Lesson 7	Create a Windows Server Reference Image
Objective	Explain how to prepare, generalize, capture, and maintain a reusable Windows Server 2025 reference image.

Create a Windows Server 2025 Reference Image

A Windows Server reference image is a prepared operating-system installation that can be captured and reused when deploying or recovering physical servers and virtual machines. The reference image provides a standardized Windows Server 2025 foundation containing an approved operating-system edition, current updates, common configuration, and, when appropriate, selected applications or management agents.

The reference-image process is the modern replacement for the Remote Installation Preparation, or RIPrep, workflow used with Windows 2000 Remote Installation Services. RIPrep copied a configured source computer to a RIS server so that similar client computers could install the same operating system, applications, and settings over the network. Windows Server 2025 uses a more modular process based on Sysprep, Windows Preinstallation Environment, Windows Imaging Format files, DISM, and automated deployment workflows.

The underlying objective remains the same: create one reusable operating-system platform and deploy it consistently to multiple systems. The modern process provides greater flexibility because hardware drivers, server roles, applications, answer files, scripts, and environment-specific settings can be applied during deployment rather than permanently embedded in every image.

Reference Image Workflow

A Windows Server 2025 reference image is normally created through the following sequence:

Create a clean reference computer or virtual machine.
Install Windows Server 2025 from trusted installation media.
Apply current cumulative, servicing, and security updates.
Install approved applications, agents, roles, features, and common configuration.
Validate the reference installation.
Generalize the operating system with Sysprep.
Shut down the reference computer.
Boot the reference computer into Windows PE.
Capture the Windows partition as a WIM image with DISM.
Store, document, and version the captured image.
Deploy the image through Microsoft Configuration Manager, custom WinPE automation, or another supported deployment platform.

These stages should be treated as a controlled image-engineering process. A reference image should not be created casually from an active production server. It should originate from a clean, documented, and reproducible build.

Prepare the Reference Computer

A reference computer is the modern counterpart to the RIPrep source computer. It contains the base Windows Server installation and any shared components that should be present in every system created from the image.

A virtual machine is generally preferable to a physical reference computer because it provides a cleaner and more repeatable starting point. A virtual machine can be recreated quickly, isolated from production workloads, and kept free of unnecessary hardware-specific drivers. Hypervisor checkpoints can also be used during image development, although the final image should be captured only after the build has been validated and prepared correctly.

The reference computer should be created from trusted Windows Server 2025 installation media. Administrators should document the edition, build number, installation source, servicing level, and configuration applied during the build.

Reference Computer Preparation Guidelines

Use a clean virtual machine or dedicated physical computer.
Do not use an existing production server as the image source.
Avoid adding unnecessary vendor-specific hardware drivers to a general-purpose image.
Do not embed passwords, private keys, certificates, tokens, or other secrets in the image.
Do not permanently join the reference machine to the production domain unless the deployment design specifically requires it.
Apply computer names, domain membership, static IP addresses, and server-specific settings after deployment.
Record every application, agent, role, feature, update, and configuration change included in the image.

The reference system should remain as hardware-neutral and environment-neutral as practical. Server-specific identity and configuration should be supplied later through an answer file, task-sequence variables, PowerShell, Group Policy, or another configuration-management system.

Choose Between Thin and Thick Images

Thin Image

A thin image contains Windows Server 2025, current updates, and only the components required on nearly every target server. Applications, drivers, server roles, and specialized configuration are installed later through task-sequence steps or post-deployment automation.

Thin images are generally easier to maintain because fewer embedded components must be updated. One thin image can support many server roles, including web servers, file servers, application servers, management servers, and database hosts.

Thick Image

A thick image contains the operating system plus a larger set of preinstalled applications, agents, roles, and configuration. This can reduce deployment time because more components are already present when the image is applied.

the same software is required on every target server;
deployment speed is more important than image flexibility;
network bandwidth is limited;
servers must be rebuilt rapidly during disaster recovery;
or a tightly controlled appliance-style configuration is being deployed.

The disadvantage is increased maintenance. Every embedded application and component must be serviced, tested, and recaptured when it changes. For most environments, a moderately thin image combined with automated task-sequence configuration provides the best balance.

Install Updates, Applications, and Common Configuration

current cumulative and security updates;
approved endpoint-security or monitoring agents;
backup and recovery agents;
PowerShell modules;
common runtime libraries;
organization-wide security settings;
Windows roles or features required by every target server;
and scripts used during initial configuration.

Applications required only by specific departments or server roles should normally be installed during deployment rather than embedded in the image. A single base WIM can then be reused by several task sequences, each applying different applications, drivers, roles, and settings.

Default User Profile Considerations

The Windows 2000 RIPrep process often involved direct customization of the default user profile. This is no longer a mandatory part of reference-image creation.

Windows Server deployments usually require less desktop personalization than client operating systems. When standardized user settings are necessary, administrators should use supported mechanisms such as Group Policy, PowerShell, registry policies, configuration-management tools, or the supported CopyProfile setting in an unattended Setup file.

Manually copying profile directories or registry data into the default profile can create unsupported or inconsistent configurations.

Generalize the Installation with Sysprep

Sysprep prepares the reference installation for capture and reuse.

C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown

/generalize removes system-specific deployment information from the Windows installation.
/oobe configures the deployed installation to enter the appropriate first-boot setup phase.
/shutdown shuts down the reference computer after generalization.

C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown /unattend:C:\Deploy\unattend.xml

After Sysprep shuts down the reference computer, do not boot it back into the generalized Windows installation before capture. Instead, boot directly into Windows PE.

Boot the Reference Computer into Windows PE

a bootable USB drive;
a mounted ISO;
UEFI PXE boot;
a hypervisor virtual DVD drive;
or remote-management hardware such as iDRAC or iLO.

The WinPE image should contain any network, storage, RAID, NVMe, or controller drivers required to access the Windows partition and the destination where the WIM file will be stored.

Capture the Windows Installation with DISM

Dism /Capture-Image `
    /ImageFile:D:\Images\Windows-Server-2025-Reference.wim `
    /CaptureDir:C:\ `
    /Name:"Windows Server 2025 Reference Image" `
    /Description:"Generalized Windows Server 2025 reference installation" `
    /Compress:Max `
    /CheckIntegrity `
    /Verify

/Capture-Image creates a WIM image from an existing volume.
/ImageFile specifies the destination WIM file.
/CaptureDir identifies the Windows volume to capture.
/Name assigns a descriptive name to the image.
/Description records additional image information.
/Compress:Max uses maximum WIM compression.
/CheckIntegrity detects corruption during capture.
/Verify verifies files as they are captured.

The output WIM should be written to a different disk, network share, or deployment repository.

Document and Version the Image

image name and version;
creation date;
Windows Server edition and build;
servicing and cumulative-update level;
installed applications and agents;
installed roles and features;
security baseline;
Sysprep and answer-file configuration;
image hash;
test results;
and the administrator responsible for the build.

Windows-Server-2025-Standard-Core-v2026.06.wim

Deploy the Reference Image

The captured WIM can be deployed through Microsoft Configuration Manager, a custom WinPE process, scripted DISM automation, a supported third-party deployment platform, hypervisor templates, or cloud image services.

boot a target server into WinPE;
partition and format storage;
apply the captured Windows Server image;
inject hardware-specific drivers;
supply an unattend.xml file;
install server roles and applications;
run PowerShell scripts;
join the system to a domain;
apply organization-specific settings;
and validate the completed deployment.

Windows Deployment Services and MDT

Windows Deployment Services succeeded Remote Installation Services, but the traditional installation-media-based WDS workflow is not the primary deployment model for Windows Server 2025. Microsoft blocks the traditional end-to-end WDS process that relies on boot.wim copied directly from installation media for Windows Server releases after Windows Server 2022.

WDS may still participate in limited PXE transport scenarios involving custom boot images, but current deployment designs should emphasize customized WinPE, Configuration Manager, supported third-party deployment systems, DISM, and automated task sequences.

Microsoft Deployment Toolkit should not be recommended as a current Windows Server 2025 solution. MDT was retired in 2026 and no longer receives normal feature development, compatibility updates, or product support.

Use Reference Images in Disaster Recovery

replacement-server provisioning;
rebuilding failed virtual machines;
standardized bare-metal deployment;
restoration of common server platforms;
and recovery of infrastructure services.

A reference image is not a backup. Databases, application data, Active Directory state, configuration databases, certificates, encryption keys, and other server-specific information must be protected separately.

Boot the replacement server into WinPE.
Partition and format the replacement disks.
Apply the Windows Server 2025 reference image.
Install hardware-specific drivers.
Apply the required server-role configuration.
Restore application, system, and configuration data.
Restore certificates, keys, and secrets through approved procedures.
Validate networking, services, monitoring, backup, and security controls.

Test and Maintain the Reference Image

the WIM applies without errors;
Windows starts and completes specialization;
drivers load correctly;
network connectivity is available;
unattended Setup settings are applied;
task-sequence scripts complete successfully;
security agents and monitoring tools register correctly;
roles and applications function as intended;
and the system can receive current updates.

Summary

RIPrep has been replaced by a modular Windows deployment process. The modern equivalent is to prepare a clean Windows Server 2025 reference computer or virtual machine, apply approved updates and common configuration, generalize the installation with Sysprep, boot into WinPE, and capture the installation as a WIM file with DISM.

The captured image can then be deployed through Configuration Manager, custom WinPE automation, or another supported deployment platform.

This approach preserves the original RIPrep goal of deploying a standardized operating system efficiently while improving maintainability, security, automation, hardware independence, and disaster-recovery readiness.