### Example setupapi.dev.log content Source: https://learn.microsoft.com/en-us/windows/deployment/upgrade/log-files Log entries detailing a device driver installation process. ```text >>> [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F] >>> Section start 2023/09/26 20:13:01.623 cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf ndv: Install flags: 0x00000000 ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8} ndv: Search options: 0x00000081 ndv: Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf' dvi: {Build Driver List} 20:13:01.643 dvi: Searching for hardware ID(s): dvi: pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04 dvi: pci\ven_8086&dev_8c4f&subsys_05be1028 dvi: pci\ven_8086&dev_8c4f&cc_060100 dvi: pci\ven_8086&dev_8c4f&cc_0601 dvi: Searching for compatible ID(s): dvi: pci\ven_8086&dev_8c4f&rev_04 dvi: pci\ven_8086&dev_8c4f dvi: pci\ven_8086&cc_060100 dvi: pci\ven_8086&cc_0601 dvi: pci\ven_8086 dvi: pci\cc_060100 dvi: pci\cc_0601 sig: {_VERIFY_FILE_SIGNATURE} 20:13:01.667 sig: Key = lynxpointsystem.inf sig: FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf sig: Catalog = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat sig: Success: File is signed in catalog. sig: {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683 dvi: Created Driver Node: dvi: HardwareID - PCI\VEN_8086&DEV_8C4F dvi: InfName - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf dvi: DevDesc - Intel(R) QM87 LPC Controller - 8C4F dvi: Section - Needs_ISAPNP_DRV dvi: Rank - 0x00ff2001 dvi: Signer Score - WHQL ``` -------------------------------- ### Example setuperr.log content Source: https://learn.microsoft.com/en-us/windows/deployment/upgrade/log-files A sample log output demonstrating error entries during a migration or setup process. ```text 27:08, Error SP Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570] 27:08, Error MIG Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570] 27:08, Error Gather failed. Last error: 0x00000000 27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C 27:09, Error SP CMigrateFramework: Gather framework failed. Status: 44 27:09, Error SP Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7] 27:09, Error SP Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7] 27:09, Error SP CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7] ``` -------------------------------- ### Configure SetupConfig.ini for Normal Priority Source: https://learn.microsoft.com/en-us/windows/deployment/update/feature-update-user-install Create this file to override the default low-priority setup behavior, which can reduce total installation time. ```ini [SetupConfig] Priority=Normal ``` -------------------------------- ### Get examples for a VAMT cmdlet Source: https://learn.microsoft.com/en-us/windows/deployment/volume-activation/use-vamt-in-windows-powershell View practical usage examples for a specific VAMT cmdlet. ```PowerShell get-help -examples ``` ```PowerShell get-help get-VamtProduct -examples ``` -------------------------------- ### LoadState Local Account Enablement Example Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax Example of using both /lac and /lae to create and enable a local account. ```bash LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:LoadState.log /lac:password /lae ``` -------------------------------- ### Uncompressed Migration Store Example Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax Example command to restore data from an uncompressed migration store. ```text LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /nocompress ``` -------------------------------- ### LoadState Local Account Creation Example Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax Example of using the /lac option to create local accounts on the destination computer. ```bash LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore ``` -------------------------------- ### Import TLS Certificate Example Source: https://learn.microsoft.com/en-us/windows/deployment/do/mcc-ent-https-windows-guide Example command for importing a certificate using local account credentials. ```PowerShell .\importCert.ps1 ` -mccRunTimeAccount $myLocalAccountCredential.Username ` -mccLocalAccountCredential $myLocalAccountCredential ` -certName "myTlsCert.crt" ``` -------------------------------- ### Add optional components to boot image via PowerShell Source: https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image Use Add-WindowsPackage to install optional components into a mounted boot image. These examples assume a 64-bit architecture. ```PowerShell Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\.cab" -Path "" -Verbose ``` ```PowerShell Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab" -Path "C:\Mount" -Verbose ``` -------------------------------- ### Complete Offline.xml example Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/offline-migration-reference A full example demonstrating the structure of an Offline.xml file. ```XML C:\Windows D:\Windows E:\ 1 ``` -------------------------------- ### LoadState Domain Migration Example Source: https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-loadstate-syntax Example of using the /md option to map users from one domain to another during migration. ```bash LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:LoadState.log /md:contoso:fabrikam ``` -------------------------------- ### Verify Microsoft File Signature and Install Client Broker Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker This script verifies the digital signature of the MSI installer against Microsoft's root certificate before proceeding with the installation using msiexec. ```powershell <# .SYNOPSIS Installs Microsoft Autopatch Client Broker .EXAMPLE .\SetupAutopatchClientPackage.ps1 #> param ( [switch] $DisableTranscript = $false ) # Ensures that Invoke-WebRequest uses TLS 1.2 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function VerifyMicrosoftFileSignature { <# .Synopsis Verifies if a file is Microsoft Signed .Description Checks if a file is signed by a certificate with a microsoft subject and rooted to the microsoft root .Parameter -FilePath .Example VerifyMicrosoftFileSignature -FilePath 'C:\temp\temp.cab' .Inputs string. .Outputs None. #> param ( [parameter(mandatory)] [string] $FilePath ) $signature = Get-AuthenticodeSignature -FilePath $FilePath Write-Host 'Digital Signature validity:' $signature.status Write-Host 'Signer Certificate subject:' $signature.signerCertificate.subject $cert = $signature.SignerCertificate $chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain $chain.Build($cert) $rootCertSubject = ($chain.ChainElements | Select-Object -Last 1).Certificate.Subject Write-Host 'Root Certificate subject:' $rootCertSubject Write-Host 'Chain Status:' ($chain.ChainStatus | Format-List) if ($chain.ChainStatus) { foreach ($chainStatus in $chain.ChainStatus) { # We are only okay with chain statuses that are NoError(0) or NotTimeValid(1) if (($chainStatus.Status -eq 0) -or ($chainStatus.Status -eq 1)) { continue } else { Write-Host 'Chain Not Trusted. Chain Status:' $chainStatus.Status throw "Chain Not Trusted. Chain Status: $chainStatus.Status" } } } # Check that the signing cert is syntactically valid, has the Microsoft subject, is rooted to the Microsoft root cert, and has no errors in the chain if (-not ($signature.status -eq 'valid' -and ($signature.signerCertificate.subject -eq 'CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US' -and ($rootCertSubject -eq 'CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US')))) { Write-Host 'Not signed by Microsoft PRS Cert with Microsoft Root' throw "Not signed by Microsoft PRS Cert with Microsoft Root" } } function InstallAutopatchClientBroker { $AutopatchClientBrokerLogPath = "$LogPath\AutopatchClientBrokerInstall" + $stampDate.ToFileTimeUtc() + '.log' $AutopatchClientBrokerMsi = "$ExpandedCabDirectory\ClientBroker.msi" Write-Host "Validating msi installer" try { VerifyMicrosoftFileSignature -FilePath $AutopatchClientBrokerMsi Write-Host 'ACB MSI is trusted and verified' } catch { Write-Host 'ACB MSI is not trusted. Skipping' return } $MSIInstallArguments = @( "/i" "$AutopatchClientBrokerMsi" "SVCENV=$CabEnvironment" "/qb!" "/l*v $AutopatchClientBrokerLogPath" "/norestart" "/quiet" ) try { Write-Host 'Installing Autopatch Client Broker' $InstallProcess = Start-Process "msiexec.exe" -ArgumentList $MSIInstallArguments -PassThru -Wait -NoNewWindow $InstallExitCode = $InstallProcess.ExitCode Write-Host "Finished running msi installer for $appName. Exit Code: $InstallExitCode" if ($InstallExitCode -ne 0) { Write-Host "An ``` -------------------------------- ### List Installed Applications Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker Retrieves a list of installed applications from the Windows Registry by querying the Uninstall key. ```powershell function ListInstalledApps { <# Rename properties to be compatible with Win32_Product IdentifyingNumber : {FE737213-9769-415E-AE34-772FF239DBF3} Name : Azure Developer CLI Vendor : Microsoft Corporation Version : 1.3.100 Caption : Azure Developer CLI #> $installedApps = @() $installedApps += ( Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* ` | Select-Object @{Name='IdentifyingNumber'; Expression='PSChildName'}, @{Name='Name'; Expression='DisplayName'}, @{Name='Version'; Expression='DisplayVersion'}, @{Name='Vendor'; Expression='Publisher'}, InstallDate ) return $installedApps } ``` -------------------------------- ### Manual Windows Autopatch Client Broker Installation Script Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker Use this PowerShell script to manually install the Windows client broker on devices when Win32 App management is unavailable. ```PowerShell function Cleanup { cd $PSScriptRoot if (Test-Path $ScriptFolderPath) { Write-Host 'Removing script directory' Remove-Item -LiteralPath $ScriptFolderPath -Force -Recurse } } Function Setup { # Cleanup scheduled task if it exists $oldTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue if ($oldTask) { if ($oldTask.State -eq 'Running') { Stop-ScheduledTask -TaskName $ScheduledTaskName } Unregister-ScheduledTask -TaskName $ScheduledTaskName -Confirm:$false -ErrorAction SilentlyContinue } Cleanup } $LogPrefix = "\AutopatchClientV2SetupInstallScheduled" $Timestamp = Get-Date $LogPath = "$Env:windir\ccm\logs" $LogFile = $LogPath + $LogPrefix + $Timestamp.ToFileTimeUtc() + ".log" $ScheduledTaskName = 'Autopatch Client V2 Setup Installer' $ScriptFolderPath = "$env:SystemDrive\ProgramData\Microsoft\AutopatchSetupScheduled" $SystemScriptPath = "$ScriptFolderPath\SetupAutopatchClientV2Package.ps1" $SystemScript = ``` -------------------------------- ### Deployment audience creation response Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls Example JSON response body returned after successfully creating a deployment audience. ```json { "@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deploymentAudiences/$entity", "id": "d39ad1ce-0123-4567-89ab-cdef01234567", "reportingDeviceCount": 0, "applicableContent": [] } ``` -------------------------------- ### Applicable content response structure Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls Example JSON response showing matched devices and catalog entry details for a driver update. ```json "matchedDevices": [ { "recommendedBy": [ "Microsoft" ], "deviceId": "01ea3c90-12f5-4093-a4c9-c1434657c976" } ], "catalogEntry": { "@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry", "id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c", "displayName": "Microsoft - Test - 1.0.0.1", "deployableUntilDateTime": null, "releaseDateTime": "0001-01-21T04:18:32Z", "description": "Microsoft test driver update released in January 2021", "driverClass": "OtherHardware", "provider": "Microsoft", "setupInformationFile": null, "manufacturer": "Microsoft", "version": "1.0.0.1", "versionDateTime": "2021-01-11T02:43:14Z" ``` -------------------------------- ### Deploy Windows Autopatch Client Broker via PowerShell Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker This script initializes the environment, creates a scheduled task for the installation, and monitors the task for completion or failure. ```powershell if (-not (Test-Path $LogPath)) { New-Item -Force -ItemType directory -Path $LogPath } Start-Transcript -Path $LogFile #Cleanup lingering resources from previous runs Setup $content = [System.Convert]::FromBase64String($SystemScript) New-Item -ItemType Directory -Force -Path $ScriptFolderPath Set-Content -Path $SystemScriptPath -Value $content -Encoding Byte $Trigger = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddHours(4)) -RepetitionInterval (New-TimeSpan -Hours 4) # Specify the trigger settings $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries $User = "NT AUTHORITY\SYSTEM" $Argument = "-ExecutionPolicy Bypass $SystemScriptPath" $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $argument # Specify what program to run andtask with its parameters Register-ScheduledTask -TaskName $ScheduledTaskName -Trigger $Trigger -User $User -Action $Action -Settings $Settings -RunLevel Highest -Force $MaxRetries = 10 Start-ScheduledTask -TaskName $ScheduledTaskName $ScheduledTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue # Wait for the scheduled task to complete so its log can be read and uploaded while (-not (($ScheduledTask.State -eq 'Ready') -or ($MaxRetries -eq 0))) { Write-Host "Waiting for scheduled task to complete" Start-Sleep -Seconds 60 $MaxRetries-- $ScheduledTask = Get-ScheduledTask -TaskName $ScheduledTaskName -ErrorAction SilentlyContinue if (-not $ScheduledTask) { # The scheduled task was removed by the install script because it installed clients successfully break } } if (-not $ScheduledTask) { # The scheduled task was removed by the install script because it installed clients successfully Write-Host "[SUCCESSFUL_AUTOPATCH_CLIENT_SETUP_SCHEDULED]" Cleanup Stop-Transcript -Verbose exit 0 } if ($MaxRetries -ne 0) { # There was some error in attempting to install the clients Write-Error "[FAILED_AUTOPATCH_CLIENT_SETUP_SCHEDULED]" -Category NotInstalled } else { # We timed out on waiting for the task to complete Write-Error "[UNKNOWN_AUTOPATCH_CLIENT_SETUP_SCHEDULED]" -Category OperationTimeout } # Grab results from most recent log file and add them to the transcript $InternalScriptPrefix = 'AutopatchClientV2SetupInstallTask' $LogFound = $false foreach ($InstallLogFile in (Get-ChildItem $LogPath | Sort-Object LastAccessTime -Descending)) { if ($InstallLogFile.Name.StartsWith($InternalScriptPrefix) -and $InstallLogFile.Extension.Equals('.log')) { Write-Error "----------[Start] Results from Install Task ----------" $FullInstallLogPath = $LogPath + '\' + $InstallLogFile.Name $LogContents = Get-Content $FullInstallLogPath -Raw Write-Error $LogContents Write-Error "----------[End] Results from Install Task ----------" $LogFound = $true break } } if (-not $LogFound) { Write-Error "[Log Not Found]" Get-ChildItem $LogPath | Sort-Object LastAccessTime -Descending } Stop-Transcript -Verbose exit 8 ``` -------------------------------- ### GET /devices Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls Retrieves a list of devices with specific fields selected. ```APIDOC ## GET https://graph.microsoft.com/v1.0/devices ### Description Retrieves device information from Microsoft Entra ID. Use query parameters to filter and select specific device attributes. ### Method GET ### Endpoint https://graph.microsoft.com/v1.0/devices ### Parameters #### Query Parameters - **$select** (string) - Optional - Comma-separated list of properties to return (e.g., deviceid, displayName). - **$filter** (string) - Optional - OData filter expression to narrow down results. - **$search** (string) - Optional - Search expression for advanced queries. - **$count** (boolean) - Optional - Include the count of items in the response. ### Request Example GET https://graph.microsoft.com/v1.0/devices?$select=deviceid,displayName ``` -------------------------------- ### Example JSON response for catalog entry Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls A sample response showing the structure of a quality update catalog entry, including the Catalog ID and CVE severity information. ```json { "@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries", "value": [ { "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry", "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5", "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later", "deployableUntilDateTime": null, "releaseDateTime": "2023-08-08T00:00:00Z", "isExpeditable": true, "qualityUpdateClassification": "security", "catalogName": "2023-08 Cumulative Update for Windows 10 and later", "shortName": "2023.08 B", "qualityUpdateCadence": "monthly", "cveSeverityInformation": { "maxSeverity": "critical", "maxBaseScore": 9.8, "exploitedCves@odata.context": "https://graph.microsoft.com/$metadata#admin/windows/updates/catalog/entries('e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5')/microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/cveSeverityInformation/exploitedCves", "exploitedCves": [ { "number": "ADV230003", "url": "https://msrc.microsoft.com/update-guide/vulnerability/ADV230003" }, { "number": "CVE-2023-38180", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38180" } ] } } ] } ``` -------------------------------- ### GET /admin/windows/updates/deployments Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls Retrieves a list of deployments, ordered by creation date. ```APIDOC ## GET /admin/windows/updates/deployments ### Description Displays all deployments, ordered by the createdDateTime property in descending order. ### Method GET ### Endpoint https://graph.microsoft.com/beta/admin/windows/updates/deployments?orderby=createdDateTime desc ### Parameters #### Query Parameters - **orderby** (string) - Optional - The field to order results by, e.g., createdDateTime desc ``` -------------------------------- ### Create a Windows Quality Update Deployment Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls Use this POST request to initiate a deployment for a specific security update, including configuration for expedited installation and user experience settings. ```http POST https://graph.microsoft.com/beta/admin/windows/updates/deployments content-type: application/json { "@odata.type": "#microsoft.graph.windowsUpdates.deployment", "content": { "@odata.type": "#microsoft.graph.windowsUpdates.catalogContent", "catalogEntry": { "@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry", "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5" } }, "settings": { "@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings", "expedite": { "isExpedited": true }, "userExperience": { "daysUntilForcedReboot": 2 } } } ``` -------------------------------- ### Windows Autopatch Client Broker Deployment Script Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker This script initializes the environment, manages log rotation, handles legacy uninstallation, and retrieves installation metadata from a remote manifest. ```powershell 3ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGwuZXhlIiAtTm9uSW50ZXJhY3RpdmUgLU5vUHJvZmlsZSAtZmlsZSAiJCgkbXlJbnZvY2F0aW9uLkludm9jYXRpb25OYW1lKSIgJGFyZ3MNCiAgICB9DQogICAgZXhpdCAkbGFzdGV4aXRjb2RlDQp9DQoNCiMgZW52aXJvbm1lbnQgdmFyaWFibGVzDQpXcml0ZS1Ib3N0ICJJbml0aWFsaXppbmcgdmFyaWFibGVzIg0KJG1hbmlmZXN0RG93bmxvYWRVcmkgPSAnaHR0cHM6Ly9kZXZpY2UuYXV0b3BhdGNoLm1pY3Jvc29mdC5jb20vY2RuL2NsaWVudHNldHVwL21hbmlmZXN0X2x0cy5qc29uJw0KJG1hbmlmZXN0RG93bmxvYWRCYWNrdXBVcmkgPSAnaHR0cHM6Ly9kdmNnbGJscHJvZHN0b3JhZ2UxLmJsb2IuY29yZS53aW5kb3dzLm5ldC9jbGllbnRzZXR1cC9tYW5pZmVzdF9sdHMuanNvbicNCg0KJENhYkRpcmVjdG9yeSA9ICIkZW52OlN5c3RlbURyaXZlXFByb2dyYW1EYXRhXE1pY3Jvc29mdFxBdXRvcGF0Y2hTZXR1cCINCiRDYWJGaWxlID0gIiRDYWJEaXJlY3RvcnlcQXV0b3BhdGNoQ2xpZW50QnJva2VyQnJva2VyLmNhYiINCg0KJExvZ1BhdGggPSAiJEVudjp3aW5kaXJcY2NtXGxvZ3NcIg0KJExvZ1ByZWZpeCA9ICJBdXRvcGF0Y2hDbGllbnRWMlNldHVwSW5zdGFsbFRhc2siDQoNCiRFeHBhbmRlZENhYkRpcmVjdG9yeSA9ICIkZW52OlN5c3RlbURyaXZlXFByb2dyYW1EYXRhXE1pY3Jvc29mdFxBdXRvcGF0Y2hDbGllbnRCcm9rZXJcRmlsZXMiDQokc3RhbXBEYXRlID0gR2V0LURhdGUNCiRhcHBOYW1lID0gIldpbmRvd3MgQXV0b3BhdGNoIENsaWVudCBCcm9rZXIiDQokQ2xpZW50QnJva2VyUmVnaXN0cnlLZXkgPSAnU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NBdXRvcGF0Y2hcQ2xpZW50QnJva2VyJw0KJENtZFJlZ2lzdHJ5S2V5ID0gJ1NvZnR3YXJlXE1pY3Jvc29mdFxDbG91ZE1hbmFnZW1lbnREZXNrdG9wXEV4dGVuc2lvbicNCg0KIyBTdGFydCBMb2dnaW5nDQppZiAoLW5vdCAkRGlzYWJsZVRyYW5zY3JpcHQpIHsNCiAgICAkbG9nRmlsZSA9ICRMb2dQYXRoICsgJExvZ1ByZWZpeCArICRzdGFtcERhdGUuVG9GaWxlVGltZVV0YygpICsgJy5sb2cnDQogICAgU3RhcnQtVHJhbnNjcmlwdCAtUGF0aCAkbG9nRmlsZQ0KfQ0KDQojIFJlbW92ZSBBdXRvcGF0Y2ggSW5zdGFsbCBsb2dzIHRoYXQgYXJlIDcrIGRheXMgb2xkDQokY3V0T2ZmRGF0ZSA9IChHZXQtRGF0ZSkuQWRkRGF5cygtNykuVG9GaWxlVGltZVV0YygpDQpmb3JlYWNoICgkbG9nRmlsZSBpbiBHZXQtQ2hpbGRJdGVtICRMb2dQYXRoKSB7DQogICAgaWYgKCRsb2dGaWxlLk5hbWUuU3RhcnRzV2l0aCgkTG9nUHJlZml4KSAtYW5kICRsb2dGaWxlLkV4dGVuc2lvbi5FcXVhbHMoJy5sb2cnKSkgew0KICAgICAgICAkbG9nRGF0ZVN0ciA9ICRsb2dGaWxlLk5hbWUuU3Vic3RyaW5nKCRMb2dQcmVmaXguTGVuZ3RoKQ0KICAgICAgICAkbG9nRGF0ZVN0ciA9ICRsb2dEYXRlU3RyLlN1YnN0cmluZygwLCAkbG9nRGF0ZVN0ci5JbmRleE9mKCcuJykpDQogICAgICAgICRsb2dEYXRlID0gMA0KICAgICAgICBpZiAoW3VpbnQ2NF06OlRyeVBhcnNlKCRsb2dEYXRlU3RyLCBbcmVmXSRsb2dEYXRlKSAtYW5kICRsb2dEYXRlIC1sdCAkY3V0T2ZmRGF0ZSkgew0KICAgICAgICAgICAgUmVtb3ZlLUl0ZW0gKCd7MH17MX0nIC1mICRMb2dQYXRoLCAkbG9nRmlsZSkNCiAgICAgICAgICAgIFdyaXRlLUhvc3QgIlJlbW92ZWQgb2xkIGxvZyBmaWxlICRsb2dGaWxlIg0KICAgICAgICB9DQogICAgfQ0KfQ0KDQojIFVuaW5zdGFsbCB0aGUgb2xkIENNREV4dGVuc2lvbnMgZm9yIG5vbi1DUEMgZGV2aWNlcy4NCiRpc0NQQ0RldmljZSA9IENvbmZpcm0tSXNDUENEZXZpY2UNCmlmICgtbm90ICRpc0NQQ0RldmljZSkgew0KICAgIHRyeSB7DQogICAgICAgIFdyaXRlLUhvc3QgJ1VuaW5zdGFsbGluZyBIZXJtZXMgVjEuLi4nDQogICAgICAgIFVuaW5zdGFsbC1IZXJtZXNWMQ0KICAgICAgICBXcml0ZS1Ib3N0ICdIZXJtZXMgVjEgc3VjY2Vzc2Z1bGx5IHVuaW5zdGFsbGVkLicNCiAgICB9DQogICAgY2F0Y2ggew0KICAgICAgICAkbWVzc2FnZSA9ICRfLkV4Y2VwdGlvbi5NZXNzYWdlDQogICAgICAgIFdyaXRlLUhvc3QgIlVuaW5zdGFsbCBIZXJtZXMgVjEuIEVycm9yIE1lc3NhZ2U6ICRtZXNzYWdlIg0KICAgIH0NCn0NCg0KIyBHZXQgY2FiIGRvd25sb2FkIHVyaSBmcm9tIG1hbmlmZXN0DQp0cnkgew0KICAgIFdyaXRlLUhvc3QgIkRvd25sb2FkaW5nIG1hbmlmZXN0IGZpbGUgZnJvbSAkbWFuaWZlc3REb3dubG9hZFVyaSINCiAgICAkbWFuaWZlc3QgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICRtYW5pZmVzdERvd25sb2FkVXJpIC1Vc2VCYXNpY1BhcnNpbmcgfCBDb252ZXJ0RnJvbS1Kc29uDQp9DQpjYXRjaCB7DQogICAgV3JpdGUtSG9zdCAkXy5FeGNlcHRpb24uTWVzc2FnZWBuDQogICAgV3JpdGUtSG9zdCAiRmFpbGVkIHRvIGRvd25sb2FkIG1hbmlmZXN0IGZyb20gJG1hbmlmZXN0RG93bmxvYWRVcmkiDQogICAgdHJ5IHsNCiAgICAgICAgV3JpdGUtSG9zdCAiVHJ5aW5nIGJhY2t1cCB1cmk6ICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIg0KICAgICAgICAkbWFuaWZlc3QgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIC1Vc2VCYXNpY1BhcnNpbmcgfCBDb252ZXJ0RnJvbS1Kc29uDQogICAgfQ0KICAgIGNhdGNoIHsNCiAgICAgICAgV3JpdGUtSG9zdCAkXy5FeGNlcHRpb24uTWVzc2FnZWBuDQogICAgICAgIFdyaXRlLUhvc3QgIkZhaWxlZCB0byBkb3dubG9hZCBtYW5pZmVzdCBmcm9tICRtYW5pZmVzdERvd25sb2FkQmFja3VwVXJpIg0KICAgICAgICBDbGVhbnVwDQogICAgICAgIGV4aXQgMQ0KICAgIH0NCn0NCg0KdHJ5IHsNCiAgICBbc3RyaW5nXSRjYWJEb3dubG9hZFVyaSA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5JbnN0YWxsRnJvbQ0KICAgIFtzdHJpbmddJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5taW5pbXVtVmVyc2lvbg0KICAgIFtzdHJpbmddJGFsbG93ZWRNYXhpbXVtVmVyc2lvbiA9ICRtYW5pZmVzdC5DbGllbnRCcm9rZXIuYnJvYWRSaW5nU2V0dGluZy5tYXhpbXVtVmVyc2lvbg0KDQogICAgaWYgKCRhbGxvd2VkTWluaW11bVZlcnNpb24pIHsNCiAgICAgICAgV3JpdGUtSG9zdCAiQWxsb3dlZCBtaW5pbXVtVmVyc2lvbiBpbiBtYW5pZmVzdCAnJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiciDQogICAgfQ0KICAgIGVsc2Ugew0KICAgICAgICBXcml0ZS1Ib3N0ICJObyBtaW5pbXVtVmVyc2lvbiBpbiBtYW5pZmVzdDogJyRhbGxvd2VkTWluaW11bVZlcnNpb24nIg0KICAgICAgICBleGl0IDINCiAgICB9DQoNCiAgICBpZiAoISRhbGxvd2VkTWF4aW11bVZlcnNpb24gLW9yICgkYWxsb3dlZE1heGltdW1WZXJzaW9uIC1sdCAkYWxsb3dlZE1pbmltdW1WZXJzaW9uKSkgew0KICAgICAgICBXcml0ZS1Ib3N0ICIgICAgT3ZlcnJpZGluZyBtYXhpbXVtVmVyc2lvbiBmcm9tICckYWxsb3dlZE1heGltdW1WZXJzaW9uJyB0byAnJGFsbG93ZWRNaW5pbXVtVmVyc2lvbiciDQogICAgICAgICRhbGxvd2VkTWF4aW11bVZlcnNpb24gPSAkYWxsb3dlZE1pbmltdW1WZXJzaW9uDQogICAgfQ0KDQogICAgV3JpdGUtSG9zdCAiQWxsb3dlZCBtYXhpbXVtVmVyc2lvbiBpbiBtYW5pZmVzdCAnJGFsbG93ZWRNYXhpbXVtVmVyc2lvbiciDQp9DQpjYXRjaCB7DQogICA ``` -------------------------------- ### Cleanup Script Environment Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-client-broker Cleans up files, directories, and scheduled tasks associated with the installation process. ```powershell function Cleanup { <# .Synopsis Cleans up files, directories, and scheduled tasks associated with this install process except this script .Description Cleans up files, directories, and scheduled tasks associated with this install process except this script .Parameter -SuccessfulRun .Example Cleanup -SuccessfulRun $true .Inputs boolean. .Outputs None. #> param ( [boolean] $SuccessfulRun = $false ) cd $PSScriptRoot if (Test-Path $CabDirectory) { Write-Host "Removing Cab directory $CabDirectory" Remove-Item -LiteralPath $CabDirectory -Force -Recurse } if (Test-Path $ExpandedCabDirectory) { Write-Host "Removing Cab expanded directory $ExpandedCabDirectory" Remove-Item -LiteralPath $ExpandedCabDirectory -Force -Recurse } if ($SuccessfulRun) { # Cleanup scheduled task if it exists Unregister-ScheduledTask -TaskName 'Autopatch Client V2 Setup Installer' -Confirm:$false -ErrorAction SilentlyContinue Write-Host "[SUCCESSFUL_AUTOPATCH_CLIENT_SETUP]" } else { Write-Host "[FAILED_AUTOPATCH_CLIENT_SETUP]" } if (-not $DisableTranscript) { # Stop Logging Stop-Transcript -Verbose } } ``` -------------------------------- ### Query applicable driver content Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-driver-and-firmware-update-programmatic-controls Use this GET request to retrieve applicable driver and firmware updates for a specific deployment audience ID. ```http GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/applicableContent ``` -------------------------------- ### GET /admin/windows/updates/catalog/entries (List Expeditable Updates) Source: https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-programmatic-controls Lists security and non-security quality updates that can be deployed as expedited updates by Windows Autopatch. ```APIDOC ## GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries ### Description Lists all security and non-security quality updates that can be deployed as expedited updates by Windows Autopatch. The response includes the Catalog ID required for creating deployments. ### Method GET ### Endpoint https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=2 ### Parameters #### Query Parameters - **$filter** (string) - Required - Filters for qualityUpdateCatalogEntry and isExpeditable eq true - **$orderby** (string) - Optional - Sorts results by releaseDateTime descending - **$top** (integer) - Optional - Limits the number of results returned ### Response #### Success Response (200) - **value** (array) - List of catalog entries - **id** (string) - The Catalog ID used to create a deployment - **displayName** (string) - Name of the update - **releaseDateTime** (string) - Date and time of release ### Response Example { "value": [ { "id": "e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5", "displayName": "08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later", "isExpeditable": true } ] } ```