Control Windows Features with DISM

Microsoft's product releases over the past few years might lead you to assume that "R2" means "tiny, incremental changes." However, once you spend some time with Windows Server 2008 R2, you'll find that many of its changes are neither tiny nor incremental. Case in point: After I set up my first Server 2008 R2 system, I wanted to automate the addition of a few roles and features. So, I turned to the OS's Servermanagercmd and vastly overhauled OCSetup commands to see how they worked under R2—only to find Servermanagercmd's rather curt Help message: Servermanagercmd is deprecated, and is not guaranteed to be supported in future releases of Windows. Ah, Servermanagercmd, we hardly knew ye ...

Server 2008 R2 offers not one but two completely new command-line tools to add, remove, and modify roles and features: a set of PowerShell cmdlets, which need Microsoft .NET 3.5 to run, and a standalone command called Deployment Image Servicing and Management (DISM), which doesn't need .NET at all. Managing features isn't DISM's only job, but I'll focus on feature control in this article.

Roles and Features
First, DISM shows you all your system's possible roles and features and whether they're installed—much as the Servermanagercmd -Query command did. To get that list, type

dism /online /get-features 

DISM will spit out several screens of output; here's an excerpt:

Name : FaxServiceRole 
State : Disabled
Feature Name : Printing-Server-Role
State : Enabled 

In this example, you can see that I've enabled the role that DISM calls Printing-Server-Role—a role that Server 2008 R2 calls Print and Document Services in Server Manager—but left the Fax Server role disabled. (You'll sometimes have trouble figuring out which of DISM's names correspond to certain features; so far, I haven't unearthed the secret Server-Manager-to-DISM decoder ring.) To install the Fax Server role, I'd type

dism /online /enable-feature:FaxServiceRole 

Unlike Servermanagercmd, which could install only one role or feature per command (unless you crafted some pretty ugly XML to make it install multiple things simultaneously), you can instruct DISM to install more than one role or feature with this slightly different syntax:

 dism /online /enable-feature 
/featurename:[featurename] /featurename:[featurename]

For example, to install the fax service and the DNS server role in one command, you could typedism /online /enable-feature /featurename:DNS-Server-Full-Role /featurename:FaxServiceRoleTo remove a feature or features with DISM, just replace /enable-feature with /disable-feature.

DISM controls features on Windows 7, as well, so—for example—if you wanted to roll out Windows desktop images without any games, you could easily accomplish that with the command

dism /online /disable-feature:InboxGames 

DISM also handles dependencies amongst roles and features. If you try to install a role or feature that needs another role or feature that isn't installed, it will ask you whether you want to install the necessary piece.

Fixes and Rough Spots
Servermanagercmd was a decent tool, but I never understood why Microsoft built it atop .NET, which guaranteed that Servermanagercmd couldn't run on Server Core and necessitated yet another command-line feature/role-configuration tool, OCSetup. DISM's designers were careful to make DISM as dependency-free as possible, which is why it not only runs on the full GUI-based Server 2008 R2, it also works well on Server Core R2 and even Windows Preinstallation Environment (PE) 3.0.

As you can see, DISM offers some good news, but DISM has some rough spots, too. The most annoying DISM irritant is its insistence on specific case in its feature names. If, in my example, I'd typed

dism /online /disable-feature:inboxgames 

it would tell me Feature name inboxgames is unknown. Come on! Case-sensitive data processing went out with the Eisenhower administration. I know next to nothing about writing C++, but I do know that—given a string named mystring—I can force it all to lowercase with this line:

for(j=1;j=tolower(mystring[j]); 

I've already mentioned the lack of clarity between some of the feature names and their meanings, so be prepared to do a bit of homework when looking for the right words. What does BusScan-ScanServer refer to? Neither Google nor Bing offered any help, so all I can guess is that it's related to the new server feature that supports centralized scanners. Even if you focus on well-known roles such as DNS or DHCP, the names are puzzling or inconsistent: Why is DNS's name DNS-Server-Full-Role but DHCP's is DHCPServer?

Warts and All
Despite a few warts, DISM's ability to add or subtract sections of Windows will be extremely useful to anyone looking to automate server or desktop rollouts. It's worth spending a little time to get to know it.