There is that one moment in almost every PVS project. A worker doesn't boot properly, a policy doesn't take effect and the admin stares at an image into which all sorts of things have migrated over the years. Nobody knows exactly why this one service is still running or who set this registry key back then.<\/p>\n\n\n\n
Welcome to the topic of master target hygiene - perhaps the most underestimated success factor in provisioning.<\/p>\n\n\n\n
The most common mistake is to treat the master target like a normal server that you set up properly. But the master target is not a productive machine. It is the Mold<\/strong>, from which all workers are created.<\/p>\n\n\n\n And this is precisely the core of the provisioning model: a lean, shared image is streamed to many targets. The individual configuration - especially the group policies - only comes on the boat of the respective worker<\/strong> fresh via normal GPO processing. Not from the frozen image.<\/p>\n\n\n\n This is not a minor matter. This is the foundation.<\/p>\n\n\n\n If you bake policies into the master target, you catch exactly the problems that are so difficult to find later:<\/p>\n\n\n\n The clean rule is therefore: The Master Target should be low in policy.<\/strong> Ideally, only the default domain policy applies. Then the GPO processing at worker boot is the only clear source of truth. No drift, no guesswork.<\/p>\n\n\n\n You can't recognize a clean master target by the fact that it works - many dirty images also work. You can recognize it by the fact that can explain why<\/strong> every ingredient is included.<\/p>\n\n\n\n Three things you should have under control:<\/p>\n\n\n\n Deactivate updates before sealing.<\/strong> If the imaging process freezes the state via VSS and a Windows update or an agent self-update is still running in the background, a semi-finished state is frozen. Updates therefore before<\/em> off, then on again (this is unsealing).<\/p>\n\n\n\n Take pending reboots seriously.<\/strong> A pending restart that goes into the image is a time bomb. Every worker inherits the unfinished state. A mandatory reboot before imaging is not harassment, but self-protection.<\/p>\n\n\n\n Do not forget telemetry hygiene.<\/strong> A good example is CrowdStrike: If the sensor is not set up correctly, the same host name suddenly appears a hundred times in the Falcon console after the rollout - that of the master. Not a boot problem, but a classic symptom of an improperly sealed image.<\/p>\n\n\n\n A well-maintained Master Target doesn't pay off today, but in six months' time - when a worker starts to get on your nerves and you find the cause in minutes instead of hours, because the image doesn't hold any surprises.<\/p>\n\n\n\n Hygiene at the Master Target is not a compulsory exercise for perfectionists. It's the difference between a farm that you understand and one that you only manage.<\/p>\n\n\n\n PVS Forge automates precisely this discipline: pending reboot detection, update deactivation before sealing and clean unsealing afterwards - so that every image remains as lean and traceable as it should be.<\/em><\/p>","protected":false},"excerpt":{"rendered":" Es gibt diesen einen Moment in fast jedem PVS-Projekt. Ein Worker bootet nicht sauber, eine Policy greift nicht, und der Admin starrt auf ein Image, in das \u00fcber die Jahre alles M\u00f6gliche hineingewandert ist. Niemand wei\u00df mehr genau, warum dieser eine Dienst noch l\u00e4uft oder wer damals diesen Registry-Key gesetzt hat. Willkommen beim Thema Hygiene […]<\/p>\n","protected":false},"author":6,"featured_media":654,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"disabled","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[7,10],"tags":[],"class_list":["post-80","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-best-practice","category-blog-posts"],"uagb_featured_image_src":{"full":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1.png",1080,720,false],"thumbnail":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1-150x150.png",150,150,true],"medium":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1-300x200.png",300,200,true],"medium_large":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1-768x512.png",768,512,true],"large":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1-1024x683.png",1024,683,true],"1536x1536":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1.png",1080,720,false],"2048x2048":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1.png",1080,720,false],"trp-custom-language-flag":["https:\/\/www.pvs-forge.com\/wp-content\/uploads\/2026\/05\/hero-01-hygiene-master-target-1.png",18,12,false]},"uagb_author_info":{"display_name":"Thomas K\u00f6tzing","author_link":"https:\/\/www.pvs-forge.com\/en\/author\/thomas-koetzing\/"},"uagb_comment_info":0,"uagb_excerpt":"Es gibt diesen einen Moment in fast jedem PVS-Projekt. Ein Worker bootet nicht sauber, eine Policy greift nicht, und der Admin starrt auf ein Image, in das \u00fcber die Jahre alles M\u00f6gliche hineingewandert ist. Niemand wei\u00df mehr genau, warum dieser eine Dienst noch l\u00e4uft oder wer damals diesen Registry-Key gesetzt hat. Willkommen beim Thema Hygiene…","_links":{"self":[{"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/posts\/80","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/comments?post=80"}],"version-history":[{"count":5,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/posts\/80\/revisions"}],"predecessor-version":[{"id":691,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/posts\/80\/revisions\/691"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/media\/654"}],"wp:attachment":[{"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/media?parent=80"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/categories?post=80"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pvs-forge.com\/en\/wp-json\/wp\/v2\/tags?post=80"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Group policies do not belong in the image<\/h2>\n\n\n\n
\n
Hygiene means knowing what is in the image<\/h2>\n\n\n\n
The reward of clean form<\/h2>\n\n\n\n
\n\n\n\n