Operational processes for keeping your VDI or PVS gold image updated

Posted by on May 7, 2014 in View, XenDesktop | 3 comments

I often get asked about “How do I keep my gold image update to date” in a VDI environment. Does not matter if we are talking about VMware View or Citrix XenDesktop, customers of both have similar questions. The fact is you work from some master image for these technologies and you need a good process for keeping them up to date and releasing new updates. So I have put together some thoughts on this and want to try and make this a collaborative effort. So if you have something that works for you share with others in the comments or get a message to me.


What needs to be done

There needs to be some form of cadence when you update an image so that things do not get missed. I don’t care if you have just one image or if you have multiple to keep updated, You’re going to miss things if you don’t have a process. So I’ve put together a list to start of what might need to be updated each time you do gold image maintenance.

  • Operating System patches
  • Application updates
  • Antivirus Definitions – there’s better ways than this :)
  • Add or remove applications
  • Version tracking


Gold Image updates

This is the part I would like to hear feedback from others on. These are the major steps that I think should be accounted for in image management. I’ve broken them down into steps and explained my thoughts on them.

Clone image – This seems pretty obvious but wanted to make sure it was clear. You could just update your existing image but I personally make a clone of the image and perform my updates on the new clone. This clone will ultimately become the new gold image once the updates are done. I do this rather than just updating the existing and continuing to add more and more snapshots to it. I tend to keep a few versions around in case I have to roll back and also keep additional older versions on some type of backup media.

OS updates – Also a bit of an assumption here but you need some regular schedule of OS patching. This might mesh with your normal desktop patching schedule or might be specific to this. But you need to set a schedule for performing these updates. You should know if it will be done once a month will you be applying all patches, what if something of high concern comes out and you are required to update in between your regular updates.

You might manually go in and run windows update manager or maybe you have a tool for this. I read a post from Sean Massey a VMUG member from Wisconsin that he came up with for using WSUS you can read here.

Application updates – Almost no customer can completely keep applications from being installed into their images. There are just some applications that work better in the image than being presented by other methods or being virtualized in some manner. You will either need to update these at the same time you are doing the other updates or have their own schedule. To cut down on your maintenance activities I would look at doing them all in the same window when possible.

Antivirus updates – I’m not a fan of installing AV products into your gold images but if you must than look for ways to optimize the process. Vendors like Symantec have guides for using their products in VDI environments that deal with how to install, update and setup scans. There should also be guidance around how you should be updating definitions and such. Do you leave auto updates on or just update in the image update process? This will help with operations and performance. The better way would be to adopt a AV product that can scan at the hypervisor level and utilize the vShield Endpoint features from VMware.

QA testing – So you have done all your updates are you going to just put that image back into service? Well some will but I would recommend that you spend time testing and putting the updated image through some type of QA process. At minimum I would create a check list of things that you can test the image against, maybe a list of web sites or running applications that are common in your environment. Don’t forget to do some basic user tasks like web browsing, flash, java etc. To accomplish this I would recommend you create a new temp desktop pool and use the updated image. This would allow you to test the image as it will be used by your customers, rather than just testing by using the VM directly.

Update tracker – So you’ve done all these updates now what? Well I bet by lunch you will have forgotten what you all updated. This means that you will need a method for tracking what was updated in the image. To accomplish this I think a few things need to be done. The first is come up with some type of version tracking for your gold images. I think something as simple as tracking versions works for most and incorporating them into the naming convention, examples below. Also to track version info I think you should incorporate the version number into the build in some method. I have seen customers add a registry key with the version info in it. This is a good idea because you can look at this if you need to confirm what version a user is running if needed.

  • windows7-gold-V3
  • gold-image-version5

The last part of tracking updates is some type of a change log or build sheet. When you make updates and changes I think you need a way to see what is in the current version being used and what was in previous versions. This would help in troubleshooting and also audits. A simple idea that I had was to create a spreadsheet for this tracking. I’ve created a simple Google doc that you can use as a starting point and build from for your environment. You can access the doc direct via this link.



To wrap things up these are a few of my thoughts on this. I’m sure others have some great ideas and if we share, this list can be updated and become a great resources for others to use.




About Brian Suhr

Brian is a VCDX5-DCV and a Sr. Tech Marketing Engineer at Nutanix and owner of this website. He is active in the VMware community and helps lead the Chicago VMUG group. Specializing in VDI and Cloud project designs. Awarded VMware vExpert status 6 years for 2016 - 2011. VCP3, VCP5, VCP5-Iaas, VCP-Cloud, VCAP-DTD, VCAP5-DCD, VCAP5-DCA, VCA-DT, VCP5-DT, Cisco UCS Design


  1. Some great points/ideas on here Brian. Thanks for putting this together!

    I am in agreement with you on the AV side. Unfortunately right now our View environment is running vSphere 5.x and we want to use our Sophos options at the Hypervisor level with vShield endpoint…but that requires 5.1x and higher. So, for the moment we have the app installed on the image. #Soon

    I have to admit that I often do forget to update my change log. Need to keep up on that!

    Thanks again.


  2. I like your idea about cloning. Is that in reference to using MCS or PVS, or either. We are using Citrix xendesktop 7.1 within VMware esx 5.1. Thanks!

    • Hey Neil,

      It could be with both. The main difference I think would be MCS would be using a VM, while PVS is using a VHD file. But the strategy is the same. Nice to have at least two copies.


  1. vCoffee Links Issue #4 – 5/19/2014 » vHersey - VCDX Two to the Seventh Power (#128) - […] vCoffee Links is a regular feature on vHersey.com. vCoffee Links features news and links of interest from the past …

Leave a Comment

Your email address will not be published. Required fields are marked *