mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 10:53:43 +00:00
Fix merge conflicts
This commit is contained in:
Dan Mabee
@ -1,18 +1,14 @@
|
||||
---
|
||||
title: Windows Updates using forward and reverse differentials
|
||||
description: A technique to produce compact software updates optimized for any origin and destination revision pair
|
||||
keywords: updates, servicing, current, deployment, General Availability Channel, feature, quality, rings, insider, tools
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Windows Updates using forward and reverse differentials
|
||||
@ -71,7 +67,7 @@ numerous advantages:
|
||||
|
||||
Historically, download sizes of Windows 10 quality updates (Windows 10, version 1803 and older supported versions of Windows 10) are optimized by using express download. Express download is optimized such that updating Windows 10 systems will download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version.
|
||||
|
||||
For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints.
|
||||
For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints.
|
||||
|
||||
The flip side of express download is that the size of PSF files can be very large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they are unable to leverage express updates to keep their fleet of devices running Windows 10 up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it is only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly.
|
||||
|
||||
|
||||
@ -1,17 +1,13 @@
|
||||
---
|
||||
title: Introduction to the Windows Insider Program for Business
|
||||
description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join.
|
||||
keywords: updates, servicing, current, deployment, General Availability Channel, General Availability Channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.audience: itpro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Introduction to the Windows Insider Program for Business
|
||||
@ -48,10 +44,10 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op
|
||||
|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.|
|
||||
|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. |
|
||||
|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)<br> - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications<br> - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. |
|
||||
|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.<br> - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)<br> - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) |
|
||||
|Feedback | - This helps us make adjustments to features as quickly as possible.<br> - Encourage users to sign into the Feedback Hub using their Azure Active Directory work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)<br> - [Learn how to provide effective feedback in the Feedback Hub](/windows-insider/feedback) |
|
||||
|
||||
## Validate Insider Preview builds
|
||||
Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits:
|
||||
Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. Early validation has several benefits:
|
||||
|
||||
- Get a head start on your Windows validation process.
|
||||
- Identify issues sooner to accelerate your Windows deployment.
|
||||
@ -65,4 +61,4 @@ Along with exploring new features, you also have the option to validate your app
|
||||
|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.|
|
||||
|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. |
|
||||
|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. |
|
||||
|Guidance | Application and infrastructure validation:<br>- [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](/mem/configmgr/desktop-analytics/overview)<br>- [Use Device Health to identify problem devices and device drivers](/windows/deployment/update/device-health-monitor)<br> - [Windows 10 application compatibility](/windows/windows-10/)|
|
||||
|Guidance | Application and infrastructure validation:<br>- [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](/mem/configmgr/desktop-analytics/overview)<br>- [Use Device Health to identify problem devices and device drivers](/windows/deployment/update/device-health-monitor)<br> - [Windows 10 application compatibility](/windows/windows-10/)|
|
||||
|
||||
@ -1,64 +1,57 @@
|
||||
---
|
||||
title: "How to check Windows release health"
|
||||
ms.author: v-nishmi
|
||||
author: DocsPreview
|
||||
manager: jren
|
||||
audience: Admin
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
localization_priority: Normal
|
||||
f1.keywords:
|
||||
- CSH
|
||||
ms.custom:
|
||||
- Adm_O365
|
||||
- 'O365P_ServiceHealthModern'
|
||||
- 'O365M_ServiceHealthModern'
|
||||
- 'O365E_ViewStatusServices'
|
||||
- 'O365E_ServiceHealthModern'
|
||||
- 'seo-marvel-apr2020'
|
||||
ms.collection:
|
||||
- Ent_O365
|
||||
- M365-subscription-management
|
||||
search.appverid:
|
||||
- MET150
|
||||
- MOE150
|
||||
- BCS160
|
||||
- IWA160
|
||||
ms.assetid: 932ad3ad-533c-418a-b938-6e44e8bc33b0
|
||||
description: "Check the release health status of Microsoft 365 services before you call support to see if there is an active service interruption."
|
||||
feedback_system: none
|
||||
title: How to check Windows release health
|
||||
description: Check the release health status of Microsoft 365 services before you call support to see if there's an active service interruption.
|
||||
ms.date: 06/07/2023
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
manager: aaroncz
|
||||
ms.reviewer: mstewart
|
||||
ms.topic: how-to
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
---
|
||||
|
||||
# How to check Windows release health
|
||||
|
||||
The Windows release health page in the Microsoft 365 admin center enables you to view the latest information on known issues for Windows monthly and feature updates. A known issue is an issue that has been identified in a Windows monthly update or feature update that impacts Windows devices. The Windows release health page is designed to inform you about known issues so you can troubleshoot issues your users may be experiencing and/or to determine when, and at what scale, to deploy an update in your organization.
|
||||
The Windows release health page in the Microsoft 365 admin center enables you to view the latest information on known issues for Windows monthly and feature updates. A known issue is an issue that impacts Windows devices and that has been identified in a Windows monthly update or feature update. The Windows release health page is designed to inform you about known issues. You can use this information to troubleshoot issues your users may be experiencing. You can also determine when, and at what scale, to deploy an update in your organization.
|
||||
|
||||
If you are unable to sign in to the Microsoft 365 admin portal, check the [Microsoft 365 service health](https://status.office365.com) status page to check for known issues preventing you from logging into your tenant.
|
||||
If you're unable to sign in to the Microsoft 365 admin portal, check the [Microsoft 365 service health](https://status.office365.com) status page to check for known issues preventing you from signing into your tenant.
|
||||
|
||||
To be informed about the latest updates and releases, follow us on Twitter [@WindowsUpdate](https://twitter.com/windowsupdate).
|
||||
To be informed about the latest updates and releases, follow [@WindowsUpdate](https://twitter.com/windowsupdate) on Twitter.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Ensure the following prerequisites are met to display the Windows release health page in the Microsoft 365 admin center: <!--7872213-->
|
||||
|
||||
- One of the following licenses:
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
|
||||
- Sign into the Microsoft 365 admin center using an [admin role](/microsoft-365/admin/add-users/about-admin-roles).
|
||||
- Most roles containing the word `administrator` give you access to the Windows release health page such as [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator), [Helpdesk Administrator](/azure/active-directory/roles/permissions-reference#helpdesk-administrator), and [Service Support Administrator](/azure/active-directory/roles/permissions-reference#service-support-administrator). For more information, see [Assign admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/assign-admin-roles).
|
||||
|
||||
> [!NOTE]
|
||||
> Currently, Windows release health isn't available for Government Community Cloud (GCC) tenants.
|
||||
|
||||
## How to review Windows release health information
|
||||
|
||||
1. Go to the Microsoft 365 admin center at [https://admin.microsoft.com](https://go.microsoft.com/fwlink/p/?linkid=2024339), and sign in with an administrator account.
|
||||
|
||||
> [!NOTE]
|
||||
> By default, the Windows release health page is available to individuals who have been assigned the global admin or service administrator role for their tenant. To allow Exchange, SharePoint, and Skype for Business admins to view the Windows release health page, you must first assign them to a Service admin role. For more information about roles that can view service health, see [About admin roles](/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide&preserve-view=true#roles-available-in-the-microsoft-365-admin-center).
|
||||
1. Go to the [Microsoft 365 admin center](https://admin.microsoft.com) and sign in with an admin account.
|
||||
|
||||
2. To view Windows release health in the Microsoft 365 Admin Center, go to **Health > Windows release health**.
|
||||
1. To view Windows release health in the Microsoft 365 Admin Center, go to **Health > Windows release health**.
|
||||
|
||||
3. On the **Windows release health** page, you will have access to known issue information for all supported versions of the Windows operating system.
|
||||
1. On the **Windows release health** page, you have access to known issue information for all supported versions of the Windows operating system.
|
||||
|
||||
The **All versions** tab (the default view) shows all Windows products with access to their posted known issues.
|
||||
|
||||
|
||||
|
||||
|
||||
A known issue is an issue that has been identified in a Windows monthly update or feature update that impacts Windows devices. The **Active and recently resolved** column provides a link to the **Known issues** tab filtered to the version selected. Selecting the **Known issues** tab shows known issues that are active or resolved within the last 30 days.
|
||||
|
||||
|
||||
|
||||
A known issue is an issue that has been identified in a Windows monthly update or feature update that impacts Windows devices. The **Active and recently resolved** column provides a link to the **Known issues** tab filtered to the version selected. Selecting the **Known issues** tab will show known issues that are active or resolved within the last 30 days.
|
||||
|
||||
|
||||
|
||||
The **History** tab shows the history of known issues that have been resolved for up to 6 months.
|
||||
|
||||
|
||||
|
||||
|
||||
The known issue summary provides the following information:
|
||||
|
||||
@ -68,62 +61,77 @@ To be informed about the latest updates and releases, follow us on Twitter [@Win
|
||||
- **Originating KB** - The KB number where the issue was first identified.
|
||||
- **Originating build** - The build number for the KB.
|
||||
|
||||
Select the **Issue title** to access more information, including a link to the history of all status updates posted while we work on a solution. Here is an example:
|
||||
Select the **Issue title** to access more information, including a link to the history of all status updates posted while we work on a solution. For example:
|
||||
|
||||
|
||||
|
||||
|
||||
## Sign up for email notifications
|
||||
|
||||
You can sign up for email notifications about Windows known issues and informational updates. Notifications include changes in issue status, new workarounds, and issue resolutions. To subscribe to notifications:
|
||||
|
||||
1. Go to the [Windows release health page](https://admin.microsoft.com/Adminportal/Home?#/windowsreleasehealth).
|
||||
1. Select **Preferences** > **Email**, then select **Send me email notifications about Windows release health**.
|
||||
1. Specify the following information:
|
||||
- Email address for the notifications
|
||||
- Each admin account can specify up to two email addresses under their email preferences
|
||||
- Windows versions to be notified about
|
||||
1. Select **Save** when you're finished specifying email addresses and Windows versions. It may take up to 8 hours for these changes to take effect.
|
||||
|
||||
> [!Note]
|
||||
> When a single known issue affects multiple versions of Windows, you'll receive only one email notification, even if you've selected notifications for multiple versions. Duplicate emails won't be sent.
|
||||
|
||||
## Status definitions
|
||||
|
||||
In the **Windows release health** experience, every known issue is assigned as status. Those statuses are defined as follows:
|
||||
|
||||
|
||||
| Status | Definition |
|
||||
|:-----|:-----|
|
||||
|**Reported** | An issue has been brought to the attention of the Windows teams. At this stage, there is no confirmation that users are affected. |
|
||||
|**Investigating** | The issue is believed to affect users and efforts are underway to gather more information about the issue’s scope of impact, mitigation steps, and root cause. |
|
||||
|**Confirmed** | After close review, Microsoft teams have determined the issue is affecting Windows users, and progress is being made on mitigation steps and root cause. |
|
||||
|**Mitigated** | A workaround is available and communicated to Windows customers for a known issue. A known issue will stay in this state until a KB article is released by Microsoft to resolve the known issue. |
|
||||
|**Mitigated: External** | A workaround is available and communicated to Windows customers for a known issue that was caused by a software or driver from a third-party software or device manufacturer. A known issue will stay in this state until the issue is resolved by Microsoft or the third-party. |
|
||||
|**Resolved** | A solution has been released by Microsoft and has been documented in a KB article that will resolve the known issue once it’s deployed in the customer’s environment. |
|
||||
|**Resolved: External** | A solution has been released by a Microsoft or a third-party that will resolve the known issue once it’s deployed in the customer’s environment. |
|
||||
|**Reported** | An issue has been brought to the attention of the Windows teams. At this stage, there's no confirmation that users are affected. |
|
||||
|**Investigating** | The issue is believed to affect users and efforts are underway to gather more information about the issue's scope, mitigation steps, and root cause. |
|
||||
|**Confirmed** | After close review, Microsoft has determined the issue is affecting Windows users, and progress is being made on mitigation steps and root cause. |
|
||||
|**Mitigated** | A workaround is available and communicated to Windows customers for a known issue. A known issue stays in this state until a KB article is released by Microsoft to resolve the known issue. |
|
||||
|**Mitigated: External** | A workaround is available and communicated to Windows customers for a known issue caused by a software or driver from a third-party software or device manufacturer. A known issue stays in this state until the issue is resolved by Microsoft or the third-party. |
|
||||
|**Resolved** | A solution was released by Microsoft and was documented in a KB article that resolves the known issue once it's deployed in the customer's environment. |
|
||||
|**Resolved: External** | A solution was released by Microsoft or a third-party that resolves the known issue once it's deployed in the customer's environment. |
|
||||
|
||||
## Known issue history
|
||||
|
||||
The Windows release health page lets you view the history of all status updates posted for a specific known issue. To view all past updates posted for a given issue, select **View history** on the issue detail page.
|
||||
|
||||
|
||||
|
||||
|
||||
A list of all status updates posted in the selected timeframe will be displayed, as shown below. You can expand any row to view the specific information provided in that status update.
|
||||
A list of all status updates posted in the selected time frame is displayed. You can expand any row to view the specific information provided in that status update.
|
||||
|
||||
|
||||
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
### Windows release health coverage
|
||||
|
||||
- **What is Windows release health?**
|
||||
- **What is Windows release health?**
|
||||
Windows release health is a Microsoft informational service created to keep licensed Windows customers aware of identified known issues and important announcements.
|
||||
|
||||
- **Microsoft 365 service health content is specific to my tenants and services. Is the content in Windows release health specific to my Windows environment?**
|
||||
Windows release health does not monitor user environments or collect customer environment information. In Windows release health, all known issue content across all supported Windows versions is published to all subscribed customers. Future iterations of the solution may target content based on customer location, industry, or Windows version.
|
||||
Windows release health doesn't monitor user environments or collect customer environment information. In Windows release health, all known issue content across all supported Windows versions is published to all subscribed customers. Future iterations of the solution may target content based on customer location, industry, or Windows version.
|
||||
|
||||
- **Where do I find Windows release health?**
|
||||
After logging into Microsoft 365 admin center, expand the left-hand menu using **…Show All**, click **Health** and you’ll see **Windows release health**.
|
||||
After logging into Microsoft 365 admin center, expand the left-hand menu using **…Show All**, select **Health** to display the **Windows release health** menu option.
|
||||
|
||||
- **Is the Windows release health content published to Microsoft 365 admin center the same as the content on Windows release health on Docs.microsoft.com?**
|
||||
No. While the content is similar, you may see more issues and more technical details published to Windows release health on Microsoft 365 admin center to better support the IT admin. For example, you’ll find details to help you diagnose issues in your environment, steps to mitigate issues, and root cause analysis.
|
||||
|
||||
- **Is the Windows release health content published to Microsoft 365 admin center the same as the content on Windows release health on Microsoft Learn?**
|
||||
No. While the content is similar, you may see more issues and more technical details published to Windows release health on Microsoft 365 admin center to better support the IT admin. For example, you'll find details to help you diagnose issues in your environment, steps to mitigate issues, and root cause analysis.
|
||||
|
||||
- **How often will content be updated?**
|
||||
In an effort to ensure Windows customers have important information as soon as possible, all major known issues will be shared with Windows customers on both Docs.microsoft.com and the Microsoft 365 admin center. We may also update the details available for Windows release health in the Microsoft 365 admin center when we have additional details on workarounds, root cause, or other information to help you plan for updates and handle issues in your environment.
|
||||
To ensure Windows customers have important information as soon as possible, all major known issues are shared with Windows customers on both Microsoft Learn and the Microsoft 365 admin center. We may also update the details available for Windows release health in the Microsoft 365 admin center when we have additional details on workarounds, root cause, or other information to help you plan for updates and handle issues in your environment.
|
||||
|
||||
- **Can I share this content publicly or with other Windows customers?**
|
||||
Windows release health is provided to you as a licensed Windows customer and is not to be shared publicly.
|
||||
Windows release health is provided to you as a licensed Windows customer and isn't to be shared publicly.
|
||||
|
||||
- **Is the content redundant? How is the content organized in the different tabs?**
|
||||
Windows release health provides three tabs. The landing **All versions** tab allows you to click into a specific version of Windows. The Known issues tab shows the list of issues that are active or resolved in the past 30 days. The History tab shows a six-month history of known issues that have been resolved.
|
||||
Windows release health provides three tabs. The landing **All versions** tab allows you to select a specific version of Windows. The **Known issues** tab shows the list of issues that are active or resolved in the past 30 days. The **History** tab shows a six-month history of known issues that have been resolved.
|
||||
|
||||
- **How do I find information for the versions of Windows I’m managing?**
|
||||
On the **All versions** tab, you can select any Windows version. This will take you to the Known issues tab filtered for the version you selected. The known issues tab provides the list of active known issues and those resolved in the last 30 days. This selection persists throughout your session until changed. From the History tab you can view the list of resolved issues for that version. To change versions, use the filter in the tab.
|
||||
- **How do I find information for the versions of Windows I'm managing?**
|
||||
On the **All versions** tab, you can select any Windows version. This action takes you to the **Known issues** tab filtered for the version you selected. The **Known issues** tab provides the list of active known issues and the issues resolved in the last 30 days. This selection persists throughout your session until changed. From the **History** tab, you can view the list of resolved issues for that version. To change versions, use the filter in the tab.
|
||||
|
||||
### Microsoft 365 Admin Center functions
|
||||
|
||||
@ -131,13 +139,13 @@ A list of all status updates posted in the selected timeframe will be displayed,
|
||||
You can search Microsoft 365 admin center pages using keywords. For Windows release health, go to the desired product page and search using KB numbers, build numbers, or keywords.
|
||||
|
||||
- **How do I add other Windows admins?**
|
||||
Using the left-hand menu, go to Users, then select the Active Users tab and follow the prompts to add a new user, or assign an existing user, to the role of “Service Support admin.”
|
||||
Using the left-hand menu, go to Users, then select the Active Users tab and follow the prompts to add a new user, or assign an existing user, to the role of **Service Support admin**.
|
||||
|
||||
- **Why can’t I click to the KB article from the Known issues or History tabs?**
|
||||
Within the issue description, you’ll find links to the KB articles. In the Known issue and History tabs, the entire row is a clickable entry to the issue’s Details pane.
|
||||
- **Why can't I click to the KB article from the Known issues or History tabs?**
|
||||
Within the issue description, you'll find links to the KB articles. In the known issue and history tabs, the entire row is a clickable entry to the issue's Details pane.
|
||||
|
||||
- **Microsoft 365 admin center has a mobile app but I don’t see Windows release health under the Health menu. Is this an open issue?**
|
||||
We are working to build the Windows release health experience on mobile devices in a future release.
|
||||
- **Microsoft 365 admin center has a mobile app but I don't see Windows release health under the Health menu. Is this an open issue?**
|
||||
We're working to build the Windows release health experience on mobile devices in a future release.
|
||||
|
||||
### Help and support
|
||||
|
||||
@ -145,7 +153,7 @@ A list of all status updates posted in the selected timeframe will be displayed,
|
||||
Seek assistance through Premier support, the [Microsoft Support website](https://support.microsoft.com), or connect with your normal channels for Windows support.
|
||||
|
||||
- **When reaching out to Support, they asked me for an advisory ID. What is this and where can it?**
|
||||
The advisory ID can be found in the upper left-hand corner of the known issue Details pane. To find it, select the Known issue you’re seeking help on, click the Details pane and you’ll find the ID under the issue title. It will be the letters WI followed by a number, similar to “WI123456”.
|
||||
The advisory ID can be found in the upper left-hand corner of the known issue Details pane. To find it, select the known issue you're seeking help on, select the **Details** pane, and you'll find the ID under the issue title. The ID is the letters `WI` followed by a number, similar to `WI123456`.
|
||||
|
||||
- **How can I learn more about expanding my use of Microsoft 365 admin center?**
|
||||
To learn more, see the [Microsoft 365 admin center documentation](/microsoft-365/admin/admin-overview/about-the-admin-center).
|
||||
For more information, see the [Microsoft 365 admin center documentation](/microsoft-365/admin/admin-overview/about-the-admin-center).
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
---
|
||||
title: Create a deployment plan
|
||||
description: Devise the number of deployment rings you need and how you want to populate them
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.collection: m365initiative-coredeploy
|
||||
manager: laurawi
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Create a deployment plan
|
||||
@ -20,7 +20,7 @@ ms.topic: article
|
||||
|
||||
A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity.
|
||||
|
||||
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline.
|
||||
When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows client are similar to the deployment groups most organizations constructed for previous major revision upgrades. They're simply a method to separate devices into a deployment timeline.
|
||||
|
||||
At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur.
|
||||
|
||||
@ -39,7 +39,7 @@ A common ring structure uses three deployment groups:
|
||||
|
||||
## How many rings should I have?
|
||||
|
||||
There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large organization, you might want to consider assigning devices to rings based on geographic location or the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization.
|
||||
There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large organization, you might want to consider assigning devices to rings based on geographic location. Or assign based on the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization.
|
||||
|
||||
## Advancing between rings
|
||||
|
||||
@ -60,17 +60,17 @@ The purpose of the Preview ring is to evaluate the new features of the update. I
|
||||
|
||||
### Who goes in the Preview ring?
|
||||
|
||||
The Preview ring users are the most tech savvy and resilient people, who will not lose productivity if something goes wrong. In general, these users are IT pros, and perhaps a few people in the business organization.
|
||||
The Preview ring users are the most tech savvy and resilient people, who won't lose productivity if something goes wrong. In general, these users are IT pros, and perhaps a few people in the business organization.
|
||||
|
||||
During your plan and prepare phases, you should focus on the following activities:
|
||||
|
||||
- Work with Windows Insider Preview builds.
|
||||
- Identify the features and functionality your organization can or wants to use.
|
||||
- Establish who will use the features and how they will benefit.
|
||||
- Understand why you are putting out the update.
|
||||
- Establish who will use the features and how they'll benefit.
|
||||
- Understand why you're putting out the update.
|
||||
- Plan for usage feedback.
|
||||
|
||||
Remember, you are working with pre-release software in the Preview ring and you will be evaluating features and testing the update for a targeted release.
|
||||
Remember, you're working with pre-release software in the Preview ring and you'll be evaluating features and testing the update for a targeted release.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you are using Windows Insider (pre-release) releases for your preview ring and you are using WSUS or Windows Update for Business, be sure to set the following policies to allow for Preview builds:
|
||||
@ -80,11 +80,11 @@ Remember, you are working with pre-release software in the Preview ring and you
|
||||
## Limited ring
|
||||
|
||||
The purpose of the Limited ring is to validate the update on representative devices across the network. During this period, data, and feedback are generated to enable the decision to move forward to broader deployment. Desktop
|
||||
Analytics can help with defining a good Limited ring of representative devices and assist in monitoring the deployment.
|
||||
Analytics can help with defining a good Limited ring of representative devices and help monitor the deployment.
|
||||
|
||||
### Who goes in the Limited ring?
|
||||
|
||||
The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented, and it's important that the people selected for this ring are using their devices regularly in order to generate the data you will need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network.
|
||||
The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented. It's important that the people selected for this ring are using their devices regularly to generate the data you'll need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network.
|
||||
|
||||
|
||||
During your pilot and validate phases, you should focus on the following activities:
|
||||
@ -93,7 +93,7 @@ During your pilot and validate phases, you should focus on the following activit
|
||||
- Assess and act if issues are encountered.
|
||||
- Move forward unless blocked.
|
||||
|
||||
When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring, because your Limited ring represents your organization across the board, and when you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly.
|
||||
When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring. Your Limited ring represents your organization across the board. When you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly.
|
||||
|
||||
## Broad deployment
|
||||
|
||||
@ -101,7 +101,7 @@ Once the devices in the Limited ring have had a sufficient stabilization period,
|
||||
|
||||
### Who goes in the Broad deployment ring?
|
||||
|
||||
In most businesses, the Broad ring includes the rest of your organization. Because of the work in the previous ring to vet stability and minimize disruption (with diagnostic data to support your decision) broad deployment can occur relatively quickly.
|
||||
In most businesses, the Broad ring includes the rest of your organization. Because of the work in the previous ring to vet stability and minimize disruption (with diagnostic data to support your decision), a broad deployment can occur relatively quickly.
|
||||
|
||||
> [!NOTE]
|
||||
> In some instances, you might hold back on mission-critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows client feature updates to mission critical-devices.
|
||||
@ -109,33 +109,4 @@ In most businesses, the Broad ring includes the rest of your organization. Becau
|
||||
During the broad deployment phase, you should focus on the following activities:
|
||||
|
||||
- Deploy to all devices in the organization.
|
||||
- Work through any final unusual issues that were not detected in your Limited ring.
|
||||
|
||||
|
||||
## Ring deployment planning
|
||||
|
||||
Previously, we have provided methods for analyzing your deployments, but these have been standalone tools to assess, manage and execute deployments. In other words, you would generate an analysis, make a deployment strategy, and then move to your console for implementation, repeating these steps for each deployment. We have combined many of these tasks, and more, into a single interface with Desktop Analytics.
|
||||
|
||||
|
||||
[Desktop Analytics](/mem/configmgr/desktop-analytics/overview) is a cloud-based service and a key tool in [Microsoft Endpoint Manager](/mem/configmgr/core/understand/microsoft-endpoint-manager-faq). Using artificial intelligence and machine learning, Desktop Analytics is a powerful tool to give you insights and intelligence to
|
||||
make informed decisions about the readiness of your Windows devices.
|
||||
|
||||
In Windows client deployments, we have seen compatibility issues on < 0.5% of apps when using Desktop Analytics. Using Desktop Analytics with Microsoft Endpoint Manager can help you assess app compatibility with the latest
|
||||
feature update and create groups that represent the broadest number of hardware and software configurations on the smallest set of devices across your organization. In addition, Desktop Analytics can provide you with a device and software inventory and identify issues, giving you data that equate to actionable decisions.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Desktop Analytics does not support preview (Windows Insider) builds; use Configuration Manager to deploy to your Preview ring. As noted previously, the Preview ring is a small group of devices represents your ecosystem very well in terms of app, driver, and hardware diversity.
|
||||
|
||||
### Deployment plan options
|
||||
|
||||
There are two ways to implement a ring deployment plan, depending on how you manage your devices:
|
||||
|
||||
- If you are using Configuration Manager: Desktop Analytics provides end-to-end deployment plan integration so that you can also kick off phased deployments within a ring. Learn more about [deployment plans in Desktop Analytics](/mem/configmgr/desktop-analytics/about-deployment-plans).
|
||||
- If you are using Microsoft Intune, see [Create deployment plans directly in Intune](/mem/intune/fundamentals/planning-guide).
|
||||
|
||||
For more about Desktop Analytics, see these articles:
|
||||
|
||||
- [How to set up Desktop Analytics](/mem/configmgr/desktop-analytics/set-up)
|
||||
- [Tutorial: Deploy Windows 10 to Pilot](/mem/configmgr/desktop-analytics/tutorial-windows10)
|
||||
- [Desktop Analytics documentation](/mem/configmgr/desktop-analytics/overview)
|
||||
- [Intune deployment planning, design, and implementation guide](/mem/intune/fundamentals/planning-guide)
|
||||
- Work through any final unusual issues that weren't detected in your Limited ring.
|
||||
|
||||
@ -1,82 +0,0 @@
|
||||
---
|
||||
title: Using a proxy with Delivery Optimization
|
||||
manager: laurawi
|
||||
description: Settings to use with various proxy configurations to allow Delivery Optimization to work
|
||||
keywords: updates, downloads, network, bandwidth
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Using a proxy with Delivery Optimization
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
When Delivery Optimization downloads content from HTTP sources, it uses the automatic proxy discovery capability of WinHttp to streamline and maximize the support for complex proxy configurations as it makes range requests from the content server. It does this by setting the **WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY** flag in all HTTP calls.
|
||||
|
||||
Delivery Optimization provides a token to WinHttp that corresponds to the user that is signed in currently. In turn, WinHttp automatically authenticates the user against the proxy server set either in Internet Explorer or in the **Proxy Settings** menu in Windows.
|
||||
|
||||
For downloads that use Delivery Optimization to successfully use the proxy, you should set the proxy via Windows **Proxy Settings** or the Internet Explorer proxy settings.
|
||||
|
||||
Setting the Internet Explorer proxy to apply device-wide will ensure that the device can access the proxy server even when no user is signed in. In this case, the proxy is accessed with the “NetworkService” context if proxy authentication is required.
|
||||
|
||||
> [!NOTE]
|
||||
> We don't recommend that you use `netsh winhttp set proxy ProxyServerName:PortNumber`. Using this offers no auto-detection of the proxy, no support for an explicit PAC URL, and no authentication to the proxy. This setting is ignored by WinHTTP for requests that use auto-discovery (if an interactive user token is used).
|
||||
|
||||
If a user is signed in, the system uses the Internet Explorer proxy.
|
||||
|
||||
If no user is signed in, even if both the Internet Explorer proxy and netsh configuration are set, the netsh configuration will take precedence over the Internet Explorer proxy. This can result in download failures. For example, you might receive HTTP_E_STATUS_PROXY_AUTH_REQ or HTTP_E_STATUS_DENIED errors.
|
||||
|
||||
You can still use netsh to import the proxy setting from Internet Explorer (`netsh winhttp import proxy source=ie `) if your proxy configuration is a static *proxyServerName:Port*. However, the same limitations mentioned previously apply.
|
||||
|
||||
### Summary of settings behavior
|
||||
|
||||
These tables summarize the behavior for various combinations of settings:
|
||||
|
||||
With an interactive user signed in:
|
||||
|
||||
|Named proxy set by using: |Delivery Optimization successfully uses proxy |
|
||||
|---------|---------|
|
||||
|Internet Explorer proxy, current user | Yes |
|
||||
|Internet Explorer proxy, device-wide | Yes |
|
||||
|netsh proxy | No |
|
||||
|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, Internet Explorer proxy is used |
|
||||
|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, Internet Explorer proxy is used |
|
||||
|
||||
With NetworkService (if unable to obtain a user token from a signed-in user):
|
||||
|
||||
|Named proxy set by using: |Delivery Optimization successfully uses proxy |
|
||||
|---------|---------|
|
||||
|Internet Explorer proxy, current user | No |
|
||||
|Internet Explorer proxy, device-wide | Yes |
|
||||
|netsh proxy | Yes |
|
||||
|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, netsh proxy is used |
|
||||
|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, netsh proxy is used |
|
||||
|
||||
## Setting a device-wide Internet Explorer proxy
|
||||
|
||||
You can set a device-wide proxy that will apply to all users including an interactive user, LocalSystem, and NetworkService by using the [Network Proxy CSP](/windows/client-management/mdm/networkproxy-csp).
|
||||
|
||||
Or, if you use Group Policy, you can apply proxy settings to all users of the same device by enabling the **Computer Configuration\ Administrative Templates\ Windows Components\ Internet Explorer\ Make proxy settings per-machine (rather than per-user)** policy.
|
||||
|
||||
This policy is meant to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user, so if you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings.
|
||||
|
||||
## Using a proxy with Microsoft Connected Cache
|
||||
|
||||
Starting with Windows 10, version 2004, you can use Connected Cache behind a proxy. In older versions, when you set Delivery Optimization to download from Connected Cache, it will bypass the proxy and try to connect directly to the Connected Cache server. This can cause failure to download.
|
||||
|
||||
However, you can set the Connected Cache server to use an unauthenticated proxy. For more information, see [Microsoft Connected Cache in Configuration Manager](/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache#prerequisites-and-limitations).
|
||||
|
||||
## Related articles
|
||||
|
||||
- [How can I configure Proxy AutoConfigURL Setting using Group Policy Preference (GPP)?](/archive/blogs/askie/how-can-i-configure-proxy-autoconfigurl-setting-using-group-policy-preference-gpp)
|
||||
- [How to use GPP Registry to uncheck automatically detect settings? ](/archive/blogs/askie/how-to-use-gpp-registry-to-uncheck-automatically-detect-settings)
|
||||
- [How to configure a proxy server URL and Port using GPP Registry?](/archive/blogs/askie/how-to-configure-a-proxy-server-url-and-port-using-gpp-registry)
|
||||
@ -1,44 +0,0 @@
|
||||
---
|
||||
title: Delivery Optimization client-service communication explained
|
||||
manager: dougeby
|
||||
description: Details of how Delivery Optimization communicates with the server when content is requested to download.
|
||||
keywords: updates, downloads, network, bandwidth
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
audience: itpro
|
||||
author: carmenf
|
||||
ms.localizationpriority: medium
|
||||
ms.author: carmenf
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Delivery Optimization client-service communication explained
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
## Download request workflow
|
||||
|
||||
This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device. Delivery Optimization uses content metadata to determine all available locations to pull content from, as well as content verification.
|
||||
|
||||
|
||||
1. When a download starts, the Delivery Optimization client attempts to get its content metadata. This content metadata is a hash file containing the SHA-256 block-level hashes of each piece in the file (typically one piece = 1 MB).
|
||||
2. The authenticity of the content metadata file itself is verified prior to any content being downloaded using a hash that is obtained via an SSL channel from the Delivery Optimization service. The same channel is used to ensure the content is curated and authorized to leverage peer-to-peer.
|
||||
3. When Delivery Optimization pulls a certain piece of the hash from another peer, it verifies the hash against the known hash in the content metadata file.
|
||||
4. If a peer provides an invalid piece, that piece is discarded. When a peer sends multiple bad pieces, it's banned and will no longer be used as a source by the Delivery Optimization client performing the download.
|
||||
5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to “simple mode” (pulling content only from an HTTP source) and peer-to-peer won't be allowed.
|
||||
6. Once downloading is complete, Delivery Optimization uses all retrieved pieces of the content to put the file together. At that point, the Delivery Optimization caller (for example, Windows Update) checks the entire file to verify the signature prior to installing it.
|
||||
|
||||
## Delivery Optimization service endpoint and data information
|
||||
|
||||
|Endpoint hostname|Port|Name|Description|Data sent from the computer to the endpoint
|
||||
|--------------------------------------------|--------|---------------|-----------------------|------------------------|
|
||||
| geover-prod.do.dsp.mp.microsoft.com <br> geo-prod.do.dsp.mp.microsoft.com <br> geo.prod.do.dsp.mp.microsoft.com <br> geover.prod.do.dsp.mp.microsoft.com | 443 | Geo | Service used to identify the location of the device in order to direct it to the nearest data center. | **Profile**: The device type (for example, PC or Xbox) <br> **doClientVersion**: The version of the DoSvc client <br> **groupID**: Group the device belongs to (set with DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies) |
|
||||
| kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services as well as device configs. | **countryCode**: The country the client is connected from <br> **doClientVersion**: The version of the DoSvc client <br> **Profile**: The device type (for example, PC or Xbox) <br> **eId**: Client grouping Id <br> **CacheHost**: Cache host id |
|
||||
| cp\*.prod.do.dsp.mp.microsoft.com <br> | 443 | Content Policy | Provides content specific policies as well as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **countryCode**: The country the client is connected from <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **eId**: Client grouping Id <br> **CacheHost**: Cache host id |
|
||||
| disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupId and external IP. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **partitionId**: Client partitioning hint <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **eId**: Client grouping Id |
|
||||
| array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **PeerId**: Identity of the device running DO client <br> **ReportedIp**: The internal / private IP Address <br> **IsBackground**: Is the download interactive or background <br> **Uploaded**: Total bytes uploaded to peers <br> **Downloaded**: Total bytes downloaded from peers <br> **DownloadedCdn**: Total bytes downloaded from CDN <br> **Left**: Bytes left to download <br> **Peers Wanted**: Total number of peers wanted <br> **Group Id**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies) <br> **Scope**: The Download mode <br> **UploadedBPS**: The upload speed in bytes per second <br> **DownloadBPS**: The download speed in Bytes per second <br> **eId**: Client grouping Id |
|
||||
| dl.delivery.mp.microsoft.com <br> emdl.ws.microsoft.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer. |
|
||||
@ -1,21 +1,21 @@
|
||||
---
|
||||
title: Deploy Windows client updates with Configuration Manager
|
||||
description: Deploy Windows client updates with Configuration Manager
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Deploy Windows 10 updates with Configuration Manager
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
See the Microsoft Endpoint Manager [documentation](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates.
|
||||
See the [Microsoft Configuration Manager documentation](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates.
|
||||
|
||||
@ -1,21 +1,24 @@
|
||||
---
|
||||
title: Deploy updates with Intune
|
||||
description: Deploy Windows client updates with Intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
description: Deploy Windows client updates with Intune.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Deploy Windows 10 updates with Intune
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
See the Microsoft Intune [documentation](/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows client updates.
|
||||
See the Microsoft Intune [documentation](/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows client updates.
|
||||
|
||||
335
windows/deployment/update/deployment-service-drivers.md
Normal file
335
windows/deployment/update/deployment-service-drivers.md
Normal file
@ -0,0 +1,335 @@
|
||||
---
|
||||
title: Deploy drivers and firmware updates with Windows Update for Business deployment service.
|
||||
description: Use Windows Update for Business deployment service to deploy driver and firmware updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 06/22/2023
|
||||
---
|
||||
|
||||
# Deploy drivers and firmware updates with Windows Update for Business deployment service
|
||||
<!--7260403, 7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a driver update to clients. In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
>
|
||||
> - [Open Graph Explorer](#open-graph-explorer)
|
||||
> - [Run queries to identify devices](#run-queries-to-identify-devices)
|
||||
> - [Enroll devices](#enroll-devices)
|
||||
> - [Create a deployment audience and add audience members](#create-a-deployment-audience-and-add-audience-members)
|
||||
> - [Create an update policy](#create-an-update-policy)
|
||||
> - [Review applicable driver content](#review-applicable-driver-content)
|
||||
> - [Approve driver content for deployment](#approve-driver-content-for-deployment)
|
||||
> - [Revoke content approval](#revoke-content-approval)
|
||||
> - [Unenroll devices](#unenroll-devices)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## Enroll devices
|
||||
|
||||
When you enroll devices into driver management, the deployment service becomes the authority for driver updates coming from Windows Update. Devices don't receive drivers or firmware from Windows Update until a deployment is manually created or they're added to a driver update policy with approvals.
|
||||
|
||||
<!--Using include for enrolling devices using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-enroll-device-graph-explorer.md)]
|
||||
|
||||
## Create a deployment audience and add audience members
|
||||
|
||||
<!--Using include for creating deployment audiences and adding audience members using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-audience-graph-explorer.md)]
|
||||
|
||||
Once a device has been enrolled and added to a deployment audience, the Windows Update for Business deployment service will start collecting scan results from Windows Update to build a catalog of applicable drivers to be browsed, approved, and scheduled for deployment.
|
||||
|
||||
## Create an update policy
|
||||
|
||||
Update policies define how content is deployed to a deployment audience. An [update policy](/graph/api/resources/windowsupdates-updatepolicy) ensures deployments to a deployment audience behave in a consistent manner without having to create and manage multiple individual deployments. When a content approval is added to the policy, it's deployed to the devices in the associated audiences. The deployment and monitoring settings are optional.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) configured for a [content approval](#approve-driver-content-for-deployment) will be combined with the existing update policy's deployment settings. If the content approval and update policy specify the same deployment setting, the setting from the content approval is used.
|
||||
|
||||
|
||||
### Create a policy and define the settings later
|
||||
|
||||
To create a policy without any deployment settings, in the request body specify the **Audience ID** as `id`. In the following example, the **Audience ID** is `d39ad1ce-0123-4567-89ab-cdef01234567`, and the `id` given in the response is the **Policy ID**:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Response returning the policy, without any additional settings specified, that has a **Policy ID** of `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```json
|
||||
HTTP/1.1 202 Accepted
|
||||
content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/updatePolicies/$entity",
|
||||
"id": "9011c330-1234-5678-9abc-def012345678",
|
||||
"createdDateTime": "2023-01-25T05:32:21.9721459Z",
|
||||
"autoEnrollmentUpdateCategories": [],
|
||||
"complianceChangeRules": [],
|
||||
"deploymentSettings": {
|
||||
"schedule": null,
|
||||
"monitoring": null,
|
||||
"contentApplicability": null,
|
||||
"userExperience": null,
|
||||
"expedite": null
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Specify settings during policy creation
|
||||
|
||||
To create a policy with additional settings, in the request body:
|
||||
- Specify the **Audience ID** as `id`
|
||||
- Define any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings).
|
||||
- Add the `content-length` header to the request if a status code of 411 occurs. The value should be the length of the request body in bytes. For information on error codes, see [Microsoft Graph error responses and resource types](/graph/errors).
|
||||
|
||||
In the following driver update policy example, any deployments created by a content approval will start 7 days after approval for **Audience ID** `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.updatePolicy",
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567"
|
||||
},
|
||||
"complianceChanges": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval"
|
||||
}
|
||||
],
|
||||
"complianceChangeRules": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApprovalRule",
|
||||
"contentFilter": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateFilter"
|
||||
},
|
||||
"durationBeforeDeploymentStart": "P7D"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
### Review and edit update policy settings
|
||||
|
||||
To review the policy settings, run the following query using the **Policy ID**, for example `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678
|
||||
```
|
||||
|
||||
To edit the policy settings, **PATCH** the policy using the **Policy ID**. Run the following **PATCH** to automatically approve driver content that's recommended by `Microsoft`for deployment for **Policy ID** `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
``` msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"complianceChangeRules": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApprovalRule",
|
||||
"contentFilter": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateFilter"
|
||||
}
|
||||
}
|
||||
],
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"contentApplicability": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApplicabilitySettings",
|
||||
"offerWhileRecommendedBy": ["microsoft"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
## Review applicable driver content
|
||||
|
||||
Once Windows Update for Business deployment service has scan results from devices, the applicability for driver and firmware updates can be displayed for a deployment audience. Each applicable update returns the following information:
|
||||
|
||||
- An `id` for its [catalog entry](/graph/api/resources/windowsupdates-catalogentry)
|
||||
- The **Azure AD ID** of the devices it's applicable to
|
||||
- Information describing the update such as the name and version.
|
||||
|
||||
To display [applicable content](/graph/api/resources/windowsupdates-applicablecontent), run a query using the **Audience ID**, for example `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/applicableContent
|
||||
```
|
||||
|
||||
The following truncated response displays:
|
||||
- An **Azure AD ID** of `01234567-89ab-cdef-0123-456789abcdef`
|
||||
- The **Catalog ID** of `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`
|
||||
|
||||
```json
|
||||
"matchedDevices": [
|
||||
{
|
||||
"recommendedBy": [
|
||||
"Microsoft"
|
||||
],
|
||||
"deviceId": "01ea3c90-12f5-4093-a4c9-c1434657c976"
|
||||
}
|
||||
],
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c",
|
||||
"displayName": "Microsoft - Test - 1.0.0.1",
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "0001-01-21T04:18:32Z",
|
||||
"description": "Microsoft test driver update released in January 2021",
|
||||
"driverClass": "OtherHardware",
|
||||
"provider": "Microsoft",
|
||||
"setupInformationFile": null,
|
||||
"manufacturer": "Microsoft",
|
||||
"version": "1.0.0.1",
|
||||
"versionDateTime": "2021-01-11T02:43:14Z"
|
||||
```
|
||||
|
||||
## Approve driver content for deployment
|
||||
|
||||
Each driver update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). Approve content for drivers and firmware by adding a [content approval](/graph/api/resources/windowsupdates-contentapproval) for the catalog entry to an existing policy. Content approval is a [compliance change](/graph/api/resources/windowsupdates-compliancechange) for the policy.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) configured for the content approval will be combined with the existing [update policy's](#create-an-update-policy) deployment settings. If the content approval and update policy specify the same deployment setting, the setting from the content approval is used.
|
||||
|
||||
Add a content approval to an existing policy, **Policy ID** `9011c330-1234-5678-9abc-def012345678` for the driver update with the **Catalog ID** `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`. Schedule the start date for February 14, 2023 at 1 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c"
|
||||
}
|
||||
},
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T01:00:00Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The response for a content approval returns content and deployment settings along with an `id`, which is the **Compliance Change ID**. The **Compliance Change ID** is `c03911a7-9876-5432-10ab-cdef98765432` in the following truncated response:
|
||||
|
||||
```json
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"id": "c03911a7-9876-5432-10ab-cdef98765432",
|
||||
"createdDateTime": "2023-02-02T17:54:39.173292Z",
|
||||
"isRevoked": false,
|
||||
"revokedDateTime": "0001-01-01T00:00:00Z",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c"
|
||||
}
|
||||
},
|
||||
"deploymentSettings": {
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T01:00:00Z",
|
||||
```
|
||||
|
||||
Review all of the compliance changes to a policy with the most recent changes listed in the response first. The following example returns the compliance changes for a policy with the **Policy ID** `9011c330-1234-5678-9abc-def012345678` and sorts by `createdDateTime` in descending order:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges?orderby=createdDateTime desc
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> There should only be one **Compliance Change ID** per **Catalog ID** for a policy. If there are multiple **Compliance Change IDs** for the same **Catalog ID** then, most likely, there's multiple deployments for the same piece of content targeted to the same audience but with different deployment behaviors. To remove the duplicate, [delete the compliance change](/graph/api/windowsupdates-compliancechange-delete) with the duplicate **Catalog ID**. Deleting the compliance change will mark any deployments created by the approval as `archived`.
|
||||
|
||||
To retrieve the deployment ID, use the [expand parameter](/graph/query-parameters#expand-parameter) to review the deployment information related the content approval. The following example displays the content approval and the deployment information for **Compliance Change ID** `c03911a7-9876-5432-10ab-cdef98765432` in update **Policy ID** `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432/$/microsoft.graph.windowsUpdates.contentApproval?$expand=deployments
|
||||
```
|
||||
|
||||
### Edit deployment settings for a content approval
|
||||
|
||||
Since content approval is a compliance change for the policy, when you [update a content approval](/graph/api/windowsupdates-contentapproval-update), you're editing the compliance change for the policy. The following example changes the `startDateTime` for the **Compliance Change ID** of `c03911a7-9876-5432-10ab-cdef98765432` in the update **Policy ID** `9011c330-1234-5678-9abc-def012345678` to February 28, 2023 at 5 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-28T05:00:00Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Revoke content approval
|
||||
|
||||
Approval for content can be revoked by setting the `isRevoked` property of the [compliance change](/graph/api/resources/windowsupdates-compliancechange) to true. This setting can be changed while a deployment is in progress. However, revoking will only prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new [approval](#approve-driver-content-for-deployment) will need to be created.
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"isRevoked": true
|
||||
}
|
||||
```
|
||||
|
||||
To display all deployments with the most recently created returned first, order deployments based on the `createdDateTime`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deployments?orderby=createdDateTime desc
|
||||
```
|
||||
|
||||
## Unenroll devices
|
||||
|
||||
<!--Using include for removing device enrollment-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-graph-unenroll.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
@ -0,0 +1,196 @@
|
||||
---
|
||||
title: Deploy expedited updates with Windows Update for Business deployment service
|
||||
description: Use Windows Update for Business deployment service to deploy expedited updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Deploy expedited updates with Windows Update for Business deployment service
|
||||
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
>
|
||||
> * [Open Graph Explorer](#open-graph-explorer)
|
||||
> * [Run queries to identify test devices](#run-queries-to-identify-devices)
|
||||
> * [List catalog entries for expedited updates](#list-catalog-entries-for-expedited-updates)
|
||||
> * [Create a deployment](#create-a-deployment)
|
||||
> * [Add members to the deployment audience](#add-members-to-the-deployment-audience)
|
||||
> * [Delete a deployment](#delete-a-deployment)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## List catalog entries for expedited updates
|
||||
|
||||
Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security updates that can be deployed as expedited updates by the deployment service. Using `$top=3` and ordering by `ReleaseDateTimeshows` displays the three most recent updates.
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=3
|
||||
```
|
||||
|
||||
The following truncated response displays a **Catalog ID** of `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432` for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update:
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries",
|
||||
"value": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432",
|
||||
"displayName": "01/10/2023 - 2023.01 B Security Updates for Windows 10 and later",
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "2023-01-10T00:00:00Z",
|
||||
"isExpeditable": true,
|
||||
"qualityUpdateClassification": "security"
|
||||
},
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Create a deployment
|
||||
|
||||
When creating a deployment, there are [multiple options](/graph/api/resources/windowsupdates-deploymentsettings) available to define how the deployment behaves. The following example creates a deployment for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update with catalog entry ID `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432`, and defines the `expedite` and `userExperience` deployment options in the request body.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deployments
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deployment",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"expedite": {
|
||||
"isExpedited": true
|
||||
},
|
||||
"userExperience": {
|
||||
"daysUntilForcedReboot": 2
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The request returns a 201 Created response code and a [deployment](/graph/api/resources/windowsupdates-deployment) object in the response body for the newly created deployment, which includes:
|
||||
|
||||
- The **Deployment ID** `de910e12-3456-7890-abcd-ef1234567890` of the newly created deployment.
|
||||
- The **Audience ID** `d39ad1ce-0123-4567-89ab-cdef01234567` of the newly created deployment audience.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments/$entity",
|
||||
"id": "de910e12-3456-7890-abcd-ef1234567890",
|
||||
"createdDateTime": "2023-02-09T22:55:04.8547517Z",
|
||||
"lastModifiedDateTime": "2023-02-09T22:55:04.8547524Z",
|
||||
"state": {
|
||||
"effectiveValue": "offering",
|
||||
"requestedValue": "none",
|
||||
"reasons": []
|
||||
},
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/content/microsoft.graph.windowsUpdates.catalogContent/catalogEntry/$entity",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432",
|
||||
"displayName": null,
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "2023-01-10T00:00:00Z",
|
||||
"isExpeditable": false,
|
||||
"qualityUpdateClassification": "security"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"schedule": null,
|
||||
"monitoring": null,
|
||||
"contentApplicability": null,
|
||||
"userExperience": {
|
||||
"daysUntilForcedReboot": 2
|
||||
},
|
||||
"expedite": {
|
||||
"isExpedited": true
|
||||
}
|
||||
},
|
||||
"audience@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/audience/$entity",
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567",
|
||||
"applicableContent": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Add members to the deployment audience
|
||||
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be expedited.
|
||||
|
||||
The following example adds two devices to the deployment audience using the **Azure AD ID** for each device:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
To verify the devices were added to the audience, run the following query using the **Audience ID** of `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/members
|
||||
```
|
||||
|
||||
## Delete a deployment
|
||||
|
||||
To stop an expedited deployment, DELETE the deployment. Deleting the deployment will prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new approval will need to be created.
|
||||
|
||||
|
||||
The following example deletes the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
DELETE https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
|
||||
<!--Using include for Update Health Tools log location-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)]
|
||||
292
windows/deployment/update/deployment-service-feature-updates.md
Normal file
292
windows/deployment/update/deployment-service-feature-updates.md
Normal file
@ -0,0 +1,292 @@
|
||||
---
|
||||
title: Deploy feature updates with Windows Update for Business deployment service.
|
||||
description: Use Windows Update for Business deployment service to deploy feature updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Deploy feature updates with Windows Update for Business deployment service
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a feature update to clients. In this article, you will:
|
||||
|
||||
In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
> * [Open Graph Explorer](#open-graph-explorer)
|
||||
> * [Run queries to identify devices](#run-queries-to-identify-devices)
|
||||
> * [Enroll devices](#enroll-devices)
|
||||
> * [List catalog entries for feature updates](#list-catalog-entries-for-feature-updates)
|
||||
> * [Create a deployment](#create-a-deployment)
|
||||
> * [Add members to the deployment audience](#add-members-to-the-deployment-audience)
|
||||
> * [Pause a deployment](#pause-a-deployment)
|
||||
> * [Delete a deployment](#delete-a-deployment)
|
||||
> * [Unenroll devices](#unenroll-devices)
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## Enroll devices
|
||||
|
||||
When you enroll devices into feature update management, the deployment service becomes the authority for feature updates coming from Windows Update.
|
||||
As long as a device remains enrolled in feature update management through the deployment service, the device doesn't receive any other feature updates from Windows Update unless explicitly deployed using the deployment service. A device is offered the specified feature update if it hasn't already received the update. For example, if you deploy Windows 11 feature update version 22H2 to a device that's enrolled into feature update management and is currently on an older version of Windows 11, the device updates to version 22H2. If the device is already running version 22H2 or a later version, it stays on its current version.
|
||||
|
||||
> [!TIP]
|
||||
> Windows Update for Business reports has a [workbook](wufb-reports-workbook.md#feature-updates-tab) that displays the current operating system version for devices. In the workbook, go to the **Feature updates** tab and in the **In Service feature update** tile, select the **View details** link to open the details flyout. The OS version and Azure AD ID of devices can easily be exported into a .csv file or opened in [Azure Monitor Logs](/azure/azure-monitor/logs/log-query-overview) to help when creating a deployment audience.
|
||||
|
||||
<!--Using include for enrolling devices using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-enroll-device-graph-explorer.md)]
|
||||
|
||||
## List catalog entries for feature updates
|
||||
|
||||
Each feature update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). The `id` returned is the **Catalog ID** and is used to create a deployment. Feature updates are deployable until they reach their support retirement dates. For more information, see the support lifecycle dates for [Windows 10](/lifecycle/products/windows-10-enterprise-and-education) and [Windows 11](/lifecycle/products/windows-11-enterprise-and-education) Enterprise and Education editions. The following query lists all deployable feature update catalog entries:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.featureUpdateCatalogEntry')
|
||||
```
|
||||
|
||||
The following truncated response displays a **Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f` for the Windows 11, version 22H2 feature update:
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries",
|
||||
"value": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f",
|
||||
"displayName": "Windows 11, version 22H2",
|
||||
"deployableUntilDateTime": "2025-10-14T00:00:00Z",
|
||||
"releaseDateTime": "2022-09-20T00:00:00Z",
|
||||
"version": "Windows 11, version 22H2"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Create a deployment
|
||||
|
||||
When creating a deployment for a feature update, there are multiple options available to define how the deployment behaves. The deployment and monitoring settings are optional. The following [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) are defined in the example request body for deploying the Windows 11, version 22H2 feature update (**Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f`):
|
||||
|
||||
- Deployment [start date](/graph/api/resources/windowsupdates-schedulesettings) of February 14, 2023 at 5 AM UTC
|
||||
- [Gradual rollout](/graph/api/resources/windowsupdates-gradualrolloutsettings) at a rate of 100 devices every three days
|
||||
- [Monitoring rule](/graph/api/resources/windowsupdates-monitoringrule) that will pause the deployment if five devices rollback the feature update
|
||||
- Default [safeguard hold](/graph/api/resources/windowsupdates-safeguardprofile) behavior of applying all applicable safeguards to devices in a deployment
|
||||
- When safeguard holds aren't explicitly defined, the default safeguard hold behavior is applied automatically
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deployments
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": "100"
|
||||
}
|
||||
},
|
||||
"monitoring": {
|
||||
"monitoringRules": [
|
||||
{
|
||||
"signal": "rollback",
|
||||
"threshold": 5,
|
||||
"action": "pauseDeployment"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The response body will contain:
|
||||
- The new **Deployment ID**, `de910e12-3456-7890-abcd-ef1234567890` in the example
|
||||
- The new **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567` in the example
|
||||
- Any settings defined in the deployment request body
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments/$entity",
|
||||
"id": "de910e12-3456-7890-abcd-ef1234567890",
|
||||
"createdDateTime": "2023-02-07T19:21:15.425905Z",
|
||||
"lastModifiedDateTime": "2023-02-07T19:21:15Z",
|
||||
"state": {
|
||||
"effectiveValue": "scheduled",
|
||||
"requestedValue": "none",
|
||||
"reasons": []
|
||||
},
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/content/microsoft.graph.windowsUpdates.catalogContent/catalogEntry/$entity",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f",
|
||||
"displayName": "Windows 11, version 22H2",
|
||||
"deployableUntilDateTime": "2025-10-14T00:00:00Z",
|
||||
"releaseDateTime": "0001-01-01T00:00:00Z",
|
||||
"version": "Windows 11, version 22H2"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"contentApplicability": null,
|
||||
"userExperience": null,
|
||||
"expedite": null,
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": 100
|
||||
}
|
||||
},
|
||||
"monitoring": {
|
||||
"monitoringRules": [
|
||||
{
|
||||
"signal": "rollback",
|
||||
"threshold": 5,
|
||||
"action": "pauseDeployment"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"audience@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/audience/$entity",
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567",
|
||||
"applicableContent": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Edit a deployment
|
||||
|
||||
To [update deployment](/graph/api/windowsupdates-deployment-update), PATCH the deployment resource by its **Deployment ID** and supply the updated settings in the request body. The following example keeps the existing gradual rollout settings that were defined when creating the deployment but changes the deployment start date to February 28, 2023 at 5 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-28T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": "100"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Verify the deployment settings for the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
## Add members to the deployment audience
|
||||
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be offered.
|
||||
|
||||
The following example adds three devices to the deployment audience using the **Azure AD ID** for each device:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde1"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
To verify the devices were added to the audience, run the following query using the **Audience ID** of `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/members
|
||||
```
|
||||
|
||||
## Pause a deployment
|
||||
|
||||
To pause a deployment, PATCH the deployment to have a `requestedValue` of `paused` for the [deploymentState](/graph/api/resources/windowsupdates-deploymentstate). To resume the deployment, use the value `none` and the state will either update to `offering` or `scheduled` if the deployment hasn't reached the start date yet.
|
||||
|
||||
The following example pauses the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deployment",
|
||||
"state": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentState",
|
||||
"requestedValue": "paused"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Delete a deployment
|
||||
|
||||
To remove the deployment completely, DELETE the deployment. Deleting the deployment will prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new approval will need to be created.
|
||||
|
||||
|
||||
The following example deletes the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
DELETE https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
## Unenroll devices
|
||||
|
||||
<!--Using include for removing device enrollment-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-graph-unenroll.md)]
|
||||
@ -1,104 +1,72 @@
|
||||
---
|
||||
title: Windows Update for Business deployment service
|
||||
description: Overview of deployment service to control approval, scheduling, and safeguarding of Windows updates
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: overview
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
|
||||
|
||||
# Windows Update for Business deployment service
|
||||
|
||||
**Applies to**
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It's designed to work with your existing [Windows Update for Business](waas-manage-updates-wufb.md) policies and [Windows Update for Business reports](wufb-reports-overview.md). The deployment service provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update to managed devices. The service is privacy focused and backed by leading industry compliance certifications.
|
||||
|
||||
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update. It's designed to work in harmony with your existing Windows Update for Business policies.
|
||||
Windows Update for Business product family has three elements:
|
||||
|
||||
The deployment service is designed for IT Pros who are looking for more control than is provided through deferral policies and deployment rings. It provides the following abilities:
|
||||
- Client policy to govern update experiences and timing, which are available through Group Policy and CSPs
|
||||
- [Windows Update for Business reports](wufb-reports-overview.md) to monitor update deployment
|
||||
- Deployment service APIs to approve and schedule specific updates for deployment, which are available through the Microsoft Graph and associated SDKs (including PowerShell)
|
||||
|
||||
- You can schedule deployment of updates to start on a specific date (for example, deploy 20H2 to specified devices on March 14, 2021).
|
||||
- You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021).
|
||||
- You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise.
|
||||
- You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization.
|
||||
- You can use safeguards against likely update issues that have been identified by Microsoft machine-learning algorithms and automatically hold the deployment for any affected devices.
|
||||
The deployment service complements existing Windows Update for Business capabilities, including existing device policies and the[Windows Update for Business reports workbook](wufb-reports-workbook.md).
|
||||
|
||||
The service is privacy focused and backed by leading industry compliance certifications.
|
||||
:::image type="content" source="media/7512398-deployment-service-overview.png" alt-text="Diagram displaying the three elements that are parts of the Windows Update for Business family.":::
|
||||
|
||||
## How it works
|
||||
## How the deployment service works
|
||||
|
||||
The deployment service complements existing Windows Update for Business capabilities, including existing device policies and [Update Compliance](update-compliance-monitor.md).
|
||||
With most update management solutions, usually update policies are set on the client itself using either registry edits, Group Policy, or an MDM solution that leverages CSPs. This means that the end user experience and deployment settings for updates are ultimately determined by the individual device settings. However, with Windows Update for Business deployment service, the service is the central point of control for update deployment behavior. Because the deployment service is directly integrated with Windows Update, once the admin defines the deployment behavior, Windows Update is already aware of how device should be directed to install updates when the device scans. The deployment service creates a direct communication channel between a management tool (including scripting tools such as Windows PowerShell) and the Windows Update service so that the approval and offering of content can be directly controlled by an admin.
|
||||
|
||||
:::image type="content" source="media/wufbds-product-large.png" alt-text="Elements in following text.":::
|
||||
|
||||
Windows Update for Business comprises three elements:
|
||||
- Client policy to govern update experiences and timing – available through Group Policy and CSPs
|
||||
- Deployment service APIs to approve and schedule specific updates – available through the Microsoft Graph and associated SDKs (including PowerShell)
|
||||
- Update Compliance to monitor update deployment – available through the Azure Marketplace
|
||||
|
||||
Unlike existing client policy, the deployment service does not interact with devices directly. The service is native to the cloud and all operations take place between various Microsoft services. It creates a direct communication channel between a management tool (including scripting tools such as Windows PowerShell) and the Windows Update service so that the approval and offering of content can be directly controlled by an IT Pro.
|
||||
|
||||
:::image type="content" source="media/wufbds-interaction-small.png" alt-text="Process described in following text.":::
|
||||
|
||||
Using the deployment service typically follows a common pattern:
|
||||
1. IT Pro uses a management tool to select devices and approve content to be deployed. This tool could be PowerShell, a Microsoft Graph app or a more complete management solution such as Microsoft Endpoint Manager.
|
||||
2. The chosen tool conveys your approval, scheduling, and device selection information to the deployment service.
|
||||
1. An admin uses a management tool to select devices and approve content to be deployed. This tool could be PowerShell, a Microsoft Graph app, or a more complete management solution such as Microsoft Intune.
|
||||
2. The chosen management tool conveys your approval, scheduling, and device selection information to the deployment service.
|
||||
3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers approved content to devices on their next check for updates.
|
||||
|
||||
The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as Microsoft Endpoint Manager.
|
||||
:::image type="content" source="media/wufbds-interaction-small.png" alt-text="Diagram displaying ":::
|
||||
|
||||
## Prerequisites
|
||||
The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
To work with the deployment service, devices must meet all these requirements:
|
||||
## Capabilities of the Windows Update for Business deployment service
|
||||
|
||||
- Be running Windows 10, version 1709 or later (or Windows 11)
|
||||
- Be joined to Azure Active Directory (AD) or Hybrid AD
|
||||
- Have one of the following Windows 10 or Windows 11 editions installed:
|
||||
- Pro
|
||||
- Enterprise
|
||||
- Education
|
||||
- Pro Education
|
||||
- Pro for Workstations
|
||||
The deployment service is designed for IT Pros who are looking for more control than is provided through deferral policies and deployment rings. The service provides the following capabilities for updates:
|
||||
|
||||
Additionally, your organization must have one of the following subscriptions:
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
- **Approval and scheduling**: Approve and schedule deployment of updates to start on a specific date
|
||||
- *Example*: Deploy the Windows 11 22H2 feature update to specified devices on February 17, 2023.
|
||||
- **Gradual rollout**: Stage deployments over a period of days or weeks by specifying gradual rollout settings
|
||||
- *Example*: Deploy the Windows 11 22H2 feature update to 500 devices per day, beginning on February 17, 2023
|
||||
- **Expedite**: Bypass the configured Windows Update for Business policies to immediately deploy a security update across the organization
|
||||
- **Safeguard holds**: Automatically holds the deployment for devices that may be impacted by an update issue identified by Microsoft machine-learning algorithms
|
||||
|
||||
## Getting started
|
||||
Certain capabilities are available for specific update classifications:
|
||||
|
||||
To use the deployment service, you use a management tool built on the platform, script common actions using PowerShell, or build your own application.
|
||||
|Capabilities | [Quality updates](deployment-service-expedited-updates.md) | [Feature updates](deployment-service-feature-updates.md) | [Drivers and firmware](deployment-service-drivers.md)|
|
||||
|---|---|---|---|
|
||||
|Approval and scheduling | | Yes | Yes |
|
||||
|Gradual rollout | | Yes | |
|
||||
|Expedite | Yes | | |
|
||||
|Safeguard holds| | Yes | |
|
||||
|
||||
### Using Microsoft Endpoint Manager
|
||||
|
||||
Microsoft Endpoint Manager integrates with the deployment service to provide Windows client update management capabilities. For more information, see [Feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates).
|
||||
|
||||
### Scripting common actions using PowerShell
|
||||
|
||||
The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started).
|
||||
|
||||
### Building your own application
|
||||
|
||||
Microsoft Graph makes deployment service APIs available through. Get started with these learning paths:
|
||||
- Learning Path: [Microsoft Graph Fundamentals](/learn/paths/m365-msgraph-fundamentals/)
|
||||
- Learning Path: [Build apps with Microsoft Graph](/learn/paths/m365-msgraph-associate/)
|
||||
|
||||
Once you are familiar with Microsoft Graph development, see [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview) for more.
|
||||
|
||||
## Deployment protections
|
||||
|
||||
The deployment service protects deployments through a combination of rollout controls and machine-learning algorithms that monitor deployments and react to issues during the rollout.
|
||||
|
||||
### Schedule rollouts with automatic piloting
|
||||
### Gradual rollout
|
||||
|
||||
The deployment service allows any update to be deployed over a period of days or weeks. Once an update has been scheduled, the deployment service optimizes the deployment based on the scheduling parameters and unique attributes spanning the devices being updated. The service follows these steps:
|
||||
|
||||
@ -107,80 +75,45 @@ The deployment service allows any update to be deployed over a period of days or
|
||||
3. Start deploying to earlier waves to build coverage of device attributes present in the population.
|
||||
4. Continue deploying at a uniform rate until all waves are complete and all devices are updated.
|
||||
|
||||
This built-in piloting capability complements your existing ring structure and provides another support for reducing and managing risk during an update. Unlike tools such as Desktop Analytics, this capability is intended to operate within each ring. The deployment service does not provide a workflow for creating rings themselves.
|
||||
|
||||
You should continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and additional protections within each ring.
|
||||
This built-in piloting capability complements your existing [deployment ring](waas-quick-start.md) structure and provides another support for reducing and managing risk during an update. This capability is intended to operate within each ring. The deployment service doesn't provide a workflow for creating rings themselves. Continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and other protections within each ring.
|
||||
|
||||
### Safeguard holds against likely and known issues
|
||||
|
||||
Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out.
|
||||
|
||||
To verify whether a device is affected by a safeguard hold, see [Am I affected by a safeguard hold?](/windows/deployment/update/safeguard-holds#am-i-affected-by-a-safeguard-hold)
|
||||
Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service also extends safeguard holds to protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out. To verify whether a device is affected by a safeguard hold, see [Am I affected by a safeguard hold?](/windows/deployment/update/safeguard-holds#am-i-affected-by-a-safeguard-hold).
|
||||
|
||||
### Monitoring deployments to detect rollback issues
|
||||
|
||||
During deployments of Windows 11 or Windows 10 feature updates, driver combinations can sometimes result in an unexpected update failure that makes the device revert to the previously installed operating system version. The deployment service can monitor devices for such issues and automatically pause deployments when this happens, giving you time to detect and mitigate issues.
|
||||
|
||||
### How to enable deployment protections
|
||||
## Get started with the deployment service
|
||||
|
||||
Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your population, devices must share diagnostic data with Microsoft.
|
||||
To use the deployment service, you use a management tool built on the platform like Microsoft Intune, script common actions using PowerShell, or build your own application.
|
||||
|
||||
#### Device prerequisites
|
||||
To learn more about the deployment service and the deployment process, see:
|
||||
|
||||
- Diagnostic data is set to *Required* or *Optional*.
|
||||
- The **AllowWUfBCloudProcessing** policy is set to **8**.
|
||||
- [Prerequisites for Windows Update for Business deployment service](deployment-service-prerequisites.md)
|
||||
- [Deploy feature updates using Graph Explorer](deployment-service-feature-updates.md)
|
||||
- [Deploy expedited updates using Graph Explorer](deployment-service-expedited-updates.md)
|
||||
- [Deploy driver and firmware updates using Graph Explorer](deployment-service-drivers.md)
|
||||
|
||||
#### Set the **AllowWUfBCloudProcessing** policy
|
||||
### Scripting common actions using PowerShell
|
||||
|
||||
To enroll devices in Windows Update for Business cloud processing, set the **AllowWUfBCloudProcessing** policy using mobile device management (MDM) policy or Group Policy.
|
||||
The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started).
|
||||
|
||||
| Policy | Sets registry key under **HKLM\\Software** |
|
||||
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
|
||||
| GPO for Windows 10, version 1809 or later: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow WUfB Cloud Processing** | \\Policies\\Microsoft\\Windows\\DataCollection\\AllowWUfBCloudProcessing |
|
||||
| MDM for Windows 10, version 1809 or later: ../Vendor/MSFT/ Policy/Config/System/**AllowWUfBCloudProcessing** | \\Microsoft\\PolicyManager\\default\\System\\AllowWUfBCloudProcessing |
|
||||
### Building your own application
|
||||
|
||||
Following is an example of setting the policy using Microsoft Endpoint Manager:
|
||||
Microsoft Graph makes deployment service APIs available through. Get started with the resources below:
|
||||
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
- Learning path: [Microsoft Graph Fundamentals](/training/paths/m365-msgraph-fundamentals/)
|
||||
- Learning path: [Build apps with Microsoft Graph](/training/paths/m365-msgraph-associate/)
|
||||
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
- Windows Update for Business deployment service [sample driver deployment application](https://github.com/microsoftgraph/windowsupdates-webapplication-sample) on GitHub
|
||||
- [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview)
|
||||
|
||||
3. Select **Windows 10 and later** in **Platform**, select **Templates** in **Profile type**, select **Custom** in **Template name**, and then select **Create**.
|
||||
### Use Microsoft Intune
|
||||
|
||||
4. In **Basics**, enter a meaningful name and a description for the policy, and then select **Next**.
|
||||
|
||||
5. In **Configuration settings**, select **Add**, enter the following settings, select **Save**, and then select **Next**.
|
||||
- Name: **AllowWUfBCloudProcessing**
|
||||
- Description: Enter a description.
|
||||
- OMA-URI: `./Vendor/MSFT/Policy/Config/System/AllowWUfBCloudProcessing`
|
||||
- Data type: **Integer**
|
||||
- Value: **8**
|
||||
|
||||
6. In **Assignments**, select the groups that will receive the profile, and then select **Next**.
|
||||
|
||||
7. In **Review + create**, review your settings, and then select **Create**.
|
||||
|
||||
8. (Optional) To verify that the policy reached the client, check the value of the following registry entry:
|
||||
|
||||
**HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager \\default\\System\\AllowWUfBCloudProcessing**
|
||||
|
||||
## Best practices
|
||||
Follow these suggestions for the best results with the service.
|
||||
|
||||
### Device onboarding
|
||||
|
||||
- Wait until devices finish provisioning before managing with the service. If a device is being provisioned by Autopilot, it can only be managed by the deployment service after it finishes provisioning (typically one day).
|
||||
|
||||
- Use the deployment service for feature update management without feature update deferral policy. If you want to use the deployment service to manage feature updates on a device that previously used a feature update deferral policy, it's best to set the feature update deferral policy to **0** days to avoid having multiple conditions governing feature updates. You should only change the feature update deferral policy value to 0 days after you've confirmed that the device was enrolled in the service with no errors.
|
||||
|
||||
### General
|
||||
|
||||
Avoid using different channels to manage the same resources. If you use Microsoft Endpoint Manager along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it.
|
||||
|
||||
|
||||
## Next steps
|
||||
|
||||
To learn more about the deployment service, try the following:
|
||||
Microsoft Intune integrates with the deployment service to provide Windows client update management capabilities. For more information, see:
|
||||
|
||||
- [Feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates)
|
||||
- [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview)
|
||||
- [Expedite Windows quality updates in Microsoft Intune](/mem/intune/protect/windows-10-expedite-updates)
|
||||
|
||||
|
||||
108
windows/deployment/update/deployment-service-prerequisites.md
Normal file
108
windows/deployment/update/deployment-service-prerequisites.md
Normal file
@ -0,0 +1,108 @@
|
||||
---
|
||||
title: Prerequisites for the Windows Update for Business deployment service
|
||||
description: Prerequisites for using the Windows Update for Business deployment service.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Windows Update for Business deployment service prerequisites
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
Before you begin the process of deploying updates with Windows Update for Business deployment service, ensure you meet the prerequisites.
|
||||
|
||||
## Azure and Azure Active Directory
|
||||
|
||||
- An Azure subscription with [Azure Active Directory](/azure/active-directory/)
|
||||
- Devices must be Azure Active Directory-joined and meet the below OSrequirements.
|
||||
- Devices can be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- Devices that are [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business
|
||||
|
||||
## Licensing
|
||||
|
||||
Windows Update for Business deployment service requires users of the devices to have one of the following licenses:
|
||||
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
|
||||
## Operating systems and editions
|
||||
|
||||
- Windows 11 Professional, Education, Enterprise, Pro Education, or Pro for Workstations editions
|
||||
- Windows 10 Professional, Education, Enterprise, Pro Education, or Pro for Workstations editions
|
||||
|
||||
Windows Update for Business deployment service supports Windows client devices on the **General Availability Channel**.
|
||||
|
||||
### Windows operating system updates
|
||||
|
||||
- Expediting updates requires the *Update Health Tools* on the clients. The tools are installed starting with [KB 4023057](https://support.microsoft.com/topic/kb4023057-update-for-windows-10-update-service-components-fccad0ca-dc10-2e46-9ed1-7e392450fb3a). To confirm the presence of the Update Health Tools on a device:
|
||||
- Look for the folder **C:\Program Files\Microsoft Update Health Tools** or review *Add Remove Programs* for **Microsoft Update Health Tools**.
|
||||
- As an Admin, run the following PowerShell script: `Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Update Health Tools"}`
|
||||
|
||||
- For [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), installing the January 2023 release preview cumulative update, or a later equivalent update, is recommended
|
||||
|
||||
## Diagnostic data requirements
|
||||
|
||||
Deployment scheduling controls are always available. However, to take advantage of the unique deployment protections tailored to your population and to [deploy driver updates](deployment-service-drivers.md), devices must share diagnostic data with Microsoft. For these features, at minimum, the deployment service requires devices to send [diagnostic data](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-settings) at the *Required* level (previously called *Basic*) for these features.
|
||||
|
||||
When you use [Windows Update for Business reports](wufb-reports-overview.md) in conjunction with the deployment service, using diagnostic data at the following levels allows device names to appear in reporting:
|
||||
|
||||
- *Optional* level (previously *Full*) for Windows 11 devices
|
||||
- *Enhanced* level for Windows 10 devices
|
||||
|
||||
## Permissions
|
||||
|
||||
- [Windows Update for Business deployment service](/graph/api/resources/adminwindowsupdates) operations require [WindowsUpdates.ReadWrite.All](/graph/permissions-reference#windows-updates-permissions)
|
||||
- Some roles, such as the [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator), already have the permissions.
|
||||
|
||||
> [!NOTE]
|
||||
> Leveraging other parts of the Graph API might require additional permissions. For example, to display [device](/graph/api/resources/device) information, a minimum of [Device.Read.All](/graph/permissions-reference#device-permissions) permission is needed.
|
||||
|
||||
## Required endpoints
|
||||
|
||||
- Have access to the following endpoints:
|
||||
|
||||
- [Windows Update endpoints](/windows/privacy/manage-windows-1809-endpoints#windows-update)
|
||||
- *.prod.do.dsp.mp.microsoft.com
|
||||
- *.windowsupdate.com
|
||||
- *.dl.delivery.mp.microsoft.com
|
||||
- *.update.microsoft.com
|
||||
- *.delivery.mp.microsoft.com
|
||||
- tsfe.trafficshaping.dsp.mp.microsoft.com
|
||||
- Windows Update for Business deployment service endpoints
|
||||
|
||||
- devicelistenerprod.microsoft.com
|
||||
- login.windows.net
|
||||
- payloadprod*.blob.core.windows.net
|
||||
|
||||
- [Windows Push Notification Services](/windows/uwp/design/shell/tiles-and-notifications/firewall-allowlist-config): *(Recommended, but not required. Without this access, devices might not expedite updates until their next daily check for updates.)*
|
||||
- *.notify.windows.com
|
||||
|
||||
|
||||
## Limitations
|
||||
|
||||
<!--Using include for deployment service limitations-->
|
||||
[!INCLUDE [Windows Update for Business deployment service limitations](./includes/wufb-deployment-limitations.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
|
||||
|
||||
## General tips for the deployment service
|
||||
|
||||
Follow these suggestions for the best results with the service:
|
||||
|
||||
- Wait until devices finish provisioning before managing with the service. If a device is being provisioned by Autopilot, it can only be managed by the deployment service after it finishes provisioning (typically one day).
|
||||
|
||||
- Use the deployment service for feature update management without feature update deferral policy. If you want to use the deployment service to manage feature updates on a device that previously used a feature update deferral policy, it's best to set the feature update deferral policy to **0** days to avoid having multiple conditions governing feature updates. You should only change the feature update deferral policy value to 0 days after you've confirmed that the device was enrolled in the service with no errors.
|
||||
|
||||
- Avoid using different channels to manage the same resources. If you use Microsoft Intune along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it.
|
||||
@ -1,27 +1,23 @@
|
||||
---
|
||||
title: Troubleshoot the Windows Update for Business deployment service
|
||||
description: Solutions to common problems with the service
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
|
||||
|
||||
# Troubleshoot the Windows Update for Business deployment service
|
||||
|
||||
**Applies to**
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](windows-update-troubleshooting.md).
|
||||
This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](/troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json).
|
||||
|
||||
## The device isn't receiving an update that I deployed
|
||||
|
||||
@ -30,9 +26,36 @@ This troubleshooting guide addresses the most common issues that IT administrato
|
||||
- Check that the deployment to which the device is assigned has the state *offering*. Deployments that have the states *paused* or *scheduled* won't deploy content to devices.
|
||||
- Check that the device has scanned for updates and is scanning the Windows Update service. To learn more about scanning for updates, see [Scanning updates](how-windows-update-works.md#scanning-updates).
|
||||
- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is successfully enrolled will be represented by an Azure AD device resource with an update management enrollment for feature updates and have no Azure AD device registration errors.
|
||||
- **Expedited quality updates only**: Check that the device has the Update Health Tools installed (available for Windows 10 version 1809 or later in the update described in [KB 4023057 - Update for Windows 10 Update Service components](https://support.microsoft.com/topic/kb4023057-update-for-windows-10-update-service-components-fccad0ca-dc10-2e46-9ed1-7e392450fb3a), or a more recent quality update). The Update Health Tools are required for a device to receive an expedited quality update. On a device, the program can be located at **C:\\Program Files\\Microsoft Update Health Tools**. You can verify its presence by reviewing **Add or Remove Programs** or using the following PowerShell script: `Get-WmiObject -Class Win32\_Product \| Where-Object {$\_.Name -amatch "Microsoft Update Health Tools"}`.
|
||||
- **Expedited quality updates only**: Check that the device has the Update Health Tools installed (available for Windows 10 version 1809 or later in the update described in [KB 4023057 - Update for Windows 10 Update Service components](https://support.microsoft.com/topic/kb4023057-update-for-windows-10-update-service-components-fccad0ca-dc10-2e46-9ed1-7e392450fb3a), or a more recent quality update). The Update Health Tools are required for a device to receive an expedited quality update. On a device, the program can be located at **C:\\Program Files\\Microsoft Update Health Tools**. You can verify its presence by reviewing **Add or Remove Programs** or using the following PowerShell script: `Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Update Health Tools"}`.
|
||||
|
||||
## The device is receiving an update that I didn't deploy
|
||||
|
||||
- Check that the device is scanning the Windows Update service and not a different endpoint. If the device is scanning for updates from a WSUS endpoint, for example, it might receive different updates. To learn more about scanning for updates, see [Scanning updates](how-windows-update-works.md#scanning-updates).
|
||||
- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is not successfully enrolled might receive different updates according to its feature update deferral period, for example. A device that is successfully enrolled will be represented by an Azure AD device resource with an update management enrollment for feature updates and have no Azure AD device registration errors.
|
||||
|
||||
### The device installed a newer update then the expedited update I deployed
|
||||
|
||||
There are some scenarios when a deployment to expedite an update results in the installation of a more recent update than specified in policy. This result occurs when the newer update includes and surpasses the specified update, and that newer update is available before a device checks in to install the update that's specified in the expedite update policy.
|
||||
|
||||
Installing the most recent quality update reduces disruptions to the device and user while applying the benefits of the intended update. This avoids having to install multiple updates, which each might require separate reboots.
|
||||
|
||||
A more recent update is deployed when the following conditions are met:
|
||||
|
||||
- The device isn't targeted with a deferral policy that blocks installation of a more recent update. In this case, the most recently available update that isn't deferred is the update that might install.
|
||||
|
||||
- During the process to expedite an update, the device runs a new scan that detects the newer update. This can occur due to the timing of:
|
||||
- When the device restarts to complete installation
|
||||
- When the device runs its daily scan
|
||||
- When a new update becomes available
|
||||
|
||||
When a scan identifies a newer update, Windows Update attempts to stop installation of the original update, cancel the restart, and then starts the download and installation of the more recent update.
|
||||
|
||||
While expedite update deployments will override an update deferral for the update version that's specified, they don't override deferrals that are in place for any other update version.
|
||||
|
||||
<!--Using include for Update Health Tools log location-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
|
||||
@ -1,16 +1,14 @@
|
||||
---
|
||||
title: Evaluate infrastructure and tools
|
||||
manager: laurawi
|
||||
description: Steps to make sure your infrastructure is ready to deploy updates
|
||||
keywords: updates, servicing, current, deployment, General Availability Channel, feature, quality, rings, insider, tools
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.audience: itpro
|
||||
ms.topic: article
|
||||
ms.collection: m365initiative-coredeploy
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Evaluate infrastructure and tools
|
||||
@ -47,7 +45,7 @@ Keep security baselines current to help ensure that your environment is secure a
|
||||
|
||||
There are a number of Windows policies (set by Group Policy, Intune, or other methods) that affect when Windows updates are installed, deferral, end-user experience, and many other aspects. Check these policies to make sure they are set appropriately.
|
||||
|
||||
- **Windows Administrative templates**: Each Windows client feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 10, version 1909](https://www.microsoft.com/download/100591).
|
||||
- **Windows Administrative templates**: Each Windows client feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 11, version 22H2](https://www.microsoft.com/download/details.aspx?id=104593).
|
||||
- **Policies for update compliance and end-user experience**: A number of settings affect when a device installs updates, whether and for how long a user can defer an update, restart behavior after installation, and many other aspects of update behavior. It's especially important to look for existing policies that are out of date or could conflict with new ones.
|
||||
|
||||
|
||||
|
||||
@ -1,18 +1,14 @@
|
||||
---
|
||||
title: Best practices - deploy feature updates for user-initiated installations
|
||||
title: Best practices - deploy feature updates for user-initiated installations
|
||||
description: Learn recommendations and best practices for manually deploying a feature update for a user-initiated installation.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.author: mstewart
|
||||
ms.date: 07/10/2018
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
ms.collection: M365-modern-desktop
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.technology: itpro-updates
|
||||
---
|
||||
|
||||
# Deploy feature updates for user-initiated installations (during a fixed service window)
|
||||
@ -239,4 +235,4 @@ After you deploy the feature update(s), you can monitor the deployment status. U
|
||||
|
||||
1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**.
|
||||
2. Click the software update group or software update for which you want to monitor the deployment status.
|
||||
3. On the **Home** tab, in the **Deployment** group, click **View Status**.
|
||||
3. On the **Home** tab, in the **Deployment** group, click **View Status**.
|
||||
|
||||
@ -1,18 +1,14 @@
|
||||
---
|
||||
title: Make FoD and language packs available for WSUS/Configuration Manager
|
||||
description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: article
|
||||
ms.author: jaimeo
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 03/13/2019
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.technology: itpro-updates
|
||||
---
|
||||
# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager
|
||||
|
||||
|
||||
@ -1,15 +1,14 @@
|
||||
---
|
||||
title: Windows client updates, channels, and tools
|
||||
description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them
|
||||
keywords: updates, servicing, current, deployment, General Availability Channel, General Availability Channel, feature, quality, rings, insider, tools
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
manager: dougeby
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.collection: highpri
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Windows client updates, channels, and tools
|
||||
@ -46,7 +45,7 @@ We include information here about many different update types you'll hear about,
|
||||
|
||||
There are three servicing channels, each of which offers you a different level of flexibility with how and when updates are delivered to devices. Using the different servicing channels allows you to deploy Windows "as a service," which conceives of deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process.
|
||||
|
||||
The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel with any of several tools, including Microsoft Endpoint Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means. By dividing devices into different populations ("deployment groups" or "rings") you can use servicing channel assignment, followed by other management features such as update deferral policies, to create a phased deployment of any update that allows you to start with a limited pilot deployment for testing before moving to a broad deployment throughout your organization.
|
||||
The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel with any of several tools, including Microsoft Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means. By dividing devices into different populations ("deployment groups" or "rings") you can use servicing channel assignment, followed by other management features such as update deferral policies, to create a phased deployment of any update that allows you to start with a limited pilot deployment for testing before moving to a broad deployment throughout your organization.
|
||||
|
||||
|
||||
### General Availability Channel
|
||||
@ -105,4 +104,4 @@ Your individual devices connect to Microsoft endpoints directly to get the updat
|
||||
|
||||
### Hybrid scenarios
|
||||
|
||||
It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery.
|
||||
It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery.
|
||||
|
||||
@ -1,19 +1,14 @@
|
||||
---
|
||||
title: How Windows Update works
|
||||
title: How Windows Update works
|
||||
description: In this article, learn about the process Windows Update uses to download and install updates on a Windows client devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl:
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
manager: dougeby
|
||||
ms.collection:
|
||||
- M365-modern-desktop
|
||||
- highpri
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.custom: seo-marvel-apr2020
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# How Windows Update works
|
||||
@ -91,6 +86,18 @@ When users start scanning in Windows Update through the Settings panel, the foll
|
||||
- Windows Update uses the thread ID filtering to concentrate on one particular task.
|
||||
|
||||
|
||||
|
||||
#### Proxy Behavior
|
||||
For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP]: SimpleAuth Web Service | Microsoft Docs, [MS-WUSP]: Client Web Service | Microsoft Docs):
|
||||
- System proxy is attempted (set using the `netsh` command).
|
||||
- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then user proxy is attempted (generally it is the logged-in user).
|
||||
|
||||
> [!Note]
|
||||
> For intranet WSUS update service URLs, we provide an option via Windows Update policy to select the proxy behavior.
|
||||
|
||||
For Windows Update URLs that _aren't_ used for update detection, such as for download or reporting:
|
||||
- User proxy is attempted.
|
||||
- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then the system proxy is attempted.
|
||||
|
||||
#### Identifies service IDs
|
||||
|
||||
@ -105,7 +112,7 @@ When users start scanning in Windows Update through the Settings panel, the foll
|
||||
|
||||
|Service|ServiceId|
|
||||
|-------|---------|
|
||||
|Unspecified / Default|WU, MU, or WSUS <br>00000000-0000-0000-0000-000000000000 |
|
||||
|Unspecified / Default|Windows Update, Microsoft Update, or WSUS <br>00000000-0000-0000-0000-000000000000 |
|
||||
|Windows Update|9482F4B4-E343-43B6-B170-9A65BC822C77|
|
||||
|Microsoft Update|7971f918-a847-4430-9279-4a52d1efe18d|
|
||||
|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289|
|
||||
@ -133,7 +140,7 @@ Once the Windows Update Orchestrator determines which updates apply to your comp
|
||||
|
||||
To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption.
|
||||
|
||||
For more information, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md).
|
||||
For more information, see [Configure Delivery Optimization for Windows 10 updates](../do/waas-delivery-optimization.md).
|
||||
|
||||
## Installing updates
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 85 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 420 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 451 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 357 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 245 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 56 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.0 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 75 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 927 B |
Binary file not shown.
|
Before Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 5.0 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 57 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 253 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 43 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 105 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 94 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 79 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 77 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 148 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 67 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 72 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 408 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 76 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 337 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 166 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 82 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 87 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.5 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 61 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 57 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 114 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 76 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 68 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 73 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 162 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 145 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 104 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 118 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 63 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 304 B |
Binary file not shown.
|
Before Width: | Height: | Size: 448 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 877 B |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 6.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 140 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 70 KiB |
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user