They run sysprep to generalize the system (remove unique identifiers, SIDs, computer names). Then, they boot from a WinPE environment and capture the entire partition as a .WIM or .GHO file.
Many ghosts disable Windows Update via Group Policy or services. Re-enable it and install all security patches. Note: This may break custom themes or activation. ghost windows 10 64 bit auto driver all programs