Installing updates during Autopilot: Windows 11 edition, revisited again

This seems to be a frequent blog topic, with posts going back to 2019:

So why bring this up yet again? I blame Gary Block, whose comment on Twitter said that he sees this taking about 10 minutes in his testing with a similar script:

OK, so if it takes 10 minutes for a similar process, why is it taking much longer in my tests? I switched to using the same logic he was using (from OSDBuilder, using this script) which directly leverages the Windows Update COM controls instead of using the PSWindowsUpdate module. I didn’t expect that to make much of a difference, and sure enough, it didn’t. 

So what’s the difference? The next theory was the hardware — maybe my VMs are slower than his test hardware. My VM had 2 vCPUs, 4GB of RAM, and fast NVMe PCIe Gen4 storage, running Windows 11 23H2 patched through December 2023. I can’t improve the storage speed, and there were no signs that this was memory-constrained, but what about CPU? Easy enough to try increasing that to 4 vCPUs. Amazingly, that reduced the time from 25 minutes down to 10 minutes, so the process most definitely was CPU-bound. (That said, if you were to try this on a machine with spinning disks or slower SATA SSDs, those will definitely slow things down more.)

With a little more testing, you can definitely see a trend:

So what’s the lesson learned? Don’t run Windows 11 on a VM with less than 4 virtual CPUs. I knew the performance was awful with a single vCPU so I never do that, but I didn’t realize that two wasn’t much better. Four appears to be the sweet spot, with diminishing or no returns after that point (at least when it comes to OOBE and Windows Update).

The performance was actually so bad with a single vCPU that the device ESP always timed out waiting for Intune Management Extensions to install and provide a list of apps to track — ESP will only wait 15 minutes for that to complete. So I couldn’t even get to the point of running the UpdateOS script — I eventually gave up and just ran it manually. (Maybe that’s why Microsoft got rid of the single vCPU Windows 365 configuration that they originally announced — it just wasn’t usable. Now they only have two or more vCPUs. Two will at least work, but if WU kicks in while you’re trying to do real work on the machine, expect some sluggishness.)

So the mystery is solved, and the problem isn’t as big as it originally seemed — fortunately, most CPUs supported by Windows 11 (8th generation and later) have four or more CPU cores. (The exceptions would be Pentium Gold and Celeron processors, but if you’re buying those for enterprise use you should be ashamed; the same goes for devices with spinning or SATA disks, every device should have an M.2 NVMe drive — I bought two 256GB drives this week for $20 a piece.) Spending 10 minutes during ESP installing updates is somewhat reasonable.

With that mystery solved, I did post updated files to GitHub at https://github.com/mtniehaus/UpdateOS. Changes in this version:

• Switched to direct use of the Windows Update COM objects, so no more PSWindowsUpdate use.
• Added logic to opt into Microsoft Update to get patches for other things.
• Added the ability to install updated drivers from Windows Update (borrowing from OSDBuilder again).
• Added some additional logging to make it easier to see how long the process took.

See the first blog post mentioned at the top, or the GitHub documentation page at https://github.com/mtniehaus/UpdateOS, for details on how to set up the Win32 app in Intune.