Showing posts with label Windows 8. Show all posts
Showing posts with label Windows 8. Show all posts

Monday, October 28, 2013

Windows 8.1 Exhibits Gaming Performance Deficit

Microsoft just released Windows 8.1, and with that I subjected the latest version of the operating system to some gaming performance testing. The results illustrate a small decline in the performance of Windows when moving from 8.0 to 8.1.



System as Tested


  • Asus z87-Pro Motherboard
  • Intel i7-4770k @ 4.7Ghz/4.4Ghz Uncore
  • Corsair Dominator Pro 16GB (8x2) @ 2133, 10-11-11-27
  • Nvidia 670 2GB @  995/3204
    • ForceWare 320.49 on both 8.0 and 8.1
  • Sound Blaster ZxR Rendering in 5.1
  • "Upgrade Install" of 8.1 from 8.0. 8.0 was installed fresh. 
  • All drivers the same 
  • App/Service footprint nearly identical

Testing Methodology


For the last 13 years or so, I've used a benchmarking script to test gaming performance. This script performs automated testing and logs results from each game to a central file. The script runs each game n (i.e. as many as I would like) times and then generates a median (rather than average). I have added games to this periodically since its inception.

I say all this because you'll notice there are a few old games listed. I have found including these results useful to judge CPU/Memory performance and identify bottlenecks specific to different APIs.

For these tests, each game was run at least three times (most more) for each set of settings. There are 4 tested settings that apply to most games: 4xAA/16xAnisotropic filtering, 0x/0x, and all combinations thereof. Normally these results would be split, but for the purposes of this platform comparison they have been combined. Bioshock Infinite does not support any AA, so that is not affected by the AA setting. All tests are performed at 1600x1200 which maintains compatibility with the older titles and while being a less than ten percent deviation from the 1080p effective pixel count.

For the first set of results there were over 250 test runs. These runs have been compared in total between Windows 8.0 and Windows 8.1 on a per game basis to generate a % performance change.

Games tested as follows: (in order of age, oldest->newest)
  • Quake 3 (1999, OpenGL)
  • Comanche 4 (2001, D3D8)
  • Doom 3 (2004 OpenGL)
  • Serious Sam 2 (2005 OpenGL)
  • Company of Heroes (2006 DX10)
  • Crysis (2007 DX10 Very High Settings)
  • Dirt 2 Ultra (2009 DX11Ultra Settings)
  • Alien vs. Predator (2010 DX11)
  • Bioshock Infinite Ultra (2013 DX11 Ultra Settings)
  • Unigine Valley (2013 DX11)

Results 


As illustrated in the bar chart below, the results indicate that Windows 8.1 lags in performance when compared to Windows 8.0 original release.



Game; All Scores Median of Multiple Runs 8.0 4xAA 16xAni 8.1 4xAA 16xAni % Diff 8.0 0xAA 0xAni 8.1 0xAA 0xAni % Diff 8.0 4xAA 0xAni 8.1 4xAA 0xAni % Diff 8.0 0xAA 16xAni 8.1 0xAA 16xAni % Diff
Quake3 904.4 904.73 0.04 912.37 910.97 -0.15 903.43 903.8 0.04 911.1 908.6 -0.27
Comanche4 198.47 198.5 0.02 198.53 198.97 0.22 198.33 199.87 0.78 199.5 198.93 -0.29
Serious Sam 2 486.7 469.6 -3.51 549.3 536.2 -2.38 521.5 507.5 -2.68 547.9 538.7 -1.68
Doom3 338 334.7 -0.98 473.2 472.1 -0.23 339.8 337.7 -0.62 468.5 472.7 0.90
Company of Heroes_DX10 261.55 246.5 -5.75 290.25 268.05 -7.65 267.3 248.7 -6.96 285.15 264.05 -7.40
Crysis_Island_DX10 63.06 62.12 -1.49 81.16 79.59 -1.93 66.03 64.73 -1.97 77.82 76.32 -1.93
Dirt 2 DX11_Ultra 129.46 127.62 -1.42 167.47 165.05 -1.45 142.65 139.97 -1.88 155.99 154.13 -1.19
Alien vs. Predator DX11 63 62.2 -1.27 110.3 108.6 -1.54 65.4 64.6 -1.22 104.6 103.3 -1.24
Bioshock Infinite Ultra_DX11 100.4 99.29 -1.11 99.73 99.11 -0.62 99.53 97.93 -1.61 100.2 98.48 -1.72
Unigine_Valley 58.63 58.28 -0.60 79.75 79.67 -0.10 60.13 59.08 -1.75 78.25 77.6 -0.83


While most percentages are relatively low, the trend appears consistent and the high sample size lends to the reliability of the data. I find this a bit troubling since there are no obvious reasons performance degradation should be introduced when looking at the 8.1 changes. Note there is still work to do; I'd like to get additional opinions including ATI results.

Now let's take a look at Futuremark 3dMark Advanced Edition. These tests were run through a couple times each and averaged. They were performed on default settings. (1080p/720p/720p)





3DMark Test win 8.0 win 8.1 % Diff
Fire Strike 6560 6502 -0.88
Cloud Gate 25138 24331 -3.21
Ice Storm 179351 176476 -1.60


Again, consistent downturns in performance.

This is where I was going to publish this article, but as my finger hovered over the "Publish" button I had one lingering concern: What if I'm wrong? What if I missed a setting or something in the upgrade that might have this impact?

So Then We Did it Over Again


I wouldn't feel right publishing this article without doing a clean install and absolute parity of all operating systems involved. For the sake of being complete, I included a Windows 7 install as well. What I found stunned me... 8.1 isn't the start of a downturn, it's a continuation. On a smaller subset of tests I performed the same amount of runs. (average of 14 runs per title) The operating system/drivers were as follows:

  • Windows 7 SP1 fully patched, clean install
  • Windows 8 fully patched, clean install
  • Windows 8.1 fully patched, clean install
  • Nvidia driver version 327.23 on all platforms
 Here are the results using Windows 7 as baseline:



As you can see, Windows 8.1 lags behind Windows 8 and Windows 8 lags behind Windows 7. This is a troubling trend. Here's 3dMark (at least 3 runs per test):



The "Fire Strike" test gives us the only real hope of progress in Windows 8, but Windows 8.1 gives that gain right back. Overall, more troubling results.

This, coupled with the lingering mouse and input issues make for a bit of a shaky upgrade to 8.1 from a gaming perspective. As I outlined in my previous article, I believe it's time for Microsoft to step up their game (hah!) in light of new market pressures. This trend is unfortunate since there are a lot of minor changes in 8.1 that are a step in the right direction. (UI, etc.) Let's hope they iron out this performance issue quickly.

Update (11/4/2013): It looks as if Microsoft has acknowledged the mouse issue which I expect means a fix would be coming. Let's hope performance and other issues are addressed as well.

Update (11/9/2013): Microsoft has released a patch to deal with mouse issues. 

Saturday, July 6, 2013

Manage the Windows Firewall with Powershell

With the release of Windows Server 2012 and Windows 8, Microsoft has begun issuing the following warning when using NETSH to manage the firewall:


In future versions of Windows, Microsoft might remove the Netsh functionality
for Windows Firewall with Advanced Security.

    
Sounds like a good enough reason to learn how to manage the firewall with Powershell to me. Fortunately Microsoft has made welcome improvements to firewall management in Powershell for version 3. Let's do it.


Assumptions


  • Windows 2012 or Windows 8
  • Administrator access to the machine in question
  • Powershell ran as administrator on the machine in question

CMDLets Involved


Powershell provides the following commands for firewall management:

Get-Command -Noun "*Firewall*"


Copy-NetFirewallRule
Disable-NetFirewallRule
Enable-NetFirewallRule
Get-NetFirewallAddressFilter
Get-NetFirewallApplicationFilter
Get-NetFirewallInterfaceFilter
Get-NetFirewallInterfaceTypeFilter
Get-NetFirewallPortFilter
Get-NetFirewallProfile
Get-NetFirewallRule
Get-NetFirewallSecurityFilter
Get-NetFirewallServiceFilter
Get-NetFirewallSetting
New-NetFirewallRule
Remove-NetFirewallRule
Rename-NetFirewallRule
Set-NetFirewallAddressFilter
Set-NetFirewallApplicationFilter
Set-NetFirewallInterfaceFilter
Set-NetFirewallInterfaceTypeFilter
Set-NetFirewallPortFilter
Set-NetFirewallProfile
Set-NetFirewallRule
Set-NetFirewallSecurityFilter
Set-NetFirewallServiceFilter
Set-NetFirewallSetting
Show-NetFirewallRule
As per normal, type get-help followed by the CMDLet name in question to get more information.

Common Examples


Below are some examples of common tasks you may wish to perform with Powershell:

Enable or Disable the Firewall


Disable the firewall on the DOMAIN profile:

Set-NetFirewallProfile -Profile Domain -Enabled True

Note the -Enabled parameter does not accept typical $True but rather True. Obviously False is an option and the other valid profiles are "Public" and "Private".


Enable a Group of Pre-Made Rules


Groups are sets of rules for a specific purpose. Windows ships with several; are a few you may find useful:

Set-NetFirewallRule -DisplayGroup "Remote Event Log Management" -Enabled True
Set-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Enabled True
Set-NetFirewallRule -DisplayGroup "Windows Management Instrumentation(WMI)" -Enabled True
Set-NetFirewallRule -DisplayGroup "Remote Desktop" -Enabled True
Set-NetFirewallRule -DisplayGroup "Windows Remote Management" -Enabled True
Set-NetFirewallRule -DisplayGroup "Remote Administration" -Enabled True

To list all groups, see the item below.

List all current Rule Groups


$rules=Get-NetFirewallRule
$DisplayGroups=foreach ($rule in $rules){$rule.displaygroup}
$DisplayGroups|Select-Object -Unique


Make a New Rule


New-NetFirewallRule -DisplayName "Allow Inbound OpenVPN Client Requests" -Direction Inbound -LocalPort 1194 -Protocol UDP -Action Allow
New-NetFirewallRule -DisplayName "Block Outbound itunes.exe" -Direction Outbound -Program "C:\Program Files\apple\itunes\itunes.exe" -Action Block

Enable or Disable an Existing Rule


Set-NetfirewallRule -DisplayName "Allow Inbound OpenVPN Client Requests" -Enabled True
Set-NetfirewallRule -DisplayName "Allow Inbound OpenVPN Client Requests" -Enabled False

Delete a Rule

This will permanently delete a rule. To disable use the set-netfirewallrule command from the previous section.

Remove-NetfirewallRule -DisplayName "Allow Inbound OpenVPN Client Requests"

Get Firewall Profile Information


Get-NetFirewallProfile -name Domain


Manage Rules Remotely


Any of the commands can be used remotely by using the New-CimSession cmdlet. This also assumes you have already enabled the firewall rule group "Windows Firewall Remote Management" as listed above.

$TargetComputer=New-CIMSession -Computername MYCOMPUTER
Set-NetFirewallRule -DisplayGroup "Remote Event Log Management" -Enabled True -CimSession $TargetComputer


What About Windows Server 2008/7?


Unfortunately, this will only work in 2012, 8, or newer even if you install Powershell 3.0 on  previous versions. The NetSecurity module was newly introduced in 2012/8. If you want to manage the FW on older versions you'll need to use NETSH.

Tip 'o The Iceberg!


So that's just a start to all the things we can do with powershell to manage the firewall. This article focuses on controlling one machine at a time so you'll most likely want to investigate controlling rules via group policy. Server 2012 introduces some very interesting tools for that as well. (Open-NetGPO!) For more information, see the links below and as always feel free to interact using the comments!

Further Reading


Technet: Windows Firewall with Advanced Security Administration with Windows Powershell
Let IT Know Blog: Manage Windows Firewall With Powershell 3
Microsoft Networking Blog: Deployment: Windows Firewall and Group Policy

Thursday, April 18, 2013

What is RemoteFX on Windows 2012 Hyper-V and Deploying a Win 8 Virtual Desktop


Updated 2/3/2017 for Windows Server 2016 and Windows 10!

RemoteFX is Microsoft's advanced desktop RDP solution based on technology acquired from Calista Technologies. It allows for the following functionality above and beyond standard RDP:

This Article Written in RemoteFX. It's... amazing?

Server 2008r2 Based:

  • Virtualized 3d GPU: you can split a single GPU into multiple virtual GPUs for VDI VMs. This allows for 3d accelerated apps to run in the RDP session.
  • RemoteFX Codec: A more advanced version of the RDP compression scheme that allows for more efficient streaming of both video and audio. While it works fine for text, you can always get groceries in a Yugo
  • USB Device redirection: Now you can finally use your USB Scan Toaster on your remote desktop!

Server 2012 Additions: 

  • Multi-Touch: Multi-Touch support through RDP. Needs a compatible client! (RDP 8.0, etc.)
  • Adaptive Graphics: Different compression codecs depending on the content (dynamically on a given screen) among other enhancements. 
  • Media Redirection API: Used primarily to facilitate rendering audio and video of VOIP clients local to the client. (Only Lync right now) 
  • WAN Enhancements: Support UDP; tweaks to lower bandwidth requirements for both remote and WiFi scenarios.  
  • GPU Changes: Support either a software-emulated GPU or a real hardware GPU. DX11 support added. 

Server 2016 Additions: 

  • OpenGL/CL Support: Now supports hardware-accelerated OpenGL (^4.4) and CL (^1.1)... CAD/Lightwave/Photoshop users rejoice!
  • vRAM Assignment Enhancements: Decouple vRAM amount from monitors and resolution, increased dedicated vRAM per host capability to 1GB from 256MB. 
  • Better Performance: More FPS=smoother performance. Noticeable in my case, videos now watchable through RemoteFX without the audio issues that sometimes accompanied the prior version. 
  • Generation 2 VM Support: Allows for use of the new VM platform and all the associated features
  • ... and more, see the reference links at the bottom of this article.

Hardware Requirements:

Full MSFT Article , RDS Blog reqs link
  • The standard HyperV Requirements
  • SLAT Enabled CPU; EPT on Intel, NPT/RVI on AMD
  • DX11 (WDDM 1.2) Compatible GPU; All made for purpose DX11 GPUs from NVIDIA and AMD work, and for testing I've been using a consumer grade NVIDIA 650 in my lab without issue.

Software Requirements:

  • Server: Server 2012/2016 (core preferred, see next section)
  • Client: Windows 8/10 Enterprise, and Enterprise only. Pro won't work. Additionally, I found that re-keying a Win8 Pro to Enterprise install will not work either. While it will report that all is well, and it will install the RemoteFX graphics adapter, when you try to connect it will report "error during licensing protocol" in the final stage of connection negotiation.

Setup

Assumptions

  • You have a fully functional HyperV Host that meets the hardware requirements listed above.
  • You're using server core. You can do this on standard, but you should be using core for performance and patching (or lack thereof) reasons. The commands I relay assume core. 

Prepare the Host

  1. Patch it up; make sure you're fully up to date. 
  2. Install the graphics drivers for your GPU on the host. This may pose some issues on server core, but fortunately I've got a guide for NVIDIA GPUs to help. The procedure is most likely similar for AMD GPUs. Bounce the host after driver install regardless of if it tells you to do so or not. 
  3. Install the Remote Desktop Virtualization Host feature. Either use the server manager remotely to do so, or execute the following directly on the Hyper-V host: "Install-WindowsFeature –name RDS-Virtualization -source j:\sources\sxs" where J: is the DVD-ROM or image with the 2012 install bits. You can use other sources if desired, for more information see this post.
  4. Reboot the server. 
  5. Enable the Adapter for use with the Hyper-V host by opening the Hyper-V management console, right click the server->Hyper-V Settings....
  6. Select "Physical GPUs"
  7. If configured correctly, you should see your adapter listed. Check the "Use this GPU with RemoteFX" box and click "OK". 


Alternatively for steps 5 through 7 you can use the following powershell cmdlets: 

Setup The VM


  1. As noted above, only Win 8 (7 if you want, update + 10) Enterprise will work. Use a template or build from scratch. There are no special needs at build time. 
  2. Enable RDP on the Win8 VM
  3. Install the VM Integration services & shut down the VM
  4. Add a 3D Adapter to the VM by opening the Hyper-V management console, right click the VM->Settings
  5. Under "Add Hardware" select "RemoteFX 3D Video Adapter", click "Add", select the max resolution and # of monitors you plan on using via RDP, and select "OK"
  6. Start up the VM. You now will need to logon via RDP, as the Hyper-V remoting will be locked out. The machine should notify of new hardware being installed that requires a reboot. If it does not, re-install the integration services. Reboot the VM. 
  7. To ensure the VM is operating with the adapter open device manager and look under "Display Adapters". You should see "Microsoft RemoteFX Graphics Device - WDDM"

Alternative Powershell Command:


Configuration

Note that unlike the previous version of RDP, you don't need to select your connection speed on RDS 8.0. So that said, the only configuration you really need in 8.0 can be done via GPO.

Adjust Settings via GPO


Primer: Modifying GPO settings.

Microsoft makes some RemoteFX settings "Tweakable" via GPO. These settings can be found here:

Computer Configuration->Policies->Administrative Templates->Windows Components->Remote Desktop Services->
  Remote Desktop Connection Client->RemoteFX USB Device Redirection
     -Allow RDP redirection of other supported RemoteFX USB devices from this computer
  Remote Desktop Session Host->Remote Session Environment
     -Configure compression for RemoteFX data
     -Configure image quality for RemoteFX Adaptive Graphics
     -Enable RemoteFX encoding for RemoteFX clients designed for WindowServer 2008r2 SP1
     -Configure RemoteFX Adaptive Graphics (Tweak if using only on a LAN)
     RemoteFX for Windows Server 2008 R2
        -Configure RemoteFX (this just allows for disabling RemoteFX via GPO)
        -Optimize visual experience when using RemoteFX (Tweak this one if using only on a LAN)
        -Optimize visual experience for Remote Desktop Service Sessions (Change to "Text" if you setup RemoteFX so Bobby can do his spreadsheets. Why did you setup RemoteFX again?)

Troubleshooting

 

Sound isn't working on the youtubes! : Seems like flash doesn't work correctly with audio redirection. HTML5 works though! Switch to the HTML 5 beta by going here.

Seems Slow: Make sure your color depth is set to 32bit. Based on my testing it seems that the codec favors full 32 bit color.

FAQ (By me of myself @ least, and by frequently I mean once until I answered them)

  • Q: Should I want to, what can I use to benchmark this thing?  A: PassMark works great; I must admit that watching DX11 accelerated 3d benchmarks through an RDP session is kind of cool. :) 
  • Q: Does RemoteFX work through an RDP gateway? What versions? A: Yup, it works through a gateway running on 2008, 2008R2, or 2012.
  • Q: Is GPU performance good enough to run intensive applications or GPU computation tasks? A: In most cases, no. The RemoteFX solution virtualizes the GPU and exposes it as a Microsoft "GPU", essentially translating all requests through a proxy driver. While that solution allows for splitting the GPU across multiple VMs, it also makes for reduced functionality/performance of the card since the OS isn't exposed directly to the native driver. Additionally, framerate is limited by the RDP protocol itself.
  • Q: Does RemoteFX support accelerated OpenGL? A: No, it is done in software.
  • Q: Can RemoteFX do GPU direct passthrough? A: No, only Xenserver Enterprise or higher can do that right now. 
  • Q: How do I know how much memory on my GPU is being used by my VMs? A: You can find the answer on the Hyper-V/Physical GPUs page for each server. The memory stats are listed right under GPU Details->Summary. 
  • Q: Can I deploy RemoteFX in a VDI environment? A: Yeah, though note your max simultaneous RemoteFX sessions will be limited by available GPU memory. (See above post) Fortunately for you, I have a guide on how to setup Hyper-V based VDI!
  • Q: Will this VMWare tweak help up the framerate on Hyper-V/RemoteFX? A: In my testing, it did not. I suspect this is because the HyperV NICs probably don't support interrupt coalescing. It looks like one could enable interrupt coalescing on the host with the following instructions and perhaps that would change the answer depending on how the packets are handled from the RemoteFX machine. 

References

Microsoft: What is RemoteFX?
RDS Blog: RemoteFX Features for Windows 8 and 2012
Technet: Frequently Asked Questions and Troubleshooting Tips
RDS Blog: Your desktop will be a rich DX11-based experience, and your virtual GPU should be too
My Crazy Adventures with RemoteFX, Part 1

2016 Updates

Enterprise Mobility and Security Blog: RemoteFX vGPU Updates in Windows Server Next
Technet: Experience guide for Enabling OpenGL Support for vGPU in Server 2016

Questions/Concerns? Contact me or leave a comment!

Tuesday, January 8, 2013

Just take my monies! How to fix "Something happened and your purchase can't be completed" In Windows 8

I'm trying to buy an app in the Windows store on Windows 8 and I'm greeted with this message:

Amazing. It's like a riddle. Here's how to fix it:
  1. In the Metro(oops!) interface, open up the charms bar and select "Settings->Change PC Settings"
  2. Select "Users"; your account should be referenced on the right pane. 
  3. (Variable) Most folks will need to click "Switch to a local account", but if you, like me, are on a domain account that is linked to your MSFT ID, you will need to click "Disconnect from your Microsoft account". 
  4. Log out, then back on. 
  5. Buy something from the Windows Store. You should be prompted for your ID and it *should* (see below if not) work. 
  6. You can now re-link your account by navigating to "Settings->Change PC Settings->Users" and linking your account under your username on the top right plane.  You'll be prompted for your e-mail, password, and which settings you would like to sync during the process.
However

If this didn't work for you like it didn't for me (why'd I write it then!?!) you may need to look deeper. In my case it turned out being the fault of a toxic combination of Displaylink software and Nvidia drivers. While the Displaylink folks noted fixes in their latest driver release I wonder if it didn't also have something to do with the fact that the NV drivers aren't all signed properly. To help determine your problem, try the following: 
  1. Re-create the issue by trying to purchase your app again. 
  2. Bring up the charms bar and hit the "Start" charm to bring up the Met..Modern UI interface.
  3. Start typing "reliability" and click "Settings" then select "View reliability history". 
  4. Look for a report from the time frame in which you re-created the problem. In my case, I had issues from "Credential Manager UI Host" and "CredentialUIBroker.exe"
  5. "Right click crash report->View Technical Details". 
  6. Look for "Faulting module path". In my case it was nvwgf2umx.dll, provided by nVidia. Taking a look at that DLL, I noted it wasn't signed correctly. 


This (and procmon, but that's an article for a different day) is what led me down the track of investigating the graphics drivers. Odd when graphics drivers can be the cause of your inability to buy something from the Windows store. Hopefully in the future MSFT builds a DRM/ID testing path tool that can be used to improve this troubleshooting routine. 

Postscript: While the fix in my case was more on the Displaylink software side, I found it interesting that the newest nVidia drivers still aren't signed right. The signing cert traces back up through the "Microsoft Digital Media Authority 2005" CA which hasn't been valid for quite some time. Two driver revs ago, however, the signing was done correctly. Someone's dev box @ NV needs attention. :) Update 4/21/2014: NVidia contacted me regarding this issue we determined that the "Microsoft Digital Media Authority 2005" certificate is actually "baked into" Vista and higher operating systems. This seems a relatively well hidden fact, but it was revealed in this paper by Symantec. Interesting to say the least... anyhow their cert still has a potential revocation issue and they are working to resolve it.

If this still doesn't work, take a look @ the Windows store logs @ %USERPROFILE%\AppData\Local\Temp\winstore.log and %windir%\temp\winstore.log . Good luck!

Tuesday, November 6, 2012

Installing .NET 3.5 on Windows10/8/Server 2012 With Powershell

Here's how to install .NET 3.5 (or another feature by subbing the feature name) on Windows 8/10 or Server 2012 from Powershell:
  • Launch Powershell as Admin
Install .NET 3.5 using default sources (Windows Update or defined in group policy)
  • 2012: Install-WindowsFeature –name NET-Framework-Core
  • Win8/10: Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All
Install .NET 3.5 using a network SxS share: 
  • 2012: Install-WindowsFeature –name NET-Framework-Core -source \\server\share\source\sxs
  • Win8/10:Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All -LimitAccess -Source \\server\share\source\sxs
    • On Windows 8, -all indicates that all parent features should be enabled as well and -LimitAccess prevents it from connecting to Windows Update. These options are not valid on Win 2012. 
Install .NET 3.5 using DVD-ROM 
  • 2012: Install-WindowsFeature –name NET-Framework-Core -source j:\sources\sxs    (See note below)
  • Win8:Enable-WindowsOptionalFeature –Online –FeatureName NetFx3 –All -LimitAccess -Source J:\sources\sxs
Make sure to run Windows Update after install if you're installing from a non-updated source!

Note: Depending on your configuration, on server 2012 you may need to use the install.wim on the install media and specify the index of the proper version of your install. To do so, execute:

Get-WindowsImage -ImagePath {OpticalDrive}:\sources\install.wim
This will display a list of images with associated indexes. Take note of the index of your install type.
Then, instead of the -source line above, use -source:wim:e:\sources\install.wim:X (where X is the number of the appropriate index. 

Update: Confirmed this works on Windows 10 as well!

Thursday, October 18, 2012

WSUS 3.0 vs. 2012/Windows 8 Notes

As I posted earlier, server 2012 includes a new version of WSUS. There are a few gotchas associated with WSUS and Server 2012/Windows 8, especially as it pertains to using a previous version of WSUS. Here are some key points:

  • Windows 8 and Server 2012 "clients" will NOT work with WSUS 3.0 SP2 or any version that isn't shipped with 2012 unless this update is installed BEFORE any clients connect to it. 
  • If your Win8/2012 clients attempted to talk to an older WSUS server before patching or upgrading, you will need to perform the following before they will update again: 
    • Net stop wuauserv
    • rd /s %windir%\softwaredistribution\
    • Net start wuauserv
  • If your new WSUS 2012 server is downstream from an older WSUS server, it will have the same effect as if your clients were pulling directly from that older server. All WSUS servers between the clients and MSFT need to be newer or patched. 
  • According to Microsoft, updates canNOT be scanned by an intermediary... i.e. HTTPS inspection must be turned off on content from Windows Update. 
Client errors may manifest themselves as "error 0x80246003". According to the WSUS error table that corresponds to an unrecognized hash. I haven't completed my research yet but I'm guessing that the new endpoints will only honor update packages from MSFT using a new, stronger hash to raise security in the aftermath of the Flame malware. 

Sources: