EWF and cloning: Does Microsoft even care?
Mark Tamola
I have asked numerous times and searched the list numerous
times and no one can give a straight answer. How do I
clone an XPE image with EWF installed? I have tried all
the solutions offered on this list to no avail. I've tried
to disable EWF, delete the EWF partition and clone it, do
the rundll32 ewfdll.dll thing, and it does NOT do it
consistently. In fact, I've only been able to do it once
and have never been able to reduplicate it again. I've
tried doing the rundll32 ewfdll.dll thing and then do the
fbreseal.exe thing twice, and that doesn't work either.
Nothing short of FBA can reliably recreate the EWF
partition, and there is NO way I can make my customer run
FBA every single time. I have to deliver 47 systems and I
can't do any of them because the EWF feature MUST work.
Can someone PLEASE tell me how to make an image with an
EWF partition and successfully clone/deploy it with
PowerQuest DriveImage? And MS, don't even think about
telling me to use SDI and then give a one line: the docs
are on MSDN. Those documents are TERRIBLE and explain
nothing. Not even one example. As for the rest of the XPE
documentation, all marketing hype. NOT ONE of the new so-
called "Embedded Enabling Features" were even implemented
far enough for a proper release, and NONE of them are
documented correctly. The number of confused souls trying
to use EWF, MUI, cloning, SDI and all the rest of them
posting unanswered questions to this newsgroup is proof
enough.
Microsoft, Jon Fincher, Andy or whoever else: can you
please spell it out for me (because after spending more
than one month on this stupid EWF issue, I guess even
after all my experience I must be an incredibly stupid
software developer) how do you clone an XPE image with an
EWF partition consistently and reliably?? What are the
EXACT steps? Can you EVEN refer me to an official
document? Did you even care about this issue when you
released EWF?
Thanks.
-Mark
Denys Meung
"rundll32...," it should work fine. However, when you use Ghost or Driv
Image
to clone the master image, then restore it, MBR corruption seems to be the
problem. To be able to re-create EWF partition, you might want to run
this command from DOS: fdisk/mbr <Enter>
Also, one thing I have notice is that after you restore your image and boot
it up, if you reboot the second time, then run the rundll32 to re-create the
ewf partition, it won't work. You must create the EWF partition at first
boot. Also , note that you need to set delay time (about 15-20 seconds)
before creating EWF partition.
Yes, EWF seems to work inconsistently, for third party cloning software are
not ready to support. Below are steps I have done. I'm still in testing
phase.
It seems to work most of the time (still the mbr issue)
You need to work with batches and scripts:
Cloning using Ghost:
1. EWF status must be "Disable"
2. Put a batch file in All Users ==> Starup called ewfcfg.bat
ewfcfg.bat:
a.Check if d:\ewf.log does not exist, then run the rundll32 to create
the ewf partition. Then create D:\ewf.log. Then reboot
b. After the reboot, check the D:\ewf.log again. Now it exists, so
don't run the runlll32 again. Just delete the shortcut and D:\ewf.log.
In the ewfcfg.bat, call the batch name xpeprep.bat.
Xpeprep.bat:
Run in order:
b.1 Run a batch to change computer name (randomly --- you need to
create one)
b.2 Run a batch that runs "fbreseal.exe" to set a unuque SID.
Reboot. Done
3. Now ghost this image as Disk ===> Image File
To restore ===> Image File ===> Disk
To restore as a Restore CD, you need to see the Ghost switches
Note: do not delete the EWF partition before cloning. Just leave it
there
****** What I have tested so far: If a system never have XPE, restoring the
first time works all the time. If I switch between enable/Disable again and
again for many times, then restore image over again and over again, ewf will
not be re-created until I run "fdisk/mbr." This is probably a quick
fix/workaround solution for your customer (fdisk/mbr).
Good luck with this.
Denys-
"Mark Tamola" <markt...@hotmail.com> wrote in message
news:707401c26e2b$bd26f050$2ae2...@phx.gbl...
Matt Keith
We were fighting the disk based EWF for a long time. Finally we
stumbled accross a method that works and lets you clone the image with
standard deployment tools. With this method, you are cloning only the
standard partition, and you let the OS re-create the EWF on the first
boot after a reseal.
In the registry, there is a FBA section that is used to tell the os what
needs to be run during the first boot process. If you go into
HKEY_Local_Machine\System\CurrentControlSet\Control\WindowsEmbedded\FBA
you will see a long list of numbered subkeys. Find the highest number,
and in it is the information for creating the EWF (it is the last thing
that gets done). In that subkey is a FBAWasHere key. If you set that
flag to 0, then on the first boot after a reseal, the ewf will be recreated.
So here is our current procedure for building a deployable os image:
- Build os image files
- Copy files to target drive
- Allow first boot to complete
- Disable the ewf (ewfmgr c: -disable; reboot)
- Delete the ewf partition with Disk Management
- Perform additional configuration (Custom S/W install, etc.)
- Set FBAWasHere flag to 0 for ewf
- Reseal the image (fbreseal)
- Use standard deployment tools to replicate image
We have been using this procedure now for a few weeks and it has always
worked fine. Can anyone at Microsoft confirm that this is a safe
workaround?
Hope this helps,
Matt