Intune Feature Update Policies Plan B – Inside the Windows Update Assistant

The Windows Update Assistant is a Microsoft utility that installs feature updates on your machines. For example, upgrading Windows 10 22H2 to Windows 11 24H2. While it's primarily designed for individual ad-hoc upgrades, I've seen a few organizations running this as an enterprise upgrade tool or as a backup when Feature Update Policies from Intune are misbehaving. Hence the "Plan B" notion 🙂

When used with Intune, the Windows Update Assistant is typically started from a Remediation script, but you can also package it as a Win32 application so that users can launch the upgrade at will from the Company Portal.

Note #1: The Windows Update Assistant does not currently support Windows on ARM.

Note #2: This is not the only Plan B option available, but it is a fully supported tool from Microsoft. I've also seen other creative solutions, such as packaging the entire Windows 11 media into a Win32 app or generating an offline media from MDT and packaging it into a Win32 app.

Downloading the Windows Update Assistant

The latest Windows Update Assistant (Windows11InstallationAssistant.exe) can be downloaded from: https://go.microsoft.com/fwlink/?linkid=2171764

Running the Windows Update Assistant Unattended

The Windows Update Assistant is a GUI-based tool, but it does support command-line switches to automate the process. These switches are not particularly well documented (like not at all), but here is a pretty good reference list: https://learn.microsoft.com/en-us/answers/questions/1020951/upgrading-w10-to-w11-with-windows11installationass

When launched via a Remediation script in Intune, you can (and should) add some basic error handling around the tool. Here are two examples from the Intune community:

Upgrade_Windows_with_Fixes.ps1 from John Marcum @ PowerStacks
https://github.com/PowerStacks-BI/UpgradeWindows

Windows 11 24H2 Upgrade Using Intune & PowerShell Script from Chander Mani Pandey @ Unisys
https://github.com/ChanderManiPandey2022/Windows-11-24H2-Upgrade-using-Intune-PowerShell-Script

Inside the Windows Update Assistant

If you start the Windows Update Assistant interactively (GUI), you'll see that the default behavior is to look for the result of running the Windows PC Health Check application. If there is no result, the assistant will prompt you to download and run the Windows PC Health Check (download link: https://go.microsoft.com/fwlink/?linkid=2169346).

However, when starting the Windows Update Assistant unattended, the Windows PC Health Check requirement is bypassed. For example, when using these switches: /quietinstall /skipeula /auto upgrade /copylogs C:\ProgramData\FeatureUpdate

Here is the process flow when the Windows Update Assistant is launched:

1. The Windows Update Assistant It installs itself into the C:\Program Files (x86)\WindowsInstallationAssistant folder and launches the Windows10UpgraderApp.exe process.

2. The Windows10UpgraderApp.exe process downloads the latest Windows 11 ESD file – for example, 26100.1742.240909-0928.ge_release_svc_refresh_CLIENTBUSINESS_VOL_x64FRE_en-us.esd – into the %temp% folder.

3. The Windows10UpgraderApp.exe process extracts the Windows 11 ESD file to the C:\$GetCurrent folder.

    4. The Windows10UpgraderApp.exe process then launches setup.exe from the C:\$GetCurrent\media folder with a set of command line switches. When I tested, these switches were used:

    /migchoice upgrade
    /showoobe none
    /quiet
    /Compat IgnoreWarning
    /eula accept
    /noreboot
    /postoobe C:\$GetCurrent\SafeOS\SetupComplete.cmd
    /CorrelationVector gRHX7OFwnkKE4Efl.999
    /ClientId Win10UA:VNL:URL::<1.4.19041.5003>:<3>:{D91A3CF5-C63A-4E76-891C-C3A8AD5625B7}:[10.0.19045]:[2]
    /DynamicUpdate Enable
    /telemetry enable
    /UpdateMedia Decline
    /SkipSummary

    5. The Windows10UpgraderApp.exe process also creates a few batch and ini files related to setup in the C:\$GetCurrent\SafeOS folder. I uploaded a few samples here: https://github.com/DeploymentResearch/DRFiles/tree/master/Scripts/WindowsUpgradeAssistant/SafeOS-Sample

    6. When the downlevel phase (old Windows) is completed, a prompt for reboot will be presented, and from that point the upgrade continues.

    7. When the upgrade is completed, the end user will see the following screen:

    About the author

    Johan Arwidmark

    5 3 votes
    Article Rating
    Subscribe
    Notify of
    guest
    0 Comments
    Newest
    Oldest Most Voted

    >