Unable to capture any windows images. Fails in the validation step with: “relevance substitution fails”. Same place every time. I was able to capture images in the past. I had captured win11 23h2 and 24h2. Wanted to do a new capture after updating, and ran into this issue. I did a full rebuild, no difference. I have been able to run most of the actions using the QNA tool on the endpoint. What is this “failed substitution”? What did you get and what were you expecting?
Target: Win11 25H2 (OSD deployed this as a standard OSD Image).
OSD: 7.1.120.31202
MDT Bundle: 3.12.15 (PE10_B26100x64 (24H2), USMT10_B26100x64
BES: 11.0.3, 11.0.4, 11.0.5 (tried all 3, currently running 11.0.3). Re-built entire environment also, same result.
Validation Step:
From Endpoint:
At 09:38:57 -0700 - mailboxsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/mailboxsite1624054375)
Relevant - (fixlet:406)
Relevant - Validation (fixlet:407)
At 09:40:01 -0700 -
Report posted successfully
At 09:40:19 -0700 - mailboxsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/mailboxsite1624054375)
Relevant - Download and Set up Windows Bundle Resource Files (fixlet:408)
Relevant - Create Image Info File (fixlet:409)
Relevant - Determine Applicable Drivers (fixlet:410)
Relevant - Download Applicable Drivers and Apply (fixlet:411)
Relevant - Prepare custom settings configuration file (fixlet:412)
Relevant - Initiate Capture Action (fixlet:413)
At 09:40:20 -0700 -
ActionLogMessage: (action:406) Action signature verified for Execution
ActionLogMessage: (action:406) starting group action
ActionLogMessage: (action:406) starting sub action
At 09:40:20 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded regset (group:406,action:407)
At 09:40:22 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded override (group:406,action:407)
Command succeeded run (group:406,action:407)
Command started - waithidden (group:406,action:407)
At 09:40:23 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=0) waithidden (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command started - waithidden (group:406,action:407)
Command succeeded (Exit Code=0) waithidden (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
Command succeeded (evaluated true) continue if (group:406,action:407)
At 09:40:25 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command started - waithidden (group:406,action:407)
At 09:40:28 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=0) waithidden (group:406,action:407)
Command started - waithidden (group:406,action:407)
At 09:40:30 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=0) waithidden (group:406,action:407)
Not paused pause while (group:406,action:407)
At 09:42:30 -0700 - actionsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/actionsite)
Command failed (Relevance substitution failed) pause while (group:406,action:407)
At 09:42:30 -0700 -
ActionLogMessage: (group:406,action407) ending sub action
ActionLogMessage: (action:406) ending group action (aborted)
At 09:42:30 -0700 - mailboxsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/mailboxsite1624054375)
Not Relevant - Validation (fixlet:407)
Not Relevant - (fixlet:406)
At 09:42:31 -0700 - mailboxsite (http://FOLBESSERVER.folsom.demo.com:52311/cgi-bin/bfgather.exe/mailboxsite1624054375)
Not Relevant - Download and Set up Windows Bundle Resource Files (fixlet:408)
Not Relevant - Create Image Info File (fixlet:409)
Not Relevant - Determine Applicable Drivers (fixlet:410)
Not Relevant - Download Applicable Drivers and Apply (fixlet:411)
Not Relevant - Prepare custom settings configuration file (fixlet:412)
Not Relevant - Initiate Capture Action (fixlet:413)
At 09:42:32 -0700 -
Report posted successfully
At 09:43:05 -0700 - BES Support (http://sync.bigfix.com/cgi-bin/bfgather/bessupport)
Relevant - Administrative Login Needed (fixlet:240)
Corresponding log from Console (the data is cut-n-pasted, from the action output) Validation step:
Validation
FOL-00C29B397B3
Summary
The action failed.
This action has been applied 1 time and will not be applied again.
Status Failed
Start Time 3/31/2026 9:40:20 AM
End Time 3/31/2026 9:42:30 AM
Exit Code 0
Action Script Execution Detail
Completed // Check that there are no other capture actions running
Completed continue if {NOT exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\ImageInfo" whose (exists value "lastActionID" whose (exists action (it as integer) whose (status of it as lowercase = "running")) of it) of x32 registry}
Completed // Lock this computer from other captures while this action group is running
Completed regset "[HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\ImageInfo]" "lastActionID"="{id of active action - 1}"
Completed // Verify if Windows installation can be successfully rearmed after capture (max number of sysprep not reached)
Completed if {version of operating system >= "6.1"}
Completed continue if {integer value of select "RemainingWindowsReArmCount from SoftwareLicensingService" of wmi > 0}
Completed endif
Completed // Verify that the computer is in a workgroup and not in a domain
Completed continue if {string value of select ("DomainRole From Win32_ComputerSystem") of WMI is "0" OR string value of select ("DomainRole From Win32_ComputerSystem") of WMI is "2"}
Completed // Verify that the provided user is logged on and his credentials work on target Windows 10/11 computer
Completed override run
Completed Hidden=true
Completed RunAs=localuser
Completed user="Administrator"
Completed asadmin=interactive
Completed password="{parameter "DiffUserPassword" of action}"
Completed run cmd.exe /C ver
Completed // Verify connection to image share
Completed waithidden cmd.exe /C net use "\\folosd2\osdcapture" {parameter "credentials" of action}
Completed continue if{exists folder "\\folosd2\osdcapture"}
Completed // Verify connection to log share
Completed waithidden cmd.exe /C net use "\\folosd2\osdcapturelogs" {parameter "credentials" of action}
Completed continue if {exists folder "\\folosd2\osdcapturelogs"}
Completed // Verify the operating system
Completed continue if {(version of it = "10.0" as version AND product type of it is nt workstation product type) of operating system}
Completed // Verify the architecture
Completed continue if {x64 of operating system}
Completed // Verify that there exists at LEAST 448 MB of RAM on the endpoint
Completed continue if {(size of ram as integer / (1024*1024)) + 1 > 448}
Completed // Check that the endpoint has enough space (MB)
Completed continue if {2290 < ((free space of drive of client) /1024 /1024)}
Completed // Restart WMI and SMP services
Completed if {exists running service "smphost"}
Completed waithidden cmd.exe /c net stop "smphost" /y
Completed endif
Completed if {exists running service "winmgmt"}
Completed waithidden cmd.exe /c net stop "winmgmt" /y
Completed endif
Completed waithidden cmd.exe /c net start "winmgmt"
Completed pause while {not exists running service "winmgmt"}
Failed pause while {not exists wmi}
waithidden cmd.exe /c net start "smphost"
// Stop WMPNetworkSvc service
if {exists running service "WMPNetworkSvc"}
waithidden cmd.exe /c net stop "WMPNetworkSvc"
regset "[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WMPNetworkSvc]" "Start"=dword:00000004
endif
// Verify that Rescue and Recovery is installed
continue if {not exists key whose ((it contains "rescue and recovery") of (value "DisplayName" of it as string as lowercase)) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registry; (if exists x64 registry then x64 registry else nothing))}
// Verify that WSF has not been disabled
continue if {(not exists key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings" whose(value "Enabled" of it is 0) of x32 registry) AND (not exists key "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings" whose(value "Enabled" of it is 0) of x32 registry)}
// Verify that there are no pending operations requiring reboot
continue if {not pending restart AND not exists file "pending.xml" of folder "WinSxS" of windows folder}
// Check if any partition is encrypted with bitlocker
waithidden cmd.exe /C "powershell -command get-bitlockervolume > out.txt 2>nul"
continue if {if exit code of action is 0 then (if (exists it And number of lines of it > 0 ) of file "out.txt" then (exists line whose (it as string contains "FullyDecrypted") of it And not exists line whose (it as string contains "FullyEncrypted" or it as string contains "DecryptionInProgress" or it as string contains "EncryptionInProgress") of it) of file "out.txt" else true) else true}
// Verify the release ID and build of the image being captured are supported by PE10 version (B26100). If this step fails, you must import an MDT Bundle with a later version of PE10
parameter "ImageReleaseID" = "{if (version of operating system as string contains "10.0.10240") then "1507" else if (version of client >= "9.5" as version) then (releaseid of operating system) else if exists value "ReleaseId" of key "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of registry then value "ReleaseId" of key "HKLM\Software\Microsoft\Windows NT\CurrentVersion" of registry as string else "1507"}"
parameter "ImageBuild" = "{preceding text of first "." of following text of first "." of following text of first "." of (version of operating system as string)}"
if {parameter "ImageReleaseID" as integer > 1607}
parameter "latestPe10SupportedBuild" = "26100"
parameter "currentPe10Build" = "26100"
parameter "isAllowedException" = "{if ((parameter "ImageBuild" as integer) > (parameter "latestPe10SupportedBuild" as integer)) then "TRUE" else "FALSE"}"
continue if {(parameter "currentPe10Build" as integer) >= (parameter "ImageBuild" as integer) OR parameter "isAllowedException" = "TRUE"}
endif
// if windows10 GA or windows10 1511 check that it is not an upgraded system
if {parameter "ImageReleaseID" as integer < 1607}
continue if {not exists value "Upgrade" of key "HKEY_LOCAL_MACHINE\System\Setup" of (if (x64 of operating system) then native registry else registry)}
endif
// Check that Deploy and MININT are deleted. (Maybe left behind from previous Reimage or Capture job)
parameter "deployPath" = "{(value of variable "SystemDrive" of environment) & "\Deploy"}"
parameter "minintPath" = "{(value of variable "SystemDrive" of environment) & "\MININT"}"
parameter "smTaskPath" = "{(value of variable "SystemDrive" of environment) & "\_SMTaskSequence"}"
parameter "runLiteTouchBat" = "{(value of variable "SystemDrive" of environment) & "\runLiteTouch.bat"}"
parameter "liteTouchStartup" = "{(value of variable "AllUsersProfile" of environment) & "\Start Menu\Programs\Startup\LiteTouch.lnk"}"
waithidden cmd /C rmdir /S /Q "{parameter "deployPath"}"
waithidden cmd /C rmdir /S /Q "{parameter "minintPath"}"
waithidden cmd /C rmdir /S /Q "{parameter "smTaskPath"}"
waithidden cmd /C del /F /Q "{parameter "runLiteTouchBat"}"
waithidden cmd /C del /F /Q "{parameter "liteTouchStartup"}"
continue if{not exists folder (parameter "deployPath")}
continue if{not exists folder (parameter "minintPath")}
continue if{not exists folder (parameter "smTaskPath")}
continue if{not exists file (parameter "runLiteTouchBat")}
continue if{not exists file (parameter "liteTouchStartup")}