Praktikum 2

Create bootable Windows PE media

Install into the shared folder with your name (shared), created in the previous practical (Praktikum_1) two programs, ADK.zip and ADKWINPE.zip, which can be found in the public folder of the class or downloaded on your own "Windows Assessment and Deployment Kit (ADK) deployment tools" and "ADK Windows PE Add-ons". Only the Deployment Tools need to be installed in the ADK.

Install programs

Make sure your PC has the ADK and ADK Windows PE add-on installed.

Start the Deployment and Imaging Tools Environment as an administrator.

Run copype to create a working copy of the Windows PE files.

copype amd64 C:\WinPE_amd64 

Create a virtual hard drive (.vhd)

diskpart
create vdisk file="C:\shared\WinPE.vhd" maximum=1000
attach vdisk
create partition primary
assign letter=F
format fs=ntfs quick

Prepare the drive by using MakeWinPEMedia:

MakeWinPEMedia /UFD C:\WinPE_amd64 F:

Detach the drive with diskpart or use Computer Management:

diskpart
select vdisk file="C:\shared\WinPE.vhd"
detach vdisk
exit

Move the resulting WinPE.vhd file (do not copy) to a real PC in a folder with your lastname

Delete all files and folders (ADK) from the public folder on the virtual machine

Shut down with Windows Start > Shut Down

Attach the virtual disk in VirtualBox via Settings > Storage > Add New Storage Attachment (icon with a plus) > Add New Hard Disk > Choose existing Disk

Start the Windows virtual machine again and when prompted for a password, press and hold the Shift key, then select the Restart button

In the window that appears select "Use a device" and then the last UEFI disk

Start from the WinPE virtual disk

When the command prompt appears, type exit and reboot back into the OS

Start Windows and configure the local group policy so that you are only able to run the program mspaint.exe

1. Open 'gpedit'

2. In 'User configuration' select 'Administrative templates'

3. Double click on the 'System'

4. In the window on the right double click 'Run only specified Windows applications'

5. Choose Enable and write "mspaint.exe" in the list of button 'Show')

Make sure you can't run most programs now (like cmd). Show the result to your teacher!

Reboot again to the WinPE environment (Shift + restart)

Run diskpart and run the commands to assign a letter to the volume with Windows installed

list disk
select Disk 0
list volume
select Volume 1
assign letter=E
exit

Launch the registry editor regedit.

Highlight the HKEY_USERS registry branch, from the menu select File > Load Hive....

From the list find the virtual disk on which Windows is installed and specify the path to the administrator folder (for example, E:\Users\user)

In the file name input field, write ntuser.dat

Give a name to the connected branch, for example user_ntuser.dat

Expand HKEY_USERS and find the pluggable branch with the name you specified previously

Find the "RestrictRun" key in the .\user_ntuser\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ branch and change the value from 1 to 0

Select the branch you are connecting again (user_ntuser.dat) and from the File menu choose Unload Hive... > yes

Close regedit and run exit command to reboot

Make sure you can run programs again

Show the result to the teacher

Source