Updating Drivers in a Slipstream Installation

Now that references to Windows XP Service Pack 2 (SP2) and Windows 2000 SP4 are appearing in Microsoft documents, it’s time to review the procedure you follow to combine hotfixes with a slipstream installation directory. Hotfixes that you might want to include in the current build can include updates you get from Microsoft Product Support Services (PSS), security hotfixes, updates you download through the Windows Update catalog (e.g., for an internal Software Update Services—SUS—Server), and fixes for OS components that are available for public download. Later in this article, I describe how you add hotfixes that update drivers to a slipstream version of the OS.

For those of you unfamiliar with the slipstream technique, a slipstream installation contains the original release of the OS (i.e., Windows 2003 Server, XP, Win2K) updated with the current service pack, plus any hotfixes you deem necessary for your site. A slipstream installation saves time when you're deploying many new workstations, and you want the system image to be fixed in time and consistent across the enterprise. If your images are well defined, you might want to distribute a new image every quarter instead of distributing 20 to 30 hotfixes per month to affected systems.

Windows XP and Win2K Hotfix Status
In the XP arena, Microsoft has released two versions of the first service pack: SP1 released September 9, 2002, and SP1a released February 3, 2003. SP1a is identical to SP1 except that it doesn't include Microsoft Virtual Machine (VM), a component that has proven vulnerable to multiple security-based exploits. As of early March, the company has released 100 hotfixes for XP Professional Edition and 12 security hotfixes, for a total of 112 during a 7-month period (or 16 per month). As of mid-March, Microsoft has released 275 official bug fixes for Win2K SP3, plus 17 security hotfixes released after July 2002, for a total of 292 fixes. If you average this number over the 8-month life span of Win2K SP3, administrators must manage roughly 36 bugs per month for Win2K systems.

Creating a Slipstream Directory
Creating a slipstream installation kit takes three steps:
1. Copy the contents of the distribution CD-ROM’s i386 directory, including all subdirectories, to a local or shared network folder.
2. Expand the service pack file to a temporary directory.
3. In the service pack directory, run Update.exe with the slipstream option –s: where is the path to the i386 directory you created in Step 1. The slipstream option instructs Setup to replace or add service pack files to the i386 directory, instead of updating the running OS. So, for example, if you copy the gold code release of Win2K to D:win2ksp3, you slipstream SP3 into this directory by typing the command

Update.exe –s:d:win2ksp3

The net result is an installation directory that contains the most current OS version, excluding hotfixes. For instructions about how to create an XP slipstream installation, see the Microsoft article "PRB: An Error Occurred While Copying the Adod6522.icm File" (http://support.microsoft.com/?kbid=329613); for the equivalent Win2K instructions, see the "Hotfix Installation and Deployment Guide" (http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/hfdeploy.htm).

Adding Hotfixes to a Slipstream Directory
Now, let’s review the procedure for adding hotfixes to a directory you've already updated to Win2K SP3. For this discussion, I assume that you have a slipstream directory build for each platform and that you've collected all hotfixes that apply to a specific platform and service pack (e.g., XP Pro or Win2K) in a directory named for the platform. A hotfix file uses the general format Qnnnnnn__X86.exe, where OS is the platform (e.g., WXP or W2K) and SP refers to the service pack in which the hotfix will be included (e.g., SP4 or SP2). Although Microsoft dropped the Q designation for Knowledge Base articles, the company still uses this naming convention for downloadable hotfixes and service packs.

When hotfixes replace files that are contained in the driver.cab file of the original release or the service pack, you must hand-load the replacement cabinet files into the slipstream directory. If you don’t follow this procedure, the setup utility might use the original driver instead of the driver update in the hotfix. Thus you might think you've slipstreamed the hotfix, when in fact the slipstream directory contains all hotfix files except the updated driver. You can either rename each hotfix file to conform to the old DOS 8.3 name format, or you can copy the file as explained below and rename the slipstream version so that it conforms to the 8.3 format. You also need to expand each hotfix into its individual components so that you can locate the new driver.cab file. To expand a hotfix, open a command prompt, type the name of the hotfix executable (e.g., Q819002) with the /X (expand) option and provide a destination path when prompted. The command Q819002 /x d:w2kQ819002 tells the hotfix to place all hotfix files into the directory d:w2k819002.

Create a service pack folder below the i386 directory (e.g., md d:i386svcpack). Copy each hotfix executable you want to slipstream to the d:i386svcpack folder, and rename the destination copy so that it conforms to the 8.3 format (e.g., Qxxxxxx.exe). Examine the expanded files in all hotfixes, and note the instances in which multiple hotfixes update the same binary file, meaning a file that has a file type of .sys, .dll, or .exe. If you see the same binary file, you need to compare version numbers and keep only the file with the highest version number. Repeat the following process for each hotfix you want to slipstream:
1. Copy the hotfix files to the correct slipstream directory, as noted below. Note: You don't have to copy the standard update.exe, update.inf, update.ver, spmsg.dll, spcustom.dll, spuninst.exe, or symbols.pdb hotfix files.

• Copy the hotfix catalog file Q819002.cat to d:i386svcpack.
• Copy each binary file into d:i386.
• Delete the original d:i386 binary file. (It will have the same name and type, except the last character of the type is an underscore; driver.exe corresponds to driver.ex_, driver.dll to driver.dl_, driver.sys to driver.sy_.)

2. Identify the hotfix files you want to slipstream. Create a custom .inf file that contains a list of the hotfixes you want to slipstream. First, delete the default d:i386svcpack.inf file. Start a text editor and follow the format below. You must include each hotfix twice, one in ProductCatalogsToInstall (with a .cat extension) and one in SetupHotfixesToRun (with an .exe extension and the installer options /q for quiet mode, /n to disable creation of the uninstall directory, and /z to disable the automatic reboot).

[Version]
Signature="$Windows NT$"

[SetupData]
CatalogSubDir="i386svcpack"

[ProductCatalogsToInstall]
Q810400.cat

[SetupHotfixesToRun]
Q810400.exe /q /n /z

3. Modify the .inf file to denote driver updates are required. Modify d:i386dosnet.inf to show the location of the hotfix executables and the driver files that must be extracted from the updated hotfix cabinet files. OptionalSrcDirs names the directory that contains the Qxxxxxx.exe files, and ForceCopyDriverCabFiles identifies the files Setup should extract from the updated cabinet files.

[OptionalSrcDirs]
svcpack

[ForceCopyDriverCabFiles]
usbhub.sys

Now you can test the slipstream directory. Perform a clean installation and verify the hotfixes are present—you can enumerate hotfixes with the update.exe /l installer utility, HFNetCheck, or the Microsoft Baseline Security Analyzer (MBSA). If you’re dealing with many hotfixes, keep in mind that it’s easy to overlook one .dll file. Likewise, be sure you delete the compressed binary equivalents of all the files the hotfixes replace in the original installation. Good luck and let me know how the installation goes.