Servicing Stack Update - what it is and when you need it!

From time to time it is necessary to fix the Windows Setup itself. This is the so called "Component Base Setup" CBS. This you will also find the setup logs. For several reasons it might be necessary to do an update!

Here you will find the latest Servicing Stack Updates:

(Sometimes they have even something to do with security fixes.)
 

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001

You will find this also in my "Important Links" list.

So what is it in detail?

The "servicing stack" is the code that installs other operating system updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month.

For more information please refer to:

https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates

When and how to apply?

Best is to add it via DISM right after applying the image in a Task Sequence in SCCM. So you ensure it is already updated before Windows Setup starts its tasks. e.g. with this command during an task sequence where your are still offline but C:\Windows exists due to the fact that you applied the image first and then you run this command in a SCCM package:

dism /Image:C:\ /Add-Package /PackagePath=windows10.0-kb00001-x64.msu /LogPath=C:\Windows\logs\dism-add-stackservicingpackage.log
Write them in one line! Word wrapping is just for better readability in my blog!
The missing path to the MSU file is by purpose. The command always get executed in the same directory as the command is invoked by the Task sequence SCCM package. 

Also image directory in offline mode (Windows PE) is C:\

You have also the option to mount the Vanila WIM Image (it is important that is is NOT a built and capture image for upgrade scenarios!) and add the servicing stack update directly there. So it becomes out of the box part of the WIM file.

But keep in mind if you are using the WIM image for Windows 10 inplace upgrade (7 to 10 or 10 old to 10 newer) then your are only allowed to do a very limited set of image modifications. Built and capture is absolutelly forbidden in this scenario.

You can add the following to the WIM used for upgrades:



1. Latest servicing stack update (for your particular Windows version!)1. Latest cummulative update (for your particular Windows version!)
2. Latest cumulative update (for your particular Windows version!)
3. Additional feature on demand packages (keep in mind you need to look for the right Feature on demand DVD that fits to this version of windows!)
4. Language packs (also need to fit to the right version of Windows!)

NEVER mix up versions!

Kudos to Manuel for sending me the link of the repo! ;-)

Windows cummulative updates cause WSUS to fail

Recently Microsoft released an interesting article about failing WSUS to deliver updates to Windows Clients. Currently affected are Versions before 1703 but due to the nature of the updates and the issue this will be soon the case also for the current Version.

Short Story:
High CPU and Memory consumption on the WSUS process (w3wp.exe IIS worker threat) due to the high volume of meta data caused by later and therefore larger cummulative updates for Windows 10.
 
The symptoms include:

• High CPU on your WSUS server – 70-100% CPU in w3wp.exe hosting WsusPool
• High memory in the w3wp.exe process hosting the WsusPool – customers have reported memory usage approach 24GB
• Constant recycling of the W3wp.exe hosting the WsusPool (identifiable by the PID changing)
• Clients failing to scan with 8024401c (timeout) errors in the WindowsUpdate.log
• Mostly 500 errors for the /ClientWebService/Client.asmx requests in the IIS logs

The solution is:

• Configure IIS to stop recycling the IIS pool
• Limit the number of inbound connections to IIS
• Increase the ASP.net timeout
• Monitor the processes

Long Story with solution details:
https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/

Updated Office 365 release cycle and new deployment method

Microsoft just released new informations regarding the new Office 365 release cycle and improved update Management.

Good news first:

• it is alligned with Windows 10
• it will be managed like Windows 10 with SCCM (at least SCCM 1610)

Checkout this 9 minute video:
https://www.youtube.com/watch?v=d1xHdHsTspY

Windows Update Optimization

Recently I discussed the Windows Update Peer to Peer functionality with one of my customers. And MS also added some GPOs to control this better.


In Windows Update -> Advanced Options -> Choose how updates are delivered
You will find the plain simple setting for this. But you can do much more.

 

 

What it is for:

Windows Update Delivery Optimization enables you to download Windows updates and Windows Store apps from sources other than Microsoft. This can help you get updates and apps more quickly if you have a limited or unreliable Internet connection. If you own more than one PC, Delivery Optimization can reduce the amount of Internet bandwidth that is required to keep all your PCs up-to-date. Delivery Optimization also sends updates and apps from your PC to other PCs on your local network or on the Internet.

You can use Group Policy to configure Windows Update Delivery Optimization. To do this, follow these steps:

1. Download the Administrative Templates (.admx) file for Windows 10 from the following Microsoft Download Center website:
   
   Administrative Templates (.admx) for Windows 10 Version 1607 and Windows Server 2016
   
   Administrative Templates (.admx) for Windows 10 and Windows 10 Version 1511
2. Copy the following files to the SYSVOL central store:
   • DeliveryOptimization.admx from C:\Program Files (x86)\Microsoft Group Policy\Windows 10\PolicyDefinitions
   • DeliveryOptimization.adml from C:\Program Files (x86)\Microsoft Group Policy\Windows 10\PolicyDefinitions\en-US
3. Start the Gpeditor tool.
4. Browse to the following location:
   Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization
5. Make the following Windows Update Delivery Optimization settings, as appropriate.

Source
https://support.microsoft.com/en-us/help/3088114/how-to-use-group-policy-to-configure-windows-update-delivery-optimization-in-windows-10

Whats new in 1607:

There are also additional GPO settings available in 1607 which added more control on this (The support article refer to an obsolete article at the end!) This is the new replaced blog entry from Michael Niehaus.
https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/

Windows 10 Update Assistant for failing upgrades from RTM to 1511

Recently MS released an update that let you update your system to the latest public release (1511) if your system is still on RTM and may not update automatically to the recent version due to errors in Windows Update.

Please chekcout this KB article therefore https://support.microsoft.com/en-us/kb/3159635


The update to 1511 is essential to receive the new Redstone release coming in few weeks!