I don’t know if a 2008 R2 CA is technically supported for use with 2007 SCCM certificates, but for those of you who are doing this, be aware that how you set up your CA on it’s initial install will determine if your client certificates work properly or not.  There are workarounds, of course, for those few of you who are already running 2008 R2 CAs from a default installation - in the Site Mode tab of the Site properties, you can change the “If multiple certificates match criteria:” from “Fail selection and send error message” to “Select any certificate that matches”, and set “Certificate criteria:” to “Check only certificate purpose”.  Doing this allows the MP communications to start up again, although I’m not sure of the potential risks (if any) that are taken if you allow this.

Adding the application(s)

To create an application bundle that will show up in the list of applications to install (or be available to configure via a task sequence), you first need to add all of the applications to MDT that will make up the bundle.  This is done similar to adding Office 2007 as I documented in my post on creating an MDT deployment point – you must create a New Application and add it’s source files to the deployment share.  I’ll document quickly how to add the Windows Live Essentials components to your deployment share and “bundle” them (instructions on getting the .msi packages you’ll need from the Windows Live Essentials downloadable package can be found here, if you do actually want to try this).

First, right-click on the Applications folder in the deployment share (in this example I’ve created a folder underneath applications to hold all of the Windows Live installation apps – this is purely for cosmetic reasons) and select “New Application” from the drop-down list:

Select “Application with source files” from the first wizard page, click “Next”, and then fill out the information about the application and click “Next” again – in this example, I’m adding the x86 package for the Application Error Reporting component of Windows Live:

Point the wizard to the local path that contains the setup package, and click “Next”:

You will need to provide the actual installation command used to run the setup – in this case, the command is “msiexec /i dw20shared.msi /qn”, so I’ve entered that into the “Command line” field:

Once that’s done, click “Next” a few times and the application will be added to your Applications in your deployment share.  Next, right-click the new Application and select “Properties” from the drop-down list:

Make sure to *check* the box labeled “Hide this application in the Deployment Wizard” – this will keep the individual installers from showing up in the list of applications to be installed during deployment, ensuring only the bundle will be used to install the apps, in the correct order – click “OK” to save the changes:

Creating the bundle

Once you’ve added all the other components necessary (repeating the above steps for each application that will make up your bundle), the bundle itself needs to be created.  To do this, right-click on the Applications folder (or any subfolder, as in my example) in the deployment share, and select “New Application”:

This time, select the “Application bundle” option from the list of application types, and click “Next”:

Fill out the details of the application as you would any other application, and click “Next” a few times until the new bundle is added to your Applications list:

Next, right-click on the new Application bundle in the Applications list, and select “Properties” from the drop-down list:

Go to the “Dependencies” tab, and click the “Add” button:

In the “Select an item” window that pops up, select the application installers from the list, one at a time (clicking “OK” after selecting each to add to the list), until you’ve got all of the applications that will make up this “bundle” in your list, in the order you want or need.  Note that you can use the “Up” and “Down” buttons to move applications up and down the list in this window if you didn’t add them from the Applications list in the order required:

Lastly, right-click your deployment share and choose “Update Deployment Share” to update it, and also right click on your Media and select “Update Media Content” (again, as per previous posts on this subject).  Once these complete, you can copy the updated media to your USB key, or burn the .ISO.  The new “bundle” will show up in the applications list during deployment, and will install each application, in the order it is listed in the “Dependencies” tab during deployment if it’s selected to be installed.

If you’ve got lots of applications that you deploy to each and every build you do, this is a great way to cut down on the clicking in the deployment wizard – or makes for fewer entries in your task sequences for applications.

Adding the DaRT files

First, you will need to copy the files from the MS DaRT WinPE ISO image to your “Content” folder that was created when you used MDT 2010 as per my previous post.  The content folder should look something like this:

And the contents of the MS DaRT ISO image, once extracted to the hard disk, will look something like this:

You will need to go through this folder structure (boot, EFI, and sources) and copy to your “Content” folder anything from the MS DaRT contents that does not already exist as a file or folder in your “Content” folder.  For example, the MS DaRT media is on the left, and the “Content” media is on the right:
 

And the “Content” folder looks like this afterwards:

The same with the EFI and sources folders from the MS DaRT media:

And the “Content” folder looks like this afterwards:
 

Since most WinPE distributions use a “boot.wim” file in the “sources” folder, and we’re going to have multiples, you’ll want to rename any boot.wim files you copy here to something else, preferably something descriptive.  For example, I’ve renamed the boot.wim file from the x64 MS DaRT media I just copied over to “msdart64.wim” – this will be important later, when we create our boot entries:

I’ve repeated the above process for the x86 MS DaRT media as well, and renamed the boot.wim from that media to “msdart86.wim”:

Once you’re done with all of this, the last bit needed is to use bcdedit to add the new .wim files to your boot menu, and copy the updated “Content” folder to your USB key.

Using bcdedit to modify the boot menu

You’ll need to open a command prompt into the \boot folder of your “Content” media folder, and execute some bcdedit commands to modify the boot menu.  To make sure you’re in the right folder, the dir listing output should look something like this:

What you will need to do is use bcdedit to edit the “bcd” file you see here – that file actually contains the boot configuration data used during boot, and we’re going to modify it to add the new .wim files we just copied over.

First, let’s look at the current boot configuration stored in this file.  Run the command “bcdedit /store bcd /enum” to show the current boot manager configuration stored in the bcd file.  You’ll note that we already have 2 entries here – one labeled “Litetouch Boot [MEDIA001] (x86)” and another labeled “Litetouch Boot [MEDIA001] (x64)” – also make a quick note of the default GUID in the {default} entry at the end of the device and osdevice lines, because you’re going to need this later:

To create a new entry, you just need to create a copy of the {default} boot entry, and give it a name.  Use the command “bcdedit /store bcd /copy {default} /d “<name>” to create a new entry called “<name>”.  I’ve created a new entry called “Diagnostics and Recovery x64” by using the command “bcdedit /store bcd /copy {default} /d “Diagnostics and Recovery x64” – please note very carefully the GUID that the entry was copied to – you will need this to further modify the entry in the next steps:

The next thing you need to do is add the DEVICE that this boot entry is going to use – this is the .wim file that the entry is going to point to, and you do this via the “bcdedit /store bcd /set <GUID for the new entry> DEVICE ramdisk=[boot]\<path to .wim file>,<GUID of default entry>”.  I’ve edited the new entry to point to the msdart64.wim file via the command “bcdedit /store bcd /set {c77ebc03-8748-11de-8cb4-00137228d4cf} DEVICE ramdisk=[boot]\sources\msdart64.wim,{7619dcc8-fafe-11d9-b411-000476eba25f}” (remember I told you you’d need the GUID for the new entry, as well as the GUID from the default entry? – here is where you use them):”

You will next need to add the OSDEVICE that this boot entry is going to use.  This command is basically identical to the previous, except that “DEVICE” in the previous command is replaced with “OSDEVICE” – “bcdedit /store bcd /set <GUID for the new entry> OSDEVICE ramdisk=[boot]\<path to .wim file>,<GUID of default entry>”.  I’ve edited the new entry to point to the msdart64.wim file via the command “bcdedit /store bcd /set {c77ebc03-8748-11de-8cb4-00137228d4cf} DEVICE ramdisk=[boot]\sources\msdart64.wim,{7619dcc8-fafe-11d9-b411-000476eba25f}”:

If everything was successful, you should be able to run “bcdedit /store bcd /enum” and see your new entry at the end of the list:

If you want to add another (for example, I’m adding the x86 version of MS DaRT as well), just do the same steps over again for the new .wim file:

Once you’re done, you can replace what’s on your USB key with the new contents of the “Content” media folder.  If you want to create an ISO image (for burning to DVD, or testing in a VM), you can open the Deployment Tools command prompt from the Windows AIK start menu folder, and run oscdimg on the “Content” folder.  The command is “oscdimg –b”<path to etfsboot.com>” –h –u2 –m -l<Volume Name> “<path containing content to be copied to ISO>” “<path and name of resulting ISO image>” (note that –l in the command is a lower-case “L”, not an “I”).  I’ve created my image via the command “oscdimg –b”C:\Program Files\Windows AIK\Tools\PETools\amd64\boot\etfsboot.com” –h –u2 –m –lINSTALLER D:\Hybrid_Media\Content D:\Hybrid_Media\installer.iso”:

Seeing it in action

If you boot your new USB key (or ISO image), you should now see the new boot entries:

That’s it – and you could theoretically do this with any Windows PE-based .wim file.  I used MS DaRT for this example, but you could use something like BartPE or any other Windows PE image.

Here’s the list:

Windows Vista:

• Ultimate  -  VMCB9-FDRV6-6CDQM-RV23K-RP8F7
• Business  -  4D2XH-PRBMM-8Q22B-K8BM3-MRW4W
• Home Premium  -  X9HTF-MKJQQ-XK376-TJ7T4-76PKF
• Home Basic  -  RCG7P-TX42D-HM8FM-TCFCW-3V4VD
• Starter  -  X9PYV-YBQRV-9BXWV-TQDMK-QDWK4

Windows 7:

• Ultimate  -  D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV
• Professional  -  HYF8J-CVRMY-CM74G-RPHKF-PW487
• Home Premium  -  RHPQ2-RMFJH-74XYM-BH4JX-XM76F
• Home Basic  -  YGFVB-QTFXQ-3H233-PTWTJ-YRYRV
• Starter  -  7Q28W-FT9PC-CMMYT-WHMY2-89M6G

Note that these were easy to acquire, as they are stored in a file called product.ini in the \sources folder for Vista, Server 2008, Win7, and Server 2008 R2.  To verify, I installed Windows Vista and Windows 7 without a product key, and then ran a utility in the OS to display the current product key – I used GetKey written by GunSmokingMan on the MSFN forums, but anything that’ll run in Vista or Windows 7 will work.

However, after playing with the Microsoft Deployment Toolkit for a bit, I realized I could probably make my USB key bend to my will and be said multi-bootable Windows OS installer, without a whole lot of work.  I set about to put all of those versions of Windows one one key, along with some unattended applications (for this blog post, I’m just adding Office 2007 to keep it short).

You’re going to need a few things to start, most notably you’ll need a Windows machine that can install the latest Windows Automated Installation Kit (WAIK) for Windows 7 (that’d be Server 2003 SP1 or newer, Vista SP1 / Server 2008 or newer, or Win7 / Server 2008 R2 – sorry, no XP support, it seems).  You’ll also need the MDT 2010 bits and the version(s) of Windows and any applications you would like to install from MDT.

Adding Operating Systems

Once you’ve got a machine with the WAIK and MDT 2010 installed, the first thing to do is open the Deployment Workbench from the Microsoft Deployment Toolkit folder in your start menu.  Since you’ve already got the prerequisites needed to do a basic MDT deployment (namely, the WAIK), just right-click on the “Deployment Shares” folder and select “New Deployment Share” from the drop-down:

This will open a wizard that will help you create the Deployment folder and share – note that you will have to create this folder, as the current version (beta2) does not do this.  The wizard will look like the following:

Again, use the “Browse” button to create the folder as necessary, and make sure this is on a drive with ample space, as all of your OS files and applications will be stored here.

Once you’ve gotten yourself a deployment share, it will show up as a subfolder of the “Deployment Shares” tree, and the first thing you’ll want to do is add the version(s) of Windows you want to use MDT to install.  To do this, right-click on the “Operating Systems” subfolder in your deployment share, and select “Import Operating System”:

This will bring up the “Import Operating System” wizard.  For this example, I’m going to be using the full Windows installations as my source, and since I’ve copied the contents of the Windows DVDs / CDs to the hard disk on this machine already, I select “Full set of source files” and point the wizard to the folder that contains the Windows source that I’m using (in this example, I’ve extracted the Windows 7 RTM to a folder on the D: drive):

The wizard will go through copying the files from the source directory into the distribution share, and add each OS choice to the Operating Systems list in the Deployment Workbench – after adding Vista, Server 2008, Win7, and Server 2008 R2 via this method, my Operating Systems list looks like this:

Adding Applications (optional)

If you want to have your installation media install applications along with Windows, you’ll need to add them to the deployment share and the task sequence – in this example, I’m adding Office 2007.  To add an application, you’ll need to right-click the “Applications” subfolder in your deployment share, and select “New Application” from the drop-down:

Once the wizard comes up, you’ll have to enter the Application Name – the Publisher, Version, and Language are optional (but recommended):

Again, I’ve copied the contents of the Office 2007 DVD to the hard disk, so I’m going to point the wizard to this source, but if you have the files you need for the application you’re adding to the deployment share in another location (say, on a DVD or a network share), point the wizard to that source directory, and click “Next”:

This will place the Office 2007 entry into the “Applications” list in the deployment share, and you will need to edit the properties of the application before the application will install properly.  To do so, right-click the application from the Applications list and select “Properties”:

From here, you will need to click the “Details” tab and configure the installation command (the Working directory will already be configured) to run the application’s setup, including any switches required by the application.  You can also enable or disable the application from the deployment share, cause the application to reboot the computer it’s being installed onto once it has completed installation, as well as a host of other options that may be of interest to you.  You may also note that MDT recognizes that this is an Office application, and adds an “Office Products” tab where you can configure the unattended parameters of Office (if your version supports it – for example, Office 2007 Enterprise):

Once you’re comfortable with the application settings, click “OK” to complete adding the application.

Adding Drivers (optional)

If you want to inject drivers into your installation, you will need to use the “Out-of-Box Drivers” subfolder in your distribution share.  Note that there is a requirement here – you will need to have the driver package extracted that you want to use, and it must not be a driver package that requires an .exe to install.  For this portion of the deployment, you will have to direct the MDT wizard to the folder that contains the .inf, .sys, and any .cat files the driver requires, hence why .exe driver installers will not work.  You may be able to add these types of drivers as application packages, however, but that’s a bit outside my scope here.

For this example, I’m adding the drivers for a 3ware 9550SX controller that I’ve already extracted:

To add the driver to the deployment share, simply right-click on the “Out-of-Box Drivers” folder and select “Import Drivers” from the drop-down:

Point the wizard to the folder that contains the drivers you want to import, and click “Next” (in my example, I’m going to import both x64 and x86 drivers, so I’m running the wizard twice) – note that if you do import the x86 and x64 versions of the same driver, make certain that the “Import drivers even if they are duplicates of an existing driver” box is checked before clicking “Next”:

If you have imported both x64 and x86 versions of the same driver, make sure to right-click on each driver in the listing of Out-of-Box drivers and select the proper architecture – the wizard will add a number at the end of the driver’s name for each iteration of the same driver you import (in this case, (1) was added to the x86 driver I imported), and the wizard will tell you at the end what display name it gave to the driver added.  In this case, I’ll make sure that the “AMCC System 3wManage.inf” is configured to be used only for x64 platforms:

Make certain to do this for each x64 and x86 driver you add, if you do add multiple architecture versions of the same driver.

Creating the Task Sequence

To get MDT to actually *do* something with the operating system(s) you’ve imported, you’ll have to create what is called a “Task Sequence”.  In MDT parlance, this is the “logic” that drives MDT – it’ll tell MDT what drives to format, what version of Windows to install, and any applications, hot fixes/updates, and drivers you configure in MDT.  To create your first task sequence, right-click on the “Task Sequences” subfolder in your deployment share, and select “New Task Sequence” from the dropdown:

Once the wizard comes up, you’ll need to give the Task Sequence a unique ID number in the “Task sequence ID” box, as well as a name (this is the name that will show up in the list of operating systems to deploy, so consider using the name of the version of Windows the task sequence will install).  Enter any comments in the comment box, and click “Next”:

Choose the “Standard Client Task Sequence” from the drop-down list (or “Standard Server Task Sequence”, if this is a server OS), and click “Next”:

Select the version of Windows you want the Task Sequence to install from the list, and click “Next”:

At this point in the wizard, you can enter a product key (or not), set the registered Name and Organization, set the IE homepage, and configure the Administrator Password (or not).  Once you’ve done all this and finished the wizard, the task sequence will now show up in the Task Sequence list, but it’s not complete just yet if you want to edit the unattended file and change some of the advanced options (like the default time zone, in my example).  If you want to leave everything as-is, skip to the next section.  However, if you do want to edit the file, you’ll need to right-click the Task Sequence and select “Properties” from the drop-down:

Once the properties of the Task Sequence opens up, click on the “OS Info” tab, and click the “Edit Unattend.xml” button to open the unattended file in the Windows System Image Manager (WSIM) for editing:

Again, for this example, I want to edit the Time Zone.  To do this, once WSIM has the unattend.xml file open, expand the 4 specialize component and select “Microsoft-Windows-Shell-Setup_neutral” from the list (note that this says amd64 at the beginning because this is an x64 image – if you’re editing an x86 image, it will say x86 at the beginning).  From here, you can edit the default (Pacific Standard Time) with the full name of the Time Zone you want (I’ve entered “Eastern Standard Time”):

Once you’re done editing the unattend file, close the WSIM window and save the file when prompted.

Putting it all together

The last steps involve updating the deployment share with the changes made, and building the media we’re going to use to copy to the USB key.  First, you will need to update the deployment share, by right-clicking on the deployment share root folder, and selecting “Update Deployment Share” from the drop-down:

This will cause the deployment share to update, and you will see progress indicated in a wizard window that will look like the image below, and when it’s done, click the “Finish” button:

Next, you’ll need to actually create the media.  To do this, expand the “Advanced Configuration” folder in the deployment share, and right-click the “Media” folder and select “New Media” from the drop-down:

Once the wizard opens, you’ll need to point the Media path to a folder that will contain the exported media – note that you will have to create this folder as well, as the current version (beta2) does not do this.  Also note that it appears (from some comments and my own testing) that the media share path cannot contain spaces (again, this is beta2, so we’ll wait to see if this problem continues in the RCs), or the creation wizard will fail.  I’m currently investigating this to see why this is, although it does seem fairly repeatable.  Use underscores or dashes if you want to name it something that would otherwise contain a space.  The New Media Wizard will look like the following:

Again, use the “Browse” button to create the folder as necessary, and make sure this is also on a drive with ample space, as all of your OS files and applications will be stored here, as well as an .ISO file that can be burned to a DVD (if it’s small enough).  Once you’ve selected a folder, click “Next” to create the share.

Once the creation of the media share is complete, you’ll see it in the list of Media available to be created.  Right-click on the new media and select “Properties”:

Click the “Rules” tab, and add one field at the end, called “_SMSTSORGNAME” and set it equal to what you want the Unattended progress bar to call your deployment (you’ll see later what I mean by this) – I’ve named mine “cluberti’s imaging stick” for this example:

Next, click the “Edit Bootstrap.ini button, and add the same field with the same name.  Once you’re done, save the file, and then click OK:

Lastly, right-click the new media entry and select “Update Media Content” from the drop-down.  This will actually create the content folder and the .ISO in the media share, and it WILL take a long time the first time you do this, so be patient:

Once the wizard completes successfully and you click “Finish”, your media is now ready to be copied to your USB key – just put your USB key into the machine, and use Windows Explorer to copy the contents of the “Content” folder in the media share to your USB key:

Seeing it in action

I’m going to show you what this looks like from my deployment media in a Hyper-V VM, so you can see what the end-product will look like.  Note that basically ALL of this can be automated via entries into the “Rules” tab and Bootstrap.ini of the media share (or even the Deployment Share folder – the same settings can be seen in the properties of this folder) and entries into the Task Sequence (which I’m leaving for another post.

Without further ado, see the task sequence in action: