Skip to content

P02-T08 - Windows 11 IoT Enterprise LTSC Golden Image

Objective

Build a reusable Windows 11 IoT Enterprise LTSC template for dedicated-purpose endpoints, validate the post-capture clone, and only then publish the approved template as VMID 4003.

This runbook exists because Windows 11 IoT Enterprise LTSC must be treated as a separate platform standard from the general corporate workstation template.

This runbook is an image-engineering exception to the normal Windows operations model in this guide. Where guest-side automation is needed during image construction, QEMU Guest Agent remains valid as the transport because the objective here is template engineering and clone validation.

Use it for:

  • kiosks
  • signage
  • point-of-sale
  • healthcare or industrial endpoints
  • single-purpose or limited-purpose application devices

Do not use it for:

  • standard office workstations
  • general-purpose laptops
  • developer endpoints
  • normal productivity desktops

Sources

  • Microsoft Learn: Windows IoT Enterprise overview
  • https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/overview
  • Microsoft Learn: Windows IoT Enterprise licensing
  • https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/commercialization/licensing
  • Microsoft Learn: Windows 11 IoT Enterprise LTSC lifecycle
  • https://learn.microsoft.com/en-us/lifecycle/products/windows-11-iot-enterprise-ltsc-2024

Inputs

Key Value
Build VMID 4015
Validation clone VMID 4043
Final template VMID 4003
Template name TPL-W11-IOT-LTSC
Required OS caption Microsoft Windows 11 IoT Enterprise LTSC
Build IP 172.20.110.32/24
Build gateway 172.20.110.1
Build DNS 1.1.1.1, 9.9.9.9
Validation VLAN 30
PowerShell target version 7.6.3

Target State

Property Value
Edition Windows 11 IoT Enterprise LTSC
Firmware OVMF
Machine type q35
TPM v2.0 present
Secure Boot Enabled through enrolled keys
CPU 2 vCPU
Memory 4096 MB
Disk 64 GB
Guest agent Enabled
PowerShell 7.6.3
Domain joined No
Static IP retained in template No
First cloned boot behavior completes OOBE without product-key or skip prompts

Design guardrails

  • Windows 11 IoT Enterprise LTSC must be explicitly validated by OS caption. If the installed OS reports only Windows 11 Enterprise LTSC, do not treat the build as IoT.
  • Sysprep must be launched from an interactive local administrator session, not through QGA.
  • The generalized build must pass a clone boot test before 4003 is published as the approved template.
  • Any snapshot chain must be removed from the source VM before qm template.

Validated lab outcome

This guide now reflects a successful lab validation with:

  • build source 4015
  • validation clone 4043
  • final template slot 4003

Validated clone result:

  • Caption: Microsoft Windows 11 IoT Enterprise LTSC
  • OOBEInProgress: 0
  • SystemSetupInProgress: 0
  • ImageState: IMAGE_STATE_COMPLETE
  • DHCP address on VLAN 30
  • PowerShell 7.6.3
  • QEMU-GA: Running / Automatic

Execution summary

  1. Build 4015 from media that exposes the IoT Enterprise LTSC edition.
  2. Install QEMU Guest Agent and VirtIO guest tools.
  3. Configure temporary build networking on VLAN 110.
  4. Install PowerShell 7.6.3.
  5. Apply updates and verify no pending reboot remains.
  6. Create rc1-pre-sysprep.
  7. Run cleanup and reset the NIC to DHCP.
  8. Stage C:\Windows\Panther\Unattend\Unattend.xml with:
  9. temporary local administrator autologon
  10. LogonCount=1
  11. FirstLogonCommands disabling AutoAdminLogon
  12. Launch Sysprep interactively with:
Start-Process `
  'C:\Windows\System32\Sysprep\Sysprep.exe' `
  -ArgumentList '/generalize','/oobe','/shutdown','/mode:vm' `
  -Wait
  1. Clone the stopped generalized source to 4043.
  2. Validate the clone on VLAN 30.
  3. Delete snapshots from 4015.
  4. Remove installation ISOs.
  5. Convert 4015 to template.
  6. Replace the final template slot by publishing the validated result as 4003.

Validation requirements

Do not approve 4003 until the validation clone confirms all of the following:

  • Caption: Microsoft Windows 11 IoT Enterprise LTSC
  • OOBEInProgress: 0
  • SystemSetupInProgress: 0
  • ImageState: IMAGE_STATE_COMPLETE
  • no product-key or first-boot wizard prompt remains
  • DHCP: Enabled
  • valid lease on the validation network
  • PowerShell 7.6.3
  • QEMU-GA: Running / Automatic
  • PartOfDomain: False

Publication rules

Before qm template:

qm listsnapshot 4015
qm delsnapshot 4015 rc1-pre-sysprep
qm listsnapshot 4015

Then:

qm set 4015 --delete ide2
qm set 4015 --delete ide3

qm set 4015 \
  --boot order=scsi0 \
  --description "Windows 11 IoT Enterprise LTSC golden image. Validated, generalized with Sysprep, QEMU Guest Agent enabled, PowerShell 7 installed, clone-tested. Dedicated-device baseline only. Do not start directly."

qm template 4015

After that, publish the approved final slot:

qm destroy 4003 --purge 1 2>/dev/null || true
qm clone 4015 4003 \
  --name TPL-W11-IOT-LTSC \
  --full 1 \
  --storage local-zfs

qm set 4003 \
  --boot order=scsi0 \
  --description "Windows 11 IoT Enterprise LTSC golden image. Validated, generalized with Sysprep, QEMU Guest Agent enabled, PowerShell 7 installed, clone-tested. Dedicated-device baseline only. Do not start directly."

qm template 4003

Evidence

  • Output confirming Caption: Microsoft Windows 11 IoT Enterprise LTSC
  • Output of the pre-capture validation
  • Output of the validation clone on 4043
  • Output of qm listsnapshot 4015
  • Output of qm config 4003
  • Output of qm status 4003

Rollback

  • Restore 4015 from rc1-pre-sysprep if answer file or cleanup must be redone.
  • Destroy and rebuild if the installed OS caption is not IoT Enterprise LTSC.
  • Never promote a build to 4003 if the validation clone still shows any OOBE friction or wrong edition.