mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 18:33:43 +00:00
Merge branch 'public' into patch-2
This commit is contained in:
David Strome
GitHub
@ -13,7 +13,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 09/08/2023
|
||||
ms.date: 06/04/2024
|
||||
---
|
||||
|
||||
# How to check Windows release health
|
||||
@ -33,7 +33,7 @@ Ensure the following prerequisites are met to display the Windows release health
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
|
||||
- Sign into the Microsoft 365 admin center using an [admin role](/microsoft-365/admin/add-users/about-admin-roles).
|
||||
- Most roles containing the word `administrator` give you access to the Windows release health page such as [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator), [Helpdesk Administrator](/azure/active-directory/roles/permissions-reference#helpdesk-administrator), and [Service Support Administrator](/azure/active-directory/roles/permissions-reference#service-support-administrator). For more information, see [Assign admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/assign-admin-roles).
|
||||
- Most roles containing the word `administrator` give you access to the Windows release health page such as [Helpdesk Administrator](/azure/active-directory/roles/permissions-reference#helpdesk-administrator) and [Service Support Administrator](/azure/active-directory/roles/permissions-reference#service-support-administrator). For more information, see [Assign admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/assign-admin-roles).
|
||||
|
||||
> [!NOTE]
|
||||
> Currently, Windows release health is available for Government Community Cloud (GCC) tenants, but isn't available for GCC High and DoD. <!--8337541-->
|
||||
@ -85,6 +85,18 @@ You can sign up for email notifications about Windows known issues and informati
|
||||
> [!Note]
|
||||
> When a single known issue affects multiple versions of Windows, you'll receive only one email notification, even if you've selected notifications for multiple versions. Duplicate emails won't be sent.
|
||||
|
||||
## Working with the Windows updates API in Microsoft Graph
|
||||
<!--8884260-->
|
||||
If you'd like to develop an alternative way to get information on known issues documented within the Windows release health section in the admin center, you can use the Windows updates API in [Microsoft Graph](/graph/api/overview).
|
||||
|
||||
The Windows updates API has current and historical known issues data for any supported Windows product. You can check if an issue is confirmed, and if a resolution is available before calling support or spending time troubleshooting.
|
||||
|
||||
The Windows updates API also has product lifecycle information. For instance, you can search for end of servicing dates for all supported Windows versions and editions you manage in your organization. For more information on how to access these known issue and lifecycle data, see [Microsoft Graph product resource type](/graph/api/resources/windowsupdates-product).
|
||||
|
||||
> [!Note]
|
||||
> These Windows data sets are currently under the [Microsoft Graph REST API beta endpoint reference](/graph/api/overview?view=graph-rest-beta&preserve-view=true).
|
||||
|
||||
|
||||
## Status definitions
|
||||
|
||||
In the **Windows release health** experience, every known issue is assigned as status. Those statuses are defined as follows:
|
||||
|
||||
@ -14,7 +14,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 08/29/2023
|
||||
ms.date: 04/05/2024
|
||||
---
|
||||
|
||||
# Deploy expedited updates with Windows Update for Business deployment service
|
||||
@ -55,10 +55,10 @@ All of the [prerequisites for the Windows Update for Business deployment service
|
||||
|
||||
## List catalog entries for expedited updates
|
||||
|
||||
Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security updates that can be deployed as expedited updates by the deployment service. Using `$top=1` and ordering by `ReleaseDateTimeshows` displays the most recent update that can be deployed as expedited.
|
||||
Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security and nonsecurity<!--8891502--> quality updates that can be deployed as expedited updates by the deployment service. Using `$top=2` and ordering by `ReleaseDateTimeshows` displays the most recent updates that can be deployed as expedited.
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=1
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=2
|
||||
```
|
||||
|
||||
The following truncated response displays a **Catalog ID** of `e317aa8a0455ca604de95329b524ec921ca57f2e6ed3ff88aac757a7468998a5` for the `08/08/2023 - 2023.08 B SecurityUpdate for Windows 10 and later` security update:
|
||||
|
||||
@ -14,7 +14,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 01/29/2024
|
||||
ms.date: 07/01/2024
|
||||
---
|
||||
|
||||
# Windows Update for Business deployment service prerequisites
|
||||
@ -26,7 +26,7 @@ Before you begin the process of deploying updates with Windows Update for Busine
|
||||
## Azure and Microsoft Entra ID
|
||||
|
||||
- An Azure subscription with [Microsoft Entra ID](/azure/active-directory/)
|
||||
- Devices must be Microsoft Entra joined and meet the below OSrequirements.
|
||||
- Devices must be Microsoft Entra joined and meet the below OS requirements.
|
||||
- Devices can be [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- Devices that are [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business
|
||||
|
||||
@ -85,9 +85,11 @@ When you use [Windows Update for Business reports](wufb-reports-overview.md) in
|
||||
- Windows Update for Business deployment service endpoints
|
||||
|
||||
- devicelistenerprod.microsoft.com
|
||||
- devicelistenerprod.eudb.microsoft.com for the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) <!--9131668-->
|
||||
- login.windows.net
|
||||
- payloadprod*.blob.core.windows.net
|
||||
|
||||
|
||||
- [Windows Push Notification Services](/windows/uwp/design/shell/tiles-and-notifications/firewall-allowlist-config): *(Recommended, but not required. Without this access, devices might not expedite updates until their next daily check for updates.)*
|
||||
- *.notify.windows.com
|
||||
|
||||
|
||||
@ -3,7 +3,7 @@ title: Evaluate infrastructure and tools
|
||||
description: Review the steps to ensure your infrastructure is ready to deploy updates to clients in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: article
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
|
||||
@ -3,7 +3,7 @@ title: FoD and language packs for WSUS and Configuration Manager
|
||||
description: Learn how to make FoD and language packs available to clients when you're using WSUS or Configuration Manager.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: reference
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
@ -13,28 +13,44 @@ appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/mem/configmgr/ > Microsoft Configuration Manager</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus > WSUS </a>
|
||||
ms.date: 03/13/2019
|
||||
ms.date: 04/22/2024
|
||||
---
|
||||
|
||||
# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager
|
||||
|
||||
This reference article describes how to make Features on Demand (FoDs) and language packs available when you're using Windows Server Update Services (WSUS) or Configuration Manager for specific versions of Windows.
|
||||
|
||||
This article describes how to make Features on Demand and language packs available when you're using WSUS or Configuration Manager for specific versions of Windows.
|
||||
## High-level changes affecting Features on Demand and language pack content
|
||||
|
||||
## Version information for Features on Demand and language packs
|
||||
The following changes for FoD and language pack content affected how client policy needs to be configured:
|
||||
|
||||
- Starting in Windows 10 version 1709, you can't use WSUS to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FoDs) locally.
|
||||
- Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS.
|
||||
|
||||
In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features.
|
||||
Due to these changes, the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](/windows/client-management/mdm/policy-csp-admx-servicing)) policy, located under `Computer Configuration\Administrative Templates\System` was used to specify alternate ways to acquire FoDs and language packs, along with content for corruption repair. This policy allows specifying one alternate location. It's important to note the policy behaves differently across OS versions. For more information, see the [Version specific information for Features on Demand and language packs](#version-specific-information-for-features-on-demand-and-language-packs) section.
|
||||
|
||||
As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS.
|
||||
The introduction of the **Specify source service for specific classes of Windows Updates** ([SetPolicyDrivenUpdateSourceFor<UpdateClass\>](/windows/client-management/mdm/policy-csp-update#setpolicydrivenupdatesourceforfeatureupdates)) policy in Windows 10, version 2004 further complicated configuring settings for FoD and language pack content.
|
||||
|
||||
The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions.
|
||||
Starting in Windows 11, version 22H2, on-premises Unified Update Platform (UUP) updates were introduced. FoDs and language packs are available from WSUS again. It's no longer necessary to use the **Specify settings for optional component installation and component repair** policy for FoD and language pack content.
|
||||
|
||||
In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired.
|
||||
## Version specific information for Features on Demand and language packs
|
||||
|
||||
In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location.
|
||||
Windows 11, version 22H2, and later clients use on-premises Unified Update Platform (UUP) updates with WSUS and Microsoft Configuration Manager. These clients don't need to use **Specify settings for optional component installation and component repair** for FoDs and language packs since the content is available in WSUS due to on-premises UUP.
|
||||
|
||||
For Windows 10, version 2004 through Windows 11, version 21H2, clients can't download FoDs or language packs when **Specify settings for optional component installation and component repair** is set to Windows Update and **Specify source service for specific classes of Windows Updates** ([SetPolicyDrivenUpdateSourceFor<FeatureUpdates/QualityUpdates>](/windows/client-management/mdm/policy-csp-update#setpolicydrivenupdatesourceforfeatureupdates)) for either feature or quality updates is set to WSUS. If you need this content, you can set **Specify settings for optional component installation and component repair** to Windows Update and then either:
|
||||
- Change the source selection for feature and quality updates to Windows Update
|
||||
- Allow all classes of updates to come from WSUS by not configuring any source selections <!--8907933-->
|
||||
|
||||
> [!Note]
|
||||
> In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features.
|
||||
|
||||
In Windows 10 version 1809 and later, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update (until Windows 11 version 22H2). It's currently not possible to acquire them from a network share. Specifying a network location works for FoD packages or corruption repair, depending on the content at that location.
|
||||
|
||||
In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FoD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired.
|
||||
|
||||
For all OS versions, changing the **Specify settings for optional component installation and component repair** policy doesn't affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location.
|
||||
|
||||
Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/).
|
||||
Learn about other client management options, including using Group Policy and administrative templates, in [Manage Windows clients](/windows/client-management/).
|
||||
|
||||
## More resources
|
||||
|
||||
|
||||
@ -10,4 +10,6 @@ ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-overview.md and the deployment-service-prerequisites.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
Windows Update for Business deployment service is a Windows service hosted in Azure that uses Windows diagnostic data. You should be aware that Windows Update for Business deployment service doesn't meet [US Government community compliance (GCC)](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#us-government-community-compliance) requirements. For a list of GCC offerings for Microsoft products and services, see the [Microsoft Trust Center](/compliance/regulatory/offering-home). Windows Update for Business deployment service is available in the Azure Commercial cloud, but not available for GCC High or United States Department of Defense customers.
|
||||
Windows Update for Business deployment service is a Windows service hosted in Azure Commercial that uses Windows diagnostic data. While customers with GCC tenants may choose to use it, the Windows Update for Business deployment service is outside the [US Government community compliance (GCC)](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#us-government-community-compliance) boundary. For a list of GCC offerings for Microsoft products and services, see the [Microsoft Trust Center](/compliance/regulatory/offering-home).
|
||||
|
||||
Windows Update for Business deployment service isn't available in Azure Government for [Office 365 GCC High and DoD](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc-high-and-dod) tenants.
|
||||
|
||||
@ -19,7 +19,6 @@ Accessing Windows Update for Business reports typcially requires permissions fro
|
||||
|
||||
To [enroll](../wufb-reports-enable.md#bkmk_enroll) into Windows Update for Business reports from the [Azure portal](https://portal.azure.com) or the [Microsoft 365 admin center](https://admin.microsoft.com) requires one of the following roles:
|
||||
|
||||
- [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator) Microsoft Entra role
|
||||
- [Intune Administrator](/azure/active-directory/roles/permissions-reference#intune-administrator) Microsoft Entra role
|
||||
- [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator) Microsoft Entra role
|
||||
- [Policy and profile manager](/mem/intune/fundamentals/role-based-access-control#built-in-roles) Microsoft Intune role
|
||||
|
||||
@ -13,7 +13,7 @@ appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server</a>
|
||||
ms.date: 12/05/2023
|
||||
ms.date: 07/10/2024
|
||||
---
|
||||
|
||||
# Update Windows installation media with Dynamic Update
|
||||
@ -38,10 +38,10 @@ Devices must be able to connect to the internet to obtain Dynamic Updates. In so
|
||||
|
||||
## Acquire Dynamic Update packages
|
||||
|
||||
You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https://catalog.update.microsoft.com). At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. Check various parts of the results to be sure you've identified the needed files. The following tables show the key values to search for or look for in the results.
|
||||
You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https://catalog.update.microsoft.com). At that site, use the search bar in the upper right to find the Dynamic Update packages for a particular release. The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. Check various parts of the results to be sure you've identified the files needed. The following tables show the key values to search for or look for in the results.
|
||||
|
||||
### Windows 11, version 22H2 Dynamic Update packages
|
||||
**Title** can distinguish each Dynamic Package. Cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update.
|
||||
### Windows 11, version 22H2 and later Dynamic Update packages
|
||||
**Title** can distinguish each Dynamic Package. Latest cumulative updates have the servicing stack embedded. The servicing stack is published only if necessary for a given cumulative update.Titles below are for Windows 11, version 22H2. Windows 11, version 23H2 and 24H2 have a similar format.
|
||||
|
||||
| Update packages |Title |
|
||||
|-----------------------------------|---------------------------------------------------------------|
|
||||
@ -61,7 +61,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https
|
||||
|Latest cumulative update | YYYY-MM Cumulative Update for Windows 11 | | |
|
||||
|Servicing stack Dynamic Update | YYYY-MM Servicing Stack Update for Windows 11 Version 21H2 | | |
|
||||
|
||||
### For Windows 10, version 22H2 Dynamic Update packages
|
||||
### Windows 10, version 22H2 Dynamic Update packages
|
||||
**Title**, **Product** and **Description** are required to distinguish each Dynamic Package. Latest cumulative update has the servicing stack embedded. Servicing stack published separately only if necessary as a prerequisite for a given cumulative update.
|
||||
|
||||
| Update packages |Title |Product |Description |
|
||||
@ -75,7 +75,7 @@ If you want to customize the image with additional languages or Features on Dema
|
||||
|
||||
## Update Windows installation media
|
||||
|
||||
Properly updating the installation media involves a large number of actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include:
|
||||
Properly updating the installation media involves many actions operating on several different targets (image files). Some actions are repeated on different targets. The target images files include:
|
||||
|
||||
- Windows Preinstallation Environment (WinPE): a small operating system used to install, deploy, and repair Windows operating systems
|
||||
- Windows Recovery Environment (WinRE): repairs common causes of unbootable operating systems. WinRE is based on WinPE and can be customized with additional drivers, languages, optional packages, and other troubleshooting or diagnostic tools.
|
||||
@ -86,7 +86,7 @@ This table shows the correct sequence for applying the various tasks to the file
|
||||
|
||||
|Task |WinRE (winre.wim) |Operating system (install.wim) | WinPE (boot.wim) | New media |
|
||||
|-----------------------------------|-------------------|--------------------------------|------------------|-----------|
|
||||
|Add servicing stack Dynamic Update | 1 | 9 | 17 | |
|
||||
|Add servicing stack Dynamic Update | 1 | 9 | 17 | |
|
||||
|Add language pack | 2 | 10 | 18 | |
|
||||
|Add localized optional packages | 3 | | 19 | |
|
||||
|Add font support | 4 | | 20 | |
|
||||
@ -119,6 +119,13 @@ You don't have to add more languages and features to the image to accomplish the
|
||||
|
||||
Optional Components, along with the .NET feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid the cleanup failure. One option is to skip the image cleanup step, though that results in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you'll have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month).
|
||||
|
||||
|
||||
### Checkpoint cumulative updates
|
||||
Starting with Windows 11, version 24H2, the latest cumulative update may have a prerequisite cumulative update that is required to be installed first. These are known as checkpoint cumulative updates. In these cases, the cumulative update file level differentials are based on a previous cumulative update instead of the Windows RTM release. The benefit is a smaller update package and faster installation. When you obtain the latest cumulative update from the [Microsoft Update Catalog](https://catalog.update.microsoft.com), checkpoint cumulative updates will be available from the download button. In addition, the knowledge base article for the cumulative update will provide additional information.
|
||||
|
||||
To install the checkpoint(s) when servicing the Windows OS (steps 9 & 12) and WinPE (steps 17 & 23), call `Add-WindowsPackage` with the target cumulative update. The folder from `-PackagePath` will be used to discover and install one or more checkpoints as needed. Only the target cumulative update and checkpoint cumulative updates should be in the `-PackagePath` folder. Cumulative update packages with a revision <= the target cumulative update will be processed. If you are not customizing the image with additional languages and/or optional features, then separate calls to `Add-WindowsPackage` (checkpoint cumulative updates first) can be used for steps 9 & 17 above. Separate calls cannot be used for steps 12 and 23.
|
||||
|
||||
|
||||
## Windows PowerShell scripts to apply Dynamic Updates to an existing image
|
||||
|
||||
These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure:
|
||||
@ -150,12 +157,13 @@ $LANG_FONT_CAPABILITY = "jpan"
|
||||
# If you are using this script for Windows 10, modify to mount and use the LANGPACK ISO.
|
||||
$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso"
|
||||
|
||||
# Declare Dynamic Update packages
|
||||
$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu"
|
||||
$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu"
|
||||
$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab"
|
||||
$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab"
|
||||
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu"
|
||||
# Declare Dynamic Update packages. A dedicated folder is used for the latest cumulative update, and as needed
|
||||
# checkpoint cumulative updates.
|
||||
$LCU_PATH = "C:\mediaRefresh\packages\CU\LCU.msu"
|
||||
$SSU_PATH = "C:\mediaRefresh\packages\Other\SSU_DU.msu"
|
||||
$SETUP_DU_PATH = "C:\mediaRefresh\packages\Other\Setup_DU.cab"
|
||||
$SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\Other\SafeOS_DU.cab"
|
||||
$DOTNET_CU_PATH = "C:\mediaRefresh\packages\Other\DotNet_CU.msu"
|
||||
|
||||
# Declare folders for mounted images and temp files
|
||||
$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia"
|
||||
@ -211,14 +219,14 @@ This process is repeated for each edition of Windows within the main operating s
|
||||
# Update each main OS Windows image including the Windows Recovery Environment (WinRE)
|
||||
#
|
||||
|
||||
# Get the list of images contained within WinPE
|
||||
# Get the list of images contained within the main OS
|
||||
$WINOS_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim"
|
||||
|
||||
Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
|
||||
# first mount the main OS image
|
||||
Write-Output "$(Get-TS): Mounting main OS, image index $($IMAGE.ImageIndex)"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index $IMAGE.ImageIndex -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index $IMAGE.ImageIndex -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null
|
||||
|
||||
if ($IMAGE.ImageIndex -eq "1") {
|
||||
|
||||
@ -237,19 +245,22 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
# Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published seperately; the combined
|
||||
# cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined
|
||||
# cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the
|
||||
# combined cumulative update can be installed.
|
||||
# combined cumulative update can be installed.
|
||||
|
||||
# This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
# Now, attempt the combined cumulative update.
|
||||
# There is a known issue where the servicing stack update is installed, but the cumulative update will fail. This error should
|
||||
# be caught and ignored, as the last step will be to apply the Safe OS update and thus the image will be left with the correct
|
||||
# packages installed.
|
||||
|
||||
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH to WinRE"
|
||||
try
|
||||
{
|
||||
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $LCU_PATH | Out-Null
|
||||
}
|
||||
Catch
|
||||
@ -270,29 +281,27 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
# update. This second approach is commented out below.
|
||||
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
#
|
||||
# Optional: Add the language to recovery environment
|
||||
#
|
||||
# Install lp.cab cab
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Install language cabs for each optional package installed
|
||||
$WINRE_INSTALLED_OC = Get-WindowsPackage -Path $WINRE_MOUNT
|
||||
Foreach ($PACKAGE in $WINRE_INSTALLED_OC) {
|
||||
|
||||
if ( ($PACKAGE.PackageState -eq "Installed") `
|
||||
-and ($PACKAGE.PackageName.startsWith("WinPE-")) `
|
||||
-and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
|
||||
if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
|
||||
|
||||
$INDEX = $PACKAGE.PackageName.IndexOf("-Package")
|
||||
if ($INDEX -ge 0) {
|
||||
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
|
||||
if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
|
||||
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
@ -301,7 +310,7 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
|
||||
# Add font support for the new language
|
||||
if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
@ -309,16 +318,16 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
# Add Safe OS
|
||||
Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH to WinRE"
|
||||
Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
@ -347,54 +356,54 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
# includes the servicing stack updates (i.e. SSU + LCU are combined). Windows 11, version 21H2 and Windows 11, version 22H2 are examples. In these
|
||||
# cases, the servicing stack update is not published seperately; the combined cumulative update should be used for this step. However, in hopefully
|
||||
# rare cases, there may breaking change in the combined cumulative update format, that requires a standalone servicing stack update to be published,
|
||||
# and installed first before the combined cumulative update can be installed.
|
||||
# and installed first before the combined cumulative update can be installed.
|
||||
|
||||
# This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
# Now, attempt the combined cumulative update. Unlike WinRE and WinPE, we don't need to check for error 0x8007007e
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH | Out-Null
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH | Out-Null
|
||||
|
||||
# The second approach for Step 18 is for Windows releases that have not adopted the combined cumulative update
|
||||
# but instead continue to have a seperate servicing stack update published. In this case, we'll install the SSU
|
||||
# update. This second approach is commented out below.
|
||||
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH to main OS, index $($IMAGE.ImageIndex)"
|
||||
# Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
# Optional: Add language to main OS
|
||||
Write-Output "$(Get-TS): Adding package $OS_LP_PATH"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null
|
||||
Write-Output "$(Get-TS): Adding package $OS_LP_PATH to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Optional: Add a Features on Demand to the image
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0"
|
||||
Write-Output "$(Get-TS): Adding language FOD: Language.Speech~~~$LANG~0.0.1.0 to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Note: If I wanted to enable additional Features on Demand, I'd add these here.
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Output "$(Get-TS): Performing image cleanup on main OS"
|
||||
Write-Output "$(Get-TS): Performing image cleanup on main OS, index $($IMAGE.ImageIndex)"
|
||||
DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null
|
||||
|
||||
#
|
||||
@ -403,11 +412,11 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
# the image to be booted, and thus if we tried to cleanup after installation, it would fail.
|
||||
#
|
||||
|
||||
Write-Output "$(Get-TS): Adding NetFX3~~~~"
|
||||
Write-Output "$(Get-TS): Adding NetFX3~~~~ to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Add .NET Cumulative Update
|
||||
Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH to main OS, index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Dismount
|
||||
@ -420,6 +429,7 @@ Foreach ($IMAGE in $WINOS_IMAGES) {
|
||||
}
|
||||
|
||||
Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null
|
||||
|
||||
```
|
||||
|
||||
### Update WinPE
|
||||
@ -438,7 +448,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
# update WinPE
|
||||
Write-Output "$(Get-TS): Mounting WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null
|
||||
|
||||
# Add servicing stack update (Step 9 from the table)
|
||||
|
||||
@ -448,11 +458,11 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
# Windows 11, version 22H2 are examples. In these cases, the servicing stack update is not published separately; the combined
|
||||
# cumulative update should be used for this step. However, in hopefully rare cases, there may breaking change in the combined
|
||||
# cumulative update format, that requires a standalone servicing stack update to be published, and installed first before the
|
||||
# combined cumulative update can be installed.
|
||||
# combined cumulative update can be installed.
|
||||
|
||||
# This is the code to handle the rare case that the SSU is published and required for the combined cumulative update
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
# Now, attempt the combined cumulative update.
|
||||
# There is a known issue where the servicing stack update is installed, but the cumulative update will fail.
|
||||
@ -461,6 +471,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
try
|
||||
{
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH | Out-Null
|
||||
}
|
||||
Catch
|
||||
@ -481,19 +492,17 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
# update. This second approach is commented out below.
|
||||
|
||||
# Write-Output "$(Get-TS): Adding package $SSU_PATH"
|
||||
# Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
# Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH | Out-Null
|
||||
|
||||
# Install lp.cab cab
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Install language cabs for each optional package installed
|
||||
$WINPE_INSTALLED_OC = Get-WindowsPackage -Path $WINPE_MOUNT
|
||||
Foreach ($PACKAGE in $WINPE_INSTALLED_OC) {
|
||||
|
||||
if ( ($PACKAGE.PackageState -eq "Installed") `
|
||||
-and ($PACKAGE.PackageName.startsWith("WinPE-")) `
|
||||
-and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
|
||||
if ( ($PACKAGE.PackageState -eq "Installed") -and ($PACKAGE.PackageName.startsWith("WinPE-")) -and ($PACKAGE.ReleaseType -eq "FeaturePack") ) {
|
||||
|
||||
$INDEX = $PACKAGE.PackageName.IndexOf("-Package")
|
||||
if ($INDEX -ge 0) {
|
||||
@ -501,7 +510,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
$OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab"
|
||||
if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) {
|
||||
$OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $OC_CAB_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
@ -510,7 +519,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
|
||||
# Add font support for the new language
|
||||
if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) {
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
@ -518,10 +527,10 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) {
|
||||
if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) {
|
||||
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH"
|
||||
Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null
|
||||
}
|
||||
}
|
||||
@ -533,11 +542,11 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
}
|
||||
|
||||
# Add latest cumulative update
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
Write-Output "$(Get-TS): Adding package $LCU_PATH to WinPE, image index $($IMAGE.ImageIndex)"
|
||||
Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null
|
||||
|
||||
# Perform image cleanup
|
||||
Write-Output "$(Get-TS): Performing image cleanup on WinPE"
|
||||
Write-Output "$(Get-TS): Performing image cleanup on WinPE, image index $($IMAGE.ImageIndex)"
|
||||
DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup /ResetBase /Defer | Out-Null
|
||||
|
||||
if ($IMAGE.ImageIndex -eq "2") {
|
||||
@ -545,6 +554,18 @@ Foreach ($IMAGE in $WINPE_IMAGES) {
|
||||
# Save setup.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder
|
||||
Copy-Item -Path $WINPE_MOUNT"\sources\setup.exe" -Destination $WORKING_PATH"\setup.exe" -Force -ErrorAction stop | Out-Null
|
||||
|
||||
# Save setuphost.exe for later use. This will address possible binary mismatch with the version in the main OS \sources folder
|
||||
# This is only required starting with Windows 11 version 24H2
|
||||
$TEMP = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex
|
||||
if ([System.Version]$TEMP.Version -ge [System.Version]"10.0.26100") {
|
||||
|
||||
Copy-Item -Path $WINPE_MOUNT"\sources\setuphost.exe" -Destination $WORKING_PATH"\setuphost.exe" -Force -ErrorAction stop | Out-Null
|
||||
}
|
||||
else {
|
||||
|
||||
Write-Output "$(Get-TS): Skipping copy of setuphost.exe; image version $($TEMP.Version)"
|
||||
}
|
||||
|
||||
# Save serviced boot manager files later copy to the root media.
|
||||
Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgfw.efi" -Destination $WORKING_PATH"\bootmgfw.efi" -Force -ErrorAction stop | Out-Null
|
||||
Copy-Item -Path $WINPE_MOUNT"\Windows\boot\efi\bootmgr.efi" -Destination $WORKING_PATH"\bootmgr.efi" -Force -ErrorAction stop | Out-Null
|
||||
@ -580,21 +601,26 @@ cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PA
|
||||
Write-Output "$(Get-TS): Copying $WORKING_PATH\setup.exe to $MEDIA_NEW_PATH\sources\setup.exe"
|
||||
Copy-Item -Path $WORKING_PATH"\setup.exe" -Destination $MEDIA_NEW_PATH"\sources\setup.exe" -Force -ErrorAction stop | Out-Null
|
||||
|
||||
# Copy setuphost.exe from boot.wim, saved earlier.
|
||||
if (Test-Path -Path $WORKING_PATH"\setuphost.exe") {
|
||||
|
||||
Write-Output "$(Get-TS): Copying $WORKING_PATH\setuphost.exe to $MEDIA_NEW_PATH\sources\setuphost.exe"
|
||||
Copy-Item -Path $WORKING_PATH"\setuphost.exe" -Destination $MEDIA_NEW_PATH"\sources\setuphost.exe" -Force -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
# Copy bootmgr files from boot.wim, saved earlier.
|
||||
$MEDIA_NEW_FILES = Get-ChildItem $MEDIA_NEW_PATH -Force -Recurse -Filter b*.efi
|
||||
|
||||
Foreach ($File in $MEDIA_NEW_FILES){
|
||||
if (($File.Name -ieq "bootmgfw.efi") -or `
|
||||
($File.Name -ieq "bootx64.efi") -or `
|
||||
($File.Name -ieq "bootia32.efi") -or `
|
||||
($File.Name -ieq "bootaa64.efi"))
|
||||
if (($File.Name -ieq "bootmgfw.efi") -or ($File.Name -ieq "bootx64.efi") -or ($File.Name -ieq "bootia32.efi") -or ($File.Name -ieq "bootaa64.efi"))
|
||||
{
|
||||
|
||||
Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgfw.efi to $($File.FullName)"
|
||||
Copy-Item -Path $WORKING_PATH"\bootmgfw.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null
|
||||
}
|
||||
elseif ($File.Name -ieq "bootmgr.efi")
|
||||
{
|
||||
|
||||
Write-Output "$(Get-TS): Copying $WORKING_PATH\bootmgr.efi to $($File.FullName)"
|
||||
Copy-Item -Path $WORKING_PATH"\bootmgr.efi" -Destination $File.FullName -Force -ErrorAction stop | Out-Null
|
||||
}
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 292 KiB After Width: | Height: | Size: 118 KiB |
@ -11,11 +11,11 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/15/2023
|
||||
ms.date: 04/22/2024
|
||||
---
|
||||
|
||||
# Migrating and acquiring optional Windows content during updates
|
||||
|
||||
|
||||
This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term.
|
||||
|
||||
When you update the operating system, it's critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a *media-based* or *task-sequence-based* update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a *servicing-based* update).
|
||||
@ -28,7 +28,8 @@ Optional content includes the following items:
|
||||
|
||||
- General Features on Demand also referred to as FODs (for example, Windows Mixed Reality)
|
||||
- Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0)
|
||||
- Local Experience Packs
|
||||
- Local Experience Packs
|
||||
- Language packs
|
||||
|
||||
Optional content isn't included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it's released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This approach provides more space for user's data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network.
|
||||
|
||||
@ -137,7 +138,8 @@ Several of the options address ways to address optional content migration issues
|
||||
- This setting doesn't support installing language packs from an alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired.
|
||||
- If this setting isn't configured or disabled, files are downloaded from the default Windows Update location, for example Windows Update for Business or WSUS.
|
||||
|
||||
For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source).
|
||||
|
||||
For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) and [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](fod-and-lang-packs.md).
|
||||
|
||||
|
||||
## More resources
|
||||
|
||||
@ -1,63 +0,0 @@
|
||||
---
|
||||
title: Determine application readiness
|
||||
description: How to test your apps to identify which need attention prior to deploying an update in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Determine application readiness
|
||||
|
||||
Before you deploy a Windows client update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps](plan-define-readiness.md) with respect to their criticality in your organization.
|
||||
|
||||
## Validation methods
|
||||
|
||||
You can choose from various methods to validate apps. Exactly which ones to use depends on the specifics of your environment.
|
||||
|
||||
|
||||
|Validation method |Description |
|
||||
|---------|---------|
|
||||
|Full regression | A full quality assurance probing. Staff that know the application well and can validate its core functionality should do this validation. |
|
||||
|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they're validating. |
|
||||
|Automated testing | Software performs tests automatically. The software lets you know whether the tests have passed or failed, and provides detailed reporting for you automatically. |
|
||||
|Test in pilot | You preselect users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. |
|
||||
|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren't handled by enterprise application distribution. |
|
||||
|
||||
Combining the various validation methods with the app classifications you've previously established might look like this:
|
||||
|
||||
|
||||
|Validation method |Critical apps |Important apps |Not important apps |
|
||||
|---------|---------|---------|---------|
|
||||
|Full regression | x | | |
|
||||
|Smoke testing | | x | |
|
||||
|Automated testing | x | x | x |
|
||||
|Test in pilot | x | x | x |
|
||||
|
||||
|
||||
### Identify users
|
||||
|
||||
Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you have to choose which users are best suited for validation testing. Some factors to consider include:
|
||||
|
||||
- **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in?
|
||||
- **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work?
|
||||
- **Technical ability**: Do the users have enough technical competence to provide useful feedback from various test scenarios?
|
||||
|
||||
You could seek volunteers who enjoy working with new features and include them in the pilot deployment. You might want to avoid using core users like department heads or project managers. Current application owners, operations personnel, and developers can help you identify the most appropriate pilot users.
|
||||
|
||||
### Identify and set up devices for validation
|
||||
|
||||
In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection includes devices representing all of the hardware models in your environment.
|
||||
|
||||
There's more than one way to choose devices for app validation:
|
||||
|
||||
- **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles.
|
||||
- **Manual selection**: Some internal groups like operations have expertise to help choose devices manually based on specifications, usage, or records of past support problems.
|
||||
- **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices.
|
||||
@ -1,14 +1,14 @@
|
||||
---
|
||||
title: Prepare to deploy Windows
|
||||
description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users
|
||||
description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: concept-article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
@ -19,7 +19,7 @@ ms.date: 12/31/2017
|
||||
Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase left you with these useful items:
|
||||
|
||||
- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md)
|
||||
- A plan for [testing and validating](plan-determine-app-readiness.md) apps
|
||||
- A plan for [testing and validating](/windows/compatibility/windows-11/testing-guidelines) apps
|
||||
- An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness
|
||||
- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use
|
||||
|
||||
@ -35,7 +35,7 @@ Your infrastructure probably includes many different components and tools. You n
|
||||
|
||||
1. Review all of the infrastructure changes that you've identified in your plan. It's important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on.
|
||||
|
||||
2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment.
|
||||
2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment.
|
||||
|
||||
3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure.
|
||||
|
||||
@ -105,7 +105,6 @@ Ensure that devices can reach necessary Windows Update endpoints through the fir
|
||||
|Protocol |Endpoint URL |
|
||||
|---------|---------|
|
||||
|TLS 1.2 | `*.prod.do.dsp.mp.microsoft.com` |
|
||||
|HTTP | `emdl.ws.microsoft.com` |
|
||||
|HTTP | `*.dl.delivery.mp.microsoft.com` |
|
||||
|HTTP | `*.windowsupdate.com` |
|
||||
|HTTPS | `*.delivery.mp.microsoft.com` |
|
||||
@ -167,11 +166,11 @@ You can also create and run scripts to perform additional cleanup actions on dev
|
||||
|
||||
In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You need to complete these higher-level tasks to gain those new capabilities:
|
||||
|
||||
- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates.
|
||||
- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates.
|
||||
|
||||
- Validate new changes to understand how they affect the wider environment.
|
||||
|
||||
- Remediate any potential problems that have been identified through validation.
|
||||
- Remediate any potential problems that have been identified through validation.
|
||||
|
||||
## Prepare users
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 05/19/2023
|
||||
ms.date: 06/04/2024
|
||||
---
|
||||
|
||||
# Update release cycle for Windows clients
|
||||
@ -56,18 +56,15 @@ Many update management tools, such as [Microsoft Configuration Manager](/mem/con
|
||||
|
||||
## Optional nonsecurity preview release
|
||||
|
||||
**Optional nonsecurity preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional nonsecurity preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows.
|
||||
**Optional nonsecurity preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional nonsecurity preview release**, then ship in the following **monthly security update release**. **Optional nonsecurity preview releases** are typically released on the fourth Tuesday of the month at 10:00 AM Pacific Time (PST/PDT). These releases are only offered to the most recent, supported versions of Windows.
|
||||
|
||||
**Optional nonsecurity preview releases** might commonly be referred to as:
|
||||
|
||||
- C or D week releases (meaning the third or fourth week of the month)
|
||||
- D week releases (meaning the fourth week of the month)
|
||||
- Preview updates
|
||||
- Preview CU
|
||||
- LCU preview
|
||||
|
||||
> [!Important]
|
||||
> Starting in April 2023, all **optional nonsecurity preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features.
|
||||
|
||||
To access the optional nonsecurity preview release:
|
||||
- Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**.
|
||||
- Use [Windows Insider Program for Business](https://insider.windows.com/for-business)
|
||||
@ -77,7 +74,7 @@ To access the optional nonsecurity preview release:
|
||||
|
||||
**Out-of-band (OOB) releases** might be provided to fix a recently identified issue or vulnerability. They're used in atypical cases when an issue is detected and can't wait for the next monthly release, because devices must be updated immediately to address security vulnerabilities or to resolve a quality issue impacting many devices. **Out-of-band (OOB) releases** are provided outside of the monthly schedule when there's an exceptional need.
|
||||
|
||||
Some key considerations about OOB releases include:
|
||||
Some key considerations about OOB releases include:
|
||||
|
||||
- OOB releases are always cumulative.
|
||||
- OOB releases supersede any prior monthly security update and optional nonsecurity preview release.
|
||||
|
||||
@ -0,0 +1,71 @@
|
||||
---
|
||||
title: Defining Windows update-managed devices
|
||||
description: This article provides clarity on the terminology and practices involved in managing Windows updates for both managed and unmanaged devices.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: overview
|
||||
ms.date: 06/25/2024
|
||||
author: v-fvalentyna
|
||||
ms.author: v-fvalentyna
|
||||
ms.reviewer: mstewart,thtrombl,arcarley
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
---
|
||||
|
||||
# Defining Windows update-managed devices
|
||||
|
||||
As an IT administrator, understanding the differences between managed and unmanaged devices is crucial for effective Windows update management. This article provides clarity on the terminology and practices involved in managing Windows updates for both types of devices.
|
||||
|
||||
## What are update-managed Windows devices?
|
||||
|
||||
Update-managed devices are those where an IT administrator or organization controls Windows updates through a management tool, such as Microsoft Intune, or by directly setting policies. You can directly set policies with group policy objects (GPO), configuration service provider (CSP) policies, or Microsoft Graph.
|
||||
|
||||
> [!NOTE]
|
||||
> This definition is true even if you directly set registry keys. However, we don't recommended doing this action because registry keys can be easily overwritten.
|
||||
|
||||
Managed devices can include desktops, laptops, tablets, servers, and manufacturing equipment. These devices are secured and configured according to your organization's standards and policies.
|
||||
|
||||
### IT-managed: Windows update offering
|
||||
|
||||
Devices are considered Windows update-managed if you manage the update offering in the following ways:
|
||||
|
||||
- You configure policies to manage which updates are offered to the specific device.
|
||||
- You set when your organization should receive feature, quality, and driver updates, among others.
|
||||
- You use [group policy objects (GPO)](/windows/deployment/update/waas-wufb-group-policy), [configuration service provider (CSP)](/windows/client-management/mdm/policy-csp-update#update-allowupdateservice), or [Microsoft Graph](/windows/deployment/update/deployment-service-overview) to configure these offerings.
|
||||
|
||||
### IT-managed: Windows update experience
|
||||
|
||||
Devices are considered Windows update-managed if you use policies (GPO, CSP, or Microsoft Graph) to manage device behavior when taking Windows updates.
|
||||
|
||||
Examples of controllable device behavior include active hours, update grace periods and deadlines, update notifications, update scheduling, and more. Consult the complete list at [Update Policy CSP](/windows/client-management/mdm/policy-csp-update).
|
||||
|
||||
## Examples of update-managed Windows devices
|
||||
|
||||
Here are a few examples of update-managed devices:
|
||||
|
||||
- **Company-owned devices:** Devices provisioned by your IT department with corporate credentials, configurations, and policies.
|
||||
- **Employee-owned devices in BYOD programs:** Personally owned devices that are enrolled in the company's device management system to securely access corporate resources.
|
||||
- **Devices provisioned through Windows Autopilot:** Devices that are set up and preconfigured to be business-ready right out of the box.
|
||||
- **Mandated security settings:** Devices with health requirements such as device encryption, PIN or strong password, specific inactivity timeout periods, and up-to-date operating systems.
|
||||
- **Intune-enrolled devices:** Devices enrolled in Microsoft Intune for network access and enforced security policies.
|
||||
- **Third-party managed devices:** Devices enrolled in non-Microsoft management tools with configured Windows update policies via GPO, CSP, or registry key.
|
||||
|
||||
## What are update-unmanaged Windows devices?
|
||||
|
||||
Unlike update-managed devices, unmanaged devices aren't controlled through policies, management tools, or software. These devices aren't enrolled in tools like Microsoft Intune or Configuration Manager. If you only configure the Settings page to control overall device behavior when taking updates, it's considered an unmanaged device.
|
||||
|
||||
> [!NOTE]
|
||||
> The term "Microsoft managed devices" used to refer to what we now call "update unmanaged Windows devices." Based on feedback, we have updated our terminology for clarity.
|
||||
|
||||
## Examples of update-unmanaged Windows devices
|
||||
|
||||
Examples of update-unmanaged devices include:
|
||||
|
||||
- **Personal devices:** Devices owned by individuals at your organization that aren't enrolled in any corporate management system.
|
||||
- **BYOD devices not enrolled in management programs:** Devices used for work but not part of an organizational bring your own device (BYOD) program.
|
||||
- **Peripheral devices:** Devices like printers, IP phones, and uninterruptible power supplies (UPS) that can't accept centrally managed administrative credentials.
|
||||
|
||||
For more information on managed and unmanaged devices, see [Secure managed and unmanaged devices](/microsoft-365/business-premium/m365bp-managed-unmanaged-devices).
|
||||
@ -1,17 +1,17 @@
|
||||
---
|
||||
title: Update other Microsoft products
|
||||
title: Update other Microsoft products
|
||||
titleSuffix: Windows Update for Business
|
||||
description: List of other Microsoft products that are updated when install updates for other Microsoft products (allowmuupdateservice) is used.
|
||||
description: List of other Microsoft products that are updated when install updates for other Microsoft products (allowmuupdateservice) is used.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: reference
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 02/27/2024
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 06/07/2024
|
||||
---
|
||||
|
||||
# Update other Microsoft products
|
||||
@ -23,7 +23,7 @@ This article contains a list of other Microsoft products that might be updated w
|
||||
- **MDM**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowmuupdateservice)
|
||||
|
||||
> [!Note]
|
||||
> This policy includes drivers. If you need to exclude drivers, use [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update&bc=/windows/deployment/breadcrumb/toc.json#excludewudriversinqualityupdate).
|
||||
> This policy includes drivers. If you need to exclude drivers, use [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#excludewudriversinqualityupdate).
|
||||
|
||||
|
||||
## List of other Microsoft products
|
||||
@ -44,6 +44,7 @@ The following is a list of other Microsoft products that might be updated:
|
||||
- Microsoft Advanced Threat Analytics
|
||||
- Microsoft Application Virtualization
|
||||
- Microsoft Azure StorSimple
|
||||
- Microsoft Configuration Manager
|
||||
- Microsoft Dynamics CRM
|
||||
- Microsoft Information Protection
|
||||
- Microsoft Lync Server and Microsoft Lync
|
||||
@ -52,25 +53,25 @@ The following is a list of other Microsoft products that might be updated:
|
||||
- Microsoft StreamInsight
|
||||
- Mobile and IoT
|
||||
- MSRC
|
||||
- Office 2016 (MSI versions of Office)
|
||||
- .NET (also known as .NET Core)
|
||||
- Office 2016 (MSI versions of Office)
|
||||
- PlayReady
|
||||
- Windows Admin Center
|
||||
- Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware
|
||||
- Silverlight
|
||||
- Skype for Business
|
||||
- SQL
|
||||
- System Center Application Controller
|
||||
- System Center Configuration Manager
|
||||
- System Center Data Protection Manager
|
||||
- System Center Operations Manager
|
||||
- System Center Orchestrator
|
||||
- System Center Virtual Machine Manager
|
||||
- Visual Studio
|
||||
- Windows Admin Center
|
||||
- Windows Azure Hyper-V Recovery Manager
|
||||
- Windows Azure Pack - Web Sites
|
||||
- Windows Azure Pack
|
||||
- Windows Azure Service Bus
|
||||
- Windows Embedded Developer Update
|
||||
- Windows Intune
|
||||
- Windows Live Sign-in Assistant
|
||||
- Windows Small Business Server
|
||||
- Zune
|
||||
|
||||
@ -15,11 +15,11 @@ appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus > WSUS </a>
|
||||
ms.date: 12/31/2017
|
||||
ms.date: 04/22/2024
|
||||
---
|
||||
|
||||
# Deploy Windows client updates using Windows Server Update Services (WSUS)
|
||||
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 11/07/2023
|
||||
ms.date: 05/16/2024
|
||||
---
|
||||
|
||||
# What is Windows Update for Business?
|
||||
@ -112,7 +112,7 @@ Windows Update for Business provides controls to help meet your organization's s
|
||||
|
||||
#### Recommended experience settings
|
||||
|
||||
Features like the smart busy check (which ensure updates don't happen when a user is signed in) and active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features:
|
||||
Features like active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features:
|
||||
|
||||
1. Automatically download, install, and restart (default if no restart policies are set up or enabled).
|
||||
1. Use the default notifications.
|
||||
|
||||
@ -14,20 +14,20 @@ ms.collection:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
ms.date: 03/13/2024
|
||||
---
|
||||
|
||||
# Overview of Windows as a service
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2).
|
||||
|
||||
Windows as a service is a way to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
|
||||
Windows as a service is a way to simplify the lives of IT pros and maintain a consistent Windows experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
|
||||
|
||||
## Building
|
||||
|
||||
Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features. That scenario doesn't always work in today's rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges.
|
||||
|
||||
In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features are delivered to the [Windows Insider Program](/windows-insider/) as soon as possible, during the development cycle, through a process called *flighting*. Organizations can see exactly what Microsoft is developing and start their testing as soon as possible.
|
||||
In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. Now, new features are delivered to the [Windows Insider Program](/windows-insider/) as soon as possible, during the development cycle, through a process called *flighting*. Organizations can see exactly what Microsoft is developing and start their testing as soon as possible.
|
||||
|
||||
Microsoft also depends on receiving feedback from organizations throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider).
|
||||
|
||||
@ -35,7 +35,7 @@ Microsoft also runs extensive internal testing, with engineering teams installin
|
||||
|
||||
## Deploying
|
||||
|
||||
Deploying Windows 10 and Windows 11 is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, you can use an easy in-place upgrade process to automatically preserve all apps, settings, and data. Afterwards, deployment of feature updates is equally simple.
|
||||
Deploying a modern version of Windows is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, you can use an easy in-place upgrade process to automatically preserve all apps, settings, and data. Afterwards, deployment of feature updates is equally simple.
|
||||
|
||||
### Application compatibility
|
||||
|
||||
@ -43,7 +43,9 @@ Application compatibility testing has historically been a burden when approachin
|
||||
|
||||
## Servicing
|
||||
|
||||
Traditional Windows servicing has included several release types: major revisions (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10 and Windows 11, there are two release types: feature updates that add new functionality and quality updates that provide security and reliability fixes.
|
||||
Traditional Windows servicing has included several release types: major revisions (for example, the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10 and Windows 11, there are two release types:
|
||||
- **Quality updates**: Updates that provide security and reliability fixes and can also add new functionality or features periodically.
|
||||
- **Feature updates**: Updates that are released once a year on which the [servicing timeline](/lifecycle/faq/windows#windows-11) for the operating system is based. These updates can contain new features and functionality and previously released quality updates.
|
||||
|
||||
Servicing channels are the first way to separate users into deployment groups for feature and quality updates. For more information about developing a deployment strategy that uses servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
|
||||
@ -54,50 +56,42 @@ There are three servicing channels, each of which provides different levels of f
|
||||
There are currently three release channels for Windows clients:
|
||||
|
||||
- The **General Availability Channel** receives feature updates as soon as they're available.
|
||||
- The **Long-Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
|
||||
- The **Windows Insider Program** provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update.
|
||||
- The **Long-Term Servicing Channel** (LTSC) is designed to be used only for specialized devices such as those that control medical equipment or ATM machines. LTSC receives new feature releases every two to three years.
|
||||
- The **Windows Insider Program** provides organizations with the opportunity to test and provide feedback on features that will be shipped in upcoming updates.
|
||||
|
||||
>[!NOTE]
|
||||
>With each General Availability release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible.
|
||||
With each General Availability release, you would typically begin deploying right away to devices selected for early adoption (targeted validation) and then ramp up to full deployment at your discretion. This enables you to gain access to new features, experiences, and integrated security as soon as possible.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Devices on the General Availability Channel must have their diagnostic data set to **1 (Basic)** or higher in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
|
||||
> Devices on the General Availability Channel must have their diagnostic data set to **1 (Basic)** or higher in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
|
||||
|
||||
### Feature updates
|
||||
|
||||
New features are packaged into feature updates that you can deploy using existing management tools. These changes come in bite-sized chunks rather than all at once, decreasing user readiness time.
|
||||
You can deploy feature updates using existing management tools. These changes come in bite-sized chunks rather than all at once like in previous versions of Windows, decreasing user readiness time.
|
||||
|
||||
### Quality updates
|
||||
|
||||
Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn't, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of nonsecurity fixes.
|
||||
|
||||
Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month's update, containing both security and non-security fixes. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates.
|
||||
Rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators see one cumulative monthly update that supersedes the previous month's update, containing both security and nonsecurity payloads. This approach makes updating simpler and ensures that devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from updates.
|
||||
|
||||
## Servicing channels
|
||||
|
||||
There are three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [General Availability Channel](#general-availability-channel) provides new functionality with feature update releases. Organizations can choose when to deploy updates from the General Availability Channel. The [Long-Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For more information about the versions in each servicing channel, see [Windows release information](/windows/release-health/).
|
||||
|
||||
> [!NOTE]
|
||||
> Servicing channels aren't the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
Servicing channels aren't the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows client updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
|
||||
### General Availability Channel
|
||||
|
||||
In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you'll be able to choose the timing at which it goes into broad deployment.
|
||||
|
||||
When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. For more information about servicing tools, see [Servicing tools](#servicing-tools).
|
||||
When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel is available but not necessarily immediately mandatory, depending on the policy of the management system. Organizations can electively delay feature updates into as many phases as they wish by using servicing tools. For more information about servicing tools, see [Servicing tools](#servicing-tools).
|
||||
|
||||
> [!NOTE]
|
||||
> All releases of Windows 10 have **18 months of servicing for all editions**--these updates provide security and feature updates for the release. However, fall releases of the **Enterprise and Education editions** will have an **additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release**. This extended servicing window applies to Enterprise and Education editions starting with Windows 10, version 1607.
|
||||
>
|
||||
> Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
|
||||
### Long-term Servicing Channel
|
||||
|
||||
Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don't need feature updates as frequently as other devices in the organization. It's more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Enterprise LTSC devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSC clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
|
||||
> [!NOTE]
|
||||
>
|
||||
> The Long-term Servicing channel is not intended for deployment on most or all the devices in an organization; it should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the General Availability channel.
|
||||
The Long-term Servicing channel isn't intended for deployment on most or all the devices in an organization. It should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it's better suited for the General Availability channel.
|
||||
|
||||
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSC. Instead, it typically offers new LTSC releases every 2-3 years, and organizations can choose to install them as in-place upgrades or even skip releases over the product's lifecycle. Always check your individual LTSC release to verify its servicing lifecycle. For more information, see [release information](/windows/release-health/), or perform a search on the [product's lifecycle information](/lifecycle/products/) page.
|
||||
|
||||
@ -114,7 +108,7 @@ Microsoft recommends that all organizations have at least a few devices enrolled
|
||||
|
||||
## Servicing tools
|
||||
|
||||
There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
|
||||
There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows updates:
|
||||
|
||||
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the General Availability Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
|
||||
- **Windows Update for Business** includes control over update deferment and provides centralized management using Group Policy or MDM. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the General Availability Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Microsoft Intune.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Quick guide to Windows as a service (Windows 10)
|
||||
title: Quick guide to Windows as a service
|
||||
description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
@ -8,15 +8,15 @@ author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Quick guide to Windows as a service
|
||||
|
||||
Here's a quick guide to the most important concepts in Windows as a service. For more information, see the [extensive set of documentation](index.md).
|
||||
Here's a quick guide to the most important concepts in Windows as a service.
|
||||
|
||||
## Definitions
|
||||
|
||||
@ -25,10 +25,10 @@ Some new terms have been introduced as part of Windows as a service, so you shou
|
||||
- **Feature updates** are released annually. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
||||
- **Quality updates** deliver both security and nonsecurity fixes. They're typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they're important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md).
|
||||
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
||||
- **Servicing channels** allow organizations to choose when to deploy new features.
|
||||
- **Servicing channels** allow organizations to choose when to deploy new features.
|
||||
- The **General Availability Channel** receives feature updates annually.
|
||||
- The **Long-Term Servicing Channel**, which is meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATMs, receives new feature releases every two to three years.
|
||||
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
||||
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
||||
|
||||
For more information, see [Overview of Windows as a service](waas-overview.md).
|
||||
|
||||
@ -36,7 +36,7 @@ For some interesting in-depth information about how cumulative updates work, see
|
||||
|
||||
## Key concepts
|
||||
|
||||
With each release in the General Availability Channel, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion.
|
||||
With each release in the General Availability Channel, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion.
|
||||
|
||||
Windows Enterprise LTSC versions are separate **Long-Term Servicing Channel** versions. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years.
|
||||
|
||||
@ -44,10 +44,10 @@ For more information, see [Assign devices to servicing channels for Windows clie
|
||||
|
||||
## Staying up to date
|
||||
|
||||
To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products to help with this process. [Upgrade Readiness](/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help.
|
||||
To stay up to date, deploy feature updates at an appropriate time after their release. You can use various management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, and non-Microsoft products to help with this process.
|
||||
|
||||
Extensive advanced testing isn't required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin.
|
||||
|
||||
This process repeats with each new feature update. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
|
||||
|
||||
Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
||||
Other technologies such as [BranchCache](waas-branchcache.md) and [Delivery Optimization](../do/delivery-optimization-configure.md), both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
|
||||
|
||||
@ -11,7 +11,7 @@ ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 10/10/2023
|
||||
@ -43,7 +43,7 @@ When **Configure Automatic Updates** is enabled in Group Policy, you can also en
|
||||
- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device restarts at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**.
|
||||
|
||||
> [!NOTE]
|
||||
> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted.
|
||||
> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted.
|
||||
|
||||
You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it overrides this setting.
|
||||
|
||||
@ -211,7 +211,6 @@ There are three different registry combinations for controlling restart behavior
|
||||
|
||||
## More resources
|
||||
|
||||
- [Update Windows in the enterprise](index.md)
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Configure Delivery Optimization for Windows updates](../do/waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows updates](waas-branchcache.md)
|
||||
|
||||
@ -3,7 +3,7 @@ title: Manage additional Windows Update settings
|
||||
description: In this article, learn about additional settings to control the behavior of Windows Update in your organization.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.topic: reference
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
@ -14,7 +14,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 04/25/2023
|
||||
ms.date: 04/29/2024
|
||||
---
|
||||
|
||||
# Manage additional Windows Update settings
|
||||
@ -42,32 +42,35 @@ You can use Group Policy settings or mobile device management (MDM) to configure
|
||||
>[!IMPORTANT]
|
||||
>Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**.
|
||||
>
|
||||
>Additional settings that configure when Feature and Quality updates are received are detailed on **[Configure Windows Update for Business](waas-configure-wufb.md)**.
|
||||
>Additional settings that configure when feature and quality updates are received are detailed on **[Configure Windows Update for Business](waas-configure-wufb.md)**.
|
||||
|
||||
## Scanning for updates
|
||||
|
||||
Admins have a lot of flexibility in configuring how their devices scan and receive updates.
|
||||
Admins have flexibility in configuring how their devices scan and receive updates.
|
||||
|
||||
[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them the option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates.
|
||||
|
||||
You can make custom device groups that will work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that weren't signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location).
|
||||
You can make custom device groups that work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that weren't signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location).
|
||||
|
||||
Finally, to make sure the updating experience is fully controlled by the admins, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users.
|
||||
Finally, to make sure the updating experience is fully admin controlled, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users.
|
||||
|
||||
For additional settings that configure when Feature and Quality updates are received, see [Configure Windows Update for Business](waas-configure-wufb.md).
|
||||
For additional settings that configure when feature and quality updates are received, see [Configure Windows Update for Business](waas-configure-wufb.md).
|
||||
|
||||
### Specify intranet Microsoft update service location
|
||||
|
||||
Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.
|
||||
This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.
|
||||
This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client searches this service for updates that apply to the computers on your network.
|
||||
|
||||
To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service.
|
||||
To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values:
|
||||
- The server from which the Automatic Updates client detects and downloads updates
|
||||
- The server to which updated workstations upload statistics
|
||||
You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service.
|
||||
|
||||
If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them.
|
||||
If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates isn't disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
|
||||
|
||||
The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service.
|
||||
The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service doesn't provide download Urls in the update metadata for files that are present on the alternate download server.
|
||||
The option to download files with missing URLs allows content to be downloaded from the Alternate Download Server when there are no download URLs for files in the update metadata. This option should only be used when the intranet update service doesn't provide download URLs in the update metadata for files that are present on the alternate download server.
|
||||
|
||||
>[!NOTE]
|
||||
>If the "Configure Automatic Updates" policy is disabled, then this policy has no effect.
|
||||
@ -84,8 +87,8 @@ Specifies the hours that Windows will use to determine how long to wait before c
|
||||
|
||||
To set this setting with Group Policy, navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Automatic Updates detection frequency**.
|
||||
|
||||
If the setting is set to **Enabled**, Windows will check for available updates at the specified interval.
|
||||
If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours.
|
||||
If the setting is set to **Enabled**, Windows checks for available updates at the specified interval.
|
||||
If the setting is set to **Disabled** or **Not Configured**, Windows checks for available updates at the default interval of 22 hours.
|
||||
|
||||
>[!NOTE]
|
||||
>The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect.
|
||||
@ -96,7 +99,7 @@ To configure this policy with MDM, use [DetectionFrequency](/windows/client-mana
|
||||
|
||||
### Remove access to use all Windows Update features
|
||||
|
||||
By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured.
|
||||
By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads, and installations will continue to work as configured.
|
||||
|
||||
### Do not connect to any Windows Update Internet locations
|
||||
|
||||
@ -109,11 +112,11 @@ Use **Computer Configuration\Administrative Templates\Windows Components\Windows
|
||||
|
||||
### Enable client-side targeting
|
||||
|
||||
Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or Configuration Manager.
|
||||
Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that receive different updates from sources like WSUS or Configuration Manager.
|
||||
|
||||
This Group Policy setting can be found under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting**.
|
||||
If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service, which uses it to determine which updates should be deployed to this computer.
|
||||
If the setting is set to **Disabled** or **Not Configured**, no target group information will be sent to the intranet Microsoft update service.
|
||||
If the setting is set to **Disabled** or **Not Configured**, no target group information is sent to the intranet Microsoft update service.
|
||||
|
||||
If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified.
|
||||
|
||||
@ -147,7 +150,7 @@ Allows admins to exclude Windows Update drivers during updates.
|
||||
|
||||
To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**.
|
||||
Enable this policy to not include drivers with Windows quality updates.
|
||||
If you disable or don't configure this policy, Windows Update will include updates that have a Driver classification.
|
||||
If you disable or don't configure this policy, Windows Update includes updates that have a Driver classification.
|
||||
|
||||
### Configure Automatic Updates
|
||||
|
||||
@ -157,15 +160,15 @@ Enables the IT admin to manage automatic update behavior to scan, download, and
|
||||
|
||||
Under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the following options:
|
||||
|
||||
**2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates.
|
||||
**2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users are notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates.
|
||||
|
||||
**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user isn't notified or interrupted during this process). When the downloads are complete, users will be notified that they're ready to install. After going to **Settings > Update & security > Windows Update**, users can install them.
|
||||
|
||||
**4 - Auto download and schedule the install** - Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see [Schedule update installation](waas-restart.md#schedule-update-installation).
|
||||
|
||||
**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators won't be allowed to disable the configuration for Automatic Updates. This option isn't available in any Windows 10 or later versions.
|
||||
**5 - Allow local admin to choose setting** - With this option, local administrators are allowed to use the settings app to select a configuration option of their choice. Local administrators won't be allowed to disable the configuration for Automatic Updates. This option isn't available in any Windows 10 or later versions.
|
||||
|
||||
**7 - Notify for install and notify for restart** (Windows Server 2016 and later only) - With this option, when Windows finds updates that apply to this device, they'll be downloaded, then users will be notified that updates are ready to be installed. Once updates are installed, a notification will be displayed to users to restart the device.
|
||||
**7 - Notify for install and notify for restart** (Windows Server 2016 and later only) - With this option, when Windows finds updates that apply to this device, they are downloaded, then users are notified that updates are ready to be installed. Once updates are installed, a notification is displayed to users to restart the device.
|
||||
|
||||
If this setting is set to **Disabled**, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to **Settings > Update & security > Windows Update**.
|
||||
|
||||
@ -257,14 +260,14 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\
|
||||
|
||||
## Display organization name in Windows Update notifications
|
||||
<!--6286260-->
|
||||
When Windows 11 clients are associated with a Microsoft Entra tenant, the organization name appears in the Windows Update notifications. For instance, when you have a compliance deadline configured for Windows Update for Business, the user notification will display a message similar to **Contoso requires important updates to be installed**. The organization name will also display on the **Windows Update** page in the **Settings** for Windows 11.
|
||||
When Windows 11 clients are associated with a Microsoft Entra tenant, the organization name appears in the Windows Update notifications. For instance, when you have a compliance deadline configured for Windows Update for Business, the user notification displays a message similar to **Contoso requires important updates to be installed**. The organization name will also display on the **Windows Update** page in the **Settings** for Windows 11.
|
||||
|
||||
The organization name appears automatically for Windows 11 clients that are associated with Microsoft Entra ID in any of the following ways:
|
||||
- [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join)
|
||||
- [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register)
|
||||
- [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid)
|
||||
|
||||
To disable displaying the organization name in Windows Update notifications, add or modify the following in the registry:
|
||||
To disable displaying the organization name in Windows Update notifications, add or modify the following values in the registry:
|
||||
|
||||
- **Registry key**: `HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\Orchestrator\Configurations`
|
||||
- **DWORD value name**: UsoDisableAADJAttribution
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 01/18/2024
|
||||
ms.date: 05/16/2024
|
||||
---
|
||||
|
||||
# Walkthrough: Use CSPs and MDMs to configure Windows Update for Business
|
||||
@ -39,9 +39,9 @@ You can control when updates are applied, for example by deferring when an updat
|
||||
|
||||
Both feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device.
|
||||
|
||||
To enable Microsoft Updates, use [Update/AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update#update-allowmuupdateservice).
|
||||
To enable Microsoft Updates, use [Update/AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update#allowmuupdateservice).
|
||||
|
||||
Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to be updated on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use Update/[ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#update-excludewudriversinqualityupdate).
|
||||
Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to be updated on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use Update/[ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#excludewudriversinqualityupdate).
|
||||
|
||||
We also recommend that you allow Microsoft product updates as discussed previously.
|
||||
|
||||
@ -51,20 +51,20 @@ Drivers are automatically enabled because they're beneficial to device systems.
|
||||
|
||||
1. Ensure that you're enrolled in the Windows Insider Program for Business. Windows Insider is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates.
|
||||
|
||||
1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set the option to **Enable preview builds**.
|
||||
1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#managepreviewbuilds). Set the option to **Enable preview builds**.
|
||||
|
||||
1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation.
|
||||
1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation.
|
||||
|
||||
1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
|
||||
1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
|
||||
|
||||
#### I want to manage which released feature update my devices receive
|
||||
|
||||
A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you don't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify.
|
||||
|
||||
- To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays)
|
||||
- To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdatesstarttime)
|
||||
- To defer a quality update: [Update/DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays)
|
||||
- To pause a quality update: [Update/PauseQualityUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausequalityupdatesstarttime)
|
||||
- To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferfeatureupdatesperiodindays)
|
||||
- To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#pausefeatureupdatesstarttime)
|
||||
- To defer a quality update: [Update/DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#deferqualityupdatesperiodindays)
|
||||
- To pause a quality update: [Update/PauseQualityUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#pausequalityupdatesstarttime)
|
||||
|
||||
#### Example
|
||||
|
||||
@ -103,42 +103,42 @@ Now all devices are paused from updating for 35 days. When the pause is removed,
|
||||
|
||||
#### I want to stay on a specific version
|
||||
|
||||
If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the [Update/TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion) (or Deploy Feature Updates Preview in Intune) instead of using feature update deferrals. When you use this policy, specify the version that you want your device(s) to move to or stay on (for example, "1909"). You can find version information at the [Windows 10 Release Information Page](/windows/release-health/release-information).
|
||||
If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the [Update/TargetReleaseVersion](/windows/client-management/mdm/policy-csp-update#targetreleaseversion) (or Deploy Feature Updates Preview in Intune) instead of using feature update deferrals. When you use this policy, specify the version that you want your device(s) to move to or stay on (for example, "1909"). You can find version information at the [Windows 10 Release Information Page](/windows/release-health/release-information).
|
||||
|
||||
### Manage how users experience updates
|
||||
|
||||
#### I want to manage when devices download, install, and restart after updates
|
||||
|
||||
We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check.
|
||||
We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours.
|
||||
|
||||
For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart).
|
||||
For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#activehoursstart).
|
||||
|
||||
It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours.
|
||||
|
||||
To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan:
|
||||
To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan:
|
||||
|
||||
- [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday)
|
||||
- [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek)
|
||||
- [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek)
|
||||
- [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek)
|
||||
- [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek)
|
||||
- [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek)
|
||||
- [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime)
|
||||
- [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#scheduledinstallday)
|
||||
- [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstalleveryweek)
|
||||
- [Update/ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfirstweek)
|
||||
- [Update/ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallfourthweek)
|
||||
- [Update/ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallsecondweek)
|
||||
- [Update/ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#scheduledinstallthirdweek)
|
||||
- [Update/ScheduledInstallTime](/windows/client-management/mdm/policy-csp-update#scheduledinstalltime)
|
||||
|
||||
|
||||
When you set these policies, installation happens automatically at the specified time and the device will restart 15 minutes after installation is complete (unless it's interrupted by the user).
|
||||
|
||||
If you don't want to allow any automatic updates prior to the deadline, set [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) to Option 5, which turns off automatic updates.
|
||||
If you don't want to allow any automatic updates prior to the deadline, set [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#allowautoupdate) to Option 5, which turns off automatic updates.
|
||||
|
||||
#### I want to keep devices secure and compliant with update deadlines
|
||||
|
||||
We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. Deadlines work by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings:
|
||||
|
||||
- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates)
|
||||
- [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates)
|
||||
- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod)
|
||||
- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlineforfeatureupdates)
|
||||
- [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#configuredeadlineforqualityupdates)
|
||||
- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiod)
|
||||
- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates)
|
||||
- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot)
|
||||
- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#configuredeadlinenoautoreboot)
|
||||
|
||||
These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point, the device automatically schedules a restart regardless of active hours.
|
||||
|
||||
@ -168,11 +168,37 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window
|
||||
|
||||
|
||||
|
||||
#### <a name="user-settings-for-notifications"></a> End user settings for notifications
|
||||
<!--8936877-->
|
||||
*Applies to:*
|
||||
- Windows 11, version 23H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
|
||||
- Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
|
||||
|
||||
Users can set a preference for notifications about pending restarts for updates under **Settings** > **Windows Update** > **Advanced options** > **Notify me when a restart is required to finish updating**. This setting is end-user controlled and not controlled or configurable by IT administrators.
|
||||
|
||||
Users have the following options for the **Notify me when a restart is required to finish updating** setting:
|
||||
|
||||
- **Off** (default): Once the device enters a pending reboot state for updates, restart notifications are suppressed for 24 hours. During the first 24 hours, automatic restarts can still occur outside of active hours. Typically, users receive fewer notifications about upcoming restarts while the deadline is approaching.
|
||||
- When the deadline is set for 1 day, users only receive a notification about the deadline and a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
- **On**: Users immediately receive a toast notification when the device enters a reboot pending state for updates. Automatic restarts for updates are blocked for 24 hours after the initial notification to give these users time to prepare for a restart. After 24 hours have passed, automatic restarts can occur. This setting is recommended for users who want to be notified about upcoming restarts.
|
||||
- When the deadline is set for 1 day, an initial notification occurs, automatic restart is blocked for 24 hours, and users receive another notification before the deadline and a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
When a deadline is set for 0 days, no matter which option is selected, the only notification users receive is a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
The user preference for notifications applies when the following policies for [compliance deadlines](wufb-compliancedeadlines.md) are used:
|
||||
|
||||
- [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates)
|
||||
- [Update/ConfigureDeadlineForQualityUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates)
|
||||
- [Update/ConfigureDeadlineGracePeriod](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod)
|
||||
- [Update/ConfigureDeadlineGracePeriodForFeatureUpdates (Windows 11, version 22H2 or later)](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates)
|
||||
- [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot)
|
||||
|
||||
#### I want to manage the notifications a user sees
|
||||
|
||||
There are additional settings that affect the notifications.
|
||||
|
||||
We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values:
|
||||
We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/NoUpdateNotificationsDuringActiveHours](/windows/client-management/mdm/policy-csp-update#NoUpdateNotificationsDuringActiveHours) policy with these values:
|
||||
|
||||
**0** (default) - Use the default Windows Update notifications<br/>
|
||||
**1** - Turn off all notifications, excluding restart warnings<br/>
|
||||
@ -181,16 +207,18 @@ We recommend that you use the default notifications as they aim to provide the b
|
||||
> [!NOTE]
|
||||
> Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled.
|
||||
|
||||
Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications.
|
||||
Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications.
|
||||
|
||||
#### I want to manage the update settings a user can access
|
||||
|
||||
Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users.
|
||||
|
||||
Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#update-setdisablepauseuxaccess).
|
||||
Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#setdisablepauseuxaccess).
|
||||
When you disable this setting, users see **Some settings are managed by your organization** and the update pause settings are greyed out.
|
||||
|
||||
If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess).
|
||||
If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#setdisableuxwuaccess).
|
||||
|
||||
|
||||
|
||||
#### I want to enable features introduced via servicing that are off by default
|
||||
<!--6544872-->
|
||||
|
||||
@ -17,7 +17,7 @@ appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
|
||||
ms.date: 02/27/2024
|
||||
ms.date: 05/16/2024
|
||||
---
|
||||
|
||||
# Walkthrough: Use Group Policy to configure Windows Update for Business
|
||||
@ -132,7 +132,7 @@ When you set the target version policy, if you specify a feature update version
|
||||
|
||||
#### I want to manage when devices download, install, and restart after updates
|
||||
|
||||
We recommend that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check.
|
||||
We recommend that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours.
|
||||
|
||||
For more granular control, you can set the maximum period of active hours the user can set with **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify active hours range for auto restart**.
|
||||
|
||||
@ -174,6 +174,28 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window
|
||||
|
||||
|
||||
|
||||
|
||||
#### <a name="user-settings-for-notifications"></a> End user settings for notifications
|
||||
<!--8936877-->
|
||||
*Applies to:*
|
||||
- Windows 11, version 23H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
|
||||
- Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) or later
|
||||
|
||||
Users can set a preference for notifications about pending restarts for updates under **Settings** > **Windows Update** > **Advanced options** > **Notify me when a restart is required to finish updating**. This setting is end-user controlled and not controlled or configurable by IT administrators.
|
||||
|
||||
Users have the following options for the **Notify me when a restart is required to finish updating** setting:
|
||||
|
||||
- **Off** (default): Once the device enters a pending reboot state for updates, restart notifications are suppressed for 24 hours. During the first 24 hours, automatic restarts can still occur outside of active hours. Typically, users receive fewer notifications about upcoming restarts while the deadline is approaching.
|
||||
- When the deadline is set for 1 day, users only receive a notification about the deadline and a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
- **On**: Users immediately receive a toast notification when the device enters a reboot pending state for updates. Automatic restarts for updates are blocked for 24 hours after the initial notification to give these users time to prepare for a restart. After 24 hours have passed, automatic restarts can occur. This setting is recommended for users who want to be notified about upcoming restarts.
|
||||
- When the deadline is set for 1 day, an initial notification occurs, automatic restart is blocked for 24 hours, and users receive another notification before the deadline and a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
When a deadline is set for 0 days, no matter which option is selected, the only notification users receive is a final nondismissable notification 15 minutes before a forced restart.
|
||||
|
||||
The user preference for notifications applies when [compliance deadlines](wufb-compliancedeadlines.md) are used. The policy for compliance deadlines is under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify deadlines for automatic updates and restarts**.
|
||||
|
||||
|
||||
#### I want to manage the notifications a user sees
|
||||
|
||||
There are additional settings that affect the notifications.
|
||||
|
||||
@ -12,7 +12,7 @@ manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 10/10/2023
|
||||
ms.date: 05/16/2024
|
||||
---
|
||||
# Enforcing compliance deadlines for updates
|
||||
|
||||
@ -46,6 +46,7 @@ The deadline calculation for both quality and feature updates is based off the t
|
||||
The grace period for both quality and feature updates starts its countdown from the time of a pending restart after the installation is complete. As soon as installation is complete and the device reaches pending restart, users are able to schedule restarts during the grace period and Windows can still automatically restart outside of active hours if users choose not to schedule restarts. Once the *effective deadline* is reached, the device tries to restart during active hours. (The effective deadline is whichever is the later of the restart pending date plus the specified deadline or the restart pending date plus the grace period.) Grace periods are useful for users who may be coming back from vacation, or other extended time away from their device, to ensure a forced reboot doesn't occur immediately after they return.
|
||||
|
||||
> [!NOTE]
|
||||
> - When these policies are used, [user settings for notifications](waas-wufb-csp-mdm.md#user-settings-for-notifications) are also used on clients running Windows 11, version 22H2 and later.
|
||||
> - When **Specify deadlines for automatic updates and restarts** is used, updates will be downloaded and installed as soon as they are offered.
|
||||
> - When **Specify deadlines for automatic updates and restarts** is used, download, installation, and reboot settings stemming from the [Configure Automatic Updates](waas-restart.md#schedule-update-installation) are ignored.
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows Update for Business reports</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/microsoft-365/admin/admin-overview/admin-center-overview >Microsoft 365 admin center</a>
|
||||
ms.date: 04/26/2023
|
||||
ms.date: 05/08/2024
|
||||
---
|
||||
|
||||
# Microsoft 365 admin center software updates page
|
||||
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/15/2023
|
||||
ms.date: 07/09/2024
|
||||
---
|
||||
|
||||
# Manually configure devices for Windows Update for Business reports
|
||||
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 07/11/2023
|
||||
ms.date: 07/09/2024
|
||||
---
|
||||
|
||||
# Configuring devices through the Windows Update for Business reports configuration script
|
||||
@ -22,9 +22,9 @@ The Windows Update for Business reports configuration script is the recommended
|
||||
|
||||
## About the script
|
||||
|
||||
The configuration script configures registry keys directly. Be aware that registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script doesn't reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Windows Update for Business reports](wufb-reports-configuration-manual.md), device data might not appear in Windows Update for Business reports correctly.
|
||||
The configuration script configures registry keys directly. Registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script doesn't reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Windows Update for Business reports](wufb-reports-configuration-manual.md), device data might not appear in Windows Update for Business reports correctly.
|
||||
|
||||
You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting.
|
||||
You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086).
|
||||
|
||||
## How this script is organized
|
||||
|
||||
@ -39,11 +39,11 @@ Edit the `RunConfig.bat` file to configure the following variables, then run the
|
||||
|
||||
| Variable | Allowed values and description | Example |
|
||||
|---|---|---|
|
||||
| runMode | **Pilot** (default): Verbose mode with additional diagnostics with additional logging. Pilot mode is best for a testing run of the script or for troubleshooting. <br> **Deployment**: Doesn't run any additional diagnostics or add extra logging | `runMode=Pilot` |
|
||||
| logPath | Path where the logs will be saved. The default location of the logs is `.\UCLogs`. | `logPath=C:\temp\logs` |
|
||||
| logMode | **0**: Log to the console only </br> **1** (default): Log to file and console. </br> **2**: Log to file only. | `logMode=2` |
|
||||
| DeviceNameOptIn | **true** (default): Device name is sent to Microsoft. </br> **false**: Device name isn't sent to Microsoft. | `DeviceNameOptIn=true` |
|
||||
| ClientProxy | **Direct** (default): No proxy is used. The connection to the endpoints is direct. </br> **System**: The system proxy, without authentication, is used. This type of proxy is typically configured with [netsh](/windows-server/networking/technologies/netsh/netsh-contexts) and can be verified using `netsh winhttp show proxy`. </br> **User**: The proxy is configured through IE and it might or might not require user authentication. </br> </br> For more information, see [How the Windows Update client determines which proxy server to use to connect to the Windows Update website](https://support.microsoft.com/en-us/topic/how-the-windows-update-client-determines-which-proxy-server-to-use-to-connect-to-the-windows-update-website-08612ae5-3722-886c-f1e1-d012516c22a1) | `ClientProxy=Direct` |
|
||||
| runMode | **Pilot** (default): Verbose mode with additional diagnostics and logging. Pilot mode is best for a testing run of the script or for troubleshooting. <br> **Deployment**: Doesn't run any additional diagnostics or add extra logging | `runMode=Pilot` |
|
||||
| logPath | Path where the logs are saved. The default location of the logs is `.\UCLogs`.| `logPath=C:\temp\logs` |
|
||||
| logMode | **0**: Log to the console only </br> **1** (default): Log to file and console.</br> **2**: Log to file only. | `logMode=2` |
|
||||
| DeviceNameOptIn | **true** (default): Device name is sent to Microsoft.</br> **false**: Device name isn't sent to Microsoft. | `DeviceNameOptIn=true` |
|
||||
| ClientProxy | **Direct** (default): No proxy is used. The connection to the endpoints is direct.</br> **System**: The system proxy, without authentication, is used. This type of proxy is typically configured with [netsh](/windows-server/networking/technologies/netsh/netsh-contexts) and can be verified using `netsh winhttp show proxy`. </br> **User**: The proxy is configured through IE and it might or might not require user authentication. </br> </br> For more information, see [How the Windows Update client determines which proxy server to use to connect to the Windows Update website](https://support.microsoft.com/en-us/topic/how-the-windows-update-client-determines-which-proxy-server-to-use-to-connect-to-the-windows-update-website-08612ae5-3722-886c-f1e1-d012516c22a1) | `ClientProxy=Direct` |
|
||||
| source | Used by the .bat file and PowerShell script to locate dependencies. It's recommended that you don't change this value. | `source=%~dp0` |
|
||||
|
||||
|
||||
|
||||
@ -59,7 +59,7 @@ Windows Update for Business reports uses the following Delivery Optimization ter
|
||||
|
||||
## Calculations for Delivery Optimization
|
||||
|
||||
Each calculated values used in the Delivery Optimization report are listed below.
|
||||
The calculated values used in the Delivery Optimization report are listed below.
|
||||
|
||||
**Efficiency (%) Calculations**:
|
||||
|
||||
@ -188,7 +188,7 @@ A row in UCDOAggregatedStatus represents data summarized at the tenant level (Az
|
||||
If there's a Connected Cache server at the ISP level, BytesFromCache filters out any bytes coming the ISP's Connected Cache.
|
||||
|
||||
- **How do the results from the Delivery Optimization PowerShell cmdlets compare to the results in the report?**
|
||||
[Delivery Optimization PowerShell cmdlets](waas-delivery-optimization-setup.md#monitor-delivery-optimization) can be a powerful tool used to monitor Delivery Optimization data on the device. These cmdlets use the cache on the device. The data calculated in the report is taken from the Delivery Optimization telemetry events.
|
||||
[Delivery Optimization PowerShell cmdlets](waas-delivery-optimization-reference.md) can be a powerful tool used to monitor Delivery Optimization data on the device. These cmdlets use the cache on the device. The data calculated in the report is taken from the Delivery Optimization telemetry events.
|
||||
|
||||
- **The report represents the last 28 days of data, why do some queries include >= seven days?**
|
||||
The data in the report does represent the last 28 days of data. The query for last seven days is just to get the data for the latest snapshot from past seven days. It's possible that data is delayed for sometime and not available for current day, so we look for past 7 day snapshot in log analytics and show the latest snapshot.
|
||||
|
||||
@ -11,7 +11,7 @@ manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 07/11/2023
|
||||
ms.date: 07/09/2024
|
||||
---
|
||||
|
||||
# Enable Windows Update for Business reports
|
||||
@ -34,7 +34,7 @@ After verifying the [prerequisites](wufb-reports-prerequisites.md) are met, you
|
||||
|
||||
## <a name="bkmk_add"></a> Add Windows Update for Business reports to your Azure subscription
|
||||
|
||||
Before you configure clients to send data, you'll need to add Windows Update for Business reports to your Azure subscription so the data can be received. First, you'll select or create a new Log Analytics workspace to use. Second, you'll enroll Windows Update for Business reports to the workspace.
|
||||
Before you configure clients to send data, you need to add Windows Update for Business reports to your Azure subscription so the data can be received. First, you select or create a new Log Analytics workspace to use. Second, you enroll Windows Update for Business reports to the workspace.
|
||||
|
||||
## <a name="bkmk_workspace"></a> Select or create a new Log Analytics workspace for Windows Update for Business reports
|
||||
|
||||
@ -69,7 +69,7 @@ Enroll into Windows Update for Business reports by configuring its settings thro
|
||||
> [!Tip]
|
||||
> If a `403 Forbidden` error occurs, verify the account you're using has [permissions](wufb-reports-prerequisites.md#permissions) to enroll into Windows Update for Business reports.
|
||||
1. The initial setup can take up to 24 hours. During this time, the workbook will display that it's **Waiting for Windows Update for Business reports data**.
|
||||
- Enrolling into Windows Update for Business reports doesn't influence the rate that required data is uploaded from devices. Device connectivity to the internet and how active the device is influences how long it will take before the device appears in reporting. Devices that are active and connected to the internet daily can expect to be fully uploaded within one week (usually less than 72 hours). Devices that are less active can take up to two weeks before data is fully available.
|
||||
- Enrolling into Windows Update for Business reports doesn't influence the rate that required data is uploaded from devices. Device connectivity to the internet and how active the device is influences how long it takes before the device appears in reporting. Devices that are active and connected to the internet daily can expect to be fully uploaded within one week (usually less than 72 hours). Devices that are less active can take up to two weeks before data is fully available.
|
||||
|
||||
##### <a name="bkmk_admin-center"></a> Enroll through the Microsoft 365 admin center
|
||||
<!--Using include for onboarding Windows Update for Business reports through the Microsoft 365 admin center-->
|
||||
|
||||
@ -9,7 +9,7 @@ metadata:
|
||||
manager: aaroncz
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
ms.date: 01/26/2024
|
||||
ms.date: 05/07/2024
|
||||
title: Frequently Asked Questions about Windows Update for Business reports
|
||||
summary: |
|
||||
This article answers frequently asked questions about Windows Update for Business reports. <!--7760853-->
|
||||
@ -64,6 +64,8 @@ sections:
|
||||
- question: What Windows versions are supported?
|
||||
answer: |
|
||||
Windows Update for Business reports supports clients running a [supported version of Windows 10 or Windows 11](/windows/release-health/supported-versions-windows-client) Professional, Education, Enterprise, and Enterprise multi-session editions. Windows Update for Business reports only provides data for the standard Desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions.
|
||||
> [!Important]
|
||||
> Currently there is a known issue where Windows Update for Business reports doesn't display data for Enterprise multi-session edition devices. <!--8928451-->
|
||||
|
||||
- name: Setup questions
|
||||
questions:
|
||||
@ -103,7 +105,7 @@ sections:
|
||||
answer: |
|
||||
Here are some reasons why you may not be seeing devices in reports:
|
||||
|
||||
- **The device isn't enrolled with Azure Active Directory**: A [prerequisite](wufb-reports-prerequisites.md#azure-and-azure-active-directory) for devices is that they're either [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- **The device isn't enrolled with Microsoft Entra**: A [prerequisite](wufb-reports-prerequisites.md#azure-and-azure-active-directory) for devices is that they're either [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- **The device isn't sending data**: It's possible devices aren't sharing data due to a policy being incorrectly configured or a proxy or firewall configuration. Try using the [configuration script](wufb-reports-configuration-script.md) on devices to ensure they're configured properly.
|
||||
- **The device isn't active enough**: Clients must be active and connected to the internet to scan against Microsoft Update. Ensure devices are powered on and have been active at least once in the past 28 days.
|
||||
- **The workbook has limited the results**: The default limit for rows in Azure workbooks is set to 1000. This limit is to avoid any delay in the load time for the interface. If you noticed that you can't find a specific device, you can export the output in Excel, or open the results in the logs view for the full result by selecting the three dots beside each component.
|
||||
@ -115,13 +117,13 @@ sections:
|
||||
An unknown client state is displayed if there isn't an update record for the device. This state can happen for many reasons, like the device not being active, not being able to scan Windows Update, or it doesn't currently have any update related activity occurring.
|
||||
- question: What is the difference between OS version and target version?
|
||||
answer: |
|
||||
The word *target* in data labels refers to the update version, build or KB the client intends to update to. Typically, the fields starting with *OS*, such as OSbuild and OSversion, represents what the device is currently running.
|
||||
The word *target* in data labels refers to the update version, build, or KB the client intends to update to. Typically, the fields starting with *OS*, such as OSbuild and OSversion, represents what the device is currently running.
|
||||
- question: When should I use the UCClient, UCClientUpdateStatus, or UCUpdateAlert tables?
|
||||
answer: |
|
||||
These tables can be used for the following information:
|
||||
|
||||
- **UCClient**: Represents an individual device's record. It contains data such as the device's name, currently installed build, and the OS Edition. Each device has one record in this table. Use this table to get the overall compliance status of your devices.
|
||||
- To display information for a specific device by Azure AD device ID: </br>
|
||||
- To display information for a specific device by Microsoft Entra device ID: </br>
|
||||
`UCClient where AzureADDeviceId contains "01234567-89ab-cdef-0123-456789abcdef"`
|
||||
- To display all device records for devices running any Windows 11 OS version:</br>
|
||||
`UCClient | where OSVersion contains "Windows 11"`
|
||||
@ -132,7 +134,7 @@ sections:
|
||||
- To display devices that are in the restart required substate:</br>
|
||||
`UCClientUpdateStatus |where ClientSubstate =="RestartRequired"`
|
||||
|
||||
- **UCUpdateAlert**: Use this table to understand update failures and act on devices through alert recommendations. This table contains information that needs attention, relative to one device, one update and one deployment (if relevant).
|
||||
- **UCUpdateAlert**: Use this table to understand update failures and act on devices through alert recommendations. This table contains information that needs attention, relative to one device, one update, and one deployment (if relevant).
|
||||
- To display information about an error code:
|
||||
`UCUpdateAlert|where ErrorCode =="0X8024000b"`
|
||||
- To display a count of devices with active alerts by subtype:
|
||||
@ -181,7 +183,7 @@ sections:
|
||||
If there's a Connected Cache server at the ISP level, BytesFromCache filters out any bytes coming the ISP's Connected Cache.
|
||||
- question: How do the results from the Delivery Optimization PowerShell cmdlets compare to the results in the report?
|
||||
answer: |
|
||||
[Delivery Optimization PowerShell cmdlets](waas-delivery-optimization-setup.md#monitor-delivery-optimization) can be a powerful tool used to monitor Delivery Optimization data on the device. These cmdlets use the cache on the device. The data calculated in the report is taken from the Delivery Optimization events.
|
||||
[Delivery Optimization PowerShell cmdlets](waas-delivery-optimization-reference.md) can be a powerful tool used to monitor Delivery Optimization data on the device. These cmdlets use the cache on the device. The data calculated in the report is taken from the Delivery Optimization events.
|
||||
- question: The report represents the last 28 days of data, why do some queries include >= seven days?
|
||||
answer: |
|
||||
The data in the report does represent the last 28 days of data. The query for last seven days is just to get the data for the latest snapshot from past seven days. It's possible that data is delayed for sometime and not available for current day, so we look for past seven day snapshot in log analytics and show the latest snapshot.
|
||||
|
||||
@ -4,14 +4,14 @@ titleSuffix: Windows Update for Business reports
|
||||
description: Windows Update for Business reports support, feedback, and troubleshooting information.
|
||||
ms.service: windows-client
|
||||
ms.subservice: itpro-updates
|
||||
ms.topic: article
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 02/10/2023
|
||||
ms.date: 07/09/2024
|
||||
---
|
||||
|
||||
# Windows Update for Business reports feedback, support, and troubleshooting
|
||||
@ -52,7 +52,7 @@ You can open support requests directly from the Azure portal. If the **Help + S
|
||||
- **Service type** - Select ***Windows Update for Business reports*** under ***Monitoring and Management***
|
||||
|
||||
|
||||
1. Based on the information you provided, you'll be shown some **Recommended solutions** you can use to try to resolve the problem.
|
||||
1. Based on the information you provided, you are shown some **Recommended solutions** you can use to try to resolve the problem.
|
||||
1. Complete the **Additional details** tab and then create the request on the **Review + create** tab.
|
||||
|
||||
## Documentation feedback
|
||||
|
||||
@ -11,7 +11,7 @@ manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/15/2023
|
||||
ms.date: 06/04/2024
|
||||
---
|
||||
|
||||
# Windows Update for Business reports prerequisites
|
||||
@ -35,11 +35,14 @@ Before you begin the process of adding Windows Update for Business reports to yo
|
||||
|
||||
## Operating systems and editions
|
||||
|
||||
- Windows 11 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions
|
||||
- Windows 10 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions
|
||||
- Windows 11 Professional, Education, Enterprise, and Enterprise multi-session editions <!--8928451-->
|
||||
- Windows 10 Professional, Education, Enterprise, and Enterprise multi-session editions
|
||||
|
||||
Windows Update for Business reports only provides data for the standard desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions.
|
||||
|
||||
> [!Important]
|
||||
> Currently there is a known issue where Windows Update for Business reports doesn't display data for Enterprise multi-session edition devices. <!--8928451, also listed in FAQ-->
|
||||
|
||||
## Windows client servicing channels
|
||||
|
||||
Windows Update for Business reports supports Windows client devices on the following channels:
|
||||
@ -47,9 +50,11 @@ Windows Update for Business reports supports Windows client devices on the follo
|
||||
- General Availability Channel
|
||||
- Windows Update for Business reports *counts* Windows Insider Preview devices, but doesn't currently provide detailed deployment insights for them.
|
||||
|
||||
### Windows operating system updates
|
||||
## Windows operating system updates for client devices
|
||||
|
||||
For [changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), installing the January 2023 release preview cumulative update, or a later equivalent update, is recommended.
|
||||
Installing the February 2023 cumulative update, or a later equivalent update, is required for clients to enroll into Windows Update for Business reports. This update helped enable [changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), which Windows Update for Business reports relies on.
|
||||
|
||||
For more information about available updates, see [Windows 11 release information](/windows/release-health/windows11-release-information) and [Windows 10 release information](/windows/release-health/release-information).
|
||||
|
||||
## Diagnostic data requirements
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ manager: aaroncz
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/06/2023
|
||||
ms.date: 03/12/2024
|
||||
---
|
||||
|
||||
# UCClient
|
||||
@ -35,7 +35,6 @@ UCClient acts as an individual device's record. It contains data such as the cur
|
||||
| **IsVirtual** | [bool](/azure/data-explorer/kusto/query/scalar-data-types/bool) | No | `Yes, No` | Whether device is a virtual device. |
|
||||
| **LastCensusScanTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | The last time this device performed a successful census scan, if any. |
|
||||
| **LastWUScanTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | The last time this device performed a successful Windows Update scan, if any. |
|
||||
| **NewTest_CF [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. |
|
||||
| **OSArchitecture** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | Yes | `x86` | The architecture of the operating system (not the device) this device is currently on. |
|
||||
| **OSBuild** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `10.0.22621.1702` | The full operating system build installed on this device, such as Major.Minor.Build.Revision |
|
||||
| **OSBuildNumber** | [int](/azure/kusto/query/scalar-data-types/int) | No | `22621` | The major build number, in int format, the device is using. |
|
||||
@ -62,18 +61,18 @@ UCClient acts as an individual device's record. It contains data such as the cur
|
||||
| **WUAutomaticUpdates** | | No | | Currently, data isn't gathered to populate this field. Manage automatic update behavior to scan, download, and install updates. |
|
||||
| **WUDeadlineNoAutoRestart** | | No | | Currently, data isn't gathered to populate this field. Devices won't automatically restart outside of active hours until the deadline is reached - It's 1 by default and indicates enabled, 0 indicates disabled |
|
||||
| **WUDODownloadMode** | | No | | Currently, data isn't gathered to populate this field. The Windows Update DO DownloadMode configuration. |
|
||||
| **WUFeatureDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: ConfigureDeadlineForFeatureUpdates. The Windows Update feature update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
|
||||
| **WUFeatureDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: DeferFeatureUpdates. The Windows Update feature update deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the policy setting. |
|
||||
| **WUFeatureGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | The Windows Update grace period for feature update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
|
||||
| **WUFeaturePauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause will end, if activated, else null. |
|
||||
| **WUFeatureDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: ConfigureDeadlineForFeatureUpdates. The feature update deadline configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
|
||||
| **WUFeatureDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | CSP: DeferFeatureUpdates. The feature update deferral configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the policy setting. |
|
||||
| **WUFeatureGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | The Windows Update grace period for feature update in days. -1 indicates not configured. 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
|
||||
| **WUFeaturePauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause ends, if activated, else null. |
|
||||
| **WUFeaturePauseStartTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update feature update pause was activated, if activated, else null. Feature updates are paused for 35 days from the specified start date. |
|
||||
| **WUFeaturePauseState** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `NotConfigured` | Indicates pause status of device for feature updates. Possible values are Paused, NotPaused, NotConfigured. |
|
||||
| **WUNotificationLevel** | | No | | Currently, data isn't gathered to populate this field. This policy allows you to define what Windows Update notifications users see. 0 (default) - Use the default Windows Update notifications. 1 - Turn off all notifications, excluding restart warnings. 2 - Turn off all notifications, including restart warnings |
|
||||
| **WUNotificationLevel** | | No | | Currently, data isn't gathered to populate this field. This policy allows you to define what Windows Update notifications users see. 0 (default) - Use the default Windows Update notifications. 1 - Turn off all notifications, excluding restart warnings. 2 - Turn off all notifications, including restart warnings |
|
||||
| **WUPauseUXDisabled** | | No | | Currently, data isn't gathered to populate this field. This policy allows the IT admin to disable the Pause Updates feature. When this policy is enabled, the user can't access the Pause updates' feature. Supported values 0, 1. |
|
||||
| **WUQualityDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | CSP: ConfigureDeadlineForQualityUpdates. The Windows update quality update deadline configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
|
||||
| **WUQualityDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `-1` | CSP: DeferQualityUpdates. The Windows Update quality update deferral configuration in days. -1 indicates not configured, 0 indicates configured but set to 0. Values greater than 0 indicate the policy setting. |
|
||||
| **WUQualityGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | The Windows Update grace period for quality update in days. -1 indicates not configured, 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
|
||||
| **WUQualityPauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update quality update pause- will end, if activated, else null. |
|
||||
| **WUQualityDeadlineDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `7` | CSP: ConfigureDeadlineForQualityUpdates. The Windows update quality update deadline configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values > 0 indicate the deadline in days. |
|
||||
| **WUQualityDeferralDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `-1` | CSP: DeferQualityUpdates. The Windows Update quality update deferral configuration in days. -1 indicates not configured. 0 indicates configured but set to 0. Values greater than 0 indicate the policy setting. |
|
||||
| **WUQualityGracePeriodDays** | [int](/azure/kusto/query/scalar-data-types/int) | No | `0` | The Windows Update grace period for quality update in days. -1 indicates not configured. 0 indicates configured and set to 0. Values greater than 0 indicate the grace period in days. |
|
||||
| **WUQualityPauseEndTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time the quality update pause ends, if activated, else null. |
|
||||
| **WUQualityPauseStartTime [UTC]** | [datetime](/azure/kusto/query/scalar-data-types/datetime) | No | `2020-05-14 09:26:03.478039` | Currently, data isn't gathered to populate this field. The time Windows Update quality update pause- was activated; if activated; else null. |
|
||||
| **WUQualityPauseState** | [string](/azure/data-explorer/kusto/query/scalar-data-types/string) | No | `NotConfigured` | Indicates pause status of device for quality updates. Possible values are Paused, NotPaused, NotConfigured. |
|
||||
| **WURestartNotification** | | No | | Currently, data isn't gathered to populate this field. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. The following list shows the supported values: 1 (default) = Auto Dismissal. 2 - User Dismissal. |
|
||||
|
||||
@ -11,10 +11,10 @@ ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 01/13/2022
|
||||
ms.date: 04/22/2024
|
||||
---
|
||||
|
||||
# Use Windows Update for Business and WSUS together
|
||||
# Use Windows Update for Business and WSUS together
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -46,7 +46,7 @@ To help you better understand the scan source policy, see the default scan behav
|
||||
- On Windows 10: All of your updates will come from WSUS.
|
||||
- On Windows 11: All of your updates will still come from WSUS unless you configure the specify scan source policy.
|
||||
|
||||
- If you configure a WSUS server and deferral policies: All of your updates will come from Windows Update unless you specify the scan source policy.
|
||||
- If you configure a WSUS server and deferral policies on Windows 10: All of your updates will come from Windows Update unless you specify the scan source policy or have disabled dual scan.
|
||||
- If you configure a WSUS server and the scan source policy: All of your updates will come from the source chosen in the scan source policy.
|
||||
|
||||
> [!TIP]
|
||||
@ -69,7 +69,8 @@ The policy can be configured using the following two methods:
|
||||
|
||||
> [!NOTE]
|
||||
> - You should configure **all** of these policies if you are using CSPs.
|
||||
> - Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered.
|
||||
> - Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered.
|
||||
> - If you're also using the **Specify settings for optional component installation and component repair** policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](fod-and-lang-packs.md) to verify your policy configuration.
|
||||
|
||||
- [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourcefordriver)
|
||||
- [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforfeature)
|
||||
|
||||
Reference in New Issue
Block a user