Golden Machine Preparation for OS Deployment
A golden machine is a fully configured reference workstation or server from which you capture the OS image that ServiceOps deploys to target machines. Every target machine receives an identical copy of this image, so the quality of your golden machine determines the quality of every deployment.
Skipping or rushing this process is the most common cause of deployment failures, duplicate device conflicts, and post-deployment management problems. Follow every step in order before running Image Creator.
Prerequisites
Confirm the following before starting:
- The machine runs a supported Windows OS version.
- All required applications are installed and configured.
- All Windows Updates are applied and no reboot is pending.
- The machine is in a WORKGROUP, not joined to a domain.
- A local administrator account with a known password exists.
- The machine has a wired network connection with DHCP assigned.
Software: What Not to Install on the Golden Machine
Do not install any software that embeds a unique per-device identity before capture. Installing these on the golden machine causes every deployed endpoint to share the same identity, breaking management tools and creating conflicts.
| Category | Examples | Problem | Correct Approach |
|---|---|---|---|
| Endpoint management agents | SCCM, Intune, Tanium | Embeds a unique device ID at install time | Install via post-deployment task sequence |
| Antivirus / EDR | CrowdStrike, Defender ATP, Symantec | Registers a device fingerprint with the vendor cloud | Install after deployment |
| VPN clients | Cisco AnyConnect, GlobalProtect | Embeds a machine certificate tied to that device | Install after deployment |
| Backup and monitoring agents | Veeam Agent, Datto, PRTG | Registers the device with the management server | Install after deployment |
| MDM enrollment | Intune enrollment, Jamf | Ties device identity to Azure AD or MDM server | Enroll after deployment |
Step 1: Configure the OS
Set the machine to a clean, consistent state that produces identical output on every target machine after deployment.
Install all pending Windows Updates. Run Windows Update until no further updates are available.
Verify no reboot is pending before continuing.
Install all required standard applications. Do not install any software listed in the table above.
Set the network adapter to DHCP so deployed machines request an IP automatically.
Get-NetAdapter | Set-NetIPInterface -Dhcp Enabled
Step 2: Pre-Capture Verification Checklist
Confirm every item before running Sysprep. A failed Sysprep is difficult to recover from and usually requires rebuilding the golden machine.
| Check | Verification Command or Method |
|---|---|
| All Windows Updates installed | Run Windows Update and confirm no updates pending |
| No pending reboot | Check Settings > Windows Update for any restart required |
| Required applications installed and tested | Open each application and confirm it launches correctly |
| Machine in WORKGROUP (not domain) | systeminfo \| findstr /i "domain" — must show WORKGROUP |
| Local admin account with known password exists | Log out and log back in with the local admin account |
| Windows Update service disabled | sc query wuauserv — must show STOPPED |
Step 3: After Deployment
The following tasks are intentionally excluded from the golden image and must be completed after each deployment, either manually or via a post-deployment task sequence:
- Join the machine to the domain.
- Install endpoint management, antivirus, VPN, and backup agents.
- Enroll in MDM.
- Apply per-machine configuration (hostname, static IP if required, certificates).