Deploy Windows 10 feature update to remote users - SCCM - Deployment size

Question

Deploy Windows 10 feature update to remote users - SCCM - Deployment size

n4 41

Good Afternoon,

I have roughly 5000 remote clients due to Covid, and we need to move off Windows 10 1809 fairly soon.

I have a working deployment, but I am very concerned about how to release this to users on VPN (not always-on).

I have BITS throttling pretty aggressively, but I'm still worrying about overloading our 3 VPN pipes. We are not able to use cloud services or split tunnel VPN.

For now I'm looking at required, silent deployments to small numbers. The deployments would be time-randomized per the client setting, and install would be allowed outside the nightly maintenance window. The machine would be rebooted (the longest part) during the window.

I guess the biggest question is roughly how many clients I can deploy per day. 10? 100? 500?

Has anyone dealt with this situation? I'm looking for advice, guidelines, etc. I'm just not finding much info on how to deal with this volume.

Amandayou-MSFT 11,156 Reputation points

2021-03-03T07:23:02.683+00:00

Hi,

If we are not able to use cloud services or split tunnel VPN, it is better to get the feature update from Microsoft directly to relieve the pressure on the DP. The size of the feature update is about 3G, there may not the best suggestions, we could test them according the VPN pipes, BITS throttling to find the best practice.

Best regards,
Amanda

1 answer

Your answer

Amandayou-MSFT 11,156 Reputation points

2021-03-03T07:23:02.683+00:00

Hi,

If we are not able to use cloud services or split tunnel VPN, it is better to get the feature update from Microsoft directly to relieve the pressure on the DP. The size of the feature update is about 3G, there may not the best suggestions, we could test them according the VPN pipes, BITS throttling to find the best practice.

Best regards,
Amanda

Answer 1

n4 41

Thanks for the reply!

Getting content from MS is possible to set in the deployment, but users would have to disconnect their VPN beforehand or they would pull it through our network anyway. I might also have to change some GPO settings such as enabling Windows Update on the client. In this scenario it would have to be a user-initiated install or I would have to use a task sequence to ensure they drop their VPN. All probably possible, but I'm not super-comfortable here.

We have 2 local WAN-connected locations (30GB pipe IIRC) where VPN's terminate and I built 2 DPs at each location. I'm in the process of setting the VPN boundaries to only talk to the DPs at their location. So maybe the DPs can take it, if we're careful? I suspect we may have to find out.

Also MS says a 'required' deployment will use BITS to start caching the package right away. I'm not finding this to be true at all. Deployment is set to required after 7 days currently for testing. I have another test under way and will check again to make sure.

3GB? That's not much bigger than a monthly patch load. From observation it looks closer to 7GB. If it matters we're going 1809/1909 to 20H2.

Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2021-03-04T20:55:37.173+00:00

Also MS says a 'required' deployment will use BITS to start caching the package right away.

This is almost correct. It starts at a random time (up to 1 hour I believe) after the available time of the deployment. It also uses BITS background mode so the download is throttled based on user activity.
n4 41 Reputation points

2021-03-05T10:42:14.457+00:00

I left the test machine for 48 hours with the deployment available with a cleared cache. Required date is 4/1. No caching occurred.
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2021-03-05T15:15:54.663+00:00

If the systems doesn't require an update, it won't cache it. Are you sure that the Feature Update you deployed is applicable to the target system? Also, the content must be available. Have you reviewed applicable logs, like WUAHandler, Update*.log, and DataTransferManager.log to validate these?
n4 41 Reputation points

2021-03-05T17:06:16.947+00:00

Yes the update is applicable. Content is available.

Bear in mind I've already upgraded this VM once with this deployment. Reverted my snap, and reset ccmclient with wmic.

After waiting 48 hours to see if it would cache (with the update showing in software center) there were 0 bytes in cache, with no folders existing under ccmcache. I then clicked the update and it began downloading the update and proceeded to install it.

If I have some time I may review logs with the next test group. Its not a show stopper, nor am I surprised as I have never seen this claimed behavior actually work.

If you have some thoughts on my deployment scenario, though, I would love to hear them.
Jason Sandys 31,406 Reputation points Microsoft Employee Moderator

2021-03-05T18:52:52.57+00:00

I've never known or seen this not work. Opening a support case may be your best path here.

Share via

Deploy Windows 10 feature update to remote users - SCCM - Deployment size

1 answer

Your answer