Abstract: A “Zero-Touch Manager” (“ZTM”) supplies updates to device firmware, operating system (OS), frameworks, applications, etc., from cloud-based or other network-accessible storage. These updates ensure that groups of “identical” devices (i.e., devices having the same hardware version) run from the same known state, while maintaining local customizations for individual devices. The ZTM uses sector-level differences to generate differential update versions (“diffs”) of Virtual Hard Disk (VHD) images of planned update versions relative to local hard drive images of each device's current version. Consequently, updates to the local hard drive image are achieved by replacing sectors of the local hard drive image that have corresponding changed sectors in the diff, though additional information may also be included in the diff. “Manifest” files are used in combination with the diffs to control device updates based upon the current version of the local hard drive image relative to update versions in the diff.