Online servicing is performed on a running operating system, usually when the operating system is booted to audit mode, but can occur in other phases of deployment as well. Online servicing includes verifying modifications and taking inventory of what is installed on an image, as well as adding applications, drivers, system components, service packs, or language packs while the operating system is running. If you update or modify the operating system while it is booted to audit mode, you can also add applications such as virus protection software before the first user logs on.

In a typical corporate scenario, you might have a customized Microsoft® Windows® image that you serviced offline. Some of the packages and drivers that were added or removed offline might be in a pending state. This is usually because a reboot is required to complete online actions. Booting the image to audit mode will satisfy the reboot requirement, and allow you to take inventory of your image, verify the installation state of drivers and other packages, and further service the running operating system.


The following definitions will help you understand the terminology used in this scenario.

Technician computer

The computer on which you install the Windows Automation Installation Kit (AIK) tools and create answer files.

Destination computer

The computer on which you will install Windows.

Master image

A Windows image that you want to update.

Online pending actions

When drivers and other packages are added to an offline image, the installation might not be able to complete until the operating system is booted. If the installation is pending because it requires a reboot, then there are online pending actions.

In-box drivers

Inbox drivers are installed by default with the Windows operating system.

Out-of-box drivers

Out-of-box drivers are third-party drivers that are not installed by default.

Process Overview

The following illustration shows the workflow for this scenario.

Diagram of workflow for servicing an online image

To service an image online, start by using a Windows image to boot a destination computer to audit mode. Then use DISM to take an inventory of what is installed on the operating system and to make sure it is configured and operating properly. You can also use other tools to add or remove additional plug-and-play drivers, add Windows service packs, or applications and language packs while the operating system is running. When you are done servicing the online image, you can make the computer ready for delivery by using the System Preparation tool (Sysprep) and the sysprep /oobe /generalize /shutdown command to shut down the operating system.

Why use audit mode?

There are two modes that Windows can boot to during an unattended installation: audit mode and Windows Welcome (also called "Out-of-Box Experience" or OOBE). Audit mode is the ideal environment for you to make additional changes and configurations to a Windows installation, without requiring activation or finalizing the computer for the end user. Audit mode enables you to install additional applications and device drivers, run scripts, or apply updates to a Windows installation. After you complete your additional configurations in audit mode, you can configure the computer to boot to Windows Welcome on next boot by using the Sysprep command line utility.

Why use OCSetup?

System component files, provided as .msi or .exe files from Windows Installer or CBS-based installation packages, can be installed online using OCSetup. System component .msi and .exe files cannot be installed offline with DISM. DISM can install only .cab files, .msu files, and .inf files.

Why use DPInst?

The Driver Package Installer (DPInst) will selectively install non-boot-critical drivers only if the hardware is present or if the driver package is a better match for the device. DPInst will not install a driver if the hardware is not detected.

Why use PNPUtil?

The PNPUtil tool can be used to add, remove, and enumerate plug-and-play drivers. The device does not need to be present. If you know that the end user will be connecting a device such as a camera, fax, or other device, you can install the appropriate driver so that the end user does not get prompted to install the driver.

Why use WUSA?

Windows Update Standalone installer (WUSA) can be used to install service packs and other software updates. Service packs must be installed online. They cannot be installed offline.

Why use LPKSetup?

When you add language packs using the LPKSetup tool, the licensing requirements are verified. You will be alerted if you are running a single-language edition of Windows and cannot install additional language packs.

Scenario Tasks

Before you begin, make sure you have the following:

  • A Windows image (.wim file) to service.

  • A destination computer to boot the Windows image to.

  • The drivers, update packages, and language packs that you will use to service the image, stored in an accessible location.

Use the following table to find the step-by-step instructions and information that will help you complete this process.



For more information

Boot to audit mode

Typically, Windows starts Windows Welcome immediately after the installation completes. However, by booting to audit mode, you can bypass Windows Welcome. Audit mode is pre-activation and doesn't require resetting of the activation counter. This also enables you to access the desktop as quickly as possible.

There are several ways to boot to audit mode:

  • From the Windows Welcome screen, press Shift+Ctrl+F3.

  • In unattended installations, configure the Microsoft-Windows-Deployment | Reseal | Mode setting to audit. For more information on this settings, see the Unattended Windows Setup Reference.

  • Run the sysprep command with the /audit option on the image before you install it. This configures the system to boot to audit mode on the next reboot.


After a computer boots to audit mode, the computer will continue to boot to audit mode until you configure the computer to boot to Windows Welcome.

Windows System Image Manager Technical Reference

Sysprep Technical Reference

Service the image

Use the following tools to service the operating system:

  • Use DISM to enumerate drivers, international settings, packages and features, and to apply unattended answer file settings.

  • Use OCSetup to add system components (.msi and .exe files from Windows Installer or CBS-based installation packages).

  • Use DPInst to add drivers for detected hardware.

  • Use PNPUtil to add, remove, and enumerate plug-and-play drivers.

  • Use WUSA to add service packs.

  • Use LPKSetup to add or remove language packs and verify licensing requirements.

Sysprep the image to prepare it for the end user

If the image is ready for deployment and delivery, shut down the operating system by using the System Preparation tool (Sysprep) and the sysprep /oobe /generalize /shutdown command.

Sysprep Technical Reference


The following list provides additional options to consider as you develop your image management and servicing strategy.

  • Service an Online Image

    Describes how to modify or service a running operating system.

  • OCSetup Command-Line Options

    Describes the command-line options that can be used on a running operating system to install or uninstall Windows Installer (.msi) files, Component Based Servicing (CBS) files, and .exe files.

  • Lpksetup Command-Line Options

    Describes the command-line options that can be used to install language packs and configure international settings.

See Also