How could Windows 10 1803 be delayed

TL;DR: Some background on Windows Releases, and some speculation on why the latest build of Windows 10 Version 1803 has been delayed

BVT

My first job at Microsoft was working as a tester in the Windows NT build lab. First build 807. The job was to test Windows NT to ensure that it passed a series of automated regression tests, and met the basic functionality requirements to be sent out for broader testing within the Windows NT Product Groups. Called Build Verification Testing.

Testing things like Word, Excel, Notepad, Network Connectivity, printing, etc… Believe it or not, this was *before* Internet Explorer. so no Web browsing.

The idea is that if you could *not* perform some basic operations, then you wouldn’t want the build to get out to the larger test org, so they don’t have to waste their time on a build version that can’t even run notepad.

Windows 10

Which brings up back to Windows 10. There are a lot of testing phases involved with Windows 10. Each phase involves more people, broader testing, each phase, hopefully testing more functionality in the OS:

• Build lab testing (BVT)
• Microsoft internal testing
• Fast Ring ( external to Microsoft )
• Slow Ring
• Semi-Annual Channel – Targeted ( Official release ) – RTM
• Semi-Annual Channel ( Broad Deployment )

I still call the full releases “RTM” Release to Manufacturing, although for most builds, they get published to Windows Update and/or the volume licensing sites. There are still some builds that actually get put on USB Sticks, so I guess there is a factory… somewhere.

Cumulative Updates

Additionally Patches ( Cumulative updates ) also follow a Fast/Slow/Release schedule, so if you wanted to you could be deploying pre-release Cumulative updates to your test machines to get ahead of potential problems.

What’s interesting is that as of this post, the Cumulative Updates for Windows 10 version 1803 are already up to 17133.73!  Seventy Three builds since the start.

For most minor bugs that are identified after an OS is released, Microsoft has a well defined update process defined that can update and fix most issues. If you find a minor bug in notepad, then don’t release the FULL OS again, just send out the CU notepad fix via Windows Update!

Showstoppers

Not all builds make it to the next level. Sometimes the builds are just tests, and there is no need for them to continue on, they don’t have the final set of features, or have too many bugs.

But what could cause a build that nears full release to get reset like 1803? I don’t know the exact details of what is causing 17133 to have problems, but I know it’s not a minor problem. Again, minor problems can and *should* be fixed via Cumulative Updates.

Instead I speculate the problem can’t be fixed by Cumulative Update, or some other problem that prevents some machines from even installing CU’s.

That would be bad. This is my thoughts of why 17133 is delayed.

Take away

Sometimes we as IT professionals get so wrapped up in just one kind of testing that we forget to test all the environments. Perhaps we are only testing the bare-metal OS Wipe and Load process, or just testing In-Place upgrade. Really we need to test both.

(I Have a client that just had this problem, they were only testing Bare Metal Wipe and Load scenarios, and were surprised that a couple of Dell’s didn’t survive a In-Place upgrade to 1709, even though we strongly recommended In-Place upgrade testing across a wide selection of hardware types).

Additionally, add at least one Cumulative Update to your testing procedures, if you can’t service a machine after installing an OS, then you are going to have problems sometime in the future :).

-k

Out-Default Considered Harmful!

TL;DR: Don’t use Out-Default within a PowerShell cmdlet/function, unless you REALLY need to go to the console, otherwise use Write-Output.

Working with a client trying to narrow down a very quirky, but potentially damaging issue with Windows Update.

After spending several hours on the issue, we realized that we really didn’t have enough data, and it was suggested we programmatically search the WindowsUpdate.log, on a subset of machines, to search the presence of a specific string. If we find the string, then the machine is marked for further investigation.

New Log file format

For whatever reason, back in 2015, Microsoft decided to change the WindowsUpdate.log file format to a new format using the Event Tracing for Windows system.

See the blog here (the comments at the end of the blog are not kind).

The new system uses the Event Tracing for Windows system, and requires a convoluted Set of steps necessary to decode the data and write to a log file. Took me about an hour just to determine what the steps were to construct the command line arguments to extract a single *.etl file. In addition you must also connect to the Microsoft Symbol Servers to decode the data.

Thankfully Microsoft has included a PowerShell module and cmdlet to perform the operations… or so I thought…

WindowsUpdate PowerShell Module

Included in Windows 10 is a PowerShell module called WindowsUpdate. It’s not really that complex, the script is included, and you can see what it does:

C:\Windows\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdateLog.psm1

The cmdlet get-WindowsUpdateLog really just parses the c:\windows\Logs\WindowsUpdate\*.etl files and places all the information in a single log file, on the desktop by default. 

Honestly, I didn’t like the way the module connected to the Microsoft Symbol Servers, so I spent a while trying to figure out how to work around that, unfortunately the TraceRPT.exe tool couldn’t parse the file without the Symbols, and it frustrated me for other reasons. So I decided to use the PowerShell module as-is.

We wrote a PowerShell script and tried it out, but I noticed that the get-WindowsUpdateLog cmdlet was writing a lot data to the Console. I tried piping the output to null:

get-WindowsUpdateLog | out-null

But it didn’t work. A quick scan of the script source revealed that the author elected to write all output to Out-Default. Not Write-Host, not Write-Output, not Write-Verbose. To Out-Default

Why is that a problem?

Out-Default

Turns out that Out-Default is just a default handler for host output, not pipeline output. In the case of get-WindowsUpdate, it was just acting as a default wrapper around write-host. The background of why you would *NOT* want output from a cmdlet or script to go to the console, please Jeff Snover’s blog post on the matter: https://www.jsnover.com/blog/2013/12/07/write-host-considered-harmful/

That’s fine if we KNOW that we want the output to go to the console, but what if we want the output from a cmdlet to go to the pipeline? Well in that case get-WindowsUpdate is forcing output to the console no matter what. 

During a code review, I would have recommended using Write-Output instead, that would have redirected all output to the pipeline, allowing the out-null hack above to work.

SCCM Configuration Items and console output

The challenge is that if we elected to place this compliance script into a System Center Configuration Manager – Configuration Item script, it could lead to some undefined results.

For what ever reason, the SCCM team decided to key a PowerShell script’s success based on the console output. If it passes, the script would have called:

Write-Host "Compliant"

and have the Configuration Item search for the output “Compliant”. This is a case where we *KNOW* we want the script to write to the console. But we can’t have anything else in the script write to the console. Nothing! Otherwise it would be marked as a failure.

Personally, I would have also designed Configuration Item’s to measure pass/fail based on the process exit code directly.

The Hack

OK, Super! We have a PowerShell script that insists on writing output to the console, and a controller that get’s confused by non-deterministic console output. Sigh…

Time to write a hack. I developed a solution, and afterwards came across the same answer posted to StackExchange/SuperUser.com, so I’ll include that here.

https://superuser.com/questions/1058117/powershell-v5-suppress-out-default-output-in-nested-functions

Essentially the goal is to remove or replace the out-default cmdlet with our own function, PowerShell allows this action, I don’t usually recommend doing that, but it works in this case.

The Code

	<#
	.SYNOPSIS
	Search WindowsUpdate Logs
	.DESCRIPTION
	Searches the Windows Update Log for a string
	.NOTES
	Ready to be used within a
	Copyright Keith Garner, All rights reserved.
	.LINK
	https://keithga.wordpress.com/2018/04/03/out-default-considered-harmful
	#>
	[cmdletbinding()]
	param(
	[parameter(Mandatory=$true)]
	$SearchString,
	$CleanWU,
	$ETLPath = "$env:WinDir\Logs\WindowsUpdate"
	)
	$WULog = New-TemporaryFile
	# Hack Hack to work arround Windows Update SCCM Config Item interop issue.
	if ( -not ( test-path alias:out-default ) ) { new-alias Out-Default Write-Verbose -Scope global }
	Get-WindowsUpdateLog -LogPath $WULog -ETLPath $ETLPath
	remove-item alias:Out-Default -force -EA SilentlyContinue
	$WUResults = Select-String -path $WULog -Pattern $SearchString -AllMatches
	if ( $WUResults ) {
	write-host "Not Compliant $($WUResults.Count) $env:computerName"
	$wuresults | out-string -Width 200 | write-verbose
	}
	else {
	write-host "Compliant"
	}
	if ( $CleanWU ) {
	write-verbose "Cleanup"
	remove-item -Recurse -Force -Path $env:temp\WindowsUpdateLog
	}

view raw

find-StringInWULog.ps1

hosted with ❤ by GitHub

-k

 

 

A replacement for SCCM Add-CMDeviceCollectionDirectMembershipRule PowerShell cmdlet

TL;DR – The native Add-CMDeviceCollectionDirectMembershipRule PowerShell cmdlet sucks for adding more than 100 devices, use this replacement script instead.

How fast is good enough? When is the default, too slow?

I guess most of us have been spoiled with modern machines: Quad Xeon Procesors, couple hundred GB of ram, NVME cache drives, and Petabytes of storage at our command.

And don’t get me started with modern database indexing, you want to know what the average annual rainfall on the Spanish Plains are? If I don’t get 2 million responses within a half a second, I’ll be surprised, My Fair Lady.

But sometimes as a developer we need to account for actual performance, we can’t just use the default process and expect it to work in all scenarios to scale.

Background

Been working on a ConfigMgr project in an environment with a machine count well over ~300,000 devices. And we were prototyping a project that involved creating Device Collections and adding computers to the Collections using Direct Membership Rules.

Our design phase was complete, when one of our engineers mentioned that Direct Memberships are generally not optimal at scale. We figured that during the lifecycle of our project we might need to add 5000 arbitrary devices to a collection. What would happen then?

My colleague pointed to this article: http://rzander.azurewebsites.net/collection-scenarios Which discussed some of the pitfalls of Direct Memberships, but didn’t go into the details of why, or discuss what the optimal solution would be for our scenario.

I went to our NWSCUG meeting last week, and there was a knowledgeable Microsoft fella there so I asked him during Lunch. He mentioned that there were no on-going performance problems with Direct Membership collections, however there might be some performance issues when creating/adding to the collection, especially within the Console (Load up the large collection in memory, then add a single device, whew!). He recommended, of course, running our own performance analysis, to find out what worked for us.

OK, so the hard way…

The Test environment

So off to my Standard home SCCM test environment: I’m using the ever efficient Microsoft 365 Powered Device Lab Kit. It’s a bit big, 50GB, but once downloaded, I’ll have a fully functional SCCM Lab environment with a Domain Controller, MDT server, and a SCCM Server, all running within a Virtual Environment, within Seconds!

My test box is an old Intel Motherboard circa 2011, with a i7-3930k processor, 32GB of ram, and running all Virtual Machines running off a Intel 750 Series NVME SSD Drive!

First step was to create 5000 Fake computers. That was fairly easy with a CSV file and the SCCM PowerShell cmdlet Import-CMComputerInformation.  Done!

Using the native ConfigMgr PowerShell cmdlets

OK, lets write a script to create a new Direct Membership rule in ConfigMgr, and write some Device Objects to the Collection.

	<#
	Example of how to create a Device Collection and populate it with computer objects
	The Slow way. <Yuck>
	#>
	[cmdletbinding()]
	param(
	$CollBaseName = 'MyTestCol_03_{0:D4}',
	$name = 'PCTest*'
	)
	foreach ( $Count in 5,50 ) {
	$CollName = $CollBaseName -f $Count
	write-verbose "Create a collection called '$CollName'"
	New-CMDeviceCollection -LimitingCollectionName 'All Systems' -Name $CollName | % name | write-Host
	Measure-Command {
	Write-Verbose "Find all Devices that match [$Name], grab only the first $Count, and add to Collection [$CollName]"
	get-cmdevice -name $name -Fast |
	Select-Object -first $count |
	Foreach-Object {
	Add-CMDeviceCollectionDirectMembershipRule -CollectionName $CollName -ResourceId $_.ResourceID -verbose:$False
	}
	} | % TotalSeconds | write-Host
	}

view raw

DeviceCollPerformance1

hosted with ❤ by GitHub

Unfortunately the native Add-CMDeviceCollectionDirectMembershipRule cmdlet, doesn’t support adding devices using a pipe, and won’t let us add more than one Device at a time. Gee… I wonder if *that* will affect performance. Query the Collection, add a single device, and write back to the server, for each device added. Hum….

Well the performance numbers weren’t good:

Items to add	Number of Seconds to add all items
5	4.9
50	53

As you can see the number of seconds increased proportionally to the number of items added. If I wanted to add 5000 items, were talking about 5000 seconds, or an hour and a half. Um… no.

In fact a bit of decompiling of the native function in CM suggests that it’s not really designed for scale, best for adding only one device at a time.

Yuck!

The WMI way

I decided to see if we could write a functional replacement to the Add-CMDeviceCollectionDirectMembershipRule cmdlet that made WMI calls instead.

I copied some code from Kadio on http://cm12sdk.net (sorry the site is down at the moment), and tried playing around with the function.

Turns out that the SMS_Collection WMI collection has  AddMembershipRule() <Singular> and a AddMembershipRules() <multiple> function. Hey, Adding more than once one device at a time sounds… better!

<Insert several hours of coding pain here>

And finally got something that I think works pretty well:

	<#
	Example of how to create a Device Collection and populate it with computer objects
	The Faster way. <Yea!>
	#>
	[cmdletbinding()]
	param(
	$CollBaseName = 'MyTestCol_0C_{0:D4}',
	$name = 'PCTest*'
	)
	#region Replacement function
	Function Add-ResourceToCollection {
	[CmdLetBinding()]
	Param(
	[string] $SiteCode = 'CHQ',
	[string] $SiteServer = $env:computerName,
	[string] $CollectionName,
	[parameter(Mandatory=$true, ValueFromPipeline=$true)]
	$System
	)
	begin {
	$WmiArgs = @{ NameSpace = "Root\SMS\Site_$SiteCode"; ComputerName = $SiteServer }
	$CollectionQuery = Get-WmiObject @WMIArgs -Class SMS_Collection -Filter "Name = '$CollectionName' and CollectionType='2'"
	$InParams = $CollectionQuery.PSBase.GetMethodParameters('AddMembershipRules')
	$Cls = [WMIClass]"Root\SMS\Site_$($SiteCode):SMS_CollectionRuleDirect"
	$Rules = @()
	}
	process {
	foreach ( $sys in $System ) {
	$NewRule = $cls.CreateInstance()
	$NewRule.ResourceClassName = "SMS_R_System"
	$NewRule.ResourceID = $sys.ResourceID
	$NewRule.Rulename = $sys.Name
	$Rules += $NewRule.psobject.BaseObject
	}
	}
	end {
	$InParams.CollectionRules += $Rules.psobject.BaseOBject
	$CollectionQuery.PSBase.InvokeMethod('AddMembershipRules',$InParams,$null) | Out-null
	$CollectionQuery.RequestRefresh() | out-null
	}
	}
	#endregion
	foreach ( $Count in 5,50,500,5000 ) {
	$CollName = $CollBaseName -f $Count
	write-verbose "Create a collection called '$CollName'"
	New-CMDeviceCollection -LimitingCollectionName 'All Systems' -Name $CollName | % name | write-Host
	Measure-Command {
	Write-Verbose "Find all Devices that match [$Name], grab only the first $Count, and add to Collection [$CollName]"
	get-cmdevice -name $name -Fast |
	Select-Object -first $count |
	Add-ResourceToCollection -CollectionName $CollName
	} | % TotalSeconds | write-Host
	}

view raw

DeviceCollPerformance2

hosted with ❤ by GitHub

Performance numbers look much better:

Items to add	Number of Seconds to add all items
5	1.1
50	1.62
500	8.06
5000	61.65

Takes about the same amount of time to add 5000 devices using my function as it takes to add 50 devices using the native CM function. Additionally some code testing suggests that about half of the time for each group is being performed creating each rule ( the process {} block ), and the remaining half in the call to AddMembershipRules(), my guess is that should be better for our production CM environment.

Note that this isn’t just a PowerShell Function, it’s operating like a PowerShell Cmdlet. The function will accept objects from the pipeline and process them as they arrive, as quickly as Get-CMDevice can feed them through the pipeline.

However more testing continues.

-k

 

 

 

New Tool – Disk Hogs

Edit: Heavily modified script for speed. Bulk of script is now running Compiled C# Code.

Been resolving some problems at work lately with respect to full disks. One of our charters is to manage the ConfigMgr cache sizes on each machine to ensure that the packages we need to get replicated, actually get replicated out to the right machines at the right time.

But we’ve been getting some feedback about one 3rd party SCCM caching tool failing in some scenarios. Was it really the 3rd party tool failing, or some other factor?

Well we looked at the problem and found:

• Machines with a modest 120GB SSD Drive (most machines have a more robust 250GB SSD)
• Configuration Manager Application Install packages that are around 10-5GB (yowza!)
• Users who leave too much… crap laying around their desktop.
• And several other factors that have contributed to disks getting full.

Golly, when I try to install an application package that requires 12GB to install, and there is only 10GB free, it fails.

Um… yea…

I wanted to get some data for machines that are full: What is using up the disk space? But it’s a little painful searching around a disk for directories that are larger than they should be.

Options

One of my favorite tools is “WinDirStat” which produces a great graphical representation of a disk, allowing you to visualize what directories are taking up the most space, and which files are the largest.  http://windirstat.net

Additionally I also like the “du.exe” tool from SysInternals.  https://live.sysinternals.com/du.exe

I wrap it up in a custom batch script file

@%~dps0du.exe -l 1 -q -accepteula %*

and it produces output that looks like:

PS C:\Users> dudir
    263,122 C:\Users\Administrator
      1,541 C:\Users\Default
  7,473,508 C:\Users\keith
      4,173 C:\Users\Public
  7,742,345 C:\Users
Files: 27330
Directories: 5703
Size: 7,928,161,747 bytes
Size on disk: 7,913,269,465 bytes

Cool, however, I wanted something that I could run remotely, and that would give me just the most interesting directories, say everything over 1GB, or something configurable like that.

So a tool was born.

Tool

The script will enumerate through all files on a local machine and return the totals. Along the way we can add in rules to “Group” interesting directories and output the results.

So, say we want to know if there are any folders under “c:\program files (x86)\Adobe\*” that are larger than 1GB. For the most part, we don’t care about Adobe Reader, since it’s under 1GB, but everything else would be interesting. Stuff like that.

We have a default set of rules built into the script, but you can pass a new set of rules into the script using a *.csv file ( I use excel )

Folder	SizeMB
c:\*	500
C:\$Recycle.Bin	100
c:\Program Files	0
C:\Program Files\*	1000
C:\Program Files (x86)	0
C:\Program Files (x86)\Adobe\*	1000
C:\Program Files (x86)\*	1000
C:\ProgramData\*	1000
C:\ProgramData	0
C:\Windows	0
C:\Windows\*	1000
c:\users	0
C:\Users\*	100
C:\Users\*\*	500
C:\Users\*\AppData\Local\Microsoft\*	1000
C:\Users\*\AppData\Local\*	400

Example output:

The machine isn’t too interesting (it’s my home machine not work machine)

I’m still looking into tweaks and other things to modify in the rules to make the output more interesting.

• Should I exclude \windows\System32 directories under X size?
• etc…

If you have feedback, let me know

Script

	<#
	.SYNOPSIS
	Report on Disk Hogs
	.DESCRIPTION
	Returns a list of the largest directories in use on the local machine
	.NOTES
	Copyright Keith Garner, All rights reserved.
	Really Updated for Windows 7 and Optimized for !!!SPEED!!!
	.PARAMETER Path
	Start of the search, usually c:\
	.PARAMETER IncludeManifest
	Include basic info about the memory, OS, and Disk in the manifest
	.PARAMETER OutFile
	CLIXML file used to store results
	Location of a custom rules *.csv file, otherwise use the default table
	.LINK
	https://keithga.wordpress.com
	#>
	[cmdletbinding()]
	param(
	$path = 'c:\',
	[switch] $IncludeManifest,
	$OutFile
	)
	###########################################################
	$WatchList = @(
	@{ Folder = 'c:\'; SizeMB = '0' }
	@{ Folder = 'c:\*'; SizeMB = '500' }
	@{ Folder = 'C:\$Recycle.Bin'; SizeMB = '100' }
	@{ Folder = 'c:\Program Files'; SizeMB = '0' }
	@{ Folder = 'C:\Program Files\*'; SizeMB = '1000' }
	@{ Folder = 'C:\Program Files (x86)'; SizeMB = '0' }
	@{ Folder = 'C:\Program Files (x86)\Adobe\*'; SizeMB = '1000' }
	@{ Folder = 'C:\Program Files (x86)\*'; SizeMB = '1000' }
	@{ Folder = 'C:\ProgramData\*'; SizeMB = '1000' }
	@{ Folder = 'C:\ProgramData'; SizeMB = '0' }
	@{ Folder = 'C:\Windows'; SizeMB = '0' }
	@{ Folder = 'C:\Windows\*'; SizeMB = '1000' }
	@{ Folder = 'c:\users'; SizeMB = '0' }
	@{ Folder = 'C:\Users\*'; SizeMB = '100' }
	@{ Folder = 'C:\Users\*\*'; SizeMB = '500' }
	@{ Folder = 'C:\Users\*\AppData\Local\Microsoft\*'; SizeMB = '1000' }
	@{ Folder = 'C:\Users\*\AppData\Local\*'; SizeMB = '400' }
	)
	###########################################################
	Add-Type -TypeDefinition @"
	public class EnumFolder
	{
	public static System.Collections.Generic.Dictionary<string, long> ListDir(string Path, System.Collections.Generic.Dictionary<string, long> ControlList)
	{
	System.Collections.Generic.Dictionary<string, long> Results = new System.Collections.Generic.Dictionary<string, long>();
	System.IO.DirectoryInfo Root = new System.IO.DirectoryInfo(Path);
	ListDirRecursive(Root, Results, ControlList);
	return Results;
	}
	private static long ListDirRecursive
	(
	System.IO.DirectoryInfo Path,
	System.Collections.Generic.Dictionary<string, long> Results,
	System.Collections.Generic.Dictionary<string, long> ControlList
	)
	{
	try
	{
	long Total = 0;
	foreach (System.IO.DirectoryInfo Directory in Path.GetDirectories())
	if ((Directory.Attributes & System.IO.FileAttributes.ReparsePoint) == 0)
	Total += ListDirRecursive(Directory, Results, ControlList);
	foreach (System.IO.FileInfo file in Path.GetFiles())
	{
	if ((file.Attributes & System.IO.FileAttributes.ReparsePoint) == 0)
	{
	if (ControlList.ContainsKey(file.FullName))
	{
	if ((ControlList[file.FullName] * 1024 * 1024) < file.Length)
	{
	Results.Add(file.FullName, file.Length);
	}
	else
	{
	Total += file.Length;
	}
	}
	else
	{
	Total += file.Length;
	}
	}
	}
	if (ControlList.ContainsKey(Path.FullName))
	{
	if ((ControlList[Path.FullName] * 1024 * 1024) < Total)
	{
	Results.Add(Path.FullName, Total);
	Total = 0;
	}
	}
	return Total;
	}
	catch
	{
	return 0;
	}
	}
	}
	"@
	###########################################################
	$start = [datetime]::Now
	$ControlList = new-object -TypeName 'System.Collections.Generic.Dictionary[String,int64]'
	foreach ( $Item in $WatchList ) {
	if ( $item.Folder.EndsWith('*') ) {
	get-childitem $Item.Folder.TrimEnd('*') -force -ErrorAction SilentlyContinue |
	ForEach-Object {
	$_.FullName.Substring(0,1).ToLower() + $_.FullName.Substring(1)
	} |
	Where-Object { -not $ControlList.ContainsKey( $_ ) } |
	foreach-object { $ControlList.Add($_,0 + $Item.SizeMB) }
	}
	else {
	get-item $Item.Folder -force -ErrorAction SilentlyContinue |
	ForEach-Object {
	$_.FullName.Substring(0,1).ToLower() + $_.FullName.Substring(1)
	} |
	Where-Object { -not $ControlList.ContainsKey( $_ ) } |
	foreach-object { $ControlList.Add($_,0 + $Item.SizeMB) }
	}
	}
	$ControlList.Keys | write-verbose
	###################
	$Results = [EnumFolder]::ListDir($Path.ToLower(), $ControlList )
	$Results | write-output
	([datetime]::now – $Start).TotalSeconds | Write-verbose
	###################
	if ( $OutFile ) {
	new-item -ItemType Directory -Path ( split-path $OutFile ) -ErrorAction SilentlyContinue | Out-Null
	if ( $IncludeManifest ) {
	@{
	OS = GWMI Win32_OPeratingSystem | Select OSarchitecture,OSLanguage,InstallDate,Version
	Mem = GWMI Win32_PhysicalMemory | Select Capacity
	Vol = GWMI Win32_LogicalDisk -Filter "DeviceID='$($path.Substring(0,1))`:'" | Select Size,FreeSpace,VolumeName
	Data = $Results
	} | Export-Clixml -Path $OutFile
	}
	else {
	$Results | Export-Clixml -Path $OutFile
	}
	}

view raw

find-DiskHog.ps1

hosted with ❤ by GitHub

Bypass OEM Setup and install your own image.

AutoPilot

Really Windows Autopilot is the future. As soon as the OEM’s get their act together, and offer machines without the bloatware and adware. Yea, I’m talking about you Anti-Virus Trial! Go away, shoo! Shoo! Give me Signature Images, or I’ll do it myself.

Unfortunately, I’m currently working for a client that is “Cloud Adverse”, and very… particular about Security. “have our machines go through the internet, and download our apps from a cloud, oh heavens no!!”.

So all machines come from the OEM’s and into a centralized distribution center, where they run a hodge-podge of OS Imaging tools to get the machines ready to ship out to each user.

And, No they don’t use any MDT… at least not yet…

Really it’s the Anti AutoPilot…

Where to start.

Well, when the machines arrive from the OEM, they are unboxed and placed on a configuration rack. If they are Desktop Machines, they are also connected to a KVM switch (Imagine several 8-port switches daisy chained together). Then they are plugged into power, network, and turned on.

Here’s our first challenge: How do we stop the PC from booting into the OEM’s OOBE process into OUR process? Well right now the technicians need to press the magic function key press at just the right time during boot up.

You know the drill, Press F12 for Dell, or perhaps press F9 for HP, or Press enter for Lenovo. Perhaps you have a Surface Device, and need to hold down the Volume button while starting the machine. Yuck, but better than nothing…

Well, the feedback we got from the technicians is that sometimes they miss pressing the button… at “just” the right time. This is really a problem for a Desktop PC’s connected to that KVM switch. If the Monitor doesn’t sync to the new PC quickly enough, you might easily miss pressing the boot override switch.

This sounded like a good challenge to start with.

Audit Mode

Really, IT departments don’t use Audit Mode. Audit Mode is a way to make customizations *during* Windows Setup and then re-seal the OS, so the end-user gets the nice shiny Windows Setup process (Specialize and OOBE) that they expect in a new PC.

Deployments in IT are all about bypassing the shiny Windows OOBE experience. No we don’t care about all the fancy new features in Cortana, We have already signed the SA agreement with Microsoft, we already know the domain to connect to, and our company has only one locale and keyboard type. IT departments would much rather skip all that, and get the user to their machine. So the thought of re-sealing a machine and going *back* to OOBE when we just finished joining to the domain and installing apps is silly.

But there are some Possibilities here. Turns out, that when Windows Setup is running, it will look for an Unattend.xml file and try to use it.

Methods for running Windows Setup

MDT uses an Unattend.xml file on the local machine it we can skip over the settings we know about, and re-launch MDT LiteTouch when finished. What about this process? If we place the Unattend.xml file on the root of a removable USB drive, the Windows version on the hard disk will look there and use these settings. The Lab Techs appeared to have a lot of USB sticks laying around, so using them shouldn’t be a problem.

We can’t use a MDT unattend.xml file as-is, but we can use AuditMode to get to a command prompt and install our own MDT LitetouchPE_x64.wim file.

1. Boot into Audit Mode.
2. While in Audit Mode, auto login using the Administrator Account.
3. Find our PowerShell script and run it!

	<?xml version="1.0" encoding="utf-8"?>
	<unattend xmlns="urn:schemas-microsoft-com:unattend">
	<settings pass="oobeSystem">
	<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State&quot; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
	<Reseal>
	<Mode>Audit</Mode>
	</Reseal>
	</component>
	</settings>
	<settings pass="auditSystem">
	<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="wow64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State&quot; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
	<AutoLogon>
	<Enabled>true</Enabled>
	<LogonCount>5</LogonCount>
	<Username>administrator</Username>
	</AutoLogon>
	</component>
	</settings>
	<settings pass="auditUser">
	<component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State&quot; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
	<RunSynchronous>
	<RunSynchronousCommand wcm:action="add">
	<Description>Run script</Description>
	<Order>1</Order>
	<!– Enumerate through all drives looking for the MYIT_OEMBypass.ps1 script, if found, run it. Leave the command prompt open. –>
	<Path>cmd /c "(FOR %i IN (C D E F G H I J K L N M) DO IF EXIST %i:\MYIT_OEMBypass.ps1 Powershell -executionpolicy ByPass %i:\MYIT_OEMBypass.ps1) & pause"</Path>
	<WillReboot>OnRequest</WillReboot>
	</RunSynchronousCommand>
	</RunSynchronous>
	</component>
	</settings>
	</unattend>

view raw

unattend.xml

hosted with ❤ by GitHub

PowerShell script

Once we are in PowerShell, we now have full access to the system, and can modify it in any we choose. In this case, I have copied a LiteTouchPE_x64.wim file to the USB Stick, and we can force the Hard Drive to boot from that instead, continuing our process in MDT LiteTouch. Yea!

	<#
	Bypass file for OEM OOBE Setup.
	Called from within Audit Mode.
	#>
	param(
	[int] $TargetDisk = 0,
	[string] $NewBootWim = "$PSScriptRoot\Generic_x64.wim",
	[string] $UserName = 'MDTServer\MDTNonInteractive',
	[string] $Password = 'UnSecurePassword1234',
	[string] $BootType = 'x64',
	[string] $Target = 'h:'
	)
	$ErrorActionPreference = 'stop'
	#region Find the largest on-disk partition
	###############################################################################
	$TargetDrive = get-disk -Number $TargetDisk |
	Get-partition |
	Sort -Descending -Property Size |
	Select-Object -First 1 |
	Get-Volume |
	foreach-object { $_.DriveLetter + ':' }
	# get a drive letter for the system partition
	get-disk -Number $TargetDisk |
	get-partition |
	where-object { -not $_.DriveLetter } |
	Where-Object Type -eq System |
	Add-PartitionAccessPath -AccessPath $Target
	#endregion
	#region Connect to a network share if Source is over the network…
	###############################################################################
	if ( -not ( test-path $NewBootWim ) ) {
	if ( $newBootWim.StartsWith('\\') -and $UserName -and $Password ) {
	# COnnect to the network share.
	net use "$(split-path $NewBootWim)" /user:$UserName "$Password"
	}
	}
	#endregion
	#region Copy the Boot WIM
	###############################################################################
	new-item -ItemType directory -path $TargetDrive\Sources -Force -ErrorAction SilentlyContinue | Out-Null
	copy-item $NewBootWim $TargetDrive\Sources\Boot.wim
	robocopy /e $PSScriptRoot\x64 $Target\ /xf bcd bcd.log
	#endregion
	#region Create a BCD entry
	###############################################################################
	Bcdedit /create "{ramdiskoptions}" /d "Ramdisk options"
	Bcdedit /set "{ramdiskoptions}" ramdisksdidevice boot
	Bcdedit /set "{ramdiskoptions}" ramdisksdipath \boot\boot.sdi
	$Output = bcdedit -create /d "MYIT_OEMHack" /application OSLOADER
	$GUID = $output | %{ $_.split(' ')[2] }
	bcdedit /set $Guid device "ramdisk=[$TargetDrive]\sources\boot.wim,{ramdiskoptions}"
	bcdedit /set $Guid osdevice "ramdisk=[$TargetDrive]\sources\boot.wim,{ramdiskoptions}"
	bcdedit /set $Guid path \windows\system32\boot\winload.efi
	bcdedit /set $Guid systemroot \windows
	bcdedit /set $Guid detecthal yes
	bcdedit /set $Guid winpe yes
	bcdedit /set $Guid ems no
	bcdedit /set $Guid isolatedcontext yes
	Bcdedit /displayorder $Guid -addfirst
	Bcdedit /default $Guid
	Bcdedit /timeout 10
	#endregion
	#region Reboot
	###############################################################################
	write-host "DONE"
	shutdown -r -f -t 0
	#endregion

view raw

MYIT_OEMBypass.ps1

hosted with ❤ by GitHub

Now we have a bridge between the OEM system and our LiteTouch, or any other automated WinPE disk.

Yea! Now for the *REAL* automation to begin… 🙂

-k

 

ZTISelectBootDisk.wsf new with BusType

Several years ago I wrote a script to help select which disk to deploy Windows to during your MDT LiteTouch or ZeroTouch task sequence.

https://keithga.wordpress.com/2013/09/18/ztiselectbootdisk-wsf/

Well, based on a request from my latest client, I have created a similar script that support BusType.

BackGround

My client is trying to install Windows Server 2016 on a Server with a SAN. When the machine boots to WinPE, one of the SAN drives appears *first* as Disk 0 (Zero). By default MDT Task Sequences will deploy to Disk Zero! My ZTISelectBootDisk.wsf already shows how to override. All we need to do is to find a way to tell MDT which disk to choose based on the correct WMI query.

Turns out it was harder than I thought.

What we wanted was the BusType that appears in the “Type” field when you type “Select Disk X” and then “detail disk” in Diskpart.exe.  When we ran “Detail Disk” in DIskpart.exe we could see the bus type: Fibre as compared to regular disks like SCSI or SAS.

The challenge was that the regular Win32_diskDrive WMI query wasn’t returning the BusType value, and we couldn’t figure out how to get that data through other queries.

I tried running some PowerShell queries like ‘Get-Disk’ and noticed that the output type was MSFT_Disk, from a weird WMI Namespace: root\microsoft\windows\storage. But adding that query to the script works! Yea!!!

BusType

What kind of BusTypes are there?

Name	Value	Meaning
Unknown	0	The bus type is unknown.
SCSI	1	SCSI
ATAPI	2	ATAPI
ATA	3	ATA
1394	4	IEEE 1394
SSA	5	SSA
Fibre Channel	6	Fibre Channel
USB	7	USB
RAID	8	RAID
iSCSI	9	iSCSI
SAS	10	Serial Attached SCSI (SAS)
SATA	11	Serial ATA (SATA)
SD	12	Secure Digital (SD)
MMC	13	Multimedia Card (MMC)
Virtual	14	This value is reserved for system use.
File Backed Virtual	15	File-Backed Virtual
Storage Spaces	16	Storage spaces
NVMe	17	NVMe

For this script we are *excluding* the following devices:

Name	Value	Meaning
Fibre Channel	6	Fibre Channel
iSCSI	9	iSCSI
Storage Spaces	16	Storage spaces
NVMe	17	NVMe

Meaning that the *FIRST* fixed device not in this list will become the new *Target* OS Disk. Run this query on your machine to see what disk will become the target:

gwmi -namespace root\microsoft\windows\storage -query 'select Number,Size,BusType,Model from MSFT_Disk where BusType <> 6 and BusTy
pe <> 9 and BusType <> 16 and BusType <> 17' | Select -first 1

Requirements

Reminder that this script requires MDT (latest), and the script should be placed in the %DeploymentShare%\Scripts folder. Additionally you should install all the Storage packages for WinPE, sorry I don’t recall *which* packages I selected when I did testing.

Script

	<job id="ZTISelectBootDisk">
	<script language="VBScript" src="ZTIUtility.vbs"/>
	<script language="VBScript" src="ZTIDiskUtility.vbs"/>
	<script language="VBScript">
	' // ***************************************************************************
	' //
	' // Copyright (c) Microsoft Corporation. All rights reserved.
	' //
	' // Microsoft Deployment Toolkit Solution Accelerator
	' //
	' // File: ZTISelectBootDisk.wsf
	' //
	' // Version: <VERSION>
	' //
	' // Purpose: Given a collection of Storage Devices on a machine,
	' // this program will assist in finding the correct
	' // device to be processed by "ZTIDiskPart.wsf"
	' //
	' // Currently hard coded to select the *FIRST* drive that is
	' // Not iSCSI, Fibre Channel, Storage Spaces, nor NVMe.
	' //
	' // REQUIRES that you install the correct WinPE Storage Components!
	' //
	' //
	' // WARNING: If there are any *other* disks that need to be Cleaned
	' // and formatted, they should be processed first.
	' // And this the global Variable OSDDiskIndex should be
	' // set to <blank> when done being processed by ZTIDiskPart.wsf.
	' //
	' // Variables:
	' // OSDDiskIndex [ Output ] – Disk Index
	' //
	' // Usage:
	' // cscript.exe [//nologo] ZTISelectBootDisk.wsf [/debug:true]
	' // cscript.exe [//nologo] ZTIDiskPart.wsf [/debug:true]
	' // cscript.exe [//nologo] ZTISetVariable.wsf [/debug:true] /OSDDiskIndex:""
	' //
	' // ***************************************************************************
	Option Explicit
	RunNewInstance
	'//—————————————————————————-
	'// Main Class
	'//—————————————————————————-
	Class ZTISelectBootDisk
	'//—————————————————————————-
	'// Main routine
	'//—————————————————————————-
	Function Main
	Dim oWMIDisk
	Dim bFound
	Dim oDiskPartBoot
	Dim oContext, oLocator, objQuery, objStorageWMI, objStorage
	oLogging.CreateEntry "—————- Initialization —————-", LogTypeInfo
	IF oEnvironment.Item("DEPLOYMENTTYPE") <> "NEWCOMPUTER" Then
	oLogging.ReportFailure "Not a new computer scenario, exiting Select Boot Disk.", 7700
	End If
	bFound = FAILURE
	''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
	'
	' 1st Pass – Find any disk that matches the Query "Select * From Win32_diskPartition %OSBootDiskOverrideWQL%"
	'
	Set oContext = CreateObject("WbemScripting.SWbemNamedValueSet")
	oContext.Add "__ProviderArchitecture", 64
	Set oLocator = CreateObject("Wbemscripting.SWbemLocator")
	set objStorageWMI = oLocator.ConnectServer("","root\Microsoft\Windows\Storage","","",,,,oContext)
	set objQuery = objStorageWMI.ExecQuery("select Number,Size,BusType,Model from MSFT_Disk where BusType <> 6 and BusType <> 9 and BusType <> 16 and BusType <> 17")
	If objQuery.Count = 0 then
	oLogging.CreateEntry "No Disk Drives Found!?!?! Dude, did you install the right storage drivers into WinPE 0x7b.",LogTypeError
	exit function
	End if
	For each objStorage in objQuery
	oLogging.CreateEntry "Found Device: N:" & ObjStorage.Number & " S:" & ObjStorage.Size & " M:" & ObjStorage.Model & " T:" & ObjStorage.BusType & " " , LogTypeInfo
	oEnvironment.Item("OSDDiskIndex") = ObjStorage.Number
	bFound = SUCCESS
	exit for
	Next
	''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
	'
	' 2nd pass – Use the 1st Partition larger than 15GB on the first disk with a bootable partition.
	'
	If bFound = FAILURE then
	oLogging.CreateEntry "No drive was found using search parameters, Use the 1st \Windows Partition found.", LogTypeInfo
	set oDiskPartBoot = GetBootDriveEx( false, oEnvironment.Item("ImageBuild"), false )
	If not oDiskPartBoot is nothing then
	oEnvironment.Item("OSDDiskIndex") = oDiskPartBoot.Disk
	bFound = SUCCESS
	End if
	End if
	TestAndLog bFound = SUCCESS, "Verify OSDDiskIndex was found and set: " & oEnvironment.Item("OSDDiskIndex")
	Main = bFound
	End Function
	End class
	</script>
	</job>

view raw

ZTISelectBootDisk.wsf

hosted with ❤ by GitHub

-k

 

 

New script – Import Machine Objects from Hyper-V into ConfigMgr

Quick Post, been doing a lot of ConfigMgr OSD Deployments lately, with a lot of Hyper-V test hosts.

For my test hosts, I’ve been creating Machine Objects in ConfigMgr by manually entering them in one at a time (yuck). So I was wondering what the process is for entering in Machine Objects via PowerShell.

Additionally, I was curious how to inject variables into the Machine Object that could be used later on in the deployment Process, in this case a Role.

Up next, how to extract this information from VMWare <meh>.

	<#
	.SYNOPSIS
	Generate a computer list from Hyper-V ready to import into Configuration Manager
	.DESCRIPTION
	Given a Hyper-V server and a set of Hyper-V Virtual Machines, this script will
	extract out the necessary information required to create the associated Machine Object in
	Configuration Manager.
	.PARAMETER Path
	Name of the CSV file to be created
	.PARAMETER SourceComputer
	Optional parameter used to pre-populate the SourceComputer Field in the CSV output.
	.PARAMETER Role
	Optional Paramater used to pre-populate the
	.NOTES
	If you modify this file in Excel, you should save the file in "CSV (MS-DOS) *.csv" format to ensure there are no extra double-quotes present.
	.EXAMPLE
	.\Get-VMListFOrCM.ps1 | ft
	Get all virtual machines and display in a table.
	.EXAMPLE
	.\Get-VMListFOrCM.ps1 | convertto-csv -NoTypeInformation | % { $_.replace('"','') }
	Find all Virtual Machines and convert to a CSV format without any doublequotes.
	.EXAMPLE
	.\Get-VMListFOrCM.ps1 -Verbose -name hyd-cli* -Role ROLE_Test1 -path .\test.csv
	Find all Virtual Machines that start with the name HYD-CLI, and export to .\test.csv
	.LINK
	https://technet.microsoft.com/en-us/library/bb633291.aspx
	#>
	[cmdletbinding()]
	param (
	[string[]] $Name,
	[string] $computerName,
	[pscredential] $Credential,
	[string] $path,
	[string] $SourceComputer = '',
	[string] $Role = ''
	)
	$GetVMProp = @{}
	if ( $computerName ) { $GetVMProp.add( 'ComputerName',$computerName ) }
	if ( $Credential ) { $GetVMProp.add( 'Credential',$Credential ) }
	$VitSetData = get-wmiobject -Namespace "Root\virtualization\v2" -class Msvm_VirtualSystemSettingData @GetVMProp
	if ( $Name ) { $GetVMProp.add( 'Name',$Name ) }
	write-verbose "Extract data from Hyper-V"
	$Results = Get-VM @GetVMProp |
	ForEach-Object {
	[PSCustomObject] @{
	ComputerName = $_.Name
	'SMBIOS GUID' = $VitSetData |
	Where-Object ConfigurationID -eq $_.VMId.Guid |
	ForEach-Object { $_.BIOSGUID.Trim('{}') }
	'MAC Address' = $_ | Get-VMNetworkAdapter | select-object -first 1 | ForEach-Object { $_.MacAddress -replace '..(?!$)', '$&:' }
	'Source Computer' = $SourceComputer
	'Role001' = $Role
	}
	}
	$Results | out-string -Width 200 | Write-Verbose
	write-verbose "write out to CSV file"
	if ( $path ) {
	$Results |
	ConvertTo-Csv -NoTypeInformation |
	ForEach-Object { $_.replace('"','') } |
	Out-File -FilePath $path -Encoding ascii
	write-verbose @"
	You can now import this list into CM:
	#############################################
	# Sample Script to import into Config Manager
	import-module 'C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1'
	get-psdrive | Where-Object { $_.Provider.name -eq 'CMSite' } | Select-object -first 1 | ForEach-Object { set-location `"`$(`$_.name)“:`" }
	Import-CMComputerInformation -CollectionName "All Systems" -FileName "$Path" -VariableName Role001
	#############################################
	"@
	}
	else {
	$Results
	}

view raw

get-VMListForCM.ps1

hosted with ❤ by GitHub

Decrypting the HP BIOSConfigUtility64.exe password

First off, for those of you who asked, I did leave 1E last week, off to try new things. Thought I’d take some time off during May, and then look for new opportunities. The future is wide open :^)

In the mean time, I did come across this post today about decrypting passwords with the BIOSConfigUtility64.exe utility.

https://www.serializing.me/2016/10/15/hpqpswd-encrypted-passwords-decryption/

And reminded me of some work I did recently at 1E on their BIOS 2 UEFI toolset. The HP tool did set off some red flags for me, the tool was able to take a plaintext password and put the encrypted value in a *.bin file without asking for an encryption key!?!? How did it do that? I figured it was because the tool stored the encryption key for the password within the executable itself. That’s not optimal (it’s unsecure), but not uncommon.

So I spent some time trying to reverse engineer the process, “link -dump /imports” revealed several cryptographic calls like CryptImportKey(), and with some time using trusty WinDBG.exe, I was able to locate the key. I wondered if HP would try to hide the key, but it was there in plain sight. I wrote a test program, but in my case I didn’t write a tool to decrypt the password, I wrote a tool to perform the encryption.  My thoughts were to provide a centralized password storage mechanism for HP, Dell and Lenovo, and I wondered if the HP toolset was a good starting point. 1E didn’t go down that route but the reverse engineering the HP tool was interesting.

It does bring up an interesting ethical dilemma for Engineers like myself. Something that you see on the news whenever someone discovers a new vulnerability in an OS, or Web Browser: Do you keep the vulnerability secret, or do you tell the public, knowing that some Black Hat could use the vulnerability to write an exploit and expose sensitive data?  In my case, I decided not to reveal the exploit, but Duarte chose to reveal it. Who is right?

I guess the only thing I can say is this is a good learning opportunity to discuss security/encryption of secrets like passwords. If you are an IT administrator, be weary of tools that can encrypt data magically without an encryption key, it’s not magic, they are encrypting the data with *something* and it’s possible the key is stored locally in an unsecure fashion. Better to store the passwords in a more secure location, with a more secure encryption, and then convert to the HP Password at the “Last-Minute” when preforming the actual task sequence.

This is a similar problem with other tools that “appear” to encrypt data, but store the data in a manner that *can* be easily extracted. Like the AdministratorPassword field in the unattend.xml file, and the Password in the SysInternals AutoLogon.exe tool. Both tools store passwords in an easily recoverable fashion. I’ve seen too many administrators fall for the illusion that these are secure, they are not.

-k

Hope to see many of you at MMS MOA in May 2017!!! I’ll be there.

Formatting a removable USB drive with 2 partitions

TL;DR – Starting with Windows 10 Insider Preview Build 14965, you can format any “Removable” USB Flash Drive with more than one partition. Perfect for installation of large (over 4GB) WIM files on UEFI machines!

 

Hey all, back from a week at the Microsoft MVP summit, a Week in the UK, and a week in Arizona.

A few weeks ago at the Microsoft MVP summit, an engineering manager with the Windows Product group made an offhand comment about formatting a removable USB drive with two partitions. This took several of us by surprise, because historically, this hasn’t been supported widely without converting to a Fixed disk or something.

Mike Terrill (and Mike Niehaus) already beat me to the punch with some posts, but I wanted to share my results. :^)

The Background

Why is this important? Well as I mentioned in another blog post, as more and more people are booting to UEFI, on USB flash drives formatted with Fat32, with WIM images over 4GB in size, that causes a problem because Fat32 can’t hold files over 4GB in size.

Another solution would be to use the Rufus tool to split a USB drive into multiple partitions with a hidden fat32 partition. However, the problem here is that the hidden partition uses a special UEFI app that is not signed, so it won’t work on UEFI machines with Secure Boot enabled.

This has become even more interesting since Windows Server 2016 came out, with a base WIM image for standard Server SKU that is over 4GB in size. Hum…

The Hardware

I tested on several different USB makes using my Windows 10 (version 1607) laptop. Some would allow me to create a 2nd partition on a removable Flash Drive, others would not giving me an error:

DISKPART> create part pri

No usable free extent could be found. It may be that there is insufficient 
free space to create a partition at the specified size and offset. Specify
different size and offset values or don't specify either to create the maximum 
sized partition. It may be that the disk is partitioned using the MBR disk
partitioning format and the disk contains either 4 primary partitions, (no
more partitions may be created), or 3 primary partitions and one extended
partition, (only logical drives may be created).

Mostly the older and/or cheaper drives didn’t work, but most of the newer and/or name brand drives did work.

Finally I narrowed it down to two different models, both my favorites:

• Sandisk Extreme USB 3.0 Flash Drive – 32GB   – 2 years old – worked flawlessly.
• Transcend 8GB JetFlash V10 USB 2.0 Flash Drive  – 6+ years old  – would not create a 2nd partition no matter what I tried on Windows 10 Version 1607

Then I tested against three Operating Systems: Windows 10 Version 1607, Windows 10 Preview, and Windwos 7.0 SP1. All using Diskpart to create multiple partitions.

The script

Diskpart.exe –>

sel disk 1
clean
create part pri size=450
format quick fs=fat32
assign
create part pri
format quick fs=ntfs
assign
exit

The Results:

                                 SanDisk           Transcend
Windows 7 SP1 Build 7601           Pass               Fail
Windows 10  Version 1607           Pass               Fail
Windows 10 Preview 14965           Pass               Pass   

I was able to format my SanDisk into multiple partitions using Windows 7 and beyond.

But I was not able to format the Transcend drive into multiple partitions using Windows 7 or Windows 10 Version 1607, but I was able to partition into multiple partitions on the new Windows 10 Insider Preview 14965.

That’s new!

I haven’t done enough testing using the removable flash drives on older machines, to see if the partitions are still visible, but the results look promising for a start.

Update #1 – 11/28/16:

Found out today that the reason that my SanDisk Extreme disk worked on Windows 7 and Windows 10 1607 may be because the removable Flash disk is reported as “Fixed” rather than “Removable” to the OS. Link.

Update #2 – 11/28/16:

I noticed that when taking the “removable” disk formatted with 2 partitions from Windows 10 Preview 14965 over to Windows 10 Version 1607, only the first partition was visible. As a work around I tried moving the main NTFS partition first and the Fat32 partition second.

sel disk 1
clean
create part pri
shrink desired=450
format quick fs=ntfs
assign
create part pri
format quick fs=fat32
assign
exit

Install Windows 7 in UEFI

I’m here at the Minnesota Management Summit at the Mall of America.

We got some exciting stuff going on here at 1E around Windows 10 and security features like Secure Boot and Device Guard, and I’ve have been digging into the details of BIOS and UEFI.

The big challenge in this space is helping clients and customers who are currently running Windows 7 to upgrade to Windows 10 with Secure Boot, If you rolled the UEFI firmware back to CSM/BIOS mode, then your machine can’t leverage the super cool Windows 10 In-Place Upgrade functionality to upgrade from Windows 7 to Windows 10. Instead, we will need to perform a wipe and reload on the machine. Stay tuned to 1E for more information this week on BIOS to UEFI.

This all happens when you get a machine that supports UEFI and Secure Boot (Say a machine with a Windows 8, Windows 8.1 or Windows 10 Logo), and you want to install Windows 7. Windows 7 can’t work with UEFI and Secure Boot, because Windows 7 isn’t a supported Secure Boot operating System. Windows 7 does support UEFI, however you may have some more problems getting Windows 7 loading in UEFI, so we may need to add some CSM components, in a “Hybrid Mode” to load. For many IT departments, Getting Windows 7 to load with UEFI is hard, so they load in BIOS mode instead.

Moving forwards, We are now have a new recommendation:

“Install new Computers for Windows 7 in UEFI mode without Secure Boot!” [1] [2]

[1] – May require an updated BIOS

[2] – May require CSM “Hybrid Mode” not full BIOS mode.

The advantage here, is that if/when it becomes necessary to migrate to Windows 10 and leverage the security features of Windows 10, all we need to do is run the standard Windows 10 In-place upgrade task sequence for SCCM/OSD or MDT.  Don’t fall into the CSM/BIOS trap!  :^)

OEM Specific settings

Now, honestly, we have had some problems getting Windows 7 running on a pure “UEFI” implementation, instead we have found out that you must enable *some* legacy aspects of CSM, but not the full CSM mode. We call this “UEFI Hybrid” mode, after the name HP gave this mode (see below).

So how would this look on various machines? Well, we can go into the BIOS and change the settings

Dell

• “LegacyoRom” set to “enable”
• “ActiveBootList” set to “UEFI”

Lenovo

• “UEFI/Legacy Boot” set to “Both”
• “UEFI Priority […]”  = “UEFI First”
• “CSM Support”  = “YES”

HP

• “Boot Mode”  = “UEFI Hybrid (with CSM)”

Hopefully this should help you move forwards to Windows 10, yet still deploy Windows 7 for your existing needs.

-k