Tag: Feature

[Win10] Offline installation of FoD like OpenSSH Server without VLSC ISO

Windows 10 comes with a lot of additional options to install, which are not part of the "local" installationmedia.
That means things like e.g. the OpenSSH Server component. These options are called "Features on Demand" (FoD) and do need either an active internet connection to download and install, or a specializied FoD ISO which you only can download from the Microsoft Volume Licensing Service Center (VLSC). If you need to install these options for your Windows 10 Professional or similar offline - without having a valid subscription, you cannot get the needed offline files that way.

However, there is another option by using a second computer with the same Major Release (e.g. Windows 10 1909 / 2004 / or 20H2 aka 2009) and possible latest patches installed to grab those files from the internet and then use these for offline installation.

Example, we want to get the OpenSSH Server package for Windows 10 20H2 / 2009 and install it offline afterwards.

  1. Get a Windows 10 20H2 computer connected to the internet, patched to latest version
  2. Download Everything ( https://www.voidtools.com/ - the portable version will do ) - this is a tool to scan for changes in the windows filesystem
  3. Start it, if it asks for admininistrative rights, say yes
  4. Enter "C:\Windows\" in the search path, so that only changes in the Windows path will be shown in Everything, so that you don't drown in information

5. Open an admininistrative Powershell - you can know search for the latest version of the FoD package you want to install, like
Get-WindowsCapability -Online |? Name -like 'OpenSSH.Server*'

This will get us info like:

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent
  1. Now, this is were it gets tricky. You need to start the download of the package, track it traversing through the filesystem with Everything and copy it before it gets deleted again by Windows after installation. You might need to repeat the process several times, but here it is in a full write up

6a. Enter
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
which will start the download & installation

6b. Watch the Everything window. At some point a cab file with OpenSSH will pop-up within the C:\Windows\SoftwareDistribution\Download folder. Select that file. And press CTRL+C to copy it.

6c. Move the focus of the mouse to your Desktop or other folder, at some point the file path of the selected file will change to C:\Windows\CbsTemp because it was done with downloading and will start to be installed. Your selection and copy will still be valid and now target this new file. Hence you need to hit CTRL+V to paste/copy it to your desktop fast, because it will disappear within seconds.

6d. If everything went ok, you will have the cab file with some MB size (in case of OpenSSH-Server-Package~31bf3856ad364e35~amd64~~.cab its just ~1.22 MB) and thats what we need. If you were to slow, you can try again by uninstalling the OpenSSH Server via powershell using
Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
then start at 6a and repeat until it works

6e. One word of caution - the filename will stay the same for all Windows 10 Release Versions. So it would be wise to put it into a folder with the version name - so that you don't mix up differnt versions. Also don't change the filename of the cab file, otherwise it cannot be used for installation anymore.

  1. Move the file to your target / isolated system.
  2. Powershell with Admin Rights to the correct folder with e.g. OpenSSH-Server-Package~31bf3856ad364e35~amd64~~.cab in it, then execute the installation command:
    Add-WindowsCapability -Online -Name "OpenSSH.Server~~~~0.0.1.0" -Source "." -LimitAccess

It is going to be installed. But as additional stuff…

// Set Services to Autostart
Set-Service sshd -StartupType Automatic
Set-Service ssh-agent -StartupType Automatic
// Check if Firewall Rule is activated
Get-NetFirewallRule -Name *ssh*
// There should be a firewall rule named "OpenSSH-Server-In-TCP", which should be enabled
// If the firewall does not exist, create one
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
// Configuration of OpenSSH Server
// You can set Powershell as default shell
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force
// Start Service 
Start-Service sshd
Start-Service ssh-agent