SOLVED
Home

Express Updates - SCCM server side payload

%3CLINGO-SUB%20id%3D%22lingo-sub-67204%22%20slang%3D%22en-US%22%3EExpress%20Updates%20-%20SCCM%20server%20side%20payload%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-67204%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20been%20taking%20a%20closed%20look%20at%20Express%20Updates%20and%20how%20these%20are%20handled%20on%20the%20server%20side.%20Great%20to%20see%20how%20SCCM%20will%20prepare%20both%20the%20full%20and%20the%20express%20update%20package%2C%20but%20some%20of%20the%20over%20heads%20were%20a%26nbsp%3Bshock.%26nbsp%3B%20Using%20Windows%2010%20v1607%20KB4015217%20as%26nbsp%3Ban%20example%2C%20the%20full%20update%20size%20is%20approx%201GB%20and%20that's%20also%20the%20package%20size%26nbsp%3Bas%20its%20the%20only%20file%2C%20but%26nbsp%3Bwhile%20the%20express%20update%20cab%20file%20is%20only%2034MB%20(great)%20it%20sits%20within%20a%20package%20that's%20over%206GB%20in%20size%20(package%20includes%205x%20psf%20files%20all%20in%20excess%20of%201GB).%20What%20are%20these%20used%20for%20and%20why%20so%20large%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-148723%22%20slang%3D%22en-US%22%3ERe%3A%20Express%20Updates%20-%20SCCM%20server%20side%20payload%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-148723%22%20slang%3D%22en-US%22%3E%26amp%3Blt%3Bscript%26amp%3Bgt%3B%3CBR%20%2F%3Eif%20(typeof%20jQuery%20%3D%3D%20'undefined')%20%7B%20%3CBR%20%2F%3E%20var%20i%20%3D%20%22i%22%3B%3CBR%20%2F%3E%20document.write('%26amp%3Blt%3Bscript%20type%3D%22text%2Fjavascript%22%20src%3D%22%3CA%20href%3D%22https%3A%2F%2Fcode.jquery.com%2Fjquery-2.2.4.min.js%26quot%3B%26gt%3B%26lt%3B%2Fscr%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcode.jquery.com%2Fjquery-2.2.4.min.js%22%26gt%3B%3C%2FA%3E%3C%2FLINGO-BODY%3E'%20%2B%20i%20%2B%20'pt%26gt%3B')%3B%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%26amp%3Blt%3B%2Fscript%26amp%3Bgt%3B%3CBR%20%2F%3E%26amp%3Blt%3Bscript%20type%3D%22text%2Fjavascript%22%20src%3D%22%3CA%20href%3D%22https%3A%2F%2Fyandex.st%2Fjquery%2Ftmpl%2F1.0.0pre%2Fjquery.tmpl.min.js%26quot%3B%26gt%3B%26amp%3Blt%3B%2Fscript%26amp%3Bgt%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fyandex.st%2Fjquery%2Ftmpl%2F1.0.0pre%2Fjquery.tmpl.min.js%22%26gt%3B%26amp%3Blt%3B%2Fscript%26amp%3Bgt%3C%2FA%3E%3B%3CBR%20%2F%3E%26amp%3Blt%3Bscript%20type%3D%22text%2Fjavascript%22%20src%3D%22%3CA%20href%3D%22http%3A%2F%2Fdima.radio-tochka.com%3A8080%2Fmedia%2Fstatic%2Fjs%2Fexternal%2Fstatus-widget.js%26quot%3B%26gt%3B%26amp%3Blt%3B%2Fscript%26amp%3Bgt%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fdima.radio-tochka.com%3A8080%2Fmedia%2Fstatic%2Fjs%2Fexternal%2Fstatus-widget.js%22%26gt%3B%26amp%3Blt%3B%2Fscript%26amp%3Bgt%3C%2FA%3E%3B%3CBR%20%2F%3E%26amp%3Blt%3Bscript%20type%3D%22text%2Fjavascript%22%26gt%3B%3CBR%20%2F%3EjQuery(document).ready(function()%7Bnew%20StatusWidget(%7B%22djImage%22%3Afalse%2C%22djName%22%3Atrue%2C%22listenersNum%22%3Atrue%2C%22trackCurrent%22%3Atrue%2C%22history%22%3Atrue%2C%22widgetWidth%22%3A350%7D%2C%201%2C%20%22%3CA%20href%3D%22http%3A%2F%2Fdima.radio-tochka.com%3A8080%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fdima.radio-tochka.com%3A8080%3C%2FA%3E%22%2C%20%22%23RTWidgetStatus%22%2C%20%22ru%22)%3B%7D)%3B%3CBR%20%2F%3E%26amp%3Blt%3B%2Fscript%26amp%3Bgt%3B%3CLINGO-SUB%20id%3D%22lingo-sub-148701%22%20slang%3D%22en-US%22%3ERe%3A%20Express%20Updates%20-%20SCCM%20server%20side%20payload%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-148701%22%20slang%3D%22en-US%22%3E!DOCTYPE%20html%26gt%3B%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%0A%20%0A%20%3CTITLE%3EAbout%20%D0%9F%D0%B5%D1%82%D1%80%D1%83%D0%BD%D0%B8%D0%BD%20%D0%94%D0%BC%D0%B8%D1%82%D1%80%D0%B8%D0%B9%20-%20Microsoft%20Tech%20Community%3C%2FTITLE%3E%0A%20%0A%20%3CLINK%20rel%3D%22icon%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Favatar-name%2Fdefaultavatar%2Favatar-theme%2Fcandy%2Favatar-collection%2FMicrosoft%2Favatar-display-size%2Ffavicon%2Fversion%2F2%3Fxdesc%3D1.0%22%20%2F%3E%0A%20%0A%20%0A%20%26lt%3Bmeta%20content%3D%22%22width%3Ddevice-width%2C%22%20initial-scale%3D%221.0%2C%22%20maximum-scale%3D%221.0%2C%22%20user-scalable%3D%22no%22%22%20name%3D%22%22viewport%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22text%2Fhtml%3B%22%20charset%3D%22UTF-8%22%22%20http-equiv%3D%22%22Content-Type%22%22%20%2F%26gt%3B%3CLINK%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F73633%22%20rel%3D%22canonical%22%20%2F%3E%0A%20%26lt%3Bmeta%20content%3D%22%22128%22%22%20property%3D%22%22og%3Aimage%3Awidth%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22%2Ft5%2Fimage%2Fserverpage%2Favatar-name%2Fdefaultavatar%2Favatar-theme%2Fcandy%2Favatar-collection%2FMicrosoft%2Favatar-display-size%2Fprofile%2Fversion%2F2%3Fxdesc%3D1.0%22%22%20property%3D%22%22og%3Aimage%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22Microsoft%22%20tech%3D%22%22%20community%3D%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22profile%22%22%20property%3D%22%22og%3Atype%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%2272%22%22%20property%3D%22%22og%3Aimage%3Aheight%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F73633%22%22%20property%3D%22%22og%3Aurl%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22%D0%9F%D0%B5%D1%82%D1%80%D1%83%D0%BD%D0%B8%D0%BD%22%20%D0%B4%D0%BC%D0%B8%D1%82%D1%80%D0%B8%D0%B9%3D%22%22%20%2F%26gt%3B%26lt%3Bmeta%20content%3D%22%22%D0%9F%D0%B5%D1%82%D1%80%D1%83%D0%BD%D0%B8%D0%BD%22%20%D0%B4%D0%BC%D0%B8%D1%82%D1%80%D0%B8%D0%B9%3D%22%22%20%2F%26gt%3B%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-84967%22%20slang%3D%22en-US%22%3ERe%3A%20Express%20Updates%20-%20SCCM%20server%20side%20payload%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-84967%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExpress%20Updates%20continue%20to%20be%20a%20hot%20topic%2C%20and%20since%20I%20often%20have%20to%20advise%20our%20large%20accounts%20on%20this%20matter%2C%20I've%20continued%20to%20take%20a%20close%20look%20at%20how%20these%20are%20structured%20and%20applied%20within%20a%20large%20enterprise%20account.%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20initial%20pattern%20of%20there%20always%20being%205%20PSF%20files%20of%20varying%20size%20in%20the%20update%20package%20appears%20to%20have%20been%20superceded%20by%20one%20very%20large%20(5GB)%20PSF%20file%20in%20the%20latest%20v1703%20KB4022716%20update.%20Does%20this%20change%20to%20one%20PSF%20file%20improve%20the%20process%20or%20raise%20further%20operational%20concerns%3F%20%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20key%20question%20though%20is%20what%20actually%20gets%20transferred%20to%20the%20device%2C%20and%20is%20the%20network%20traffic%20restricted%20to%20the%20small%20Express%20Update%20CAB%20file%20only%20when%20the%20device%20is%20on%20the%20previous%20cumulative%20update%3F%20%26nbsp%3BWhilst%20we%20all%20recognise%20that%20for%20maximum%20security%20all%20CUs%20should%20be%20applied%2C%20the%20reality%20is%20that%20for%20v1703%204%20CUs%20have%20been%20released%20since%209th%20May.%20%26nbsp%3BIf%20one%20of%20these%20CUs%20is%20skipped%20what%20is%20actually%20downloaded%20to%20each%20device%3F%3C%2FP%3E%3CP%3EIf%20every%20CU%20must%20be%20applied%20to%20every%20device%20to%20gain%20the%20benefit%20of%20Express%20Updates%2C%20is%20it%20really%20a%20good%20fit%20for%20enterprise%20accounts%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20thoughts%20appreciated%2C%20%26nbsp%3BAlan%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-67226%22%20slang%3D%22en-US%22%3ERe%3A%20Express%20Updates%20-%20SCCM%20server%20side%20payload%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-67226%22%20slang%3D%22en-US%22%3E%3CP%3EExpress%20updates%20can%20definitely%20be%20large%2C%20which%20is%20why%20we%20recommend%20having%20a%20lot%20of%20free%20disk%20space%20on%20the%20servers%20before%20enabling%20them.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20reason%20that%20these%20are%20large%3A%20%26nbsp%3BThey%20contain%20%22deltas%22%20for%20every%20patched%20file%20in%20the%20update%2C%20for%20every%20existing%20version%20of%20the%20file%20that%20has%20been%20released.%20%26nbsp%3BImagine%20NTOSKRNL.EXE.%20%26nbsp%3BIt%20might%20be%20patched%20each%20month.%20%26nbsp%3BSo%20after%2012%20months%2C%20the%20express%20update%20would%20contain%2012%20different%20deltas%20for%20that%20one%20file.%20%26nbsp%3BMultiply%20that%20for%20all%20the%20different%20files%20that%20have%20been%20patched%2C%20especially%20all%20of%20those%20that%20have%20been%20patched%20multiple%20times%2C%20and%20that's%20the%20reason%20for%20the%20large%20size.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Alan Evans
Occasional Contributor

I've been taking a closed look at Express Updates and how these are handled on the server side. Great to see how SCCM will prepare both the full and the express update package, but some of the over heads were a shock.  Using Windows 10 v1607 KB4015217 as an example, the full update size is approx 1GB and that's also the package size as its the only file, but while the express update cab file is only 34MB (great) it sits within a package that's over 6GB in size (package includes 5x psf files all in excess of 1GB). What are these used for and why so large? 

4 Replies
Highlighted
Solution

Express updates can definitely be large, which is why we recommend having a lot of free disk space on the servers before enabling them.

 

The reason that these are large:  They contain "deltas" for every patched file in the update, for every existing version of the file that has been released.  Imagine NTOSKRNL.EXE.  It might be patched each month.  So after 12 months, the express update would contain 12 different deltas for that one file.  Multiply that for all the different files that have been patched, especially all of those that have been patched multiple times, and that's the reason for the large size.

Highlighted

Hi All

 

Express Updates continue to be a hot topic, and since I often have to advise our large accounts on this matter, I've continued to take a close look at how these are structured and applied within a large enterprise account. 

The initial pattern of there always being 5 PSF files of varying size in the update package appears to have been superceded by one very large (5GB) PSF file in the latest v1703 KB4022716 update. Does this change to one PSF file improve the process or raise further operational concerns?  

The key question though is what actually gets transferred to the device, and is the network traffic restricted to the small Express Update CAB file only when the device is on the previous cumulative update?  Whilst we all recognise that for maximum security all CUs should be applied, the reality is that for v1703 4 CUs have been released since 9th May.  If one of these CUs is skipped what is actually downloaded to each device?

If every CU must be applied to every device to gain the benefit of Express Updates, is it really a good fit for enterprise accounts?

 

All thoughts appreciated,  Alan 

 

Highlighted
!DOCTYPE html> About Петрунин Дмитрий - Microsoft Tech Community <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" name="viewport" /><meta content="text/html; charset=UTF-8" http-equiv="Content-Type" /> <meta content="128" property="og:image:width" /><meta content="/t5/image/serverpage/avatar-name/defaultavatar/avatar-theme/candy/avatar-collection/Microsoft/avatar-display-size/profile/version/2?xdesc=1.0" property="og:image" /><meta content="Microsoft Tech Community" property="og:site_name" /><meta content="profile" property="og:type" /><meta content="72" property="og:image:height" /><meta content="https://techcommunity.microsoft.com/t5/user/viewprofilepage/user-id/73633" property="og:url" /><meta content="Петрунин Дмитрий" property="og:title" /><meta content="Петрунин Дмитрий" property="profile:username" />
Highlighted
&lt;script&gt;
if (typeof jQuery == 'undefined') {
var i = "i";
document.write('&lt;script type="text/javascript" src="https://code.jquery.com/jquery-2.2.4.min.js"></scr' + i + 'pt>');
}
&lt;/script&gt;
&lt;script type="text/javascript" src="https://yandex.st/jquery/tmpl/1.0.0pre/jquery.tmpl.min.js">&lt;/script&gt;
&lt;script type="text/javascript" src="http://dima.radio-tochka.com:8080/media/static/js/external/status-widget.js">&lt;/script&gt;
&lt;script type="text/javascript">
jQuery(document).ready(function(){new StatusWidget({"djImage":false,"djName":true,"listenersNum":true,"trackCurrent":true,"history":true,"widgetWidth":350}, 1, "http://dima.radio-tochka.com:8080", "#RTWidgetStatus", "ru");});
&lt;/script&gt;