Problem
I tried to create images of Windows 7 and Windows 10 (1607, 1703, 1709) with a SCCM Build and Capture Task Sequence. I deployed the January Windows Updates to the imaging clients so that the images should include the fixes for the Meltdown and Spectre vulnerabilities. But unfortunately this did not work. The reason is that the Antivirus compatibility Registrykey mentioned in this article had not been set before the updates were installed.
Update: After testing Build and Capture of Windows 10 with MDT I have added the necessary steps to the article.
Update 2: Thanks to @manelrodero for pointing out that a reboot is not required between setting the key and the Install Update step.
Update 3: Microsoft announced that this is not longer necessary beginning with the Cumulative Update 03-2018
Solution
You just have to add the registry in your Build and Capture sequence right before the update step performs the update scan.
SCCM
- Add a Run Command Line Step to your Build and Capture Task Sequence before the Install Updates step containing the following line
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" /v cadca5fe-87d3-4b96-b7fb-a231484277cc /T REG_DWORD /D "0x00000000" /F
2. Make sure that the box Evaluate software updates from cached scan results is not checked in the first Install Updates step.
MDT
- Add a Run Command Line Step to your Build and Capture Task Sequence before the Windows Update (Pre-Application Installation) step containing the following line
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" /v cadca5fe-87d3-4b96-b7fb-a231484277cc /T REG_DWORD /D "0x00000000" /F
