Using DISM to install Windows updates

Windows’ built-in Deployment Image Servicing and Management (DISM) command, a.k.a. dism.exe, is something of a Swiss Army knife when it comes to working on Windows OS images. Among its many capabilities — such as adding optional Windows features and packages, taking image inventories, performing image cleanups, and more — DISM includes an /Add-Package option. This option allows users to install Microsoft Catalog updates in .cab or .msu files to a targeted Windows image.

.cab is short for “Windows Cabinet,” a type of compressed file that stores data and instructions for Windows that can update device drivers, system files, and so forth. The .msu file extension is associated with the Microsoft Update Standalone Installer. Normally, this installer uses the Windows Update Agent API to install update packages. Both .cab and .msu files also work with the DISM command against Windows image files, which may be of types .wim, .esd, .ffu, or virtual hard disk files of type .vhd or .vhdx.

Note that .msu updates only work on offline images, while the more common .cab files may be applied to an online image to update a running Windows install.

Why use DISM instead of Windows Update?

Good question! Sometimes, DISM provides a way to install an update when Windows Update (WU) may be having issues. At times, Windows Update may simply refuse to work, or it may hang or crash on a particular update. DISM provides a handy way to install updates when WU itself may be unable to oblige.

Other reasons to use DISM instead of Windows images include:

• Managing Windows images for large-scale and/or remote deployments using Microsoft Intune, Windows Autopilot, or Systems Center Configuration Manager (SCCM).
• Slipstreaming drivers or updates into standard Windows images for customization and special deployments.
• As an alternative to user-driven updates from an in-house update server, perhaps during scheduled maintenance periods. Holiday weekends are popular for this kind of thing in large organizations, because they provide an extra day to fix unexpected problems or to roll back to the previous status quo if such problems can’t be fixed.

Where to get Windows Update files

The Microsoft Update Catalog is the most common source for update files of all types, including .cab and .msu. Generally, items are accessed by name (e.g., Realtek Audio Driver) or by Knowledge Base (KB) article number. Thus, for example, KB4023057 is an update that applies to editions of Windows 10 versions 1507 through 1803, intended to clean up and fix any issues with Windows Update that might prevent updates from being installed.

Figure 1 shows the Update Catalog with a portion of one page’s results for KB4023057. Click the Download button in the right-hand column for the version of the file that matches the target OS to get the update.

Ed Tittel/IDG

It you click the Download button for the topmost 1803 item shown in Figure 1, a download window appears. This provides a link to a corresponding .cab file with an extremely long name: windows10.0-kb4023057-x64_58b2f8fd3da37d22fb99bd6aa6c3f69951e67429.cab

Notice that the name includes the Windows version (10.0), the KB number, bittedness (x64 means 64-bit), and a globally unique identifier (GUID), and it ends with the cabinet file (.cab) extension. That makes this item an excellent target for an update through the DISM command.

Figure 2 shows the download page for this chosen item:

Ed Tittel/IDG

The DISM /Add-Package syntax

The DISM command is fully documented online in Microsoft Docs in the DISM Operating System Package… Servicing Command-Line Options pages. This is just a small part of the DISM Tools Reference, another online document worth bookmarking and exploring for those who work with (and on) Windows images.

The manual lays out the abstract syntax for the /Add-Package option as follows:

Dism /Add-Package /PackagePath: [/IgnoreCheck] [/PreventPending]

A /PackagePath can point to a single .cab or .msu file, a folder that contains a single expanded .cab file or a single .msu file, or a folder that contains multiple .cab or .msu files (you can’t mix the two types, however). If /PackagePath points to a folder that contains one or more .cab or .msu files at its root, any subfolders will be likewise recursively checked for such files as well.

The /PreventPending switch instructs DISM to skip installing the package if it, or the targeted Windows image, has any uncompleted actions still pending. This is intended to prevent operating on images that may not be complete or intact.

As already stated, you can add multiple packages within a single DISM command by including multiple .cab or .msu files in the directory that serves as input to the /PackagePath option. Ordinarily, DISM will check each package to make sure it’s applicable to the targeted image. If a package will not apply to that image, DISM will issue an error message. The /IgnoreCheck switch may be used to get DISM to run silently and skip the applicability check for each package.

DISM /Add-Package example

Let’s say I’m running a 32-bit instance of Windows 10 version 1803. If I wanted to apply KB4023057 to that running image, and the .cab file had been downloaded to the path D:Images, Figure 3 shows what that command would look like in Command Prompt or PowerShell. But first, some important notes for clarity, understanding and brevity:

• DISM only works with administrative privileges, so you must be logged into an administrative account and opt for “run as administrator” for your command line environment.
• The /Online switch tells DISM to apply packages to the currently running Windows image.
• I renamed the .cab file to KB4023057 so I could fit everything into a single line of text.

Figure 3 shows the example command in an administrative command prompt window.

Ed Tittel/IDG

To run the command in this format, you must be sure there are no WU transactions pending. The safest way to make sure this is true is to restart the system before running any DISM /Add-Package commands.

Working on offline images is something of a specialty exercise. Here, I’ll simply say that offline images represent images that may be “under construction” or that are maintained in an image library for deployment and/or customization for distribution to users at some kind of scale — maintaining images usually isn’t worth the extra work involved, unless you have at least dozens of users, if not hundreds or more, to whom those images will be served. For more information on using DISM /Add-Package with offline images, see this Microsoft Docs item “Add or Remove Packages Offline Using DISM.”

Common cases when DISM /Add-Package is worthwhile

In my own experience, I’ve used DISM /Add-Package dozens if not hundreds of times. In nearly every such case, that use has been motivated by one of two sets of circumstances:

1. Windows Update isn’t working properly, and I can’t download or install any updates.
2. Some particular update hangs or crashes when I try to install it using WU.

In both of those cases, downloading the .cab file and using DISM /Add-Package will get the update installed successfully on a running Windows image.

If it doesn’t work, this usually indicates deeper problems with Windows. In those rare instances, I next turn to an in-place upgrade install (see my CW story “How to fix Windows 10 with an in-place upgrade install”). If that provides no relief, my companion story “How to repair Windows 10 (and 11) in 4 steps” should set things right.