Merge pull request #2772 from v-miegge/v-miegge/manage-surface-driver

CI 113553 - Created file, images, updated TOC

devices/surface/TOC.md

@@ -43,6 +43,7 @@
 ## Manage
 
 ### [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
+### [Manage Surface driver updates in Configuration Manager](manage-surface-driver-updates-configuration-manager.md)
 ### [Optimize Wi-Fi connectivity for Surface devices](surface-wireless-connect.md)
 ### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)
 ### [Surface Dock Firmware Update](surface-dock-firmware-update.md)

devices/surface/manage-surface-driver-and-firmware-updates.md

@@ -17,12 +17,12 @@ ms.audience: itpro
 ---
 
 # Manage and deploy Surface driver and firmware updates
- 
+
 How you manage Surface driver and firmware updates varies depending on your environment and organizational requirements. On Surface devices, firmware is exposed to the operating system as a driver and is visible in Device Manager, enabling device firmware and drivers to be automatically updated using Windows Update or Windows Update for Business. Although this simplified approach may be feasible for startups and small or medium-sized businesses, larger organizations typically need IT admins to distribute updates internally. This may involve comprehensive planning, application compatibility testing, piloting and validating updates, before final approval and distribution across the network.
 
 > [!NOTE]
 > This article is intended for technical support agents and IT professionals and applies to Surface devices only. If you're looking for help to install Surface updates or firmware on a home device, see [Update Surface firmware and Windows 10](https://support.microsoft.com/help/4023505).
- 
+
 While enterprise-grade software distribution solutions continue to evolve, the business rationale for centrally managing  updates remains the same: Maintain the security of Surface devices and keep them updated with the latest operating system and feature improvements. This is essential for sustaining a stable production environment and ensuring users aren't blocked from being productive. This article provides an overview of recommended tools and processes for larger organizations to accomplish these goals.
 
 ## Central update management in commercial environments
@@ -32,18 +32,17 @@ Microsoft has streamlined tools for managing devices – including driver and fi
 ### Manage updates with Configuration Manager and Intune
 
 Microsoft Endpoint Configuration Manager allows you to synchronize and deploy Surface firmware and driver updates with the Configuration Manager client. Integration with Microsoft Intune lets you see all your managed, co-managed, and partner-managed devices in one place. This is the recommended solution for large organizations to manage Surface updates.
- 
+
 For detailed steps, see the following resources:
 
-- [How to manage Surface driver updates in Configuration Manager.](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager)
-- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications).
+- [How to manage Surface driver updates in Configuration Manager](https://docs.microsoft.com/surface/manage-surface-driver-updates-configuration-manager.md)
+- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications)
 - [Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/)
 
-
 ### Manage updates with Microsoft Deployment Toolkit
 
 Included in Endpoint Configuration Manager, the Microsoft Deployment Toolkit (MDT) contains optional deployment tools that you may wish to use depending on your environment. These include the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), and User State Migration Tool (USMT). You can download the latest version of MDT from the [Microsoft Deployment Toolkit download page](https://www.microsoft.com/download/details.aspx?id=54259).
- 
+
 For detailed steps, see the following resources:
 
 - [Microsoft Deployment Toolkit documentation](https://docs.microsoft.com/configmgr/mdt/)
@@ -54,7 +53,6 @@ Surface driver and firmware updates are packaged as Windows Installer (*.msi) fi
 
 For instructions on how to deploy updates by using Endpoint Configuration Manager refer to [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). For instructions on how to deploy updates by using MDT, see [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt).
 
-
 **WindowsPE and Surface firmware and drivers**
 
 Endpoint Configuration Manager and MDT both use the Windows Preinstallation Environment (WindowsPE) during the deployment process. WindowsPE only supports a limited set of basic drivers such as those for network adapters and storage controllers. Drivers for Windows components that are not part of WindowsPE might produce errors. As a best practice, you can prevent such errors by configuring the deployment process to use only the required drivers during the WindowsPE phase.
@@ -65,13 +63,12 @@ Starting in Endpoint Configuration Manager, you can synchronize and deploy Micro
 
 ## Supported devices
 
-Downloadable .msi files are available for Surface devices from Surface Pro 2 and later. Information about .msi files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release. 
-
+Downloadable .msi files are available for Surface devices from Surface Pro 2 and later. Information about .msi files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release.
 
 ## Managing firmware with DFCI
 
 With Device Firmware Configuration Interface (DFCI) profiles built into Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For more information, see:
- 
+
 - [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide)
 - [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333).
 
@@ -93,7 +90,6 @@ Specific versions of Windows 10 have separate .msi files, each containing all re
 - Management engine (ME)
 - Unified extensible firmware interface (UEFI)
 
-
 ### Downloading .msi files
 
 1. Browse to [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware) on the Microsoft Download Center.
@@ -102,8 +98,7 @@ Specific versions of Windows 10 have separate .msi files, each containing all re
     ![Figure 1. Downloading Surface updates](images/fig1-downloads-msi.png)
 
     *Figure 1. Downloading Surface updates*
- 
- 
+
 ### Surface .msi naming convention
 
 Since August 2019, .msi files have used the following naming convention:
@@ -120,14 +115,15 @@ This file name provides the following information:
 - **Windows release:** Win10
 - **Build:** 18362
 - **Version:** 19.073.44195 – This shows the date and time that the file was created, as follows:
-    - **Year:** 19 (2019)
-    - **Month and week:** 073 (third week of July)
-    - **Minute of the month:** 44195
+  - **Year:** 19 (2019)
+  - **Month and week:** 073 (third week of July)
+  - **Minute of the month:** 44195
 - **Revision of version:** 0 (first release of this version)
 
 ### Legacy Surface .msi naming convention
+
 Legacy .msi files (files built before August 2019) followed the same overall naming formula but used a different method to derive the version number.
- ****
+
 **Example**
 
 - SurfacePro6_Win10_16299_1900307_0.msi
@@ -138,13 +134,11 @@ This file name provides the following information:
 - **Windows release:** Win10
 - **Build:** 16299
 - **Version:** 1900307 – This shows the date that the file was created and its position in the release sequence, as follows:
-    - **Year:** 19 (2019)
-    - **Number of release:** 003 (third release of the year)
-    - **Product version number:** 07 (Surface Pro 6 is officially the seventh version of Surface Pro)
+  - **Year:** 19 (2019)
+  - **Number of release:** 003 (third release of the year)
+  - **Product version number:** 07 (Surface Pro 6 is officially the seventh version of Surface Pro)
 - **Revision of version:** 0 (first release of this version)
 
-
-
 ## Learn more
 
 - [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware)
@@ -157,4 +151,3 @@ This file name provides the following information:
 - [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide)
 - [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333).
 - [Build deployment rings for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates)
-

devices/surface/manage-surface-driver-updates-configuration-manager.md

@@ -0,0 +1,181 @@
+---
+title: Manage Surface driver updates in Configuration Manager
+description: This article describes the available options to manage and deploy firmware and driver updates for Surface devices.
+ms.assetid: b64879c4-37eb-4fcf-a000-e05cbb3d26ea
+ms.reviewer: 
+author: v-miegge
+manager: laurawi
+keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: surface, devices
+ms.sitesec: library
+author: coveminer
+ms.author: daclark
+ms.topic: article
+audience: itpro
+---
+
+# Manage Surface driver updates in Configuration Manager
+
+## Summary
+
+Starting in [Microsoft System Center Configuration Manager version 1710](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1710#software-updates), you can synchronize and deploy Microsoft Surface firmware and driver updates directly through the Configuration Manager client. The process resembles deploying regular updates. However, some additional configurations are required to get the Surface driver updates into your catalog.
+
+## Prerequisites
+
+To manage Surface driver updates, the following prerequisites must be met:
+
+- You must use Configuration Manager version 1710 or a later version.
+- All Software Update Points (SUPs) must run Windows Server 2016 or a later version. Otherwise, Configuration Manager ignores this setting and Surface drivers won't be synchronized.
+
+> [!NOTE]
+> If your environment doesn’t meet the prerequisites, refer to the [alternative methods](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager#1) to deploy Surface driver and firmware updates in the [FAQ](#frequently-asked-questions-faq) section.
+
+## Useful log files
+
+The following logs are especially useful when you manage Surface driver updates.
+
+|Log name|Description|
+|---|---|
+|WCM.log|Records details about the software update point configuration and connections to the WSUS server for subscribed update categories, classifications, and languages.|
+|WsyncMgr.log|Records details about the software updates sync process.|
+
+These logs are located on the site server that manages the SUP, or on the SUP itself if it's installed directly on a site server.
+For a complete list of Configuration Manager logs, see [Log files in System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/log-files).
+
+## Enabling Surface driver updates management
+
+To enable Surface driver updates management in Configuration Manager, follow these steps:
+
+1. In the Configuration Manager console, go to **Administration** > **Overview** > **Site Configuration** > **Sites**.
+1. Select the site that contains the top-level SUP server for your environment.
+1. On the ribbon, select **Configure Site Components**, and then select **Software Update Point**. Or, right-click the site, and then select **Configure Site Components** > **Software Update Point**.
+1. On the **Classifications** tab, select the **Include Microsoft Surface drivers and firmware updates** check box.
+
+   ![Software Update Point Component Properties](images/manage-surface-driver-updates-1.png)
+
+1. When you're prompted by the following warning message, select **OK**.
+
+   ![Configuration Manager](images/manage-surface-driver-updates-2.png)
+
+1. On the Products tab, select the products that you want to update, and then select **OK**.
+
+   Most drivers belong to the following product groups:
+
+   - Windows 10 and later version drivers
+   - Windows 10 and later Upgrade & Servicing Drivers
+   - Windows 10 Anniversary Update and Later Servicing Drivers
+   - Windows 10 Anniversary Update and Later Upgrade & Servicing Drivers
+   - Windows 10 Creators Update and Later Servicing Drivers
+   - Windows 10 Creators Update and Later Upgrade & Servicing Drivers
+   - Windows 10 Fall Creators Update and Later Servicing Drivers
+   - Windows 10 Fall Creators Update and Later Upgrade & Servicing Drivers
+   - Windows 10 S and Later Servicing Drivers
+   - Windows 10 S Version 1709 and Later Servicing Drivers for testing
+   - Windows 10 S Version 1709 and Later Upgrade & Servicing Drivers for testing
+
+   > [!NOTE]
+   > Most Surface drivers belong to multiple Windows 10 product groups. You may not have to select all the products that are listed here. To help reduce the number of products that populate your Update Catalog, we recommend that you select only the products that are required by your environment for synchronization.
+
+## Verifying the configuration
+
+To verify that the SUP is configured correctly, follow these steps:
+
+1. Open WsyncMgr.log, and then look for the following entry:
+
+   ```console
+   Surface Drivers can be supported in this hierarchy since all SUPs are on Windows Server 2016, WCM SCF property Sync Catalog Drivers is set.
+
+   Sync Catalog Drivers SCF value is set to : 1
+   ```
+
+   If either of the following entries is logged in WsyncMgr.log, recheck step 4 in the previous section:
+
+   ```console
+   Sync Surface Drivers option is not set
+
+   Sync Catalog Drivers SCF value is set to : 0
+   ```
+
+1. Open WCM.log, and then look for an entry that resembles the following:
+
+   ![WCM.log settings](images/manage-surface-driver-updates-3.png)
+
+   This entry is an XML element that lists every product group and classification that's currently synchronized by your SUP server. For example, you might see an entry that resembles the following:
+
+   ```xml
+   <Categories>
+       <Category Id="Product:05eebf61-148b-43cf-80da-1c99ab0b8699"><![CDATA[Windows 10 and later drivers]]></Category>
+       <Category Id="Product:06da2f0c-7937-4e28-b46c-a37317eade73"><![CDATA[Windows 10 Creators Update and Later Upgrade & Servicing Drivers]]></Category>
+       <Category Id="Product:c1006636-eab4-4b0b-b1b0-d50282c0377e"><![CDATA[Windows 10 S and Later Servicing Drivers]]></Category>
+   </Categories>
+   ```
+
+   If you can't find the products that you selected in step 6 in the previous section, double-check whether the SUP settings are saved.
+
+   You can also wait until the next synchronization finishes, and then check whether the Surface driver and firmware updates are listed in Software Updates in the Configuration Manager console. For example, the console might display the following information:
+
+   ![All Software Updates Search Results](images/manage-surface-driver-updates-4.png)
+
+## Manual synchronization
+
+If you don't want to wait until the next synchronization, follow these steps to start a synchronization:
+
+1. In the Configuration Manager console, go to **Software Library** > **Overview** > **Software Updates** > **All Software Updates**.
+1. On the ribbon, select **Synchronize Software Updates**. Or, right-click **All Software Update**, and then select **Synchronize Software Update**.
+1. Monitor the synchronization progress by looking for the following entries in WsyncMgr.log:
+
+   ```console
+   Surface Drivers can be supported in this hierarchy since all SUPs are on Windows Server 2016, WCM SCF property Sync Catalog Drivers is set.
+
+   sync: SMS synchronizing categories 
+   sync: SMS synchronizing categories, processed 0 out of 311 items (0%)
+   sync: SMS synchronizing categories, processed 311 out of 311 items (100%)
+   sync: SMS synchronizing categories, processed 311 out of 311 items (100%)
+   sync: SMS synchronizing updates
+
+   Synchronizing update 7eaa0148-c42b-45fd-a1ab-012c82972de6 - Microsoft driver update for Surface Type Cover Integration
+   Synchronizing update 2dcb07f8-37ec-41ef-8cd5-030bf24dc1d8 - Surface driver update for Surface Pen Pairing
+   Synchronizing update 63067414-ae52-422b-b3d1-0382a4d6519a - Surface driver update for Surface UEFI
+   Synchronizing update 8e4e3a41-a784-4dd7-9a42-041f43ddb775 - Surface driver update for Surface Integration
+   Synchronizing update 7f8baee8-419f-47e2-918a-045a15a188e7 - Microsoft driver update for Surface DTX
+   Synchronizing update aed66e05-719b-48cd-a0e7-059e50f67fdc - Microsoft driver update for Surface Base Firmware Update
+   Synchronizing update 8ffe1526-6e66-43cc-86e3-05ad92a24e3a - Surface driver update for Surface UEFI
+   Synchronizing update 74102899-0a49-48cf-97e6-05bde18a27ff - Microsoft driver update for Surface UEFI
+   ```
+
+## Deploying Surface firmware and driver updates
+
+You can deploy Surface firmware and driver updates in the same manner as you deploy other updates.
+
+For more information about deployment, see [System Center 2012 Configuration Manager–Part7: Software Updates (Deploy)](https://blogs.technet.microsoft.com/elie/2012/05/25/system-center-2012-configuration-managerpart7-software-updates-deploy/).
+
+## Frequently asked questions (FAQ)
+
+**After I follow the steps in this article, my Surface drivers are still not synchronized. Why?**
+
+If you synchronize from an upstream Windows Server Update Services (WSUS) server, instead of Microsoft Update, make sure that the upstream WSUS server is configured to support and synchronize Surface driver updates. All downstream servers are limited to updates that are present in the upstream WSUS server database.
+
+There are more than 68,000 updates that are classified as drivers in WSUS. To prevent non-Surface related drivers from synchronizing to Configuration Manager, Microsoft filters driver synchronization against an allow list. After the new allow list is published and incorporated into Configuration Manager, the new drivers are added to the console following the next synchronization. Microsoft aims to get the Surface drivers added to the allow list each month in line with Patch Tuesday to make them available for synchronization to Configuration Manager.
+
+If your Configuration Manager environment is offline, a new allow list is imported every time you import [servicing updates](https://docs.microsoft.com/mem/configmgr/core/servers/manage/use-the-service-connection-tool) to Configuration Manager. You will also have to import a [new WSUS catalog](https://docs.microsoft.com/mem/configmgr/sum/get-started/synchronize-software-updates-disconnected) that contains the drivers before the updates are displayed in the Configuration Manager console. Because a stand-alone WSUS environment contains more drivers than a Configuration Manager SUP, we recommend that you establish a Configuration Manager environment that has online capabilities, and that you configure it to synchronize Surface drivers. This provides a smaller WSUS export that closely resembles the offline environment.
+
+If your Configuration Manager environment is online and able to detect new updates, you will receive updates to the list automatically. If you don’t see the expected drivers, please review the WCM.log and WsyncMgr.log for any synchronization failures.
+
+**My Configuration Manager environment is offline, can I manually import Surface drivers into WSUS?**
+
+No. Even if the update is imported into WSUS, the update won't be imported into the Configuration Manager console for deployment if it isn't listed in the allow list. You must use the [Service Connection Tool](https://docs.microsoft.com/mem/configmgr/core/servers/manage/use-the-service-connection-tool) to import servicing updates to Configuration Manager to update the allow list.
+
+**What alternative methods do I have to deploy Surface driver and firmware updates?**
+
+For information about how to deploy Surface driver and firmware updates through alternative channels, see [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates). If you want to download the .msi or .exe file, and then deploy through traditional software deployment channels, see [Keeping Surface Firmware Updated with Configuration Manager](https://docs.microsoft.com/archive/blogs/thejoncallahan/keeping-surface-firmware-updated-with-configuration-manager).
+
+## Additional Information
+
+For more information about Surface driver and firmware updates, see the following articles:
+
+- [Download the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices)
+- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates)
+- [Considerations for Surface and System Center Configuration Manager](https://docs.microsoft.com/surface/considerations-for-surface-and-system-center-configuration-manager)