mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 15:53:40 +00:00
Merge pull request #8804 from mestew/stnd-meta2
Putting lipstick on a pig 🐖- metadata, formatting, and wording tweaks
This commit is contained in:
Meghan Stewart
GitHub
@ -2,20 +2,23 @@
|
||||
title: Windows Updates using forward and reverse differentials
|
||||
description: A technique to produce compact software updates optimized for any origin and destination revision pair
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: reference
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 08/21/2021
|
||||
---
|
||||
|
||||
# Windows Updates using forward and reverse differentials
|
||||
|
||||
Windows 10 monthly quality updates are cumulative, containing all previously
|
||||
Windows monthly quality updates are cumulative, containing all previously
|
||||
released fixes to ensure consistency and simplicity. For an operating system
|
||||
platform like Windows 10, which stays in support for multiple years, the size of
|
||||
platform like Windows, which stays in support for multiple years, the size of
|
||||
monthly quality updates can quickly grow large, thus directly impacting network
|
||||
bandwidth consumption.
|
||||
|
||||
@ -23,8 +26,8 @@ Today, this problem is addressed by using express downloads, where differential
|
||||
downloads for every changed file in the update are generated based on selected
|
||||
historical revisions plus the base version. In this paper, we introduce a new
|
||||
technique to build compact software update packages that are applicable to any
|
||||
revision of the base version, and then describe how Windows 10 quality updates
|
||||
uses this technique.
|
||||
revision of the base version, and then describe how Windows quality updates
|
||||
use this technique.
|
||||
|
||||
## General Terms
|
||||
|
||||
@ -65,45 +68,44 @@ numerous advantages:
|
||||
- Efficient to install
|
||||
- Redistributable
|
||||
|
||||
Historically, download sizes of Windows 10 quality updates (Windows 10, version 1803 and older supported versions of Windows 10) are optimized by using express download. Express download is optimized such that updating Windows 10 systems will download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version.
|
||||
Historically, download sizes of Windows quality updates (Windows 10, version 1803 and older supported versions of Windows 10) were optimized by using express download. Express download is optimized such that updating Windows systems download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version.
|
||||
|
||||
For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints.
|
||||
For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as express download files) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device applying express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints.
|
||||
|
||||
The flip side of express download is that the size of PSF files can be very large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they are unable to leverage express updates to keep their fleet of devices running Windows 10 up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it is only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly.
|
||||
The flip side of express download is that the size of PSF files can be large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they're unable to use express updates to keep their fleet of devices running Windows up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it's only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly.
|
||||
|
||||
In the following sections, we describe how Windows 10 quality updates will leverage this technique based on forward and reverse differentials for newer releases of Windows 10 and Windows Server to overcome the challenges with express downloads.
|
||||
In the following sections, we describe how quality updates use this technique based on forward and reverse differentials for newer releases of Windows and Windows Server to overcome the challenges with express downloads.
|
||||
|
||||
## High-level Design
|
||||
|
||||
### Update packaging
|
||||
|
||||
Windows 10 quality update packages will contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices will have an identical payload. Update package metadata, content manifests, and forward and reverse differentials will be packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format.
|
||||
Windows quality update packages contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices have an identical payload. Update package metadata, content manifests, and forward and reverse differentials are packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format.
|
||||
|
||||
There can be cases where new files are added to the system during servicing. These files will not have RTM baselines, thus forward and reverse differentials cannot be used. In these scenarios, null differentials will be used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows 10 quality update installer:
|
||||
There can be cases where new files are added to the system during servicing. These files won't have RTM baselines, thus forward and reverse differentials can't be used. In these scenarios, null differentials are used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows quality update installer:
|
||||
|
||||
|
||||
|
||||
### Hydration and installation
|
||||
|
||||
Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure will hydrate the full files during pre-installation and then proceed with the usual installation process.
|
||||
Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure hydrates the full files during preinstallation and then proceeds with the usual installation process.
|
||||
|
||||
Below is a high-level sequence of activities that the component servicing infrastructure will run in a transaction to complete installation of the update:
|
||||
Below is a high-level sequence of activities that the component servicing infrastructure runs in a transaction to complete installation of the update:
|
||||
|
||||
- Identify all files that are required to install the update.
|
||||
- Hydrate each of necessary files using current version (V<sub>N</sub>) of the file, reverse differential (V<sub>N</sub>--->RTM) of the file back to quality update RTM/base version and forward differential (V<sub>RTM</sub>--->R) from feature update RTM/base version to the target version. Also, use null differential hydration to hydrate null compressed files.
|
||||
- Stage the hydrated files (full file), forward differentials (under ‘f’ folder) and reverse differentials (under ‘r’ folder) or null compressed files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder).
|
||||
- Stage the hydrated files (full file), forward differentials (under `f` folder) and reverse differentials (under `r` folder) or null compressed files (under `n` folder) in the component store (%windir%\\WinSxS folder).
|
||||
- Resolve any dependencies and install components.
|
||||
- Clean up older state (V<sub>N-1</sub>); the previous state V<sub>N</sub> is retained for uninstallation and restoration or repair.
|
||||
|
||||
### **Resilient Hydration**
|
||||
|
||||
To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (“automatic corruption repair”) or on demand (“manual corruption repair”) using an online or local repair source. This service will continue to offer the ability to repair and recover content for
|
||||
hydration and successfully install an update, if needed.
|
||||
To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (automatic corruption repair) or on demand (manual corruption repair) using an online or local repair source. This service will continue to offer the ability to repair and recover content for hydration and successfully install an update, if needed.
|
||||
|
||||
When corruption is detected during update operations, automatic corruption repair will start as usual and use the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files will contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified.
|
||||
When corruption is detected during update operations, automatic corruption repair starts as usual and uses the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified.
|
||||
|
||||
Corruption repair will use the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine will be set. When automatic corruption repair runs, it will scan hydrated files using the manifest and differential files using the flags. If the differential cannot be found or verified, it will be added to the list of corruptions to repair.
|
||||
Corruption repair uses the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine are set. When automatic corruption repair runs, it scans hydrated files using the manifest and differential files using the flags. If the differential can't be found or verified, it's added to the list of corruptions to repair.
|
||||
|
||||
### Lazy automatic corruption repair
|
||||
|
||||
“Lazy automatic corruption repair” runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt.
|
||||
"Lazy automatic corruption repair" runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt.
|
||||
|
||||
@ -1,23 +1,21 @@
|
||||
---
|
||||
title: Evaluate infrastructure and tools
|
||||
description: Steps to make sure your infrastructure is ready to deploy updates
|
||||
description: Review the steps to ensure your infrastructure is ready to deploy updates to clients in your organization.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: article
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Evaluate infrastructure and tools
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness.
|
||||
|
||||
## Infrastructure
|
||||
|
||||
@ -1,20 +1,21 @@
|
||||
---
|
||||
title: Best practices - deploy feature updates for user-initiated installations
|
||||
title: Best practices - user-initiated feature update installation
|
||||
description: Learn recommendations and best practices for manually deploying a feature update for a user-initiated installation.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
ms.date: 07/10/2018
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: best-practice
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/mem/configmgr/ > Microsoft Configuration Manager</a>
|
||||
ms.date: 07/10/2018
|
||||
---
|
||||
|
||||
# Deploy feature updates for user-initiated installations (during a fixed service window)
|
||||
|
||||
**Applies to**: Windows 10
|
||||
|
||||
Use the following steps to deploy a feature update for a user-initiated installation.
|
||||
|
||||
## Get ready to deploy feature updates
|
||||
@ -22,7 +23,7 @@ Use the following steps to deploy a feature update for a user-initiated installa
|
||||
### Step 1: Enable Peer Cache
|
||||
Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache.
|
||||
|
||||
[Enable Configuration Manager client in full OS to share content](/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update).
|
||||
[Enable Configuration Manager client in full OS to share content](/mem/configmgr/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update).
|
||||
|
||||
### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later)
|
||||
|
||||
@ -35,7 +36,7 @@ If you're deploying **Feature update to Windows 10, version 1709** or later, by
|
||||
Priority=Normal
|
||||
```
|
||||
|
||||
You can use the new [Run Scripts](/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices.
|
||||
You can use the new [Run Scripts](/mem/configmgr/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices.
|
||||
|
||||
```
|
||||
#Parameters
|
||||
@ -80,7 +81,7 @@ or documentation, even if Microsoft has been advised of the possibility of such
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>If you elect not to override the default setup priority, you will need to increase the [maximum run time](/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value.
|
||||
> If you elect not to override the default setup priority, you will need to increase the [maximum run time](/mem/configmgr/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value.
|
||||
|
||||
## Manually deploy feature updates in a user-initiated installation
|
||||
|
||||
@ -89,77 +90,73 @@ The following sections provide the steps to manually deploy a feature update.
|
||||
### Step 1: Specify search criteria for feature updates
|
||||
There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying a feature update is to identify the feature updates that you want to deploy.
|
||||
|
||||
1. In the Configuration Manager console, click **Software Library**.
|
||||
2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed.
|
||||
1. In the Configuration Manager console, select **Software Library**.
|
||||
2. In the Software Library workspace, expand **Windows 10 Servicing**, and select **All Windows 10 Updates**. The synchronized feature updates are displayed.
|
||||
3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps:
|
||||
- In the **search** text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update.
|
||||
- Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, **Required** is greater than or equal to 1, and **Language** equals English.
|
||||
- In the **search** text box, type a search string that filters for the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update.
|
||||
- Select **Add Criteria**, select the criteria that you want to use to filter software updates, select **Add**, and then provide the values for the criteria. For example, Title contains 1803, **Required** is greater than or equal to 1, and **Language** equals English.
|
||||
|
||||
4. Save the search for future use.
|
||||
|
||||
### Step 2: Download the content for the feature update(s)
|
||||
Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment.
|
||||
Before you deploy the feature updates, you can download the content as a separate step. Do this download so you can verify that the content is available on the distribution points before you deploy the feature updates. Downloading first helps you avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment.
|
||||
|
||||
1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**.
|
||||
2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Download**.
|
||||
2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right-click, and select **Download**.
|
||||
|
||||
The **Download Software Updates Wizard** opens.
|
||||
3. On the **Deployment Package** page, configure the following settings:
|
||||
**Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings:
|
||||
- **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters.
|
||||
- **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It's limited to 50 characters.
|
||||
- **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters.
|
||||
- **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page.
|
||||
- **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or select **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page.
|
||||
|
||||
>[!NOTE]
|
||||
>The deployment package source location that you specify cannot be used by another software deployment package.
|
||||
> [!IMPORTANT]
|
||||
> - The deployment package source location that you specify cannot be used by another software deployment package.
|
||||
> - The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files.
|
||||
> - You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location.
|
||||
|
||||
Click **Next**.
|
||||
4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs).
|
||||
Select **Next**.
|
||||
4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then select **Next**. For more information about distribution points, see [Distribution point configurations](/mem/configmgr/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs).
|
||||
|
||||
>[!NOTE]
|
||||
>The Distribution Points page is available only when you create a new software update deployment package.
|
||||
> The Distribution Points page is available only when you create a new software update deployment package.
|
||||
5. On the **Distribution Settings** page, specify the following settings:
|
||||
|
||||
- **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: **High**, **Medium**, or **Low**. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority.
|
||||
- **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
|
||||
- **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: **High**, **Medium**, or **Low**. Packages with identical priorities are sent in the order in which they were created. If there's no backlog, the package processes immediately regardless of its priority. By default, packages are sent using Medium priority.
|
||||
- **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content isn't available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/mem/configmgr/core/plan-design/hierarchy/content-source-location-scenarios).
|
||||
- **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options:
|
||||
- **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point.
|
||||
- **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point.
|
||||
- **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting.
|
||||
- **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This setting is the default.
|
||||
|
||||
For more information about prestaging content to distribution points, see [Use Prestaged content](/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage).
|
||||
Click **Next**.
|
||||
For more information about prestaging content to distribution points, see [Use Prestaged content](/mem/configmgr/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage).
|
||||
Select **Next**.
|
||||
6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options:
|
||||
|
||||
- **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting.
|
||||
- **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access.
|
||||
- **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard doesn't have Internet access.
|
||||
|
||||
>[!NOTE]
|
||||
>When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard.
|
||||
> When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard.
|
||||
|
||||
Click **Next**.
|
||||
7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page.
|
||||
8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates.
|
||||
9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click **Close**.
|
||||
Select **Next**.
|
||||
7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then select **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page.
|
||||
8. On the **Summary** page, verify the settings that you selected in the wizard, and then select **Next** to download the software updates.
|
||||
9. On the **Completion** page, verify that the software updates were successfully downloaded, and then select **Close**.
|
||||
|
||||
#### To monitor content status
|
||||
1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console.
|
||||
2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**.
|
||||
1. To monitor the content status for the feature updates, select **Monitoring** in the Configuration Manager console.
|
||||
2. In the Monitoring workspace, expand **Distribution Status**, and then select **Content Status**.
|
||||
3. Select the feature update package that you previously identified to download the feature updates.
|
||||
4. On the **Home** tab, in the Content group, click **View Status**.
|
||||
4. On the **Home** tab, in the Content group, select **View Status**.
|
||||
|
||||
### Step 3: Deploy the feature update(s)
|
||||
After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s).
|
||||
|
||||
1. In the Configuration Manager console, click **Software Library**.
|
||||
2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**.
|
||||
3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**.
|
||||
1. In the Configuration Manager console, select **Software Library**.
|
||||
2. In the Software Library workspace, expand **Windows 10 Servicing**, and select **All Windows 10 Updates**.
|
||||
3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right select, and select **Deploy**.
|
||||
|
||||
The **Deploy Software Updates Wizard** opens.
|
||||
4. On the General page, configure the following settings:
|
||||
@ -178,7 +175,7 @@ After you determine which feature updates you intend to deploy, you can manually
|
||||
>[!NOTE]
|
||||
>A software update group deployed as **Required** will be downloaded in background and honor BITS settings, if configured.
|
||||
|
||||
- **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when **Type of deployment** is set to **Required**.
|
||||
- **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that don't require any software updates in the deployment aren't started. By default, this setting isn't enabled and is available only when **Type of deployment** is set to **Required**.
|
||||
|
||||
>[!WARNING]
|
||||
>Before you can use this option, computers and networks must be configured for Wake On LAN.
|
||||
@ -189,7 +186,7 @@ After you determine which feature updates you intend to deploy, you can manually
|
||||
- **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console.
|
||||
|
||||
- **Software available time**: Select **Specific time** to specify when the software updates will be available to clients:
|
||||
- **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment is not available for installation until after the specified date and time are reached and the required content has been downloaded.
|
||||
- **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment isn't available for installation until after the specified date and time are reached and the required content has been downloaded.
|
||||
|
||||
- **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment.
|
||||
|
||||
@ -198,7 +195,7 @@ After you determine which feature updates you intend to deploy, you can manually
|
||||
|
||||
- **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. However, for the purposes of the fixed servicing window, set the installation deadline date and time to a future value, well beyond the fixed servicing window.
|
||||
|
||||
Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients will start downloading the content based on a randomized time. The feature update will not be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation will start immediately when initiated.
|
||||
Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients start downloading the content based on a randomized time. The feature update won't be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation starts immediately when initiated.
|
||||
|
||||
7. On the User Experience page, configure the following settings:
|
||||
- **User notifications**: Specify **Display in Software Center and show all notifications**.
|
||||
@ -214,25 +211,25 @@ After you determine which feature updates you intend to deploy, you can manually
|
||||
>[!NOTE]
|
||||
>When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window.
|
||||
- **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window.
|
||||
8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page.
|
||||
8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page.
|
||||
|
||||
>[!NOTE]
|
||||
>You can review recent software updates alerts from the **Software Updates** node in the **Software Library** workspace.
|
||||
9. On the Download Settings page, configure the following settings:
|
||||
- Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location.
|
||||
- Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point.
|
||||
- **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache).
|
||||
- **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content.
|
||||
- Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates isn't available on a preferred distribution point.
|
||||
- **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache).
|
||||
- **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates aren't available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content.
|
||||
- Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection.
|
||||
|
||||
>[!NOTE]
|
||||
>Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
|
||||
10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting.
|
||||
11. Click **Next** to deploy the feature update(s).
|
||||
>Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](/mem/configmgr/core/plan-design/hierarchy/content-source-location-scenarios).
|
||||
10. On the Summary page, review the settings. To save the settings to a deployment template, select **Save As Template**, enter a name and select the settings that you want to include in the template, and then select **Save**. To change a configured setting, select the associated wizard page and change the setting.
|
||||
11. Select **Next** to deploy the feature update(s).
|
||||
|
||||
### Step 4: Monitor the deployment status
|
||||
After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status:
|
||||
|
||||
1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**.
|
||||
2. Click the software update group or software update for which you want to monitor the deployment status.
|
||||
3. On the **Home** tab, in the **Deployment** group, click **View Status**.
|
||||
2. Select the software update group or software update for which you want to monitor the deployment status.
|
||||
3. On the **Home** tab, in the **Deployment** group, select **View Status**.
|
||||
|
||||
@ -1,21 +1,26 @@
|
||||
---
|
||||
title: Make FoD and language packs available for WSUS/Configuration Manager
|
||||
description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager.
|
||||
title: FoD and language packs for WSUS and Configuration Manager
|
||||
description: Learn how to make FoD and language packs available to clients when you're using WSUS or Configuration Manager.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 03/13/2019
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/mem/configmgr/ > Microsoft Configuration Manager</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus > WSUS </a>
|
||||
ms.date: 03/13/2019
|
||||
---
|
||||
|
||||
# How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager
|
||||
|
||||
**Applies to**
|
||||
This article describes how to make Features on Demand and language packs available when you're using WSUS or Configuration Manager for specific versions of Windows.
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
## Version information for Features on Demand and language packs
|
||||
|
||||
In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features.
|
||||
|
||||
@ -23,10 +28,15 @@ As of Windows 10 version 1709, you can't use Windows Server Update Services (WSU
|
||||
|
||||
The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions.
|
||||
|
||||
In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired.
|
||||
In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired.
|
||||
|
||||
In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location.
|
||||
|
||||
For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location.
|
||||
For all OS versions, changing the **Specify settings for optional component installation and component repair** policy doesn't affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location.
|
||||
|
||||
Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/).
|
||||
|
||||
## More resources
|
||||
|
||||
- [WSUS documentation](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus)
|
||||
- [Configuration Manager documentation](/mem/configmgr/)
|
||||
|
||||
@ -1,23 +1,22 @@
|
||||
---
|
||||
title: Windows client updates, channels, and tools
|
||||
description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them
|
||||
description: Brief summary of the kinds of Windows updates, the channels they're served through, and the tools for managing them
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Windows client updates, channels, and tools
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This article provides a brief summary of the kinds of Windows updates, the channels they're served through, and the tools for managing them.
|
||||
## How Windows updates work
|
||||
|
||||
There are four phases to the Windows update process:
|
||||
@ -26,18 +25,18 @@ There are four phases to the Windows update process:
|
||||
administrator. This process is invisible to the user.
|
||||
- **Download:** Once the device determines that an update is available, it begins downloading the update. The download process is also invisible to the user. With feature updates, download happens in multiple
|
||||
sequential phases.
|
||||
- **Install:** After the update is downloaded, depending on the device’s Windows Update settings, the update is installed on the system.
|
||||
- **Install:** After the update is downloaded, depending on the device's Windows Update settings, the update is installed on the system.
|
||||
- **Commit and restart:** Once installed, the device usually (but not always) must be restarted in order to complete the installation and begin using the update. Before that happens, a device is still running the previous
|
||||
version of the software.
|
||||
|
||||
## Types of updates
|
||||
|
||||
We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
|
||||
We include information here about many different update types you hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
|
||||
|
||||
- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
|
||||
- **Quality updates:** Quality updates deliver both security and non-security fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
|
||||
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
|
||||
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
|
||||
- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they're delivered frequently (rather than every 3-5 years), they're easier to manage.
|
||||
- **Quality updates:** Quality updates deliver both security and nonsecurity fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They're typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
|
||||
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates aren't necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically doesn't have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
|
||||
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they're installed or not.
|
||||
- **Microsoft product updates:** These update other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools.
|
||||
|
||||
|
||||
@ -50,13 +49,14 @@ The first step of controlling when and how devices install updates is assigning
|
||||
|
||||
### General Availability Channel
|
||||
|
||||
In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
|
||||
In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel installs a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
|
||||
|
||||
|
||||
### Windows Insider Program for Business
|
||||
|
||||
Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel:
|
||||
Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are options within the Windows Insider Program for Business channel:
|
||||
|
||||
- Windows Insider Canary
|
||||
- Windows Insider Dev
|
||||
- Windows Insider Beta
|
||||
- Windows Insider Release Preview
|
||||
@ -73,12 +73,12 @@ The General Availability Channel is the default servicing channel for all Window
|
||||
|
||||
| Edition | General Availability Channel | Insider Program | Long-Term Servicing Channel |
|
||||
| --- | --- | --- | --- |
|
||||
| Home | | | |
|
||||
| Pro |  |  | |
|
||||
| Enterprise |  | | |
|
||||
| Enterprise LTSC |  | | |
|
||||
| Pro Education |  |  | |
|
||||
| Education |  |  | |
|
||||
| Home | Yes|No | No|
|
||||
| Pro | Yes | Yes | No|
|
||||
| Enterprise | Yes |Yes | No|
|
||||
| Enterprise LTSC | No |No | Yes|
|
||||
| Pro Education | Yes | Yes | No|
|
||||
| Education | Yes | Yes | No|
|
||||
|
||||
## Servicing tools
|
||||
|
||||
@ -104,4 +104,4 @@ Your individual devices connect to Microsoft endpoints directly to get the updat
|
||||
|
||||
### Hybrid scenarios
|
||||
|
||||
It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery.
|
||||
It's also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery.
|
||||
|
||||
@ -1,47 +1,38 @@
|
||||
---
|
||||
title: How Windows Update works
|
||||
description: In this article, learn about the process Windows Update uses to download and install updates on a Windows client devices.
|
||||
description: In this article, learn about the process Windows Update uses to download and install updates on Windows client devices.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# How Windows Update works
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
The Windows Update workflow has four core areas of functionality:
|
||||
|
||||
### Scan
|
||||
|
||||
1. Orchestrator schedules the scan.
|
||||
2. Orchestrator verifies admin approvals and policies for download.
|
||||
|
||||
|
||||
### Download
|
||||
1. Orchestrator starts downloads.
|
||||
2. Windows Update downloads manifest files and provides them to the arbiter.
|
||||
3. The arbiter evaluates the manifest and tells the Windows Update client to download files.
|
||||
4. Windows Update client downloads files in a temporary folder.
|
||||
5. The arbiter stages the downloaded files.
|
||||
|
||||
|
||||
### Install
|
||||
1. Orchestrator starts the installation.
|
||||
2. The arbiter calls the installer to install the package.
|
||||
|
||||
|
||||
### Commit
|
||||
1. Orchestrator starts a restart.
|
||||
2. The arbiter finalizes before the restart.
|
||||
1. Scan
|
||||
1. Orchestrator schedules the scan.
|
||||
1. Orchestrator verifies admin approvals and policies for download.
|
||||
1. Download
|
||||
1. Orchestrator starts downloads.
|
||||
1. Windows Update downloads manifest files and provides them to the arbiter.
|
||||
1. The arbiter evaluates the manifest and tells the Windows Update client to download files.
|
||||
1. Windows Update client downloads files in a temporary folder.
|
||||
1. The arbiter stages the downloaded files.
|
||||
1. Install
|
||||
1. Orchestrator starts the installation.
|
||||
1. The arbiter calls the installer to install the package.
|
||||
1. Commit
|
||||
1. Orchestrator starts a restart.
|
||||
1. The arbiter finalizes before the restart.
|
||||
|
||||
|
||||
## How updating works
|
||||
@ -52,7 +43,7 @@ During the updating process, the Windows Update Orchestrator operates in the bac
|
||||
|
||||
The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently.
|
||||
|
||||
When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies.
|
||||
When devices check for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies.
|
||||
|
||||
Make sure you're familiar with the following terminology related to Windows Update scan:
|
||||
|
||||
@ -61,8 +52,8 @@ Make sure you're familiar with the following terminology related to Windows Upda
|
||||
|Update|We use this term to mean several different things, but in this context it's the actual updated code or change.|
|
||||
|Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.|
|
||||
|Child update|Leaf update that's bundled by another update; contains payload.|
|
||||
|Detector update|A special "update" that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.|
|
||||
|Category update|A special "detectoid" that has an **IsInstalled** rule that is always true. Used for grouping updates and to allow the device to filter updates. |
|
||||
|Detector update|A special update that contains `IsInstalled` applicability rule only and no payload. Used for prerequisite evaluation.|
|
||||
|Category update|A special `detectoid` that has an `IsInstalled` rule that is always true. Used for grouping updates and allowing the device to filter updates. |
|
||||
|Full scan|Scan with empty datastore.|
|
||||
|Delta scan|Scan with updates from previous scan already cached in datastore.|
|
||||
|Online scan|Scan that uses the network and to check an update server. |
|
||||
@ -80,7 +71,7 @@ Windows Update does the following actions when it runs a scan.
|
||||
#### Starts the scan for updates
|
||||
When users start scanning in Windows Update through the Settings panel, the following occurs:
|
||||
|
||||
- The scan first generates a “ComApi” message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates.
|
||||
- The scan first generates a `ComApi` message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates.
|
||||
- "Agent" messages: queueing the scan, then actually starting the work:
|
||||
- Updates are identified by the different IDs ("ID = 10", "ID = 11") and from the different thread ID numbers.
|
||||
- Windows Update uses the thread ID filtering to concentrate on one particular task.
|
||||
@ -88,9 +79,9 @@ When users start scanning in Windows Update through the Settings panel, the foll
|
||||
|
||||
|
||||
#### Proxy Behavior
|
||||
For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP]: SimpleAuth Web Service | Microsoft Docs, [MS-WUSP]: Client Web Service | Microsoft Docs):
|
||||
For Windows Update (WU) scans URLs that are used for update detection ([MS-WUSP: SimpleAuth Web Service](/openspecs/windows_protocols/ms-wusp/61235469-6c2f-4c08-9749-e35d52c16899), [MS-WUSP: Client Web Service](/openspecs/windows_protocols/ms-wusp/69093c08-da97-445e-a944-af0bef36e4ec)):
|
||||
- System proxy is attempted (set using the `netsh` command).
|
||||
- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then user proxy is attempted (generally it is the logged-in user).
|
||||
- If WUA fails to reach the service due to a certain proxy, service, or authentication error code, then user proxy is attempted (generally it's the logged-in user).
|
||||
|
||||
> [!Note]
|
||||
> For intranet WSUS update service URLs, we provide an option via Windows Update policy to select the proxy behavior.
|
||||
@ -130,13 +121,13 @@ Common update failure is caused due to network issues. To find the root of the i
|
||||
> [!NOTE]
|
||||
> If the search is against WSUS or Configuration Manager, you can ignore warning messages for the Service Locator Service.
|
||||
|
||||
- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can’t scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it’s locally configured.
|
||||
- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can't scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it's locally configured.
|
||||
|
||||
|
||||
## Downloading updates
|
||||
|
||||
|
||||
Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device.
|
||||
Once the Windows Update Orchestrator determines which updates apply to your computer, it begins downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device.
|
||||
|
||||
To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption.
|
||||
|
||||
|
||||
@ -1,24 +1,22 @@
|
||||
---
|
||||
title: Update Windows installation media with Dynamic Update
|
||||
description: Learn how to deploy feature updates to your mission critical devices
|
||||
description: Learn how to acquire and apply Dynamic Update packages to existing Windows images prior to deployment
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 07/17/2023
|
||||
ms.reviewer: stevedia
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 07/17/2023
|
||||
---
|
||||
|
||||
# Update Windows installation media with Dynamic Update
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This article explains how to acquire and apply Dynamic Update packages to existing Windows images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process.
|
||||
|
||||
Volume-licensed media is available for each release of Windows in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process.
|
||||
|
||||
@ -1,20 +1,21 @@
|
||||
---
|
||||
title: Migrating and acquiring optional Windows content
|
||||
description: Keep language resources and Features on Demand during operating system updates
|
||||
description: How to keep language resources and Features on Demand during operating system updates for your organization.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 03/15/2023
|
||||
---
|
||||
|
||||
# Migrating and acquiring optional Windows content during updates
|
||||
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term.
|
||||
|
||||
When you update the operating system, it's critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a *media-based* or *task-sequence-based* update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a *servicing-based* update).
|
||||
@ -43,7 +44,7 @@ Windows Setup needs access to the optional content. Since optional content isn't
|
||||
|
||||
### User-initiated feature acquisition failure
|
||||
|
||||
The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits **Settings**, and attempts to install a second language, more language experience features, or other optional content. Again, since these features aren't in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can't be found, users are frustrated, and another help desk call could result. This pain point is sometimes referred to as *failure to acquire optional content*.
|
||||
The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows client, either by using a clean installation or an in-place update. The user visits **Settings**, and attempts to install a second language, more language experience features, or other optional content. Again, since these features aren't in the operating system, the packages need to be acquired. For a typical user with internet access, Windows acquires the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can't be found, users are frustrated, and another help desk call could result. This pain point is sometimes referred to as *failure to acquire optional content*.
|
||||
|
||||
## Options for acquiring optional content
|
||||
|
||||
@ -77,7 +78,7 @@ Consider moving to Windows Update for Business. Not only will the optional conte
|
||||
|
||||
Starting in March 2023, UUP has been integrated with WSUS and Configuration Manager to bring the same optional content and acquisition benefits of Windows Update to on-premises management solutions. For example:
|
||||
|
||||
- FODs and languages will automatically migrate for devices that perform an in-place update using an approved Windows 11, version 22H2 client feature update from WSUS. Similarly, updates such as the combined cumulative update, Setup updates, and Safe OS updates will be included and current based on the month that the feature update was approved.
|
||||
- FODs and languages will automatically migrate for devices that perform an in-place update using an approved Windows 11, version 22H2 client feature update from WSUS. Similarly, updates such as the combined cumulative update, Setup updates, and Safe OS updates are included and current based on the month that the feature update was approved.
|
||||
|
||||
- Devices that upgrade using a local Windows image but use WSUS or Configuration Manager for approving the combined cumulative update will benefit by having support for optional content acquisition in the updated Windows OS, as well as OS self-healing.
|
||||
|
||||
@ -94,9 +95,9 @@ If you're not ready to move to Windows Update, another option is to enable Dynam
|
||||
- **Latest cumulative update**: Installs the latest cumulative quality update.
|
||||
- **Driver updates**: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update.
|
||||
|
||||
In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device isn't connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with `setupconfig.ini`. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
In addition to these updates for the new operating system, Dynamic Update acquires optional content during the update process to ensure that the device has this content present when the update completes. So, although the device isn't connected to Windows Update, it fetches content from a nearby Microsoft content download network (CDN). This approach addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this value with `setupconfig.ini`. See [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details.
|
||||
|
||||
Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will reboot again for the latest cumulative update since it wasn't available during the feature update.
|
||||
Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device reboots again for the latest cumulative update since it wasn't available during the feature update.
|
||||
|
||||
One further consideration when using Dynamic Update is the effect on your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Setup downloads Dynamic Update content using Delivery Optimization when available. For devices that aren't connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog.
|
||||
|
||||
@ -120,7 +121,7 @@ The benefit of this option is that the Windows image can include those additiona
|
||||
|
||||
A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows Setup option [/InstallLangPacks](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using `setupconfig.ini`. For more information, see [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview).
|
||||
|
||||
When Setup runs, it will inject these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages can't be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cabs from the LPLIP ISO. <!--Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn't a fatal error. Starting with Windows 10, version 1903,--> We treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don't migrate FOD and languages (unless Dynamic Update is enabled).
|
||||
When Setup runs, it injects these packages into the new operating system during installation. It can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages can't be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, and the architecture-specific Language Pack .cab files from the LPLIP ISO. <!--Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn't a fatal error. Starting with Windows 10, version 1903,--> We treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don't migrate FOD and languages (unless Dynamic Update is enabled).
|
||||
|
||||
This approach has some interesting benefits. The original Windows image doesn't need to be modified, possibly saving time and scripting.
|
||||
|
||||
@ -134,12 +135,12 @@ Several of the options address ways to address optional content migration issues
|
||||
|
||||
- The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon.
|
||||
- This setting doesn't support installing language packs from an alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired.
|
||||
- If this setting isn't configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS.
|
||||
- If this setting isn't configured or disabled, files are downloaded from the default Windows Update location, for example Windows Update for Business or WSUS.
|
||||
|
||||
For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source).
|
||||
|
||||
|
||||
## Learn more
|
||||
## More resources
|
||||
|
||||
For more information about the Unified Update Platform and the approaches outlined in this article, see the following resources:
|
||||
|
||||
@ -156,11 +157,11 @@ For more information about the Unified Update Platform and the approaches outlin
|
||||
|
||||
## Sample scripts
|
||||
|
||||
Options 4 and 6 involve the most scripting. Sample scripts for Option 4 already exist, so we'll look at sample scripts for [Option 6](#option-6-install-optional-content-after-deployment): Install Optional Content after Deployment.
|
||||
Options 4 and 6 involve the most scripting. Sample scripts for Option 4 already exist, so let's look at sample scripts for [Option 6](#option-6-install-optional-content-after-deployment): Install Optional Content after Deployment.
|
||||
|
||||
### Creating an optional content repository
|
||||
|
||||
To get started, we'll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We'll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository.
|
||||
To get started, we build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository.
|
||||
|
||||
|
||||
|
||||
@ -573,7 +574,7 @@ Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction ignore | Out-Null
|
||||
|
||||
### Saving optional content in the source operating system
|
||||
|
||||
To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This action will limit the files to copy.
|
||||
To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This action limits the files to copy.
|
||||
|
||||
|
||||
```powershell
|
||||
|
||||
@ -1,26 +1,26 @@
|
||||
---
|
||||
title: Define readiness criteria
|
||||
description: Identify important roles and figure out how to classify apps
|
||||
description: Identify important roles and figure out how to classify apps so you can plan and manage your deployment
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Define readiness criteria
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
Planning and managing a deployment involves a variety of distinct activities and roles best suited to each activity. This article describes how to identify important roles and figure out how to classify apps.
|
||||
|
||||
## Figure out roles and personnel
|
||||
|
||||
Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment.
|
||||
As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment.
|
||||
|
||||
### Process manager
|
||||
|
||||
@ -50,13 +50,9 @@ This table sketches out one view of the other roles, with their responsibilities
|
||||
|Stakeholders | Represent groups affected by updates, for example, heads of finance, end-user services, or change management | Key decision maker for a business unit or department | Plan, pilot deployment, broad deployment |
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Set criteria for rating apps
|
||||
|
||||
Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise.
|
||||
Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren't critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise.
|
||||
|
||||
In the Prepare phase, you'll apply the criteria you define now to every app in your organization.
|
||||
|
||||
@ -78,7 +74,7 @@ Here's an example priority rating system; the specifics could vary for your orga
|
||||
|---------|---------|
|
||||
|1 | Any issues or risks identified must be investigated and resolved as soon as possible. |
|
||||
|2 | Start investigating risks and issues within two business days and fix them *during* the current deployment cycle. |
|
||||
|3 | Start investigating risks and issues within 10 business days. You don’t have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. |
|
||||
|3 | Start investigating risks and issues within 10 business days. You don't have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. |
|
||||
|4 | Start investigating risks and issues within 20 business days. You can fix them in the current or any future development cycle. |
|
||||
|
||||
Related to priority, but distinct, is the concept of severity. You should define a severity ranking as well, based on how you feel a problem with an app should affect the deployment cycle.
|
||||
|
||||
@ -1,45 +1,43 @@
|
||||
---
|
||||
title: Define update strategy
|
||||
description: Two examples of a calendar-based approach to consistent update installation
|
||||
description: Example of using a calendar-based approach to achieve consistent update installation in your organization.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Define update strategy with a calendar
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices.
|
||||
|
||||
Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an extra 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release.
|
||||
Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows release cycles, update mechanisms, and relevant tools to support this model. For more information about the Windows lifecycle, see [Windows lifecycle FAQ](/lifecycle/faq/windows).
|
||||
|
||||
We encourage you to deploy every available release and maintain a fast cadence for some portion of your environment. We also recognize that you might have a large number of devices, and a need for little or no disruption. So, you might choose to update annually. The 18/30 month lifecycle cadence lets you allow some portion of your environment to move faster while a majority can move less quickly.
|
||||
We encourage you to deploy every available release and maintain a fast cadence for some portion of your environment. We also recognize that you might have a large number of devices, and a need for little or no disruption. The lifecycle cadence lets you allow some portion of your environment to move faster while the majority can move less quickly.
|
||||
|
||||
## Calendar approaches
|
||||
You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they'll stop receiving the monthly security updates.
|
||||
You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they stop receiving the monthly security updates once a version is out of support.
|
||||
|
||||
### Annual
|
||||
Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Configuration Manager and Microsoft 365 Apps release cycles:
|
||||
## Annual approach
|
||||
Here's a calendar showing an example schedule that applies one Windows feature update per calendar year, aligned with Microsoft Configuration Manager and Microsoft 365 Apps release cycles:
|
||||
|
||||
[  ](images/annual-calendar.png#lightbox)
|
||||
|
||||
This approach provides approximately 12 months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates.
|
||||
This approach provides approximately 12 months of use from each feature update before the next update is due to be installed by aligning to the Windows H2 feature update.
|
||||
|
||||
This cadence might be most suitable for you if any of these conditions apply:
|
||||
|
||||
- You're just starting your journey with the Windows 10 servicing process. If you're unfamiliar with new processes that support Windows 10 servicing, moving from a project happening once every three to five years to a twice-a-year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost.
|
||||
- You're just starting your journey with the Windows servicing process. If you're unfamiliar with new processes that support Windows servicing, moving from a project happening once every three to five years to a feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost.
|
||||
|
||||
- You want to wait and see how successful other companies are at adopting a Windows 10 feature update.
|
||||
- You want to wait and see how successful other companies are at adopting a Windows feature update.
|
||||
|
||||
- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the second half of each calendar year, you get extra servicing for Windows 10 (30 months of servicing compared to 18 months).
|
||||
- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows serviced in case business priorities change.
|
||||
|
||||
|
||||
|
||||
@ -1,37 +1,35 @@
|
||||
---
|
||||
title: Determine application readiness
|
||||
manager: aaroncz
|
||||
description: How to test your apps to know which need attention prior to deploying an update
|
||||
description: How to test your apps to identify which need attention prior to deploying an update in your organization.
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
ms.author: mstewart
|
||||
author: mestew
|
||||
ms.technology: itpro-updates
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Determine application readiness
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Before you deploy a Windows client update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps](plan-define-readiness.md) with respect to their criticality in your organization.
|
||||
|
||||
## Validation methods
|
||||
|
||||
You can choose from a variety of methods to validate apps. Exactly which ones to use will depend on the specifics of your environment.
|
||||
You can choose from various methods to validate apps. Exactly which ones to use depends on the specifics of your environment.
|
||||
|
||||
|
||||
|Validation method |Description |
|
||||
|---------|---------|
|
||||
|Full regression | A full quality assurance probing. Staff who know the application well and can validate its core functionality should do this. |
|
||||
|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they’re validating. |
|
||||
|Automated testing | Software performs tests automatically. The software will let you know whether the tests have passed or failed, and will provide detailed reporting for you automatically. |
|
||||
|Test in pilot | You pre-select users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. |
|
||||
|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren’t handled by enterprise application distribution. |
|
||||
|Full regression | A full quality assurance probing. Staff that know the application well and can validate its core functionality should do this validation. |
|
||||
|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they're validating. |
|
||||
|Automated testing | Software performs tests automatically. The software lets you know whether the tests have passed or failed, and provides detailed reporting for you automatically. |
|
||||
|Test in pilot | You preselect users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. |
|
||||
|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren't handled by enterprise application distribution. |
|
||||
|
||||
Combining the various validation methods with the app classifications you've previously established might look like this:
|
||||
|
||||
@ -46,7 +44,7 @@ Combining the various validation methods with the app classifications you've pre
|
||||
|
||||
### Identify users
|
||||
|
||||
Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you'll have to choose which users are best suited for validation testing. Some factors to consider include:
|
||||
Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you have to choose which users are best suited for validation testing. Some factors to consider include:
|
||||
|
||||
- **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in?
|
||||
- **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work?
|
||||
@ -56,10 +54,10 @@ You could seek volunteers who enjoy working with new features and include them i
|
||||
|
||||
### Identify and set up devices for validation
|
||||
|
||||
In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection will include devices representing all of the hardware models in your environment.
|
||||
In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection includes devices representing all of the hardware models in your environment.
|
||||
|
||||
There is more than one way to choose devices for app validation:
|
||||
There's more than one way to choose devices for app validation:
|
||||
|
||||
- **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles.
|
||||
- **Manual selection**: Some internal groups like operations will have expertise to help choose devices manually based on specifications, usage, or records of past support problems.
|
||||
- **Manual selection**: Some internal groups like operations have expertise to help choose devices manually based on specifications, usage, or records of past support problems.
|
||||
- **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices.
|
||||
|
||||
@ -2,28 +2,26 @@
|
||||
title: Prepare to deploy Windows
|
||||
description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Prepare to deploy Windows
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase will have left you with these useful items:
|
||||
Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows client. The planning phase left you with these useful items:
|
||||
|
||||
- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md)
|
||||
- A plan for [testing and validating](plan-determine-app-readiness.md) apps
|
||||
- An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness
|
||||
- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use
|
||||
- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use
|
||||
|
||||
Now you're ready to actually start making changes in your environment to get ready to deploy.
|
||||
|
||||
@ -33,26 +31,26 @@ Now you're ready to actually start making changes in your environment to get rea
|
||||
- Update non-Microsoft security tools like security agents or servers.
|
||||
- Update non-Microsoft management tools like data loss prevention agents.
|
||||
|
||||
Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps:
|
||||
Your infrastructure probably includes many different components and tools. You need to ensure your environment isn't affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps:
|
||||
|
||||
1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on.
|
||||
1. Review all of the infrastructure changes that you've identified in your plan. It's important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on.
|
||||
|
||||
2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment.
|
||||
2. Validate your changes. You validate the changes for your infrastructure's components and tools, to help you understand how your changes could affect your production environment.
|
||||
|
||||
3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure.
|
||||
|
||||
|
||||
You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example:
|
||||
You should also look at your organization's environment's configuration and outline how you'll implement any necessary changes previously identified in the plan phase to support the update. Consider what you need to do for the various settings and policies that currently underpin the environment. For example:
|
||||
|
||||
- Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security-related configurations.
|
||||
- Implement new draft security guidance. New versions of Windows can include new features that improve your environment's security. Your security teams will want to make appropriate changes to security-related configurations.
|
||||
|
||||
- Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to.
|
||||
|
||||
However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example:
|
||||
However, your configuration will consist of many different settings and policies. It's important to only apply changes where they're necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that slow down the update process. You want to ensure your environment isn't affected adversely because of changes you make. For example:
|
||||
|
||||
1. Review new security settings. Your security team will review the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment.
|
||||
1. Review new security settings. Your security team reviews the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment.
|
||||
|
||||
2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant.
|
||||
2. Review security baselines for changes. Security teams also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant.
|
||||
|
||||
3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues.
|
||||
|
||||
@ -142,9 +140,9 @@ You can also create and run scripts to perform additional cleanup actions on dev
|
||||
|
||||
- Compact the operating system by running **Compact.exe /CompactOS:always**.
|
||||
|
||||
- Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance.
|
||||
- Remove Windows Features on Demand that the user doesn't need. For more information, see [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities).
|
||||
|
||||
- Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](/onedrive/use-group-policy) for more information.
|
||||
- Move Windows Known Folders to OneDrive. For more information, see [Use Group Policy to control OneDrive sync settings](/onedrive/use-group-policy).
|
||||
|
||||
- Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates:
|
||||
|
||||
@ -167,9 +165,9 @@ You can also create and run scripts to perform additional cleanup actions on dev
|
||||
|
||||
## Prepare capability
|
||||
|
||||
In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities:
|
||||
In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You need to complete these higher-level tasks to gain those new capabilities:
|
||||
|
||||
- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates.
|
||||
- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions come with new policies that you use to update ADMX templates.
|
||||
|
||||
- Validate new changes to understand how they affect the wider environment.
|
||||
|
||||
@ -177,12 +175,12 @@ In the plan phase, you determined the specific infrastructure and configuration
|
||||
|
||||
## Prepare users
|
||||
|
||||
Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning.
|
||||
Users often feel like they're forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning.
|
||||
|
||||
You can employ a variety of measures to achieve this goal, for example:
|
||||
You can employ various measures to achieve this goal, for example:
|
||||
|
||||
- Send overview email about the update and how it will be deployed to the entire organization.
|
||||
- Send personalized emails to users about the update with specific details.
|
||||
- Set an opt-out deadline for employees that need to remain on the current version for a bit longer, due to a business need.
|
||||
- Provide the ability to voluntarily update at users’ convenience.
|
||||
- Provide the ability to voluntarily update at users' convenience.
|
||||
- Inform users of a mandatory installation date when the update will be installed on all devices.
|
||||
|
||||
@ -1,19 +1,21 @@
|
||||
---
|
||||
title: Update release cycle for Windows clients
|
||||
description: Learn about the release cycle of updates for Windows clients to stay productive and protected.
|
||||
description: Learn about the release cycle for updates so Windows clients in your organization stay productive and protected.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 05/19/2023
|
||||
---
|
||||
|
||||
# Update release cycle for Windows clients
|
||||
<!--7696511-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
Windows updates help you to stay productive and protected. They provide your users and IT administrators with the security fixes they need, and protect devices so that unpatched vulnerabilities can't be exploited. Updates for the Windows client OS are typically cumulative. They include all previously released fixes to guard against fragmentation of the operating system. Reliability and vulnerability issues can occur when only a subset of fixes is installed.
|
||||
|
||||
@ -23,11 +25,11 @@ This article provides details on the types of updates that Microsoft provides, a
|
||||
|
||||
|Release type | Description | Release cycle |
|
||||
|---|---|---|
|
||||
| [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and non-security content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) |
|
||||
| [Optional non-security preview release](#optional-non-security-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) |
|
||||
| [Monthly security update release](#monthly-security-update-release)| A cumulative update release that includes both security and nonsecurity content | Second Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) |
|
||||
| [Optional nonsecurity preview release](#optional-nonsecurity-preview-release)| An optional cumulative update release that's typically used for early validation of the monthly security update release| Fourth Tuesday of each month, typically published at 10:00 AM Pacific Time (PST/PDT) |
|
||||
| [Out-of-band (OOB) release](#oob-releases) | Resolves a recently identified issue or vulnerability | As needed |
|
||||
| [Annual feature update](#annual-feature-updates) | An update with new features and enhancements that also changes the Windows version | Once a year in the second half of the calendar year |
|
||||
| [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional non-security preview release then in the monthly security update releases |
|
||||
| [Continuous innovation for Windows 11](#continuous-innovation-for-windows-11)| Introduces new features and enhancements for Windows 11 | Periodically included in an optional nonsecurity preview release then in the monthly security update releases |
|
||||
|
||||
|
||||
## Monthly security update release
|
||||
@ -42,7 +44,7 @@ Most people are familiar with the **monthly security update release**. The **mon
|
||||
- Latest cumulative update (LCU)
|
||||
|
||||
|
||||
**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with non-security content introduced in the prior month's [**Optional non-security preview release**](#optional-non-security-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory.
|
||||
**Monthly security update releases** are cumulative. The release includes both new and previously released security fixes, along with nonsecurity content introduced in the prior month's [**Optional nonsecurity preview release**](#optional-nonsecurity-preview-release). These updates help keep Windows devices secure and compliant by deploying stability fixes and addressing security vulnerabilities. Most organizations consider monthly security update releases as mandatory.
|
||||
|
||||
Monthly security update releases are available through the following channels:
|
||||
|
||||
@ -52,11 +54,11 @@ Monthly security update releases are available through the following channels:
|
||||
|
||||
Many update management tools, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Intune](/mem/intune/), rely on these channels for update deployment.
|
||||
|
||||
## Optional non-security preview release
|
||||
## Optional nonsecurity preview release
|
||||
|
||||
**Optional non-security preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, non-security preview releases. New features might initially be deployed in the prior month's **optional non-security preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows.
|
||||
**Optional nonsecurity preview releases** provide IT admins an opportunity for early validation of that content prior to the **monthly security update release**. Admins can test and validate production-quality releases ahead of the planned monthly security update release for the following month. These updates are optional, cumulative, nonsecurity preview releases. New features might initially be deployed in the prior month's **optional nonsecurity preview release**, then ship in the following **monthly security update release**. These releases are only offered to the most recent, supported versions of Windows.
|
||||
|
||||
**Optional non-security preview releases** might commonly be referred to as:
|
||||
**Optional nonsecurity preview releases** might commonly be referred to as:
|
||||
|
||||
- C or D week releases (meaning the third or fourth week of the month)
|
||||
- Preview updates
|
||||
@ -64,9 +66,9 @@ Many update management tools, such as [Microsoft Configuration Manager](/mem/con
|
||||
- LCU preview
|
||||
|
||||
> [!Important]
|
||||
> Starting in April 2023, all **optional non-security preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features.
|
||||
> Starting in April 2023, all **optional nonsecurity preview releases** will be released on the fourth Tuesday of the month. This change in release cadence gives admins a consistent time cycle for testing and validating fixes and features.
|
||||
|
||||
To access the optional non-security preview release:
|
||||
To access the optional nonsecurity preview release:
|
||||
- Navigate to **Settings** > **Update & Security** > **Windows Update** and select **Check for updates**.
|
||||
- Use [Windows Insider Program for Business](https://insider.windows.com/for-business)
|
||||
- Use the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx).
|
||||
@ -78,16 +80,16 @@ To access the optional non-security preview release:
|
||||
Some key considerations about OOB releases include:
|
||||
|
||||
- OOB releases are always cumulative.
|
||||
- OOB releases supersede any prior monthly security update and optional non-security preview release.
|
||||
- OOB releases supersede any prior monthly security update and optional nonsecurity preview release.
|
||||
- OOB releases generally require IT admins to deploy off-cycle.
|
||||
- Some OOB releases are classified as critical.
|
||||
- Critical OOB releases are automatically available to WSUS and Windows Update for Business, just like the monthly security update releases.
|
||||
- Some OOB releases are classified as non-critical.
|
||||
- Non-critical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update.
|
||||
- Some OOB releases are classified as noncritical.
|
||||
- Noncritical releases only go to the Microsoft Update Catalog for users or organizations to voluntarily obtain the update.
|
||||
|
||||
## Continuous innovation for Windows 11
|
||||
|
||||
Starting with Windows 11, version 22H2, new features and enhancements are introduced periodically to provide continuous innovation for Windows 11. These features and enhancements use the normal update servicing channels you're already familiar with. At first, new features are introduced with an **optional non-security preview release** and gradually rolled out to unmanaged clients. These new features are released later as part of a **monthly security update release**.
|
||||
Starting with Windows 11, version 22H2, new features and enhancements are introduced periodically to provide continuous innovation for Windows 11. These features and enhancements use the normal update servicing channels you're already familiar with. At first, new features are introduced with an **optional nonsecurity preview release** and gradually rolled out to unmanaged clients. These new features are released later as part of a **monthly security update release**.
|
||||
|
||||
Some of the new features may be disruptive to organizations. By default, these select features are turned off temporarily for all managed devices until the next annual feature update is installed. In this scenario, a device is considered managed if it uses one of the following to determine which updates to install:
|
||||
|
||||
|
||||
@ -1,31 +1,29 @@
|
||||
---
|
||||
title: Safeguard holds
|
||||
description: What are safeguard holds, how can you tell if one is in effect, and what to do about it.
|
||||
title: Safeguard holds for Windows
|
||||
description: What are safeguard holds? How to can you tell if a safeguard hold is in effect, and what to do about it.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.localizationpriority: medium
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# Safeguard holds
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe effect (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround isn't immediately available.
|
||||
|
||||
Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows client.
|
||||
|
||||
The safeguard holds lifespan varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update will resume offering new operating system versions to devices.
|
||||
The safeguard holds lifespan varies depending on the time required to investigate and fix an issue. During this time, Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the safeguard hold. Once we release the safeguard hold, Windows Update resumes offering new operating system versions to devices.
|
||||
|
||||
Safeguard holds only affect devices that use the Windows Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments.
|
||||
|
||||
@ -37,11 +35,11 @@ IT admins can use [Windows Update for Business reports](wufb-reports-overview.md
|
||||
|
||||
Windows Update for Business reports identifies safeguard holds by their 8-digit identifiers. For safeguard holds associated with publicly discussed known issues, you can find more details about the issue on the [Windows release health](/windows/release-health/) dashboard by searching for the safeguard hold ID on the **Known issues** page for the relevant release.
|
||||
|
||||
On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message:
|
||||
On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users see a message.
|
||||
|
||||
|
||||
|
||||
This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we'll release the safeguard hold and the update can resume safely.
|
||||
This message means that the device is protected by one or more safeguard holds. When the issue is resolved and the update is safe to install, we release the safeguard hold so the update can resume safely.
|
||||
|
||||
## What can I do?
|
||||
|
||||
|
||||
@ -1,38 +1,35 @@
|
||||
---
|
||||
title: Opt out of safeguard holds
|
||||
description: Steps to install an update even it if has a safeguard hold applied
|
||||
description: How to install an update in your organization even when a safeguard hold for a known issue has been applied to it.
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
ms.localizationpriority: medium
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
ms.date: 10/21/2020
|
||||
---
|
||||
|
||||
# Opt out of safeguard holds
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows client feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md).
|
||||
|
||||
## How can I opt out of safeguard holds?
|
||||
|
||||
IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update and in Windows 11.
|
||||
IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running the following operating systems:
|
||||
- Windows 11
|
||||
- Windows 10, version 1809, or later, with the October 2020 security update.
|
||||
|
||||
> [!CAUTION]
|
||||
> Opting out of a safeguard hold can put devices at risk from known performance issues.
|
||||
|
||||
We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows client feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business.
|
||||
|
||||
Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues.
|
||||
Disabling safeguards doesn't guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you're bypassing the protection against known issues.
|
||||
|
||||
> [!NOTE]
|
||||
> After a device installs a new Windows client version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
|
||||
|
||||
|
||||
|
||||
> After a device installs a new Windows client version, the **Disable safeguards for Feature Updates** Group Policy will revert to **Not configured** even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft's default protection from known issues for each new feature update.
|
||||
|
||||
Reference in New Issue
Block a user