Skip to content

P02-T01 - Golden Image Standard

Objective

Freeze the Windows Server 2025 golden image standard before building VMID 4000, so every future server clone inherits a predictable and validated base.

Inputs

Key Value
VMID 4000
Template name TPL-WS2025
OS edition Windows Server 2025 Standard (Desktop Experience)
Build VLAN 110
Build subnet 172.20.110.0/24
Build gateway 172.20.110.1
Storage local-zfs

Target State

Property Value
Firmware OVMF
Machine type q35
CPU 2 vCPU
Memory 4096 MB
Disk 64 GB
NIC VirtIO on GEILLAN tag 110
Guest agent Enabled
PowerShell 7.6.3
Domain joined No
Static IP retained in template No
Unattend staged before capture Yes
Forbidden installed roles AD DS, DNS, DHCP, IIS, File Server, Hyper-V

Standard decisions

  • The template never lives on VLAN 20; it is built on VLAN 110.
  • The template keeps QEMU Guest Agent enabled.
  • The template is generalized with Sysprep /generalize /oobe /shutdown /mode:vm.
  • Sysprep must be launched from an interactive local administrator session inside the guest, not through QGA or qm guest exec.
  • C:\Windows\Panther\Unattend\Unattend.xml must be staged before capture so the first cloned boot does not stall in deployment prompts.
  • The approved Desktop Experience Unattend.xml pattern includes:
  • a specialize pass ProductKey using the Microsoft KMS client setup key for Windows Server 2025 Standard
  • temporary Administrator autologon
  • LogonCount=1
  • a FirstLogonCommands step that disables AutoAdminLogon immediately after bootstrap
  • The template must not retain domain membership, manual IPv4 settings, or server roles.
  • OpenSSH must remain stopped and disabled at capture time.
  • Windows Update is stopped before capture, not permanently disabled.
  • A generalized build must pass a clone boot test before the final template slot is reused.

Acceptance criteria

  • Windows edition matches the approved 2025 Standard Desktop Experience baseline.
  • VirtIO storage and guest tools are installed cleanly.
  • QEMU Guest Agent responds from Proxmox VE 9 using qm guest cmd 4000 ping.
  • PowerShell 7.6.3 exists and runs.
  • No problem devices remain in Device Manager.
  • No forbidden Windows roles are installed.
  • No domain join is present.
  • No pending reboot is present before finalization.
  • Unattend.xml exists before Sysprep.
  • Sysprep is not executed as Local System.
  • The post-capture clone does not prompt for a product key or manual skip during OOBE.

Current VMID 4000 corrected

A clean clone audit on July 18, 2026 found a persistent default route to 172.20.110.1. The image was cleaned, generalized through interactive Sysprep, clone-tested with zero persistent routes, and republished as protected template 4000. The defective template was removed.

Evidence

  • Proxmox config of VMID 4000
  • Guest agent service state
  • PowerShell version evidence
  • Final golden image validation output
  • Clean-clone output proving zero persistent default routes