Windows 7 refreshed media creation
The fastest way to patch a Windows 7/Server 2008 R2 machine is to take advantage of the Convenience Update Rollup from April 2016 (KB3125574). The Conv. UR updates a lot of components and to ensure that that happens without any servicing problems, it has as a prerequisite the Servicing Stack Update from April 2015 (KB3020369). To install most of the other patches in between April 2016 and October 2016 we will include the following updates:
KB3020369 (April 2015 Servicing Stack Update)
KB3125574 (April 2016 Convenience Update Rollup)
KB3177467 (September 2016 SSU)
KB3172605 (July 2016 Functional Update Rollup, 7C* package)
KB3179573 (August 2016 FUR, 8C* package)
KB2841134 (Internet Explorer 11, Optional)
KB3185330 (October 2016 Monthly Quality Rollup, 10B' package [contains September 2016 FUR, 9C* package])
*3rd Tuesday package of that month.
Download all the packages from the Microsoft Update Catalog (now updated to work on all browsers) to a folder:
http://www.catalog.update.microsoft.com/Search.aspx?q=3020369
http://www.catalog.update.microsoft.com/Search.aspx?q=3125574
http://www.catalog.update.microsoft.com/Search.aspx?q=3177467
http://www.catalog.update.microsoft.com/Search.aspx?q=3172605
http://www.catalog.update.microsoft.com/Search.aspx?q=3179573
http://www.catalog.update.microsoft.com/Search.aspx?q=2841134
http://www.catalog.update.microsoft.com/Search.aspx?q=3185330
Expand the .MSU files to extract the .CAB file which will be used with DISM:
https://msdnshared.blob.core.windows.net/media/2017/01/image15.png
Command used:
expand -f:*Windows*.cab C:\files\Window7MediaRefresh\.msu C:\files\Window7MediaRefresh\CABs (thank you abbodi1406)
Afterwards we should have the following:
https://msdnshared.blob.core.windows.net/media/2017/01/image23.png
For this guide we will use the install.wim file from a Windows 7 Enterprise x64 SP1 Media:
https://msdnshared.blob.core.windows.net/media/2017/01/image31.png
Mount the image as described in the offline servicing article below:
Add or Remove Packages Offline Using DISM
/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/hh824838(v=win.10)
Dism /Mount-Image /ImageFile:C:\test\images\install.wim /Name:"Windows 7 ENTERPRISE" /MountDir:C:\test\offline
And now we can start adding the first package, the KB3020369 SSU:
Dism /Image:C:\test\offline /Add-Package /PackagePath:C:\files\Window7MediaRefresh\CABs\Windows6.1-KB3020369-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image41.png
We can check the installation state using the command below:
Dism /Image:C:\test\offline /Get-Packages
It is in a "Install Pending" state:
Package Identity : Package_for_KB3020369~31bf3856ad364e35~amd64~~6.1.1.1
State : Install Pending
Release Type : Update
Install Time : 11/4/2016 9:11 AM
The next update to install is the Convenience Update Rollup KB3125574:
Dism /Image:C:\test\offline /Add-Package /PackagePath:C:\files\Window7MediaRefresh\CABs\Windows6.1-KB3125574-v4-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image51.png
Package Identity : Package_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4
State : Install Pending
Release Type : Update
Install Time : 11/4/2016 10:33 AM
We cannot continue to install updates offline, because of the DISM limitation below:
Limitations
When you are installing a package in an offline image, the package state is “install pending” because of pending online actions. In other words, the package will be installed when the image is booted and the online actions are processed. If subsequent actions are requested, they cannot be processed until the previous pending online action is completed. You can use the /PreventPending option when you add a package with /AddPackage to skip the installation of a package when there are pending online actions.
/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/hh825265(v%3dwin.10)#limitations
Commit the changes with the command below to seal the image:
Dism /Unmount-Image /MountDir:C:\test\offline /Commit
https://msdnshared.blob.core.windows.net/media/2017/01/image61.png
Now we need to install a Windows 7 VM/PC with this image to finish the outstanding servicing actions and install the other updates. Do this either by hand or using your favorite deployment tool.
After the image is installed we should see the following (SP1 + KB3020369 + KB3125574 only):
C:\Windows\system32>Dism /Online /Get-Packages
Deployment Image Servicing and Management tool
Version: 6.1.7600.16385
Image Version: 6.1.7601.23403
Packages listing:
Package Identity : Package_for_KB3020369~31bf3856ad364e35~amd64~~6.1.1.1
State : Installed
Release Type : Update
Install Time : 11/4/2016 12:29 AM
Package Identity : Package_for_KB3125574~31bf3856ad364e35~amd64~~6.1.4.4
State : Installed
Release Type : Update
Install Time : 11/4/2016 12:29 AM
Package Identity : Package_for_KB976902~31bf3856ad364e35~amd64~~6.1.1.17514
State : Installed
Release Type : Update
Install Time : 11/21/2010 3:01 AM
Continue to install updates 3-5 using the DISM commands below:
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3177467-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image71.png
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3172605-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image81.png
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3179573-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image91.png
Step 6, which is installing IE11, is optional, in case you have business critical applications that are dependent on an older Internet Explorer version. The security-only, monthly rollup, and preview rollup will not install or upgrade to these versions of Internet Explorer if they are not already present, so we will install IE11 next, before we apply the monthly rollup.
This will be the IE version installed, if we do not upgrade it:
https://msdnshared.blob.core.windows.net/media/2017/01/image101.png
The last update to install is KB3185330, at the moment of writing this guide, in the future just replace it with the latest monthly/preview rollup, found on the page below:
Windows 7 SP1 and Windows Server 2008 R2 SP1 update history
https://support.microsoft.com/en-us/help/22801/windows-7-and-windows-server-2008-r2-update-history
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3185330-x64.cab
https://msdnshared.blob.core.windows.net/media/2017/01/image111.png
Now we can search online for the remainder of the updates or just capture the image after generalizing it, if we want to finish as fast as possible.
Online search results after the above updates (34/39 optional updates are language packs):
https://msdnshared.blob.core.windows.net/media/2017/01/image121.png
TL;DR version:
Download the updates:
http://www.catalog.update.microsoft.com/Search.aspx?q=3020369
http://www.catalog.update.microsoft.com/Search.aspx?q=3125574
http://www.catalog.update.microsoft.com/Search.aspx?q=3177467
http://www.catalog.update.microsoft.com/Search.aspx?q=3172605
http://www.catalog.update.microsoft.com/Search.aspx?q=3179573
http://www.catalog.update.microsoft.com/Search.aspx?q=2841134
http://www.catalog.update.microsoft.com/Search.aspx?q=3185330
Extract CAB files from MSU:
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3020369-x64_5393066469758e619f21731fc31ff2d109595445.msu C:\files\Window7MediaRefresh\CABs
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu C:\files\Window7MediaRefresh\CABs
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3177467-x64_42467e48b4cfeb44112d819f50b0557d4f9bbb2f.msu C:\files\Window7MediaRefresh\CABs
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3172605-x64_2bb9bc55f347eee34b1454b50c436eb6fd9301fc.msu C:\files\Window7MediaRefresh\CABs
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3179573-x64_0ec541490b3f7b02e41f26cb2c444cbd9e13df4d.msu C:\files\Window7MediaRefresh\CABs
expand -f:* C:\files\Window7MediaRefresh\AMD64-all-windows6.1-kb3185330-x64_8738d0ef3718b8b05659454cff898e8c4f0433d7.msu C:\files\Window7MediaRefresh\CABs
Mount the image:
Dism /Mount-Image /ImageFile:C:\test\images\install.wim /Name:"Windows 7 ENTERPRISE" /MountDir:C:\test\offline
Install the first two updates offline:
Dism /Image:C:\test\offline /Add-Package /PackagePath:C:\files\Window7MediaRefresh\CABs\Windows6.1-KB3020369-x64.cab
Dism /Image:C:\test\offline /Add-Package /PackagePath:C:\files\Window7MediaRefresh\CABs\Windows6.1-KB3125574-v4-x64.cab
Unmount and commit the changes to the install.wim file:
Dism /Unmount-Image /MountDir:C:\test\offline /Commit
Install a reference machine with the above install.wim file and continue to install the updates:
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3177467-x64.cab
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3172605-x64.cab
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3179573-x64.cab
Dism /Online /Add-Package /PackagePath:C:\temp\Windows6.1-KB3185330-x64.cab
Search online to install the remainder of the updates.
Sysprep the newly patched machine and capture an updated wim file.
If you have any questions or feedback, please use the comment section.
Thank you and see you next time!
Andrei Stoica, Windows Deployment Engineer