Introduction
In a recent customer engagement, the client had requested to upgrade Windows 10 workstations within their environment using Ivanti Endpoint Manager (EPM.)
Ivanti has a recommended method to upgrade Windows 10 workstations to newer versions through their service pack definitions.
The service pack definitions are found in the Patch and Compliance tool and can be used to determine if an endpoint can receive the upgraded version of Windows. The service pack definition defines an ISO for the deployment, which cannot be downloaded via the Patch and Compliance tool.
The ISO must be downloaded separately and renamed to match what is configured in the definition. There are both pros and cons to using the recommended method:
ISO Method
Pros:
Easy to deploy
Simple configuration
Cons:
Space requirements (2x ISO size)
Large performance impact
Poor end-user awareness
When deploying any patch or distribution package, it is important to do so consistently each time to achieve expected results.
For this reason, I developed a Software Distribution method that would offer versatility and consistency with any Windows 10 upgrade. There are pros and cons to this method as well:
Software Distribution Method
Pros:
Fewer space requirements (1x ISO size)
Full end-user awareness
No performance impact
Cons:
More involved configuration
Leaves machine unusable for the duration of the deployment
Deploying Windows 10 Upgrades via Patch and Compliance
Ivanti’s recommended method for upgrading Windows 10 is fairly straightforward for the setup and deployment.
After the ISO is named according to what is configured in the definition file, all that is left to do is deploy it to targeted endpoints.
The Patch and Compliance deployment, after scheduling the repair and starting the task, is as follows:
Copy the ISO to the machine (download ISO here)
Mount the ISO and extract the contents
Unmount the ISO and start the upgrade process with the now local files
As previously mentioned, Ivanti’s recommended method for deployment has some cons.
First, it is required to have twice the disk space on the endpoint for storing the ISO and the extracted contents; that can easily amount to 8GB or more.
Once the installation starts, a large performance impact will be seen as the upgrade will start using most of the machine’s resources.
Lastly, there is poor end-user awareness as to what is actually happening. EPM does have the capability to provide prompts to the end user with the correct agent settings; however, when using those settings there is still no indication of the progress of the deployment.
Deploying Windows 10 Upgrades via Software Distribution
Ivanti’s Windows 10 upgrade method using Patch and Compliance works, but in this case, the customer needed something that was more user friendly and did not have any impact on performance.
This is how the Software Distribution method ensued. The Software Distribution method makes use of two custom batch files.
The first batch file used in the deployment, in this case, named GetUserName.bat, is used to simply get the username of the currently logged-in user if there is one; the username will be output into a temporary text file called Username.txt.
By default, when creating a distribution package, it will run under the SYSTEM account.
This particular package, however, will run under the current user account; this is important for the next batch file in the process. The contents of the GetUserName.bat file can be seen below.
REM -- If C:\Temp doesn't exist, create it and output the current user to Username.txt
REM -- Since the task is running under the current users context, a file will only get
REM -- created if there is a user logged in
if not exist C:\Temp (
mkdir C:\Temp
echo %username% > C:\Temp\Username.txt
) else (
echo %username% > C:\Temp\Username.txt
)The second batch file, which will be named Windows10Upgrade.bat, will use the Username.txt output from the previous batch file if it exists.
If the Username.txt file exists, a scheduled task will be created to execute setup.exe that gets copied to the clients.
Setup.exe is the main executable in a Windows ISO that installs and configures the OS with the parameters you define.
The scheduled task will be created to run in the current user’s context with the highest privileges and will execute one minute from the time it is created.
Running the task with the highest privileges is a requirement, otherwise, the scheduled task will fail. The reason a scheduled task is created is to allow the user to see the GUI operation of the upgrade; if setup.exe was executed under the SYSTEM context, the currently logged in user would not see anything.
If there is no Username.txt file, setup.exe will just run under the SYSTEM context as that is the default for the distribution package. The contents of the Windows10Upgrade.bat file can be seen below.
REM -- Set the 'name' variable to whatever is in the text file, if it exists
REM -- This text file only gets created if there is a user currently logged in
set /p name=<C:\Temp\Username.txt
REM -- Get the time in 24 hour format, add one minute, and assign it to the 'hhmm' variable
set hh=%time:~0,2%
set mm=%time:~3,2%
set /A mm=%mm%+1
if %mm% GTR 59 set /A mm=%mm%-60 && set /A hh=%hh%+1
set P=00%mm%
if %mm% LSS 10 set mm=%P:~-2%
if %hh% == 24 set hh=00
if "%hh:~0,1%" == " " set hh=0%hh:~1,1%
set hhmm=%hh%:%mm%
REM -- If the Username.txt exists, that means a user is logged in, so create a scheduled task
REM -- Set the scheduled task to run with the highest privileges and under the currently logged in user
REM -- This will ensure an update prompt is seen by the user during the upgrade
REM -- Otherwise, just run setup.exe as SYSTEM since no user is logged in and Username.txt does not exist
if exist C:\Temp\Username.txt (
schtasks /create /s %computername% /tn "Windows Upgrade" /sc once /tr "%cd%\Setup.exe /Auto Upgrade /Telemetry Disable /ShowOOBE none /DynamicUpdate disable" /st %hhmm% /rl highest /ru %userdomain%\%name%
del C:\Temp\Username.txt
) else (
Setup.exe /Auto Upgrade /Telemetry Disable /ShowOOBE none /DynamicUpdate disable
)
While the batch files, along with the ISO itself, are the main components of this deployment method, below is a list of items and configurations needed for this deployment method:
Windows 10 ISO (Extracted to a folder)
GetUserName.bat (In the same folder as the Extracted ISO)
Windows10Upgrade.bat (In the same folder as the Extracted ISO)
IIS MIME type for Default Website
- Type: application/octet
- Extension: .
This method allows for a seamless, quick, and efficient deployment that will provide the end-users with a good experience if logged in during the deployment.
If they are logged in, they will have full insight into what is happening. The general process for the entire deployment is as follows:
The task starts and either begins the download on the client or starts executing the batch files if already downloaded
- GetUserName.bat runs and outputs a Username.txt file to C:\Temp that contains the username of the currently logged-in user if there is one. A file does not get created if there is no user logged in.
- Next, Windows10Upgrade.bat will run and determine if there is a Username.txt file
If there is a Username.txt file, a scheduled task will be created for the current user, obtained from the Username.txt file
If there is no Username.txt file, setup.exe will run under the SYSTEM context as is the default for the package
- The machine will transition to a blue screen showing the progress of the installation after about 30-45 seconds and will make the computer unusable for approximately 45min-1.5h; time can also vary depending on hardware capabilities
As you can see, the process is fairly straight forward and if anything gets created, such as the Username.txt file and scheduled task, it will be cleaned up.
To make this process more user friendly, one can also pair this entire deployment with notification messages or deferment timers to provide more control to the end-user.
These are a few examples of the flexibility that EPM offers. Below is a short video of the deployment and demonstration of how it works and is setup.
Ivanti Endpoint Manager (EPM) Demo & Deployment Video