A bit of history here. Windows Deployment Services has been around for quite a number of years, and it uses a file-based deduplication mechanism to conserve disk space.

When we capture an image with WDS, what it is actually doing is creating hashes for all files on the disk and then checking to see if those hashes are present in RES.WIM. Any hashed files not present in RES.WIM are copied up to the server, added to RES.WIM, and then the disk image itself is just a list of hashes to pull out of RES.WIM to reconstruct the image.

Without deduplication, it is to our benefit to only create a single huge imaging group, because for each additional image group there is a new RES.WIM which is independent of the other and may duplicate hashed files from the other RES.WIM. Throw everything into it, XP, Vista, 7, 8, 10, and all of them automatically combine into a single huge RES.WIM hash pool that greatly reduces file storage.

Except RES.WIM has a problem in that we can never shrink it, because WDS cannot know what image files we've deleted and what hashed files it needs to keep. Even if we've deleted all our Win XP images, those files for XP will live on forever in the RES.WIM hash pool.

Apparently the only real way to shrink RES.WIM is to create a new image group, export images from the first one, and import to the new one, which takes up even more disk space, before we can finally remove the old image group to recover disk space. It's extremely unhandy and inconvenient.
,

Though, Microsoft has now come up with sector-based deduplication of drive volumes. Scan in the background, deduplicate identical sectors, and regain free disk space.

This accomplishes the same thing as the file-based deduplication of WDS, but this is now even better, because we can delete deduplicated files and we can recover the disk space used by the non-duplicate parts of the image file.

Sure, we can run both WDS and sector-based deduplication on the same drive, but then we still cannot ever shrink RES.WIM, so the benefits of dedupe + RES.WIM are less than just using deduplication alone.

It seems better to just disable WDS RES.WIM file hashing completely, save all images as raw huge file collections in separate WIMs, and then let the nightly optimization shrink the WIM image disk usage to nothing, merging its content with other WIM images previously saved to the deduplicated drive.

If we then delete unneeded images, we will recover disk space as expected, and disk usage will not just grow forever as with the current RES.WIM file dedupe.

Posted on Windows forums here:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/c33ce755-8c02-4f1c-94b9-2ac5cb79c794/2016-wds-deduplication-disable-reswim-usage?forum=winserversetup#c33ce755-8c02-4f1c-94b9-2ac5cb79c794

This is a security issue.

Hello

It's really strange that we use operating systems which do not describe its executables and their eligibility to access the internet.

If we monitor which programms access the internet on a Windows Machine, then we really often have to google for its executable name and just get informations like "we do'nt know what it does, but it is probably safe to allow internet access".

Therefore, please:
1) Finally, create a professional application & service architecture. No, to route everything over svchost.exe is not a secure design. Not at all.

2) Finally, create a datasheet for each executable and answer those questions:
a) For what is it responsible?
b) Is it a helper for a superior Function? (e.g. Hyper-V probably has different executables and services)
c) Does it need access to the LAN? Why?
d) Does it need access to the Internet? Why?
e) What kind of Data is transmitted?

We expect to get all knowledge, so that we are sure what we are doing when we create outgoing firewall rules.

Everything else is reckless.

Kind regards,
Tom

I recently downloaded Server 2016 from my VL portal, got it installed/configured for testing, and I just thought I would share my discontent with the product (or unimpressed is likely a better wording). This does not require any input from anyone, or have any questions that need to be answered.

I dislike that they removed the ability to convert from GUI to Core, or Core to GUI. That was a great feature! Sorry I am not a PowerShell guru, but these feature allowed me to be flexible. Add this back in! I read your reasoning online. Find a way to overcome it; it worked before, you can make it work again.

Why all the extra services installed by default (even if disabled / set to manual)?

Xbox Live Game Save
Xbox Auth Manager
AllJoyn Router
ActiveX Installer
MapsBroker (download service)
Windows Mobile Hotspot Service

...the list goes on. Why? Just why? This isn't needed... All you need is what is required. Even the print spooler service, why is still even there by default? Trim the server install down to what is required to run itself. Let me install what I want from there. I don't even want to see it as an item/service/other, unless I install the feature/role.

What about HA/Clustered Printing? Why do I have to use Hyper-V? I haven't actually checked this, but I know this was the only 'supported' way to get HA printing in Server 2012R2.

My next complaint isn't huge, but why would you include IE11, but not Edge by default? This isn't an issue, just a source of confusion since it is in Windows 10 by default for both.

When will you stop doing what you want, and focus on doing what we, the admins, want?

Just me complaining.

In my opinion Microsoft is following a wrong paradigm when it comes to providing server admins with context based background information while working on a server desktop.
It is regarding the use of referrals in the interface to sources on the internet in order to provide the administrator with more information. I know that, when Microsofts recommendation is followed and the core version is chosen, this is no issue at all, but since several server implementations still require the full graphical version (e.g. Exchange Server 2016) and many IT organisations still choose to use RDS for server administration, many admins will still be faced with this phenomenon.

An example: While on the desktop in an interactive session of a Windows Server 2016 machine, I click start -> settings (leftmost part of the startmenu), in the settings window I click “update & security”. Right at the bottom there is a link “Learn more”. Clicking on this link causes Internet Explorer to open in IEESC mode. The page that IE tries to open however needs Java script to be enabled, and without Java script enabled, no content is shown.

And this is my main concern: The Windows interface provides the admin with links that encourage enabling features that undermine security best practices.

What makes it even worse: there is no alternative way to obtain the information via another PC (e.g. from a RD session, copying the link and paste it in the browser of your admin PC), so the admin is forced to configure the server in a manner that conflicts with security best practices (best is to avoid using a browser at all, is my opinion, but apparently that is not Microsofts point of view).

I would like to encourage Microsoft to move to text-only referrals/urls or provide at least a way to copy the link to the clipboard. If that is not feasible somehow, make the web pages behind these links as plain as possible, so there is no need for browser extensions on the server.