Gold Image
The master image from which every session host is cloned. A good gold image is the difference between a maintainable and a chaotic DaaS deployment — this is the central point where quality is decided.
What is a gold image?
A gold image (also called a master image or base image) is a pre-configured, tested Windows VM that serves as the template for every production session host. Instead of installing and configuring each session host individually, one perfect image is created — and then cloned as often as needed.
The image typically contains: the operating system version, all updates, pre-installed applications, group policies, the security baseline and optimisation tweaks. The better the image, the less work there is in operation.
Grundprinzip: After it has been created, a gold image should remain unchanged . Changes are deployed through a neues Image , not by patching running VMs afterwards. That is the immutable infrastructure philosophy.
How is a gold image built?
A typical build order
- Create the base VM from the Azure Marketplace (Windows 11 multi-session, for example)
- Install Windows updates — every available patch
- Install the AVD agent
- Office / M365 Apps through the ODT (Office Deployment Tool), in shared mode
- Teams with VDI optimisation (following the AVD recommendations)
- FSLogix Agent & Config
- LOB-Apps (SAP GUI, DATEV, industry software)
- Security — MDE, Intune Enrollment
- Optimizations — AVD Image Optimization Script (VDI Optimization Tool), disable services, remove bloatware
- Sysprep — generalising the VM (removing the SID and network configuration)
- Capture — storing it as an image in the Azure Compute Gallery
Important tools for gold images
- Azure Image Builder — code-basiertes, deklaratives Image-Building
- Nerdio Image Management — graphical, with staged rollout and automatic rollback
- Packer (HashiCorp) — DevOps-Ansatz, CI/CD-integrierbar
- Windows Optimization Tool — a Microsoft script for VDI optimisations
Gold image patching strategy
Windows updates have to go into the gold image regularly — but how?
Manuell (alte Schule)
- FrequencyMonthly
- Effort4-8h per iteration
- RiskHigh (human error)
- RollbackDifficult
- ScalingProblematic
Automatisiert (modern)
- FrequenzPossible weekly
- EffortUnder 30 minutes of review
- RiskLow (automated)
- RollbackAutomatic on error rate
- ScalingLinear
Staged rollout
Never deploy a new image straight to 100% of the session hosts. Instead:
- 5% of hosts with the new image (the canary group)
- Monitoring for 24 to 48 hours — sign-in time, error rate, user feedback
- 25% of hosts if the canary group is fine
- 100% of hosts after a further 48 hours
- Automatic Rollback if the error rate exceeds the threshold
Nerdio Manager and Citrix Provisioning Services have this built in as a standard feature.
Which applications belong in the gold image?
A central design question: what goes into the image, and what is delivered dynamically per user?
| App type | Where to install | Reason |
|---|---|---|
| Operating system components | Gold Image | Everyone needs it |
| Office 365 / M365 Apps | Gold Image (Shared Mode) | Standard tool, all users |
| Teams, Edge, Security | Gold Image | Universal |
| Small line-of-business apps | Gold Image | Easier to manage |
| Large niche applications (AutoCAD, SAP) | App Attach or per user | Only for some users, otherwise the image bloats |
| Frequently changing applications | MSIX / Intune | No image rebuild needed |
| Department-specific applications | App Volumes / App Layering | By assignment, not in the image |
Gold-Image-Patterns in DaaS Maps
DaaS Maps compares the image management workflows of the different platforms. For discussion of image optimisation, staged rollouts and patching strategies, you will find me on LinkedIn.