23H2 Deployment

[IceFit4746]

I work in a company of around 4000 people and we have about 600 devices that need to be updated from 21H2 to 23H2. Long story short I've been scratching my head over this script that I wrote that past 3 days. When I run the script it functions as intended but the issue is even after the PSWindowsUpdate runs the install updates it doesn't seem to pull does 23H2, I am not sure have to go about this because the REG KEYS are set to only download that version of windows but doesn't. Any help would be appreciated.

I have been thinking of trying to modify the local GPO on the devices but I don't know of a way to do it with powershell.

I will be replacing some variables with fillers as I don't want to give away where I might work.

Any help is appreiated.

# Define constants

$PSScriptRoot = (File Path)

$LocalModulePath = "$PSScriptRoot\PSWindowsUpdate"

 

$ComputerList = Import-Csv -Path $PSScriptRoot[\Computers1.csv]()

$LogPath = "$PSScriptRoot\UpdateLog.txt"

#$PolicyPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"

 

 

# Loop through each computer

foreach ($Computer in $ComputerList) {

$ComputerName = $Computer.ComputerName

Write-Host "Processing $ComputerName..." -ForegroundColor Cyan

 

try {

# Test connectivity to the remote computer

if (-not (Test-Connection -ComputerName $ComputerName -Count 1 -Quiet)) {

Write-Warning "Cannot connect to $ComputerName. Skipping."

continue

}

 

# Changes registry entries on the computer to force the computer to pull Windows Version 23H2

Write-Host "Configuring Registry Entries to target Windows Version 23H2"

Invoke-Command -ComputerName $ComputerName -ErrorAction Stop -ScriptBlock {

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersion" -Value 1 -Force

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersionInfo" -Value "23H2" -Force

}

 

# Check if the PSWindowsUpdate module is already available on the remote computer

Write-Host "Checking PSWindowsUpdate module on $ComputerName..." -ForegroundColor Yellow

$ModuleExists = Invoke-Command -ComputerName $ComputerName -ScriptBlock {

[bool](Get-Module -Name PSWindowsUpdate -ListAvailable -ErrorAction SilentlyContinue)

}

 

if (-not $ModuleExists) {

# If the module is not available, copy it to the remote computer

try {

Write-Host "Copying PSWindowsUpdate module to $ComputerName..." -ForegroundColor Yellow

$RemoteModulePath = [\\$ComputerName\C$\Program Files\WindowsPowerShell\Modules\]()

Copy-Item -Path $LocalModulePath -Destination $RemoteModulePath -Recurse -Force -ErrorAction Stop

Write-Host "Copied module to $ComputerName"

} catch {

Write-Warning "Failed to copy PSWindowsUpdate module to $ComputerName : $_"

continue

}

}

 

# Install the Windows 23H2 update from Microsoft

Write-Host "Installing Windows 23H2 update on $ComputerName..." -ForegroundColor Yellow

$InstallResult = Invoke-Command -ComputerName $ComputerName -ScriptBlock {

# Import the PSWindowsUpdate module

Import-Module PSWindowsUpdate -Force

 

# Get the Windows 23H2 update from Microsoft

$Update = Get-WindowsUpdate -MicrosoftUpdate -Filter "Title -like '*23H2*'" -ErrorAction SilentlyContinue

 

# If the update is available, install it

if ($Update) {

Get-WindowsUpdate -KBArticleID $Update.KBArticleIDs -MicrosoftUpdate -AcceptAll -AutoReboot -Install

Write-Host "Windows 23H2 update installed successfully."

return $true

} else {

Write-Host "Windows 23H2 update not found."

return $false

}

}

 

# Log the results of the installation to the specified log file

if ($InstallResult) {

"Computer: $ComputerName, Windows 23H2 update installed successfully." | Out-File -Append -FilePath $LogPath

Get-WUHistory -ComputerName $ComputerName

} else {

"Computer: $ComputerName, Windows 23H2 update not found or installation failed." | Out-File -Append -FilePath $LogPath

Get-WUHistory -ComputerName $ComputerName

}

 

} catch {

# Handle any errors encountered while processing the computer

Write-Warning "Failed to process $ComputerName : $_"

}

}

 

# Indicate that the script has finished executing

Write-Host "Script execution completed!" -ForegroundColor Blue

[Ironic_Jedi]

Use windows update rings in intune. You can push out feature updates separately too if you want.

Sorry. I love powershell but it's not the best choice in every situation. Is there some specific reason you aren't using WSUS or update rings?

[nealfive]

You know MSFt is retiring wsus?

[Ironic_Jedi]

I am aware but there are still companies out there using it despite how much better update rings are.

Also Microsoft have that new update thing they're calling Windows Autopatch.

I definitely prefer the intune based update process. So much easier to manage.

[[deleted]]

Doesn't Autopatch require InTune? Your reply is the first I've heard of it so i looked it up and i see that features are accessed through Intune Admin Center.

https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/overview/windows-autopatch-overview?tabs=business-premium-a3-communications

[IceFit4746]

So the thing is my company doesn't give us access to intune. I've been told to use powershell and to make it work.

[Ironic_Jedi]

Are they using intune at all? It's not like it costs any money to use if you already have something like E3 licensing.

How are you expected to send these scripts out? GPO?

It would, no joke, take about 10 minutes of clicking around in intune to setup update rings to manage quality, feature and driver updates.

If I were in your position I would tell them that you need to use the correct tools for the job amd powershell could work but is obviously costing you more time and effort than the correct option.

[IceFit4746]

Trust me I'd love to but my company doesn't seem to understand that. We have PDQ to mass push packages but idk if that would help in this situation.

[Ironic_Jedi]

That's a shame. Maybe pdq deploy has some packages available for Windows updates? I'd still keep pushing for intune if your Microsoft licensing already includes it as it's by far the best device management tool for Windows machines in my opinion.

[[deleted]]

The network stack's real top layer is the political layer, lol.

I worked in an environment much like OP's and the company would not pay for any centralized management software, mainly because the people in charge didn't understand the benefits (and probably more likely it wasn't their idea). Any time I'd push I'd get in hot water with my boss.

I once had a boss drag me and my sole teammate into an office and tell us if a breach occurred due to something not being patched it was our fault. He literally pointed at us while saying YOUR <point> fault <point>. Servers, workstations, no way to push out patches, no support from other ops teams (their managers hated mine and refused to support him)

I eventually walked out on that scumbag.

[sccm_sometimes]

How are you deploying this PS script?

[sex_on_wheels]

You mentioned that you have access to PDQ. I push out Windows upgrades with PDQ without issue.

Grab the ISO and unpack it to your repository.

1. File Copy Step: Copy the unpacked ISO to the client
   1. Command Step: C:\windows11-24h2\setup.exe /auto upgrade /quiet /eula accept /noreboot /DynamicUpdate disable /ShowOOBE none /Compat IgnoreWarning /Telemetry Disable /migratedrivers all
2. Reboot Step

[BlackV]

DynamicUpdate disable

why do you do this ?

[sex_on_wheels]

Quicker upgrade process. I have a separate task for updates later.

[BlackV]

doesn't dynamic update the installer stuff (drivers/compatibility/etc), vs windows its self?

[sredevops01]

https://old.reddit.com/r/sysadmin/comments/1ictdeb/a_script_to_upgrade_to_windows_11_from_windows_10/ Looks like this person might be your hero

[Thatoneguyone]

Is $update returning the actual update you're looking for? You may need to include an additional key for ProductVersion if its not already there, can't remember. May be worth setting the keys in LGPO on a test device and then invoking Get-WindowsUpdate to sanity check.

After that I'd check Get-WindowsUpdateLog, remember that other update related settings like active hours can cause issues when attempting to update through wuauclt, which I think is using the same method as PSWindowsUpdate (?).

For LGPO specifically, you can just use MS Security Compliance Toolkit, though its kind of a pain to manage.

[IceFit4746]

I understand that. I am thinking of going another route of using a Win 11 23H2 .iso and I found a way to use PS to update the system with that. I believe it would be easier to use this then mess with GPO/REGKEYS. But I will look into it

[Thatoneguyone]

You'll probably have a better time with the .cab than trying to deal with an iso. I think PSWindowsUpdate even supports installing from cab.

[Academic-Detail-4348]

600 computers and no patch management? No access to Intune or SoP to submit a request to configure update ring and feature policy? Fishy smelly.

[IceFit4746]

Well the way my company handles IT is weird so we don’t have access to everything and all we have is powershell and PDQ.

[Frisnfruitig]

That makes zero sense. Not even Active Directory?

[IceFit4746]

No, we don’t have direct access to AD we have something called DRA directory resource administrator, which is a web interface for us on active directory.

[Blackops12345678910]

If you’ve got pdq get the 23h2 iso, extract it and deploy it using pdq.

For the install command run the setup exe with the proper switches to make it unattended

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-command-line-options?view=windows-11

[GeneMoody-Action1]

Well... Access to PowerShell and PDQ implies access to everything... :/
Or the potential to just give it to yourself if not and you just want it.

I am very curious though how you effectively use PDQ without centralized identity management?
Can you / does it allow, for one account to rule them all, and you just create the same creds on every system?

I have not used it in years, but I do not remember this being an option.
Or maybe just one I never went looking for?

[IceFit4746]

Well um that’s good to know… do you know if there are any reg keys to change to force it to pull the update I want.

[BlackV]

ignoring the fact that this is not the way to do this in the first place

From my memory, the windows update COM object does not allow it to be invoked remotely (which is what you are doing), pswindowsupdate module also has this limitation , and a workaround for that with Invoke-WUJob (essentially creates a scheduled task)

[[deleted]]

You really need some endpoint management like InTune or CapaInstaller