SCCM In-Place OS Upgrade on McAfee Encrypted Machines

In-Place OS Upgrade on McAfee Encrypted

SCCM manage Bitlocker encryption natively during OS upgrade. But when comes to disks with third party encryption drivers then it’s always a challenge to upgrade OS. I have seen IT Admin decrypt the disk before OS Upgrade. Then after inplace OS upgrade, re-enable encryption. This need huge effort, time and impacts end user experience. This post describes Windows 10 upgrade task sequence configuration for McAfee Encrypted Machines. This configuration allows IT to perform successful OS upgrade keeping the Mcafee encryption intact.

Starting with Windows 10 1607, Microsoft provided command-line switch “/ReflectDrivers “. It allows drivers added to the OS image during the setup and installation phase.The Windows 10 upgrade starts by running setup.exe on the client.As shown below we need to add the switch “/ReflectDrivers ” along with the path to a folder that contains  Mcafee encryption drivers.For more details refer Windows setup command line


Setup.exe /ReflectDrivers "%programfiles%\McAfee\Endpoint Encryption\OSUpgrade" . 
Setup.exe /ReflectDrivers  "C:\Program Files\McAfee\Endpoint Encryption\OSUpgrade"

Below folder contains Mcafee encryption drivers.Mcafee encryption drivers Windows 10

Note : if /ReflectDrivers switch is not used during OS upgrade then computer will fail to boot.

Now we know the command-line switch, next we will see how this can be incorporated in SCCM task sequence. As shown below, task sequence doesn’t provide option to add the additional OS upgrade switch in the GUI.

SCCM in place upgrade task sequence

Hence to append additional Windows setup command line switch we need to use the variable “OSDSetupAdditionalUpgradeOptions”. As mentioned in the Niall Brady post,we can use this variable for other purpose.


End result:

  • Before updating task-sequence variable “OSDSetupAdditionalUpgradeOptions”
Set command line: "C:\WINDOWS\ccmcache\XX\SETUP.EXE" /ImageIndex 3 /auto Upgrade 
/quiet /noreboot /postoobe "C:\WINDOWS\SMSTSPostUpgrade\SetupComplete.cmd" 
/postrollback "C:\WINDOWS\SMSTSPostUpgrade\SetupRollback.cmd" /installdrivers 
"C:\WINDOWS\ccmcache\XX" /DynamicUpdate Disable


  • After updating task-sequence variable “OSDSetupAdditionalUpgradeOptions” the final Windows installation command line will look like below from SCCM
Executing command line: "C:\_SMSTaskSequence\Packages\XXXXXXXX\SETUP.EXE" /ImageIndex 1 
/auto Upgrade /quiet /noreboot /postoobe "C:\WINDOWS\SMSTSPostUpgrade\SetupComplete.cmd" 
/postrollback "C:\WINDOWS\SMSTSPostUpgrade\SetupRollback.cmd" /installdrivers 
"C:\_SMSTaskSequence\Packages\XXXXXXXX" /DynamicUpdate Disable /ReflectDrivers 
"C:\Program Files\McAfee\Endpoint Encryption\OSUpgrade"


Note : The use of MBR2GPT.exe tool is currently unsupported with McAfee Drive Encryption. So, you cannot switch from legacy BIOS to UEFI. This capability is still in proof of concept form and expected to add in planned future Mcafee release.

References :-

  1. Microsoft. Task sequence action variables in System Center Configuration Manager
  2. Mcafee. Upgrade OS with drive encryption


  1. Good article.

    One question thought, based on the last line “Note : The use of MBR2GPT.exe tool is currently unsupported with McAfee Drive Encryption. So, you cannot switch from legacy BIOS to UEFI..”

    Based on that, if I needed to do in-place upgrade from 7 to 10 on McAfee encrypted disk AND BIOS to UEFI conversion, that is not possible?

  2. Good stuff. I’m about to start testing upgrading in a Symantec environment. We have some issues with 1607 we hope to get rid of with a newer version. Only our laptops are encrypted but that’s still half of our systems.

  3. Oh yeah thanks. I’m aware the process is different. I didn’t mean for my comment to sound like I would be following the McAfee process.

  4. Great article! Would this TS work in an environment where systems on which DP is installed have client OS and not server OS. (Because for OSD, DP’s need to be installed on a server OS).

  5. Hi all, just to clarify, what is the variable to use with MDT so I can use the reflectdrivers switch? Also how or where in the task sequence do I put or does it go in the customsettings.ini?

  6. That covers starting the upgrade with McAfee disk encryption and ending the upgrade with it still intact.
    What if we want to REMOVE McAfee disk encryption at the start of the upgrade task sequence, on Windows 7, then upgrade to Windows 10, run MBR2GPT and at the end deploy MBAM & Bitlocker?
    Can the /reflectdrivers switch be used to disable McAfee disk encryption, clearing the way for the McAfee disk encryption agent and client to be uninstalled?
    Thats our current challenge.

  7. Hello,

    What variable should I use in order to have the Task Sequence detect if the device is really encrypted? I did a non elegant way which was to loof for the “C:\Program Files\McAfee\Endpoint Encryption” to exist, but I’ve detected that some devices have it installed, but are not encrypted, so the TS loads the “/ReflectDrivers” Switch and causes a system hang (luckily a force shutdown takes the machine back to previous OS, I’m upgradint 1703 to 1803.


    • In that case , instead of folder please use registry value to detect if device is encrypted or not.
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee EndPoint Encryption\MfeEpePC\Status

  8. Nice article and I have followed the same. I have created SCCM TS with Windows 10 1809 OS Package and I am deploying it on Laptop where McAfee Drive Encryption is enabled. Now as per this article, I have added TS Variable OSDSetupAdditionalUpgradeOptions with value “Setup.exe /ReflectDrivers “C:\Program Files\McAfee\Endpoint Encryption\OSUpgrade”

    OS In place upgrade is started using Software Center, but what I am wondering is that my Laptop drive encryption is not compatible with Windows 10 1809 version, then how come OS Upgrade started…? It should have failed?


Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.