Created ISO with Windows 11 doesn't install Windows Updates

[macomar]

Our created ISO with Windows 11 22H2 build 22621 does not install windows cumulative update 07-2023 and aborts at 25%.

Even when testing with Windows build versions other than ntlite ISO, the installation of the updates fails.

My NTlite version is 2023.6.9292 from 14.06.2023 - is there an update coming soon ?

Or is the error known ? The NTlite ISO's with 21H2 were always installed without errors even with subsequent windows updates.

 

[garlin]

The wording on this question is unclear. You have a custom 22H2 image which fails to install July 2023, but so do untouched Windows images.
How are these updates being installed? From Windows Update, or from NTLite to download & install the CU?

This is the first report of an update problem with July 2023, which has been out for two weeks. Please attach your preset (after removing user passwords or license key).

 

[macomar]

The following scenario:

I downloaded an original Microsoft Windows 11 ISO Version 22H2 Build 22621.1702.

If I take this ISO and load it into Matrix42 to refuel a Dell laptop via PXE, all subsequent updates (cumulative update 07-2023) are installed via our in-house WSUS without errors.

If I edit the original Microsoft ISO with NTlite just like the 21H2 version, the update drops out at 25% each time on 3 different laptops.

I will create an NTlite ISO again and upload my preset - deleted them all.

 

[garlin]

I would suggest a basic functional test, by allowing one of the laptops to connect to MS servers, instead of WSUS. Does your problem follow having WSUS provide the updates? Normally the only difference would be a different list of available KB's.

NTLite has no features directed at WSUS, so any update problems would be related to Servicing Stack or networking changes.

 

[macomar]

I don't think it's related to our WSUS, since the non-NTlite edited ISO takes the updates from there and installs them as well.
It must have something to do with what is changed in or by NTlite in the ISO.

 

[macomar]

As discussed, here is the XML file of the compiled ISO

 

[garlin]

I've duplicated the problem on a 22621.1702 (22H2 v2) ISO. The preset builds and installs just fine.

But WU hangs at 25% installation of the July CU, and fails on Error 0x800f081f (CBS_E_SOURCE_MISSING). This means DISM thinks there's corruption of the base packages, like an improper removal?

Second problem is doing a reboot right after the first user logon gets you locked out of Windows with the "Other user" screen. That normally indicates an unfinished OOBE sequence where defaultuser0 didn't remove itself.

I used my own Unattended settings, so it's not a problem with your user accounts.

+nuhi

 

[macomar]

That's exactly my problem too. The installation runs without any problems but the July CU ends up with the error Error 0x800f081f – like yours.

Why is that now? Is this an error of NTlite when compiling the ISO?

 

[garlin]

That's a question for nuhi to investigate.

 

[macomar]

Thank you - will nuhi be active in the matter?
I have a business license from NTlite - can I submit a prioritized ticket?

 

[garlin]

This is a NTLite community forum. While he reads posts on most days, if you prefer a formal response then e-mail [email protected] to get this official attention. He prefers e-mail so issues can be tracked.

 

[nuhi]

Thanks for the report, on it.

 

[nuhi]

This preset doesn't have Servicing-Stack, and Windows Update compatibilities enabled, it's expected not to work.
If you want to auto-update the OS via Windows Update, make sure to enable Windows Update compatibility option (Components - toolbar - Compatibility - Windows Update).
And more importantly, even if you update via NTLite or manually, then no need for Windows Update, but you must enable Servicing Stack compatibility at least, as that disables the deep WinSxS cleanup, enabling the protections needed for updating to work.

Warning is also on the Apply page after loading this preset.


Let me know if all good after enabling that, or it fails with that enabled as well, it shouldn't.

While at the topic, it's recommended to keep OOBE compatibility enabled, it covers many critical components for Windows setup.

 

[macomar]

Hello Nuhi,

Thanks for the quick help. According to the hardening catalog that I have as a condition, I have to prevent the possibility of creating or login to Microsoft accounts. I can only disable this if I disable OOBE and Servicing Stack compatibility in the components.

Is there any other way I can prevent this?

 

[garlin]

Settings / System / Microsoft Account / Users can't add or log on with Microsoft accounts

Which is the same local policy as:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"NoConnectedUser"=dword:00000003

I believe Microsoft Account can't be removed from OOBE, because MS has mandatory code for AutoPilot deployment. You can remove OOBE on a live post-install system by running NTLite, but using a local policy makes the most sense.

It would be the same solution if you didn't have NTLite.

 

[nuhi]

Hello Nuhi,

Thanks for the quick help. According to the hardening catalog that I have as a condition, I have to prevent the possibility of creating or login to Microsoft accounts. I can only disable this if I disable OOBE and Servicing Stack compatibility in the components.

Is there any other way I can prevent this?

View attachment 10155

You can disable Microsoft Account addition in the Settings of the loaded image, it sets what garlin suggested, titled "Microsoft Account".

Also set "Local user account setup support" to enabled, and/or pre-create a local user.
And skip setting Online and Local users in the Unattended page, you should be all done.

The point is to first have a working OS, then it's easy to experiment and disable compatibilities and remove extra, but then that's unsupported.
It may be worth re-testing a component if you confirm a functionality working with it removed.

 

[macomar]

Hello Nuhi,
Many thanks for the quick help and the information about the incorrectly set options in the NTlite settings.
We created a new ISO, which could be updated without any problems.
Greetings MAC