2pint software branchcache for osd · waik/aik directly. 4. access to windows source media of...

2Pint Software BranchCache for OSD

2Pint Software 2/22/16

1

2PINT SOFTWARE BRANCHCACHE FOR OSD 2PINT SOFTWARE

2PintS o f t w a r e

Contents BranchCache for OSD 1.4.0 Release Notes ...................................................................................................... 3

Changes from 1.3.0.0 to 1.4.0.0 .......................................................................................................................... 4

Changes from 1.1.0.0 to 1.3.0.0 .......................................................................................................................... 4

Changes from 1.0.0.2 to 1.1.0.0 .......................................................................................................................... 4

WinPE Generator: .............................................................................................................................................. 4

Download Engine (BITSFist.exe) ................................................................................................................ 4

BranchCache First Timer? .................................................................................................................................... 5

Implementing BranchCache Reporting? ............................................................................................................ 5

BranchCache and Task Sequences Script ........................................................................................................ 5

Using BranchCache for OSD Overview............................................................................................................... 6

Generating a BC WinPE Boot Image ................................................................................................................... 7

WinPE Generator Command Line Options ................................................................................................ 8

Generating the Boot Image Pre-Requisites .................................................................................................. 8

Running the BC WinPE Generator .................................................................................................................. 9

Example Generation ...................................................................................................................................10

Enabling BranchCache in the Deployment ......................................................................................................11

Enabling BranchCache in a Deployment Sequence ..................................................................................13

Usage for Enable .........................................................................................................................................13

Usage for Move ...........................................................................................................................................13

Example command lines ...........................................................................................................................13

Advanced Command Line Examples: ......................................................................................................13

Running BCEnabler.exe in a WinPE session ..........................................................................................14

Running BCEnabler.exe in a Full Windows OS.......................................................................................15

Using the BCEnable Move Command to Save the Cache ..........................................................................16

Consideration when moving the Cache ..................................................................................................17

A few little comments on Paths ...............................................................................................................17

Deploying Computers With BranchCache .......................................................................................................18

To Cache or not to Cache - That Is The Question ......................................................................................18

Deploy with "Download all content locally before starting task sequence"......................................18

Deploy with "Download content locally when needed by running task sequence" .........................19

What happens to the Cache Data during a push of the OS? ....................................................................23

In place OS upgrade is coming, is my Cache safe? ...................................................................................23

Hash Versions and WinPE .............................................................................................................................23

Cache Versions and WinPE ...........................................................................................................................23

Working around the Cache Versions............................................................................................................24

2



Can I re-use my already Distributed Content? ............................................................................................25

Setting up Pre-Caching .......................................................................................................................................25

Setting Up Cache-Injection ................................................................................................................................25

Using the new Downloader Program................................................................................................................26

Configuring BranchCache support in Task Sequences ............................................................................26

Use BranchCache on Windows Pro..............................................................................................................27

Using an Alternate Content Provider ...........................................................................................................28

Implementing the ACP ...............................................................................................................................29

Example Implementation...........................................................................................................................30

Retrieving information from the ACP & BCEnabler.exe ............................................................................33

MDT Deployment with BranchCache ...............................................................................................................36

Custom WinPE Language...................................................................................................................................37

3



BranchCache for OSD 1.4.0 Release Notes This is the 1.4 release version of both documentation and executables, future binaries and capabilities might differ greatly. For worse or hopefully for the better. This is a work in progress solution.

When using ConfigMgr build 1511 the default OSD Images are using Windows 10 version 10240 and not build 10586 which is the latest Windows 10 release. ConfigMgr currently does not support the ADK for version 10586 due to some ussies in the Task Sequence. (If you are still using 10586 then you can ignore this comment and continue on your unsupported journey).

So for staying on the supported side you need to use build your OSD images with 10240, otherwise the generator .exe will error on inconsistent build numbers. Note: You can still deploy Windows 10 10586 with a WinPE version of 10240.

This release contains the following features:

1. BranchCache WinPE Generator - For creating BranchCache enabled WinPE Images

a. Both x86 and x64 versions available, and both should manage to create x86 and x64

images

b. The reason why x86 versions is available it there is no x64 server to run the

executable on.

2. BITS & BranchCache WinPE Enabler – For enabling BranchCache in WinPE task

sequences/command line deployments

a. Both x86 and x64 versions are included

b. These are automatically injected into WinPE versions created by the Generator tool.

c. Initializes BITS and starts depending services

3. iPXE Anywhere Client

a. Connects to iPXE Anywhere Service when built from 2PXE (Not included)

4. BranchCache BITS BranchCache Downloader with BITS & BC Integration (BITSFist.exe)

a. Both x86 and x64 executables are available, although x86 should work on x64 in most

circumstances as well.

b. Runs in both WinPE as well as full OS

c. Generates the same reporting structure if the BITS Reporter is on the system

Happy Caching!

//The 2Pint Team

4



Changes from 1.3.0.0 to 1.4.0.0 1. Education and all N versions allowed as media types.

2. Localized media is allowed and must match the bas WinPE boot image being used.

3. Better support for changing the default BranchCache port.

4. Cleaned up WinPE Generator output

5. Changed /Remove-iPXE to /Add-iPXE so not included by default

6. BITSFist resumes suspended jobs after 30 sec instead of 10mins

7. Bugs fixed in all components, especially with iPXE

8. Updated documentation around BITSFist

Changes from 1.1.0.0 to 1.3.0.0 1. Support for the 2Pint Software iPXE Anywhere Solution & 2PXE Service

a. The iPXE WinPE client is included by default so nothing to worry about.

2. Changed flags for WinPE Generator to include BITS & iPXE Client by default

3. Spelling, spelling, spelling and some grammar. Great thanks Steve Burkett for pointing them

all out, 1.0 was a bit rushed.

4. Structural changes for allowing some new features coming your way!

5. Support for Windows 10 from build 10240 and onwards. Bring on the builds!

Changes from 1.0.0.2 to 1.1.0.0

WinPE Generator: Added BITS components to WinPE to support bandwidth aware and scheduled downloads

from WinPE

Complete re-work of the code, improving speed and image dismount. Image creation now

takes 2mins!

Support for Windows 7 SP1-> WinPE 3.1 image creation with BITS & BranchCache

Support for Windows Pro media with BITS & BranchCache integration (No need for

Enterprise media)

Initial support for iPXE (Don't test this as it doesn’t work without the server Stifle:R

component)

Sorted bugs where image index was hardcoded... doh!

WinPE StatGen.exe added to all WinPE image generated.

Download Engine (BITSFist.exe) BITSProTSDL.exe replaced by ->BITSFist.exe

WinPEDL.exe replaced by ->BITSFist.exe

Added reporting for WinPE downloads.

Same tool for both full OS (Any version) as well as WinPE, allowing for BITS downloads for

ALL task sequences set to download on demand.

Sorted issues with BranchCache not starting on certain hardware.

5



BranchCache First Timer? If you are not familiar with BranchCache we recommend you to read our BranchCache page before continuing with this document as it covers several key factors of BranchCache.

http://2pintsoftware.com/microsoftbranchcache

Implementing BranchCache Reporting? The BranchCache Reporting is not covered in this document, please refer to the BranchCache Reporting documentation. The space below is intentionally left blank, feel free to draw something.

BranchCache and Task Sequences Script That can be found here: http://2pintsoftware.com/download/branchcache-task-sequence-enabler/

http://2pintsoftware.com/microsoftbranchcache

http://2pintsoftware.com/download/branchcache-task-sequence-enabler/

6



Using BranchCache for OSD Overview There are a few simple steps before you can start using BranchCache for OSD. The steps can be described as the following steps, regardless of what deployment method you are using:

1. Generating a WinPE image with Support for BranchCache

2. Changing your deployment sequence to enable the BranchCache components in WinPE

3. Optional, change your sequence to move the cache content from WinPE to the new

Operating System being deployed.

4. Optional, changing your deployment sequence to work with Image Downloads from a task

Sequence in Windows Professional

5. Optional, change deployment sequence to detect an existing BranchCache Cache location on

from within WinPE

6. Optional, implement reporting of BranchCache data

Note: This document focuses a little on MDT and Configuration Manager for deployment, but these should apply to any old deployment solution that uses WinPE for deployment and HTTP for downloads.

Note: This document does not cover the Bandwidth limitation/setting/configuration needed in order to make BranchCache and BITS work nicely together. Instead look online for that whitepaper: “Where are my BITS” on the http://2pintsoftware.com site, or use “them search engines” to find it.

http://2pintsoftware.com/

7



Generating a BC WinPE Boot Image Generating a new WinPE Boot Image is done via a command line utility. This utility requires you to have administrator rights on the machine where you run the tool. The reason for this is that it mounts registry hives from the offline media, a privilege that requires administrative rights. In a locked down environment this can be done on a standalone non domain joined computer.

Creating of Windows 7SP1/8/8.1/10 Update(s) version of WinPE is described in this document. For issues when generating access for Windows 7 versions of WinPE please email [email protected].

Note: Windows 8/8.1/8.1 Update 1 & 10 versions can still use Windows 7 version of BranchCache hashes. Read the sections around hash and cache in WinPE in this document. Windows 7 SP1 cannot use Windows 8 hashes.

The WinPE images created are then used as regular boot images in ConfigMgr or MDT, there is no difference to them except that they have BranchCache enabled.

Figure 1 shows WinPE images that have been enabled with BranchCache imported into ConfigMgr, ready for use.

The tool to create the BranchCache enabled images is a command line tool as shown below, the reason for this is that we know some people will want to automate this.

mailto:[email protected]

8



Figure 2 shows the default output from the command line if no variables are fed to the generator.

WinPE Generator Command Line Options The generator has the following options:

"Source.wim" – Is the full path and name of the OS source .wim file to use to get resource data.

Index – Is the index number of the source.wim to use, Professional or Enteprise.

"Boot.wim" – This is the full path and name of an existing WinPE boot WIM file

Index – Is the index number of the WinPE image to modify.

The following options can also be provided: /Add-iPXE - Adds iPXE Startup for WinPE, Image cannot be used with iPXE Anywhere

/Remove-BITS - Removes BITS For Bandwidth Policy Aware Downloads in WinPE

/Copy-BITSPolicy - Copies the local BITS policy into the WinPE Image, This overwrites the default BITS policy which is limited to 1Mb/s during business hours of Monday-Friday 8-17 and 2Mb/s during any other time. Ignoring speed limits on the local LAN = Full throttle for cached content. Use GPEdit to create a local BITS policy and this will then be copied automatically at build time.

Note: Boot wim file will be modified, so ensure you have a backup!

Note: Source.wim MUST BE ENTERPRISE using /Remove-BITS option!

Note: Index is the index number of the wim to use inside the .wim file, like DISM /Index:1 etc.

Generating the Boot Image Pre-Requisites The process requires access to:

1. A workstation or Server with Windows 7/2008 or higher (x86 or x64) to run the process on

which you are part of the administrator group on

9



a. Administrative access is required in order to mount the registry hives in the source

and boot media. This is a privileged operation which requires administrative access

to the machine.

2. Access to the 2Pint Software “BC WinPE Generator.exe”

a. This is freely downloadable from the website http://2pintsoftware.com as a part of

the BranchCache for OSD Toolkit.

3. A boot.wim image that has not been finalized,( i.e. allowing changes to be made to it)

a. This can be acquired either from the ConfigMgr server or MDT or also through the

WAIK/AIK directly.

4. Access to Windows source media of either Enterprise or Professional

a. The media can be either Windows 7 (For Windows 7 versions of WinPE) or Windows

8.x for more up to date WinPE versions.

b. This can be in the form of a DVD or ISO file, it can even be a captured WIM as long as

the “Windows” directory exists on one of the indexed images.

c. NOTE: The media does not have to be Enterprise, but Professional requires BITS

added in order to provide BranchCache functionality. Enterprise media adds native

HTTP support for BranchCache.

Nothing else is really needed, so the process can be done on any machine. The generator does not install anything and stores/mounts temporary files in the %temp% folder of the user running the process.

Running the BC WinPE Generator The “BC WinPE Generator.exe” is available in both x86 and x64 versions. They are installed with the BranchCache for OSD to the default location of “%PROGRAMFILES%\2Pint Software\BranchCache for OSD”. If you do not want to run the executable from that directory you can freely move around the executables, they have no dependencies and can be copied to other machines etc.

1. Start the process by launching a command shell. Navigate in the prompt to the path where

the “BC WinPE Generator.exe” file is located.

2. Run “BC WinPE Generator.exe” without any command line arguments to see the parameters

available.

3. To create an Image type in the path of the BC WinPE Generator executable and the required

parameters as the example below: “BC WinPE Generator.exe” “C:\Temp\Windows8Ent\Sources\install.wim” 1 “C:\Temp\boot.wim” 1 s

4. Press Enter to start the process

5. The Generator will show progress as it mounts and customizes the boot image for you. The

program will then output the process progress on the screen, any errors encountered will be

visible on the screen.

6. Done! 7.

http://2pintsoftware.com/

10



Example Generation Preparing The following explorer window shows the setup of files in this example. We have copied the x64 generator executable to the C:\Temp\ folder

The file we are generating the image from is this:

Figure 3 note that the source media can be a DVD image mounted with the Sources\install.wim or any other wim file with the correct architecture, version and folder structure.

Here is the example command line:

Figure 4 shows the command line for running the generator.

11



Running the Generator

Hint: If you want to script this you can save the output by redirecting the standard out to a text file with the > character from a prompt (note that the > characters piping function is a function in cmd.exe so the command prompt has to be fired as well, like:

Cmd.exe /c “BC WinPE Generator.exe” “C:\Temp\Windows8Ent\Sources\install.wim” 1 “C:\Temp\boot.wim” 1>C:\MyLogfile.txt

When that kicks of you should see something like this:

Finished the Generator Run-through If all goes well, the sun is shining and Saturn is aligned with Mars it will generate a boot.wim for you and you will see the output as per below:

Figure 5 shows the completed task of generating the boot images.

The process of adding the new boot image to your deployment method is out of scope for this document. But it’s pretty simple, just right click the Boot Image node in ConfigMgr and select “Add Boot Image” and provide the details to your boot image.

Enabling BranchCache in the Deployment Once you have a BranchCache enabled WinPE image in your deployment solution it is time for editing the sequence to allow start of BranchCache and configuration of the Cache Location.

Note: You cannot use WinPE RAM Drive (X:) as the Cache Location for obvious reasons, trying to do so will result in a Cachemgr Blue Screen of Death (BSOD). So don’t do it!

12



The process of enabling BranchCache can be split into 2 steps:

1. Enabling BranchCache, setting the right location for Caching, Hash Version to use and Port

2. Moving the BranchCache over to the new machine, so that downloaded data is not lost when

leaving WinPE. This way machines can still server others while the OSD process finish.

3. Future: Adding in Download engine for pure MDT shops

Advanced Tip: In the future we will also detect existing caches on hard drives offline in WinPE. However, this can be done today by a script if required, just detect and do a file move/copy depending on your OSD setup or simply point the cache location to this path.

The tool shown below enables/moves the BranchCache in WinPE.

Figure 6 shows the command line tool BCEnable.exe's help output.

13



Enabling BranchCache in a Deployment Sequence This section covers how to implement for Configuration Manager, but the concept is the same for MDT except for the Download part.

The “BC WinPE Generator.exe” puts a little executable called “BCEnabler.exe” into the Windows\System32 directory of the WinPE image. This can then be called from the task sequence to perform certain actions.

BCEnabler runs with either the “Enable” command parameter + options or the “Move” command parameter + options.

Usage for Enable Typical Command line: BCEnabler.exe Enable CachePath [BCVersion] [BCPort] where:

CachePath: Full path to the new location for the cache, cannot be located on a RAM drive like X: but USB media works fine as long as it’s an NTFS drive.

BCVersion: Number of the version to be used, 2 for Windows 8/10 support and 1 for supporting Windows 7. If you don’t specify a version it will use the default for that WinPE version that you are using, i.e. 1 for Windows 7 and version 2 for anything else.

BCPort: Number of the port to be used. 80 is default and can be omitted if the default port is used.

Usage for Move Typical Command line: BCEnabler.exe Move NewOSDrive [NewNonDefaultCachePath] where:

NewOSDrive: Drive letter (C:) to the drive letter containing the new operating system without colons. Exampel is C or %MYDRIVELETTER% in a valid ConfigMgr drive letter.

NewNonDefaultCachePath: Full path to the new location for the cache like D:\MyCache

Note: The path might not be the same on the new computer, so use environment variables if possible.

Example command lines Some typical Enable command line examples:

Example: BCEnabler.exe Enable %_SMSTSMDataPath%\BCCache

Tthat would use the ConfigMgr variable of the

Typical Move Command Line Examples:

Example: BCEnabler.exe Move %OSDTargetSystemDrive%

Example: BCEnabler.exe Move %OSDISK%

Note: Don’t specify default path Windows\ServiceProfiles\NetworkService\AppData\Local

Advanced Command Line Examples: Example: BCEnabler.exe Enable %_SMSTSMDataPath%\BCCache 2 443

Example: BCEnabler.exe Enable "D:\Cache\My Cache" 1 81

Example: BCEnabler.exe Move %OSDISK% "D:\New Cache"

Example: BCEnabler.exe Move %OSDISK% "%OTHERDRIVEVARIABLE%:\New Cache"

14



Example: BCEnabler.exe Move %OSDISK% "%SystemDrive%:\MyBananaBoat"

Running BCEnabler.exe in a WinPE session In your deployment sequence, add a step as early as possible to add BranchCache support. Where this is, depends on your sequence. In this example we have a very simple task sequence and a MDT enabled ConfigMgr sequence.

BCEnabler uses the following parameters when Enabling BranchCache:

BCEnabler.exe Enable <Path> <Version> <Port>

Note: If you want to specify port you have to also specify Version.

Add a “Run Command Line” step and type in the command line:

BCEnabler.exe Enable %_SMSTSMDataPath%\BCCache

This will enable the BC components and also set the new Cache Location to the variable defined in %SMSTSDIR%. We strongly recommend using paths, see the section on paths in this document for more info.

The path specified does not have to exist, but be aware of paths that changes the ownership like the C:\_SMSTaskSequence directory, if you are moving things into this folder it has to be done as a part of the sequence.

Figure 7 shows the Enable step in the task sequence that starts the BranchCache components. As you see it runs directly after the Partition step, allowing caching to start as soon as the disk is active.

When BCEnabler.exe runs it logs all actions to the %WINDIR%\Temp folder, which is typically the X:\Windows\Temp folder when running under WinPE.

15



Figure 8, you can run the BCEnabler.exe on a regular full OS to check the syntax, but it typically runs under WinPE.

Figure 9 shows the BCEnabler.exe command running as part of the Task Sequence.

Running BCEnabler.exe in a Full Windows OS BCEnabler is designed to run in WinPE and should not be used to enable BranchCache in a full OS environment.

16



Using the BCEnable Move Command to Save the Cache Once feature of BCEnable.exe is that it can also move the cache location to another path as a last step in the sequence. It doesn’t have to be the last step but has to be performed after the disk and imaging tasks are complete to avoid accidental deletion.

The steps performed by the Move commands are:

Stops the BranchCache Service

Creates Folder Structures for the new folder path

Moving the physical Cache Files to the new location (default under Windows directory unless

specified on the command line)

Transfers the BC Cache encryption key from WinPE to the full OS so that the cache can be

retained

Writing new paths for the target Operating System if other cache location is used (Not

recommended)

Writes policy registry keys to allow Firewall exceptions for BranchCache and BranchCache

startup (Same policy as specified on the Enable command line)

Writes an “Automatic Startup” registry keys for BranchCache in to the new OS.

Transferring the Firewall policy keys to allow the BranchCache service to serve others during

the rest of the build process.

Writing new cache paths for the WinPE BranchCache process to continue to work

Enables the startup of BranchCache during the OSD Process

Starts the BranchCache Service to serve the last pieces of the ConfigMgr TS that downloads

the CCM client etc.

For ConfigMgr the best variable is %OSDTargetSystemDrive% which comes as an output from the Apply Operating System step. Actual installation of Windows is started by the Setup Windows and ConfigMgr task sequence step. After the Apply Operating System task sequence action has run, the OSDTargetSystemDrive task sequence variable is set to the drive letter of the partition containing the operating system files.

More information is available here: https://technet.microsoft.com/en-us/library/6b116f87-a1df-4194-ad57-f01d797b7d13#BKMK_ApplyOperatingSystemImage

If you don’t have ConfigMgr and is using the standard MDT Task Sequence the %OSDISK% is a valid variable that can be used.

https://technet.microsoft.com/en-us/library/6b116f87-a1df-4194-ad57-f01d797b7d13#BKMK_ApplyOperatingSystemImage

https://technet.microsoft.com/en-us/library/6b116f87-a1df-4194-ad57-f01d797b7d13#BKMK_ApplyOperatingSystemImage

17



Figure 10 shows how to add a BranchCache Move step, note that it’s the last step in this Task Sequence. It doesn’t have to be that, it just has to be after the Apply Image Step.

Consideration when moving the Cache Please note that the Cache format is per OS version, and it significantly changed both from Windows 7 to 8 and from 8 to 8.1 and 10. However, upon BranchCache service startup, any Windows 7 or Windows 8.0/8.1 cache (present in the configured/default cache location) is automatically migrated to the current/latest format.

So once the cache is configured + dropped (Basically using the “BCEnable.exe Move” command) into the Windows 8.1 expected location, then it is fully expected that the cache is automatically picked-up and imported/migrated to the most recent format.

This has some implications, since there is no backward compatibility on dropping the Cache from a Windows 8/8.1 to a Windows 7 machine. In that case a Windows 7 Boot image should be used. Since Windows 7 is several years’ old and most new machines today get images with 10 this has not been a focus area for us, so might lack some testing. If you find is a showstopper to you, please let us know through [email protected] and we will see what we can do.

A few little comments on Paths Keep in mind that logical drive letters might change from what they are in WinPE to what they are in the full Windows installation. I.e. WinPE might deploy the OS to E: and the final system drive will be visible as C: in Windows. It’s not rocket science to then understand that if you specify a cache location with the BCEnabler.exe Move command, pointing the cache to D:\MyCache it might be E:\MyCache in Windows. To avoid this, keep one partition for Windows and put the cache on there.

Use variables as long as you can. But keep in mind that even variables are not forever.

Add steps to update the paths in the Full OS in case you need to, the cache location paths are stored in sub keys here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\CacheMgr

As Reg_Expand_Sz type registry keys, typically pointing to %Variable% locations. Default = No entry.

Defaults are good. Don’t change the defaults unless you have to. Keep it Simple Stupid. KISS, don’t make it overly complicated and keep the default cache location.


18



Deploying Computers With BranchCache The BranchCache for OSD toolkit is meant to integrate fully with your existing task sequence deployment in ConfigMgr. There are no limitations of what you can do, all options in ConfigMgr are available for you.

If there is something that you feel is missing, then please let us know by email [email protected]

To Cache or not to Cache - That Is The Question There is no requirement to Pre-Cache content before deploying a computer, the only benefit is that the download process will of course be shorter. Also there might be a policy in place, limiting bandwidth during office hours.

Keep in mind that all Task Sequences executed by users run under the "Foreground" BITS policy, which is not by default bandwidth limited from ConfigMgr. There are other reasons why you shouldn’t use the built in policy for BITS in ConfigMgr since local peer network sharing is also capped by that policy.

There are 2 ways of deploying a task sequence when it comes to downloading, the names of the settings explain quite well what they’re about:

Download content locally when needed by running task sequence

or:

Download all content locally before starting task sequence

Both options are explained in detail below.

Deploy with "Download all content locally before starting task sequence" This setting is typically only used when pre-caching, as it downloads all the content locally. This means that every applications and package referenced by the task sequence will be downloaded locally. Mostly task sequences have conditions to control which packages apply, these variables are not evaluated; so all data is downloaded.

Why can’t I set the Download to download all content before executing? This is because the Deployment is also targeting PXE and media. Since there is no need to "Precache" or deploy to PXE/Media with the setting you can divide it into 2 separate deployments. One for Pre-caching/Deployment and one for Deployment for Full OS/PXE/Media.

The default setup for a TS deployment created to target PXE & Media as well as the full client is to "Download content locally when needed by running task sequence".

This is the default settings visualized:


19



Figure 11 shows the default values of the Deployment Settings.

With that setting you cannot change the Distribution Point settings:

Figure 12 shows that the Deployment Options cannot be changed when the PXE & Media target flag has been set.

So if you want to pre-cache content you need to change the flag. The recommended way of doing this is by adding a second Deployment, which is solely used for pre-caching tasks.

Deploy with "Download content locally when needed by running task sequence" This is the recommended setting when you are deploying live systems as each task sequence step is evaluated and only the required data is downloaded. This speeds up the process when the TS is running, and since most data should be available locally the process should be fairly quick. But in order to avoid to load all driver packages on all machines you can then filter them out by using the deployment variables as conditions.

20



The default setup for a TS deployment created to target PXE & Media as well as the full client is to "Download content locally when needed by running task sequence". In order to change that you need to change the Deployment option “Make available to the following:” in the deployment properties. Change it to “Only Configuration Manager Clients” and click Apply.

The figures below will show the setting in the User Interface:

Figure 13 shows the default value, select the dropdown to change the value.

Figure 14 shows the available values, change it to "Only Configuration Manager Clients".

When you have changed the value (Note: Don’t forget to hit the Apply button before switching tab) you can go to the Distribution Points tab and change the setting.

21



Figure 15 shows the available options have changed as PXE & Media is not set.

With this setting you can now pre-cache the entire content. Please make sure you have a valid condition on the Task Sequence as per the picture below, otherwise the sequence will actually run. In the example below the PreCache variable is checked on the top folder, causing the underlying TS to not be executed. Since the download is initiated before the task sequence starts it will download all content, start the task sequence and then exit out as the PreCache variable is set.

Figure 16 shows how the PreCache variable should not exist for the TS to run.

You can use whatever mechanism of your liking to set the PreCache variable, as an example either you use a Machine Variable or a Collection variable. The best way is probably to have a collection of your “best targeted” desktop systems with one or two machines per branch selected with a dynamic query.

22



Figure 17 shows an example of setting the PreCache variable on a collection.

23



What happens to the Cache Data during a push of the OS? The content that is downloaded into the old Windows platform is not saved by default. This is for the reason that we don’t know whether the disk will be reformatted or not. Most packages will however be downloaded from other peers and then injected into the cache again, ensuring that many machines has the majority of the packages cached. If you require the cache to be migrated there are few simple steps that that needs to be done.

1. Ensure that WinPE is of the right version, read more below about:

a. Hash Versions and WinPE

b. Cache Versions and WinPE

2. Ensure that the Format & Partition step has conditions on it

3. Ensure that the new OS supports this upgrade (You cannot go back in Cache format)

In place OS upgrade is coming, is my Cache safe? You should be, since the BranchCache Cache can be upgraded from 7->8->8.1 it's safe to assume it will work well migrating to Windows 10 as well. And since the disk is not reformatted during an upgrade the cache data should just follow the upgrade.

Hash Versions and WinPE The BranchCache for OSD components in WinPE can use the same feature as the full OS, and downgrade the Hash Version to V1 (Windows 7 & Server 2008). This means that Windows 7 machines can serve the WinPE downloads with content. Choosing V1 Hashes removes the De-Dup functionality in BranchCache. Since De-Dup and other V2 features greatly enhance BranchCache it’s worth skipping V1 if you can. Remember that you only need one V2 machines to server the branch during OSD, so for as long as the OSD process goes, you should always use V2. But for regular deployments and in order to avoid 2x downloads over the wire it might be worth going with V1. 2Pint Software recommends going with V2 directly if you can.

Upgradability of hashes is the same as cache content mentioned below.

Cache Versions and WinPE Most people use Windows 8.1 WinPE to deploy their desktop systems today. It's very likely that this will be the case for future deployments as well, that WinPE is of a higher version than the operating system being deployed. With that in mind it’s good to know that Cache information can only be migrated to the same or higher versions of the OS.

This means that if you are using WinPE of build 9600 (Windows 8.1) to deploy Windows 7 (Build 920/1) the Cache that is generated under WinPE cannot be successfully migrated to the new OS. Even though you run the Cache Enabler tool with the Move command, the new OS will not understand the new Cache format and re-initiate the Cache. This is the case even if you are using the V1 Hash format, Cache format and Hash format are not the same.

In order to avoid this, you have to deploy your Windows 7 machines using a Windows 7 version of WinPE. The WinPE Generator tool should create Windows 7 Boot .wim files as well. If you are deploying Windows 8.1 with an 8.1 WinPE then the cache is updated.

24



The following WinPE Versions are available and work with BranchCache for OSD:

Version Comment Build 3.0 Built from Windows 7 code base. It is included in WAIK 2.0. 9200 3.1 Built from Windows 7 SP1 code base. It is included in Windows Automated

Installation Kit (AIK) Supplement for Windows 7 SP1 available from Microsoft's website.

9201

4.0 Built from Windows 8 code base. It is included in Windows ADK (Windows Kits 8.0) and available from Microsoft's website.

5.0 Built from Windows 8.1 code base. It is included in Windows ADK (Windows Kits 8.1) and available from Microsoft's website.

9600

5.1 Windows ADK (Windows Kits 8.1 Update) includes 5.0 and user applies update 5.0 to 5.1 manually.

6.0 Is the release version of WinPE for Windows 10. 10240

The following upgrade paths in green work, and the ones in red does not work:

Old Operating System WinPE Version New Operating System Windows 7 3.0 Windows 7 Windows 7 3.0 Windows 7 SP1 Windows 7 SP1 3.0 Windows 7 SP1 Windows 7 SP1 3.1 Windows 7 SP1 Windows 7 SP1 4.0 Windows 7 SP1 Windows 7 SP1 5.0 Windows 8 Windows 8 3.0 Windows 8 Windows 8.1 5.0 Windows 8.1 Windows 8.1 Update 5.0 Windows 8.1 Update Windows 8.1 Update 5.1 Windows 8.1 Update Windows 7 SP1 5.0 Windows 8.1 Windows 7 SP1 5.1 Windows 8.1 Windows 7 SP1 6.0 Windows 8.1 Windows 7 SP1 6.0 Windows 10 Windows 7 SP1 5.1 Windows 7 SP1 Windows 8.1 6.0 Windows 10 Windows 10 6.0 Windows 10

Working around the Cache Versions There are 3 ways of dealing with a Cache version mismatch:

1. Create a "save" copy that will be used in the new full OS after it has been deployed.

2. Do a "Download all content before..." as the ConfigMgr client will keep the Cache during the

OSD process it can then be used to inject into the new full OS.

3. Do nothing. As most machines are likely to have bits and pieces of the OSD packages it might

just work well enough anyway.

One way of dealing with the Cache Version mismatch is to create 2 copies of the Cache. If you start in Windows 7 and end up with a new Windows 7 you can save that cache in 2 copies. One for the WinPE part (which will be upgraded but still used and thrown away after the PE phase) and then one copy for the new OS. We will cover this more in detail in the upcoming versions of the BranchCache for OSD releases.

http://en.wikipedia.org/wiki/Windows_7

http://en.wikipedia.org/wiki/Windows_Automated_Installation_Kit

http://en.wikipedia.org/wiki/Windows_7_SP1

http://en.wikipedia.org/wiki/Windows_8

http://en.wikipedia.org/wiki/Windows_8.1

25



Can I re-use my already Distributed Content? If you have already deployed/distributed lots of packages/applications/images out there, yes, instead of clearing out the ConfigMgr Client Cache you can inject all of that data into the BranchCache Cache. This also applies to other third party caching software or hardware. As long as you have physical access to the files themselves in a readable format, you can inject them into the cache.

The same applies if you have a Distribution Point that you would like to remove, simply inject the data into the caches instead.

Note: In order to inject data into the Cache you need to have the server secret available, otherwise data will not be able to be shared with other clients on the subnet. Contact 2Pint Software for more information.

Setting up Pre-Caching Setting up Pre-Caching is really a one minute job, it is that simple. You just have to keep the following in mind:

1. All content of the Task Sequence will be downloaded to the ConfigMgr client cache as well

a. This means that a Task Sequence referencing 20 GB of data will generate 40GB of

disk space without de-dup taken into consideration

2. The Task Sequence will run, so ensure that you did set a Variable Condition

3. The ConfigMgr client will start caching as soon as the policy has been received of a run time

in the future IF the task sequence policy has not been received before.

Setting Up Cache-Injection Cache Injection is a technique where content that is already available on the remote machines is injected into the cache. It is only your imagination that stops you from thinking of Cache Injection actions.

The following injections can be done:

1. Injecting the ConfigMgr client cache into the BranchCache

2. Injecting the Office Offline installation media into the Cache

3. Creating a .wim of the local machine and injecting it into the cache

4. Injecting the entire hard drives every file into the drive

The last two ones are obviously great for de-dup. Contact 2Pint Software if you are interested in this as we have some upcoming tools in this area.

26



Using the new Downloader Program BranchCache works for Task Sequences in the full OS when they are set to "Download all content locally before starting task sequence", since they are then scheduled via BITS. The BITS downloader supports BranchCache on all operating systems. So that is not an issue, when the Deployments are set to "Download when required" only Enterprise clients are using BranchCache if the Task Sequence Deployment has been configured so, since they have native HTTP support for BranchCache and the Task Sequence uses HTTP to download content.

Note: The TS Deployment configuration is done via a PowerShell script as this is not configurable in ConfigMgr. See the next section for details.

On Windows Pro machines, something has to be done in order to make "Download content locally when needed by running task sequence" BranchCache enabled. This is done via the 2Pint Software BITS BranchCache for Windows Pro executable. This can be seamlessly integrated into any ConfigMgr 2012 task sequence deployment via the use of the Alternative Content Provider support.

At first we made a stand-alone downloader for the Windows Pro machines using a standalone (same as WinPE) engine, however, we changed half way and wanted to use the BITS engine instead in order to use bandwidth policy etc. This tool is also included in the BranchCache for OSD kit.

You only need to set a Task Sequence deployment ConfigMgr SP1/R2 alternative downloader provider if the Windows OS version is Pro, Enterprise is fine and does not need it.

Note: If you want to use the same downloader on Enterprise in order to use BITS bandwidth mechanism there is nothing stopping you.

Configuring BranchCache support in Task Sequences In regular Software Deployment items such as packages and Applications you have a Checkbox on the 'Distribution Point' tab like this:

Checking this box means that BranchCache can be used to share content with other clients on the subnet.

In Task Sequences however, this checkbox isn't there, so we've included up a PowerShell script that can be used with a Status Filter Rule (or standalone if you prefer) to set the parameter that's required. This will enable your Task Sequence content to be downloaded via BranchCache. The script can be found in the \Scripts folder – setadvertflags.ps1

To deploy this script and create a Status Filter Rule, follow the steps below.

Create a folder and copy the setadvertflags.ps1 file in there. In this example the folder is called c:\MyStatusFilterRules – You can of course call it what the heck you like.

27



In the Configuration Manager Console, navigate to Administration > Overview > Site Configuration > Sites.

In the Home tab click Settings > Status Filter Rules, click Create and the Create Status Filter Rule Wizard will show.

On the General page fill in your Rule Name e.g. Enable BranchCache For Task Sequences and select the following criteria:

Select Source and then select Server.

Select Message Type: Audit, and Message ID and fill in 30006 which is the Status Message for the creation of a Deployment.

As the 30006 message covers other deployment types such as Regular Package, Driver Install etc., the script checks that it is indeed a Task Sequence (PackageType=4), so will only enable BranchCache for Task Sequences.

In the Action tab, set the Program to:

"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" "set-

executionpolicy bypass"; "c:\MyStatusFilterRules\setadvertflags.ps1

'%msgsys' '%msgsc' '%msgis02'"

This runs the script with the Computerame, Sitecode and AdvertID arguments. All being well – you should see a logfile with a line for each successful run of this script.

IMPORTANT: If a Task Sequence Deployment is edited after being BranchCache enabled by the script - the setting will be lost. To work around this, you need to set a second Status Filter Rule as above, but with Message ID 30007. This will persist the BranchCache setting even if the deployment settings are changed.

Use BranchCache on Windows Pro As already mentioned, Windows Pro only support BranchCache through BITS, or any other third party program communicating with BranchCache directly. This means that the "Download all content locally before starting task sequence" settings on Task Sequences Deployments force the use of BranchCache as they are then downloaded by BITS before the task sequence is executed.

The snag with that setup is that ALL packages referenced by the task sequence are downloaded, even packages that have conditions on them, as the download engine cannot know which packages that will apply. To get around that issue, you can set the Task Sequence deployment to: "Download content locally when needed by running task sequence", which makes the task sequence start and only download packages when the conditions have been evaluated.

The issue with this setup is that the Task Sequence downloader does not use BITS, but its own download engine.

This means two things:

1. Downloads are NOT throttled and likely to fail over bad WAN pipes.

2. Downloads are NOT BranchCache enabled on Windows Pro machines as it has no native

HTTP support for BranchCache.

The 2Pint Software BITS BC TS Download component solves this by:

28



1. Using an Alternative Content Provider (Extension provided by Microsoft to allow third party

download providers)

2. Redirecting all Downloads to BITS with BranchCache support & bandwidth management

When running a task sequence with the Alternative Content Provider (ACP) all downloads are first tried with the ACP, if it returns an error or if the data is not valid the regular built-in downloader will try again.

Figure 18 shows a Windows Pro Machine Downloading packages in a task sequence using BITS & BranchCache. Although scheduled to run at 1Mb/s it caching local content at 61Mb/s from already cached content from its peers.

Using an Alternate Content Provider This information is available in the following knowledge base article: http://support.microsoft.com/kb/2744420

This article describes an update to support Alternate Content Provider in Task Sequence in System Center 2012 Configuration Manager. In an operating system deployment scenario, distribution point locations that are stored in task sequence variables are currently inaccessible to Alternate Content Provider. Therefore, applications that are written to use the Alternate Content Provider APIs in System Center 2012 Configuration Manager are affected. To support Alternate Content Provider in Task Sequence, this update introduces the SMSTSDownloadProgram task sequence environment variable. The SMSTSDownloadProgram task sequence environment variable is specified as follows:

29



A predefined environment variable that contains the path of the downloader program (.exe file) will be set in the SMSTSDownloadProgram task sequence environment variable.

We recommend that you make the downloader program available on the boot image. Therefore, the downloader program can be run securely.

During the download process, the task sequence download library will check the environment variable to verify that there is a defined downloader program. If there is, the program will be used to perform the download.

The following command line parameters will be passed to the external downloader program:

Package ID

Absolute path of the download folder

Notes

The Configuration Manager client expects at least one location. The location will be passed to the Alternate Content Provider because it can use the Configuration Manager Distribution Point in certain situations.

The Alternate Content Provider can return a fallback code or an error code. When a nonzero code is returned, the Configuration Manager client will fall back to Content Transfer Manager and Data Transfer Service.

Alternate Content Provider will work only in a Task Sequence.

Implementing the ACP This is an easy task that is done in a minute. First, find the appropriate place to put the step that enables the Task Sequence ACP. Normally this would be one of the first actions, before any Packages are referenced, i.e. downloaded, to ensure that all content is downloaded using the new downloader. When you found the place you add a “Set Task Sequence Variable” action from the Add menu. Then give it a name of your liking and set the Task Sequence Variable name to: SMSTSDownloadProgram and set the Value to BITSFist.exe.

Then you need to ensure that the executable is reachable on the machines that you need to run this on. This can be done by either putting the executable in a separate package/program and distribute to all machines before reimaging or copy it to the machine as a part of the task sequence. In order to be safe you can do both, distribute the executable to all systems but also add a step in the task sequence to add it to Windows if it’s missing.

That’s it, you are done!

30



Example Implementation For your guidance the setup is visualized as below. Let’s start by updating the Task Sequence to use the new “Alternative Content Provider” (ACP) by setting a task sequence variable.

Figure 19 shows the Alternative Content Provider solution.

Adding the “belt + buckles” step to make sure that the BITSFist.exe is on the system and can also upgrade old versions of the downloader if needed.

Figure 20 shows an example on how to ensure that the downloader is available and the right version.

31



The action above should run with a package set as the source. If you only want the downloader to use BITS on Windows Pro machines you can set a condition to execute only on machines where the EditionID flag in registry is set to “Professional”. This means however that all Enterprise jobs will download at full speed, bypassing any throttling limits set by BITS, as the Task Sequence downloader is not bandwidth aware. So it’s better to run it on all machines.

Figure 21 shows how to set a condition on the downloader variable step to only execute if it is a Windows Professional machine.

When the Task Sequence executes the downloader executable will be called and it will start the download for you. The downloader updates the Task Sequence progress bar accordingly. The following picture shows it in action:

Figure 22 shows the downloader in action, showing number of files and number of Bytes left to download.

The Downloader creates BITS jobs for each package that is requested by the task sequence. This can be verified by running BITSADMIN.EXE or PowerShell cmdlets to list the download jobs.

32



Figure 23 shows BITSADMIN listing active downloads when the Task Sequence is running.

Figure 24 shows the event logged by BITS after a download. Note the BranchCache data information. With the 1.1 release the job title has changed to the default “CMDTS Job” and is not like above.

The Downloader also reports BITS events that are picked up by the BITS BC Reporter engine if installed.

33



Retrieving information from the ACP & BCEnabler.exe When BITSFIST and BCEnabler run then write some key information to the registry. This happens in WinPE as well as the full operating system.

The information is written to the HKLM\Software\2Pint Software key.

Under the BCEnabler key the following values are written:

Port for BranchCache to operate on. If the default port is used this will show 80 (decimal).

Version of BranchCache under the PreferedContentInformationVersion value. Unless specified this will show 2 for a Win8 or later WinPE or 1 for a Win7 (3.1) version of WinPE.

CacheRootFolder is the directory under which the cache data is stored.

Figur 1 shows the port and path to the files being used by BranchCache. These are updated at bot Enable and Move steps.

The ACP writes package information for each key under the BITSTS key.

34



Figur 2 shows the generic info written under the main key. Each package then has its own key underneath the BITSTS key.

Then each package stores the following information from the BITS job to a key underneath the BITTS registry key. The name of the value is in the format of the ContentID like R1101234.

The data stored is:

Number of bytes from the DP

Number of bytes downloaded from peers (also de-duplicated data)

Total bytes of the content

Total bytes downloaded

Number of files in the content

Number for files transferred in the content

This data can be used to create custom action Etc. in the task sequence.

35



Figur 3 shows data and statistics for a package being downloaded.

For troubleshooting you can get the stats of a package as it downloads from the registry. If no data is coming from BranchCache check the other clients and firewall settings.

Another good thing to check is “netsh.exe branchcache show status all” while the download is happening. If data is getting into the cache but not from BranchCache its likely to be a firewall/port issue. Given that the other clients have the same data in the cache.

To view the attempted network connection type “netstat –n”, it should list the attempted BranchCache connections.

36



MDT Deployment with BranchCache MDT integration is coming to BranchCache for OSD in the future. If you are interested in using BranchCache for MDT deployment please let us know by contacting us on [email protected]


37



Custom WinPE Language Customizing the Boot Image with Non-Default (EN-US) language options is supported but requires access to source media with the same language.

For more information on how to create a localized image please review:

https://msdn.microsoft.com/en-us/library/windows/hardware/dn938382(v=vs.85).aspx

Example of command lines using DISM.EXE to create a Swedish WinPE version:

copype amd64 c:\temp\win10amd64

dism.exe /mount-wim /wimfile:C:\temp\win10amd64\media\sources\boot.wim /index:1 /mountdir:C:\temp\win10amd64\mount Dism /Add-Package /image:C:\temp\win10amd64\mount /PackagePath:"C:\Program Files (x86)\Windows Kits\10\Assessment and

Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\sv-se\lp.cab"

Dism /image:C:\temp\win10amd64\mount /set-allIntl:sv-se

REM Dism /image:C:\temp\win10amd64\mount /Set-UILang:sv-se REM Dism /image:C:\temp\win10amd64\mount /Set-SysLocale:sv-se

REM Dism /image:C:\temp\win10amd64\mount /Set-UserLocale:sv-se REM Dism /image:C:\temp\win10amd64\mount /Set-InputLocale:041d:0000041d REM Dism /image:C:\temp\win10amd64\mount /Set-TimeZone:"W. Europe Standard Time "

dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment

and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\winpe-wmi.cab" dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment

and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\winpe-scripting.cab" dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment

and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\winpe-wds-tools.cab" dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment

and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-SecureStartup.cab"

dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\sv-se\WinPE-SecureStartup_sv-se.cab"

dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\sv-se\WinPE-WMI_sv-se.cab"

dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\sv-se\WinPE-Scripting_sv-se.cab"

dism.exe /image:C:\temp\win10amd64\mount /add-package /packagepath:"C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\sv-se\WinPE-WDS-Tools_sv-se.cab"

dism.exe /unmount-wim /mountdir:C:\temp\win10amd64\mount /commit

Running the generator is the same as a regular English version, but it will show the non-default language. If the language is not matching the WinPE version it will error.

https://msdn.microsoft.com/en-us/library/windows/hardware/dn938382(v=vs.85).aspx

38



2pint software branchcache for osd · waik/aik directly. 4. access to windows source media of...

Documents