Windows’ built-in Deployment Image Servicing and Management (DISM) command, a.k.a. dism.exe, is something of a Swiss Army knife when it comes to working on Windows OS images. Among its many capabilities — such as adding optional Windows features and packages, taking image inventories, performing image cleanups, and more — DISM includes an /Add-Package option. This option allows users to install Microsoft Catalog updates in .cab or .msu files to a targeted Windows image.

.cab is short for “Windows Cabinet,” a type of compressed file that stores data and instructions for Windows that can update device drivers, system files, and so forth. The .msu file extension is associated with the Microsoft Update Standalone Installer. Normally, this installer uses the Windows Update Agent API to install update packages. Both .cab and .msu files also work with the DISM command against Windows image files, which may be of types .wim, .wsm, .esd, .ffu, or virtual hard disk files of type .vhd or .vhdx.

Note that .msu updates only work on offline images, while the more common .cab files may be applied to an online image to update a running Windows install. If an .msu is the only format available for download, you can sometimes use a tool like expand.exe (built into Windows 10 and 11) to extract a .cab file that DISM can apply to online images. See this Microsoft Learn article for details: only a couple of extra steps are involved.

That said, Windows 11 updates invariably come in the form of .msu files. Perhaps worse from a DISM perspective: they do not readily cough up .cab files suitable for use on an online image. Thus, this workaround is really only suited for Windows 10.

At the end of this story, I’ll explain what you must do to take an image offline and work on it. Most readers — except for IT pros and software developers — are likely to say “Heck, no!”

Why use DISM instead of Windows Update?

Good question! Sometimes, DISM provides a way to install an update when Windows Update (WU) may have issues. At times, Windows Update may simply refuse to work, or it may hang or crash for some particular update. Thankfully, DISM provides a handy way to install updates when WU itself may be unable to oblige.

Other scenarios when you might want to use DISM instead of Windows images include:

• Managing Windows images for large-scale and/or remote deployments using Microsoft Intune, Windows Autopilot, or Systems Center Configuration Manager (SCCM).
• Slipstreaming drivers or updates into standard Windows images for customization and special deployments.
• As an alternative to user-driven updates from an in-house update server, perhaps during scheduled maintenance periods. Holiday weekends are popular for this kind of thing in large organizations, because they provide an extra day to fix unexpected problems or to roll back to the previous status quo if such problems can’t be fixed.

Where to find Windows Update files

The Microsoft Update Catalog is the most common source for update files of all types, including .cab and .msu. Generally, items are accessed by name (e.g., Realtek Audio Driver) or by Knowledge Base (KB) article number. For example, KB5066791 is an update that applies to Windows 10 21H2 and 22H2 (the most current version); it includes bug fixes and resolutions.

Figure 1 shows the Update Catalog the search results for KB5066791. Click the Download button in the right-hand column for the version of the file that matches the target OS to get the update.

Ed Tittel / Foundry

I clicked the download button for the seventh item from the top, because it matches my target PC’s OS version (22H2) and architecture (x64). This provides a link to an .msu with an extremely long filename: windows10.0-kb5066791-arm64_28dfd4874e2cd23882608cdcba89a9cc2132d677.msu.

Making the .cab conversion

Here’s the step-by-step syntax to unpack the .cab file from the downloaded .msu. For isolation and convenience, I moved it into D:\Temp from its original location (my personal Downloads folder). Figure 2 shows the contents of the .msu file as seen from within the popular archive-handling application 7-Zip. It’s trivial simply to extract the .cab file from inside 7-Zip, where it appears as Windows10.0-KB5066791-x64.cab.

Ed Tittel / Foundry

Alternatively, you can use the built-in Windows command expand.exe to do the same job from a command line terminal:

expand -F:* " windows10.0-kb5066791-x64_3210d264091be5effb3253d05397c4daefba44c8.msu" "KB5066791-x64.cab"

Now that you’ve got access to the update in both .cab and .msu formats, DISM can work against both online (.cab) and offline (.msu) images. Let’s dig into the online syntax next.

The DISM /Add-Package syntax

The DISM command is fully documented online in Microsoft Docs in the DISM Operating System Package… Servicing Command-Line Options pages. This is just a small part of the Deployment Tools Reference, another online document worth bookmarking and exploring for those who work with (and on) Windows images.

The manual lays out the abstract syntax for the /Add-Package option as follows:

Dism /Add-Package /PackagePath: [/IgnoreCheck] [/PreventPending]

A /PackagePath can point to a single .cab or .msu file, a folder that contains a single expanded .cab file or a single .msu file, or a folder that contains multiple .cab or .msu files. (You can’t mix the two types, however.) If /PackagePath points to a folder that contains one or more .cab or .msu files at its root, any subfolders will be likewise recursively checked for such files as well.

The /PreventPending switch instructs DISM to skip installing the package if it, or the targeted Windows image, has any uncompleted actions still pending. This is intended to prevent DISM from operating on images that may not be complete or intact.

As already stated, you can add multiple packages within a single DISM command by including multiple .cab or .msu files in the directory that serves as input to the /PackagePath option. Ordinarily, DISM will check each package to make sure it’s applicable to the targeted image. If a package will not apply to that image, DISM will issue an error message. The /IgnoreCheck switch may be used to get DISM to run silently and skip the applicability check for each package.

DISM /Add-Package example

Let’s say I’m running a 64-bit (x64 architecture, not ARM) version of Windows 10 22H2. If I wanted to apply KB5066791 to that running image, I’d need to download the corresponding .msu file and extract the .cab file for online image use. Figure 3 shows the syntax in PowerShell/Windows Terminal.

Ed Tittel / Foundry

Some key observations for clarity and brevity:

• DISM only works with administrative privileges, so you must be logged into an administrative account and opt for “run as administrator” for your command line environment.
• The /Online switch tells DISM to apply packages to the currently running Windows image.
• I renamed the .cab file to KB5066791-x64.cab so I could fit everything into a single line of text.

The actual command that appears in Figure 3 reads:

DISM /Online /Add-Package /PackagePath:D:\Temp\KB5066791-x64.cab

To run the command in this way, you must be sure there are no Windows Update transactions pending. The safest way to make sure this is true is to restart the system before running any DISM /Add-Package commands.

Working on offline images is something of a specialty exercise. Here, I’ll simply say that offline images represent images that may be “under construction” or that are maintained in an image library for deployment and/or customization for distribution to users at some kind of scale. Maintaining images usually isn’t worth the extra work involved, unless you have at least dozens of users, if not hundreds or more, to whom those images will be served. For more information on using DISM /Add-Package with offline images, see this Microsoft Docs item “Add or Remove Packages Offline Using DISM.”

Common cases when DISM /Add-Package is worthwhile

In my own experience, I’ve used DISM /Add-Package dozens, if not hundreds, of times. In nearly every such case, that use has been motivated by one of two sets of circumstances:

1. Windows Update isn’t working properly, and I can’t download or install any updates.
2. Some particular update hangs or crashes when I try to install it using WU.

In both of those cases, downloading the .cab file and using DISM /Add-Package will get the update installed successfully on a running Windows image. But alas, that’s not the case for Windows 11, as I’ll explain in the next section.

If it doesn’t work, this usually indicates deeper problems with Windows. In those rare instances, I next turn to an in-place upgrade install (see my Computerworld story “Fix Windows with an in-place upgrade install”). If that provides no relief, my companion story “How to repair Windows 10 or 11 in 4 steps” should set things right.

A profound change in Windows 11 .msu structure and contents

In updating this story, I learned that Windows 11 .msu files for Windows updates differ significantly from those for Windows 10. As you can see in Figure 2, the .msu for KB5066791 in Windows 10 contains five files. By comparison, the .msu for a recent Windows 11 preview update (KB5067036) contains over 100,000 files. To make things more interesting, if not worse, none of them is a .cab file that fits easily into the DISM /Online /Add-Package approach. Indeed, it’s simply impossible to create the ingredients necessary to run DISM /Add-Package on a running Windows image.

For those readers brave enough — and with enough time on their hands to spend a couple of days figuring things out, hands-on — I’d recommend the following tutorials for those who might want to explore further how to take a Windows 11 image offline, use DISM /Add-Package to add an update, and then bring it back online again:

• 4sysop.com: “Add updates (.msu) offline into Windows images (.wim)” shows how to use PowerShell cmdlets to extract install.wim from an ISO and apply .msu updates, including image index and verified integration.
• Microsoft Learn: “Add updates to a Windows image” explains how to service offline images using .msu updates, including how to apply multiple updates with a single command. Also explains how to apply servicing stack updates (SSU) before the latest cumulative update (LCU), with examples for online and offline servicing.

For most readers, it’s enough to know that DISM /Add-Package is not an expeditious or easy technique to employ in Windows 11 when Windows Update misbehaves and updates go unapplied. You’ll want to consult my story “How to troubleshoot and reset Windows Update” instead.

This article was originally published in December 2021 and updated in December 2025.