BootBuilder — Build Custom USB/ISO/WIM

EasyDeploy.BootBuilder is a Windows workstation application for building custom USB/ISO/WIM WinPE media. The tool prepares resources in the .cache folder, integrates hardware drivers, and exports a bootable ISO image to be written to USB, or a boot.wim for existing PXE/WDS servers.

Note

Refreshed interface: the latest BootBuilder shares the new EasyDeploy look with light and dark themes (dark by default) and a reorganized layout, while the engine and build logic are unchanged. Both build actions live in one window: Build ISO and Build WIM.

Note

Eligibility: BootBuilder is available for all tiers. Both Free and Advanced can build — the only difference is the number of profiles copied into the media. For details, see License Tiers.

Caution

Antivirus warning & binary integrity: EasyDeploy.BootBuilder.exe is not Authenticode-signed yet, so some antivirus products may flag it on launch — add it to the exclusion list if that happens. That does not mean the file is unchecked: each release ships a detached .sig, and the tool verifies its own signature on startup. If the .sig is missing, the binary was modified or the file was renamed, it refuses to run (fail-closed). Keep the .sig next to the .exe and always download from the official link.

1. Prerequisites

1. Download the toolkit containing EasyDeploy.BootBuilder.exe and the links.md guide (distributed by CoreSystem). Launch with administrator privileges (Run as administrator).
2. On first launch, the application automatically creates the .cache folder alongside the executable. It also initializes a configuration template (user-config.json) and 2 default profiles. You only need to add the required files to the correct subfolders inside .cache (see table below) — do not delete .cache.

Resource Inventory in the .cache Folder

Folder	Contents	Required
esd\	Windows 11 installation ESD file (*.esd format)	✅
apps\	EasyDeploy binary, its .sig and system-config.json	✅
pwsh\	PowerShell 7 zip for WinPE: win-x64 (x64 target) or win-arm64 (ARM64 target)	✅
downloads\	Hardware drivers organized by vendor: dell\, hp\, intel\, intel-wifi\, lenovo\, others\	⭕
wallpaper\	Image wallpaper.jpg or winpe.jpg for WinPE background customization	⭕
usb\	USB payload: folder EASYDEPLOY\ (configurations, profiles), .lic license + Softwares\ (Portable rescue tools)	⭕

Note

Target architecture: BootBuilder keeps two caches — .cache (x64) and .cache-arm64 (ARM64) — and the TARGET selector decides which one is used. See ARM64 media for the ARM64 specifics.

Caution

The tool operates fully offline and does not automatically download resources from the internet. You must download and place them in the correct folders in advance. Missing a required file → the UI shows a red warning; open links.md for download links. Missing an optional file → yellow warning, build will still succeed.

Caution

For security, BootBuilder verifies the signatures of EasyDeploy.exe and EasyDeploy.exe.sig to confirm they are authentic files supplied by CoreSystem before allowing the ISO build.

System Software Requirements (one-time setup on the workstation)

Component	Technical Notes
Windows ADK + WinPE add-on	Install the same ADK version, compatible with the Windows ESD version in use. In the ADK installer, under Select the features you want to install, select at least Deployment Tools.
PowerShell 7.4+	Required for the build engine (runs on the build workstation).
PowerShell 7 WinPE payload	The zip under pwsh\ must contain a native pwsh.exe for the selected target: PowerShell-7.x-win-x64.zip or PowerShell-7.x-win-arm64.zip. Required for both targets.

Note

ADK setup: the Windows PE add-on is a separate installer and must be installed alongside the ADK. BootBuilder only recognizes the ADK when the ADK feature Deployment Tools and the WinPE add-on are both present.

Note

The current ADK is 25H2, which supports ESDs with build 26100 (24H2), 26200 (25H2) and 26300 (26H2).

1.1 The Windows ESD — what the build expects

• Architecture must match the target. The file name contains x64FRE for x64 and A64FRE for ARM64. A mismatch is reported in the pre-check before any build work starts.
• Any Germanium-core build works — 26100 (24H2), 26200 (25H2) and 26300 (26H2) share the same core. There is no “required” build.
• Edition: the import walks Enterprise → Pro → Pro N → Home → Education and takes the first that exists, so a consumer ESD without Enterprise lands on Pro. That is expected, not an error.
• Language: the installed image keeps the ESD’s own language; the WinPE / Windows Setup UI is always en-US.
• A new ESD creates a new build folder (.cache\os\<build>\) — the previous build stays untouched. Delete it to reclaim space.

2. Pre-check

Launch the tool → click Refresh Precheck → Ensure all items show a green check (✓) before building the ISO:

Check Item	Required	Technical Meaning
PowerShell 7.4+	✅	Script build execution environment.
PowerShell 7 (WinPE payload)	✅	The zip under pwsh\ contains a native pwsh.exe for the selected target (win-x64 / win-arm64). A mismatch blocks the build.
ADK + WinPE add-on	✅	Windows ADK development toolkit, must be compatible with the ESD file.
ESD (.cache\esd)	✅	Validates existence of the source OS installation file.
Apps (.cache\apps)	✅	Complete EasyDeploy binaries and system configuration file. BootBuilder verifies the YubiKey signature of EasyDeploy.exe to ensure the file has not been tampered with.
Drivers (.cache\downloads)	⭕	Required only when the target device needs specific network or storage drivers.
Wallpaper (.cache\wallpaper)	⭕	Background image. If missing, the default background is used.

Note

The Apps pre-check will report Signature verified (YubiKey signed by CoreSystem) when EasyDeploy.exe is intact. BootBuilder has the public key embedded to verify it — if EasyDeploy.exe fails signature validation, ISO building will be blocked. This safety gate prevents you from creating a USB from a repacked file.

3. Building Media — Build ISO or Build WIM

Both actions share the same pre-check, license selection and driver selection. Pick the output that matches your boot method:

Action	Output	Use for
⚙️ Build ISO	bootmedia.iso (+ bootmedia_ca2023.iso)	USB (Rufus), disc, or a general-purpose bootable ISO.
📦 Build WIM	boot.wim (under .cache\os\<build>\pxe\)	Existing PXE/WDS servers that boot a WinPE image over the network.

3a. Build ISO

1. When all pre-check conditions pass (green checks), click ⚙️ Build ISO to start.
2. Select license (if applicable): The EasyDeploy License dialog will prompt Do you have an EasyDeploy license to unlock all features?

   • Select Continue without license — build in Free mode: only the 2 default profiles (1.Tweaks, 2.TweaksApp) are copied into the ISO.

   • Select I have a license → the .lic file picker opens directly → choose the file (digitally signed, bound to USB-SN) → BootBuilder verifies it and saves it to .cache\usb\EASYDEPLOY\ → build in Advanced mode: unlimited profiles are automatically copied into the ISO. The license is also embedded into the ISO automatically, so you don’t have to copy it to the USB by hand later (a step that is easy to forget). If the file is rejected (invalid, expired, or not an advanced license), the tool explains why and offers to choose another one.

   • Driver Selection: 6 toggles for driver packages (Dell, HP, Intel Ethernet, Intel Wireless, Lenovo, Others) — default ON. Enable only the vendors matching your target hardware. Disabling a driver package only excludes it from the ISO and will not cause a build failure.

     • ARM64 targets: the Dell/HP/Intel/Lenovo toggles are disabled (vendor packs are x64-only) — only Others is available.
     • Others option: For devices not covered by the 5 groups above. Extract the driver package (containing *.inf files) into .cache\downloads\others\ (each subfolder = 1 driver package); the tool will automatically integrate it into the ISO.

Note

The Dell, HP, Intel, Lenovo + WinRE driver packs cover most office PCs. Others is only needed for specialized models (Acer, Asus, Japan/Korea/China domestic models). You must use WinPE 10/11 drivers, not regular Windows drivers, to avoid conflicts.

• CA2023: Also generate bootmedia_ca2023.iso — an ISO supporting Secure Boot with the CA 2023 certificate set (the updated certificates for newer firmware/machines). Default OFF — enable only when Secure Boot is enabled on the target machine.

3. Click OK — Start Build to package → Monitor progress and logs in the Console Log window:
   • First build: 22–25 minutes (system initializes structure and cache).
   • Subsequent builds: Approximately 12 minutes.
4. Output files: bootmedia.iso (and bootmedia_ca2023.iso if the CA2023 option is enabled). Select 📁 Output Folder to open the folder containing the ISO, or 💾 Save Log to export the build log.

3a.1 CA2023 media — when to use it

bootmedia_ca2023.iso boots through a boot manager signed by Windows UEFI CA 2023, so it only works on firmware whose Secure Boot DB already contains the CA2023 certificate. The standard bootmedia.iso (CA2011) is always produced alongside it, so enabling the toggle never leaves you without a bootable image. If the CA2023 ISO reports a “Security Violation”, use the standard ISO.

Description	Link
Microsoft blog — Updating Microsoft Secure Boot Keys	https://techcommunity.microsoft.com/blog/windows-itpro-blog/updating-microsoft-secure-boot-keys/4055324
CA2023 status check tool (CheckCA2023)	https://github.com/claude-boucher/CheckCA2023
Script to update CA2023 in the Secure Boot DB	https://github.com/mathisokle/SecureBoot-CA2023-Automatic-Update

Caution

Writing the ISO to USB: Use Rufus to write the ISO to a bootable USB. If you need to copy the .esd file (>4 GB) to the USB, the USB must be formatted as NTFS (FAT32 does not support single files >4 GB). Select NTFS in Rufus before writing.

3b. Build WIM (PXE/WDS)

A supplementary option for teams that still use a WDS/PXE server — not the main (USB-based) workflow. Use it when you only need the WinPE boot image; no ISO is produced.

1. When all pre-check conditions pass, click 📦 Build WIM. There is no license dialog and no license check — the build starts right away.
2. Driver Selection: identical to the ISO flow. CA2023 is not applicable in WIM mode (no ISO is emitted), so the toggle is disabled.
3. Click OK — Build WIM → the engine injects the payload inside the image (X:\EASYDEPLOY\Profiles, X:\EASYDEPLOY\user-config.json and X:\Softwares) so profiles, configuration and tools are available over the network.
4. Output: .cache\os\<build>\pxe\boot.wim. Serve this image from your WDS/PXE server.

Note

PXE always runs in Free mode. A PXE boot has no USB, and the offline license is validated by USB-SN bound to the .lic — so there is no license mechanism in WIM mode, and all advanced features are off. Only the 2 default profiles (1.Tweaks, 2.TweaksApp) are used.

4. USB Directory Structure After Packaging

[USB]:
├── bootmgr, bootmgr.efi
├── Boot\  EFI\  en-us\  sources\     ← WinPE boot partition (EasyDeploy.exe integrated in boot.wim)
├── EASYDEPLOY\
│   ├── user-config.json               ← Deployment configuration
│   ├── license.lic                    ← Offline license (place here, embedded into ISO)
│   ├── Profiles\                      ← Custom profiles (default 1.Tweaks and 2.TweaksApp)
│   └── OS\                            ← (Optional) Offline/hybrid OS installation source
└── Softwares\                         ← Portable rescue software and tools

5. Quick Customization

Goal	Action
Change WinPE wallpaper	Place an image named wallpaper.jpg or winpe.jpg in .cache\wallpaper\
Customize post-install Profile	Edit configuration or scripts in usb\EASYDEPLOY\Profiles\ — Free: 2 profiles, Advanced: unlimited (details bundled with Advanced .lic)
Add rescue tools	Copy Portable software into usb\Softwares\ (apps are not included in the release package — bring your own; keep the toolPaths folder structure or declare it in user-config.json; unlimited count — extras run via F6/F8/cmd)
Add drivers for other vendors (Others)	Extract the driver package containing *.inf into .cache\downloads\others\ (each subfolder = 1 driver package). Use the vendor’s WinPE 10/11 drivers.
Select driver packages	Use the toggle switches in the build settings UI

6. Safe Operation Recommendations

• Power: Disable automatic sleep during the build (especially the first build, ~22–25 minutes) to avoid interruption.
• Conflicts: only one BootBuilder instance can run at a time — the tool enforces it, because two instances would share the cache and a DISM mount. Use one instance per cache/architecture.
• Power loss: If interrupted, relaunch the tool — the system automatically cleans up temporary files and resumes normally.

7. Next Steps

After successfully exporting the ISO: Write the ISO to USB with Rufus → configure user-config.json for the customer (see Getting Started with EASYDEPLOY or Quick Start) → hand over the USB to the technician or customer.