Introduction
- Ivanti Patch Linux
- Ivanti Patch For Windows Servers
- Ivanti Patch And Compliance Manager
- Avanti Patch And Compliance Act
In a recent customer engagement, the client had requested to upgrade Windows 10 workstations within their environment using Ivanti Endpoint Manager (EPM.)
These reports provide useful information about security risk assessment, compliance, patch deployment, and remediation status for scanned devices on your network and for each of the various security risk content types. To access the Reports tool and generate and view reports, a user must have the Ivanti Administrator right (implying full rights. Open the Ivanti Endpoint Manager Console and go to the Security and Compliance Tool group. Open the Patch and Compliance Tool. Ensure that you have downloaded the latest updates in the Vulnerabilities category. After downloading the vulnerabilities category, select the correct definition for the version that you would like to upgrade to.
The Patch and Compliance tool, like all other Ivanti tools, is opened from either the Tools menu or the Toolbox and can be docked, floated, and tabbed with other open tool windows. To open the Patch and Compliance tool, click Tools Security and Compliance Patch and Compliance. Ivanti provides several patch management options for Windows, Linux, Unix and Mac and an extensive third-party catalog of software updates. Compliance, configuration management.
Ivanti has a recommended method to upgrade Windows 10 workstations to newer versions through their service pack definitions.
The service pack definitions are found in the Patch and Compliance tool and can be used to determine if an endpoint can receive the upgraded version of Windows. The service pack definition defines an ISO for the deployment, which cannot be downloaded via the Patch and Compliance tool.
The ISO must be downloaded separately and renamed to match what is configured in the definition. There are both pros and cons to using the recommended method:
ISO Method
Pros:
- Easy to deploy
- Simple configuration
Cons:
- Space requirements (2x ISO size)
- Large performance impact
- Poor end-user awareness
When deploying any patch or distribution package, it is important to do so consistently each time to achieve expected results.
For this reason, I developed a Software Distribution method that would offer versatility and consistency with any Windows 10 upgrade. There are pros and cons to this method as well:
Software Distribution Method
Pros:
- Fewer space requirements (1x ISO size)
- Full end-user awareness
- No performance impact
Cons:
- More involved configuration
- Leaves machine unusable for the duration of the deployment
Deploying Windows 10 Upgrades via Patch and Compliance
Ivanti Patch Linux
Ivanti's recommended method for upgrading Windows 10 is fairly straightforward for the setup and deployment.
After the ISO is named according to what is configured in the definition file, all that is left to do is deploy it to targeted endpoints.
The Patch and Compliance deployment, after scheduling the repair and starting the task, is as follows:
- Copy the ISO to the machine (download ISO here)
- Mount the ISO and extract the contents
- Unmount the ISO and start the upgrade process with the now local files
As previously mentioned, Ivanti's recommended method for deployment has some cons.
First, it is required to have twice the disk space on the endpoint for storing the ISO and the extracted contents; that can easily amount to 8GB or more.
Once the installation starts, a large performance impact will be seen as the upgrade will start using most of the machine's resources.
Lastly, there is poor end-user awareness as to what is actually happening. EPM does have the capability to provide prompts to the end user with the correct agent settings; however, when using those settings there is still no indication of the progress of the deployment.
Deploying Windows 10 Upgrades via Software Distribution
Ivanti's Windows 10 upgrade method using Patch and Compliance works, but in this case, the customer needed something that was more user friendly and did not have any impact on performance.
This is how the Software Distribution method ensued. The Software Distribution method makes use of two custom batch files.
The first batch file used in the deployment, in this case, named GetUserName.bat, is used to simply get the username of the currently logged-in user if there is one; the username will be output into a temporary text file called Username.txt.
By default, when creating a distribution package, it will run under the SYSTEM account.
ISO Method
Pros:
- Easy to deploy
- Simple configuration
Cons:
- Space requirements (2x ISO size)
- Large performance impact
- Poor end-user awareness
When deploying any patch or distribution package, it is important to do so consistently each time to achieve expected results.
For this reason, I developed a Software Distribution method that would offer versatility and consistency with any Windows 10 upgrade. There are pros and cons to this method as well:
Software Distribution Method
Pros:
- Fewer space requirements (1x ISO size)
- Full end-user awareness
- No performance impact
Cons:
- More involved configuration
- Leaves machine unusable for the duration of the deployment
Deploying Windows 10 Upgrades via Patch and Compliance
Ivanti Patch Linux
Ivanti's recommended method for upgrading Windows 10 is fairly straightforward for the setup and deployment.
After the ISO is named according to what is configured in the definition file, all that is left to do is deploy it to targeted endpoints.
The Patch and Compliance deployment, after scheduling the repair and starting the task, is as follows:
- Copy the ISO to the machine (download ISO here)
- Mount the ISO and extract the contents
- Unmount the ISO and start the upgrade process with the now local files
As previously mentioned, Ivanti's recommended method for deployment has some cons.
First, it is required to have twice the disk space on the endpoint for storing the ISO and the extracted contents; that can easily amount to 8GB or more.
Once the installation starts, a large performance impact will be seen as the upgrade will start using most of the machine's resources.
Lastly, there is poor end-user awareness as to what is actually happening. EPM does have the capability to provide prompts to the end user with the correct agent settings; however, when using those settings there is still no indication of the progress of the deployment.
Deploying Windows 10 Upgrades via Software Distribution
Ivanti's Windows 10 upgrade method using Patch and Compliance works, but in this case, the customer needed something that was more user friendly and did not have any impact on performance.
This is how the Software Distribution method ensued. The Software Distribution method makes use of two custom batch files.
The first batch file used in the deployment, in this case, named GetUserName.bat, is used to simply get the username of the currently logged-in user if there is one; the username will be output into a temporary text file called Username.txt.
By default, when creating a distribution package, it will run under the SYSTEM account.
This particular package, however, will run under the current user account; this is important for the next batch file in the process. The contents of the GetUserName.bat file can be seen below.
The second batch file, which will be named Windows10Upgrade.bat, will use the Username.txt output from the previous batch file if it exists.
If the Username.txt file exists, a scheduled task will be created to execute setup.exe that gets copied to the clients.
Setup.exe is the main executable in a Windows ISO that installs and configures the OS with the parameters you define.
The scheduled task will be created to run in the current user's context with the highest privileges and will execute one minute from the time it is created.
Running the task with the highest privileges is a requirement, otherwise, the scheduled task will fail. The reason a scheduled task is created is to allow the user to see the GUI operation of the upgrade; if setup.exe was executed under the SYSTEM context, the currently logged in user would not see anything.
Ivanti Patch For Windows Servers
If there is no Username.txt file, setup.exe will just run under the SYSTEM context as that is the default for the distribution package. The contents of the Windows10Upgrade.bat file can be seen below.
While the batch files, along with the ISO itself, are the main components of this deployment method, below is a list of items and configurations needed for this deployment method:
- Windows 10 ISO (Extracted to a folder)
- GetUserName.bat (In the same folder as the Extracted ISO)
- Windows10Upgrade.bat (In the same folder as the Extracted ISO)
- IIS MIME type for Default Website
- Type: application/octet
- Extension: .
This method allows for a seamless, quick, and efficient deployment that will provide the end-users with a good experience if logged in during the deployment.
If they are logged in, they will have full insight into what is happening. The general process for the entire deployment is as follows:
- The task starts and either begins the download on the client or starts executing the batch files if already downloaded
- GetUserName.bat runs and outputs a Username.txt file to C:Temp that contains the username of the currently logged-in user if there is one. A file does not get created if there is no user logged in.
- Next, Windows10Upgrade.bat will run and determine if there is a Username.txt file
- If there is a Username.txt file, a scheduled task will be created for the current user, obtained from the Username.txt file
- If there is no Username.txt file, setup.exe will run under the SYSTEM context as is the default for the package
- The machine will transition to a blue screen showing the progress of the installation after about 30-45 seconds and will make the computer unusable for approximately 45min-1.5h; time can also vary depending on hardware capabilities
As you can see, the process is fairly straight forward and if anything gets created, such as the Username.txt file and scheduled task, it will be cleaned up.
To make this process more user friendly, one can also pair this entire deployment with notification messages or deferment timers to provide more control to the end-user.
These are a few examples of the flexibility that EPM offers. Below is a short video of the deployment and demonstration of how it works and is setup.
Ivanti Endpoint Manager (EPM) Demo & Deployment Video
In Conclusion
Ivanti Patch And Compliance Manager
Thank you for reading and please feel free to reach out if you have questions, comments, or concerns about the information presented in this article.
Avanti Patch And Compliance Act
Zach Thurmond
IT Consultant
Critical Design Associates
