Solved Sanity check for manual offline update to fresh 26100.1 install

LASTBOOMER66 said:

So after the install is completed what can I do to get the latest security patches ?

Click to expand...

If you have a different machine that has access to the Internet, you could simply download the latest cumulative update from the Microsoft Update Catalog. Then you can copy that over to the other system on a thumb drive or whatever media you like and simply run to install the latest cumulative update which will include all the security updates. If you need any more information or more specific details just let me know.

hsehestedt said:

Amen, I got tired of doing it manually so I scriped it.

Click to expand...

Windows Image Updater bVersion 6.0.4 by Hannes Sehestedt I had to find out WHY he would write this! I see now it lets us have a clean setup of 24H2 of Win 11 PRO that has all of its boot files aligned and with current updates and avoids mishaps with DU. I need to at least update to CA 2023 first the revoks are not required just yet ? I can run rufus on the win pro ISO it after it is done ?

You do not yet have to install the 2023 certs or revoke the 2011, but it won't hurt if you want to do that.

Yes, you can use Rufus with the resulting ISO image just as with any Windows installation ISO.

my iso copy of 24H2 the boot files within are not dual signed for CA 2011 / CA 2023 but I am told some are. I hope obtain a 24H2 ISO that does have dual signed boot files. MS does not offer a ISO anymore and do not know how to obtain it, or at least one that I can verify its hash.

LASTBOOMER66 said:

I hope obtain a 24H2 ISO that does have dual signed boot files.

Click to expand...

Is there some reason that you are not using 25H2?

EDIT: I should just add that 24H2 and 25H2 are identical with the only real difference being that some features are enabled in 25H2 that are not in 24H2, although they are present, just dormant in 24H2. Both 24H2 and 25H2 share effectively the same updates.

hsehestedt said:

Is there some reason that you are not using 25H2

Click to expand...

Non of the oobe BYPASS methodes i know of work, MSA OK for corporate but we want old school local only setup and MSA by choice. So reason is I dont know a way with 25H2.

LASTBOOMER66 said:

So reason is I dont know a way with 25H2.

Click to expand...

I did see Rufus mentioned when skimming. Have you used it before?

You don’t need to format the USB, RUFUS will do it.

• The latest ISO is available via the Media Creation Tool. (Option One in the tutorial below)
  • At the time of this post, the latest version available from Microsoft is: > Windows 11 Version 25H2 build 26200.7840 ISO
  • Before Media Creation Tool starts downloading Windows 11, when asked, tell Media Creation Tool to create the ISO and not burn to media (USB)

• Download Windows 11 ISO

• Download RUFUS
  • #1 Direct RUFUS to your USB
  • #2 Click “Select” and direct RUFUS to the ISO that you downloaded from Microsoft.
  • #3 should sort itself out if the OS drive is partitioned properly. But to be sure, make certain it’s GPT. Your Windows OS really should be partitioned to GPT. Make sure #3 says GPT
  • If you’re running an older system and have no choice but to use MBR (According to your HDD partition structure) then choose MBR at #3 in the image below. Find what partition table is used, in this Tutorial

• Click “Start”

• After clicking “Start”, the following options will show — Make your selections.
  • Select Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0 (to bypass requirements) IF you need to.
  • Select Remove requirement for an online Microsoft account
  • Pre tell the installation to Create a local account with username and give it a name (if you want to)
  • Set regional options to the same values as this user (On the PC you’re creating the media on)
  • Disable data collection
  • Disable Bitlocker automatic drive encryption
  • Use “Windows CA 2023”
• Click OK and the USB install media will be created on the USB
• Once Rufus has created the USB installer, you can proceed with the Windows installation.

• Let Rufus create the USB
• Install Windows.

LASTBOOMER66 said:

Non of the oobe BYPASS methodes i know of work, MSA OK for corporate but we want old school local only setup and MSA by choice. So reason is I dont know a way with 25H2.

Click to expand...

BypassNRO.cmd still exists in 25H2.

LASTBOOMER66 said:

Non of the oobe BYPASS methodes i know of work, MSA OK for corporate but we want old school local only setup and MSA by choice. So reason is I dont know a way with 25H2.

Click to expand...

Did you try the solution I provided in DM?

@hsehestedt this command line from your script is not extracting the SSU*.cab file out of the .msu:



Have you tested this?

After much searching .. looks like Microsoft has decided to convert the format of an .msu file into a WIM image but still name them with the .msu extension.

¯\_(ツ)_/¯

This change breaks use of the extract command for scripts that are pulling .cab's out of the newer file format.

Starting on line 499 you can read where the code is detecting the format of the file. If it matches the newer format it then proceeds to mount it as an image in order to extract the .cab files out:


@hsehestedt .. I hate to be the bearer of bad news but looks like some retooling of your script is in order to accomplish the same goal.

.. and running the code by hand on the February 2026 update you can see that UTF8 encoding matches that of WIM:

johnblue said:

@hsehestedt this command line from your script is not extracting the SSU*.cab file out of the .msu:

View attachment 164003

Have you tested this?

Click to expand...

Thanks for the heads up on this. If it is broken in this script, then it is likely also broken in my program. I may not have the opportunity to look at this in detail until tomorrow, but I will do so and will respond back.

Thanks again for taking the time to let me know!

@johnblue, thanks for reporting the problem with my batch file. I spent several hours trying to find a solution that would not require any third-party tools. Unfortunately, so far everything that I have tried has failed so I had to resort to making use of 7-Zip. I've updated the batch file to make use of 7-Zip to extract the SSU. This will require that 7-Zip is installed on the system, or at the very least, that the 7z.exe command line utility from 7-Zip be available.

To accommodate this change, I have added another user defined variable to specify the location of 7-Zip. Right now, you will find that it is set to the default location of 7-Zip. If you install to a different location, then that variable will need to be updated.

If I find a way to do this without 7-Zip, then I'll certainly post an update.

You can find the updated batch file in post #13 of this thread.

NOTE: My program up on GitHub had the same flaw but I have also fixed that now. That one will not require 7-Zip to be installed because I am simply embedding 7z.exe into the program. I have not yet updated the version posted on GitHub. I have not gone through my battery of testing yet on it but I expect that if all goes well, I will be post9ing the updated version later today (Sunday, Feb 22). The new version will be 25.0.5.285.

Thanks again for reporting this! BTW, out of curiosity how was it that you realized that the SSU was not being updated? Clearly, I need to implement some error checking because this issue has apparently existed silently for a while without me even realizing it.

hsehestedt said:

Thanks again for reporting this! BTW, out of curiosity how was it that you realized that the SSU was not being updated?

Click to expand...

So. The way my brain is wired to learn is to actually do things instead of simply kicking off a script. I found it by manually issuing each command of the script in sequence and then checking the result.

That said, I recommend that you keep using DISM in your script instead of trying to bolt 7zip onto the process to copy out the needed .cab file.

Rename the .msu file extension to .wim, mount the image and then copy out the SSU .cab:



Should be only a minor change to include the extra step.

I was thinking along those lines but had not tried it yet. I wanted to get a fairly quick fix out before going that route because I had limited time and that option is going to need a lot more testing by me and time I just won't have for a couple of days. It's good to know that this is an option.

EDIT: Resolved. Below I said that I could not mount the cumulative update. I resolved that problem.

I did have enough time to try a quick sanity check. I tried to mount the latest differential update (KB5077241 for build 26200.7921) and even when renamed to .wim DISM is unable to mount it.

BTW, I see that you were mounting KB5043080. I just want to make sure that you are aware that this file is not needed if you are updating any build from 26100.1742 and newer. That KB is already built into those builds. You only need the differential update to update those builds since the checkpoint update is already present.

hsehestedt said:

I just want to make sure that you are aware that this file is not needed if you are updating any build from 26100.1742 and newer.

Click to expand...

Thanks for the reminder.

As mentioned at the beginning of the thread and in a couple of other places .. I am exclusively working with 26100.1.

@johnblue, I did at least take the time to do a full assesment here. Your post has had me completely re-evaluate the batch file. I now realize that there is one other major that I need to address:

For now, since only the latest differential update needs to be installed, the batch file will work fine (with the exception of the SSU issue). The problem would be that if both a checkpoint AND differential update need to be installed, I am not handling that correctly. I have never had to do that so I didn't catch that.

It's not going to be a real quick fix. Worse yet is my program because it does WAY more than this batch file so fixing it will be a bit of a job.

But again, thanks so much for reporting this.

hsehestedt said:

But again, thanks so much for reporting this.

Click to expand...

No worries .. team effort.