Capturing images

Turning a prepared machine into a stored, hashed, attributed image.

Source machine readiness

Windows install is the one you want to reuse BitLocker is suspended, disabled, or intentionally documented Sysprep state is known for the target use case Forge has enough free store space Direct capture prerequisites are available, or staging space exists Image name, category, and description are ready

BOOT CLIENT

connect capture logs

capture win11-labdirect

PreflightBitLocker ok, Sysprep warning acknowledged

DISMstreaming to hidden Forge share

Finalizehashing and cataloging image

Direct capture streams to a one-time SMB share and then verifies/catalogs the image on the Forge.

The flow

Boot the source machine from the ImageForge USB, sign in with a technician code, choose capture.
Name the image, give it a description and category. The client identifies the source OS automatically (e.g. "Windows 10 Pro 22H2") and records it with the image.
Preflight checks the source before anything runs (see below).
Direct capture: the Forge creates a hidden, single-use SMB share backed by the image store; DISM streams the image straight to it. No staging disk needed on the source machine.
Finalize: the Forge verifies and SHA-256 hashes the whole image, catalogs it, and destroys the temporary share and account. Expect minutes of hashing on large images — the client shows elapsed time.

Capture preflight

Check	Blocks	Warns
BitLocker	Volume locked, or encryption/decryption in progress	Encrypted but unlocked (suspend protection for clean captures)
Sysprep state	Windows marked undeployable mid-setup	Not generalized — fine for one-off clones; broad deployment of a non-sysprepped image duplicates machine identity

Warnings can be overridden by typing CAPTURE — the confirmation exists so "I cloned identity into 40 machines" never happens by accident.

Direct capture requirements

Forge running elevated or as the service (it creates the share and one-time account).
TCP 445 reachable on the Forge; Windows Server service running.

When any of that is missing, the client says so and falls back automatically to the older path: capture to a local staging volume, then upload. Staging needs free space on the source machine roughly equal to the compressed image, so direct capture is strongly preferred.

Sizing — a used Windows install commonly produces a 30–80 GB WIM. For fast, repeatable demos and lab work, also keep a lean golden image (fresh install, 8–15 GB) — every deploy of it is minutes, not an hour.

Good golden-image hygiene

Build the reference machine, install apps and updates, then run sysprep /generalize /oobe /shutdown before capturing for fleet use.
Suspend BitLocker before capture (manage-bde -protectors -disable C:).
Recapture after Patch Tuesday, or patch stored images in place with offline servicing (console: images → service).