Hi,
I was wondering if BigFix can downloaded “upgrade updates”. For example, can I upgrade my Windows 10 1803 to 1909? I was going to setup a WSUS server for that but was wondering, if WSUS can push this update, why can’t BigFix? Isn’t that just another KB/Fixlet in a way?
Thanks
You can perform these upgrades with BigFix using either Patch Management or the OS Deployment and Bare Metal Imaging (OSD) solution. If you own OSD I think that offers more options and is a little bit easier (to me) in the long run, but it does require more up front “training”. Many people here on the forums use the Patch Management solution since it is more light weight and requires less setup time or training. However, I don’t have much personal experience outside of just playing around with it in my lab since I prefer OSD. There are a lot of posts here on the forums about using Patch though and I’m sure someone else will be happy to share their experiences with you. Here is the info for performing in-place upgrades with OSD: https://help.hcltechsw.com/bigfix/10.0/lifecycle/Lifecycle/OSD_Users_Guide/c_manage_win_inplace_upgrade.html.
For the non-OSD method (for instance if you only have BigFix Patch and not LifeCycle), check one of these fixlets (assuming English, but we also have many other languages) in the “Patches for Windows” Site:
1111556 Windows 10 Business Editions Version 20H2 Available - Windows 10 (x64) (English-United Kingdom)
1111574 Windows 10 Business Editions Version 20H2 Available - Windows 10 (x64) (English (United States))
1111553 Windows 10 Business Editions Version 20H2 Available - Windows 10 (English-United Kingdom)
1111572 Windows 10 Business Editions Version 20H2 Available - Windows 10 (English (United States))
1111518 Windows 10 Business Editions Version 2004 Available - Windows 10 (x64) (English-United Kingdom)
1111517 Windows 10 Business Editions Version 2004 Available - Windows 10 (x64) (English (United States))
1111507 Windows 10 Business Editions Version 2004 Available - Windows 10 (English-United Kingdom)
1111510 Windows 10 Business Editions Version 2004 Available - Windows 10 (English (United States))
1111415 Windows 10 Business Editions Version 1909 Available - Windows 10 (x64) (English-United Kingdom)
1111414 Windows 10 Business Editions Version 1909 Available - Windows 10 (x64) (English (United States))
1111482 Windows 10 Business Editions Version 1909 Available - Windows 10 (English-United Kingdom)
1111427 Windows 10 Business Editions Version 1909 Available - Windows 10 (English (United States))
The Description tab of each of these fixlets has additional instructions you’ll need to follow. They mention which OS editions can be upgraded:
This Fixlet requires downloading the Windows 10 ISO image before deploying the Fixlet. You can use a custom repository to do so. Once this Fixlet completes, restart the target to complete the upgrade process.
The business edition ISO contains the following Windows editions:
Windows 10 Pro
Windows 10 Pro N
Windows 10 Pro for Workstations
Windows 10 Pro N for Workstations
Windows 10 Pro Education
Windows 10 Pro Education N
Windows 10 Education
Windows 10 Education N
Windows 10 Enterprise
Windows 10 Enterprise N
What I see sometimes is not clear is that you have to obtain the ISO image first, from your Microsoft Volume License Service Center (VLSC) account. Your download should match the size/sha1/sha256 of the ISO listed in the Fixlet, or you might need to create a custom copy of the Fixlet to update those values if the ISO image has changed and our fixlet hasn’t caught up yet.
Right now for 2004 English - US we are using the ISO image “en_windows_10_business_editions_version_20h2_updated_nov_2020_x64_dvd_e5d7759b.iso” which I think is still the latest.
The Description tab also goes a bit more into increasing the download cache sizes of your clients which may be necessary.
Thank you Jason and dmccalla. I read a little about this subject but I’m not sure where to download the ISO to. I have the relevant ISO, but where do I copy it to?
Do I create a custom site and upload the files to it? Then what? Not quite sure how to begin.
This is a little tricky, as MS doesn’t allow us to download the ISO image for you directly. You have to do the steps manually that we would normally do for a download.
You have to rename the .ISO file to it’s sha1 hash value, with no extension. Then copy it on the Server to BES Server\wwwrootbes\bfmirror\downloads\sha1 , where you’ll find cached copies of the other files your server has downloaded.
You may use the fixlet debugger to calculate the file’s sha1 hash:
q: sha1 of file "c:\path\to\image.iso"
That sha1 should match the file requested in the fixlet. If it does not, you may have a more (or less) up-to-date copy of the image file than what our fixlet expects. In that case, make a Custom Copy of the fixlet, and replace the download values for size, sha1, and sha256 with the actual values for your ISO image.
Once you have the image cached into the server’s sha1 folder, and the fixlet matches it, you should be ready to action the fixlet to some clients. Test on a few first, I strongly recommend using a VM for testing so you can watch the upgrade process run (it takes several reboots so you can’t watch it remotely)
One more thing I forgot to ask is, where do I put the ISO itself? I have a Windows 10 Pro ISO file in my downloads folder. I duplicated it, changed its’ name to the sha1 value and copied it over to Server\wwwrootbes\bfmirror\downloads\sha1. Now I’m confused because in the fixlet, it says add prefetch item name =en_windows_10_business_editions_version_20h2_updated_nov_2020_x64_dvd_e5d7759b.iso. Can I use paths or is there a specific directory it searches in?
Thanks 
The ISO, renamed to it’s sha1 value, needs to be directly in the bfmirror/downloads/sha1 folder.
When the server gets a download requests from the client, it always checks the sha1 folder first to see whether that files has been downloaded and cached before. When checking that cache, the server doesn’t care about the filename, just its sha1 hash value.
Thanks.
I ran it once and it failed. I’m changing some things and hopefully it will succeed. If not, I can post everything I did and hopefully you’ll be able to explain what I was missing.
Thank you Jason, your help is greatly appreciated
If it got as far as “Failed” status you’re doing it right
If you dhadn’t cached the ISO correctly it would be stuck in ‘Pending Downloads’.
You’ll need the BigFix client log and, if it got as far as running the setup, probably the Windows Setup logs, whichever are most recent, at \Windows\Panther
Thanks. Seems like it failed due to lack of disk space. Hopefully that is it
We use these 3 fixlets, easy to tweak too:
https://bigfix.me/fixlet/details/25593
https://bigfix.me/fixlet/details/25594
https://bigfix.me/fixlet/details/25595
Looks awesome! Thank you!
Couple of beginner questions if I may:
Thank you
We have used BigFix to upgrade our client OS many times and the biggest problems we have see are do to Host Based Security System (HBSS). Sometimes it is an individual package of HBSS, but I have most of the time just uninstalled HBSS from the client with the exception of the Agent. After that it usually goes well. Finding out was is blocking a client is just like any other fixlet. Manually try and install on client and see what is causing the error. Things that we have to change in the fixlet is the SHA1, SHA256 and the file size. Other than that, it seems to go pretty smooth.
Been doing this recently. Several steps are involved to get this to work.
1: update the BigFix server and relays cache if necessary, the ISO is 5+GB so you need the space. Use BES Relay / BES Server Setting: Download Cache Size (search Fixlets and Tasks).
2: Then the client needs the cache size updated to at least 6 GB as well. You can do this manually but I suggest creating a task like:
action parameter query “setDownloadCacheSize” with description “Please enter the download cache size you would like to to set in MB (valid limits range from 1024 to 2147483647 MB):”
//check for numbers, we don’t like letters or special characters.
continue if {parameter “setDownloadCacheSize” of action as integer>= 1 AND parameter “setDownloadCacheSize” of action as integer <= 2147483647}
setting “_BESClient_Download_PreCacheStageDiskLimitMB”="{parameter “setDownloadCacheSize” of action}" on “{parameter “action issue date” of action}” for client
setting “_BESClient_Download_NormalStageDiskLimitMB”="{parameter “setDownloadCacheSize” of action}" on “{parameter “action issue date” of action}” for client
It will prompt you for a value when run, enter “6000” for 6 GB of cache space on the client.
3: Use the BigFix supplied Fixlet for your situation per @JasonWalker above so you have support from BigFix. This means you need to download the correct ISO from MS. - Done
4: If you bake your own or modify the upgrade fixlet to match your own ISO, ensure you change the ISO name, ISO SHA1 and ISO SHA256 hashes to match your ISO you are uploading into the SHA1 folder on the BF server. These can be found in the Actions tab. Don’t miss the "action requires restart “” at the end of the fixlet.