This winter I had the opportunity to present the Upgrading to Windows 11 using Microsoft Intune – Tips and Tricks session at Microsoft Ignite here in my hometown, Chicago. Unfortunately, this session was not among the sessions that were recorded, and I have received many requests of the information and sample scripts I showcased in the session. So, I made a summary of the session.
Preparation and Planning
- Selecting a Windows 11 Version. When upgrading to Windows 11 you typically work with two versions at the same time. The production version that you have tested, for most organizations right now that is Windows 11 23H2, and the next version you start to test/pilot. For now, that is Windows 11 24H2. The trick is to get 3-6 months of proper testing, before starting to upgrade in a large scale,
- Firmware Versions and Configuration. Pretty much every vendor out there, Dell, HP, Lenovo, Microsoft and others recommend keeping your BIOS/Firmware updated. Not just for security reasons, but also for compatibility with newer versions of the operating system. To update BIOS/Firmware versions you can use the firmware update control plane in Intune (which also supports driver updates).
- Driver Updates. The preceding section also goes for drivers, they should also be updated for security and compatibility reasons. If you are upgrading from one Windows 11 version to another Windows 11 version you will find the existing driver often works quite well, but when upgrading from Windows 10 to Windows 11, you are more likely to have to provide updated drivers during the upgrade process.
- Improving Network Performance. Windows 11, like Windows 10, has a large payload that has to be downloaded for the upgrade, and it will also start to download a fairly large set of updates to built-in components when the upgrade is completed. All in all, up to about 5 GB of content. If you are upgrading an office-type setup with hundreds, or maybe even thousands of devices sharing the same Internet link, that can cause impact on the network. To reduce that impact, it's important to configure the Delivery Optimization download stack correctly (see the next section).
Delivery Optimization Settings
When it comes to configuring Delivery Optimization (DO) for Inplace upgrades, you can pretty much follow the DO best practices for Win32 apps from Intune, but in general there are a few critical settings in a scenario when you have an office with 10 or more machines that you need to upgrade.
- Download Mode and Peer Selection. Download Mode 2, or group mode, is the most common download mode, combined with configuring a uniques Group ID for the office network, so that machines don't try to peer content to other offices over the WAN links. It's also beneficial to configure peer selection to DNS-SD, this mode enable all downloaded files to be shareable on the network, not just four files at the time.
- Delays and Throttling. Configuring Delay Foreground and Background Download allows the client to look for local content longer, before trying to download of the Internet. Minimum Background QoS should be configured, either to 20 or 64 depending on the Internet link speed. When it comes to bandwidth throttling, it is ok to do, but don't throttle to much or the Inplace upgrade download will timeout. In general, don't go below 4 mbit/s (512 KB/s).
- Cache Nodes. You can also set up local cache servers via the Microsoft Connected Cache for Enterprise and Education feature. This will speed up upgrades as well.
Windows 11 Upgrade Readiness
- Upgrade Experience Indicators. The Upgrade Experience Indicators are registry values created by the Microsoft Compatibility Appraiser task. These values will tell you the Windows 11 readiness state your devices, and if there are any safeguard holds. To learn more, read this post: https://www.deploymentresearch.com/understanding-upgrade-experience-indicators-for-windows-11-upgrade-readiness/
- Readiness Reports in Intune. Microsoft Intune has several reports that can be used to review readiness data gather from client telemetry, including the upgrade experience indicators. Zach Dvorak with Microsoft has an excellent post here: https://techcommunity.microsoft.com/blog/microsoftendpointmanagerblog/understanding-readiness-for-windows-11-with-microsoft-endpoint-manager/2770866
Upgrading to Windows 11 using Intune
- Feature Update Rings. Creating Feature Update rings in Intune is pretty straight forward, but there are limitations for GCC and GCC High/Dod cloud environments to be aware of. Read more here: https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-feature-updates
- Customizing Feature Updates. Even though the Intune console does not offer any ready-made customization options for feature updates (Inplace upgrades), you can use Remediation scripts to control advanced settings of the upgrade, and you can use Win32 apps to download drivers to the devices for the upgrade process when needed. If your remediation script creates the needed configuration file (setupconfig.ini) in the right folder, Intune will use it. The setupconfig.ini file in turn can also call other scripts in different phases of the upgrade. Here is an example:
[SetupConfig]
Quiet
Auto=Upgrade
EULA=Accept
BitLocker=AlwaysSuspend
Compat=IgnoreWarning
Priority=Normal
DynamicUpdate=Enable
ShowOOBE=None
Telemetry=Enable
DiagnosticPrompt=Enable
PKey=NPPR9-FWDCX-D2C8J-H872K-2YT43
InstallDrivers=C:\ProgramData\FeatureUpdate\Drivers
PostOOBE=C:\ProgramData\FeatureUpdate\Scripts\PostOOBE.cmd
CopyLogs=C:\ProgramData\FeatureUpdate\Logs
;Version=1.2Sample Scripts
The sample Remediation scripts used in the session can be found here: https://github.com/DeploymentResearch/DRFiles/tree/master/Scripts/Intune/Windows11FeatureUpdate
Tip: While feature updates in Intune requires the setupconfig.ini to be created in the C:\Users\Default\AppData\Local\Microsoft\Windows\WSUS folder, to save time when testing out your setupconfig.ini file for upgrades, you can just mount a Windows 11 ISO, copy the generated setupconfig.ini file to any folder, say C:\Temp, and then run the below command:
d:\setup.exe /configfile c:\temp\SetupConfig.iniReal World Note: If your setupconfig.ini references a folder for drivers, or a script, those better exist or setup.exe is going to fail.
Beyond the blog post
If you want to learn more, check out our online training academy covering Windows 11 upgrades, Intune and many other topics: https://academy.viamonstra.com