Windows upgrade woes

[Benjamin_John]

I'm trying to upgrade our workstations from 1803 to 1909 using an SCCM task sequence. They have FDE/MEPP installed.

On our HP desktops (no pre-boot), we found that we had to change the boot order to be Checkpoint FDE followed by Windows Boot Manager for the upgrade to work. We were able to use SCCM and a HP Bios config utility to do this. After the change, we were able to upgrade most of our machines without issues. Still  some machines randomly fail with BSOD's, some times re-running the upgrade will work, sometimes it takes multiple tries. Some machines are missing either the Checkpoint FDE or the Windows Boot manager option in BIOS boot sequence. Not sure how to add these options back.

On our Dell laptops (pre-boot enabled), we found that the checkpoint option is missing in the BIOS boot sequence. I haven't found a way to programmatically add this option. These laptops are running E82.50 and have BCDBOOT already enabled and we are following the SK that mentions using the setupconfig file.

I have already opened a ticket, but not very helpful and I've seen most of the posts here about upgrades. 

Any times or ideas on why the FDE option would be missing?

[J_B]

First thing I would do is upgrade the endpoint client on the machines to the latest one as there have been several fixes to do with Windows 10 upgrades since the E82.50 client.  There are others, but the 2 main ones that I found are as follows.....

E84.30 - BCDBOOT mode is now the default for upgrades

E84.60 - Fixes the issue where Windows 10 upgrades require an extra restart to repair Media Encryption and Port Protection. Now, an extra restart is only necessary for Windows 10 version 1709 and lower.

[Benjamin_John]

We are already on the latest version E84.60. Anyway, we managed to upgrade our most of our desktops either by re-running the update multiple times or just re-imaging some that just didn't want to upgrade.

Now we have turned our attention to upgrading the laptops and are running into stop code 0x05001647 on some laptops. If we decrypt the laptop, the upgrade continues. This clearly indicates that check point is the issue. Any ideas? I cant even find anything on this specific error code.

[Courtesy5]

Any update on this issue?

We had similar issues with Random dell devices rebooting into a recovery screen. I was able to come up with a workaround which I am not sure is supported yet however it allows the device to upgrade fine. Run FDEcontrol.exe and set the device back to BOOTMGFW which cleans up the boot start, then during the upgrade set the machine back to BCDBOOT and restart. Upgrades worked after that

We did also see a small number of devices which failed when connected to certain external devices, once disconnected they would upgrade. Still working with CP support on these. 

[Benjamin_John]

Unfortunately, No. I think we ended up re-imaging some of the laptops.

Just ran into the same thing when doing 1909 to 21H2. How are you running FDEcontrol  when the laptop is in a BSOD state?

[Courtesy5]

Do you know if the BSOD is actually a Recovery screen?

We recover the device when it fails presenting the recovery screen by going into the bios and adding a new boot record then placing it at the top of the boot order.  \EFI\BOOT\bootx64.efi

After recovering the device we use FDE control to set the device to Bootmgfw and our upgrade task sequence places the device back into BCDBOOT and restarts. We could not identify anything unique about the problem devices so far neither can Checkpoint support so we just added a step in the task sequence to rollback to Bootmgfw and then place the device into bcdboot and restart which seems to work so far. 

[Benjamin_John]

ah, yes, I remember adding the boot record in the BIOS menu now..

We are not using a task sequence for laptops anymore. so I guess we'll have to manually run fde control.

This whole process is just nutty and why it fails on random devices.