In this article, I will demonstrate how to use Microsoft Deployment Toolkit (MDT) and PowerShell to create a reusable in-place upgrade process for domain-joined computers.

Dan Franciscus

Dan Franciscus is a systems engineer and VMware Certified Professional (VCP) specializing in VMware, PowerShell, and other Microsoft-based technologies. You can reach Dan at his blog or his Twitter at @dan_franciscus.

This is a completely automated process. Thus, no end-user interaction is necessary, and it can take place on any remote computer. Although I have not tested it specifically, theoretically this function should be able to upgrade hundreds of workstations simultaneously with the proper computing in place.

While adoption of Windows 10 for businesses has been growing, many workstations still run Windows 7 or Windows 8. For mass in-place upgrades, System Center Configuration Manager (SCCM) is the most widely used option as it allows administrators to push out the upgrade easily. For organizations that do not use SCCM, such as small to medium-sized businesses, there are other viable options, notably using MDT along with PowerShell.

Please note this solution will not be a fit for every organization. It requires the use of the Remote Desktop Protocol (RDP) on each machine to launch the upgrade process, and it is widely known that RDP is not entirely secure. The need for using RDP is due to the MDT upgrade process requiring a user logged on to the computer to launch the litetouch.vbs file. With that said, there are ways to reduce the security hole by using public key infrastructure (PKI) and enabling RDP only during the upgrade process. I also recommend changing the password on the account connecting via RDP immediately after the upgrade is complete.

Setting up MDT ^

Before we can begin deploying the in-place upgrade, we need to setup an MDT deployment share including importing the Windows 10 media and creating a new upgrade task sequence. I will not go into how to do this since this Microsoft blog already covers it.

The setup of MDT for the in-place upgrade is trivial, but to automate the role of MDT in this process fully, we must alter the bootstrap.ini and customsettings.ini files on the MDT share.

We need to edit bootstrap.ini to skip the welcome screen and supply credentials to the MDT share:

In the customsettings.ini file we will need to configure MDT monitoring, skip all of the screens, and most importantly specify the task sequence to run, which should match your Windows 10 in-place upgrade task sequence.

Overview of the Invoke-Win10Upgrade function ^

Now that MDT is ready, PowerShell will be orchestrating the remote in-place upgrades. The main process of the function is as follows:

  • Ping each computer using a PowerShell workflow to ensure it is online.
  • Restart all computers to ensure no users are logged on to the console.
  • Create a scheduled task to launch litetouch.vbs when a specified user logs on.
  • Enable RDP on each workstation.
  • Launch an RDP session to each computer, which will launch the upgrade MDT process.
  • Remove the scheduled task since it will be no longer be needed.
  • Monitor the MDT upgrade process for each remote computer until all are complete.
  • Disable RDP on each workstation.

Stepping through Invoke-Win10Upgrade ^

Now let's step through some code in this function to understand better what is happening.

The workflow Test-Ping can sift through the computers provided in the $ComputerName parameter to ensure they are online. If it cannot ping computers, it will not attempt an upgrade on them.

Next, Restart-Computer reboots all computers. The command waits for PowerShell to be accessible before continuing. This ensures no users are logged on to the console and also gets the machines in a clean state, ready for upgrade.

Here, we use Invoke-Command to create a scheduled task to launch litetouch.vbs upon the logon of the account specified in the $Credential parameter.

The Connect-RDP workflow launches an RDP connection to each computer, which will then launch litetouch.vbs via the scheduled task. Due the workflow using ‑parallel, these RDP connections will happen simultaneously with a default throttle of 150 workstations. Remember there will be an RDP process for each computer you are upgrading. Thus, you should have a certain amount of CPU and memory on your local machine depending on how many workstations you want to upgrade simultaneously.

After launching RDP, Invoke-Command removes the scheduled task created previously.

Now that all computers are in the process of upgrading, we monitor our MDT share to see the status. The status will update every 60 seconds in your console until all upgrades are done.

Invoke-Win10Ugrade example ^

In this example I have machines Test-1 and Test-2 that I want to upgrade. For the parameters, I need to specify the MDT server hostname, MDT litetouch, the computers to upgrade, and the credential to use.

Using Invoke Win10Upgrade

Using Invoke Win10Upgrade

Code for Invoke-Win10Upgrade ^

Note you can also download the latest version from my GitHub repository:

Win the monthly 4sysops member prize for IT pros


Users who have LIKED this post:

  • avatar

Related Posts


Leave a reply

Your email address will not be published. Required fields are marked *



Please ask IT administration questions in the forum. Any other messages are welcome.

© 4sysops 2006 - 2017

Log in with your credentials


Forgot your details?

Create Account