How can I use servicing plans in System Center Configuration Manager (Current Branch) to upgrade Windows 10 devices ?

[anyweb]

Introduction

At the start of this series of step by step guides you installed System Center Configuration Manager (Current Branch), then you configured discovery methods. Next you configured boundaries to get an understanding of how automatic site assignment and content location works. After that you learned how to update ConfigMgr with new features and fixes using a new ability called Updates and Servicing and you learned how to configure ConfigMgr to use Updates and Servicing in one of these two modes:

• Online mode
• Offline mode

To prepare your environment for Windows 10 servicing (this guide) you learned how to setup Software Updates using an automated method (via a PowerShell script) or manually using the ConfigMgr console. Next you used a PowerShell script to prepare some device collections, then you configured client settings for your enterprise and finally you'll deployed the ConfigMgr client agent using the software updates method which is the least intensive method of deploying the Configuration Manager client agent.

As System Center Configuration Manager (current branch) is being delivered as a service now, version 1602 was made available (March 11th, 2016) and you used Updates and Servicing to do an in-place upgrade to that version as explained here. Next you learned about how to use the Upgrade task sequence to upgrade your Windows 7, Windows 8 (and 8.1) and even your Windows 10 devices to a later build of Windows 10. In this guide you'll take a look at the new Windows 10 servicing features in ConfigMgr (Current Branch).

A short introduction to Windows 10 servicing

Windows 10 servicing is a broad category (discussed at length here on Technet) which includes different options for applying updates and upgrades to Windows 10 devices using a variety of different methods available. In this guide we are primarily interested in looking at Windows 10 servicing options within ConfigMgr (Current Branch) so that will be the focus. In a nutshell there are three Windows 10 servicing options we need to consider:

• Current Branch
• Current Branch for Business
• Long Term Servicing Branch

Each branch has its' own properties. If you are using Current Branch, then updates and upgrades are made available as soon as they are released from Microsoft and the key benefits are that it makes new features available to users as soon as possible. Current Branch for Business allows more time (4 to 8 months depending on your Defer Updates and Upgrades preferences) to 'wait and see' how those updates (and upgrades) can impact your environment. The key benefit here is it provides additional time to test new feature upgrades before deployment which is useful in a business scenario. Long Term Servicing Branch is aimed at low-change configurations (Operational Technology for example) where changing functionality can impact production. This is all neatly explained in the following table from Technet.

Note: Make sure to read the following post so that you understand the implications of enabling CBB using various methods (registry or gpo).

Familiarizing yourself with the Windows 10 servicing dashboard

Note: All screenshots taken here were from System Center Configuration Manager version 1602 (Current Branch). As ConfigMgr (Current Branch) is evolving at a fast rate based on UserVoice and production development it is very likely that abilities and even UI elements shown here will change in later versions of the product. In order to populate information on the dashboard and test Windows 10 Servicing, this lab already contains two Windows 10 computers, one is version 1507 and the other is version 1511.

 

In the ConfigMgr console select Software Library and expand Windows 10 Servicing. A dashboard similar to the below screenshot should appear.

 

 

The first thing you'll notice in the tiles displayed are the two doughnuts which contain visual clues about the versions and branches of Windows 10 in your organization.

Note: You will notice similar colors used throughout the tiles in the dashboard, however they don't necessarily match up between different tiles. This behavior will more than likely change in a later release of ConfigMgr (a bug has been raised and Microsoft is working on it).

Windows 10 Usage

Within the first tile is a doughnut called Windows 10 Usage.

 

 

This tile should give you an estimate of the different Windows 10 build versions encountered by ConfigMgr in your organization. If you have any Windows 10 Insider Preview versions, they'll be listed as Other.

Windows 10 Rings

Within the second tile is a doughnut called Windows 10 Rings.

 

 

This tile is used to give you an overview of the Windows 10 Branches in use and their readiness state, however instead of referring to those branches as explained in the table above, they have alias's. The following Table should clear that up:

• Release Ready : Current Branch
• Business Ready : Current Branch for Business
• Long Term Servicing Branch : Long Term Servicing Branch

In addition to the two doughnuts in the first two tiles you have another two tiles which allow you to Create Servicing plan and monitor Alerts along with a big tile reminding you to Please define servicing plan for Windows 10.

Note: Creating a servicing plan directly from within the dashboard will create a basic servicing plan which only prompts you for name, collection, deployment package, and readiness state (along with associated limitations for the last two). All other values will be default. If you want custom options, create the servicing plan directly from the ConfigMgr console.

Windows 10 Build

To see more information you either need a large resolution monitor or simply scroll down to reveal the Windows 10 Build tile which is a graph that plots out the versions of Windows 10, their readiness state and an approximate EOL.

 

 

What you can see from the above is that Windows 10 version 1507 is classified as Business Ready (Current Branch for Business) from the date it was released, and from approximately March 2016 Windows 10 version 1511 takes over that spot (while Windows 10 1507 heads into EOL). In fact, Windows 10 version 1511 was declared Current Branch for Business on the 8th of April 2016.

 

Ok so now that you've seen the dashboard, let's get on with the business of creating a servicing plan.

Step 1. Synchronize Software Updates

Before you create your servicing plan, make sure that the data you are using is up to date. To do that you need to synchronize with Microsoft Update. To perform a sync do as follows:

In the ConfigMgr console select the Software Library workspace, select Software Updates, right click on All Software Updates and choose Synchronize Software Updates. Answer Yes to the popup.

Using CMTrace, monitor the sync progress in <ConfigMgr Installation Path>\Logs\Wsyncmgr.log. Look for the Sync succeeded. Setting sync alert to canceled state on site <your_site_code> text in the log file to notify you of a successful sync.

Step 2. Creating a servicing plan

Servicing plans are akin to Automatic Deployment Rules (ADR) in Software Updates in that they can automatically download, and deploy updates to a collection based on the settings you define in the rule. Servicing plans however allow you to define what Windows 10 branches are in user in your environment and then monitor them in the servicing dashboard. From version 1602 onward, servicing plans are also tied so that you can manage the behavior for high-risk deployments.

Note: Servicing plans are designed to upgrade Windows 10 versions from one build to another build only. They are not designed for upgrading Windows 7 or Windows 8.1 to Windows 10. If you need to upgrade your Windows 7 or Windows 8.1 computers to Windows 10 use the Upgrade Task Sequence instead.

In this example you will create a servicing plan for Windows 10 Current Branch (this is because at the time of writing there were no upgrades available for Current Branch for Business). In the ConfigMgr console select Software Library and expand Windows 10 Servicing. Select Servicing Plans and in the ribbon click on Create Servicing Plan.

When the wizard appears, give the Servicing Plan a suitable name like SUM: Servicing Plan for Windows 10 (The SUM prefix allows you to clearly see that the deployment is for software updates in the monitoring console later.)

Next, point it to your target collection, this collection should contain Windows 10 computers that are suitable for this servicing plan (i.e. Current Branch as defined by not setting the Defer Upgrades setting).

Note: In production you'd want to create a hierarchy of test collections prior to releasing upgrades to the masses, this is in order to verify that your critical applications are not affected by the upgrade. How you populate those collections is up to you.

Next you get to choose which Deployment Ring you'd like to use. The Deployment Ring refers to the Windows readiness state that applies to this servicing plan, and once again you get to choose between Release Ready (Current Branch) or Business Ready (Current Branch for Business). Depending on which state you choose, you will see different results in the console, so it's a good idea to use the Preview button on the Upgrades screen particularly when moving the days (to wait) slider.

This servicing plan is aimed at Current Branch computers so select the first option.

Note: Even though Windows 10 version 1511 was declared as Current Branch for Business (CBB) on April 8th, 2016, that information has not yet trickled down to ConfigMgr as of 2016/4/10 therefore if you select the Business Ready deployment ring and 0 days, you will not see any suitable upgrades listed.

On the Upgrades screen select the three checkboxes and set the search criteria to

• Language=English
• Required=>=1
• Title= Upgrade to Windows 10 Enterprise

Note: Make sure to select the right version (SKU) of Windows 10 for your deployment, if your clients are running Windows 10 Enterprise, then you should select the Enterprise version of the upgrade.

Next, click on the Preview button, this will show what updates the wizard found that match your criteria

For the Deployment Schedule screen set the Software Available Time to be at least 4 hours after the rule has run in order for the actual software update deployment packages to reach the destination distribution points. In a slow wan, increase that time. For Installation Deadline, the deadline is the displayed deadline time plus a random amount of time up to 2 hours, this is to reduce the load generated by all computers in the collection downloading the updates at the same time.

On the User Experience screen, for User Notifications select Display in Software Center and show all notifications. For Deadline behavior, place a checkmark in Software Update Installation and System Restarts.

On the Deployment Package screen choose Create a new deployment package and fill in the details as appropriate

Next add the Distribution Points you want the package distributed to

select where to download the content from

and click through to the completion screen.

Step 3. Review additional servicing plan properties

Now that the servicing plan is created, highlight it in the console, right click and choose Properties.

Select the Evaluation Schedule tab, as you can see by default it's set to run after every SUP sync, if you want to change that behavior modify it here.

You can also review the Download Settings for the client in the Download Settings tab.

In Deployment Settings set the amount of detail to Only success and error messages

Step 4. Run the servicing plan and monitor

Now everything is in place, you could sit back and wait for things to happen or kick off a test run. To trigger the servicing plan into running you need to initiate a SUP sync (as specified by the Evaluation Schedule), or right click on the Servicing Plan and choose Run Now.

click OK to the message

Using CMTrace, monitor the download progress in <ConfigMgr Installation Path>\Logs\PatchDownloader.log. If you are connecting to the console using terminal services check C:\Users\<username>\AppData\Local\Temp\2\PatchDownloader.log. You can even determine how much of the download is remaining based on the percent complete value as shown in this screenshot below:

Note: Each Upgrade selected for download contains two architectures (X86 and X64) and their associated files. It is currently not possible to decide which Architecture to download.

Using CMTrace, you can review the servicing plan progress in <ConfigMgr Installation Path>\Logs\RuleEngine.log

After the download has completed successfully the Servicing Plan will be deployed (and the content distributed to the distribution points) and then show up in the ConfigMgr console in the Monitoring workspace, under Deployments.

You can also review Software Update Groups where the servicing plan will be listed along with its' Deployment.

Step 5. Review the Upgrade process on your Windows 10 devices

Note: Ensure that one or more applicable Windows devices are in the collection used when creating the servicing plan. Also note that if you are just testing the servicing plan, and you used the settings above that it may take up to 4 hours to show up on the client, adjust the servicing plan as necessary and choose Run Now again to re-deploy it with the new settings..

Now everything is in place for the Windows 10 servicing to begin. For this section you can review what happens on a Windows 10 version 1507 client. The first thing the client will see is a familiar notification in the systray informing the user that Software Changes are required.

clicking on that shows you these options

and before long it starts downloading and then installing the Upgrade

as the Servicing Plan was configured for all notifications, the user will be notified of the pending restart

at which time Windows will get updated

after everything is complete, log in to Windows to see this...

note the new version after the upgrade ?

Job done!

After confirming the success of the upgrade methodology, you can hop back to the ConfigMgr console and review the Windows 10 Servicing Dashboard.

Notice the Deploy Now button, that allows you to further deploy the same Servicing Plan to more collections.

Note: Occasionally Microsoft re-releases the Windows 10 upgrade media to the VLSC and Windows Update with newer versions of the media (for example adding Cumulative Updates to the media), and when they do so they currently expire the available media, meaning that new content has to be downloaded and evaluated by your servicing plans. This behavior may change in the future but for now, be aware of it.

until next time, adios !

Summary

Upgrading Windows 10 devices to a later release of Windows 10 is made easier with servicing plans defined at a schedule that suits you. While servicing plans won't take care of earlier versions of Windows such as Windows 7 or Windows 8.1, you can upgrade those devices with the upgrade task sequence method instead. Client side language packs are important to keep in mind as Servicing Plans do not deal with languages on the client side (if any are installed). Also, servicing plans cannot handle drivers or pre and post setup upgrade steps, for that use the upgrade task sequence method instead.

A significant amount of functionality has improved and changed between the ConfigMgr 1511 and ConfigMgr 1602 Current Branch releases based on feedback from UserVoice and connect.microsoft.com. I strongly expect the next release of ConfigMgr will be even more fine tuned and feature rich particularly in the area of Windows 10 servicing.

Related Reading

• Plan for Windows 10 deployment - https://technet.microsoft.com/itpro/windows/plan/index
• Windows 10 servicing options for updates and upgrades - https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing
• Manage Windows as a service using System Center Configuration Manager - https://technet.microsoft.com/en-us/library/mt627931.aspx
• Windows 10 1511 is now a Current Branch for Business (CBB) release - http://blogs.technet.com/b/windowsitpro/archive/2016/04/08/windows-10-1511-is-now-a-current-branch-for-business-cbb-release.aspx
• Windows 10 release information - https://technet.microsoft.com/en-us/windows/mt679505.aspx?ocid=wc-ext-aka

Downloads

You can download a Microsoft Word copy of this guide here dated 2016/04/10

How can I use servicing plans in System Center Configuration Manager (Current Branch) to upgrade Windows 10 devices.zip

[RichMawdsley]

Excellent write up Niall.

[bcsdtech]

I'm confused if my enviornment will support windows 10 servicing..

I'm running SCCM 1602 on Server 2008r2 - WSUS 3.2.7600

 

 

The appears, looks like it downloaded, and I deployed to a test OU.

Installing the update fails on a client computer.

 

Do I look into why this install is failing? Or is this enviornment not supported for windows 10 servicing? Do I need a 2012 software update point, or separate WSUS server? thank you,.

 

[anyweb]

that version of WSUS is not supported as your SUP for Windows 10 servicing, didn't you get any warning messages about that during your upgrade ?

 

WSUS 3.0 SP2 and unpatched WSUS 4.0 servers will be able to offer Windows 10 security updates but not the feature upgrades (i.e. the Windows 10 Servicing)....

 

you need to be running your Software update point role using WSUS 4.0 on Server 2012 or later to get proper support for Windows 10 servicing. See step 10 here

[bcsdtech]

that version of WSUS is not supported as your SUP for Windows 10 servicing, didn't you get any warning messages about that during your upgrade ?

 

WSUS 3.0 SP2 and unpatched WSUS 4.0 servers will be able to offer Windows 10 security updates but not the feature upgrades (i.e. the Windows 10 Servicing)....

 

you need to be running your Software update point role using WSUS 4.0 on Server 2012 R2 or later to get proper support for Windows 10 servicing. See step 10 here

Currently I have a Primary site which houses most roles, and a site system server with SQL. To fix my environment to support servicing...

 

Can I point my primary site SUP to a seperate WSUS upstream server?

or

Can I just uninstall software update point on my primary site server, make a new site server, install WSUS, and install SUP on that server?

Will either of these options work?

[anyweb]

Can I point my primary site SUP to a seperate WSUS upstream server?

not unless your primary is running server 2012r2 or later

Can I just uninstall software update point on my primary site server, make a new site server, install WSUS, and install SUP on that server?

nope

 

no, you need to upgrade the os to server 2012r2 then update use the supported version of WSUS (either remotely or on the site server)

[UESCDurandal]

I'm following these steps to deploy "Upgrade to Windows 10 Enterprise, version 1511, 10586 - en-us, Volume" to a PC running build 10240. I am able to deploy to Software Center and we receive the prompt to restart after installation, however the PC does not kick off the upgrade process after rebooting. Instead it returns to the login screen.

 

Opening Software Center after this reboot shows that the update status is "Installed", which is all the more baffling. I'm not sure why this upgrade is not starting. Attached is a screenshot of Software Center and our UpdatesStore.log file.

UpdatesStore.log

[keywan]

Hi guys,

 

my Servicing Plans do not show me all updates of Windows 10 version 1607. I see there only Updates of Windows 10 version 1511 and Feature update to Windows 10 Enterprise, version 1607( all language).

Any Idea why? I have changed the Title and Required, but no change. My Deployment Ring is CB.

[keywan]

Could I use the Servicing Plans to deploy or upgrade my Windows 7 to Winodows 10? because I see on my "All Windows Updates"

 

Upgrade to Windows Enterprise version 1511, 10586

[OffColour]

In the Source folder for the package it contains both the x32 and x64 upgrades. As we don't have any x32 installs, do you know of any way of only downloading x64 to avoid wasting disk space?

[skydriver]

Hi!

 

first Thank you @anyweb for your great HowTo's.

 

So, i've a question ... Which local path should I use as "Package Source"?

Thanks,

Marcel

[SteveH]

How does Config Manager update the which version of Windows is in which branch? I just updated from 1606 to 1610 and expected to see this chart updated:

And When I create a new "Business Ready" Servicing Plan I only get 1511 builds listed, "Release Ready" shows only 1607 builds.

Am I missing something? Thanks!

[john.rickard]

Hi guys,

 

my Servicing Plans do not show me all updates of Windows 10 version 1607. I see there only Updates of Windows 10 version 1511 and Feature update to Windows 10 Enterprise, version 1607( all language).

Any Idea why? I have changed the Title and Required, but no change. My Deployment Ring is CB.

 

Did this ever get an answer? - we are having a similar issue?

[anyweb]

How does Config Manager update the which version of Windows is in which branch? I just updated from 1606 to 1610 and expected to see this chart updated:

dashboard.JPG

And When I create a new "Business Ready" Servicing Plan I only get 1511 builds listed, "Release Ready" shows only 1607 builds.

Am I missing something? Thanks!

 

this chart is updated via the Service Connection Point role (which checks weekly)

In online mode: Diagnostics and usage data is automatically sent once a week from the service connection point to the cloud service.

[john.rickard]

 

Did this ever get an answer? - we are having a similar issue?

FIXED - ish!

 

https://www.windows-noob.com/forums/topic/14993-windows-10-1511-showing-as-compliant-in-cb-servicing-plan/

[jonnyshaw100]

I'm following these steps to deploy "Upgrade to Windows 10 Enterprise, version 1511, 10586 - en-us, Volume" to a PC running build 10240. I am able to deploy to Software Center and we receive the prompt to restart after installation, however the PC does not kick off the upgrade process after rebooting. Instead it returns to the login screen.

 

Opening Software Center after this reboot shows that the update status is "Installed", which is all the more baffling. I'm not sure why this upgrade is not starting. Attached is a screenshot of Software Center and our UpdatesStore.log file.

 

Did anyone find a resolution to this issue? We are experiencing the same thing. Doesn't seems to be all installs but most. Currently on 1511 and using servicing plan to upgrade to 1607. Software Center says installed but version is still 1511.

Also apart from the usual Software Updates logs are there any upgrade logs?

[anyweb]

use Powershell and Get-WindowsUpdate.log

 

the upgrade logs for Windows 10 will only be present if it actually starts the upgrade and they'll be in C:\$WINDOWS.~BT\Sources\Panther

 

look for setupact.log and setuperr.log

 

attach them here once found.

 

cheers

niall

[SiPhFi]

Hi

 

I'm currently new to this site and also to SCCM in general.

 

We've just upgraded to SCCM 1606, and want to utilise the Windows servicing for monthly patches. This maybe a stupid question, but can we use this for Windows 7 as well as 10?

 

Many Thanks in advanced.

 

 

[anyweb]

not a stupid question, but this is only for Windows 10, welcome to windows-noob.com

[ez_42]

First of all – thanks for the guide.
I’m running into a strange behavior and I’m not sure what to do or where I could check for more information related to the following.
I followed the guide until the point of deploying the update package.
Now the problem, I have a couple of testclients in the targeted collection but all of them are just staying under “unknown” -> “Client check passed/active” I really don’t know where or what I could possibly check/test.

Maybe I should mention that our Clients are receiving updates usually from a different WSUS which has nothing to do with the SCCM. Could this may cause the problem?
Thanks for your attention and time.

[cumbrianblues]

Have you guys seen this? https://blogs.technet.microsoft.com/windowsserver/2017/01/09/why-wsus-and-sccm-managed-clients-are-reaching-out-to-microsoft-online/

 

MS now recommend not to set the defer updates GPO as it causes dual scan issues with machines getting update via the internet, see also https://support.microsoft.com/help/4010155

[anyweb]

Maybe I should mention that our Clients are receiving updates usually from a different WSUS which has nothing to do with the SCCM. Could this may cause the problem?

 

 

yup, that's your issue, they need to be managed by ConfigMgr and whatever sup or sup's you are using

[ez_42]

 

yup, that's your issue, they need to be managed by ConfigMgr and whatever sup or sup's you are using

 

Thank you. I hoped that won't be a point. So I will switch to a tasksequence-based update process because the existing WSUS won't be replaced.

[kcorrie]

Great guide!  I hope you can offer some help though. 

I was able to follow these steps and upgrade two test VM's I setup with 1507 and 1511 to 1607 no problem.  I added two production computers to the same collection as the test VM's, but they will not upgrade.  They receive the advertisement and download the upgrade but fail installation.  The error message is "The software change returned error code 0x80070002 (-2147024894)."  I've researched this to learn that the file is not found but when I look in the ccmcache folder, it's there.  I've checked UpdatesHandler.log and UpdatesDeployment.log but nothing pops out to me.  Any idea why this is happening?

[ogeccut]

I am a bit confused about step configuring Updates in the servicing plan.

When i  click on "Preview" i do not see any information:

What have i missed?

Thank you