Sysdiff - Windows NT/2000's secret deployment tool

Sean Stecker

In networked environments of over 10 machines, software deployment by hand has become a nightmare.  As software has become more complicated, so to have the installation routines.  From specific installation directories, to component options, to bundled add on applications, sometimes installing the software with the same options on all of your machines is more difficult than actually using it.  Not to mention the 15 different tech support personnel who install it in their own "special way".  System reliability and consistent troubleshooting demand a "cookie cutter" like deployment of all software.

In networked environments of over 10 machines, software deployment by hand has become a nightmare. As software has become more complicated, so to have the installation routines. From specific installation directories, to component options, to bundled add on applications, sometimes installing the software with the same options on all of your machines is more difficult than actually using it.

There are many third party utilities on the market today that allow you to package and deploy Windows NT/2000 based applications.  A great deal of them allow after packaging manipulating of files and command lines to be included within the package. 

As many of us have found, sometimes these third party applications can sometimes give us too much leeway, causing us to add too much fluff to what started out to be a "simple install".  Inevitably causing the install to fail, especially in an automated installation environment such as SMS.  Microsoft Windows NT 4 and Windows 2000 Resource Kits include a utility called Sysdiff.exe that allows a before and after "snapshot" of your machine, to catch those installation files, and bundles them nicely into a simple installation file. 


Version control

Please note that packages created under Windows NT 4 using Sysdiff cannot be installed to a Windows 2000 machine, and vice versa.  Furthermore, packages created using either version cannot be installed on a Windows 95, 98, or ME machine.


Sysdiff components 





Copy sysdiff.exe and sysdiff.inf from your Resource Kit directory into the \winnt directory on your test/deployment machine.  (Note:  It may be a good idea to bundle these files into your standard image so that no matter which machine you use to create software packages, you will always have this tool available.  See my article Using Sysprep to deploy Windows 2000 Professional to see how to incorporate extra files into your standard image.)  

You can edit sysdiff.inf to further exclude certain directories from the discovery snapshots.  I added the directory *:\winnt\ms to exclude the local SMS directories on our workstations.  This directory and its files are updated constantly by SMS.  If you use SMS in your organization, you may want to do the same.


How it works 

Sysdiff is run on your test machine before your intended software is installed.  This "snapshot" makes a record of all the files and registry hives on your workstation, and records their current state.  This will be compared to your "after snapshot" to determine the files needed for your installation.  Your "after snapshot" is the actual file that will be applied to your target machines to install the intended software.  All files are appended with the .img extension to indicate a sysdiff image file.  

From a command line, run the before snapshot: 

Sysdiff /snap before.img 

This will open the sysdiff window, and begin its inventory of your machines current state.  We have specified the file "before.img" to hold the contents of our discovery. 

Next, install your application according to the manufacturer's instructions, or your environments specific needs. 

Again, from a command line, run the after snapshot: 

Sysdiff /diff before.img application.img 

The sysdiff window opens again, this time comparing the updated state of your machine in relation to it's previous state as indicated in "before.img".  Those differences are noted and then ported to the file "application.img" (or whatever you have named it). 


Sysdiff command options 

/snap - used to create the "before snapshot" 

/diff - used to create the "after snapshot" 

/apply - used to apply the application image to the system

/m - applies software file changes to the default user profile so software will be applied for all users.

/q - runs the apply mode quietly (errors that are generated are also not displayed) 

/dump - outputs the contents of sysdiff package to human readable format 

/inf - applies sysdiff packages to a deployment/distribution directory and generates the $OEM$ directory tree.  Best used with unattended setup of the Operating System.   


Preparing for deployment 

You are now ready to build your application directory on your network share.  Move the file "application.img" from your test workstation to your network shares specific application directory (ie. Acrobat4).  Also copy the files sysdiff.exe and sysdiff.inf to this directory.  In this example, we will be creating the installation batch file for the Acrobat Reader 4.0 package.  

We must now create our installation batch file that will apply this application image to your workstation.  In this example, we will name our batch file "install.bat" 

Contents of install.bat: 

@echo OFF

\\dc1\dist$\acrobat4\sysdiff.exe /apply /m \\dc1\dist$\acrobat4\acrobat4.img  



We now have a very solid, reliable, completely hands free installation of our application.  You can further reduce the chance of erroneous installations by restricting your support personnel's access to your software media.  With no options to misconfigure, you can assure yourself of repeatable, reliable installations throughout your organization.   

Sysdiff documentation states that sysdiff is used to apply very small applications.  I have successfully created sysdiff packages up to 784 Mb in size.  In my book, that is NOT a small application.  Acrobat Reader 4.0 is approximately 5 Mb. 

Utilizing sysdiff packages in an SMS environment is extremely beneficial as well.  With it's relatively simple procedures and installation process, failure rate on SMS packages created with Sysprep are much lower than those created with some third party applications.  It all goes back to the old saying "The more moving parts it has, the more likely it is to break". 


Known limitations 

Aha!!!  You knew there had to be a catch didn't you?  Here are some limitations that I have run across with Sysdiff: 

  1. Sysdiff has a difficult time with applications that require a restart.  Some will work, others will not.  Experiment.  I have had success with performing the "after snapshot" just prior to the reboot, then incorporating the restart into my sysdiff installation.
  1. Sysdiff cannot be used to install Internet Explorer or Netscape Navigator.  There are some very useful scripts for unattended installation of Internet Explorer using SMS.  I use it in my organization and I swear by it.
  1. Sysdiff cannot be used to install Office 2000 products.  Or Office 97 for that matter.  But I used it to create our Project 98 image, go figure.
  1. Sysdiff has problems with Windows Installer based applications.  I have created ONE successful package that was based on Windows Installer technology.  I have tried MANY others and failed.

There may be others that I have not run across.  If you find other limitations, let me know and I will update this article to reflect them. 



Sysdiff can be used to effectively deploy the majority of your company's software applications on Windows NT 4 and Windows 2000.  It's ease of use and simplistic nature make it an easy choice to assist you with your deployments.  As an IT Professional, it is your job to reduce the amount of support and downtime your organization.  Repeatable software installation is one area that will allow you to trim your support costs immediately.

This article was originally published on Dec 5, 2000
Page 1 of 1

Thanks for your registration, follow us on our social networks to keep up-to-date