Windows Image Servicing Toolkit

Public portfolio edition. The repository contains source code only—no company images, answer files, drivers, installers, keys, logs, manifests, or deployment media.

A safety-gated PowerShell workflow for servicing a Windows 11 installation image and its embedded recovery image. It validates signed Microsoft packages, works on recoverable copies, integrates optional drivers, verifies the result, records hashes and a servicing manifest, and retains the original WIM as a backup.

Highlights

• Validation-only default; image changes require the explicit -Execute switch.
• Microsoft Authenticode validation for update packages and Defender servicing files.
• Exact Windows image-name selection instead of assuming an index.
• Copy-and-hash working area before any modification.
• Offline Microsoft Defender, WinRE, cumulative update, .NET, Safe OS, and optional driver servicing.
• Mounted-image conflict detection and failure cleanup.
• Export with -CheckIntegrity, read-only final validation, and SHA-256 verification.
• Staged replacement with an automatically retained original WIM.
• UNC-aware elevated launcher for projects stored on mapped drives.

Architecture

flowchart LR
    M[Windows installation media] --> V[Path and signature validation]
    P[Approved update packages] --> V
    V --> G{Execute switch?}
    G -- No --> S[Validation summary only]
    G -- Yes --> W[Hashed working WIM]
    W --> R[Service embedded WinRE]
    R --> O[Service Windows image]
    O --> E[Export with integrity check]
    E --> Q[Read-only package validation]
    Q --> H[Hash and manifest]
    H --> B[Atomic replacement plus backup]

Loading

See Safety model for the mutation boundaries and recovery behavior.

Expected media layout

The defaults expect a servicing workspace on D::

D:\
├── sources\install.wim
└── ImageServicing\
    ├── Drivers\
    └── Packages\
        ├── CU\
        ├── Other\
        └── Defender\defender-update-kit-x64.zip

The package filenames in the script are a pinned example set. Before use, replace them with the packages approved for the target Windows build and independently verify their source, applicability, signature, and servicing order.

Validate only

Run from an elevated Windows PowerShell session:

.\Service-WindowsImage.ps1

The script validates paths and Microsoft signatures, prints the resolved plan, and returns before creating a run folder, mounting an image, or replacing media.

The CMD launcher is also validation-only by default:

Run-Service-WindowsImage.cmd

Execute servicing

Only after reviewing the target media and maintaining a separate backup:

.\Service-WindowsImage.ps1 -Execute

Or through the elevated launcher:

.\Start-Service-WindowsImage.ps1 -Execute

Execution requires administrator rights and the Windows DISM PowerShell cmdlets. It can take substantial time and disk space. Test on disposable media before using a production image.

Recovery behavior

• Work occurs under a timestamped run directory.
• Mounted images are discarded in finally if the run fails before commit.
• The final WIM is mounted read-only for package validation.
• The source WIM is replaced only after the staged file's SHA-256 matches the validated final WIM.
• File.Replace retains the previous source WIM under the servicing backup directory.

Publication safety

• Image, ISO, update, driver, log, manifest, and package formats are Git-ignored.
• No organization-specific assets, credentials, product keys, deployment paths, or prior Git history are present.
• Static verification parses both PowerShell files and checks the CMD launcher target.
• Destructive DISM execution is not run as part of the portfolio publication gate.

License

Published for portfolio review. No open-source license is granted; see LICENSE.