An error occurs when using DISM /add-package to add "C:\Windows\servicing\Packages\*.mum"

[zyr3344]

When I add features after removing the components, through commands like dism /online /norestart /add-package:"C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum", sometimes an error is reported. This will not occur on unmodified images. I did not remove components related to the functionality added by the commands I used. Does NTLite remove any files that are not related to the removed components?
OS Version 26100.1000

 

[garlin]

I've solved this exact problem before, because someone on Discord did the same thing.

You're using Home Edition, but trying to DISM enable the hidden Group Policy Editor through the .mum trick. This fails because the GPE manifest has a dependency on the Defender policy templates. In order to do both, you must instruct NTLite to protect those files from removal.

1. Study the .mum, and determine which files or packages require NTLite's protection because you removed their parent component.

2. From the Components screen, open the Compatibility window. Add to the Protected file patterns.

View attachment 12829

3. Another trick is to insert the same lines into your preset.

Replace the "22000.1" with the base version of your Windows ("26100.1"), and update the correct path for the WindowsDefender.adml & .admx files. Both of them are found inside the WinSxS folder.

        <Compatibility protectHidden="true">
...
                <ProtectedFiles>
                        <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat</File>
                        <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~10.0.22000.1.mum</File>
                        <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat</File>
                        <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.mum</File>
                        <File>*amd64_windows-defender-group-policy.resources_31bf3856ad364e35_10.0.22000.1_en-us_495a3f2a0abe3c26\WindowsDefender.adml</File>
                        <File>*amd64_windows-defender-group-policy_31bf3856ad364e35_10.0.22000.1_none_709ab10984f13f3f\WindowsDefender.admx</File>
                </ProtectedFiles>
...
        </Compatibility>

 

[zyr3344]

Another trick is to insert the same lines into your preset.

I did so, and this is the line I inserted.

        <ProtectedFiles>
            <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~10.0.26100.1.cat</File>
            <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~10.0.26100.1.mum</File>
            <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat</File>
            <File>*Packages\Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.mum</File>
            <File>*amd64_windows-defender-group-policy.resources_31bf3856ad364e35_10.0.26100.1_en-us_f00a49e46e81c33b\WindowsDefender.adml</File>
            <File>*amd64_windows-defender-group-policy_31bf3856ad364e35_10.0.26100.1_none_174abbc3e8b4c654\WindowsDefender.admx</File>
        </ProtectedFiles>

It's amazing, it works. Thanks for your reply. But there is still a problem. When I unchecked Servicing stack in Compatibility, a new error appeared. Do you know which files are caused this time?

 

[garlin]

1. Why do you need to disable Servicing stack in Compatibility?

If you're going to enable GPE using DISM, mount a clean ISO and perform the same steps on the mounted image before NTLite needs to do any removals. Then you can remove Defender afterwards on the updated image.

DISM /mount-wim /wimfile:C:\path\to\install.wim /index:1 /mountdir:C:\Mount
DISM /image:C:\Mount /norestart /add-package /packagepath:C:\Mount\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-Client...mum

DISM /unmount-wim /mountdir:C:\Mount /commit

It doesn't make sense to remove first, then add a feature.

2. The hack calls for installling two sets of manifests, you're adding other mum's not part of the instructions.

\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum
\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package*.mum