Windows 8 UEFI Imaging Tips

From FOG Project
Jump to: navigation, search

The below steps work with Windows 8, 8.1, and Windows 10.

Steps for imaging Windows 8 with UEFI install.


  1. Disable Secure Boot NOT ALL BIOSes "TRULY" ALLOW THIS CURRENTLY. Motherboard ASUS H81M-A, from personal experience falsely tells you it's disabled, but it doesn't ever actually happen.
  2. Enable the Legacy Boot Option (You may have an option in Advanced Boot Options to Enable Legacy ROMS. You want to check this, as well to allow the legacy PXE to appear)
  3. Restart and register the machine in Fog. Registration can happen anytime before if you can do it.'
  4. Create the capture task in the Web GUI.
  5. Restart and capture your image.
  6. On the machines to be imaged, repeat steps 1-3.
  7. Create the download task in the Web GUI, if you aren't using Capone.
  8. Restart the machines and download the image.
  9. (optional) Re-enable Secure Boot. (You will probably have to disable legacy boot option and legacy ROMS in order to do this.)
  10. Reboot

Windows 8, 8.1, and 10 Imaging Problems

The "Dirty Bit"

If you received this message (or a very similar one) from Partclone, it means that the Windows "Dirty Bit" is turned ON:

ntfsclone-ng.c: NTFS Volume '/dev/sda4' is scheduled for a check or it was shutdown uncleanly. Please boot Windows or fix it by fsck.

Partclone Windows Dirty Bit.jpg

The Windows "dirty bit" is set ON when:

  • There are pending Windows updates
  • There is a pending restart
  • Fast Startup is enabled
  • Windows is hibernated
  • Windows is improperly shutdown
  • There is a chkdsk scheduled
  • Data corruption is detected

There are a number of ways to clear the dirty bit, but the best and easiest ways are to simply not have updates pending, disabling fast startup, shutting down windows properly, not having chkdsk scheduled, and having non-damaged HDDs and non-damaged partitions. AFTER making the necessary changes to clear the "dirty bit", windows should be restarted at least two times for it to clear properly.

Windows "Fast Startup"

Windows 8.0, 8.1, and 10 (and most likely future Windows versions) have a feature called "Fast Startup". This feature basically sets windows so that a hibernation occurs whenever the system is shutting down. This enables Windows to startup much faster than in past Windows versions. Because this feature is on by default, the windows OS partition has a hibernation file which prevents mounting and imaging via FOG, and also marks the OS partition's "Dirty Bit" to ON. Even when hibernation and fast startup is disabled, the hibernation file remains and the "Dirty Bit" remains ON and these things causes problems. There are a few ways to fix/get around this.

Way 1 (clean method)

Disable: "Turn on fast startup", located here: Control Panel (Classic View) -> Power Options -> Choose what the power button does -> Change Settings that are currently unavailable -> "Turn On Fast Startup & Hibernate"

Both of those settings should be turned off for use with FOG. They may be turned on at a later time via GPO or snapins.

Shutdown and then boot the system.

Then run this command from an elevated command prompt to disable hibernation and remove the hibernation file:

powercfg.exe /H off

Now you can shut down and reboot once or twice, and then capture your image via FOG.

Way 2 (A little hackish)

When you're ready to capture an image, do not shut down the computer. Instead, tell it to restart. The middle point of the restart is when the OS stops, and control is handed over to the system's firmware. When POST is happening, do your typical procedure to network boot and the image should capture.

This is because without changing the settings (in way 1), a shutdown is actually a hibernate. A restart is the only real way to take the system down fully without changing settings. The reboot causes the system to shutdown fully, thus clearing the "dirty bit".

Way 3 (Very hackish, not clean)

This method is just as viable but not as clean or easy and requires timing.

You would open an elevated command prompt and then run:

chkdsk /F

Answer yes to schedule the checkdisk at the next reboot.

Now you would reboot and allow the checkdisk to run. At some point during the check disk (which may not be at 100%), check disk will tell the sytem to reboot.

At this moment, you need to boot to the network and capture your image to fog. If you miss this moment and windows boots, you will have to re-run chkdsk.

Resources used

Major resources:

Minor resources:

UEFI and BIOS coexistence / together

See this article: