How to install Windows Server 2012 R2 and not get 200 updates after

Windows Server 2012 R2 was released on October 18, 2013. Since then, several hundred updates have been released to this Microsoft server operating system to correct vulnerabilities and product defects, as well as improve functionality.

A huge number of updates - the source of a headache . The most current distribution of the server, the so-called “Update2”, in which updates are integrated through November 2014, is hopelessly outdated. Having installed an operating system from it, you will get 200 + more updates, which will be installed 2-4 hours.

In this short instruction we will refresh the November distribution by integrating all cumulative update packages and security updates into it.
')
In addition to the distribution, we will refresh the memory of the administrator, remembering how the installation media is updated, why every step is performed, and what tricks we can expect at different stages.

We will do the maximum simple using standard tools.

All work is best done on a server with already deployed Windows Server 2012 R2, so that there are no overlays with the DISM version of the utility. It is also convenient to connect ISO files on it without unpacking them.

Preparing working directories

For the work will require the following directories:

ISO - distributive files are copied to this directory. To copy the contents of the SW_DVD9_Windows_Svr_Std_and_DataCtr_2012_R2_64Bit_English_-4_MLF_X19-82891.ISO distribution kit into it, after having first mounted the image and then unmounted.


MOUNT is an empty directory; images from a wim file will be mounted into it.
CU - put cumulative updates in this directory
SU - this directory will contain security updates and other updates.

mkdir D:\WS2012R2\ISO mkdir D:\WS2012R2\MOUNT mkdir D:\WS2012R2\CU mkdir D:\WS2012R2\SU 

Download cumulative updates

Tip & Trick # 1. Microsoft releases cumulative update packages for Windows Server 2012 R2, but they only include updates that fix bugs and improve functionality. Security updates are not included. At the same time, the updates are not particularly cumulative. Some do not include previous updates, and you need to put a "cumulative" for each month. Mess. In October, this situation will change for the better.

A list of cumulative updates can be found on this wiki page .

From November 2014, we will need to integrate the following updates:

1. December 2014 Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB3013769, download .

2. July 2016 Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB3172614, download .

The packages for May and June are absorbed by this July package. But before installing the update is required April 2015 servicing stack update for Windows 8.1 and Windows Server 2012 R2 . KB3021910, download .

3. August 2016 Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB3179574, download .



UPD: I have somewhat exaggerated how well Microsoft has prepared a distribution kit. Updates of April 2014 and November 2014 are truly integrated. And all the intermediate - no. Therefore we add
May 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2955164 download
June 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2962409, download .
July 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2967917 download .
August 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2975719, download .
September 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2984006, download .
October 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2. KB2995388, download .

Tip & Trick # 2. In various articles for the integration of updates, it is proposed to extract the cab file from the msu. It is not necessary to do this for the offline image - integrate msu without unpacking.

In the CU folder place the above mentioned msu files - Windows8.1-KB3013769-x64.msu, Windows8.1-KB3021910-x64.msu, Windows8.1-KB3138615-x64.msu, Windows8.1-KB3172614-x64.msu, Windows8 .1-KB3179574-x64.msu.

Download security updates

In addition to cumulative updates, we integrate updates that the WSUS Offline Update utility is capable of downloading.
For this:

1. Download the program download.wsusoffline.net
2. Selecting updates for Windows Server 2012 R2
   
   
   
   
3. After downloading, open the wsusoffline \ client \ w63-x64 \ glb directory and * .cab files, copy them to the C: \ WS2012R2 \ SU directory

CAUTION: If KB2966828 or KB2966827 are in the list, delete them, otherwise after installation you will not be able to add the Net Framework 3.5 component ( details ).

Updates are ready, we will start integration.

Update integration

To integrate updates we need:

1. Mount the contents of one of the images in install.wim
   
   

    dism /mount-wim /wimfile:{  wim } /Index:{N} /mountdir:{   } 

   
   
2. Integrate offline installation every update
   
   

    dism /image:{   } /add-package /packagepath:{  *.msu  *.cab } 

   
   
3. Save changes
   
   

    dism /Unmount-WIM /MountDir:{   } /Commit 

   
   

This process is easily automated by the following batch file:

 for /l %%N in (1,1,4) do ( dism /mount-wim /wimfile:"D:\WS2012R2\ISO\sources\install.wim" /Index:%%N /mountdir:D:\WS2012R2\MOUNT for %%f in (D:\WS2012R2\CU\*.*) DO (dism /image:D:\WS2012R2\MOUNT /add-package /packagepath:%%f) for %%f in (D:\WS2012R2\SU\*.*) DO (dism /image:D:\WS2012R2\MOUNT /add-package /packagepath:%%f) dism /unmount-WIM /MountDir:D:\WS2012R2\MOUNT /Commit ) 

Tip: When launching the batch file, redirect the output to the log

 UpdateWIM.cmd >>log.txt 2>>&1 

As a result, we get the file D: \ WS2012R2 \ ISO \ sources \ install.wim of 6.15Gb in size. Can we reduce it? Yes, with the help of export you can get an optimized file of 5.85Gb in size.

The savings are small, moreover, after this, the operating system selection dialog does not look very nice when installing, so the next step is optional.

Build the ISO file

To build, we need the oscdimg.exe utility from the Windows ADK . If you do not have it, you can simply download the utility by reference (do not use anything from this kit except the utility itself).

Tip & Trick # 3. In order to avoid problems with booting from the image, you should arrange the boot files within the first 4 gigabytes of the image . To do this, use the file bootorder.txt

boot \ bcd
boot \ boot.sdi
boot \ bootfix.bin
boot \ bootsect.exe
boot \ etfsboot.com
boot \ memtest.exe
boot \ en-us \ bootsect.exe.mui
boot \ fonts \ chs_boot.ttf
boot \ fonts \ cht_boot.ttf
boot \ fonts \ jpn_boot.ttf
boot \ fonts \ kor_boot.ttf
boot \ fonts \ wgl4_boot.ttf
sources \ boot.wim

The paths in this file are relative to the root directory with the image, so it is not necessary to adjust the paths to your actual ones.

Tip & Trick # 4. If install.wim is larger than 4700Mb, the installer will crash with the error "Windows cannot open the required file D: \ sources \ install.wim. Error code: 0x8007000D.

We were taught that life is a fight, so we divide the original install.wim into two with the command

 dism /split-Image /imagefile:D:\WS2012R2\ISO\sources\install.wim /swmfile:D:\WS2012R2\ISO\sources\install.swm /filesize:4096 

The original install.wim file can be deleted.

Tip & Trick # 5. In general, Microsoft says that you can not drink so.

In Windows 8.1 and Windows 8, Windows Setup does not support installing a split .wim file.

We say we will! The installer perfectly picks up the swm file. Installation problems will not be.

Putting the image team:

oscdimg -m -n -yoD: \ WS2012R2 \ bootorder.txt -bD: \ WS2012R2 \ ISO \ BOOT \ etfsboot.com -lIR5_SSS_X64FREV_EN-US_DV9 D: \ WS2012R2 \ ISO en_windows_server_2012R2_August_2016.o

Dear ildarz suggests that to create an image that works equally well with BIOS and EFI, you should follow KB947024 and create an image like this:

 oscdimg -m -u2 -udfver102 -yoD:\WS2012R2\bootorder.txt -bootdata:2#p0,e,bD:\WS2012R2\ISO\BOOT\Etfsboot.com#pEF,e,bD:\WS2012R2\ISO\EFI\microsoft\BOOT\efisys.bin -lIR5_SSS_X64FREV_EN-US_DV9 D:\WS2012R2\ISO en_windows_server_2012R2_August_2016.iso 

Performance tested in ESXi with any type of boot (BIOS / EFI).

Everything worked out? Congratulations!



But is the problem solved completely? For the ideal, it is necessary to integrate another hundred of “optional” and “recommended” updates, but let's not rush into this. Let's give Microsoft a chance to sort out the mess they made with the updates themselves.

Ps. Why did we all do this? In order to refresh the memory, make the work a little more convenient and get some simple batch files with which you can later almost automatically integrate the updates into the server distribution, saving time for the server to be up and running. Moreover, there is hope that starting from October, it will become much easier to integrate updates.

Similarly, you can integrate Windows 7 convenience rollup and avoid stepping on the unpacking of updates, the inability to boot from the image, or the size of install.wim.

Thank you for your attention and see you soon, friends.

If you have the opportunity to share experiences - waiting for you in the comments.