• https://blogs.technet.microsoft.com/wsus/2017/08/04/improving-dual-scan-on-1607/
• https://blogs.technet.microsoft.com/configurationmgr/2017/10/10/using-configmgr-with-windows-10-wufb-deferral-policies/

Let's double check that!

Which GPO does what?

• the "Check for Updates" Button to be disabled or not
  • Note: the Button has no use if dualscan is disabled.
• The Link "Check online for updates from Microsoft Update" whether it is shown or not
  • Note: a click on the link would fetch updates and upgrades from Microsoft Update
• Whether you can manually search for drivers against Microsoft Update in the Device Manager or not
• Whether drivers are updated via Microsoft Update, WSUS or not at all
• Whether Apps are getting updates from the Microsoft Store or not

Where do i find these GPOs?

GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Updates\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ SetDisableUXWUAccess REG_DWORD

GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Updates\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ DoNotConnectToWindowsUpdateInternetLocations REG_DWORD

GPO: Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ DisableWindowsUpdateAccess REG_DWORD

GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Updates\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ ExcludeWUDriversInQualityUpdate REG_DWORD

GPO: Computer Configuration\Administrative Templates\System\Device Installation\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DriverSearching\ DriverServerSelection REG_DWORD

GPO: Computer Configuration\Administrative Templates\System\Device Installation\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DriverSearching\ SearchOrderConfig REG_DWORD

Managing Microsoft Store and App Updates!

---

Turn Off Access to the Store

Description

This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed. If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog.

GPO: Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings\ Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer NoUseStoreOpenWith REG_DWORD App Updates: not affected One might think this is the GPO to disable the Microsoft Store, this is what is really does: Your users won't be asked to find a app in the store if they try to open an unknown file extension.

Turn off Store application

Description

Denies or allows access to the Store application.If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. If you disable or don't configure this setting, access to the Store application is allowed.

GPO: Computer Configuration\Administrative Templates\Windows Components\Store or User Configuration\Administrative Templates\Windows Components\Store Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore RemoveWindowsStore REG_DWORD or HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStore RemoveWindowsStore REG_DWORD App Updates: If configured in the computer context, it turns off app updates Blocks the Microsoft Store app, with the following message

---

Only display the private store within the Microsoft Store app

Description

Denies access to the retail catalog in the Windows Store app, but displays the private store. If you enable this setting, users will not be able to view the retail catalog in the Windows Store app, but they will be able to view apps in the private store. If you disable or don't configure this setting, users can access the retail catalog in the Windows Store app

GPO: Computer Configuration\Administrative Templates\Windows Components\Store or User Configuration\Administrative Templates\Windows Components\Store Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore RequirePrivateStoreOnly  REG_DWORD or HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStore RequirePrivateStoreOnly REG_DWORD App Updates: not affected Users will only be presented with the Apps you have added into the Store for Business

---

Disable all apps from Windows Store

Description

Disable turns off the launch of all apps from the Windows Store that came pre-installed or were downloaded. Apps will not be updated. Your Store will also be disabled. Enable turns all of it back on. This setting applies only to Enterprise and Education editions of Windows.

GPO: Computer Configuration\Administrative Templates\Windows Components\Store Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore DisableStoreApps REG_DWORD (Note: disable = 1 = apps disabled) App Updates: not affected Apps cannot be started and you will be presented witht this message Note: Does include Calculator, Maps, Photos, Camera, etc. Does not affect Edge.

---

Turn off Automatic Download and Install of updates

Description

Enables or disables the automatic download and installation of app updates. If you enable this setting, the automatic download and installation of app updates is turned off. If you disable this setting, the automatic download and installation of app updates is turned on. If you don't configure this setting, the automatic download and installation of app updates is determined by a registry setting that the user can change using Settings in the Windows Store.

GPO: Computer Configuration\Administrative Templates\Windows Components\Store Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore AutoDownload REG_DWORD (NB: enable = 2 = apps will not be updated, disable = 4 = app will be automatically updated) App Update: Yes and No, Keyword here is automatic, the “Get Updates” button in the store app will not be disabled. Automatic App updates can be locked to be on or off, again "Get Updates" in the Download and Updates Menu would still download and update apps

Finally...

• Please make sure you have tested your GPO settings thoroughly, before you continue to implement them in your production environment. Especially if you use a combination of the GPOs explained in this blog or any other Update/Store related GPO.
• Things might change with the soon to be release Win10 1803 Release.
• Stop hurting yourself by not updating: https://blogs.technet.microsoft.com/yongrhee/2018/03/20/stop-hurting-yourself-by-not-updating-the-drivers-and-firmwares-in-windows-and-windows-server/

Solution

Script

# Script OSD_PasswordChecker.ps1 - Version 1802
# ***** Disclaimer *****
# This file is provided "AS IS" with no warranties, confers no 
# rights, and is not supported by the authors or Microsoft 
# Corporation. Its use is subject to the terms specified in the 
# Terms of Use (http://www.microsoft.com/info/cpyright.mspx).
#

# -----------------------------------------------------------------------------------
# Function Section
# -----------------------------------------------------------------------------------
function ok-button {
 <#
 .SYNOPSIS
 Compares the entered Password with the OSDPassword 
 .DESCRIPTION
 Function to compare the Task Sequence Varibale "OSDPassword" with the entered Password
 #>

if($tsenv.Value("OSDPassword") -eq $MaskedTextBox) {
 $tsenv.Value("OSDPasswordChecked")=$True 
 }
}

# -----------------------------------------------------------------------------------
# Worker Section
# ----------------------------------------------------------------------------------- 
# Construct TSEnv object
try {
 $TSEnv = New-Object -ComObject Microsoft.SMS.TSEnvironment -ErrorAction Stop
}
catch [System.Exception] {
 Write-Warning -Message "Unable to construct Microsoft.SMS.TSEnvironment object" ; exit 1
}

#GUI Creation
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing") 
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

$objForm = New-Object System.Windows.Forms.Form 
$objForm.Text = "OSD PasswordChecker"
$objForm.Size = New-Object System.Drawing.Size(300,200) 
$objForm.StartPosition = "CenterScreen"
$objForm.KeyPreview = $True

$objForm.Add_KeyDown({
 if ($_.KeyCode -eq "Enter") {
 ok-button;$objForm.Close()
 }
})
$objForm.Add_KeyDown({
 if ($_.KeyCode -eq "Escape") {
 $objForm.Close()
 }
})

$OKButton = New-Object System.Windows.Forms.Button
$OKButton.Location = New-Object System.Drawing.Size(75,120)
$OKButton.Size = New-Object System.Drawing.Size(75,23)
$OKButton.Text = "OK"
$OKButton.Add_Click({
 ok-button;$objForm.Close()
})
$objForm.Controls.Add($OKButton)

$CancelButton = New-Object System.Windows.Forms.Button
$CancelButton.Location = New-Object System.Drawing.Size(150,120)
$CancelButton.Size = New-Object System.Drawing.Size(75,23)
$CancelButton.Text = "Cancel"
$CancelButton.Add_Click({
 $objForm.Close()
})
$objForm.Controls.Add($CancelButton)

$objLabel = New-Object System.Windows.Forms.Label
$objLabel.Location = New-Object System.Drawing.Size(10,20) 
$objLabel.Size = New-Object System.Drawing.Size(280,20) 
$objLabel.Text = "Please enter the information in the space below:"
$objForm.Controls.Add($objLabel)

$MaskedTextBox = New-Object System.Windows.Forms.MaskedTextBox
$MaskedTextBox.PasswordChar = '*'
$MaskedTextBox.Location = New-Object System.Drawing.Size(10,40) 
$MaskedTextBox.Size = New-Object System.Drawing.Size(260,20) 
$objForm.Controls.Add($MaskedTextBox) 
$objForm.Topmost = $True
$objForm.Add_Shown({$objForm.Activate()})

[void] $objForm.ShowDialog()

Implementation

Step: Set OSDPassword

Step: Run OSDPasswordChecker

• Enable Powershell Feature in the Boot WIM
• ServiceUI.exe needed to create a GUI in WinPE. By the way, we are using the same technique to launch the well known MDT UDI wizard.

ServiceUI.exe -process:TSProgressUI.exe %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File OSDPasswordChecker.ps1

Deployment Start Folder

BranchCache

• Fast distribution of content
• "set and forget" config
• DeDuplication Benefits
• can share Content (Blocks) as soon as the Block is in the Cache (no need to wait until the full Filesize was replicated)
• can handle all content (non-SCCM)
• only changes will be transferred (Block-level replication)
• Full API and PowerShell available for customizations.
• Allows sharing of Task Sequence Policies between clients (these policies are usually small. But some of these policies can get quite big and as they are also transferred to the clients it would be like distributing a big application)

• Difficult to visualize
• only within Broadcast Domain possible
• additional cache location (not using the SCCM Cache folder)

Peer Cache

Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache. It is available as a feature since the Configuration Manager Current Branch version 1710.

Peer Cache was specifically designed for Configuration Manager, therefore it only handles Configuration Manager content. The Content can be shared via the Boundary Groups to all managed Configuration Manager Clients. This means that Content Sharing is not restricted by the Broadcast Domain.

To configure Peer Cache, open up the Configuration Manager Client Settings and activate it in the "Client Cache" section. Once a client has this setting enabled, it becomes a ‘Peer Cache Source’ - which will be handled similar to a Distribution Point.

Peer Cache sources can only share content to other client, as soon as the whole Package / File is downloaded and cached. This process is similar to the Distribution Point. The Content is downloaded by designated Peer Cache sources, and once the download is complete (and it has to be the whole package/application etc), the Configuration Manager Client reports back to the CM Site that it has the content.

When promoting a Client to a Peer Cache Source, the existing content in the CCMCache folder is also reported back to the CM Site.

Client that request content during a deployment, perform a content lookup. This lookup will contain any Peer Cache source (which already have the content successfully cached) along with the regular Distribution Points. The requesting client then connects to the CCMCache folder on the Peer Cache source and download the content via a regular BITS download job.

Peer Cache sources are also available to a client during OS Deployment in WinPE.

The best practice is to choose only clients best suited as peer cache sources. Evaluate client suitability based on attributes such as chassis type, disk space, and network connectivity. For more information that can help you select the best clients to use for Peer Cache, see this blog by a Microsoft consultant.

• Boundary sharing
• Reporting
• All Content in CCMCache

• Configuration Manager content only
• slow to initially share content
• Content version increase invalidates the whole package

Comparison BranchCache vs. Peer Cache

Some Examples

Required deployment (... at a specific time)

Depending on the time between when the content was available and the deadline, the client peer cache might have attempted to pre-download the content. (depending on Maintenance Windows, etc)

Latest the content will be downloaded by the Peer Cache Computer when the deadline is reached. As Peer Cache Content can only be shared when the content is fully downloaded, Obviously this results in a massive fallback of all Client to the DP. To solve this the content needs to be pre-cached prior deployment start.

BranchCache in this scenario works a little better, as it can share content as soon as any client gets a block of data.

Available deployment 

Peer Cache might work much better in this scenario, as it might be able to have already downloaded the content prior an Client request it.

BranchCache can also be used (as Backup) in the case no Peer Cache clients are available. Then clients can ‘fall back’ to using BranchCache and still get the benefit of Peer to Peer.

Frequently updated Packages

If a Configuration Manager Content (Application, Packages) is updated, the version changes. This invalidates the content on all Peer Cache clients, that is , the new version is treated as new content so Peer Cache sources with the previous version will not be returned in the content lookup, until they have downloaded the new version into the cache in its entirety.

BranchCache clients will simply download the changes to the content at the block level. So again, BranchCache can be used to facilitate the efficient updating of content which can then be used by Peer Cache.

Verdict

To get the most out of the technologies, enable both Branch Cache and Peer Cache. Both Method work great together and both technologies can fill the gaps of the other one.

BranchCache is for all clients on and Peer Cache is enabled on carefully selected clients (within their own collection that custom client settings can be used to enable Peer Cache on them). Try to ensure then, that your Peer Cache sources have enough disk space, and are powered on when available.