u/Reaction-Consistent

Hello! I think the new PSADT 4.x has a function that can make changes to the currently logged on user (or perhaps - to all user profiles?) while also being able to make system changes - in the same script/deployment - or is that simply not possible with this tool? If it is, does anyone have an example of how they implemented their own machine+user based code - deployed via software center (as whatever, but I'm assuming application model)? An example of this would be - the code would first make sure windows feature A was installed, if not, it installs it system wide - then - in the same script, it installs files/reg keys, etc. under the user's account.

I am looking for a way to deploy an available whatever...app, package program, TS, etc. to systems, but NOT show the deployment in software center - in short, I want to be able to run this deployed whatever using either run script, or right click tools - 'rerun deployment'. I have a somewhat sensitive/risky .exe I want only our admins to run on systems remotely using the CM admin console. I know I can throw the .exe in a file share, give them rights, etc. I'm trying to keep it all encapsulated in CM, so I can at least pretend I'm trying to keep it 'secure' (it's a tool to bypass the stupid encryption preboot screen, which I think (and many agree) is about as useful as a bag of turds.)

I just watched the movie, and it struck me so hard that the backrooms concept is a very, very accurate description of the astral plane. We’ve all experienced it, leaving our bodies in our own house only to find that the details are wrong. doors appearing on the wrong side of the room, the color scheme all wrong, and yet while we are there, it feels perfectly normal. I’ve heard it said many times that the astral is merely a mental copy of the physical, built entirely of astral matter, whatever that is. It could also just be a very vivid lucid dream. Thoughts?

If I want to disable the Windows update Service during the OSD task sequence, or directly after it is completed, what is the best way to do that?
To answer the inevitable question, why am I doing this? It’s because for whatever reason after the task sequence completes, I can see that the CM client policy for Windows update redirection has not applied yet, and there is a window of time where the system can run automatic Windows update updates.
Now, if I open the CM client on the system, and simply run the software updates, action, that immediately populates the registry key and thus prevents any automatic Windows updates. I’ve pondered and even tried using a script to run the client action post build using first log on commands, but this doesn’t work, either the commands run too soon, or they don’t run with the necessary token, I don’t know what’s going on I also tried disabling the Windows update step using a task, sequence, run command line or run power shell step, the step runs, but gets reverted at the end of the build. Do I just manually populate those registry keys and call it a day? Am I over complicating things here?

I have a 2 index W10 LTSC image (index 1 Windows 10 Enterprise LTSC, and 2 Windows 10 Enterprise N LTSC) so I thought I would reduce the overall size of the image by exporting only the one I needed in my OSD, index 1. I further thought to myself that I would use /compress:fast to further reduce the size of the exported image. On my first attempt, the resultant size of the exported .wim was a few hundred MB larger than the original 2 index .wim! I ran a second test, this time without the /compress:fast, and now, the new exported .wim is about 500MB smaller than the original. Copilot gave me some rambling explanations, but it really made no sense to me - has anyone experienced something similar, or do you know why this would happen?
copilot summary: The reason is that the export engine's handling of existing resources and compression state is not always obvious. DISM may preserve certain existing compressed resources more efficiently when you don't force a specific compression level.

We are having increasing reports of Windows 11 24H2 feature upgrades, taking upwards of eight hours to complete. This is on Prem, pulling content from the distribution point not from Microsoft. There is no bits throttling, testing a bit transfer of a four gig file from the same distribution point to the same client PC takes a normal amount of time, there is a language pack installed and maybe a feature, I know those can add time to the upgrade process. A standard Windows 11 in place upgrade takes around two hours at the same site. We are digging into the logs now, but if anybody has a similar experience and can offer some insight, please do.

I currently use the amazing script, wimwizard to update Windows 11 images on a monthly basis, and it works very well. But now I have to toss in some Windows 10 IOT images, 21 H2, 1809, and at least one server 2022 image. Is anyone else patching images in their environments besides just the windows 11? If so, how are you managing it? What other projects, scripts are out there that can handle multiple OS versions fairly easily with regards to injecting LCU, safe Os,.NET, features on demand, language packs, and maybe even remove default Windows features all via a single script? I am currently using a modified form of the sample Microsoft script they provide for this purpose. But it’s not very slick and needs lots of improvement yet. I guess it does the job, however.

Has anyone been able to validate any of Robert Monroe’s claims and/or had the same experiences, or visited the same realms he did? It seems like his experiences were very consistent, where most of the posts I read seem to be very random, inconsistent and often very dreamlike.

I was getting a ton of 2FA pop-ups for my MSN account in my Authenticator, where it pops up a series of numbers, and you have to pick the right one, only I did not initiate any of these so I assume someone has my account info and is attempting to login probably a bot because of the frequency that these occur. I wasn’t too concerned, but decided to check recent account activity, there was none except for my own. Shouldn’t I see these attempts in my recent account activity? In any case I decided to change my password and now I do not get those random Authenticator pop-ups. Was this evidence of Mal, or just some person or hacker organization that found my password in a leak and was simply trying to get me to click the correct number randomly? When I did change my password and had my Authenticator app open, those MFA pop-ups were coming rapid fire. I’m not sure if it’s because they get queued up or something else was going on.

Quick question, if I add a dependency to an application, and set that dependency to 'automatically install', deploy that app to all systems as 'available' in software center - does that dependency automatically install to all systems??

Has anyone created a basic UI that prompts for user/pass at the start of a typical OSD task sequence, checks that account to see if it belongs to a specific AD group - and only if it is, proceed with the rest of the TS, and if not, presents a message/quits the TS. Doesn't have to be that exact scenario, just something close. I'd like to use TSGui which seems to support LDAP, just not sure if it requires any specific ADSI related drivers to be pre-loaded in the winpe environment, or perhaps via a prestart command.

A quick Copilot search leads me to believe this is possible, with such tools as serviceui.exe, .NET rather than ADSI PS commands, and some added features to the WinPE boot wim.

UPDATE: I've found the magic sauce! Finally! While it should not have been this difficult, the problem with my script (problem(s) I should say..) ultimately was caused by the way the 'scriptblock' function handles/mangles double-quotes in whatever code is within the block. I discovered via trial and error, and ultimately, by presenting a working script, and a non-working script to copilot - which led me to the final working script. My script had a few lines with various elements in double-quotes, and the whole script was within a script block - this was supposed to be the workaround to get windows forms PS script to show up in a winpe session, and this code here ultimately fixed the whole shebang:

“Out-of-process PowerShell execution with encoded payload”

$bytes  = [System.Text.Encoding]::Unicode.GetBytes($script.ToString())

$encoded = [Convert]::ToBase64String($bytes)

Start-Process powershell.exe -ArgumentList "-NoProfile -EncodedCommand $encoded" -Wait

For those that are familiar with the PS Windows update Power Shell module, can it be used to upgrade an operating system to the next version? For instance, Windows 11 23H2 to 24H2? I know you can install specific KB‘s perhaps I could identify the KB number of the feature update if that’s even a thing.

We have a few windows 11 N systems in our environment, vendor provided systems. To upgrade them I’ve typically just downloaded and shared the full Windows 11 ISO to the local site IT and let them upgrade using that. Are there any other options short of importing the Windows 11 full ISO (not just the enterprise index), and creating an in place upgrade for them? If there were more than one site I would consider that, but this is just a one off and I’m curious to see if anybody else has ran into a similar situation. I had imported the full ISO at one time, but did not like having to patch every index, it tends to make for a very large WIM file.

We have mostly W11 24H2 systems, and we've seen recently an odd or different behavior when applying the LCU via CM/Wsus - systems need 2 reboots to fully apply the LCU. Is that everyone else's experience as well?

My admin account, which is also my CM admin account, has no access to the internet. In the past, when I've tried to install/run the MDM tool, it has to both connect to the CM infra, and connect to the internet - but my admin account is also blocked from accessing the internet. I really don't want to make my standard user account a full CM Admin, what other options do I have, short of asking our security/firewall team to allow comms to specific URLs required by the MDM tool? It's kind of a catch-22.

I’m trying to integrate the latest SSU, LCU, .NET patches, and possibly a few additional KBs related to Secure Boot DBX and microcode updates into some older Windows 10 LTSC images, and I’m looking for advice on best practices.

I found Microsoft’s official guide along with the example script, but it spends a lot of time covering Dynamic Updates. From what I understand, I may not actually need to integrate those, although I could be mistaken.

The guide also includes steps for updating WinRE and WinPE. Is it actually necessary to apply the SSU and LCU to the WinRE image inside the Windows 10 image, or is patching the main OS image enough?

I’m also trying to follow the recommended order of operations as closely as possible while modifying the script for my own workflow. My goal is to end up with:
a fully updated install image
a repeatable script/process I can reuse later.

I’m aware of the excellent work from people here, including the Wimwitch alternative patching script , but most of the discussion seems focused on newer Windows 11 servicing techniques. I’m specifically working with older Windows 10 LTSC images, where things like the ICU update process and Features on Demand ISO layout are a bit different.
Has anyone here built and maintained fully patched Windows 10 LTSC images recently? If so, I’d really appreciate any guidance, recommended workflows, or lessons learned.

Since about the release of the March cumulative updates were released for W11, CM, we’ve been seeing huge increase of failures for W11 language pack installations. We allow users to install the languages via the language and regional UI settings, rather than using a separate package or app deployments. This has been working great for the last few years, until recently- users trigger the install and shortly afterwards they see a hex code error that I can’t remember at the moment. We’re still working on troubleshooting and investigating. Is anyone having similar issues, or aware of any known issues/bugs that affect W11 24H2, with either the March or April LCU?

Update - just to be thorough, I also tested installing the language cabs directly using powershell/dism commands, with the FULL FOD ISO copied to the system, and with 'limitaccess' added to the command lines. I installed all De-de cabs (German), installed, rebooted, went to install the language via settings, saw the download button, but when I click it, it runs for a few minutes then fails! all the other language features installed fine.

https://preview.redd.it/vg577zv78bzg1.png?width=1031&format=png&auto=webp&s=17bbfeee8373d8f2db6a8f0b41514c02b77f9b04

We're dipping our toes into the WUFB world, and are trying to piece together how the various techs work together (or not). For those that are already doing this, please let me know how you guys are implementing Windows Update for Biz, Delivery Optimization and Connected Cache, respectively or together. What DO policies are you enabling, are you setting up connected cache servers for each site, are you using CM to monitor any of it, perhaps via the Client Data Sources? Any guides, websites you'd recommend me reading would be great if you could share your sources and experience, thanks! FYI - We're fully SCCM on prem, WSUS, and haven't yet switched to intune, comanagement, etc. but are testing this out as well.