Wednesday, February 19, 2020

Windows as a Service: Forcing machine forward

Do you have a Windows as a Service strategy lined out? 
How do you are going to push the upgrades. 
Are you going to allow everyone to upgrade to any version or control it? 
What are you doing about special machines you cannot force due to software or process control, are they moving at the end of cycle? 
Are you tracking which machines are out of compliance?

I bet that last question made you think.  Many companies have not tracked their end of life for Windows 10 which can be found here:
https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet

Now you can create a CI and pull machines into a collection that will soon be end of life, use this to force a popup, Toast Notification, force the upgrade, etc...


Powershell:

CI Discovery script
Data type:String
------------------------------------------
 $Win10_Life = @(
                 ("1607","1703","1709", "1803","1809","1903","1909"),
                  ("4/9/2019","10/8/2019","4/14/2020","11/10/2020","5/11/2021","12/8/2020","5/10/2022") )

$CurentWindowsVer = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ReleaseID -ErrorAction Stop).ReleaseID

$index= 0..20 | Where { $Win10_Life[0][$_] -eq $CurentWindowsVer }
if ($index -ge 0)
{
  # grab the end of life date for the OS version
  $EndofLifeDate= $Win10_Life[1][$index]

  #determine number of days left in life
  $EndofLifeDays = (New-TimeSpan -Start (Get-Date) -End $EndofLifeDate).Days

   #$EndofLifeDate
   #$EndofLifeDays

    If ($EndofLifeDays -lt 60) {"Upgrade"}
}

-------------------------------------------------------------
You can see there is a 2 Dimension array with the build numbers and the end of life date.  If you are running Pro then you will need to change these dates, these are for Enterprise/Education. 

 In the Compliance setting I use 
"The value returned by the specified script:"
Not Equal to
Upgrade

This can be run once a month or every 3 weeks on a machine.  It will pull the machine into the collection if it has less than 60 days. 

How do I create the collection?
In the baseline right click on the deployment
Select the Non-Compliant. 

This will create a collection of machines that are not running a supported version of Windows 10.