Windows Deployment

https://learn.microsoft.com/en-us/windows/deployment/
Admin
Windows Deployment provides tools, services, and guidance for deploying, updating, and managing...
Tokens:284,584
Snippets:3,900
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example setupapi.dev.log content

Source: https://learn.microsoft.com/en-us/windows/deployment/upgrade/log-files

Log entries detailing a device driver installation process.

```text
>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
>>>  Section start 2023/09/26 20:13:01.623
      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
     ndv: Install flags: 0x00000000
     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
     ndv:      Search options: 0x00000081
     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
     dvi:      {Build Driver List} 20:13:01.643
     dvi:           Searching for hardware ID(s):
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
     dvi:                pci\ven_8086&dev_8c4f&cc_060100
     dvi:                pci\ven_8086&dev_8c4f&cc_0601
     dvi:           Searching for compatible ID(s):
     dvi:                pci\ven_8086&dev_8c4f&rev_04
     dvi:                pci\ven_8086&dev_8c4f
     dvi:                pci\ven_8086&cc_060100
     dvi:                pci\ven_8086&cc_0601
     dvi:                pci\ven_8086
     dvi:                pci\cc_060100
     dvi:                pci\cc_0601
     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
     sig:                Key      = lynxpointsystem.inf
     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
     sig:                Success: File is signed in catalog.
     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
     dvi:           Created Driver Node:
     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
     dvi:                Section      - Needs_ISAPNP_DRV
     dvi:                Rank         - 0x00ff2001
     dvi:                Signer Score - WHQL
```

--------------------------------

### Example setuperr.log content

Source: https://learn.microsoft.com/en-us/windows/deployment/upgrade/log-files

A sample log output demonstrating error entries during a migration or setup process.

```text
27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Error                  Gather failed. Last error: 0x00000000
27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]
```

--------------------------------

### Configure SetupConfig.ini for Normal Priority

Source: https://learn.microsoft.com/en-us/windows/deployment/update/feature-update-user-install

Create this file to override the default low-priority setup behavior, which can reduce total installation time.

```ini
[SetupConfig]
Priority=Normal
```

--------------------------------

### Get examples for a VAMT cmdlet

Source: https://learn.microsoft.com/en-us/windows/deployment/volume-activation/use-vamt-in-windows-powershell

View practical usage examples for a specific VAMT cmdlet.

```PowerShell
get-help <cmdlet name> -examples
```

```PowerShell
get-help get-VamtProduct -examples
```

--------------------------------

### LoadState Local Account Enablement Example

Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax

Example of using both /lac and /lae to create and enable a local account.

```bash
LoadState.exe  /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore
/progress:Progress.log /l:LoadState.log /lac:password /lae
```

--------------------------------

### Uncompressed Migration Store Example

Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax

Example command to restore data from an uncompressed migration store.

```text
LoadState.exe  /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /nocompress
```

--------------------------------

### LoadState Local Account Creation Example

Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax

Example of using the /lac option to create local accounts on the destination computer.

```bash
LoadState.exe  /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore
```

--------------------------------

### Import TLS Certificate Example

Source: https://learn.microsoft.com/en-us/windows/deployment/do/mcc-ent-https-windows-guide

Example command for importing a certificate using local account credentials.

```PowerShell
  .\importCert.ps1 `
    -mccRunTimeAccount $myLocalAccountCredential.Username `
    -mccLocalAccountCredential $myLocalAccountCredential `
    -certName "myTlsCert.crt"
```

--------------------------------

### Add optional components to boot image via PowerShell

Source: https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image

Use Add-WindowsPackage to install optional components into a mounted boot image. These examples assume a 64-bit architecture.

```PowerShell
Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\<Component>.cab" -Path "<Mount_folder_path>" -Verbose
```

```PowerShell
Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab" -Path "C:\Mount" -Verbose
```

--------------------------------

### Complete Offline.xml example

Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/offline-migration-reference

A full example demonstrating the structure of an Offline.xml file.

```XML
<offline>
     <winDir>
          <path>C:\Windows</path>
          <path>D:\Windows</path>
          <path>E:\</path>
     </winDir>
     <failOnMultipleWinDir>1</failOnMultipleWinDir>
</offline>
```

--------------------------------

### Verify Microsoft File Signature and Install Client Broker

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

This script verifies the digital signature of the MSI installer against Microsoft's root certificate before proceeding with the installation using msiexec.

```powershell
<#
    .SYNOPSIS
        Installs Microsoft Autopatch Client Broker 
    .EXAMPLE
        .\SetupAutopatchClientPackage.ps1
#>
param (
    [switch] $DisableTranscript = $false
)
# Ensures that Invoke-WebRequest uses TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

function VerifyMicrosoftFileSignature {
    <#
        .Synopsis
            Verifies if a file is Microsoft Signed
        .Description
            Checks if a file is signed by a certificate with a microsoft subject and rooted to the microsoft root
        .Parameter
            -FilePath
        .Example
            VerifyMicrosoftFileSignature -FilePath 'C:\temp\temp.cab'
        .Inputs
            string.
        .Outputs
            None.
    #>
    param (
        [parameter(mandatory)] [string] $FilePath
    )

    $signature = Get-AuthenticodeSignature -FilePath $FilePath
    Write-Host 'Digital Signature validity:' $signature.status
    Write-Host 'Signer Certificate subject:' $signature.signerCertificate.subject
    $cert = $signature.SignerCertificate
    $chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain
    $chain.Build($cert)
    $rootCertSubject = ($chain.ChainElements | Select-Object -Last 1).Certificate.Subject
    Write-Host 'Root Certificate subject:' $rootCertSubject
    Write-Host 'Chain Status:' ($chain.ChainStatus | Format-List)

    if ($chain.ChainStatus) 
    {
        foreach ($chainStatus in $chain.ChainStatus) 
        {
            # We are only okay with chain statuses that are NoError(0) or NotTimeValid(1)
            if (($chainStatus.Status -eq 0) -or ($chainStatus.Status -eq 1)) {
                continue
            }
            else {
                Write-Host 'Chain Not Trusted. Chain Status:' $chainStatus.Status
                throw "Chain Not Trusted. Chain Status: $chainStatus.Status"
            }
        }
    }

    # Check that the signing cert is syntactically valid, has the Microsoft subject, is rooted to the Microsoft root cert, and has no errors in the chain
    if (-not ($signature.status -eq 'valid' -and ($signature.signerCertificate.subject -eq 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' -and ($rootCertSubject -eq 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US')))) {
        Write-Host 'Not signed by Microsoft PRS Cert with Microsoft Root'
        throw "Not signed by Microsoft PRS Cert with Microsoft Root"
    }
}

function InstallAutopatchClientBroker {
    $AutopatchClientBrokerLogPath = "$LogPath\AutopatchClientBrokerInstall" + $stampDate.ToFileTimeUtc() + '.log'
    $AutopatchClientBrokerMsi = "$ExpandedCabDirectory\ClientBroker.msi"
    Write-Host "Validating msi installer"
    try {
        VerifyMicrosoftFileSignature -FilePath $AutopatchClientBrokerMsi
        Write-Host 'ACB MSI is trusted and verified'
    }
    catch {
        Write-Host 'ACB MSI is not trusted. Skipping'
        return
    }

    $MSIInstallArguments = @(
        "/i"
        "$AutopatchClientBrokerMsi"
        "SVCENV=$CabEnvironment"
        "/qb!"
        "/l*v $AutopatchClientBrokerLogPath"
        "/norestart"
        "/quiet"
    )

    try {
        Write-Host 'Installing Autopatch Client Broker'
        $InstallProcess = Start-Process "msiexec.exe" -ArgumentList $MSIInstallArguments -PassThru -Wait -NoNewWindow
        $InstallExitCode = $InstallProcess.ExitCode
        Write-Host "Finished running msi installer for $appName. Exit Code: $InstallExitCode"

        if ($InstallExitCode -ne 0) {
            Write-Host "An
```

--------------------------------

### LoadState Domain Migration Example

Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax

Example of using the /md option to map users from one domain to another during migration.

```bash
LoadState.exe  /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore
/progress:Progress.log /l:LoadState.log /md:contoso:fabrikam
```

--------------------------------

### List Installed Applications

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

Retrieves a list of installed applications from the Windows Registry by querying the Uninstall key.

```powershell
function ListInstalledApps {
    <#  Rename properties to be compatible with Win32_Product
        IdentifyingNumber : {FE737213-9769-415E-AE34-772FF239DBF3}
        Name              : Azure Developer CLI
        Vendor            : Microsoft Corporation
        Version           : 1.3.100
        Caption           : Azure Developer CLI
    #>
    $installedApps = @()
    $installedApps += (
        Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* `
        | Select-Object @{Name='IdentifyingNumber'; Expression='PSChildName'}, @{Name='Name'; Expression='DisplayName'}, @{Name='Version'; Expression='DisplayVersion'}, @{Name='Vendor'; Expression='Publisher'}, InstallDate
    )
  return $installedApps
}
```

--------------------------------

### Manual Windows Autopatch Client Broker Installation Script

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

Use this PowerShell script to manually install the Windows client broker on devices when Win32 App management is unavailable.

```PowerShell
function Cleanup {
    cd $PSScriptRoot
    if (Test-Path $ScriptFolderPath) {
        Write-Host 'Removing script directory'
        Remove-Item -LiteralPath $ScriptFolderPath -Force -Recurse
    }
}

Function Setup {
    # Cleanup scheduled task if it exists
    $oldTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue
    if ($oldTask) {
        if ($oldTask.State -eq 'Running') {
            Stop-ScheduledTask -TaskName $ScheduledTaskName
        }
        Unregister-ScheduledTask -TaskName $ScheduledTaskName -Confirm:$false -ErrorAction SilentlyContinue
    }
    Cleanup
}

$LogPrefix = "\AutopatchClientV2SetupInstallScheduled"
$Timestamp = Get-Date
$LogPath = "$Env:windir\ccm\logs"
$LogFile = $LogPath + $LogPrefix + $Timestamp.ToFileTimeUtc() + ".log"
$ScheduledTaskName = 'Autopatch Client V2 Setup Installer'
$ScriptFolderPath = "$env:SystemDrive\ProgramData\Microsoft\AutopatchSetupScheduled"
$SystemScriptPath = "$ScriptFolderPath\SetupAutopatchClientV2Package.ps1"
$SystemScript = 
```

--------------------------------

### Deployment audience creation response

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls

Example JSON response body returned after successfully creating a deployment audience.

```json
{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deploymentAudiences/$entity",
    "id": "d39ad1ce-0123-4567-89ab-cdef01234567",
    "reportingDeviceCount": 0,
    "applicableContent": []
}
```

--------------------------------

### Applicable content response structure

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls

Example JSON response showing matched devices and catalog entry details for a driver update.

```json
"matchedDevices": [
    {
        "recommendedBy": [
            "Microsoft"
        ],
        "deviceId": "01ea3c90-12f5-4093-a4c9-c1434657c976"
    }
],
"catalogEntry": {
    "@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
    "id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c",
    "displayName": "Microsoft - Test - 1.0.0.1",
    "deployableUntilDateTime": null,
    "releaseDateTime": "0001-01-21T04:18:32Z",
    "description": "Microsoft test driver update released in January 2021",
    "driverClass": "OtherHardware",
    "provider": "Microsoft",
    "setupInformationFile": null,
    "manufacturer": "Microsoft",
    "version": "1.0.0.1",
    "versionDateTime": "2021-01-11T02:43:14Z"
```

--------------------------------

### Deploy Windows Autopatch Client Broker via PowerShell

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

This script initializes the environment, creates a scheduled task for the installation, and monitors the task for completion or failure.

```powershell
if (-not (Test-Path $LogPath)) {
    New-Item -Force -ItemType directory -Path $LogPath
}
Start-Transcript -Path $LogFile

#Cleanup lingering resources from previous runs
Setup

$content = [System.Convert]::FromBase64String($SystemScript)

New-Item -ItemType Directory -Force -Path $ScriptFolderPath
Set-Content -Path $SystemScriptPath -Value $content -Encoding Byte

$Trigger = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddHours(4)) -RepetitionInterval (New-TimeSpan -Hours 4) # Specify the trigger settings
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries
$User = "NT AUTHORITY\SYSTEM"
$Argument = "-ExecutionPolicy Bypass $SystemScriptPath"
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $argument # Specify what program to run andtask with its parameters
Register-ScheduledTask -TaskName $ScheduledTaskName -Trigger $Trigger -User $User -Action $Action -Settings $Settings -RunLevel Highest -Force

$MaxRetries = 10
Start-ScheduledTask -TaskName $ScheduledTaskName
$ScheduledTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue

# Wait for the scheduled task to complete so its log can be read and uploaded
while (-not (($ScheduledTask.State -eq 'Ready') -or ($MaxRetries -eq 0))) {
    Write-Host "Waiting for scheduled task to complete"
    Start-Sleep -Seconds 60
    $MaxRetries--
    $ScheduledTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue
    if (-not $ScheduledTask) {
        # The scheduled task was removed by the install script because it installed clients successfully
        break
    }
}

if (-not $ScheduledTask) {
    # The scheduled task was removed by the install script because it installed clients successfully
    Write-Host "[SUCCESSFUL_AUTOPATCH_CLIENT_SETUP_SCHEDULED]"
    Cleanup
    Stop-Transcript -Verbose
    exit 0
}

if ($MaxRetries -ne 0) {
    # There was some error in attempting to install the clients
    Write-Error "[FAILED_AUTOPATCH_CLIENT_SETUP_SCHEDULED]" -Category NotInstalled
}
else {
    # We timed out on waiting for the task to complete
    Write-Error "[UNKNOWN_AUTOPATCH_CLIENT_SETUP_SCHEDULED]" -Category OperationTimeout
}

# Grab results from most recent log file and add them to the transcript
$InternalScriptPrefix = 'AutopatchClientV2SetupInstallTask'
$LogFound = $false
foreach ($InstallLogFile in (Get-ChildItem $LogPath | Sort-Object LastAccessTime -Descending)) {
    if ($InstallLogFile.Name.StartsWith($InternalScriptPrefix) -and $InstallLogFile.Extension.Equals('.log')) {
        Write-Error "----------[Start] Results from Install Task ----------"
        $FullInstallLogPath = $LogPath + '\' + $InstallLogFile.Name
        $LogContents = Get-Content $FullInstallLogPath -Raw
        Write-Error $LogContents
        Write-Error "----------[End] Results from Install Task ----------"
        $LogFound = $true
        break
    }
}

if (-not $LogFound) {
    Write-Error "[Log Not Found]"
    Get-ChildItem $LogPath | Sort-Object LastAccessTime -Descending
}

Stop-Transcript -Verbose
exit 8
```

--------------------------------

### GET /devices

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls

Retrieves a list of devices with specific fields selected.

```APIDOC
## GET https://graph.microsoft.com/v1.0/devices

### Description
Retrieves device information from Microsoft Entra ID. Use query parameters to filter and select specific device attributes.

### Method
GET

### Endpoint
https://graph.microsoft.com/v1.0/devices

### Parameters
#### Query Parameters
- **$select** (string) - Optional - Comma-separated list of properties to return (e.g., deviceid, displayName).
- **$filter** (string) - Optional - OData filter expression to narrow down results.
- **$search** (string) - Optional - Search expression for advanced queries.
- **$count** (boolean) - Optional - Include the count of items in the response.

### Request Example
GET https://graph.microsoft.com/v1.0/devices?$select=deviceid,displayName
```

--------------------------------

### Example JSON response for catalog entry

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls

A sample response showing the structure of a quality update catalog entry, including the Catalog ID and CVE severity information.

```json
{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries",
    "value": [
        {
            "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
            "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5",
            "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later",
            "deployableUntilDateTime": null,
            "releaseDateTime": "2023-08-08T00:00:00Z",
            "isExpeditable": true,
            "qualityUpdateClassification": "security",
            "catalogName": "2023-08 Cumulative Update for Windows 10 and later",
            "shortName": "2023.08 B",
            "qualityUpdateCadence": "monthly",
            "cveSeverityInformation": {
                "maxSeverity": "critical",
                "maxBaseScore": 9.8,
                "exploitedCves@odata.context": "https://graph.microsoft.com/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/cveSeverityInformation/exploitedCves",
                "exploitedCves": [
                    {
                        "number": "ADV230003",
                        "url": "https://msrc.microsoft.com/update-guide/vulnerability/ADV230003"
                    },
                    {
                        "number": "CVE-2023-38180",
                        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180"
                    }
                ]
            }
        }
    ]
}
```

--------------------------------

### GET /admin/windows/updates/deployments

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls

Retrieves a list of deployments, ordered by creation date.

```APIDOC
## GET /admin/windows/updates/deployments

### Description
Displays all deployments, ordered by the createdDateTime property in descending order.

### Method
GET

### Endpoint
https://graph.microsoft.com/beta/admin/windows/updates/deployments?orderby=createdDateTime desc

### Parameters
#### Query Parameters
- **orderby** (string) - Optional - The field to order results by, e.g., createdDateTime desc
```

--------------------------------

### Create a Windows Quality Update Deployment

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls

Use this POST request to initiate a deployment for a specific security update, including configuration for expedited installation and user experience settings.

```http
POST https://graph.microsoft.com/beta/admin/windows/updates/deployments
content-type: application/json

{
    "@odata.type": "#microsoft.graph.windowsUpdates.deployment",
    "content": {
        "@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
        "catalogEntry": {
            "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
            "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5"
        }
    },
    "settings": {
        "@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
        "expedite": {
            "isExpedited": true
        },
        "userExperience": {
            "daysUntilForcedReboot": 2
        }
    }
}
```

--------------------------------

### Windows Autopatch Client Broker Deployment Script

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

This script initializes the environment, manages log rotation, handles legacy uninstallation, and retrieves installation metadata from a remote manifest.

```powershell
3ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGwuZXhlIiAtTm9uSW50ZXJhY3RpdmUgLU5vUHJvZmlsZSAtZmlsZSAiJCgkbXlJbnZvY2F0aW9uLkludm9jYXRpb25OYW1lKSIgJGFyZ3MNCiAgICB9DQogICAgZXhpdCAkbGFzdGV4aXRjb2RlDQp9DQoNCiMgZW52aXJvbm1lbnQgdmFyaWFibGVzDQpXcml0ZS1Ib3N0ICJJbml0aWFsaXppbmcgdmFyaWFibGVzIg0KJG1hbmlmZXN0RG93bmxvYWRVcmkgPSAnaHR0cHM6Ly9kZXZpY2UuYXV0b3BhdGNoLm1pY3Jvc29mdC5jb20vY2RuL2NsaWVudHNldHVwL21hbmlmZXN0X2x0cy5qc29uJw0KJG1hbmlmZXN0RG93bmxvYWRCYWNrdXBVcmkgPSAnaHR0cHM6Ly9kdmNnbGJscHJvZHN0b3JhZ2UxLmJsb2IuY29yZS53aW5kb3dzLm5ldC9jbGllbnRzZXR1cC9tYW5pZmVzdF9sdHMuanNvbicNCg0KJENhYkRpcmVjdG9yeSA9ICIkZW52OlN5c3RlbURyaXZlXFByb2dyYW1EYXRhXE1pY3Jvc29mdFxBdXRvcGF0Y2hTZXR1cCINCiRDYWJGaWxlID0gIiRDYWJEaXJlY3RvcnlcQXV0b3BhdGNoQ2xpZW50QnJva2VyQnJva2VyLmNhYiINCg0KJExvZ1BhdGggPSAiJEVudjp3aW5kaXJcY2NtXGxvZ3NcIg0KJExvZ1ByZWZpeCA9ICJBdXRvcGF0Y2hDbGllbnRWMlNldHVwSW5zdGFsbFRhc2siDQoNCiRFeHBhbmRlZENhYkRpcmVjdG9yeSA9ICIkZW52OlN5c3RlbURyaXZlXFByb2dyYW1EYXRhXE1pY3Jvc29mdFxBdXRvcGF0Y2hDbGllbnRCcm9rZXJcRmlsZXMiDQokc3RhbXBEYXRlID0gR2V0LURhdGUNCiRhcHBOYW1lID0gIldpbmRvd3MgQXV0b3BhdGNoIENsaWVudCBCcm9rZXIiDQokQ2xpZW50QnJva2VyUmVnaXN0cnlLZXkgPSAnU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NBdXRvcGF0Y2hcQ2xpZW50QnJva2VyJw0KJENtZFJlZ2lzdHJ5S2V5ID0gJ1NvZnR3YXJlXE1pY3Jvc29mdFxDbG91ZE1hbmFnZW1lbnREZXNrdG9wXEV4dGVuc2lvbicNCg0KIyBTdGFydCBMb2dnaW5nDQppZiAoLW5vdCAkRGlzYWJsZVRyYW5zY3JpcHQpIHsNCiAgICAkbG9nRmlsZSA9ICRMb2dQYXRoICsgJExvZ1ByZWZpeCArICRzdGFtcERhdGUuVG9GaWxlVGltZVV0YygpICsgJy5sb2cnDQogICAgU3RhcnQtVHJhbnNjcmlwdCAtUGF0aCAkbG9nRmlsZQ0KfQ0KDQojIFJlbW92ZSBBdXRvcGF0Y2ggSW5zdGFsbCBsb2dzIHRoYXQgYXJlIDcrIGRheXMgb2xkDQokY3V0T2ZmRGF0ZSA9IChHZXQtRGF0ZSkuQWRkRGF5cygtNykuVG9GaWxlVGltZVV0YygpDQpmb3JlYWNoICgkbG9nRmlsZSBpbiBHZXQtQ2hpbGRJdGVtICRMb2dQYXRoKSB7DQogICAgaWYgKCRsb2dGaWxlLk5hbWUuU3RhcnRzV2l0aCgkTG9nUHJlZml4KSAtYW5kICRsb2dGaWxlLkV4dGVuc2lvbi5FcXVhbHMoJy5sb2cnKSkgew0KICAgICAgICAkbG9nRGF0ZVN0ciA9ICRsb2dGaWxlLk5hbWUuU3Vic3RyaW5nKCRMb2dQcmVmaXguTGVuZ3RoKQ0KICAgICAgICAkbG9nRGF0ZVN0ciA9ICRsb2dEYXRlU3RyLlN1YnN0cmluZygwLCAkbG9nRGF0ZVN0ci5JbmRleE9mKCcuJykpDQogICAgICAgICRsb2dEYXRlID0gMA0KICAgICAgICBpZiAoW3VpbnQ2NF06OlRyeVBhcnNlKCRsb2dEYXRlU3RyLCBbcmVmXSRsb2dEYXRlKSAtYW5kICRsb2dEYXRlIC1sdCAkY3V0T2ZmRGF0ZSkgew0KICAgICAgICAgICAgUmVtb3ZlLUl0ZW0gKCd7MH17MX0nIC1mICRMb2dQYXRoLCAkbG9nRmlsZSkNCiAgICAgICAgICAgIFdyaXRlLUhvc3QgIlJlbW92ZWQgb2xkIGxvZyBmaWxlICRsb2dGaWxlIg0KICAgICAgICB9DQogICAgfQ0KfQ0KDQojIFVuaW5zdGFsbCB0aGUgb2xkIENNREV4dGVuc2lvbnMgZm9yIG5vbi1DUEMgZGV2aWNlcy4NCiRpc0NQQ0RldmljZSA9IENvbmZpcm0tSXNDUENEZXZpY2UNCmlmICgtbm90ICRpc0NQQ0RldmljZSkgew0KICAgIHRyeSB7DQogICAgICAgIFdyaXRlLUhvc3QgJ1VuaW5zdGFsbGluZyBIZXJtZXMgVjEuLi4nDQogICAgICAgIFVuaW5zdGFsbC1IZXJtZXNWMQ0KICAgICAgICBXcml0ZS1Ib3N0ICdIZXJtZXMgVjEgc3VjY2Vzc2Z1bGx5IHVuaW5zdGFsbGVkLicNCiAgICB9DQogICAgY2F0Y2ggew0KICAgICAgICAkbWVzc2FnZSA9ICRfLkV4Y2VwdGlvbi5NZXNzYWdlDQogICAgICAgIFdyaXRlLUhvc3QgIlVuaW5zdGFsbCBIZXJtZXMgVjEuIEVycm9yIE1lc3NhZ2U6ICRtZXNzYWdlIg0KICAgIH0NCn0NCg0KIyBHZXQgY2FiIGRvd25sb2FkIHVyaSBmcm9tIG1hbmlmZXN0DQp0cnkgew0KICAgIFdyaXRlLUhvc3QgIkRvd25sb2FkaW5nIG1hbmlmZXN0IGZpbGUgZnJvbSAkbWFuaWZlc3REb3dubG9hZFVyaSINCiAgICAkbWFuaWZlc3QgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICRtYW5pZmVzdERvd25sb2FkVXJpIC1Vc2VCYXNpY1BhcnNpbmcgfCBDb252ZXJ0RnJvbS1Kc29uDQp9DQpjYXRjaCB7DQogICAgV3JpdGUtSG9zdCAkXy5FeGNlcHRpb24uTWVzc2FnZWBuDQogICAgV3JpdGUtSG9zdCAiRmFpbGVkIHRvIGRvd25sb2FkIG1hbmlmZXN0IGZyb20gJG1hbmlmZXN0RG93bmxvYWRVcmkiDQogICAgdHJ5IHsNCiAgICAgICAgV3JpdGUtSG9zdCAiVHJ5aW5nIGJhY2t1cCB1cmk6ICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIg0KICAgICAgICAkbWFuaWZlc3QgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIC1Vc2VCYXNpY1BhcnNpbmcgfCBDb252ZXJ0RnJvbS1Kc29uDQogICAgfQ0KICAgIGNhdGNoIHsNCiAgICAgICAgV3JpdGUtSG9zdCAkXy5FeGNlcHRpb24uTWVzc2FnZWBuDQogICAgICAgIFdyaXRlLUhvc3QgIkZhaWxlZCB0byBkb3dubG9hZCBtYW5pZmVzdCBmcm9tICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIg0KICAgICAgICBDbGVhbnVwDQogICAgICAgIGV4aXQgMQ0KICAgIH0NCn0NCg0KdHJ5IHsNCiAgICBbc3RyaW5nXSRjYWJEb3dubG9hZFVyaSA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5JbnN0YWxsRnJvbQ0KICAgIFtzdHJpbmddJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5taW5pbXVtVmVyc2lvbg0KICAgIFtzdHJpbmddJGFsbG93ZWRNYXhpbXVtVmVyc2lvbiA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5tYXhpbXVtVmVyc2lvbg0KDQogICAgaWYgKCRhbGxvd2VkTWluaW11bVZlcnNpb24pIHsNCiAgICAgICAgV3JpdGUtSG9zdCAiQWxsb3dlZCBtaW5pbXVtVmVyc2lvbiBpbiBtYW5pZmVzdCAnJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiciDQogICAgfQ0KICAgIGVsc2Ugew0KICAgICAgICBXcml0ZS1Ib3N0ICJObyBtaW5pbXVtVmVyc2lvbiBpbiBtYW5pZmVzdDogJyRhbGxvd2VkTWluaW11bVZlcnNpb24nIg0KICAgICAgICBleGl0IDINCiAgICB9DQoNCiAgICBpZiAoISRhbGxvd2VkTWF4aW11bVZlcnNpb24gLW9yICgkYWxsb3dlZE1heGltdW1WZXJzaW9uIC1sdCAkYWxsb3dlZE1pbmltdW1WZXJzaW9uKSkgew0KICAgICAgICBXcml0ZS1Ib3N0ICIgICAgT3ZlcnJpZGluZyBtYXhpbXVtVmVyc2lvbiBmcm9tICckYWxsb3dlZE1heGltdW1WZXJzaW9uJyB0byAnJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiciDQogICAgICAgICRhbGxvd2VkTWF4aW11bVZlcnNpb24gPSAkYWxsb3dlZE1pbmltdW1WZXJzaW9uDQogICAgfQ0KDQogICAgV3JpdGUtSG9zdCAiQWxsb3dlZCBtYXhpbXVtVmVyc2lvbiBpbiBtYW5pZmVzdCAnJGFsbG93ZWRNYXhpbXVtVmVyc2lvbiciDQp9DQpjYXRjaCB7DQogICA
```

--------------------------------

### Cleanup Script Environment

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker

Cleans up files, directories, and scheduled tasks associated with the installation process.

```powershell
function Cleanup {
    <#
        .Synopsis
            Cleans up files, directories, and scheduled tasks associated with this install process except this script
        .Description
            Cleans up files, directories, and scheduled tasks associated with this install process except this script
        .Parameter
            -SuccessfulRun
        .Example
            Cleanup -SuccessfulRun $true
        .Inputs
            boolean.
        .Outputs
            None.
    #>
    param (
        [boolean] $SuccessfulRun = $false
    )

    cd $PSScriptRoot
    if (Test-Path $CabDirectory) {
        Write-Host "Removing Cab directory $CabDirectory"
        Remove-Item -LiteralPath $CabDirectory -Force -Recurse
    }

    if (Test-Path $ExpandedCabDirectory) {
        Write-Host "Removing Cab expanded directory $ExpandedCabDirectory"
        Remove-Item -LiteralPath $ExpandedCabDirectory -Force -Recurse
    }

    if ($SuccessfulRun) {
        # Cleanup scheduled task if it exists
        Unregister-ScheduledTask -TaskName 'Autopatch Client V2 Setup Installer' -Confirm:$false -ErrorAction SilentlyContinue
        Write-Host "[SUCCESSFUL_AUTOPATCH_CLIENT_SETUP]"
    }
    else {
        Write-Host "[FAILED_AUTOPATCH_CLIENT_SETUP]"
    }

    if (-not $DisableTranscript) {
        # Stop Logging
        Stop-Transcript -Verbose
    }
}
```

--------------------------------

### Query applicable driver content

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls

Use this GET request to retrieve applicable driver and firmware updates for a specific deployment audience ID.

```http
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/applicableContent
```

--------------------------------

### GET /admin/windows/updates/catalog/entries (List Expeditable Updates)

Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls

Lists security and non-security quality updates that can be deployed as expedited updates by Windows Autopatch.

```APIDOC
## GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries

### Description
Lists all security and non-security quality updates that can be deployed as expedited updates by Windows Autopatch. The response includes the Catalog ID required for creating deployments.

### Method
GET

### Endpoint
https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=2

### Parameters
#### Query Parameters
- **$filter** (string) - Required - Filters for qualityUpdateCatalogEntry and isExpeditable eq true
- **$orderby** (string) - Optional - Sorts results by releaseDateTime descending
- **$top** (integer) - Optional - Limits the number of results returned

### Response
#### Success Response (200)
- **value** (array) - List of catalog entries
- **id** (string) - The Catalog ID used to create a deployment
- **displayName** (string) - Name of the update
- **releaseDateTime** (string) - Date and time of release

### Response Example
{
    "value": [
        {
            "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5",
            "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later",
            "isExpeditable": true
        }
    ]
}
```
Tokens:
Raw