How to update local source media to add roles and features

I’ve talked in the past about the new Features on Demand option in Windows 8 and Windows Server 2012.  However, let’s say you build out an image, remove some roles and features and then patch the overall install.  If you attempt to add back in roles and features previously removed, the operation will fail because it needs updated source files (RTM+patch level) to complete this operation.

My colleague Ben Herila from the Server Core team has some information about this on their team blog:

This post is to show you how you can update a recovery source to match that of your environment so it can successfully be used later to install roles and features.  For the purposes of this discussion, I’ll use KB2756872 ( as most people received this package during the initial Windows 8 release.

First, you want to download the contents of the needed updated from the Microsoft Update Catalog (  In this case, you’d just type in the KB number and get the following results:


Choose the appropriate downloads needed for your environment to a local computer, in this case we’ll use the 2012 update.  When the updates are downloaded, they will look like this in explorer.  These are the files we’ll need to use to update the source


Once you have the files downloaded, mount an install.wim for the operating system you need to update as a source.  On a Windows 8 or Windows Server 2012 machine, this can all be done from an elevated command prompt using the IMAGEX commands.  In the commands below, we’ll walk through the steps to mounting the install.wim to a temporary location and updating it to be a new source directory.

Copy install.wim from DVD to a temp directory

copy d:\sources\install.wim z:\install.wim

Make a mount directory for the install.wim

mkdir c:\mountdir

Remove the Read-Only attribute from the copied file so we can modify its contents

attrib.exe -r z:\install.wim

Get index information from the WIM file so we can verify the proper source index we wish to modify

dism.exe /get-wiminfo /wimfile:z:\install.wim

Mount the ‘2’ index of install.wim to our mount location

dism.exe /mount-wim /WimFile:z:\install.wim /index:2 /mountDir:c:\mountdir

I highlighted the image index above because you’ll want to ensure you’re updating the proper index when performing these operations.  The Server WIM contains 4 indexes (typically) and indexes 2 and 4 contain the full operating system binaries where indexes 1 and 3 contain only the Server Core binaries.  We’ll also need to make sure we know which index we updated so we can later use it for adding the roles and features back to the OS.

With the WIM mounted, you’ll need to use DISM to add the package to the index you’d previously mounted.  The command for this if you’d downloaded the files above to your C:\ folder would be:

dism.exe “/Image:c:\mountdir” /Add-Package “/PackagePath:C:\2756872\Update for Windows Server 2012 (KB2756872)”

NOTE: We use the source folder for this command and not an individual MSU inside the folder

Once this step is completed, commit the changes you’ve made to the WIM and unmount it:

dism.exe /Unmount-Wim /MountDir:c:\mountdir /commit

Now you have a new source directory that can be used to add roles and features back to your patched images.  So, if you were on Server Core and wanted to add back the shell components using your updated index 2 source, the command would be:

Install-WindowsFeature Server-Gui-Mgmt-Infra,Server-Gui-Shell –Source:wim:z:\install.wim:2

Organizations will need to determine how often they need to update their source recovery media.  Any time an update is released, the source is potentially invalid for reinstallation or repair operations. 

Hope that helps.


Comments (24)

  1. @Adam;

    I added a small blurb at the end of this post to reflect that you'll need to update this anytime a new update is released to keep the source current.  There isnt an automated way to do this in product currently.

  2. Glad you got it worked out.  Sorry you ran into this

  3. Both of the remaining updates are servicing stack updates which have to be applied while the system is online.  You'd need to boot the install.wim to actually apply those because they cant be done offline.  That being said, I don't know that you'd need them for a repair/installation source so you should be fine with the WIM you have now.

  4. JoeGasper says:

    Thank you for this post, though while it has been greatly helpful to understanding what is needed to maintain an updated local source, it has also led to great frustration.  The problem I’m finding is that you end up with packages in an "Install Pending"
    state and it creates problems for adding more packages.  Here are my steps in an attempt to create an updated local source for Windows Server 2012 Datacenter Core:

    Installed RTM of Windows Server 2012 Datacenter Core.

    Configured system enough to get on the network.

    sconfig, 6, all – to get a list of available patches.

    Downloaded the patches (33) from Windows Catalog:…/home.aspx

    Installed the patches, rebooted.

    sconfig, 6, all – to get any additional patches

    Downloaded the patches (4) from Windows Catalog:…/home.aspx
     (what a pain…)

    These patches were downloaded to their own folders in path D:Server2012Patches.

    Start with an elevated command prompt/PowerShell console.

    Mount the Server ISO and copy the sourcesinstall.wim to a folder (D:InstallWIM)

    Remove the Read-Only attribute on the WIM file:

    attrib.exe -r D:InstallWIMinstall.wim

    View the images in the WIM:

    Dism /Get-WIMInfo /WimFile:C:testimagesinstall.wim  (3 for DataCenter Core, 4 for GUI)

    Mount the WIM choosing the index 3 for Datacenter Core:

    md D:InstallWIMMountDir

    Dism.exe /Mount-WIM /WimFile:D:InstallWIMinstall.wim /Index:3 /MountDir:D:InstallWIMMountDir

    Add Patch Packages to the mounted WIM:

    Get-ChildItem -Path D:Server2012Patches | % {Dism.exe /image:D:InstallWIMMountDir /Add-Package /PackagePath:D:Server2012Patches$_}

    (Or copy all the MSU files to a single folder

    Dism.exe /image:D:InstallWIMMountDir /Add-Package /PackagePath:D:Server2012Patches)

    I had 4 packages fail:

    KB2772501 (it’s an EXE… how do you apply that offline?)

    And the last 3:




    They had the error:

    An error occurred applying the Unattend.xml file from the .msu package.

    For more information, review the log file.

    Error: 0x800f082f

    dism.log says:

    CBS    Exec: Cannot finalize session because an exclusive session is pending. [HRESULT = 0x800f082f – CBS_E_EXCLUSIVE_WOULD_MERGE]

    I went ahead and committed the WIM.

    Commit the changes to the WIM

    dism.exe /Unmount-Wim /MountDir:D:InstallWIMMountDir /commit

    I then remounted the install.wim and tried applying just one of the failed packages, but got the same error.

    I then listed the installed packages:

    DISM.exe /image:d:installwimmountdir /get-packages

    Most came back with "State: Installed", but a number are listed as "State: Install Pending" and one as "State: Staged" (KB2823233).

    I’m not running McAfee 🙂…/index

    And for good measure I uninstalled System Center Endpoint Protection.

    So, what the heck do we had to do to maintain an updated source??  Thanks!

  5. JoeGasper says:

    Add KB2871777 to the list of servicing updates to not install offline.  So skip these:




  6. @Adam,

    Thanks for the comment.  I'll look into amending this post or writing something new that speaks to this.

  7. The .exe's cant be applied offline, they would either need to be run or you could extract the executable to see if it was just a wrapper for an MSU (which you could apply).  For the updates that pend a reboot, that installation source would need to satisfy those requirements first before any other updates could be added to the source directory.  In other words, you'd need to boot it once to let it clear the pending cache.

  8. JoeGasper says:


    You can use the PackagePath option:

    Dism.exe /image:D:InstallWIMMountDir /Add-Package /PackagePath:D:Server2012Patches

    Manually adding each package was to discover which ones will break the ability to add additional packages.

  9. Yes, its ironic 🙂

    We've been working hard to get more and more updates to be offline capable.

  10. NeighborGeek says:

    How would you update the bits that aren't part of the install.wim on the 2012 media, such as the install files for the .Net 3.5 feature?

  11. JoeGasper says:

    Thank you for the reply. Guess I'm missing something.

    How do you boot an offline install.wim?

    I'm trying to maintain an updated local source WIM as you have walked us through in the blog posting. I'm finding that a number of patches will fail to be applied to the mounted WIM because there are pending updates in the offline install.wim.


    Error: 0x800f082e

    Package D:Server2012Patcheskb2822241.msu may have failed due to pending updates to servicing components in the image.

    My last attempt was to place all the patches for 2012 Datacenter Core in a single folder and have them applied to the install.wim in order of KB article – earliest first. 9 of 64 fail because of pending update.

    Thanks again for your time.

  12. NeighborGeek says:

    Also, if we have created a network based side-by-side store, with the winsxs source files extracted from the install.wim, is it possible to update the network sxs store directly, or is the only option going to be to update an install.wim and extract the updated contents of the winsxs directory from the wim each time?

  13. JoeGasper says:

    Thanks again.  It's sort of funny, in the service stack update of KB2821895, the first listed improvement is "Enables servicing stack updates to be installed offline."   So, I'm wondering if I might find it easier to maintain an online system fully patched and just image it to a WIM (mostly a once a month process) and use that image as the source going forward when adding features/roles. I really appreciate your thoughts and time.  -Joe

  14. First, Akirax I'm glad you got your source media updated to allow the scenario to work.  Secondly, we have the ServerManager commands well documented for Features on Demand and how to utilize them.  I talk about role persistence here:…/understanding-features-on-demand-and-role-persistence-in-windows-server-2012.aspx

    Additional FoD information is located here:…/ee662311.aspx

    Hope that helps you in the future.

  15. Joseph, great detail and process – thanks for sharing this as well as Ben!  

  16. You would need to update the install.wim and then re-extract it I believe.  

  17. JoeGasper says:

    After some trial and error, I was able to narrow down problems to 2 patches:


    This one fails and states:

    Processing 1 of 1 – Package_for_KB2771431: The specified package cannot be added to an offline image.

    Add this package to a running operating system using the /Online option.

    Error: 0x800f082e



    Once that patch applied, all other adding of packages begin failing with "Cannot finalize session because an exclusive session is pending. [HRESULT = 0x800f082f.]"

    These were successful:






























































  18. Anonymous says:

    Good idea to not have to go through 37 updates manually one by one:

    ForFiles /P C:2012Updates /C "CMD /C dism.exe "/Image:c:mountdir" /Add-Package /PackagePath:@Path

  19. the latest 2 updates should be able to integrate into a WIM:


  20. You do this in the same way, just use the sxs path.

  21. Adam Stasiak says:

    Is there a way to automate this, or at least to tell which patch you need to include reinstall a feature?

    At this point in the 2012 lifecycle it's not too bad, but in a year or two, when there are a couple dozen patches, maybe a service pack, it seems like it would be a big pain in the neck.

    You get to either maintain a source image with every patch that you've added to your servers, or you need to go hunting down the right patch when you want to install a feature.

    It seems like this makes features on demand rather unappealing as it now stands.

    Also, if you put the SxS folder in a network share for this same purpose, is there a way to achieve the same thing, or can this only be done on a WIM?

  22. AkiraX says:

    Been trying to add gui to a core datacenter install for 2 days now.

    After stumbling upon this site and realizing it will not work unless you add patches to the install.wim

    is completely ridiculous..

  23. AkiraX says:

    As it stands, install the full gui and remove when done. but don't specify the -remove option or it will remove the binaries and put you back into the same predicament.

    Remove-WindowsFeature blah blah     <——YES

    Remove-WindowsFeature blah blah     -Remove <——NO

    just wow…

  24. AkiraX says:

    Appreciate your follow-up.

    The server 2012 core in question was installed a little over a year ago and the amount patches and hotfixes installed are well over 50 or more. An issue occurred with my Hyperv failover cluster that require further troubleshooting with the gui. This is where the frustration started just trying to add the gui to the install.

    In the end, I evicted the node, cluster node cleanup, and was able to add the node in question back into the cluster which resolved the issue.

    As I move forward with 2012R2, I have my eye on minimal interface as I like the benefits of the reduced attack surface and fewer patches as the article you referenced mentioned.