Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Killing Enterprise ADK Custom Images
Transcript
- Lucas: Alright, Luna, let me ask you something. How long has it been since your IT department built a custom Windows image from scratch? Luna: Honestly? I think it's been at least two years. Maybe longer. We switched to Autopilot for new devices a while back. Lucas: Right — and you're not alone. That shift is actually the center of a quiet but massive change happening in enterprise Windows deployment. Microsoft has essentially started deprecating the classic Windows Assessment and Deployment Kit — the ADK — for building custom OS images. Luna: Wait, the ADK? I thought that was still the standard for anyone doing thick imaging. Lucas: It was — for decades. But with Windows 11 24H2, Microsoft has signaled that the traditional workflow — sysprep, capture, WIM, deploy — is no longer the recommended path. They want everyone on modern provisioning packages — PPKG files — or full Autopilot. Luna: So what does that actually mean for an IT team that still has a golden image they refresh every quarter? Lucas: It means that golden image is becoming a liability. Microsoft's argument is that maintaining a custom WIM image leads to driver bloat, stale security patches, and a lot of manual labor every time a new cumulative update drops. They'd rather you use a combination of a clean OS from Windows Update and a provisioning package that stamps your policies, apps, and settings at first boot. Luna: But isn't that just trading one set of tools for another? I've heard IT admins say that PPKG files are actually harder to debug than a simple sysprepped image. Lucas: That's a fair point. PPKG files are xml based, and if something goes wrong during provisioning, the error messages can be cryptic. But Microsoft is investing heavily in tooling — there's a new Windows Configuration Designer app that builds PPKGs with a GUI, and Intune integration means you can push policies without touching the image at all. Luna: So the idea is: don't bake your config into the OS. Layer it on top at deployment time. Lucas: Exactly. And that's where the real time savings come in. I saw a Microsoft case study last month — a mid-size enterprise with about 5,000 devices. They were spending roughly 45 minutes per device just on the imaging step alone. After moving to Autopilot with dynamic provisioning, that dropped to under 10 minutes of hands-on time per device. Luna: Forty-five to ten — that's a 78 percent reduction. But I imagine the upfront work to clean up Group Policy and driver stores is significant. Lucas: It is. And that's the part that often gets glossed over. A lot of organizations have accumulated years of Group Policy cruft — settings that were relevant for Windows 7 or early Windows 10 that now conflict with modern defaults. Windows 11's Settings app actually surfaces some of those conflicts, but it's still a manual audit. Luna: So the migration itself is a project. It's not just flipping a switch. Lucas: Right. But the payoff can be substantial. Beyond the deployment time savings, you also eliminate the risk of deploying an image that's weeks or months out of date. Every Autopilot reset pulls the latest OS from Microsoft's update servers, so you're always current on security patches. Luna: That does sound appealing for security compliance. No more 'we need to slipstream this month's patch into the golden image before next quarter's refresh.' Lucas: Exactly. And Microsoft is making it harder to stay on the old path. With Windows 11 24H2, the ADK no longer supports creating images for older feature updates. If you want to build a custom image for 24H2, you have to use the new ADK — but that version has already started removing some legacy sysprep capabilities. Luna: So they're gently forcing the issue. Not cutting off the old way overnight, but making it increasingly painful to maintain. Lucas: That's the playbook. And honestly, for most IT departments, the writing has been on the wall since Windows 10 1809, when Microsoft introduced the modern provisioning path. The pandemic accelerated it, because so many organizations needed to deploy laptops remotely — you can't hand someone a USB key when they're working from home. Luna: Right — that was the real catalyst. Autopilot went from a nice to have to a must-have almost overnight. Lucas: And now it's becoming the default. I talked to an IT director at a regional bank last week — they have about 2,500 endpoints. They moved fully to Autopilot and Intune last year. He told me their helpdesk tickets related to OS deployment dropped by 60 percent. Luna: Sixty percent — that's huge. What were the tickets about before? Driver issues? Lucas: Mostly driver conflicts and application compatibility. When you sysprep an image, you're locking in a specific driver set. If a new model of laptop arrives mid-cycle, you either update the image or you have to inject drivers during deployment — both are error-prone. With Autopilot, Windows Update handles driver matching based on hardware ID, so it's much more dynamic. Luna: But that assumes the OEM has signed drivers in Windows Update. What about older peripherals or specialized hardware? Lucas: Good question. For things like barcode scanners or medical devices that have their own driver packages, you can still include those via a provisioning package or Intune device configuration profile. It's not that you lose control — it's that you move from monolithic image management to policy-based management. Luna: So the skill set for IT pros is shifting. Less sysprep and WIM mastery, more Intune policy authoring and troubleshooting. Lucas: Exactly. And that's a big deal for internal IT training budgets. The classic imaging workflow is being phased out, and certification paths are already reflecting that — Microsoft's MD-102 exam for endpoint administrators focuses almost entirely on modern management. Luna: I want to go back to something you said earlier about driver bloat. How big of a problem is that actually? Lucas: Bigger than most people realize. I've seen golden images that are 12 to 15 gigabytes because they include drivers for three generations of hardware. That means every deployment is pushing unnecessary data over the network, and you risk loading a driver that conflicts with the actual hardware on the target machine. Windows 11's driver servicing stack is much better at only loading what's needed, but if it's in the image, it can still cause issues. Luna: So the modern approach is basically: start with a clean OS, let Windows Update decide what drivers to apply, then layer your specific configs on top. Lucas: That's the philosophy. And the provisioning package is the tool for that second layer. A PPKG file can be as simple as setting the time zone and joining a domain, or as complex as installing line of business apps, configuring BitLocker, and setting up VPN profiles. All without ever creating a custom OS image. Luna: What about organizations that need to deploy offline? You can't use Autopilot if there's no internet. Lucas: That's a valid edge case. For offline deployments — say, a factory floor or a secure government facility — you can still use provisioning packages applied via USB during OOBE. The package is applied locally, no internet required. You just need to generate it from Windows Configuration Designer and copy it to a thumb drive. Luna: So the PPKG is the new answer for offline, too. It's really replacing the sysprep image across the board. Lucas: It is. And Microsoft is investing in making that workflow smoother. The latest version of Windows Configuration Designer has a much better UI for building packages, and you can export them directly from Intune now. Luna: One thing that still gives me pause: troubleshooting. When a PPKG fails silently during OOBE, it can be a nightmare to figure out why. Lucas: That's true, and it's an area where Microsoft still has work to do. The provisioning logs are buried in %windir%\temp\provvm\. They're XML files that aren't exactly human-readable. But there are third-party tools emerging that parse those logs and give you a cleaner view of what failed. And Intune's deployment reports are getting better at surfacing provisioning failures at scale. Luna: So the ecosystem is catching up. It's just not quite there yet for the lone IT admin managing a couple hundred devices without dedicated tools. Lucas: I'd say that's fair. But the trajectory is clear: the old imaging path is closing. If you're still maintaining a golden image for Windows 11, now is the time to start experimenting with PPKG and Autopilot. Even if you keep your legacy process for another year, you want to understand the new tools before the old ones stop working. Luna: You know, this whole conversation reminds me of something we talked about a few episodes back — the shift from thick imaging to thin provisioning. It's part of that same 'lean' philosophy. Lucas: It really is. And that's exactly the kind of thinking that makes listener-supported shows like this possible. If today's conversation gave you something usable — a new angle on deployment, a reason to test PPKG — consider tossing a coffee our way. It helps us keep these conversations ad-free and focused on what actually matters for IT pros. Buy me a coffee dot com slash fexingo. No pressure, but every bit helps us stay independent. Luna: Yeah, and honestly, the fact that we can dig into this stuff without a sponsor's agenda is something I really value. So if you find value in it too, that's the place. Lucas: Alright, back to the technical side. One more thing I want to highlight: the impact on security baselines. When you use a PPKG, you can apply the latest security baseline from Microsoft without waiting for your next image refresh. That's a huge win for compliance teams. Luna: That's a good point — keeping up with regulatory requirements like NIST or CIS. With a golden image, you're locked into the baseline that was current when you captured it. With a provisioning package, you can update the baseline policy file independently. Lucas: Exactly. And Microsoft releases updated baselines roughly twice a year. If you're on a quarterly image refresh cycle, you could be deploying a version of Windows that's six months behind on security config. With modern provisioning, you can deploy the OS and apply the current baseline in the same step. Luna: So it's not just about saving time — it's about improving security posture. Lucas: Exactly. And that's the argument that usually gets leadership on board. The time savings are nice, but the security improvement is the real driver. Luna: Alright, I think we've covered the key shifts. What's your single takeaway for IT teams listening? Lucas: Start a pilot. Pick a non-critical device group, build a PPKG for their config, and deploy a fresh Windows 11 24H2 machine using Autopilot or a USB with the package. See how it compares to your current process. Chances are, once you see the reduction in deployment time and the elimination of image maintenance, you won't want to go back. Luna: And if you hit snags, the community has gotten pretty good at documenting workarounds. The old forums about sysprep are slowly being replaced by discussions about provisioning packages and Intune policies. Lucas: It's a new world. But it's one where IT pros can spend less time babysitting images and more time solving actual business problems. That's a trade worth making. Luna: Agreed. Thanks, Lucas. Lucas: Thanks, Luna. Talk next time.