How to Build a VMware vSphere VM Template for Windows Server 2008 R2

Just some questions/comments for you…

> 2. Now prepare the virtual hardware
>> VMware Tools Install
Why wouldn’t you take the opportunity to disable the floppy controller too?

> 3. OS Installation and Configuration
>> Set time synching between the VM and ESX host
If you have you domain time heirarchy set correctly, presumably, you shouldn’t be time synching from the esx host (this is assuming you will join all computers deployed from the template into a domain, though)
> IE ESC
>> From Security Information Section, select Configure IE ESC
You’ve lost me here. I know what IE ESC is (after googling it) but don’t know where to find the “Security Information Section” you are referring to.
> 4. Turn VM into a Template
>> At command prompt, type the following command:
I can’t see any command after this statement, unless it’s the command that appears to have slipped to the bottom of your post?
“C:\windows\system32\sysprep\sysprep.exe /generalize /unattend:unattend.xml”

A very handy post otherwise. I hope these comments/questions are useful.

Regards,

David.

@Greg
By the way, that performance issue wasn’t with your template specifically, but just templates in general. It runs fine, but then when I convert my 2008 template to a VM and clone from the template using my customisation script, it just doesn’t run well… 🙁

The “fatal error” is due to the quotes. The best bet is to copy it to something like notepad, and then do a find/replace on them all with a generic “.

If you look closely in Notepad, you will see that some of them look different, and I think it also mistakes a few for something else and replaces them with question marks.

Not sure if this will help or still come up with funny formatting:

Your Organization Name
Your Registered Owner
true

I can’t answer but we use a MAK and I have done activation both before and after and not noticed any difference. In fact, I found that I had to reactivate anyway because the customization script didn’t do it correctly.

Ok, some feedback:

1. After the last step of syspreping, the server went to restart back into the OS, at which point I switched it off & then converted it to a VM template.

2. I created a ‘template’ based on the customised specification wizard in vcentre.

3. Applied this to a Test-vm.

4. After the vm fired up, and sat at ‘installing devices’ for 5 minutes (and before the OS booted it showed the safe mode screen saying there were hardware changes).

5. The VM restarted again after ‘installing devices’.

6. Vmware image customisation in progress…
(Setup is preparing your computer for first use)

7. And now presented with the Setup Windows screen (where I can choose country/region).

After doing all this, I’ve noticed:

a. The Paging Volume is totally missing, not online according to Disk Manager.
(it says The disk is offline because of a policy set by the administrator)

b. The Administrator account was renamed, but it still shows Administrator? (reverted back to its original name)

c. The hostname of the template is not of the same value as specified in the Custom Specification Wizard, it looks like its defaulted to the standard windows/random number/letter format.

d. Server appears activated?

Cheers

@Greg

I’m finding the same thing.. local area connection 2, with ‘no internet access’ and the NIC comes up with a yellow exclamation mark, but the server is pingable, accessable, on the domain, etc?

Also, each time the VM is restarted, it shoes ‘vmware image is customisating’ message and then eventually boots into the OS. Strange.

Also..strange but true – the VM hasn’t asked me once to activate the product! It’s already showing as activated…

Used a MAK Key in the customization wizard… if this helps?

System Preparation Tool 3.14 — is this already included or must I go get it somewhere??

Thank you, Tom

Hello there !

I’ve a problem with a VM template and Windows Server 2008 R2.
As mentionned before, the machine created from this template is very slow, but also, the machine reboots at first creation, then shows a message error : Windows could not finish configuring the system. To attempt to resume configuration, restart the computer.

Restart doesn’t actually work, I have to start in safe mode, shut down the machine several times, and reboot.

PS : I can’t tell you what steps have been followed, because I’m not the admin, but this problem really annoys me !

What could it be ?

Thanks !

Explanation of the above comment: I created a nice VM with an unattended install…everything I wanted, properly joined to the domain etc….sysprep caused a complete new install, where I had to set up a new password etc. for a local Administrator account etc., which I did not want to have…I only wanted the one domain admin account on the VM…

Jason,

Thanks for the article. I am having a bit of a problem with the sysprep part. I saved the file from your link to my desktop and transfered it to a server available to the VM. When I run the command I get an error that says “Windows could not parse or process unattended answer file [unattend.xml]. The specified file does not exist. I copied the unattend.xml file to the same directory ay sysprep.exe and it is not hidden or read only. I am using 2008R2 Enterprise and changed the line to reflect that.

Any suggestions?

I just found that if I navigate to the sysprep directory and run the command sysprep.exe /generalize /unattend:unattend.xml from there it runs fine. Must be a 2008 R2 rights issue.

@Tom
Tom,
I have the same problem. I ran the sysprep and now after it rebooted I’m starting a new installtation again.

I’ve gone through this process a couple of times now and everything works perfectly, except that once sysprep has run and the machine reboots I find that I have to reinstall the VMTools as the video, mouse and networking gets screwed up.

I’m using vSphere 4.1 and Windows 2008 R2 Enterprise with all the latest patches.

I’ve also has an issue where the windows interface freezes when I click on computer / drive c.

This is a nice list of those “oh I forgot to do…” for 2K8R2. It should help keep from switching back and forth between vm and template to update. The one item I disagree with is the sysprep. I see lots of discussion about this on here and some confusion. I do not manually run sysprep. During deployment, the customizations are inserted into the OS via sysprep “automagically”. No need to create an unattend file. More info> http://vinf.net/2009/07/09/how-to-deploy-a-windows-2008-server-from-a-template-with-vsphere/

Oh, FYI – the Microsoft KB article for 2008 R2 (and Win7) for copying settings to the default user profile is http://support.microsoft.com/kb/973289

The one you reference above (959753) is for Windows 2003 and XP.

Very useful indeed. It would be kick-ass-cool if someone with good scripting skills could make a script of all these settings. THAT would be a tremendous time saver. Just install a base 2008 server and then *BANG* run the script and the server is ready…

Jason or anyone,

At the end of this how to, you say:

“System Preparation Tool 3.14
Choose Enter System OOBE
Check Generalize button
Leave shutdown option as reboot
Click OK
Release the IP and turn VM into a template in Virtual Center”

I am a little confused. Wouldn’t I need to shutdown and not reboot in order to convert this vm to a template? The VM rebooted and is not at the Set Up Windows screen.

Please help if anyone can. Would like to finish this thing today.

Thanks

Kimber, Peter,
Yep you are right, you do not reboot, you just shut down and then turn it into a template, otherwise Sysprep will run on reboot, generate a new SID and as Peter pointed out your cloned VMs will then all have the same SID.

Another thing to consider when using vSphere4.x – you have the option to either Convert to Template, or Clone to Template.

Basically, if you sysprep the machine yourself (as is done here to preserve the profile settings) you should choose the Clone to Template option.

The Convert to Template option allows vSphere to take a Windows Vista or later OS and apply sysprep automatically upon conversion (because Sysprep is included with all OS versions of Vista and later). It’s a quick and dirty method of applying sysprep to a machine to quickly turn it into a template so that you don’t have to mess with the Windows AIK toolkit (which is quite cumbersome). Problem is, this method has very limited options on how you can control sysprep; most notably (as far as Jason’s original post is concerned), it won’t allow you to copy any profile settings you made – any changes you make get undone. If you sysprep the machine yourself first (as Jason has done), then this option effectively applies sysprep twice to the machine – with the vSphere4.x Sysprep getting applied last. As a result, your profile changes remain (more or less) but it messes up the vSphere Tools deployment (or at least it did in my tests) and leaves the machine unable to connect to a network – and the only way to fix it is to remove and reinstall the vSphere Tools.

Adeel, nope you do not, the same unattend.xml file will work for all 3 versions; already tested it myself by building xml files for all 3 versions, they look the same except for the one line referring to the version, which is merely an “offline reference” and won’t affect sysprep (at least not as Jason has the unattend.xml file built anyway). The only thing you might need to change is the processorArchitechture = x86 or = amd64, depending on 32bit or 64bit.

BrettM’s comment is also a little misinformed, vSphere4.x only reapplies sysprep if you choose to “customize” the template when deploying it. However, he’s right about the VMWare tools getting messed up if the template gets “double-sysprepped”.

One other thing I’ve noticed with vSphere4.x, mouse movement is REALLY laggy in the vSphere Client. This is because VMWare Tools does not apply the correct video driver. The correct video driver does get copied onto the VM, however, and can be found at \Program Files\Common Files\VMWare, which fixes the mouse problem. Unfortunately, when you sysprep the machine to create your template, it makes the mouse laggy again even with the correct video driver. The only fix I have found so far (and it’s not much of a fix) is to remove VMWare Tools right before sysprepping, and then install it again (and re-correct the video driver) after deploying your template. You can also sysprep with VMWare Tools installed, then have to remove and reinstall it again after template deploy, but that’s just more work.

It may just be me but i think i would add the second drive and use diskpart to allign=64 prior to using the VM.

Thank’s to all. I have learned a lot.
Next week I will try to create first template.

Any more improvments or updates to this procedure???

AcDalek, thin provisioning is more a function of which hypervisor you are using, rather than the template itself.

That being said, I’ve had no problems thin provisioning my own templates using ESXi 4.1.

On another note – ESX templates:
About 4 months ago I mentioned problems I’d had with converting to an ESXi template, which Xeiran mistook as problems with “double sysprepping”. It took me quite a while to track down what my actual problem was – turns out it was a video driver issue. If you use Jason’s “unattend.xml” above verbatim, it won’t correctly apply the VMWare video driver; as a result, the mouse becomes very laggy after the first sysprep which copies the profile. The way to fix this is to bring the machine back up, configure it as needed by sysprep, uninstall and reinstall the VMWare tools (this will take 3 reboots), and *then* convert it into a template.

Of course, if you do this, then the machine must be re-sysprepped again in order to wipe the SID a second time. So when you choose “Deploy Virtual Machine from this template”, it will walk you through several choices, and at the end you have the option to “Customize” the deployment – you *must* choose this, and must choose the “Generate New Security ID (SID)” option as well. When ESX runs sysprep a second time with its own customized “unattend.xml” file, it will correctly re-insert the video drivers and your template will deploy correctly (the template will boot a first time, then will seemingly sit idle for about 3 minutes before shutting down and rebooting again, with the custom ESX sysprep unattend file running during the second boot).

I was also running into the video display driver issues after Sysprep (using Generalize and OOBE options). One of my coworkers figured out that if you use the Guest Customization option in vCenter instead of manually running Sysprep, the issue does not occur. There must be something different with how Guest Customization runs Sysprep that it mitigates the issue.

Moving the page file allows you to easily snapshot or back up the machine file w/o having the page file take up space on that snapshot\backup. For backups, it simply makes things a bit cleaner (you don’t have to take the time to exclude the pagefile from the backup), while for SANs this is important since most SAN based snapshot methods cannot exclude the pagefile from the snap, and snapping a pagefile is a large waste of snap space.

SNMP is mostly for those folks who have programs for monitoring various metrics through SNMP/WMI. These programs (such as Microsoft System Management Server or PRTG or Orion to name a few) monitor such metrics as how full the disks are, memory and CPU use, uptime of the server, etc, and can be programmed to automatically alert you in the event of a problem, or generate statistical reports on those metrics.

Regarding pagefile size: Windows uses very liberal settings for “recommended” pagefile usage. The truth is, as long as a server has enough RAM, the pagefile will hardly ever get used and can be set at a minimal amount. For VM’s, if you ever find a server needing more than a minimal pagefile, it really needs more RAM – resize that instead. This is also the most efficient thing to do for VMWare, since its ballooning feature is faster and more efficient than pagefile swapping. A small pagefile is still useful even for VM’s however, for holding modified (stale) page info and freeing more RAM for running processes or file cache. I personally only use a swapfile of roughly 1Gb, or at most 2 Gb for virtualized SQL or Exchange servers, and it works just fine like that. For more info on actual pagefile use, go here: http://www.vmwareinfo.com/2009/02/how-big-should-i-make-paging-file-in.html

Great Build Book template, but I was disappointed that you recommend to disable Windows Firewall. This is very noobish.

Jez, see my comment from Feb23.

In short, you bypass the problem by sysprepping twice, once to copy the profile, and again via ESX “customized” template deployment to actually deploy the template. Unfortunately, this trick won’t work unless you are using paid ESX which gives you the “clone/convert to template” option.

Great template build procedure, used it for 50+ VMs so far. I’ve discovered a few tweaks you may find useful for a performance boost.

Check out
http://www.citrixtools.net/Resources/Articles/articleType/ArticleView/articleId/5610/Windows-2008-R2-Remote-Desktop-and-XenApp-6-Tuning-Tips-Update.aspx

The section under “Windows 2008 CPU Tuning (for VM only)” does give some extra performance if your VMs have multiple CPUs.

I’ve has sluggish Mouse response in a VMWare console, this has been fixed in vSphere 4.1 vmtools updates.

BrettM – I think you have this all right and the whole manual sysprep vs esx sysprep and clone vs convert are confusing. I have my machine build per the tutorial above. When I had my idea machine ready, I did NOT sysprep, and then I just converted to template. Then I deployed my vm from that template with an esx customization that I had previously setup. In the end, none of the profile specific settings are saved and only about half of the customizations set in my esx customization are set correctly.

My question is, from the point where I have my ideal machine setup, what steps then should I take if I want to use my esx customization? Do I sysprep manually before I convert/clone to template? Do I convert or clone to template? Then once I have my template, do I just deploy from template or clone it?

I apologize that you have explained this a few time above already, but it’s kind of spread out and there are different ways to go about this and I’m still a little confused.

Thanks Jason, Brett and all for your contributions.

Hi,

You may also need to add SkipRearm to your Sysprep to prevent Rearm countdown :

– – 1

@Gina
Like *all* windows OS’s after 2000, if you sysprep them in order to make a deployable template, then for legal purposes you will have to activate the “new” OS with a different activation code.

Practically speaking, the only way to avoid this step after deployment would be to either use an OS old enough that it does not require activation, or for 2008 servers set up a KMS licensing server which will activate it for you, which themselves can be a hassle and have their own minimum requirements, although they can be well worth the effort if you’re a big enough operation or if you have Windows Datacenter licensing.

@Gina
In that case, you don’t need a template, you simply need to clone the server. So don’t run Sysprep, just make a clone, as the whole point of sysprep is to make a template to deploy multiple new machines.

However, if you don’t run sysprep you won’t be able to set up a user profile and then make it the default for all new users. If you want to do that, then when initially configuring the OS, don’t activate it. Do your initial setup, sysprep it, uninstall and reinstall VMWare tools if this is a VMWare installation, and THEN activate the OS. Then just clone it with whatever cloning software you prefer and set the clone aside for your backup purposes.

Jason, thanks for great guide.

gents, i’m stuck with sysprep error “”windows could not parse or process unattend answer file for pass [specialize] the settings specified in the answer file cannot be applied the error was detected while processing settings for component microsoft-windows-shell-setup”.

i have tried to rename Administrator account back to the original name, i have tried to rearm my VL copy of Windows 2008 R2 (version was specifed in XML file)

i have never created other users in the system to delete them in registry

any other suggestions?

the problem was with deleted user.

i had to delete deleted user registry key from

HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList

now setup is ok. but I’m still unclear what to do with settings which are not surviving sysprep

Has anyone else noticed a problem with the UAC Settings window not working after deploying from this template?

I have built a template for my organization and then run the sysprep steps that Jason provided above. After that I actually did reinstall of the VM tools and chose to repair them instead of uninstalling/reinstalling. This seemed to preserve my NIC and some other settings that a uninstall got rid of. I then shutdown the server and cloned to a template.

After deploying from this template, I found that if I attempt to open the UAC options window, it just appears totally blank and then disappears. I will also get a “COM Surrogate has stopped working” error message from time to time.

This seems to be the only thing I’m currently having issue with and any help would be appreciated.

Gents,

i have updated unattend.xml file.

1. You dont need to reinstall vmware tools! (true)

2. it does not any question during after sysprep (accepts eula, set US locales),

3. changes time zone

4. configures IE to do not ask wizard

5. Setup “P@ssw0rd” for Administrators account as password (you should change it)

6. skip rearm process during sysprep (3 times max by default you can do rearm) so i think it will let us to do sysprep on single image many times

pleasee bellow my full xml, but i’m not sure will you able to propely copy it

i’m working on the script wich will finileze installation and edit Default User regisrty before Administrator logons to the system. so you will have full unattended installation soon

unattend.xml

registry.vbs

Hi,

Great post.

But Im havign issues with the pagefile. I’ve set it to map to the Z: drive on a NFS share so it’s not included in any backups and for SRM. But when the VM is rebooted Im seeing the disk and being offline. I have to online it, initialiase and then create the volume. Very frustrating. This is on my base image before I run sysprep.

Any ideas anyone?

Thanks

Very nice information , which saved lot of time for me. Thanks you. I have mentioned this article on my blog as well.

Excellent guide!

Out of curiosity does all the fun and games regarding sysprepping and double-sysprepping also hold true for vSphere5? Not sure if any changes were made since 4.1 regarding this.

Behruz gaf de oplossing al aan maar ik vond het toen niet direct.
Onder HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList was er inderdaad nog een sleutel met een bijhorende user.

Great blog Jason. Sounds like you and your co-worker really know your stuff…especially the co-worker 🙂

LOL

Mark

After I initially commented I seem to have clicked
on the -Notify me when new comments are added- checkbox and from now on every time a
comment is added I receive 4 emails with the same comment.
Is there a way you are able to remove me from that service?
Kudos!

Great writeup. Sure wish our IT department would pull their heads out of their a%$es. So with that, I’ll continue better practices with my personal lab at the house!

Hi, great article, can you tell me if the sysprep section applys to windows server 2012?

Jason,

I am still trying to understand why it is that you indicate to leave shutdown option as “reboot”. Can you go into more detail here and also explain what you do after clicking OK as the system is going through the process and rebooting. Do you let it come back up and set itself up before converting to a template in the vSphere client? When you release the IP do you do that inside of the OS or in the vm Settings?

Sincerely
Moirae