Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.
ChatGPT

Patching WinPE Media

This page will cover having DeployR's regeneration process updating the boot media with the latest cumulative update from Microsoft.

To patch your x64 boot media, DeployR will automatically do this if you've downloaded the CUs and placed them into the correct folder.

Assuming DeployR is installed to the default the location, it will look here for the updates:

C:\Program Files\2Pint Software\DeployR\WebServer\Scripts\%ARCH%\updates

Ex for x64 C:\Program Files\2Pint Software\DeployR\WebServer\Scripts\amd64\updates

Based on the ADK installed, as example 24H2 (26100) ADK, download the corresponding CU files from the Microsoft Update Catalog, in this example, you'll grab the latest CU from the normal patch cycle.

Click on Download, a new box will open, if more than one file is listed, download them all:

With both of them downloaded, make sure they are unblocked in the properties, then move them into the correct location:

Then regenerate the media via the button in the dashboard. When following along in the log, you'll see first an error trying to apply the first update (kb5095093), this is expected. It will then successfully apply the main CU, patching the media.

To confirm patch level, use Get-WindowsImage function, grabbing the index 1 for the winpe_amd64.wim in the content\boot directory.

Then the next time a device is booted with that media, it will also show the value in the WINPEBUILDINFO varaible:

Why Patch WinPE?

Typically this is unneeded, but sometimes Microsoft has a bug or an issue in the default ADK that requires a patch. The other reason is to support an updated Secure Version Number (SVN) in the firmware. For addtional details: https://support.microsoft.com/en-us/topic/enterprise-deployment-guidance-for-cve-2023-24932-88b8f034-20b7-4a45-80cb-c6049b0f9967 and check out Mitigation 4: Apply the Secure Version Number​​​​​​​ update to the firmware. Additional information from the community concerning the SVN: https://www.deploymentresearch.com/creating-uefi-2023-compliant-winpe-iso-files/

Last updated