I can see there was a feature request for Windows 11 Upgrade that is marked as complete, but I can’t find the relevant task to run within Immy.
Can someone please advise which task to run for WIndows 11 upgrade, or is this feature still in development?
Use the Target Feature Version to set your version to Windows 11, and then use the windows update task to make it happen. These two tasks are being combined (by me) and should be released this month.
Hi I don’t see the Target Feature Version option in Tasks there is only a Task to Block Windows 11 in my global list is this something I would have to create? can you post some screenshots or link to guide?
Thank You
Hi Winston,
I just had a look myself. You need to use the “Target Windows Feature Version (Block Windows 11)” task and create a deployment so you can edit the parameters. Default parameters are REMOVE which blocks Windows 11. But you can edit this default value when creating a deployment and select Windows 11 as the target:
Just to be clear, REMOVE removes the entries from the registry–that doesn’t necessarily block Windows 11. If you have Windows 10 and set the ProductVersion to Windows 10, Windows 11 will NEVER be offered or install over Windows 10 (for example).
@Gav has recently updated the notes on the task with link references for further understanding of how this Microsoft implemented feature works–on the Immy side, the script is simply setting 3 Windows Registry entries based on the parameters chosen.
@DimitriRodis I’ve used these steps and the deployment shows as compliant, but when I run the Windows Update deployment Im not seeing any action. Am I missing something?
Here is the output logs:
Windows Update PolicyState: HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\PolicyState
These values are present due to policies that are defined elsewhere, such as an MDM, Windows
Update for Business (WufB), Windows Target Feature Update settings, or other registry
locations, such as:
HKLM:\SOFTWARE\Microsoft\WindowsUpdate\ux\Settings
HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\update
The following values are present in the registry which will affect update applicability.
The following values cannot be directly set, as they represent a resulting set of policies.
PolicyState DefaultValue CurrentValue
FeatureUpdatesDeferralInDays (NOT PRESENT) 0
PolicySources (NOT PRESENT) 2
QualityUpdatesDeferralInDays (NOT PRESENT) 0
TargetProductVersion (NOT PRESENT) Windows 11
TargetReleaseVersion (NOT PRESENT) 24H2
Excluded Updates (7):
Title Category Severity KB CVEIDs DaysOld IsHidden
Saitek - Input - Saitek Gamers’ Keyboard Hot Keys (HID) Drivers 2328 True
Saitek - Input - Saitek Gamers’ Keyboard Command Pad (HID) Drivers 2327 True
Saitek - Input - Saitek Gamers’ Keyboard Hot Keys (HID) Drivers 2325 True
Saitek - Input - Saitek Gamers’ Keyboard (USB) Drivers 2324 True
Saitek - Input - Saitek Gamers’ Keyboard Hot Keys (HID) Drivers 2319 True
Saitek - Input - Saitek Gamers’ Keyboard Command Pad (USB) Drivers 2318 True
Saitek - Input - Saitek Gamers’ Keyboard Hot Keys (USB) Drivers 2318 True
Included Updates (0):
True
There is likely an update blocker. Deploying the target feature update settings will cause Windows Update to offer the update as long as the machine is supported to do so. Does this machine meet the Windows 11 requirements?
Run the Windows 11 Hardware Readiness task in Audit mode.
I am getting the same message as the above user.
I have the Hardware Rediness tool as apart of the deployment and it is coming back as compliant on the hardware side.
Here’s a metascript we’ve been developing internally at our MSP you can use to run in-place upgrade silently.
Any suggested changes or additions are appreciated.
The script will:
1. Download the matching ESD.
2. Expand/export to WIM.
3. Launch setup.exe with /auto upgrade /quiet /noreboot.
4. Reboot when finished (unless $rebootPreference says otherwise).
<#
.SYNOPSIS
Searches the OSD Cloud catalog for the specified Windows build, downloads the ESD,
converts it to an installable WIM, and (optionally) performs an in-place upgrade.
.DESCRIPTION
• Looks up a Windows build that matches the desired **major version**, **Release ID**
(a.k.a. “23H2”, “24H2”, etc.), language, and **retail** activation channel in the
OSD Cloud JSON catalog.
• Pulls the ESD, verifies its SHA-1, extracts the required indexes, and stages the
files under **C:\x64** and **C:\temp\OSD**.
• Performs a barrage of pre-flight sanity checks: free-space ≥ 30 GB, battery ≥ 25 %,
and “don’t-even-think-about-it” release-ID comparison so you don’t downgrade by
accident.
• Supports two execution paths:
**test** – read-only checks; no file downloads or installs.
**set** – the real deal: download, expand, run *setup.exe* silently, handle
reboots, rollbacks, and success/failure flags in **C:\!msp**.
• Built to be called inside ImmyBot metascripts with **Invoke-ImmyCommand** so the
job survives reboots.
.PARAMETER searchVersion
*Mandatory.*
The marketing name of the Windows family to target (e.g. **"Windows 11"**, **"Windows 10"**).
Wildcards are accepted.
.PARAMETER searchReleaseId
*Mandatory.*
The Release ID / “half” (e.g. **"22H2"**, **"24H2"**). Wildcards accepted, case-insensitive.
.PARAMETER searchLanguage
ISO language-culture code for the desired media (default **"en-us"**).
Accepts wildcards; “zh-*” would grab any Chinese build, for example.
.INPUTS
None. Parameters are passed directly.
.OUTPUTS
• Descriptive progress to the host.
• **C:\!msp\start.txt** and **success.txt** sentinel files (for automation logic).
• Throws on fatal errors so ImmyBot can trap and report them.
.EXAMPLE
# Dry-run sanity check – will only echo findings and exit.
PS C:\> $method = 'test'
PS C:\> .\Invoke-WinUpgrade.ps1 -searchVersion 'Windows 11' -searchReleaseId 24H2
.EXAMPLE
# Full silent upgrade to Windows 11 24H2 English-US retail media.
PS C:\> $method = 'set'
PS C:\> .\Invoke-WinUpgrade.ps1 -searchVersion 'Windows 11' -searchReleaseId 24H2
The script will:
1. Download the matching ESD.
2. Expand/export to WIM.
3. Launch **setup.exe** with `/auto upgrade /quiet /noreboot`.
4. Reboot when finished (unless `$rebootPreference` says otherwise).
.NOTES
Author: Braintek
Contributors: Jonathan Jeude, David Foster, Matt Herring
Side-Effects: Creates and/or deletes: **C:\x64**, **C:\temp\OSD**, **C:\!msp**
Execution Mode: Designed to be run inside ImmyBot metascripts with session persistence.
.LINK
OSD Cloud catalog — https://raw.githubusercontent.com/OSDeploy/OSD/master/Catalogs/CloudOperatingSystems.json
#>
param (
[Parameter(Mandatory = $true, HelpMessage = "Desired Major Windows version. (example: Windwos 10)")]
[String]$searchVersion = 'Windows 11',
[Parameter(Mandatory = $true, HelpMessage = "Desired version Release ID. (example: 22h2)")]
[string]$searchReleaseId = '24h2',
[Parameter(HelpMessage = "ISO language code (example: en-us)")]
[string]$searchLanguage = 'en-us'
)
#No touchy parameters - not user defined
$url = 'https://raw.githubusercontent.com/OSDeploy/OSD/master/Catalogs/CloudOperatingSystems.json'
$ApplyPath = 'C:\x64'
$osdPath = 'C:\temp\OSD\'
$successFilePath = "C:\!msp\success.txt"
$startFilePath = "C:\!msp\start.txt"
#$ImagePath = "C:\temp\OSD\$osdfile"
#$method = "test"
#ImageURL retrieved elsewhere
$batterypercent = "25"
$searchActivation = "retail"
$jsonContent = Invoke-RestMethod -Uri $url
#Get URL from json for selected parameters
$matchingOS = $jsonContent | Where-Object {
$_.Version -like "*$searchVersion*" -and
$_.ReleaseID -like "*$searchReleaseId*" -and
$_.Language -like "*$searchLanguage*" -and
$_.Activation -like "*$searchActivation*"
}
if ($matchingOS) {
$IMAGEURL = $matchingOS.Url
$filename = $matchingOS.Filename
$newreleaseID = $matchingOS.Build
$imageHash = $matchingOS.SHA1
$ImagePath = "C:\temp\OSD\$filename"
Write-Host "Found build $newreleaseID"
Write-Host "Matching URL found: $IMAGEURL"
Write-Host "ImagePath set to: $ImagePath"
}
else {
Write-Host "No matching URL found for the specified criteria."
exit
}
$checkSuccess = {
$VerbosePreference = 'Continue'
$ErrorActionPreference = 'Stop'
Write-Host $using:searchversion $using:searchReleaseId
# Retrieve the $releaseID from the registry
$releaseID = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name 'CurrentBuildNumber').CurrentBuildNumber
$newreleaseID = $using:newreleaseID -replace '\..*$', ''
#Write-Host "Truncated ReleaseID" $newreleaseID
# Check if the retrieved Release ID is equal to or greater than the search Release ID
# $releaseID is current Release ID
# $newreleaseID is desired Release ID
if ($releaseID -ge $newreleaseID) {
Write-Host "Current Windows build $releaseID matches or is newer than the requested upgrade $newreleaseID. Terminating process"
if (Test-Path $using:successFilePath) {
Remove-Item $using:successFilePath -Force
}
if (Test-Path $using:startFilePath) {
Remove-Item $using:startFilePath -Force
}
if (Test-Path $using:osdPath) {
Remove-Item $using:osdPath -Force
}
if (Test-Path $using:ApplyPath) {
Remove-Item $using:ApplyPath -Force
}
return $true
}
else {
Write-Host "$SearchVersion $newreleaseID is the requested upgrade. Current is $releaseID."
#not correct version, see if start and success txt exist
# Initialize variables to track file existence
$successfile = $false
$startfile = $false
if (Test-Path $using:successFilePath) {
$successfile = true
}
if (Test-Path $using:startFilePath) {
$startfile = true
}
# Determine the state based on the existence of start.txt and success.txt
if ($startfile -and -not $successfile) {
# If only start.txt exists
Write-Host "Start file exists, success file does not exist. Indicates failure during upgrade process."
}
elseif (-not $startfile -and $successfile) {
#If only success.txt exists
Write-Host "Files indicate success but version incorrect. Indicates rollback."
}
else {
# If neither file exists proceed
}
return $false
}
}
#Pre-checks
$preCheck = {
$minFreeSpace = 30GB
$freeSpace = (Get-PSDrive C).Free
# Check if the free space is greater than or equal to the minimum required
if ($freeSpace -lt $minFreeSpace) {
Write-Error "C drive has less than $minFreeSpace remaining. Aborting. "
exit 1
}
# else {
# Write-Host "$freespace available, more than required $minFreeSpace"
# }
}
#Scriptblock creates osd temp folder
$osdFolder = {
if (-Not (Test-Path $using:osdPath)) {
Write-Host "Created OSD temp folder"
try {
New-Item -Path $using:osdPath -ItemType Directory -Force | Out-Null
}
catch {
Write-Host "Error creating 'C:\temp\OSD\"
}
}
else {
Write-Host "OSD temp folder already exists. removing"
try {
Remove-Item -Path $using:osdPath -Recurse -Force
}
catch {
Write-Host "Failed to delete C:\temp\OSD\. - aborting. "
exit 1
}
}
$applyPathExists = Test-Path $using:ApplyPath
Write-Host "Testing if $using:ApplyPath exists: $applyPathExists"
if (-Not $applyPathExists) {
New-Item -Path $using:ApplyPath -ItemType Directory -Force | Out-Null
Write-Host "Created $using:ApplyPath"
}
else {
Write-Host "$using:ApplyPath already exists. Removing"
try {
Remove-Item -Path $using:ApplyPath -Recurse -Force
Write-Host "Deleted $using:ApplyPath."
New-Item -Path $using:ApplyPath -ItemType Directory -Force | Out-Null
Write-Host "Created $using:ApplyPath."
}
catch {
Write-Host "Failed to delete $using:ApplyPath - aborting. "
exit 1
}
}
}
#scriptblock expands and exports image
$expandexport = {
try {
Write-Host "Unpacking Windows ESD to ImagePath for installation"
Expand-WindowsImage -ImagePath $using:ImagePath -Index 1 -ApplyPath $using:ApplyPath
}
catch {
Write-Host "Error occurred during Expand-WindowsImage: $_"
}
Write-Host "Unpacking Windows Pro Index to Sources.WIM"
try {
$destinationPath = "$Using:ApplyPath\Sources\Install.wim"
Write-Host "Exporting $using:ImagePath to $destinationPath"
Export-WindowsImage -SourceImagePath $using:ImagePath -SourceIndex 9 -DestinationImagePath $destinationPath -DestinationName 'Windows 11 Pro' -CompressionType max
Write-Host "Image extracted and ready for Installation, proceeding to next step"
}
catch {
Write-Host "Error occurred during Export-WindowsImage: $_"
$errorException = $Error[0]
Write-Output "!!!Error: $($errorException.Exception.Message)"
Write-Output "!!!StackTrace: $($errorException.ScriptStackTrace)"
}
}
# Export-WindowsImage -SourceImagePath $using:ImagePath -SourceIndex 9 -DestinationImagePath $Using:ApplyPath"\Sources\Install.wim" -DestinationName 'Windows 11 Pro' -CompressionType max
#Scriptblock checks for running setup processes
$CheckSetupProcess = {
$VerbosePreference = 'Continue'
Write-Host "Checking for running Setup processes"
$SetupProcesses = "Setup.exe", "SetupHost.exe", "setupprep.exe"
while ($true) {
$running = $SetupProcesses | ForEach-Object {
Get-Process -Name $_ -ErrorAction SilentlyContinue
} | Measure-Object
if ($running.Count -gt 0) {
Write-Host "Setup still running, please wait"
Start-Sleep 3
}
else {
Write-Host "No Setup processes are running."
break
}
}
}
#Scriptblock to do the upgade
$doUpgrade = {
$VerbosePreference = 'Continue'
$ErrorActionPreference = 'Stop'
try {
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Setup Files" /v "StateFlags1337" /t REG_DWORD /d 2 /f
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Previous Installations" /v "StateFlags1337" /t REG_DWORD /d 2 /f
cleanmgr.exe -sagerun:1337
}
catch {
Write-Error "Error creating registry for 1337 or running cleanmgr: $_"
}
$startFilePath = $using:startFilePath
# Ensure the directory exists before attempting to create the file
If (-Not (Test-Path "C:\!msp")) {
New-Item -Path "C:\!msp" -ItemType Directory -Force | Out-Null
}
# Create the success.txt file
"Setup processes have completed successfully." | Out-File -FilePath $startFilePath
Write-Host "File start.txt created in C:\!msp"
Write-Host "Proceeding with install"
$installpath = @("C:\x64\setup.exe", "C:\x64\sources\install.wim")
$result = $installpath | ForEach-Object { Test-Path $_ }
If ($result -contains $false) {
Write-Warning "Install Files Missing, cannot proceed"
}
else {
if (Test-Path $using:osdPath) {
Remove-Item $using:osdPath -Recurse -Force -ErrorAction Stop
}
Write-Host "Starting Upgrade. This will take some time... Do not power off your computer..."
$job = Start-Job -ScriptBlock {
Start-Process -FilePath "C:\x64\setup.exe" -Wait -ArgumentList "/auto upgrade /dynamicupdate disable /showoobe None /Telemetry Enable /compactos enable /compat ignorewarning /EULA accept /quiet /noreboot"
}
start-sleep 15
$totaltimes = 100
do {
$i = (Get-ItemProperty -Path HKLM:\SYSTEM\Setup\MoSetup\Volatile -ErrorAction SilentlyContinue).SetupProgress
$percentcomplete = ($i / $totaltimes) * 100
Write-Progress -Activity 'Upgrade Windows' -Status "Windows Upgrade Progress $i %" -PercentComplete $percentcomplete
Start-Sleep -Seconds 1
} while ($i -ne $totaltimes)
Wait-Job $job
$jobResult = Receive-Job $job
if ($null -ne $jobResult) {
Write-Host "Setup.exe job completed with output: $jobResult"
return $jobResult
}
if ($i = 100) {
# After confirming no setup processes are running, create success.txt file
$successFilePath = $using:successFilePath
# Ensure the directory exists before attempting to create the file
If (-Not (Test-Path "C:\!msp")) {
New-Item -Path "C:\!msp" -ItemType Directory -Force | Out-Null
}
# Create the success.txt file
"Setup processes have completed successfully." | Out-File -FilePath $successFilePath
Write-Host "File success.txt created in C:\!msp"
Remove-Item -path $startFilePath
}
}
}
switch ($method) {
"test" {
try {
& Invoke-ImmyCommand -ScriptBlock $checkSuccess -ArgumentList $startFilePath, $successFilePath, $osdPath, $ApplyPath
}
catch {
Write-Error "$_"
}
}
"set" {
try {
#try Reboot before running upgrade
if ($rebootPreference -ieq "suppress") {
Write-Host "Ending session, reboot preference is set to $rebootPreference"
exit 1
}
else {
Restart-ComputerAndWait -TimeoutDuration 3600 #1 hour
Start-Sleep 45
}
}
catch {
#catch error rebooting
Write-Host $_
exit 1
}
#Run scriptblock to calculate if system has 30gb of free space and minimum battery %
try {
Stop-SessionOnBatteryStatus -MinimumBatteryLevelPercentage $batterypercent -NotPluggedIn
Invoke-ImmyCommand -ScriptBlock $preCheck -ArgumentList $startFilePath, $successFilePath
}
catch {
Write-Error "Error calculating free space: $_"
Exit 1
}
# Run scriptblock $osdFolder to create folders on machine
try {
Invoke-ImmyCommand -Scriptblock $osdFolder -ArgumentList $ApplyPath
}
catch {
Write-Host $_
exit 1
}
# Download ESD
try {
Download-File -Source $IMAGEURL -Destination $ImagePath -HashAlgorithm SHA1 -ExpectedHash $imageHash
Write-Host "ESD download completed. Unpacking Windows ESD to ImagePath for installation."
}
catch {
Write-Error "Error downloading ESD: $_"
exit 1
}
# Expand and export image
try {
Invoke-ImmyCommand -ScriptBlock $expandexport -ArgumentList ImagePath, ApplyPath -Timeout 10800
Write-Host "Image expansion and export completed."
}
catch {
Write-Error "Error expanding and exporting image: $_"
exit 1
}
# Run upgrade
try {
#try upgrade block
Write-Host "Upgrade process initiated."
Invoke-ImmyCommand -ScriptBlock $doUpgrade -ArgumentList $startFilePath, $successFilePath -Timeout 14400 #4 hours
}
catch {
#catch upgrade block
Write-Error "error while running upgrade. Refer to C:\!msp\upgradefailure.xml "
Invoke-ImmyCommand -Scriptblock {
C:\$WINDOWS.~BT\sources\setupdiag.exe /output:C:\!msp\upgradefailure.xml /format:xml
exit 1
}
}
try {
Write-Host "Upgrade script completed, rebooting (if not suppressed)."
if ($rebootPreference -ieq "suppress") {
Write-Host "Ending session, reboot preference is set to $rebootPreference"
exit 1
}
else {
$testpath = { Test-Path $using:successFilePath }
# Check if success.txt exists
if (Invoke-ImmyCommand -scriptblock $testpath -ArgumentList $startFilePath, $successFilePath) {
Restart-ComputerAndWait -TimeoutDuration 16200 #4.5 hours
Start-Sleep 300
}
else {
Write-Host "${$using:startFilePath} not found. Aborting."
exit 1
}
}
}
catch {
Write-Error "Error during upgrade process: $_"
exit 1
}
try {
Invoke-ImmyCommand -scriptblock $CheckSetupProcess -ArgumentList $startFilePath, $successFilePath -Timeout 10800
}
catch {
Write-Error "$_"
}
}
}Here is my WUA11 2.1 script.
It checks for 64GB free disk space (I’ve seen Windows fail for disk all the way up to 63.9GB)
8GB RAM
It downloads the Windows Upgrade Assistant, and then installs silently doing a reboot (it prompts about 1 min, so don’t run this during the day against people)
It will stream the Panther Setup log which has some great information in it when you do have failures.
After it finishes the upgrade (or attempt)
it will then reboot (if you see a successfull Win11 upgrade, the WUA11 will reboot you, then Immy will also reboot you)
It will then pull the Panther setup error log, I usually use the error log and then go see what was happening around the error for better context of whats going on.
It will then install the Powershell module by AdamGrossTX (github) “FU.WhyAmiBlocked” and then run the module commands to pull why you are being blocked.
As a note, the good data comes from the SDB files, which you will need python 3.8 installed on the machine to deflate the compressed SDB file.
It Should, if it has a valid decompressed and parsable XML file, should then spit out all the BlockTypes that are preventing you from upgrading. You should carefully review these.
It should also, let you know the root cause of the block,
If there is a manual registry Block Override key to utilize,
Then spit out a reg and ps1 file for you to utilize to implement the BlockOverrides.
I will NOT provide any warranty on using a block override. You should ideally FIX the cause.
I’m in the MSPGeekChat all the time, and have shared this there as well. And will be working on updates to it when I can.
switch($method){
"set" {
Write-Host "Checking to see if we have the minimum requirements of RAM."
$totalMemoryGB=Invoke-ImmyCommand {
$computerSystem = Get-WmiObject -Class Win32_ComputerSystem
return [Math]::Round($computerSystem.TotalPhysicalMemory / (1GB))
}
Write-Output "Total System Memory: $totalMemoryGB GB"
if ($totalMemoryGB -lt 8) {
Write-Error -Message "System memory $($totalMemoryGB) is less than 8GB." -ErrorAction Stop
} else {
Write-Output "System memory is sufficient (8GB or more)."
}
Write-Host "Goign to Check for Disk space, Need at least 64GB free to be able to upgrade."
$freespacegb=Invoke-ImmyCommand{
$drive = Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Root -eq 'C:\'}
return [math]::Round($drive.Free / 1GB, 2)
}
if ($freeSpaceGB -ge 64) {
Write-Host "C: drive has $($freeSpaceGB) GB free, which is more than 64GB."
} else {
Write-Error -Message "Houston, we have a problem. Not enough Diskspace: $($freeSpaceGB) GB < 64GB" -ErrorAction Stop
}
Restart-ComputerAndWait
$uri = "https://go.microsoft.com/fwlink/?linkid=2171764"
$downloaduri = Get-RedirectedUri $uri
$upgradeAssistant = "C:\Windows\Temp\Win11Upgrade\UpgradeAssistant.exe"
Download-File -Source $downloaduri -Destination $upgradeAssistant -Force
$logFile = 'C:\`$WINDOWS.~BT\Sources\Panther\setupact.log'
$logFolder='C:\Win11UpgradeLogs'
Write-Host "Checking to see if `$Windows.~BT folder exists, and if so, remove it for clean run results."
Invoke-ImmyCommand {
$logFile = 'C:\$WINDOWS.~BT\Sources\Panther\setupact.log'
$WindowsBT='C:\$WINDOWS.~BT\'
if (Test-Path -Path $logFile) {
Write-Host "Panther setupact file already exists."
Write-Host "Removing $($WindowsBT) folder recursively prior to WUA launch."
Remove-Item -Path $WindowsBT -Recurse -Force
}
$FUPath='C:\FeatureUpdateBlocks'
Get-ChildItem -Path $FUPath -Directory | ForEach-Object {
Remove-Item -Path $_.FullName -Recurse -Force
Write-Host "Deleted FU Log directory, we want a clean log run each Immy run: $($_.FullName)"
}
}
Start-ProcessWithLogTail -Path $upgradeAssistant -ArgumentList "/quietinstall /skipeula /auto upgrade /NoRestartUI /copylogs $LogFolder" -LogFilePath $logFile -Timeout 14400
Restart-ComputerAndWait
Invoke-ImmyCommand -Timeout 14400 {
$currentbuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
if($currentbuild -lt 22000) {
$logPath = 'C:\$WINDOWS.~BT\Sources\Panther\setupact.log'
$errLogPath = 'C:\$WINDOWS.~BT\Sources\Panther\setuperr.log'
Write-Host "Checking for file $errLogPath`n"
if (Test-Path $errLogPath) {
Set-ExecutionPolicy Unrestricted -force
$errLogFileContent = Get-Content -Path $errLogPath -Force
Write-Host "$errLogPath found. Log contents:`n"
#Write-Host "$errLogFileContent`n"
Get-Content $errLogPath
#Sometimes Dell and Windows do not see eye to eye on BIOS updates, so let's check hidden Windows updates.
Install-Module -Name -Force
if (-not (Get-Module -ListAvailable -Name "PSWindowsUpdate")) {
Write-Host "Module 'PSWindowsUpdate' not found. Installing from PowerShell Gallery..."
Install-Module -Name "PSWindowsUpdate" -Force -Scope AllUsers -AllowClobber
Import-module -Name "PSWindowsUpdate"
} else { Import-module -Name "PSWindowsUpdate"}
Get-Windowsupdate -WithHidden
#Let's See Why we are blocked with this lovley little Powershell module by AdamGrossTX
#https://www.powershellgallery.com/packages/FU.WhyAmIBlocked/1.0.0.9
#https://github.com/AdamGrossTX/FU.WhyAmIBlocked
# Check if the module "FU.WhyAmIBlocked" is installed
#but before we do that, we need to ensure that NuGet is installed, at at the minimimum version from my testing, 3.0.0.1
try {
# Check if NuGet provider is installed and its version
$nugetProvider = Get-PackageProvider -Name NuGet -ErrorAction SilentlyContinue
if ($nugetProvider -eq $null -or $nugetProvider.Version -lt [Version]"3.0.0.1") {
Write-Host "NuGet provider is not installed or the version is less than 3.0.0.1. Installing NuGet provider..."
Install-PackageProvider -Name NuGet -MinimumVersion 3.0.0.1 -Force -Confirm:$False
Write-Host "NuGet provider installed successfully."
} else {
Write-Host "NuGet provider is already installed and meets the minimum version requirement."
}
} catch {
Write-Error "Failed to install NuGet provider: $_.Exception.Message"
exit 1
}
if (-not (Get-Module -ListAvailable -Name "FU.WhyAmIBlocked")) {
Write-Host "Module 'FU.WhyAmIBlocked' not found. Installing from PowerShell Gallery..."
Install-Module -Name "FU.WhyAmIBlocked" -Force -Scope AllUsers -AllowClobber
Import-module -Name "FU.WhyAmIBlocked"
Initialize-FUModule
}
# Import the module
Import-Module "FU.WhyAmIBlocked"
Write-Host "We are going to need python for this so, please make sure you have python deployed for machines being upgraded via WUA so we can see what the issue is."
# Lets now run the FU Why Am I Blocked powershell against the Panther install logs
#We also need to put the Pythong file SDBUnpacker useses.
$myDownloadUrl="https://raw.githubusercontent.com/TheEragon/SdbUnpacker/refs/heads/master/SdbUnpacker.py"
Invoke-WebRequest $myDownloadUrl -OutFile 'C:\Program Files\WindowsPowerShell\Modules\FU.WhyAmIBlocked\1.0.0.9\SdbUnpacker.py'
Get-FUBlocks -ProcessPantherLogs
$FUBlocksContent='C:\FeatureUpdateBlocks\*\Results.txt'
Write-Host "Please review the FU Blocks Content"
Write-host "It is recommend to correct the root cause vs using a Block."
Get-Content $FUBlocksContent
Write-Host "We will now go ahead and generate the reg keys to import to enable block overrides"
$BOPath="C:\BlockOverRide"
if (-Not (Test-Path -Path $BOPath)) {
New-Item -ItemType Directory -Path $BOPath
}
Export-FUBypassBlock -Path $BOPath
Write-Host "Please review the registry files in $($BOPath)"
Write-Host "Please note, we are not responsibile for any damages caused by using a block override."
}else {
Write-Host "$errLogPath not found`n"
}
}else{
Write-Host "It appears we have upgraded, version build shows as $($CurrentBuild) is > 22000"
}
}
}
"test" {
#Returns true or false if the Current Build should be upgraded, or has upgraded.
$CurrentBuild=Invoke-ImmyCommand {
$currentbuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
if($currentbuild -lt 22000) {
return $false
}else {
return $true
}
}
return $CurrentBuild
}
"get" {
$CurrentBuildNumber=Invoke-ImmyCommand {
$CurrentBuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
return $currentBuild
}
return $CurrentBuildNumber
}
}
Like Dimitri said, something is most likely blocking the update.
I ran into this issue with one specific client, and it was that their Intune policies were enforcing Windows 10 builds.
I would recommend checking any GPOs or intune policies on this, or:
The way I’ve been running it is by creating a windows 11 migration tag, then making deployments for a disk cleanup then another one that runs WUA 11 in the background. As long as the workstation has enough disk space, and its Windows 11 ready, it works.
The machine I am currently testing with was freshly wiped and related with Windows 10. I installed the Immy Bot agent and then ran the onboarding - which currently just consists of running the Upgrade option to set Windows 11 and 24H2 as the version to go to.
Then I have a task in place to run windows update. No Intune or GPOs on this test machine.
The task that sets the Win11 version puts those couple registry keys in place. If I go delete those the Update task will run (it won’t throw that message about being under management). After deleting those registry keys, I can run the hardware validation tool as well. That won’t run with the registry keys in place.
Not working for me, I have run both scripts and nothing is happening.
@ DimitriRodis did you get that combined task working?
I do-----I have a co-managed client that has been using it ad-hoc to upgrade one machine at a time and it’s been working fine. With respect to putting it up in global, there are two issues:
The Windows 10 → 11 upgrade works far more successfully with modifications I’ve made to the pre-flight script in my instance that watches for certain Windows Update processes that fire up during boot when there’s a major update, and waits for them to complete–and that improved the success rate of the upgrade very substantially. The unexpected side effect is that I have found machines that have these processes running that are indefinitely hung–so when TrustedInstaller.exe and TiWorker.exe decide to just “sit there,” you can no longer run sessions on those endpoints. I’m investigating some way to try and determine if that set of processes are actually doing any work vs being hung, and act accordingly. If you terminate them while they are actually installing updates, “bad things can happen”
There are issues with the task migration mechanism in Immy currently, and with RBAC coming, this hasn’t gotten any dev attention. It’s not a showstopper—but we want to use that feature to help folks migrate to the new version of the Windows Update task that will automagically bring over all of the parameters from it that you’ve all defined. Otherwise it’s potentially quite time consuming and tedious to do by hand.
What are you using for one at the time?
Here is my latest WUA 11 script.
It includes if fails a run of the FU.WhyAmIBlocked Powershell
You do need Python installed prior if you want it to decompress the SDB file to pull from it. This is where most blocks are going to be found.
It will if a block is found provide Registry key and PS1 files to implement the BlockOverride.
switch($method){
"set" {
Write-Host "Checking to see if we have the minimum requirements of RAM."
$totalMemoryGB=Invoke-ImmyCommand {
$computerSystem = Get-WmiObject -Class Win32_ComputerSystem
return [Math]::Round($computerSystem.TotalPhysicalMemory / (1GB))
}
Write-Output "Total System Memory: $totalMemoryGB GB"
if ($totalMemoryGB -lt 8) {
Write-Error -Message "System memory $($totalMemoryGB) is less than 8GB." -ErrorAction Stop
} else {
Write-Output "System memory is sufficient (8GB or more)."
}
Write-Host "Going to Check for Disk space, Need at least 64GB free to be able to upgrade."
$freespacegb=Invoke-ImmyCommand{
$drive = Get-PSDrive -PSProvider FileSystem | Where-Object {$_.Root -eq 'C:\'}
return [math]::Round($drive.Free / 1GB, 2)
}
if ($freeSpaceGB -ge 64) {
Write-Host "C: drive has $($freeSpaceGB) GB free, which is more than 64GB."
} else {
Write-Error -Message "Houston, we have a problem. Not enough Diskspace: $($freeSpaceGB) GB < 64GB" -ErrorAction Stop
}
$SecureBootCheck=Invoke-ImmyCommand { return Confirm-SecureBootUEFI }
if(!$SecureBootCheck){
Write-Error "SecureBoot Not Enabled."
}else { Write-Host "System has SecureBoot enabled."}
Restart-ComputerAndWait
$uri = "https://go.microsoft.com/fwlink/?linkid=2171764"
$downloaduri = Get-RedirectedUri $uri
$upgradeAssistant = "C:\Windows\Temp\Win11Upgrade\UpgradeAssistant.exe"
Download-File -Source $downloaduri -Destination $upgradeAssistant -Force
$logFile = 'C:\`$WINDOWS.~BT\Sources\Panther\setupact.log'
$logFolder='C:\Win11UpgradeLogs'
Write-Host "Checking to see if `$Windows.~BT folder exists, and if so, remove it for clean run results."
Invoke-ImmyCommand -Timeout 14000 {
$logFile = 'C:\$WINDOWS.~BT\Sources\Panther\setupact.log'
$WindowsBT='C:\$WINDOWS.~BT\'
if (Test-Path -Path $logFile) {
#Take ownership of existing Panther file
#updated provided by CCP_Jason
takeown /f $WindowsBT /r /d y > nul
Write-Host "Ownership of '$folderPath' and its contents has been taken by System."
Write-Host "Panther setupact file already exists."
Write-Host "Removing $($WindowsBT) folder recursively prior to WUA launch."
Remove-Item -Path $WindowsBT -Recurse -Force
}
$FUPath='C:\FeatureUpdateBlocks'
Get-ChildItem -Path $FUPath -Directory | ForEach-Object {
Remove-Item -Path $_.FullName -Recurse -Force
Write-Host "Deleted FU Log directory, we want a clean log run each Immy run: $($_.FullName)"
}
}
Write-Host "Starting Windows 11 Upgrade Assistant. Can't stream the setup log as it kills Immy. We wil get the contents after Windows 11 update completes before we reboot."
Invoke-ImmyCommand -timeout 14400 {
$upgradeAssistant = $using:UpgradeAssistant
Start-Process $upgradeAssistant -ArgumentList "/quietinstall /skipeula /auto upgrade /NoRestartUI /SkipCompatCheck /dynamicupdate disable /PreventWUUpgrade /SkipSelfUpdate /priority normal /copylogs $LogFolder" -Wait
}
Invoke-ImmyCommand {
$LogFile=$using:logfile
Get-Content $LogFile
}
Restart-ComputerAndWait
Invoke-ImmyCommand -Timeout 14400 {
$currentbuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
if($currentbuild -lt 22000) {
$logPath = 'C:\$WINDOWS.~BT\Sources\Panther\setupact.log'
$errLogPath = 'C:\$WINDOWS.~BT\Sources\Panther\setuperr.log'
Write-Host "Checking for file $errLogPath`n"
if (Test-Path $errLogPath) {
Set-ExecutionPolicy Unrestricted -force -Confirm:$false
$errLogFileContent = Get-Content -Path $errLogPath -Force
Write-Host "$errLogPath found. Log contents:`n"
#Write-Host "$errLogFileContent`n"
Get-Content $errLogPath
#Sometimes Dell and Windows do not see eye to eye on BIOS updates, so let's check hidden Windows updates.
if (-not (Get-Module -ListAvailable -Name "PSWindowsUpdate")) {
Write-Host "Module 'PSWindowsUpdate' not found. Installing from PowerShell Gallery..."
Install-Module -Name "PSWindowsUpdate" -Force -Scope AllUsers -AllowClobber -confirm:$false
Write-Host "Module installed, now let."
}
Write-Host "Importing Windows update Module"
Import-module -Name "PSWindowsUpdate"
Write-Host "Now pulling Windows updates with Hidden updates"
Get-Windowsupdate -WithHidden -NotTitle "Windows 11" -Verbose
if((Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse | Get-ItemProperty -Name 'Version' -ErrorAction SilentlyContinue | ForEach-Object {$_.Version -as [System.Version]} | Where-Object {$_.Major -eq 3 -and $_.Minor -eq 5}).Count -ge 1){
Write-Host ".Net FX 35 installed, good"
}else {
Write-Host "Installing .Net 3.5, required to unpack SDB files"
DISM /Online /Enable-Feature /FeatureName:NetFx3 /All
}
#Let's See Why we are blocked with this lovley little Powershell module by AdamGrossTX
#https://www.powershellgallery.com/packages/FU.WhyAmIBlocked/1.0.0.9
#https://github.com/AdamGrossTX/FU.WhyAmIBlocked
# Check if the module "FU.WhyAmIBlocked" is installed
#but before we do that, we need to ensure that NuGet is installed, at at the minimimum version from my testing, 3.0.0.1
try {
# Check if NuGet provider is installed and its version
$nugetProvider = Get-PackageProvider -Name "NuGet" -ErrorAction SilentlyContinue
if ($nugetProvider -eq $null -or $nugetProvider.Version -lt [Version]"3.0.0.1") {
Write-Host "NuGet provider is not installed or the version is less than 3.0.0.1. Installing NuGet provider..."
Install-Module "PowershellGet" -Force -confirm:$false
Install-PackageProvider -Name "NuGet" -Force -Confirm:$False
Write-Host "NuGet provider installed successfully."
} else {
Write-Host "NuGet provider is already installed and meets the minimum version requirement."
}
} catch {
Write-Error "Failed to install NuGet provider: $_.Exception.Message"
exit 1
}
if (-not (Get-Module -ListAvailable -Name "FU.WhyAmIBlocked")) {
Write-Host "Module 'FU.WhyAmIBlocked' not found. Installing from PowerShell Gallery..."
Install-Module -Name "FU.WhyAmIBlocked" -Force -Scope AllUsers -AllowClobber
Import-module -Name "FU.WhyAmIBlocked"
Initialize-FUModule
} else {
# Import the module
Import-Module "FU.WhyAmIBlocked"
}
Write-Host "We are going to need python for this so, please make sure you have python deployed for machines being upgraded via WUA so we can see what the issue is."
# Lets now run the FU Why Am I Blocked powershell against the Panther install logs
#We also need to put the Pythong file SDBUnpacker useses.
$myDownloadUrl="https://raw.githubusercontent.com/TheEragon/SdbUnpacker/refs/heads/master/SdbUnpacker.py"
Invoke-WebRequest $myDownloadUrl -OutFile 'C:\Program Files\WindowsPowerShell\Modules\FU.WhyAmIBlocked\1.0.0.9\SdbUnpacker.py'
Get-FUBlocks -ProcessPantherLogs
$FUBlocksContent='C:\FeatureUpdateBlocks\*\Results.txt'
Write-Host "Please review the FU Blocks Content"
Write-host "It is recommend to correct the root cause vs using a Block."
Get-Content $FUBlocksContent
Write-Host "We will now go ahead and generate the reg keys to import to enable block overrides"
$BOPath="C:\BlockOverRide"
if (-Not (Test-Path -Path $BOPath)) {
New-Item -ItemType Directory -Path $BOPath
}
Export-FUBypassBlock -Path $BOPath
Write-Host "Please review the registry files in $($BOPath)"
Write-Host "Please note, we are not responsibile for any damages caused by using a block override."
}else {
Write-Host "$errLogPath not found`n"
}
}else{
Write-Host "It appears we have upgraded, version build shows as $($CurrentBuild) is > 22000"
Write-host "Refreshing System Detection Information"
Refresh-ComputerSystemInfo
}
}
}
"test" {
#Returns true or false if the Current Build should be upgraded, or has upgraded.
$CurrentBuild=Invoke-ImmyCommand {
$currentbuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
if($currentbuild -lt 22000) {
return $false
}else {
return $true
}
}
return $CurrentBuild
}
"get" {
$CurrentBuildNumber=Invoke-ImmyCommand {
$CurrentBuild=[int](Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuild
return $currentBuild
}
return $CurrentBuildNumber
}
}
I have had better success pushing from ConnectWise Automate script that pulls down the Windows 11 update assistance tool, immy will show it fines Windows 11 but always times out can never get it to upgrade to Windows 11. The script I run from automate has been successfully many times in a row now.
1, SET: @SoftwarePackageName@ = Windows 11 Upgrade, Exit On Failure, All Operating Systems, 1, Windows 11 Upgrade, @SoftwarePackageName@, , , 20, 0, 0, Variable Set, 0, , ,
2, SET: @SoftwarePath@ = C:\Windows\LTSVC\Software\Microsoft\Win11, Exit On Failure, All Operating Systems, 1, C:\Windows\LTSVC\Software\Microsoft\Win11, @SoftwarePath@, , , 20, 0, 0, Variable Set, 0, , ,
3, SET: @DownloadPath@ = https://go.microsoft.com/fwlink/?linkid=2171764, Exit On Failure, All Operating Systems, 1, https://go.microsoft.com/fwlink/?linkid=2171764, @DownloadPath@, , , 20, 0, 0, Variable Set, 0, , ,
4, SET: @DownloadPath2@ = https://download.microsoft.com/download/5/4/c/54c22b82-d0cd-4e34-9a06-b75823a8aede/Windows11InstallationAssistant.exe, Exit On Failure, All Operating Systems, 1, https://download.microsoft.com/download/5/4/c/54c22b82-d0cd-4e34-9a06-b75823a8aede/Windows11InstallationAssistant.exe, @DownloadPath2@, , , 20, 0, 0, Variable Set, 0, , ,
5, SET: @SoftwareInstFile@ = Windows11InstallationAssistant.exe, Exit On Failure, All Operating Systems, 1, Windows11InstallationAssistant.exe, @SoftwareInstFile@, , , 20, 0, 0, Variable Set, 0, , ,
6, SET: @WinVersion@ = SQLRESULT[SELECT VERSION FROM Computers WHERE ComputerID = %ComputerID%;], Exit On Failure, All Operating Systems, 11, SELECT VERSION FROM Computers WHERE ComputerID = %ComputerID%;, @WinVersion@, , , 20, 0, 0, Variable Set, 0, , ,
7, SET: @TicketCreateSubject@ = @SoftwarePackageName@ - %clientname% \ %computername%, Exit On Failure, All Operating Systems, 1, @SoftwarePackageName@ - %clientname% \ %computername%, @TicketCreateSubject@, , , 20, 0, 0, Variable Set, 0, , ,
8, SET: @TicketCreateBody@ = Installing Software: @SoftwarePackageName@