y/n):"
IF "%OVERWRT%" NEQ "y" GOTO END

:STARTCAPTURE_SYSTEM
ECHO [TS] Starting capture: System partition...
Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_System.wim" /CaptureDir:S:\ /Description:"%IMG_NAME%_System" /Name:"%IMG_NAME%_System" 


:: 3)
:: ==== "Recovery" partition  ====

:: == Find System partition number ==
CALL :GetPartitionNumber PARTNUMBER %TARGET_DISK% Recovery 
IF %ERRORLEVEL% NEQ 0 (
ECHO [TS] ERROR: Couldn't find number of partition type: Recovery.
PAUSE
GOTO END
)

(
ECHO select disk %TARGET_DISK%
ECHO select partition=%PARTNUMBER%
ECHO assign letter=R
ECHO exit
) | diskpart

:: == Capture the Recovery partition  ==
IF NOT EXIST %IMG_DIR%\%IMG_FILE%_Recovery.wim GOTO STARTCAPTURE_RECOVERY
ECHO [TS] Warning: File %IMG_FILE%_Recovery.wim exists
SET /P OVERWRT="Overwrite (y/n):"
IF "%OVERWRT%" NEQ "y" GOTO END

:STARTCAPTURE_RECOVERY
ECHO [TS] Starting capture: Recovery partition...
Dism /Capture-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Recovery.wim" /CaptureDir:R:\ /Description:"%IMG_NAME%_Recovery" /Name:"%IMG_NAME%_Recovery" 



:END
ECHO [TS] Shuting down in
CALL :Delay 5
Wpeutil Shutdown
EXIT /B %ERRORLEVEL%
:: ===== The Script ends here ===//

:::::::::: LIBRARY FUNCTIONS :::::::::::::::::::

::: GetPartitionNumber <OUT_PARTNUMBER> <IN_TARGET_DISK> <IN_PARTTYPE> ::::\\
:: It returns the number of the first matching partition type found
:GetPartitionNumber
FOR /F "tokens=2,3" %%A IN ('^( ECHO select disk %~2 ^& ECHO list partition ^) ^| diskpart ^| find ^"%~3^"') DO (
  SET %~1=%%A
  EXIT /B 0
)
EXIT /B 1
::: GetPartitionNumber <OUT_PARTNUMBER> <IN_TARGET_DISK> <IN_PARTTYPE> :::://


::: GetVolumeLetter <OUT_VOLUMELETTER> <IN_TARGET_DISK> <IN_VOLUMELABEL> ::::\\
:: It returns the letter of the first Volume found
:GetVolumeLetter
FOR /F "tokens=3,4" %%A IN ('^( ECHO select disk %~2 ^& ECHO list volume ^) ^| diskpart ^| find ^"%~3^"') DO (
  SET %~1=%%A
  EXIT /B 0
)
EXIT /B 1
::: GetVolumeLetter <OUT_VOLUMELETTER> <IN_TARGET_DISK> <IN_VOLUMELABEL> :::://

::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::\\
:: It returns %ERRORLEVEL% == 0 if IN_DIR is R/O 
:ReadOnlyDir
2>nul rename %~1 %~nx1
EXIT /B %ERRORLEVEL%
::: ReadOnlyDir <IN_DIR> :::::::::::::::::::::::::::::::::::::::::::://

::: Delay <IN_SECS> :::::::::::::::::::::::::::::::::::::::::::::::::\\
:Delay
IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER
timeout /t %~1
EXIT /B 0
:STARTCMDTIMER
SETLOCAL EnableDelayedExpansion
SET /A delay=%~1-1
FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a"
FOR /L %%i IN (%delay%,-1,0) DO (
SET /p "= Delay          !Newline!" <NUL
SET /p "= Delay %%is!Newline!" <NUL
ping -n 1 -w 1000 192.168.255.0 > NUL
)
ECHO:
SETLOCAL DisableDelayedExpansion
EXIT /B 0
::: Delay <IN_SECS> ::::::::::::::::::::::::::::::::::::::::::::::::://

Note
For capturing system with customized partitions please read Capture and apply Windows, system, and recovery partitions then create the corresponding Image Capture task sequence

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_SurfaceProX.cmd

5.1.2 Deploy Task Sequence
Let's write a Deploy Task Sequence in a command file i.e.:

Deployment_SurfaceProX.cmd

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Deployment
ECHO [TS] Deployment_SurfaceProX.cmd - v1.0 - Demo purposes 
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END

:: ===== The Script begins here ===\\

:: -- Task Sequence Variables --\
:: SET THE BASE NAME OF THE IMAGES TO DEPLOY HERE
SET IMG_FILE=Windows10_SPX

:: DISKPART TARGET DISK 
SET TARGET_DISK=0

:: -- Task Sequence Variables --/

:: :: ::
:: Environment variables defined by ServaPENet
:: Variable:  Local Content:     Pointing to Serva Repository:
:: DEV_NAME   P:                 WIA_WDS_SHARE\<Head_Directory>		
:: TS_DIR     P:\TaskSequences   WIA_WDS_SHARE\<Head_Directory>\TaskSequences
:: IMG_DIR    P:\Images          WIA_WDS_SHARE\<Head_Directory>\Images
:: LOG_DIR    P:\Logs            WIA_WDS_SHARE\<Head_Directory>\Logs
:: :: ::

:: == Script protection ==
:: We protect Task Sequences that call "diskpart" from accidentally being run on not Windows PE systems
CALL :IsWinPE
IF %ERRORLEVEL% EQU 0 (
ECHO [TS] ERROR: This Task Sequence must be run under Windows PE.
PAUSE
GOTO END
)

:: == Create partitions ==
:: Windows 10 SPX UEFI ARM64 target
(
ECHO select disk %TARGET_DISK%
ECHO clean
:: Following commands are used with DiskPart to create four partitions ^
   for a UEFI/GPT-based Surface PRO X. ^
   Found at SurfaceProX_BMR_16_128.5.0.zip/sources\CreatePartitions-UEFI.txt
ECHO convert gpt
ECHO create partition efi size=260
ECHO format quick fs=fat32 label="System"
ECHO assign letter=S
ECHO create partition msr size=128
ECHO create partition primary 
ECHO shrink minimum=410
ECHO gpt attributes=0x0000000000000000
ECHO format quick fs=ntfs label="Local Disk"
ECHO assign letter=W
ECHO create partition primary size=410
ECHO set id=DE94BBA4-06D1-4D40-A16A-BFD50179D6AC
ECHO gpt attributes=0x8000000000000001
ECHO format quick fs=ntfs label="Windows RE tools"
ECHO assign letter=T
ECHO rescan
ECHO exit
) | diskpart


:: We must implement a delay of 15 sec after diskpart
CALL :Delay 15

:: == Set high-performance power scheme to speed deployment ==
CALL powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

:: == Apply the image to the "Primary" partition (Windows OS) ==
ECHO [TS] Starting deployment: Primary partition...
dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Primary.wim" /Index:1 /ApplyDir:W:\

:: == Copy boot files to the System partition ==
:: W:\Windows\System32\bcdboot W:\Windows /s S:
:: or apply the captured System partition
ECHO [TS] Starting deployment: System partition...
dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_System.wim" /Index:1 /ApplyDir:S:\

:: == Copy the Windows RE image to the
::    Windows RE Tools partition ==
:: md R:\Recovery\WindowsRE
:: xcopy /h W:\Windows\System32\Recovery\Winre.wim R:\Recovery\WindowsRE\
:: or apply the captured Recovery partition
ECHO [TS] Starting deployment: Recovery partition...
dism /Apply-Image /ImageFile:"%IMG_DIR%\%IMG_FILE%_Recovery.wim" /Index:1 /ApplyDir:T:\

:: == Make the BCD to point to the correct Disk after diskpart clean
bcdedit /set {default} device partition=W:
bcdedit /set {default} osdevice partition=W:
bcdedit /set {bootmgr} device partition=W:

:: == Register the location of the recovery tools ==
W:\Windows\System32\Reagentc /Setreimage /Path R:\Recovery\WindowsRE /Target W:\Windows

:: == Verify the configuration status of the images. ==
W:\Windows\System32\Reagentc /Info /Target W:\Windows

:END
ECHO [TS] Restarting in...
:: timeout /t 15
CALL :Delay 15
Wpeutil Reboot
EXIT /B %ERRORLEVEL%
:: ===== The Script ends here ===//

:::::::::: LIBRARY FUNCTIONS :::::::::::::::::::

::: Delay <IN_SECS> :::::::::::::::::::::::::::::::\\
:Delay
IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER
timeout /t %~1
EXIT /B 0
:STARTCMDTIMER
SETLOCAL EnableDelayedExpansion
SET /A delay=%~1-1
FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a"
FOR /L %%i IN (%delay%,-1,0) DO (
SET /p "= Delay          !Newline!" <NUL
SET /p "= Delay %%is!Newline!" <NUL
ping -n 1 -w 1000 192.168.255.0 > NUL
)
ECHO:
SETLOCAL DisableDelayedExpansion
EXIT /B 0
::: Delay <IN_SECS> ::::::::::::::::::::::::::::::://

::: IsWinPE <> :::::::::::::::::::::::::::::::::::\\
:IsWinPE
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT\ > NULL 2>&1
IF %ERRORLEVEL% NEQ 0 (
EXIT /B 0
)
ECHO:
EXIT /B 1
::: IsWinPE <> ::::::::::::::::::::::::::::::::::://

Warning !
The former script uses diskpart which could potentially wipe a disk without requiring any confirmation. The script prevents being run in other than Windows PE environments but you still must be extremely cautious if you decide to edit/debug etc.

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_SurfaceProX.cmd

5.2 Full Flash Update (FFU) Capture & Deploy

DISM in Windows 10 version 1709 and up supports the Full Flash Update (.FFU) format. Unlike the file-based WIM format, FFU is a sector-based file container that stores a whole disk. When using FFU images files you can capture and deploy a single file image of a physical drive, including Windows, Recovery, and System partition information all at once.
This method allows:
1) Deploy an image to different size of hard drive but always larger or equal than the drive it is captured from. All partition sizes will be kept unaltered.
2) Reliable deployments; a hash table is generated during capture, and validated when applying the image.
3) Modify the captured images with Dism.exe
4) Fast process (really fast); ideal for capturing and deploying Windows on a factory floor.
5) It creates larger images (about +25%)

5.2.1 Capture Task Sequence (FFU)
Let's write a Capture Task Sequence in a command file i.e.:

Capture_ffu_SurfaceProX.cmd

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Capture
ECHO [TS] Capture_ffu_SurfaceProX.cmd - v1.0 - Demo purposes 
ECHO [TS] NOTE: ServaPENet login with R/W rights on WIA_WDS_SHARE required!
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END

:: ===== The Script begins here ===\\

:: -- Task Sequence Variables --\
:: DISKPART TARGET DISK 
SET TARGET_DISK=0


:: SET THE NAME OF THE IMAGE BEING CAPTURED HERE
SET IMG_FILE=Windows10_SPX.ffu
SET IMG_NAME="Windows_10_ARM64_ffu" 
:: -- Task Sequence Variables --/

:: :: ::
:: Environment variables defined by ServaPENet
:: Variable:  Local Content:     Pointing to Serva Repository:
:: DEV_NAME   P:                 WIA_WDS_SHARE\<Head_Directory>		
:: TS_DIR     P:\TaskSequences   WIA_WDS_SHARE\<Head_Directory>\TaskSequences
:: IMG_DIR    P:\Images          WIA_WDS_SHARE\<Head_Directory>\Images
:: LOG_DIR    P:\Logs            WIA_WDS_SHARE\<Head_Directory>\Logs
:: :: ::

:: == Check Serva repository R/W access ==
CALL :ReadOnlyDir %IMG_DIR%
IF %ERRORLEVEL% NEQ 0 (
ECHO [TS] ERROR: User does not have Writing Rights in Serva's repository.
PAUSE
GOTO END
)

:: == Capture Disk image ==
IF NOT EXIST %IMG_DIR%\%IMG_FILE% GOTO STARTCAPTURE
ECHO [TS] Warning: File %IMG_FILE% exists
SET /P OVERWRT="Overwrite (y/n):"
IF "%OVERWRT%" NEQ "y" GOTO END

:STARTCAPTURE
ECHO [TS] Starting capture: Hard Disk %TARGET_DISK% ...
dism /capture-ffu /imagefile=%IMG_DIR%\%IMG_FILE% /capturedrive=\\.\PhysicalDrive%TARGET_DISK% /name:disk%TARGET_DISK% /description:"%IMG_NAME%



:END
ECHO [TS] Shuting down in
CALL :Delay 5
Wpeutil Shutdown
EXIT /B %ERRORLEVEL%
:: ===== The Script ends here ===//


::: ReadOnlyDir <IN_DIR> ::::::::::::::::::::::::::::::::::::::::::::\\
:: It returns %ERRORLEVEL% == 0 if IN_DIR is R/O 
:ReadOnlyDir
2>nul rename %~1 %~nx1
EXIT /B %ERRORLEVEL%
::: ReadOnlyDir <IN_DIR> :::::::::::::::::::::::::::::::::::::::::::://

::: Delay <IN_SECS> :::::::::::::::::::::::::::::::::::::::::::::::::\\
:Delay
IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER
timeout /t %~1
EXIT /B 0
:STARTCMDTIMER
SETLOCAL EnableDelayedExpansion
SET /A delay=%~1-1
FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a"
FOR /L %%i IN (%delay%,-1,0) DO (
SET /p "= Delay          !Newline!" <NUL
SET /p "= Delay %%is!Newline!" <NUL
ping -n 1 -w 1000 192.168.255.0 > NUL
)
ECHO:
SETLOCAL DisableDelayedExpansion
EXIT /B 0
::: Delay <IN_SECS> ::::::::::::::::::::::::::::::::::::::::::::::::://

Let's copy the task sequence script file to:
C:\SERVA_REPO\WIA\WDS\WinPE_ARM64\TaskSequeces\Capture_ffu_SurfaceProX.cmd

5.2.2 Deploy Task Sequence (FFU)
Let's write a Deploy Task Sequence in a command file i.e.:

Deployment_ffu_SurfaceProX.cmd

@ECHO OFF
ECHO [TS] Serva Pro Task Sequence: Image Deployment
ECHO [TS] Deployment_ffu_SurfaceProX.cmd - v1.0 - Demo purposes 
SET /P CONT="[TS] Would you like to continue (y/n):"
IF "%CONT%" NEQ "y" GOTO END

:: ===== The Script begins here ===\\

:: -- Task Sequence Variables --\
:: SET THE NAME OF THE IMAGES TO DEPLOY HERE
SET IMG_FILE=Windows10_SPX.ffu

:: DISKPART TARGET DISK 
SET TARGET_DISK=0

:: -- Task Sequence Variables --/

:: :: ::
:: Environment variables defined by ServaPENet
:: Variable:  Local Content:     Pointing to Serva Repository:
:: DEV_NAME   P:                 WIA_WDS_SHARE\<Head_Directory>		
:: TS_DIR     P:\TaskSequences   WIA_WDS_SHARE\<Head_Directory>\TaskSequences
:: IMG_DIR    P:\Images          WIA_WDS_SHARE\<Head_Directory>\Images
:: LOG_DIR    P:\Logs            WIA_WDS_SHARE\<Head_Directory>\Logs
:: :: ::

:: == Script protection ==
:: We protect Task Sequences that call "diskpart" from accidentally being run on not Windows PE systems
CALL :IsWinPE
IF %ERRORLEVEL% EQU 0 (
ECHO [TS] ERROR: This Task Sequence must be run under Windows PE.
PAUSE
GOTO END
)


:: == Set high-performance power scheme to speed deployment ==
CALL powercfg /s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c


:: == Apply the image to the Hard Disk ==
ECHO [TS] Starting deployment: Hard Disk %TARGET_DISK%
dism /apply-ffu /ImageFile=%IMG_DIR%\%IMG_FILE% /ApplyDrive:\\.\PhysicalDrive%TARGET_DISK%



:END
ECHO [TS] Restarting in...
:: timeout /t 15
CALL :Delay 15
Wpeutil Reboot
EXIT /B %ERRORLEVEL%
:: ===== The Script ends here ===//

:::::::::: LIBRARY FUNCTIONS :::::::::::::::::::

::: Delay <IN_SECS> :::::::::::::::::::::::::::::::\\
:Delay
IF NOT EXIST %SYSTEM32%\timeout.exe GOTO STARTCMDTIMER
timeout /t %~1
EXIT /B 0
:STARTCMDTIMER
SETLOCAL EnableDelayedExpansion
SET /A delay=%~1-1
FOR /f %%a in ('copy /Z "%~f0" nul') do set "Newline=%%a"
FOR /L %%i IN (%delay%,-1,0) DO (
SET /p "= Delay          !Newline!" <NUL
SET /p "= Delay %%is!Newline!" <NUL
ping -n 1 -w 1000 192.168.255.0 > NUL
)
ECHO:
SETLOCAL DisableDelayedExpansion
EXIT /B 0
::: Delay <IN_SECS> ::::::::::::::::::::::::::::::://

::: IsWinPE <> :::::::::::::::::::::::::::::::::::\\
:IsWinPE
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MiniNT\ > NULL 2>&1
IF %ERRORLEVEL% NEQ 0 (
EXIT /B 0
)
ECHO:
EXIT /B 1
::: IsWinPE <> ::::::::::::::::::::::::::::::::::://

5.3 Netboot a client

To start a Network Boot on a Surface Pro X while keeping pressed the VOLUME-LOW button pulse the POWER button and only release the VOLUME-LOW button when the Network Boot sequence displays its first lines on the screen.

5.3.1 Image Capture:
Netboot a Reference PC (which must be previously sysprep'ed), start our "Capture & Deploy" asset from Serva's menu, and run the Capture_SurfaceProX.cmd task sequence.

Note
If you plan to deploy only targeting the reference PC you can skip Sysprep.

5.3.2 Image Deploy:
Netboot the target PC, start our "Capture & Deploy" asset from Serva's menu, and run one of the deployment task sequences i.e. Deployment_SurfaceProX.cmd task sequence.

Fig 1: ServaPENet login to Serva's WIA repository

Fig 2: ServaPENet Task Sequence Manager

Notes
In case you want to temporarily stop offering one of the task sequences but you do not really want to erase it from the repository, you can just prepend its file name with off_ . ServaPENet Task Sequence Engine will "ignore" task sequences when their name begin with "off_" i.e. off_Deployment_SurfaceProX.cmd. If you want it back on just remove "off_" from its file name name. If the Task Sequence that you are planing to run needs to "write" to Serva's repository (i.e. a captured WIM image file, redirected Log files, etc.) then the user/password used to login on ServaPENet must correspond to a Serva PC user having R/W permissions on WIA_WDS_SHARE; using an user with Read Only permissions in this case will trigger an error when the task sequence runs.

Notes

In case you want to temporarily stop offering one of the task sequences but you do not really want to erase it from the repository, you can just prepend its file name with off_ . ServaPENet Task Sequence Engine will "ignore" task sequences when their name begin with "off_" i.e. off_Deployment_SurfaceProX.cmd. If you want it back on just remove "off_" from its file name name.
If the Task Sequence that you are planing to run needs to "write" to Serva's repository (i.e. a captured WIM image file, redirected Log files, etc.) then the user/password used to login on ServaPENet must correspond to a Serva PC user having R/W permissions on WIA_WDS_SHARE; using an user with Read Only permissions in this case will trigger an error when the task sequence runs.

5.4 Comparing The different Capture & Deploy methods.

Area	Windows image (.WIM)	Virtual Hard Disk (.VHD/VHDX)	Full Flash Update (.FFU)
Common uses	Fastest for testing and modifying Windows images. Can store multiple image variations in the same .WIM file, often with little additional storage required.	Easiest for deploying Windows to virtual PCs. You can boot a new device directly from a single VHD/VHDX file.	Fastest for capturing and deploying Windows on a factory floor.
Imaging style	File-based	Sector-based	Sector-based
Compression	Supports multiple types of compression	None	Xpress-Huffman is used by default when an FFU is captured with DISM
What does it capture?	A set of files, up to an entire partition.	Captures the full set of drive information, including partitions.	Captures the full set of drive information, including partitions.
When I apply the image, what happens?	Adds the files and folders to the partition. If there are existing files and folders with the same names, they're replaced. Otherwise, the existing files are kept.	Cleans the entire drive.	Cleans the entire drive.
Can I deploy to different sizes of hard drives?	Yes.	Yes, though the new drive must be the same size or larger than the original.	Yes, though the new drive must be the same size or larger than the original.
Can I modify the images?	Yes. With tools like DISM, you can mount, modify, and unmount the image.	Yes, you can mount a VHD/VHDX as if it were removable media, and modify the files.	Yes. With tools like DISM, you can mount, modify, and unmount the image.
Reliability			Includes a catalog and hash table to validate a signature upfront before flashing onto a device. The hash table is generated during capture, and validated when applying the image.

WIM vs. VHD vs. FFU: comparing image file formats (source: Microsoft)

In this Application Note we have implemented the Windows Image (.wim) and the Full Flash Update (.ffu) methods.

When capturing and deploying an empty Surface Pro X SQ1 8GB RAM 128GB SSD the results were:

Windows Image (.wim)
Windows10_SPX_Primary.wim 12GB
Windows10_SPX_Recovery.wim 326MB
Windows10_SPX_System.wim 11MB
Slowest overall process (capture & deploy)

Full Flash Update (.ffu)
Windows10_SPX.ffu 15GB
Fastest overall process (capture & deploy)
The required scripts are very simple

5.5 Additional Reading:
Capture and Deployment tasks are strongly dependent on Dism.exe. A clear understanding of this Microsoft tool is a must if we really want to excel at this topic.

Dism Overview

DISM Unattended Servicing Command-Line Options

Learn How to Sysprep Capture Windows 10 Image using DISM

6 Automation

6.1 Automating repository login in ServaPENet can done i.e. by creating

C:\SERVA_REPO\WIA_WDS\WinPE_ARM64\$OEM$\$Boot$\$1\Unattend.ini

as explained in PXE/BINL - AN02: Windows Network Install (Adv) & WinPE Boot

6.2 Automating ServaPENet Task Sequence selection can be done by editing ServaAsset.inf and defining the EndProcess variable as the path to the task sequence to be automatically run i.e.

ServaAsset.inf

[PXESERVA_MENU_ENTRY]
asset = Capture & Deploy 

[SERVAPENET]
EndProcess = P:\TaskSequences\Deployment_ffu_SurfaceProX.cmd

In this case after login the Task Sequence Menu is not displayed and the indicated task sequence will start running immediately. This is very useful when you have to deploy a big number of identical PCs.

7 Advanced

So far we have learned how to Capture & Deploy a Surface Pro X image by net booting with Serva a Windows PE executive. Serva sorts things in a way that when the Windows PE boots up will automatically:

Launch ServaPENet
1. Activate network services
2. Connect to Serva repository
3. Map the booted asset's Head Directory to the Windows PE drive P:
4. Run the Task Sequence Manager as the End Process
The user then can select and run one of the available task sequences.

All of the above can be done by just adding the following stanza to the [SERVAPENET] section of the corresponding ServaAsset.inf

[SERVAPENET]
EndProcess = *TaskSeqSelector

But we can also do more things:

7.1 An application might need a different letter than P: pointing to the asset's Head Directory i.e.

[SERVAPENET]
DeviceName = G:

7.2 Running a local executable i.e.

[SERVAPENET]
EndProcess = X:\Windows\System32\Notepad.exe
EndProcessParams = X:\Serva.txt

Note
On the net booted Windows PE X: points to the root of the booted Windows PE Environment.

7.3 Running a remote executable i.e.

[SERVAPENET]
EndProcess = P:\Bin\xxxx.exe
EndProcessParams = -x -y -z

Note
On the net booted Windows PE P: (by default) points to the net booted asset Head Directory on Serva's repository.

7.2 and 7.3 can be used for net booting non-PXE friendly Windows PE based tools even if they use external components.

7.4 Preventing ServaPENet login errors 0x4CF, 0x35, etc. These errors are sometimes related to network drivers not signaling that they are not ready to use when Serva attempts the repository login. ServaPENet 4.0.0 implements a small default delay before login but some drivers might need a longer value. defaults:

[SERVAPENET]
#default values in mS
BIOS_LoginDelay = 800
UEFI_LoginDelay = 1200
BIOS_UnattendLoginDelay = 2200
UEFI_UnattendLoginDelay = 4200

8 Instaling Windows 10 Enterprise ARM from ISO

Serva can also install ARM ISOs from MSDN like i.e.

en_windows_10_iot_enterprise_version_20h2_updated_nov_2020_arm64_dvd_39b08b3b.iso

we proceed as usual with an ISO install as explained in:
PXE/BINL - AN01.1: Windows Network Install - WDS OSs

This particular ISO requieres the Serva injection of both network and disk drivers for a full overwrite mode install on Surface Pro X and network driver injection for the upgrade mode install.
For installation on different ARM hardware the requierements will vary.

9 Troubleshooting

8.1 Troubleshooting Capture task sequence errors (Image_Capture.cmd).

8.1.1 [TS] ERROR: User does not have Writing Rights in Serva's repository.
Capture task sequences are meant to save the captured image file/s at Serva's repository, for that reason when we login with ServaPENet we must use an user with Writing Rights on WIA_WDS_SHARE.

8.1.2 [TS] ERROR: Couldn't find OS Volume labeled "Local Disk"
Our capture task sequence example (Capture_SurfaceProX.cmd) expects to find the Windows volume being captured labeled as "Local Disk"; this is the default for a Surface Pro X. If your Windows partition being captured is labeled differently in your reference PC (i.e. "XXX YYY") please edit the task sequence variable WINVOLUMELABEL accordingly:

:: -- Task Sequence Variables --\
:: SET THE LABEL OF THE WINDOWS PARTITION BEING CAPTURED HERE
SET WINVOLUMELABEL="Local Disk""

:: -- Task Sequence Variables --\
:: SET THE LABEL OF THE WINDOWS PARTITION BEING CAPTURED HERE
SET WINVOLUMELABEL="XXX YYY"

In order to know the Label of the OS volume on a target PC we can just open a console as soon as the client is booted and ServaPENet is active then type:

X:> diskpart
DISKPART> set disk 0
DISKPART> list volume

   Volume ###  Ltr Label        Fs     Type        Size     Status   Info
   ----------  --- -----------  -----  ----------  -------  -------- -------
   Volume 0     C  Local Disk   NTFS   Partition    118 GB  Healthy  
   Volume 1        Windows RE   NTFS   Partition    410 MB  Healthy  
   Volume 2        SYSTEM       FAT32  Partition    260 MB  Healthy  Hidden 

DISKPART> exit
X:>

In this example (MS Surface Pro X 128GB) the volume containing the OS is labeled "Local Disk".

8.2 Troubleshooting Deployment task sequence errors (Image_Deployment.cmd).

8.2.1 [TS] ECHO ERROR: This Task Sequence must be run under Windows PE.
The Deployment task sequence uses diskpart which could potentially wipe a disk without requiring any confirmation. The script prevents being run in other than Windows PE environments.

8.2.2 Target PC does not properly boot after a deployment without errors

Please verify that the captured image correspond to a bootable Windows partition, you can do that by i.e. opening the image WIM file with 7-zip and see the image content.
If the image was captured using our Image_Capture.cmd remember this task sequence expects to find the Windows partition being captured labeled as "Windows"; If your Windows partition being captured is labeled differently please read 8.1.2
The deployment task sequence Image_Deployment.cmd by default sets the target hard disk in GPT mode, if later the target PC is booted in Legacy mode it won't be able to boot. In this case booting the target in UEFI mode solves the problem.

10 Final words

The discussed Serva PXE/BINL advanced techniques represent one more step in the road to master the different Microsoft Windows network boot/install/capture/deploy scenarios. Users can now easily perform Capture and Deployment of Windows ARM OS images.

If you are a Serva Community user and you find it useful please consider purchasing Serva Pro. Non-personal or commercial use of Serva always requires a Serva Pro license (see Serva's download page for further details).

Serva bugs, comments, or ideas on how to improve the information contained in this document please contact us here.

Updated	02/20/2021
Originally published	02/18/2021