mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 02:13:43 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr into cm
This commit is contained in:
Greg Lindsay
@ -36,7 +36,7 @@ Windows as a service provides a new way to think about building, deploying, and
|
||||
| [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. |
|
||||
| [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. |
|
||||
| [Assign devices to servicing branches for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. |
|
||||
| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. |
|
||||
| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Update Compliance to monitor and manage Windows Updates on devices in your organization. |
|
||||
| [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. |
|
||||
| [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. |
|
||||
| [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. |
|
||||
|
||||
@ -8,7 +8,7 @@ itproauthor: jaimeo
|
||||
author: SteveDiAcetis
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
@ -88,7 +88,7 @@ The main operating system file (install.wim) contains multiple editions of Windo
|
||||
|
||||
### Additional languages and features
|
||||
|
||||
You don't have to add more languages and features to the image to accomplish the updates, but it's an opportunity to customize the image with more languages, Optional Components, and Features on Demand beyond what is in your starting image. To do this, it's important to make these changes in the correct order: first apply servicing stack updates, followed by language additions, then by feature additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab, there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image.
|
||||
You don't have to add more languages and features to the image to accomplish the updates, but it's an opportunity to customize the image with more languages, Optional Components, and Features on Demand beyond what is in your starting image. To do this, it's important to make these changes in the correct order: first apply servicing stack updates, followed by language additions, then by feature additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab, there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image.
|
||||
|
||||
Optional Components, along with the .Net feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid this. One option is to skip the image cleanup step, though that will result in a larger install.wim. Another option is to install the .Net and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you will have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month).
|
||||
|
||||
@ -108,7 +108,7 @@ These examples are for illustration only, and therefore lack error handling. The
|
||||
The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only.
|
||||
|
||||
```
|
||||
function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) }
|
||||
function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) }
|
||||
|
||||
Write-Host "$(Get-TS): Starting media refresh"
|
||||
|
||||
@ -121,19 +121,19 @@ $LANG = "ja-jp"
|
||||
$LANG_FONT_CAPABILITY = "jpan"
|
||||
|
||||
# Declare Dynamic Update packages
|
||||
$LCU_PATH = “C:\mediaRefresh\packages\LCU.msu”
|
||||
$SSU_PATH = “C:\mediaRefresh\packages\SSU_DU.msu”
|
||||
$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu"
|
||||
$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu"
|
||||
$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab"
|
||||
$SAFE_OS_DU_PATH = “C:\mediaRefresh\packages\SafeOS_DU.cab”
|
||||
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu”
|
||||
$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab"
|
||||
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu"
|
||||
|
||||
# Declare folders for mounted images and temp files
|
||||
$WORKING_PATH = "C:\mediaRefresh\temp"
|
||||
$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia"
|
||||
$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia"
|
||||
$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount”
|
||||
$WINRE_MOUNT = $WORKING_PATH + "\WinREMount”
|
||||
$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount”
|
||||
$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount"
|
||||
$WINRE_MOUNT = $WORKING_PATH + "\WinREMount"
|
||||
$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount"
|
||||
|
||||
# Mount the language pack ISO
|
||||
Write-Host "$(Get-TS): Mounting LP ISO"
|
||||
@ -152,7 +152,7 @@ $OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "Microsoft-Windows-Cli
|
||||
# Mount the Features on Demand ISO
|
||||
Write-Host "$(Get-TS): Mounting FOD ISO"
|
||||
$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter
|
||||
$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\"
|
||||
$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\"
|
||||
|
||||
# Create folders for mounting images and storing temporary files
|
||||
New-Item -ItemType directory -Path $WORKING_PATH -ErrorAction Stop | Out-Null
|
||||
@ -162,7 +162,7 @@ New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Keep the original media, make a copy of it for the new, updateed media.
|
||||
Write-Host "$(Get-TS): Copying original media to new media path"
|
||||
Copy-Item -Path $MEDIA_OLD_PATH“\*” -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false }
|
||||
```
|
||||
### Update WinRE
|
||||
@ -177,14 +177,14 @@ It finishes by cleaning and exporting the image to reduce the image size.
|
||||
```
|
||||
# Mount the main operating system, used throughout the script
|
||||
Write-Host "$(Get-TS): Mounting main OS"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim” -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
|
||||
|
||||
#
|
||||
# update Windows Recovery Environment (WinRE)
|
||||
#
|
||||
Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim” -Destination $WORKING_PATH"\winre.wim” -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Destination $WORKING_PATH"\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Write-Host "$(Get-TS): Mounting WinRE"
|
||||
Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim” -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null
|
||||
Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Add servicing stack update
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
@ -226,10 +226,10 @@ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
# Add TTS support for the new language
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
@ -244,35 +244,35 @@ Write-Host "$(Get-TS): Performing image cleanup on WinRE"
|
||||
DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
# Dismount
|
||||
Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
# Export
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim”
|
||||
Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim” -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim” -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\winre2.wim” -Destination $WORKING_PATH"\winre.wim” -Force -ErrorAction stop | Out-Null
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim"
|
||||
Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim" -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\winre2.wim" -Destination $WORKING_PATH"\winre.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
### Update WinPE
|
||||
|
||||
This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media.
|
||||
|
||||
```
|
||||
#
|
||||
#
|
||||
# update Windows Preinstallation Environment (WinPE)
|
||||
#
|
||||
#
|
||||
|
||||
# Get the list of images contained within WinPE
|
||||
$WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH“\sources\boot.wim”
|
||||
$WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim"
|
||||
|
||||
Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
# update WinPE
|
||||
Write-Host "$(Get-TS): Mounting WinPE"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH“\sources\boot.wim” -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Add SSU
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
|
||||
# Install lp.cab cab
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
@ -287,7 +287,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
$INDEX = $PACKAGE.PackageName.IndexOf("-Package")
|
||||
if ($INDEX -ge 0) {
|
||||
|
||||
|
||||
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
|
||||
if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
|
||||
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
|
||||
@ -307,10 +307,10 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
# Add TTS support for the new language
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
|
||||
Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
@ -321,7 +321,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
Write-Host "$(Get-TS): Updating lang.ini"
|
||||
DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null
|
||||
}
|
||||
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Host "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
@ -331,28 +331,28 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
# Dismount
|
||||
Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
#Export WinPE
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim”
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH“\sources\boot.wim” -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim"
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null
|
||||
|
||||
}
|
||||
|
||||
Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH“\sources\boot.wim” -Force -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
### Update the main operating system
|
||||
|
||||
For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod).
|
||||
|
||||
Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .Net), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image.
|
||||
|
||||
|
||||
You can install Optional Components, along with the .Net feature, offline, but that will require the device to be restarted. This is why the script installs .Net and Optional Components after cleanup and before export.
|
||||
|
||||
```
|
||||
#
|
||||
#
|
||||
# update Main OS
|
||||
#
|
||||
#
|
||||
|
||||
# Add servicing stack update
|
||||
Write-Host "$(Get-TS): Adding package $SSU_PATH"
|
||||
@ -385,20 +385,20 @@ Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOU
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Host "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Copy our updated recovery image from earlier into the main OS
|
||||
# Note: If I were updating more than 1 edition, I'd want to copy the same recovery image file
|
||||
# Note: If I were updating more than 1 edition, I'd want to copy the same recovery image file
|
||||
# into each edition to enable single instancing
|
||||
Copy-Item -Path $WORKING_PATH"\winre.wim” -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim” -Force -Recurse -ErrorAction stop | Out-Null
|
||||
Copy-Item -Path $WORKING_PATH"\winre.wim" -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Host "$(Get-TS): Performing image cleanup on main OS"
|
||||
DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
#
|
||||
# Note: If I wanted to enable additional Optional Components, I'd add these here.
|
||||
# In addition, we'll add .Net 3.5 here as well. Both .Net and Optional Components might require
|
||||
# Note: If I wanted to enable additional Optional Components, I'd add these here.
|
||||
# In addition, we'll add .Net 3.5 here as well. Both .Net and Optional Components might require
|
||||
# the image to be booted, and thus if we tried to cleanup after installation, it would fail.
|
||||
#
|
||||
|
||||
@ -413,9 +413,9 @@ Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorActio
|
||||
Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null
|
||||
|
||||
# Export
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim”
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH“\sources\install.wim” -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim” -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\install2.wim” -Destination $MEDIA_NEW_PATH“\sources\install.wim” -Force -ErrorAction stop | Out-Null
|
||||
Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim"
|
||||
Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null
|
||||
Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null
|
||||
```
|
||||
|
||||
### Update remaining media files
|
||||
@ -446,8 +446,7 @@ Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null
|
||||
# Dismount ISO images
|
||||
Write-Host "$(Get-TS): Dismounting ISO images"
|
||||
Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null
|
||||
Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null
|
||||
Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Host "$(Get-TS): Media refresh completed!"
|
||||
```
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@ ms.topic: article
|
||||
|
||||
# Delivery Optimization in Update Compliance
|
||||
|
||||
The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
The Update Compliance solution provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
|
||||
## Delivery Optimization Status
|
||||
|
||||
|
||||
@ -17,6 +17,11 @@ ms.topic: article
|
||||
|
||||
# Monitor Windows Updates with Update Compliance
|
||||
|
||||
> [!IMPORTANT]
|
||||
> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal; however, please note the following updates:
|
||||
>
|
||||
> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
> * The Perspectives feature of Update Compliance will also be removed on March 31, 2020 in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
|
||||
|
||||
|
||||
## Introduction
|
||||
@ -46,8 +51,8 @@ The Update Compliance architecture and data flow follows this process:
|
||||
4. Diagnostic data is available in the Update Compliance solution.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>This process assumes that Windows diagnostic data is enabled and data sharing is enabled as outlined in the enrollment section of [Get started with Update Compliance](update-compliance-get-started.md).
|
||||
> [!NOTE]
|
||||
> This process assumes that Windows diagnostic data is enabled and data sharing is enabled as outlined in the enrollment section of [Get started with Update Compliance](update-compliance-get-started.md).
|
||||
|
||||
|
||||
|
||||
@ -55,4 +60,4 @@ The Update Compliance architecture and data flow follows this process:
|
||||
## Related topics
|
||||
|
||||
[Get started with Update Compliance](update-compliance-get-started.md)<BR>
|
||||
[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
|
||||
[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
|
||||
|
||||
@ -16,6 +16,10 @@ ms.topic: article
|
||||
|
||||
# Perspectives
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On March 31, 2020, the Perspectives feature of Update Compliance will be removed in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
|
||||
|
||||
|
||||
|
||||
|
||||
Perspectives are elaborations on specific queries hand-crafted by developers which data views that provide deeper insight into your data. Perspectives are loaded whenever clicking into more detailed views from both the Security Update Status section and Feature Update Status section of Update Compliance.
|
||||
@ -33,10 +37,10 @@ The third blade is the **Deployment Status** blade. This defines how many days i
|
||||
| State | Description |
|
||||
| --- | --- |
|
||||
| Update Completed | When a device has finished the update process and is on the queried update, it will display here as Update completed. |
|
||||
| In Progress | Devices that report they are “In Progress” are one of the various stages of installing an update; these stages are reported in the Detailed Deployment Status blade. |
|
||||
| Deferred | When a device’s Windows Update for Business deferral policy dictates that the update is not yet applicable due to deferral, it will report as such in this blade. |
|
||||
| Progress stalled | Devices that report as “Progress stalled” have been stuck at “In progress” for more than 7 days. |
|
||||
| Cancelled | The update was cancelled. |
|
||||
| In Progress | Devices that report they are "In Progress" are one of the various stages of installing an update; these stages are reported in the Detailed Deployment Status blade. |
|
||||
| Deferred | When a device's Windows Update for Business deferral policy dictates that the update is not yet applicable due to deferral, it will report as such in this blade. |
|
||||
| Progress stalled | Devices that report as "Progress stalled" have been stuck at "In progress" for more than 7 days. |
|
||||
| Cancelled | The update was canceled. |
|
||||
| Blocked | There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update. |
|
||||
| Unknown | Devices that do not report detailed information on the status of their updates will report Unknown. This is most likely devices that do not use Windows Update for deployment. |
|
||||
| Update paused | These devices have Windows Update for Business pause enabled, preventing this update from being installed. |
|
||||
@ -48,19 +52,19 @@ The final blade is the **Detailed Deployment Status** blade. This blade breaks d
|
||||
|
||||
| State | Description |
|
||||
| --- | --- |
|
||||
| Update deferred | When a device’s Windows Update for Business policy dictates the update is deferred. |
|
||||
| Update paused | The device’s Windows Update for Business policy dictates the update is paused from being offered. |
|
||||
| Update deferred | When a device's Windows Update for Business policy dictates the update is deferred. |
|
||||
| Update paused | The device's Windows Update for Business policy dictates the update is paused from being offered. |
|
||||
| Update offered | The device has been offered the update, but has not begun downloading it. |
|
||||
| Pre-Download tasks passed | The device has finished all necessary tasks prior to downloading the update. |
|
||||
| Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) |
|
||||
| Download Started | The update has begun downloading on the device. |
|
||||
| Download Succeeded | The update has successfully completed downloading. |
|
||||
| Pre-Install Tasks Passed | Tasks that must be completed prior to installing the update have been completed. |
|
||||
| Install Started | Installation of the update has begun. |
|
||||
| Reboot Required | The device has finished installing the update, and a reboot is required before the update can be completed.
|
||||
| Install Started | Installation of the update has begun. |
|
||||
| Reboot Required | The device has finished installing the update, and a reboot is required before the update can be completed.
|
||||
| Reboot Pending | The device has a scheduled reboot to apply the update. |
|
||||
| Reboot Initiated | The scheduled reboot has been initiated. |
|
||||
| Update Completed/Commit | The update has successfully installed. |
|
||||
| Update Completed/Commit | The update has successfully installed. |
|
||||
|
||||
>[!NOTE]
|
||||
>Interacting with any rows in the perspective view will automatically apply the given value to the query and execute it with the new parameter, narrowing the perspective to devices that satisfy that criteria. For example, clicking “Not configured (-1)” devices in Deferral Configurations will filter the query to only contain devices that do not have a deferral configuration. These filters can also be applied to queries via the filter sidebar.
|
||||
> [!NOTE]
|
||||
> Interacting with any rows in the perspective view will automatically apply the given value to the query and execute it with the new parameter, narrowing the perspective to devices that satisfy that criteria. For example, clicking "Not configured (-1)" devices in Deferral Configurations will filter the query to only contain devices that do not have a deferral configuration. These filters can also be applied to queries via the filter sidebar.
|
||||
|
||||
@ -16,12 +16,16 @@ ms.topic: article
|
||||
|
||||
# Windows Defender AV Status
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
|
||||
|
||||
|
||||
The Windows Defender AV Status section deals with data concerning signature and threat status for devices that use Windows Defender Antivirus. The section tile in the [Overview Blade](update-compliance-using.md#overview-blade) provides the percentage of devices with insufficient protection – this percentage only considers devices using Windows Defender Antivirus.
|
||||
|
||||
>[!NOTE]
|
||||
>Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx).
|
||||
> [!NOTE]
|
||||
> Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx).
|
||||
|
||||
## Windows Defender AV Status sections
|
||||
The **Protection Status** blade gives a count for devices that have either out-of-date signatures or real-time protection turned off. Below, it gives a more detailed breakdown of the two issues. Selecting any of these statuses will navigate you to a Log Search view containing the query.
|
||||
|
||||
@ -6,7 +6,6 @@ description: Delivery Optimization is a new peer-to-peer distribution method in
|
||||
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
@ -183,7 +182,7 @@ Log entries are written to the PowerShell pipeline as objects. To dump logs to a
|
||||
|
||||
### Monitor with Update Compliance
|
||||
|
||||
The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
Update Compliance provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -45,7 +45,6 @@ Here's more news about [Windows as a service](windows-as-a-service.md):
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Reduced-Windows-10-package-size-downloads-for-x64-systems/ba-p/262386">Reducing Windows 10 Package Size Downloads for x64 Systems</a> - September 26, 2018</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434">Windows 7 Servicing Stack Updates: Managing Change and Appreciating Cumulative Updates</a> - September 21, 2018</li>
|
||||
<li><a href="https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop/">Helping customers shift to a modern desktop</a> - September 6, 2018</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-amp-Windows-Analytics-a-real-world/ba-p/242417#M228">Windows Update for Business & Windows Analytics: a real-world experience</a> - September 5, 2018</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-next-for-Windows-10-and-Windows-Server-quality-updates/ba-p/229461">What's next for Windows 10 and Windows Server quality updates</a> - August 16, 2018</li>
|
||||
<li><a href="https://www.youtube-nocookie.com/watch/BwB10v55WSk">Windows 10 monthly updates</a> - August 1, 2018 (<strong>video</strong>)</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376">Windows 10 update servicing cadence</a> - August 1, 2018</li>
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Windows as a service
|
||||
ms.prod: windows-10
|
||||
ms.prod: w10
|
||||
ms.topic: landing-page
|
||||
ms.manager: elizapo
|
||||
ms.manager: laurawi
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
@ -73,7 +73,6 @@ Learn more about Windows as a service and its value to your organization.
|
||||
|
||||
<a href="waas-quick-start.md">Quick guide to Windows as a service</a>
|
||||
|
||||
<a href="windows-analytics-overview.md">Windows Analytics overview</a>
|
||||
|
||||
<a href="../deploy-whats-new.md">What's new in Windows 10 deployment</a>
|
||||
|
||||
@ -117,7 +116,6 @@ Secure your organization's deployment investment.
|
||||
|
||||
Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service.
|
||||
|
||||
[BRK2417: What’s new in Windows Analytics: An Intro to Desktop Analytics](https://myignite.techcommunity.microsoft.com/sessions/64324#ignite-html-anchor)
|
||||
|
||||
[BRK3018: Deploying Windows 10 in the enterprise using traditional and modern techniques](https://myignite.techcommunity.microsoft.com/sessions/64509#ignite-html-anchor)
|
||||
|
||||
|
||||
@ -9,14 +9,13 @@ author: jaimeo
|
||||
ms.localizationprioauthor: jaimeo
|
||||
ms.audience: itpro
|
||||
author: jaimeo
|
||||
ms.date: 06/20/2018
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
# Configure the Basic group policy for Windows Update for Business
|
||||
|
||||
For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Update Compliance in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding to the Windows Analytics solution.
|
||||
For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Monitor Windows Update with Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding.
|
||||
|
||||
|Policy name|Description |
|
||||
|-|-|
|
||||
@ -28,4 +27,4 @@ For Windows Update for Business configurations to work, devices need to be confi
|
||||
|Policy|Location|Suggested configuration|
|
||||
|-|-|-|
|
||||
|Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled <br>**Option**: 1-Basic|
|
||||
|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled <br>**Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics|
|
||||
|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled <br>**Commercial ID**: The GUID created for you at the time of onboarding|
|
||||
|
||||
@ -16,15 +16,15 @@ ms.topic: article
|
||||
|
||||
Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions.
|
||||
|
||||
The compliance options have changed with the release of Windows 10, version 1903:
|
||||
The compliance options have changed for devices on Windows 10, version 1709 and above:
|
||||
|
||||
- [Starting with Windows 10, version 1903](#starting-with-windows-10-version-1903)
|
||||
- [Prior to Windows 10, version 1903](#prior-to-windows-10-version-1903)
|
||||
- [For Windows 10, version 1709 and above](#for-windows-10-version-1709-and-above)
|
||||
- [For prior to Windows 10, version 1709](#prior-to-windows-10-version-1709)
|
||||
|
||||
|
||||
## Starting with Windows 10, version 1903
|
||||
## For Windows 10, version 1709 and above
|
||||
|
||||
With a current version of Windows 10, it's best to use the new policy introduced in Windows 10, version 1903: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings:
|
||||
With a current version of Windows 10, it's best to use the new policy introduced in June 2019 to Windows 10, version 1709 and above: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings:
|
||||
|
||||
- Update/ConfigureDeadlineForFeatureUpdates
|
||||
- Update/ConfigureDeadlineForQualityUpdates
|
||||
@ -43,7 +43,7 @@ Further, the policy includes the option to opt out of automatic restarts until t
|
||||
|
||||
|Policy|Description |
|
||||
|-|-|
|
||||
| (starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. |
|
||||
| (For Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. |
|
||||
|
||||
|
||||
|
||||
@ -51,31 +51,34 @@ Further, the policy includes the option to opt out of automatic restarts until t
|
||||
|
||||
|Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days|
|
||||
|-|-|-|-|-|
|
||||
|(starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 |
|
||||
|(For Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 |
|
||||
|
||||
When **Specify deadlines for automatic updates and restarts** is set (starting in Windows 10, version 1903):
|
||||
When **Specify deadlines for automatic updates and restarts** is set (For Windows 10, version 1709 and above):
|
||||
|
||||
**While restart is pending, before the deadline occurs:**
|
||||
- For the first few days, the user receives a toast notification
|
||||
- After this period, the user receives this dialog:
|
||||
- **While restart is pending, before the deadline occurs:**
|
||||
|
||||
|
||||
- If the user scheduled a restart, or if an auto restart is scheduled, 15 minutes before the scheduled time the user is receives this notification that the restart is about to occur:
|
||||
- For the first few days, the user receives a toast notification
|
||||
|
||||
|
||||
- After this period, the user receives this dialog:
|
||||
|
||||
**If the restart is still pending after the deadline passes:**
|
||||
- Within 12 hours before the deadline passes, the user receives this notification that the deadline is approaching:
|
||||
|
||||
|
||||
|
||||
- Once the deadline has passed, the user is forced to restart to keep their devices in compliance and receives this notification:
|
||||
- If the user scheduled a restart, or if an auto restart is scheduled, 15 minutes before the scheduled time the user is receives this notification that the restart is about to occur:
|
||||
|
||||
|
||||
|
||||
|
||||
- **If the restart is still pending after the deadline passes:**
|
||||
|
||||
- Within 12 hours before the deadline passes, the user receives this notification that the deadline is approaching:
|
||||
|
||||
|
||||
|
||||
- Once the deadline has passed, the user is forced to restart to keep their devices in compliance and receives this notification:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Prior to Windows 10, version 1903
|
||||
## Prior to Windows 10, version 1709
|
||||
|
||||
|
||||
Two compliance flows are available:
|
||||
@ -119,9 +122,11 @@ Once the device is in the pending restart state, it will attempt to restart the
|
||||
#### Notification experience for deadline
|
||||
|
||||
Notification users get for a quality update deadline:
|
||||
|
||||
|
||||
|
||||
Notification users get for a feature update deadline:
|
||||
|
||||
|
||||
|
||||
### Deadline with user engagement
|
||||
|
||||
Reference in New Issue
Block a user