Merge remote-tracking branch 'refs/remotes/origin/master' into atp-powerbi
@ -8274,6 +8274,11 @@
|
||||
"source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md",
|
||||
"redirect_url": "/windows/windows-10/index",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md",
|
||||
"redirect_url": "/windows/deployment/update/waas-servicing-channels-windows-10-updates",
|
||||
"redirect_document_id": true
|
||||
}
|
||||
]
|
||||
}
|
@ -288,9 +288,9 @@ The XML file that is included in the Office Deployment Tool specifies the produc
|
||||
<td align="left"><p><code>Sourcepath = "\\Server\Office2016”</code></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Branch (attribute of Add element)</p></td>
|
||||
<td align="left"><p>Optional. Specifies the update branch for the product that you want to download or install. </p><p>For more information about update branches, see Overview of update branches for Office 365 ProPlus.</p></td>
|
||||
<td align="left"><p><code>Branch = "Business"</code></p></td>
|
||||
<td align="left"><p>Channel (attribute of Add element)</p></td>
|
||||
<td align="left"><p>Optional. Specifies the update channel for the product that you want to download or install. </p><p>For more information about update channels, see Overview of update channels for Office 365 ProPlus.</p></td>
|
||||
<td align="left"><p><code>Channel="Deferred"</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
@ -20,7 +20,7 @@ You can manage the feature settings of certain Microsoft Desktop Optimization Pa
|
||||
|
||||
**How to download and deploy the MDOP Group Policy templates**
|
||||
|
||||
1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=54957)
|
||||
1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531)
|
||||
|
||||
2. Run the downloaded file to extract the template folders.
|
||||
|
||||
|
@ -54,9 +54,9 @@ Clients need to trust domain controllers and the best way to do this is to ensur
|
||||
|
||||
Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the KDC Authentication object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template.
|
||||
|
||||
By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template a baseline to create an updated domain controller certificate template.
|
||||
By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template.
|
||||
|
||||
Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
1. Open the **Certificate Authority** management console.
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**.
|
||||
@ -73,7 +73,7 @@ Many domain controllers may have an existing domain controller certificate. The
|
||||
|
||||
The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template.
|
||||
|
||||
Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials.
|
||||
Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials.
|
||||
1. Open the **Certificate Authority** management console.
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**.
|
||||
@ -90,7 +90,7 @@ The certificate template is configured to supersede all the certificate template
|
||||
|
||||
Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
|
||||
|
||||
Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
||||
1. Open the **Certificate Authority** management console.
|
||||
2. Right-click **Certificate Templates** and click **Manage**.
|
||||
3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**.
|
||||
@ -150,7 +150,7 @@ Domain controllers automatically request a certificate from the domain controlle
|
||||
|
||||
### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object
|
||||
|
||||
Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials.
|
||||
Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials.
|
||||
1. Start the **Group Policy Management Console** (gpmc.msc)
|
||||
2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**
|
||||
3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**.
|
||||
|
@ -16,6 +16,12 @@ ms.date: 06/13/2017
|
||||
|
||||
This topic lists new and updated topics in the [Client management](index.md) documentation for Windows 10 and Windows 10 Mobile.
|
||||
|
||||
## July 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [Group Policy settings that apply only to Windows 10 Enterprise and Education Editions](group-policies-for-enterprise-and-education-editions.md) | Added that Start layout policy setting can be applied to Windows 10 Pro, version 1703 |
|
||||
|
||||
## June 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
|
@ -23,9 +23,9 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W
|
||||
| **Turn off Microsoft consumer features** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Do not display the lock screen** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Do not require CTRL+ALT+DEL** </br>combined with</br>**Turn off app notifications on the lock screen** | Computer Configuration > Administrative Templates > System > Logon </br>and</br>Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon | When both of these policy settings are enabled, the combination will also disable lock screen apps ([assigned access](/windows/configuration/set-up-a-device-for-anyone-to-use)) on Windows 10 Enterprise and Windows 10 Education only. These policy settings can be applied to Windows 10 Pro, but lock screen apps will not be disabled on Windows 10 Pro. </br></br>**Important:** The description for **Interactive logon: Do not require CTRL+ALT+DEL** in the Group Policy Editor incorrectly states that it only applies to Windows 10 Enterprise and Education. The description will be corrected in a future release.|
|
||||
| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight |
|
||||
| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) |
|
||||
| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | In Windows 10, version 1703, this policy setting can be applied to Windows 10 Pro. For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) |
|
||||
| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application<br><br>User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). |
|
||||
| **Only display the private store within the Windows Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app<br><br>User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Windows Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) |
|
||||
| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) |
|
||||
|
@ -211,7 +211,7 @@
|
||||
### [Overview of Windows as a service](update/waas-overview.md)
|
||||
### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md)
|
||||
### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md)
|
||||
### [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md)
|
||||
### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md)
|
||||
### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md)
|
||||
#### [Get started with Update Compliance](update/update-compliance-get-started.md)
|
||||
#### [Use Update Compliance](update/update-compliance-using.md)
|
||||
@ -233,4 +233,24 @@
|
||||
#### [Windows Insider Program for Business Frequently Asked Questions](update/waas-windows-insider-for-business-faq.md)
|
||||
### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md)
|
||||
|
||||
## Windows Analytics
|
||||
### [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md)
|
||||
#### [Upgrade Readiness architecture](upgrade/upgrade-readiness-architecture.md)
|
||||
#### [Upgrade Readiness requirements](upgrade/upgrade-readiness-requirements.md)
|
||||
#### [Get started with Upgrade Readiness](upgrade/upgrade-readiness-get-started.md)
|
||||
##### [Upgrade Readiness deployment script](upgrade/upgrade-readiness-deployment-script.md)
|
||||
#### [Use Upgrade Readiness to manage Windows upgrades](upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md)
|
||||
##### [Upgrade overview](upgrade/upgrade-readiness-upgrade-overview.md)
|
||||
##### [Step 1: Identify apps](upgrade/upgrade-readiness-identify-apps.md)
|
||||
##### [Step 2: Resolve issues](upgrade/upgrade-readiness-resolve-issues.md)
|
||||
##### [Step 3: Deploy Windows](upgrade/upgrade-readiness-deploy-windows.md)
|
||||
##### [Additional insights](upgrade/upgrade-readiness-additional-insights.md)
|
||||
#### [Troubleshoot Upgrade Readiness](upgrade/troubleshoot-upgrade-readiness.md)
|
||||
### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md)
|
||||
#### [Get started with Update Compliance](update/update-compliance-get-started.md)
|
||||
#### [Use Update Compliance](update/update-compliance-using.md)
|
||||
### [Device Health](update/device-health-monitor.md)
|
||||
#### [Get started with Device Health](update/device-health-get-started.md)
|
||||
#### [Using Device Health](update/device-health-using.md)
|
||||
|
||||
## [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md)
|
@ -6,7 +6,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
ms.author: daniha
|
||||
ms.date: 05/16/2017
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Change history for Update Windows 10
|
||||
@ -15,6 +15,10 @@ This topic lists new and updated topics in the [Update Windows 10](index.md) doc
|
||||
|
||||
>If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history).
|
||||
|
||||
## July 2017
|
||||
|
||||
All topics were updated to reflect the new [naming changes](waas-overview.md#naming-changes).
|
||||
|
||||
## May 2017
|
||||
|
||||
| New or changed topic | Description |
|
||||
|
180
windows/deployment/update/device-health-get-started.md
Normal file
@ -0,0 +1,180 @@
|
||||
---
|
||||
title: Get started with Device Health
|
||||
description: Configure Device Health in OMS to see statistics on frequency and causes of crashes of devices in your network.
|
||||
keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: jaimeo
|
||||
---
|
||||
|
||||
# Get started with Device Health
|
||||
|
||||
This topic explains the steps necessary to configure your environment for Windows Analytics: Device Health.
|
||||
|
||||
Steps are provided in sections that follow the recommended setup process:
|
||||
1. Ensure that [prerequisites](#device-health-prerequisites) are met.
|
||||
2. [Add Device Health](#add-device-health-to-microsoft-operations-management-suite) to Microsoft Operations Management Suite.
|
||||
3. [Deploy your Commercial ID](#deploy-your-commercial-id-to-your-windows-10-devices and set the telemetry level) to your organization’s devices.
|
||||
|
||||
## Device Health prerequisites
|
||||
|
||||
Device Health has the following requirements:
|
||||
1. Device Health is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
|
||||
2. The solution requires that at least the [enhanced level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) is enabled on all devices that are intended to be displayed in the solution. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
|
||||
3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the telemetry services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
|
||||
|
||||
Service | Endpoint
|
||||
--- | ---
|
||||
Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com<BR>settings-win.data.microsoft.com
|
||||
Windows Error Reporting | watson.telemetry.microsoft.com
|
||||
Online Crash Analysis | oca.telemetry.microsoft.com
|
||||
|
||||
>[!NOTE]
|
||||
> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. See [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization) for steps to exclude authentication for these endpoints.
|
||||
|
||||
|
||||
## Add Device Health to Microsoft Operations Management Suite
|
||||
|
||||
Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premise and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
|
||||
|
||||
**If you are already using OMS**, you’ll find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace.
|
||||
|
||||
**If you are not yet using OMS**, use the following steps to subscribe to OMS Device Health:
|
||||
|
||||
1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**.
|
||||
[](images/uc-02.png)
|
||||
|
||||
|
||||
2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS.
|
||||
[](images/uc-03.png)
|
||||
|
||||
|
||||
3. Create a new OMS workspace.
|
||||
|
||||
[](images/uc-04.png)
|
||||
|
||||
4. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Click **Create**.
|
||||
|
||||
[](images/uc-05.png)
|
||||
|
||||
5. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. If you do not yet have an Azure subscription, follow [this guide](https://blogs.technet.microsoft.com/upgradeanalytics/2016/11/08/linking-operations-management-suite-workspaces-to-microsoft-azure/) to create and link an Azure subscription to an OMS workspace.
|
||||
|
||||
[](images/uc-06.png)
|
||||
|
||||
6. To add Device Health to your workspace, go to the Solution Gallery, Select the **Device Health** tile and then select **Add** on the solution's detail page.
|
||||
|
||||
[](images/uc-08.png)
|
||||
|
||||
7. Click the **Device Health** tile to configure the solution. The **Settings Dashboard** opens.
|
||||
|
||||
[](images/uc-09.png)
|
||||
|
||||
|
||||
|
||||
After you have added Device Health and devices have a Commercial ID, you will begin receiving data. It will typically take 24-48 hours for the first data to begin appearing. The following section explains how to deploy your Commercial ID to your Windows 10 devices.
|
||||
|
||||
>[!NOTE]
|
||||
>You can unsubscribe from the Device Health solution if you no longer want to monitor your organization’s devices. User device data will continue to be shared with Microsoft while the opt-in keys are set on user devices and the proxy allows traffic.
|
||||
|
||||
## Deploy your Commercial ID to your Windows 10 devices and set the telemetry level
|
||||
|
||||
In order for your devices to show up in Windows Analytics: Device Health, they must be configured with your organization’s Commercial ID. This is so that Microsoft knows that a given device is a member of your organization and to feed that device’s data back to you. There are two primary methods for widespread deployment of your Commercial ID: Group Policy and Mobile Device Management (MDM).
|
||||
|
||||
- Using Group Policy<BR><BR>
|
||||
Deploying your Commercial ID using Group Policy can be accomplished by configuring domain Group Policy Objects with the Group Policy Management Editor, or by configuring local Group Policy using the Local Group Policy Editor.
|
||||
1. In the console tree, navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**
|
||||
2. Double-click **Configure the Commercial ID**
|
||||
3. In the **Options** box, under **Commercial Id**, type the Commercial ID GUID, and then click **OK**.<P>
|
||||
|
||||
- Using Microsoft Mobile Device Management (MDM)<BR><BR>
|
||||
Microsoft’s Mobile Device Management can be used to deploy your Commercial ID to your organization’s devices. The Commercial ID is listed under **Provider/ProviderID/CommercialID**. More information on deployment using MDM can be found [here](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dmclient-csp).
|
||||
|
||||
## Perform checks to ensure and verify successful deployment
|
||||
|
||||
While you're waiting for the initial data to populate, there are some configuration details it's worth confirming to ensure that the necessary data connections are set up properly.
|
||||
|
||||
### Check for disabled Windows Error Reporting (WER)
|
||||
|
||||
If WER is disabled or redirected on your Windows devices, then reliability information cannot be shown in Device Health.
|
||||
|
||||
Check these Registry settings in **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting**:
|
||||
|
||||
- Verify that the value "Disabled" (REG_DWORD), if set, is 0.
|
||||
- Verify that the value "DontSendAdditionalData" (REG_DWORD), if set, is 0.
|
||||
- Verify that the value "CorporateWERServer" (REG_SZ) is not configured.
|
||||
|
||||
If you need further information on Windows Error Reporting (WER) settings, see [WER Settings](https://msdn.microsoft.com/library/windows/desktop/bb513638(v=vs.85).aspx).
|
||||
|
||||
|
||||
### Endpoint connectivity
|
||||
|
||||
Devices must be able to reach the endpoints specified in the "Device Health prerequisites" section of this topic.
|
||||
|
||||
>[!NOTE]
|
||||
> If your deployment includes devices running Windows 10 versions prior to Windows 10, version 1703, you must **exclude** *authentication* for the endpoints listed in Step 3 of the "Device Health prerequisites" section of this topic. Windows Error Reporting did not support authenticating proxies until Windows 10, version 1703. (If you need more information about telemetry endpoints and how to manage them, see [Configure Windows telemetry in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-telemetry-in-your-organization).
|
||||
|
||||
If you are using proxy server authentication, it is worth taking extra care to check the configuration. Prior to Windows 10, version 1703, WER uploads error reports in the machine context. Both user (typically authenticated) and machine (typically anonymous) contexts require access through proxy servers to the diagnostic endpoints. In Windows 10, version 1703, and later WER will attempt to use the context of the user that is logged on for proxy authentication such that only the user account requires proxy access.
|
||||
|
||||
Therefore, it's important to ensure that both machine and user accounts have access to the endpoints using authentication (or to whitelist the endpoints so that outbound proxy authentication is not required).
|
||||
|
||||
To test access as a given user, you can run this Windows PowerShell cmdlet *while logged on as that user*:
|
||||
|
||||
```powershell
|
||||
|
||||
$endPoints = @(
|
||||
'v10.vortex-win.data.microsoft.com'
|
||||
'settings-win.data.microsoft.com'
|
||||
'watson.telemetry.microsoft.com'
|
||||
'oca.telemetry.microsoft.com'
|
||||
'vortex.data.microsoft.com'
|
||||
)
|
||||
|
||||
$endPoints | %{ Test-NetConnection -ComputerName $_ -Port 443 -ErrorAction Continue } | Select-Object -Property ComputerName,TcpTestSucceeded
|
||||
|
||||
```
|
||||
|
||||
If this is successful, `TcpTestSucceeded` should return `True` for each of the endpoints.
|
||||
|
||||
To test access in the machine context (requires administrative rights), run the above as SYSTEM using PSexec or Task Scheduler, as in this example:
|
||||
|
||||
```powershell
|
||||
|
||||
[scriptblock]$accessTest = {
|
||||
$endPoints = @(
|
||||
'v10.vortex-win.data.microsoft.com'
|
||||
'settings-win.data.microsoft.com'
|
||||
'watson.telemetry.microsoft.com'
|
||||
'oca.telemetry.microsoft.com'
|
||||
'vortex.data.microsoft.com'
|
||||
)
|
||||
|
||||
$endPoints | %{ Test-NetConnection -ComputerName $_ -Port 443 -ErrorAction Continue } | Select-Object -Property ComputerName,TcpTestSucceeded
|
||||
}
|
||||
|
||||
$scriptFullPath = Join-Path $env:ProgramData "TestAccessToMicrosoftEndpoints.ps1"
|
||||
$outputFileFullPath = Join-Path $env:ProgramData "TestAccessToMicrosoftEndpoints_Output.txt"
|
||||
$accessTest.ToString() > $scriptFullPath
|
||||
$null > $outputFileFullPath
|
||||
$taskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-ExecutionPolicy Bypass -Command `"&{$scriptFullPath > $outputFileFullPath}`""
|
||||
$taskTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date).Addseconds(10)
|
||||
$task = Register-ScheduledTask -User 'NT AUTHORITY\SYSTEM' -TaskName 'MicrosoftTelemetryAccessTest' -Trigger $taskTrigger -Action $taskAction -Force
|
||||
Start-Sleep -Seconds 120
|
||||
Unregister-ScheduledTask -TaskName $task.TaskName -Confirm:$false
|
||||
Get-Content $outputFileFullPath
|
||||
|
||||
```
|
||||
|
||||
As in the other example, if this is successful, `TcpTestSucceeded` should return `True` for each of the endpoints.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)<BR>
|
||||
For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
|
65
windows/deployment/update/device-health-monitor.md
Normal file
@ -0,0 +1,65 @@
|
||||
---
|
||||
title: Monitor the health of devices with Device Health
|
||||
description: You can use Device Health in OMS to monitor the frequency and causes of crashes and misbehaving apps on devices in your network.
|
||||
keywords: oms, operations management suite, wdav, health, log analytics
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: jaimeo
|
||||
---
|
||||
|
||||
# Monitor the health of devices with Device Health
|
||||
|
||||
## Introduction
|
||||
|
||||
Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity.
|
||||
|
||||
Like Upgrade Readiness and Update Compliance, Device Health is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This preview release is free for customers to try and will not incur charges on your OMS workspace for its use. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
|
||||
|
||||
Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health (preview) from the OMS solution gallery and add it to your OMS workspace. Device Health requires enhanced telemetry, so you might need to implement this policy if you've not already done so.
|
||||
|
||||
|
||||
Device Health provides the following:
|
||||
|
||||
- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
|
||||
- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
|
||||
- Notification of Windows Information Protection misconfigurations that send prompts to end users
|
||||
- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 telemetry
|
||||
|
||||
See the following topics in this guide for detailed information about configuring and using the Device Health solution:
|
||||
|
||||
- [Get started with Device Health](device-health-get-started.md): How to add Device Health to your environment.
|
||||
- [Using Device Health](device-health-using.md): How to begin using Device Health.
|
||||
|
||||
An overview of the processes used by the Device Health solution is provided below.
|
||||
|
||||
## Device Health architecture
|
||||
|
||||
The Device Health architecture and data flow is summarized by the following five-step process:
|
||||
|
||||
|
||||
|
||||
**(1)** User computers send telemetry data to a secure Microsoft data center using the Microsoft Data Management Service.<BR>
|
||||
**(2)** Telemetry data is analyzed by the Microsoft Telemetry Service.<BR>
|
||||
**(3)** Telemetry data is pushed from the Microsoft Telemetry Service to your OMS workspace.<BR>
|
||||
**(4)** Telemetry data is available in the Device Health solution.<BR>
|
||||
**(5)** You are now able to proactively monitor Device Health issues in your environment.<BR>
|
||||
|
||||
These steps are illustrated in following diagram:
|
||||
|
||||
[](images/analytics-architecture.png)
|
||||
|
||||
>[!NOTE]
|
||||
>This process assumes that Windows telemetry is enabled and you [have assigned your Commercial ID to devices](update-compliance-get-started.md#deploy-your-commercial-id-to-your-windows-10-devices).
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
[Get started with Device Health](device-health-get-started.md)
|
||||
|
||||
[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
|
||||
|
||||
For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
|
170
windows/deployment/update/device-health-using.md
Normal file
@ -0,0 +1,170 @@
|
||||
---
|
||||
title: Using Device Health
|
||||
description: Explains how to begin usihg Device Health.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: jaimeo
|
||||
---
|
||||
|
||||
# Using Device Health
|
||||
|
||||
This section describes how to use Device Health to monitor devices deployed on your network and troubleshoot the causes if they crash.
|
||||
|
||||
|
||||
Device Health provides IT Pros with reports on some common problems that users might experience so that they can be proactively remediated. This decreases support calls and improves productivity.
|
||||
|
||||
Device Health provides the following benefits:
|
||||
|
||||
- Identification of devices that crash frequently and therefore might need to be rebuilt or replaced
|
||||
- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
|
||||
- Notification of Windows Information Protection misconfigurations that send prompts to end users
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Information is refreshed daily so that health status can be monitored. Changes will be displayed about 24-48 hours after their occurrence, so you always have a recent snapshot of your devices.
|
||||
|
||||
In OMS, the aspects of a solution's dashboard are usually divided into <I>blades</I>. Blades are a slice of information, typically with a summarization tile and an enumeration of the items that makes up that data. All data is presented through <I>queries</I>. <I>Perspectives</I> are also possible, wherein a given query has a unique view designed to display custom data. The terminology of blades, tiles, and perspectives will be used in the sections that follow.
|
||||
|
||||
|
||||
## Device Reliability
|
||||
|
||||
- [Frequently Crashing Devices](#frequently-crashing-devices)
|
||||
- [Driver-Induced OS Crashes](#driver--induced-OS-crashes)
|
||||
|
||||
|
||||
|
||||
### Frequently Crashing Devices
|
||||
|
||||
This middle blade in Device Reliability displays the devices that have crashed the most often in the last week. This can help you identify unhealthy devices that might need to be rebuilt or replaced.
|
||||
|
||||
See the following example:
|
||||
|
||||
|
||||

|
||||
|
||||
Clicking the header of the Frequently Crashing Devices blade opens a reliability perspective view, where you can filter data (by using filters in the left pane), see trends, and compare to commercial averages:
|
||||
|
||||

|
||||
|
||||
"Commercial averages" here refers to data collected from deployments with a mix of operating system versions and device models that is similar to yours. If your crash rate is higher, there are opportunities for improvement, for example by moving to newer driver versions.
|
||||
|
||||
Notice the filters in the left pane; they allow you to filter the crash rate shown to a particular operating system version, device model, or other parameter.
|
||||
|
||||
>[!NOTE]
|
||||
>Use caution when interpreting results filtered by model or operating system version. This is very useful for troubleshooting, but might not be accurate for *comparisons* because the crashes displayed could be of different types. The overall goal for working with crash data is to ensure that most devices have the same driver versions and that that version has a low crash rate.
|
||||
|
||||
>[!TIP]
|
||||
>Once you've applied a filter (for example setting OSVERSION=1607) you will see the query in the text box change to append the filter (for example, with “(OSVERSION=1607)”). To undo the filter, remove that part of the query in the text box and click the search button to the right of the text box to run the adjusted query.”
|
||||
|
||||
|
||||
If you click through a particular device from the view blade or from the Device Reliability perspective, it will take you to the Crash History perspective for that device.
|
||||
|
||||

|
||||
|
||||
This displays device records sorted by date and crash details by failure ID, also sorted by date. In this view are a number of useful items:
|
||||
|
||||
- Crash history records by date, aggregated by Failure ID. The Failure ID is an internal number that is used to group crashes that are related to each other. Eventually over time, you can use the Failure ID to provide additional info. If a crash was caused by driver, some driver fields will also be populated.
|
||||
|
||||
- StopCode: this is hex value that would be displayed on a bluescreen if you were looking directly at the affected device.
|
||||
|
||||
- Count: the number times that particular Failure ID has occurred on that specific device *on that date*.
|
||||
|
||||
|
||||
|
||||
|
||||
### Driver-Induced OS Crashes
|
||||
|
||||
This blade (on the right) displays drivers that have caused the most devices to crash in the last two weeks. If your crash rate is high, you can reduce the overall operating system crashes in your deployment by upgrading those drivers with a high crash rate.
|
||||
|
||||
|
||||

|
||||
|
||||
Clicking a listed driver on the Driver-Induced OS Crashes blade opens a driver perspective view, which shows the details for the responsible driver, trends and commercial averages for that driver, and alternative versions of the driver.
|
||||
|
||||

|
||||

|
||||
|
||||
The driver version table can help you determine whether deploying a newer version of the driver might help you reduce the crash rate. In the example shown above, the most commonly installed driver version (19.15.1.5) has a crash rate of about one-half of one percent--this is low, so this driver is probably fine. However, driver version 19.40.0.3 has a crash rate of almost 20%. If that driver had been widely deployed, updating it would substantially reduce the overal number of crashes in your organization.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Windows Information Protection
|
||||
|
||||
|
||||
Windows Information Protection (WIP) helps protect work data from accidental sharing. Users might be disrupted if WIP rules are not aligned with real work behavior. WIP App Learning shows which apps on which computers are attempting to cross policy boundaries.
|
||||
|
||||
For details about deploying WIP policies, see [Protect your enterprise data using Windows Information Protection (WIP)](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
Once you have WIP policies in place, by using the WIP section of Device Health, you can:
|
||||
|
||||
- Reduce disruptive prompts by adding rules to allow data sharing from approved apps.
|
||||
- Tune WIP rules, for example by confirming that certain apps are allowed or disallowed by current policy.
|
||||
|
||||
|
||||

|
||||
|
||||
|
||||
Clicking through the **APP LEARNING** tile shows details of app statistics that you can use to explore each incident and update app policies by using AppLocker or WIP AppIDs.
|
||||
|
||||

|
||||
|
||||
In this chart view, you can click a particular app listing, which will open additional details on the app in question, including details you need to adjust your Windows Information Protection Policy:
|
||||
|
||||

|
||||
|
||||
Here you can copy the WipAppid and use that for adjusting the WIP policy.
|
||||
|
||||
## Data model and OMS built-in extensibility
|
||||
|
||||
All of the views and blades display slices of the most useful data by using pre-formed queries. You have access to the full set of data collected by Device Health, which means you can construct your own queries to expose any data that is of interest to you. For documentation on working with log searches, see [Find data using log searches](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches). This topic section provides information about the data types being populated specifically by Device Health.
|
||||
|
||||
### Example queries
|
||||
|
||||
You can run these queries from the OMS **Log Search** interface (available at several points in the Device Health interface) by just typing them in. There are few details to be aware of:
|
||||
|
||||
- After running a query, make sure to set the date range (which appears upper left after running initial query) to "7 days" to ensure you get data back.
|
||||
- If you see the search tutorial dialog appearing frequently, it's likely because you are have read-only access to the OMS workspace. Ask a workspace administrator to grant you "contributor" permissions (which is required for the "completed tutorial" state to persist).
|
||||
- If you use the search filters in the left pane, you might notice there is no control to undo a filter selection. To undo a selection, delete the (FilterName="FilterValue") element that is appended to the search query and then click the search button again. For example, after you run a base query of *Type = DHOSReliability KernelModeCrashCount > 0*, a number of filter options appear on the left. If you then filter on **Manufacturer** (for example, by setting *Manufacturer="Microsoft Corporation"* and then clicking **Apply**), the query will change to *Type = DHOSReliability KernelModeCrashCount > 0 (Manufacturer="Microsoft Corporation")*. Delete *(Manufacturer="Microsoft Corporation")* and then click the **search** button again to re-run the query without that filter.
|
||||
|
||||
### Device reliability query examples
|
||||
|
||||
|Data|Query|
|
||||
|-------------------|------------------------|
|
||||
|Total devices| Type = DHOSReliability \| measure countdistinct(ComputerID) by Type|
|
||||
|Number of devices that have crashed in the last three weeks| Type = DHOSReliability KernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type|
|
||||
|Compare the percentage of your devices that have not crashed with the percentage of similar devices outside your organization ("similar" here means other commercial devices with the same mix of device models, operating system versions and update levels).| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by Type \| Display Table|
|
||||
|As above, but sorted by device manufacturer| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by Manufacturer \| sort NumberDevices desc \| Display Table|
|
||||
|As above, but sorted by model| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by ModelFamily\| sort NumberDevices desc \| Display Table|
|
||||
|As above, but sorted by operating system version| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by OSVersion \| sort NumberDevices desc \| Display Table|
|
||||
|Crash rate trending in my organization compared to the commercial average. Each interval shows percentage of devices that crashed at least once in the trailing two weeks| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by TimeGenerated \| Display LineChart|
|
||||
|Table of devices that have crashed the most in the last two weeks| Type = DHOSReliability KernelModeCrashCount > 0 \| Dedup ComputerID \| select Computer, KernelModeCrashCount \| sort TimeGenerated desc, KernelModeCrashCount desc \| Display Table|
|
||||
|Detailed crash records, most recent first| Type = DHOSCrashData \| sort TimeGenerated desc, Computer asc \| display Table|
|
||||
|Number of devices that crashed due to drivers| Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type|
|
||||
|Table of drivers that have caused the most devices to crash| Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by DriverName \| Display Table|
|
||||
|Trend of devices crashed by driver by day| * Type=DHOSCrashData DriverName!="ntkrnlmp.exe" DriverName IN {Type=DHOSCrashData \| measure count() by DriverName | top 5} \| measure countdistinct(ComputerID) as NumberDevices by DriverName interval 1day|
|
||||
|Crashes for different versions of a given driver (replace netwtw04.sys with the driver you want from the previous list). This lets you get an idea of which *versions* of a given driver work best with your devices| Type = DHDriverReliability DriverName="netwtw04.sys" \| Dedup ComputerID \| sort TimeGenerated desc \| measure countdistinct(ComputerID) as InstallCount, sum(map(DriverKernelModeCrashCount,1,10000, 1)) as DevicesCrashed by DriverVersion \| Display Table|
|
||||
|Top crashes by FailureID| Type =DHOSCrashData \| measure count() by KernelModeCrashFailureId \| Display Table|
|
||||
|
||||
### Windows Information Protection (WIP) App Learning query examples
|
||||
|
||||
|Data|Query|
|
||||
|-------------------|------------------------|
|
||||
|Apps encountering policy boundaries on the most computers (click on an app in the results to see details including computer names)| Type=DHWipAppLearning \| measure countdistinct(ComputerID) as ComputerCount by AppName|
|
||||
|Trend of App Learning activity for a given app. Useful for tracking activity before and after a rule change| Type=DHWipAppLearning AppName="MICROSOFT.SKYPEAPP" | measure countdistinct(ComputerID) as ComputerCount interval 1day|
|
||||
|
||||
### Exporting data and configuring alerts
|
||||
|
||||
OMS enables you to export data to other tools. To do this, in any view that shows **Log Search** just click the **Export** button. Similarly, clicking the **Alert** button will enable you to run a query automaticlaly on a schedule and receive email alerts for particular query results that you set. If you have a PowerBI account, then you will also see a **PowerBI** button that enables you to run a query on a schedule and have the results automatically saved as a PowerBI data set.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
[Get started with Device Health](device-health-get-started.md)<BR>
|
||||
|
||||
For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
|
BIN
windows/deployment/update/images/WIP-detail.png
Normal file
After Width: | Height: | Size: 105 KiB |
BIN
windows/deployment/update/images/WIP.png
Normal file
After Width: | Height: | Size: 94 KiB |
BIN
windows/deployment/update/images/WIP2-sterile.png
Normal file
After Width: | Height: | Size: 79 KiB |
BIN
windows/deployment/update/images/WIP2.PNG
Normal file
After Width: | Height: | Size: 77 KiB |
After Width: | Height: | Size: 166 KiB |
BIN
windows/deployment/update/images/WIPNEW1.PNG
Normal file
After Width: | Height: | Size: 67 KiB |
BIN
windows/deployment/update/images/WIPNEW2-sterile.png
Normal file
After Width: | Height: | Size: 72 KiB |
BIN
windows/deployment/update/images/WIPNEW2.PNG
Normal file
After Width: | Height: | Size: 65 KiB |
BIN
windows/deployment/update/images/WIPNEWMAIN-sterile.png
Normal file
After Width: | Height: | Size: 68 KiB |
BIN
windows/deployment/update/images/WIPNEWMAIN.PNG
Normal file
After Width: | Height: | Size: 39 KiB |
BIN
windows/deployment/update/images/WIPappID-sterile.png
Normal file
After Width: | Height: | Size: 85 KiB |
BIN
windows/deployment/update/images/WIPappID.PNG
Normal file
After Width: | Height: | Size: 76 KiB |
BIN
windows/deployment/update/images/WIPmain.PNG
Normal file
After Width: | Height: | Size: 39 KiB |
BIN
windows/deployment/update/images/analytics-architecture.png
Normal file
After Width: | Height: | Size: 40 KiB |
BIN
windows/deployment/update/images/app-detail.png
Normal file
After Width: | Height: | Size: 22 KiB |
BIN
windows/deployment/update/images/app-health-dashboard.png
Normal file
After Width: | Height: | Size: 87 KiB |
BIN
windows/deployment/update/images/crash-hang-detail.png
Normal file
After Width: | Height: | Size: 112 KiB |
After Width: | Height: | Size: 132 KiB |
BIN
windows/deployment/update/images/dev-health-main-tile.png
Normal file
After Width: | Height: | Size: 127 KiB |
BIN
windows/deployment/update/images/device-crash-history.png
Normal file
After Width: | Height: | Size: 28 KiB |
After Width: | Height: | Size: 84 KiB |
BIN
windows/deployment/update/images/device-crash-history2.PNG
Normal file
After Width: | Height: | Size: 80 KiB |
BIN
windows/deployment/update/images/device-reliability.png
Normal file
After Width: | Height: | Size: 50 KiB |
BIN
windows/deployment/update/images/device-reliability2-sterile.png
Normal file
After Width: | Height: | Size: 89 KiB |
BIN
windows/deployment/update/images/device-reliability2.PNG
Normal file
After Width: | Height: | Size: 69 KiB |
BIN
windows/deployment/update/images/driver-deeper-detail.png
Normal file
After Width: | Height: | Size: 82 KiB |
BIN
windows/deployment/update/images/driver-detail-1-sterile.png
Normal file
After Width: | Height: | Size: 68 KiB |
BIN
windows/deployment/update/images/driver-detail-1.PNG
Normal file
After Width: | Height: | Size: 66 KiB |
BIN
windows/deployment/update/images/driver-detail-2-sterile.png
Normal file
After Width: | Height: | Size: 83 KiB |
BIN
windows/deployment/update/images/driver-detail-2.PNG
Normal file
After Width: | Height: | Size: 80 KiB |
BIN
windows/deployment/update/images/driver-detail.png
Normal file
After Width: | Height: | Size: 29 KiB |
BIN
windows/deployment/update/images/health-summary.png
Normal file
After Width: | Height: | Size: 46 KiB |
After Width: | Height: | Size: 53 KiB |
BIN
windows/deployment/update/images/login-health-detail.png
Normal file
After Width: | Height: | Size: 66 KiB |
BIN
windows/deployment/update/images/login-health.png
Normal file
After Width: | Height: | Size: 81 KiB |
BIN
windows/deployment/update/images/reliability-perspective.png
Normal file
After Width: | Height: | Size: 40 KiB |
BIN
windows/deployment/update/images/reliability-perspective2.PNG
Normal file
After Width: | Height: | Size: 48 KiB |
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Configure BranchCache for Windows 10 updates
|
||||
@ -53,7 +54,7 @@ In addition to these steps, there is one requirement for WSUS to be able to use
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Configure Windows Update for Business
|
||||
@ -19,6 +20,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for Windows 10, version 1511 and above. The MDM policies use the OMA-URI setting from the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx).
|
||||
|
||||
>[!IMPORTANT]
|
||||
@ -36,7 +42,7 @@ By grouping devices with similar deferral periods, administrators are able to cl
|
||||
<span id="configure-devices-for-current-branch-or-current-branch-for-business"/>
|
||||
## Configure devices for Current Branch (CB) or Current Branch for Business (CBB)
|
||||
|
||||
With Windows Update for Business, you can set a device to be on either the Current Branch (CB) or the Current Branch for Business (CBB) servicing branch. For more information on this servicing model, see [Windows 10 servicing options](waas-overview.md#servicing-branches).
|
||||
With Windows Update for Business, you can set a device to be on either the Current Branch (CB) or the Current Branch for Business (CBB) servicing branch. For more information on this servicing model, see [Windows 10 servicing options](waas-overview.md#servicing-channels).
|
||||
|
||||
**Release branch policies**
|
||||
|
||||
@ -257,7 +263,7 @@ In the Windows Update for Business policies in version 1511, all the deferral ru
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Configure Delivery Optimization for Windows 10 updates
|
||||
@ -204,7 +205,7 @@ On devices that are not preferred, you can choose to set the following policy to
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md)
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Build deployment rings for Windows 10 updates
|
||||
@ -29,35 +30,30 @@ Table 1 provides an example of the deployment rings you might use.
|
||||
|
||||
**Table 1**
|
||||
|
||||
| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Branch for Business (CBB) release |
|
||||
| --- | --- | --- |
|
||||
| Preview | Windows Insider | Pre-CB |
|
||||
| Ring 1 Pilot IT | CB | CB + 0 weeks |
|
||||
| Ring 2 Pilot business users | CB | CB + 4 weeks |
|
||||
| Ring 3 Broad IT | CB | CB + 6 weeks |
|
||||
| Ring 4 Broad business users | CBB | CBB + 0 weeks |
|
||||
| Ring 5 Broad business users #2 | CBB | CBB + 2 weeks as required by capacity or other constraints |
|
||||
| Deployment ring | Servicing channel | Deferral for feature updates | Deferral for quality updates | Example |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the semi-annual channel |
|
||||
| Targeted | Semi-annual channel (Targeted) | None | None | Select devices across various teams used to evaluate the major release prior to broad deployment |
|
||||
| Broad | Semi-annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback</br>Pause updates if there are critical issues |
|
||||
| Critical | Semi-annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for a period of time by the majority of the organization |
|
||||
|
||||
>[!NOTE]
|
||||
>In this example, there are no rings made up of the long-term servicing branch (LTSB). The LTSB servicing branch does not receive feature updates.
|
||||
>In this example, there are no rings made up of the long-term servicing channel (LTSC). The LTSC servicing channel does not receive feature updates.
|
||||
>
|
||||
>Windows Insider is in the deployment ring list for informational purposes only. Windows Insider PCs must be enrolled manually on each device and serviced based on the Windows Insider level chosen in the **Settings** app on that particular PC. Feature update servicing for Windows Insiderdevices is done completely through Windows Update; no servicing tools can manage Windows Insider feature updates.
|
||||
>Windows Insider PCs must be enrolled manually on each device and serviced based on the Windows Insider level chosen in the **Settings** app on that particular PC. Feature update servicing for Windows Insider devices is done completely through Windows Update; no servicing tools can manage Windows Insider feature updates.
|
||||
|
||||
|
||||
As Table 1 shows, each combination of servicing branch and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing branch to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing branch they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense.
|
||||
|
||||

|
||||
|
||||
As Table 1 shows, each combination of servicing channel and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing channel to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing channel they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense.
|
||||
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | Build deployment rings for Windows 10 updates (this topic) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Integrate Windows Update for Business with management solutions
|
||||
@ -97,7 +98,7 @@ For Windows 10, version 1607, organizations already managing their systems with
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Deploy Windows 10 updates using System Center Configuration Manager
|
||||
@ -19,6 +20,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers.
|
||||
|
||||
You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation.
|
||||
@ -292,10 +298,10 @@ With the task sequence created, you’re ready to deploy it. If you’re using t
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or Deploy Windows 10 updates using System Center Configuration Manager (this topic) |
|
||||
|
||||
@ -310,7 +316,7 @@ With the task sequence created, you’re ready to deploy it. If you’re using t
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -18,6 +18,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Center Configuration Manager provides.
|
||||
|
||||
When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10.
|
||||
@ -322,10 +327,10 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or Deploy Windows 10 updates using Windows Server Update Services (this topic)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
@ -337,7 +342,7 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -19,6 +19,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines.
|
||||
|
||||
Specifically, Windows Update for Business allows for:
|
||||
@ -75,7 +80,7 @@ The pause period is now calculated starting from the set start date. For additio
|
||||
Windows Update for Business was first made available in Windows 10, version 1511. In Windows 10, version 1607 (also known as the Anniversary Update), there are several new or changed capabilities provided as well as updated behavior.
|
||||
|
||||
>[!NOTE]
|
||||
>For more information on Current Branch and Current Branch for Business, see [Windows 10 servicing options](waas-overview.md#servicing-branches).
|
||||
>For more information on Current Branch and Current Branch for Business, see [Windows 10 servicing options](waas-overview.md#servicing-channels).
|
||||
|
||||
<table>
|
||||
<thead>
|
||||
@ -102,10 +107,10 @@ For more information about Update Compliance, see [Monitor Windows Updates using
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | Deploy updates using Windows Update for Business (this topic) </br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
@ -114,7 +119,7 @@ For more information about Update Compliance, see [Monitor Windows Updates using
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -20,14 +20,19 @@ ms.author: daniha
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!TIP]
|
||||
>If you're not familiar with the Windows 10 servicing or release branches, read [Servicing branches](waas-overview.md#servicing-branches) first.
|
||||
>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing channels](waas-overview.md#servicing-channels) first.
|
||||
|
||||
Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Current Branch (CB) unless you [enroll the device in the Windows Insider Program](waas-servicing-branches-windows-10-updates.md#enroll-devices-in-the-windows-insider-program) or assign the device to Current Branch for Business (CBB). Only devices running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile can be assigned to CBB.
|
||||
Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program) or assign the device to Current Branch for Business (CBB). Only devices running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile can be assigned to CBB.
|
||||
|
||||
[Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)
|
||||
|
||||
</br>
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
| Windows 10 edition | CB | CBB | Insider Program |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Mobile |  |  |  |
|
||||
@ -68,7 +73,7 @@ If a device running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile, versi
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -86,10 +86,10 @@ At this point, the download is complete and the update is ready to be installed.
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | Optimize update delivery for Windows 10 updates (this topic) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Overview of Windows as a service
|
||||
@ -22,7 +23,7 @@ ms.author: daniha
|
||||
|
||||
The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
|
||||
|
||||
<iframe width="560" height="315" align="center" src="https://www.youtube.com/embed/MLc4-Suv0LU" frameborder="0" allowfullscreen></iframe>
|
||||
<iframe width="560" height="315" align="center" src="https://www.youtube.com/embed/qSAsiM01GOU" frameborder="0" allowfullscreen></iframe>
|
||||
|
||||
## Building
|
||||
|
||||
@ -56,11 +57,22 @@ Device compatibility in Windows 10 is also very strong; new hardware is not need
|
||||
|
||||
Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10, there are two release types: feature updates that add new functionality twice per year, and quality updates that provide security and reliability fixes at least once a month.
|
||||
|
||||
With Windows 10, organizations will need to change the way they approach deploying updates. Servicing branches are the first way to separate users into deployment groups for feature and quality updates. With the introduction of servicing branches comes the concept of a [deployment ring](waas-deployment-rings-windows-10-updates.md), which is simply a way to categorize the combination of a deployment group and a servicing branch to group devices for successive waves of deployment. For more information about developing a deployment strategy that leverages servicing branches and deployment rings, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
With Windows 10, organizations will need to change the way they approach deploying updates. Servicing channels are the first way to separate users into deployment groups for feature and quality updates. With the introduction of servicing channels comes the concept of a [deployment ring](waas-deployment-rings-windows-10-updates.md), which is simply a way to categorize the combination of a deployment group and a servicing channel to group devices for successive waves of deployment. For more information about developing a deployment strategy that leverages servicing channels and deployment rings, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
|
||||
For information about each servicing tool available for Windows 10, see [Servicing tools](#servicing-tools).
|
||||
|
||||
To align with this new update delivery model, Windows 10 has three servicing branches, each of which provides different levels of flexibility over when these updates are delivered to client computers. For information about the servicing branches available in Windows 10, see [Servicing branches](#servicing-branches).
|
||||
To align with this new update delivery model, Windows 10 has three servicing channels, each of which provides different levels of flexibility over when these updates are delivered to client computers. For information about the servicing channels available in Windows 10, see [Servicing channels](#servicing-channels).
|
||||
|
||||
### Naming changes
|
||||
|
||||
As part of the alignment with Windows 10 and Office 365 ProPlus, we are adopting common terminology to make it as easy as possible to understand the servicing process. Going forward, these are the new terms we will be using:
|
||||
* Semi-Annual Channel - We will be referreing to Current Branch (CB) as "Semi-Annual Channel (Targeted)", while Current Branch for Business (CBB) will simply be referred to as "Semi-Annual Channel".
|
||||
* Long-Term Servicing Channel - The Long-Term Servicing Branch (LTSB) will be referred to as Long-Term Servicing Channel (LTSC).
|
||||
|
||||
>[!NOTE]
|
||||
>For additional information, see the section about [Servicing Channels](#servicing-channels).
|
||||
>
|
||||
>You can also read [this blog post](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/), with details on this change.
|
||||
|
||||
|
||||
### Feature updates
|
||||
@ -72,9 +84,9 @@ With Windows 10, Microsoft will package new features into feature updates that c
|
||||
|
||||
### Quality updates
|
||||
|
||||
Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of nonsecurity fixes.
|
||||
Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of non-security fixes.
|
||||
|
||||
In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and nonsecurity fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment PCs contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates.
|
||||
In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment PCs contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates.
|
||||
|
||||
**Figure 1**
|
||||
|
||||
@ -82,60 +94,58 @@ In Windows 10, rather than receiving several updates each month and trying to fi
|
||||
|
||||
|
||||
|
||||
## Servicing branches
|
||||
## Servicing channels
|
||||
|
||||
To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing branches to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers three servicing branches for Windows 10: Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB). In addition, the Windows Insider Program provides IT pros and other interested parties with prerelease Windows builds that they can test and ultimately provide feedback on to Microsoft. For details about the versions in each servicing branch, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx).
|
||||
To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how frequently their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity.
|
||||
|
||||
The concept of servicing branches is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools).
|
||||
With that in mind, Windows 10 offers 3 servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases about every three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx).
|
||||
|
||||
The concept of servicing channels is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools).
|
||||
|
||||
>[!NOTE]
|
||||
>Servicing branches are not the only way to separate groups of devices when consuming updates. Each branch can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing branches, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
>Servicing channels are not the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md).
|
||||
|
||||
### Semi-Annual Channel
|
||||
|
||||
### Current Branch
|
||||
In the Semi-Annual servicing channel, feature updates are available as soon as Microsoft releases them. Windows 10, version 1511, had few servicing tool options to delay feature updates, limiting the use of the Semi-Annual servicing channel. Windows 10, version 1607 and onward, includes more servicing tools that can delay feature updates for up to 365 days. This servicing modal is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately.
|
||||
Once the latest release went through pilot deployment and testing, you choose the timing at which it goes into broad deployment.
|
||||
|
||||
In the CB servicing model, feature updates are available as soon as Microsoft releases them. Windows 10 version 1511 had few servicing tool options to delay CB feature updates, limiting the use of the CB servicing branch. Windows 10 version 1607, however, includes more servicing tools that can delay CB feature updates for up to 180 days. The CB servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately.
|
||||
|
||||
When Microsoft officially releases a feature update for Windows 10, that update is marked for CB, making it available to any PC not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer CB feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for CB will be available but not necessarily immediately mandatory, depending on the policy of the management system. Only one CB build of Windows is supported at a time, so those clients not on the most current build will not receive quality updates (after a 60 day grace period) until the most current feature update has been installed. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools).
|
||||
|
||||
|
||||
### Current Branch for Business
|
||||
|
||||
Organizations typically prefer to have a testing cycle before broadly deploying new features to business users. For Windows 10, most pilot testing will be done using the CB servicing branch. In contrast, the CBB servicing branch is typically used for broad deployment. Windows 10 clients in the CBB servicing branch receive the same build of Windows 10 as those in the CB servicing branch, just at a later time. CB releases are transitioned to CBB after about 4 months, indicating that Microsoft, independent software vendors (ISVs), partners, and customers believe that the release is ready for broad deployment. Therefore, CB and CBB have an inherent “staging” effect. Both of these branches have a purpose in the overall deployment process for an enterprise, providing another layer of testing capabilities in addition to the traditional phased deployment methods to specific groups of machines. Each feature update release will be supported and updated for 18 months from the time of its release.
|
||||
When Microsoft officially releases a feature update for Windows 10, it is made available to any PC not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools).
|
||||
|
||||
Organizations are expected to initiate targeted deployment on Semi-Annual Channel releases, while after about 4 months, we will announce broad deployment readiness, indicating that Microsoft, independent software vendors (ISVs), partners, and customers believe that the release is ready for broad deployment. Each feature update release will be supported and updated for 18 months from the time of its release
|
||||
|
||||
>[!NOTE]
|
||||
>Organizations can electively delay CB and CBB updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
>Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
|
||||
Basically, CBB is a configuration state, meaning that if a computer has the **Defer Updates and Upgrades** flag enabled—either through Group Policy, a mobile device management product like Microsoft Intune, or manually on the client—it’s considered to be in the CBB servicing branch. The benefit of tying this servicing model and CB to a configuration state rather than a SKU is that they are easily interchangeable. If an organization accidentally selects CBB on a machine that doesn’t need delayed updates, it’s simple to change it back.
|
||||
### Long-term Servicing Channel
|
||||
|
||||
### Long-term Servicing Branch
|
||||
|
||||
Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSB servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools.
|
||||
|
||||
>[!NOTE]
|
||||
>LTSB is not intended for deployment on most or all the PCs in an organization; it should be used only for special-purpose devices. As a general guideline, a PC with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the CB or CBB servicing branch.
|
||||
>Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version.
|
||||
>
|
||||
>Long-term Servicing channel is not intended for deployment on most or all the PCs in an organization; it should be used only for special-purpose devices. As a general guideline, a PC with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel.
|
||||
|
||||
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSB releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle.
|
||||
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle.
|
||||
|
||||
>[!NOTE]
|
||||
>Windows 10 LTSB will support the currently released silicon at the time of release of the LTSB. As future silicon generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products).
|
||||
|
||||
LTSB is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Windows Store client, Cortana (limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. Therefore, it’s important to remember that Microsoft has positioned the LTSB model primarily for specialized devices. Since Windows Store client is not available in Windows 10 Enterprise LTSB, if you need to run a Windows Store app, you should not use Windows 10 LTSB on that device.
|
||||
The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Windows Store client, Cortana (limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. Therefore, it’s important to remember that Microsoft has positioned the LTSC model primarily for specialized devices.
|
||||
|
||||
>[!NOTE]
|
||||
>If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the CB or CBB servicing branch, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports CB and CBB.
|
||||
>If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel.
|
||||
|
||||
### Windows Insider
|
||||
|
||||
For many IT pros, gaining visibility into feature updates early—before they’re available to the CB servicing branch—can be both intriguing and valuable for future end user communications as well as provide additional prestaging for CB machines. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to CB, organizations can test their deployment on test devices for compatibility validation.
|
||||
For many IT pros, gaining visibility into feature updates early—before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next Semi-Annual Channel release. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft.
|
||||
|
||||
Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](waas-windows-insider-for-business.md).
|
||||
|
||||
>[!NOTE]
|
||||
>Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app.
|
||||
>
|
||||
>The Windows Insider Program isn’t intended to replace CB deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
|
||||
>The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
|
||||
|
||||
|
||||
|
||||
@ -143,8 +153,8 @@ Microsoft recommends that all organizations have at least a few PCs enrolled in
|
||||
|
||||
There are many tools with which IT pros can service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
|
||||
|
||||
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the CBB servicing branch. Organizations can control which devices defer updates and stay in the CBB servicing branch or remain in CB by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 client.
|
||||
- **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes a little more control over update deferment and provides centralized management using Group Policy. In Windows 10 version 1511, Windows Update for Business can be used to defer feature updates for up to 8 months and quality updates for up to 4 weeks. Also, these deferment options were available only to clients in the CBB servicing branch. In Windows 10 version 1607 and later, Windows Update for Business can be used to defer feature updates for up to 180 days and quality updates for up to 30 days. These deployment options are available to clients in either the CB or CBB servicing branch. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune.
|
||||
- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 client.
|
||||
- **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes control over update deferment and provides centralized management using Group Policy. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the Semi-Annual Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune.
|
||||
- **Windows Server Update Services (WSUS)** provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready.
|
||||
- **System Center Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times.
|
||||
|
||||
@ -159,16 +169,19 @@ With all these options, which an organization chooses depends on the resources,
|
||||
| WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability |
|
||||
| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache | Distribution points, multiple deployment options |
|
||||
|
||||
>[!NOTE]
|
||||
>Due to [naming changes](#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
|
||||
</br>
|
||||
|
||||
## Steps to manage updates for Windows 10
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | Learn about updates and servicing branches (this topic) |
|
||||
|  | Learn about updates and servicing channels (this topic) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
@ -186,11 +199,3 @@ With all these options, which an organization chooses depends on the resources,
|
||||
- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md)
|
||||
- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md)
|
||||
- [Manage device restarts after updates](waas-restart.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
@ -7,6 +7,7 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Quick guide to Windows as a service
|
||||
@ -26,7 +27,9 @@ Some new terms have been introduced as part of Windows as a service, so you shou
|
||||
- **Feature updates** will be released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
|
||||
- **Quality updates** are released monthly, delivering both security and non-security fixes. These are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update.
|
||||
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
|
||||
- **Servicing channels** allow organizations to choose when to deploy new features. The Semi-Annual Channel receives feature updates twice per year. The Long Term Servicing Channel, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases about every three years.
|
||||
- **Servicing channels** allow organizations to choose when to deploy new features.
|
||||
- The **Semi-Annual Channel** receives feature updates twice per year.
|
||||
- The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases about every three years.
|
||||
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
|
||||
|
||||
See [Overview of Windows as a service](waas-overview.md) for more information.
|
||||
@ -39,7 +42,7 @@ Each Windows 10 feature update will be serviced with quality updates for 18 mont
|
||||
|
||||
Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years.
|
||||
|
||||
See [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) for more information.
|
||||
See [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) for more information.
|
||||
|
||||
## Staying up to date
|
||||
|
||||
@ -55,7 +58,7 @@ See [Build deployment rings for Windows 10 updates](waas-deployment-rings-window
|
||||
|
||||
## Video: An overview of Windows as a service
|
||||
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/MLc4-Suv0LU" frameborder="0" allowfullscreen></iframe>
|
||||
<iframe width="560" height="315" src="https://www.youtube.com/embed/qSAsiM01GOU" frameborder="0" allowfullscreen></iframe>
|
||||
|
||||
## Learn more
|
||||
|
||||
|
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Assign devices to servicing branches for Windows 10 updates (Windows 10)
|
||||
title: Assign devices to servicing channels for Windows 10 updates (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -7,9 +7,10 @@ ms.sitesec: library
|
||||
author: DaniHalfin
|
||||
localizationpriority: high
|
||||
ms.author: daniha
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Assign devices to servicing branches for Windows 10 updates
|
||||
# Assign devices to servicing channels for Windows 10 updates
|
||||
|
||||
|
||||
**Applies to**
|
||||
@ -20,11 +21,13 @@ ms.author: daniha
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!TIP]
|
||||
>If you're not familiar with the Windows 10 servicing or release branches, read [Servicing branches](waas-overview.md#servicing-branches) first.
|
||||
>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing Channels](waas-overview.md#servicing-channels) first.
|
||||
>
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
|
||||
Current Branch is the default servicing branch for all Windows 10 devices except those with the long-term servicing branch edition installed. The following table shows the servicing branches available to each edition of Windows 10.
|
||||
Semi-Annual Channel (Targeted) is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each edition of Windows 10.
|
||||
|
||||
| Windows 10 edition | Current branch (CB) | Current branch for business (CBB) | Long-term servicing branch (LTSB) | Insider Program |
|
||||
| Windows 10 edition | Semi-Annual Channel (Targeted) | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Home |  |  |  |  |
|
||||
| Pro |  |  |  |  |
|
||||
@ -40,7 +43,12 @@ Current Branch is the default servicing branch for all Windows 10 devices except
|
||||
>[!NOTE]
|
||||
>The LTSB edition of Windows 10 is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
|
||||
|
||||
## Assign devices to Current Branch for Business
|
||||
## Assign devices to Semi-Annual Channel
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
**To assign a single PC locally to CBB**
|
||||
|
||||
@ -96,7 +104,7 @@ Enrolling devices in the Windows Insider Program is simple and requires only a M
|
||||
After enrolling your devices, you are ready to install your first preview build. To do so, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Insider level. The device receives the most recent Windows Insider build for the Insider level you select.
|
||||
|
||||
The options for Insider level are:
|
||||
- **Release Preview**: Insiders on this level receive builds of Windows just before Microsoft releases them for CB. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs.
|
||||
- **Release Preview**: Insiders on this level receive builds of Windows just before Microsoft releases them for Semi-Annual Channel. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs.
|
||||
- **Slow**: The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build.
|
||||
- **Fast**: This level is best for Insiders who would like to be the first to experience new builds of Windows, participate in identifying and reporting issues to Microsoft, and provide suggestions on new functionality.
|
||||
|
||||
@ -110,9 +118,9 @@ To prevent devices in your enterprise from being enrolled in the Insider Program
|
||||
- Group Policy: Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\\**Toggle user control over Insider builds**
|
||||
- MDM: Policy CSP - [System/AllowBuildPreview](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx#System_AllowBuildPreview)
|
||||
|
||||
## Switching branches
|
||||
## Switching channels
|
||||
|
||||
During the life of a device, it may be necessary or desirable to switch between the available branches. Depending on the branch you are using, the exact mechanism for doing this can be different; some will be simple, others more involved.
|
||||
During the life of a device, it may be necessary or desirable to switch between the available channels. Depending on the channel you are using, the exact mechanism for doing this can be different; some will be simple, others more involved.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
@ -122,63 +130,63 @@ During the life of a device, it may be necessary or desirable to switch between
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">From this branch</th>
|
||||
<th align="left">To this branch</th>
|
||||
<th align="left">From this channel</th>
|
||||
<th align="left">To this channel</th>
|
||||
<th align="left">You need to</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left" rowspan="3">Windows Insider Program</td>
|
||||
<td align="left">Current Branch</td>
|
||||
<td align="left">Wait for the final Current Branch release.</td>
|
||||
<td align="left">Semi-Annual Channel (Targeted)</td>
|
||||
<td align="left">Wait for the final Semi-Annual Channel release.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">Current Branch for Business</td>
|
||||
<td align="left">Not directly possible, because Windows Insider Program devices are automatically upgraded to the Current Branch release at the end of the development cycle.</td>
|
||||
<td align="left">Semi-Annual Channel</td>
|
||||
<td align="left">Not directly possible, because Windows Insider Program devices are automatically upgraded to the Semi-Annual Channel (Targeted) release at the end of the development cycle.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">Long-Term Servicing Branch</td>
|
||||
<td align="left">Long-Term Servicing Channel</td>
|
||||
<td align="left">Not directly possible (requires wipe-and-load).</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left" rowspan="3">Current Branch</td>
|
||||
<td align="left" rowspan="3">Semi-Annual Channel (Targeted)</td>
|
||||
<td align="left">Insider</td>
|
||||
<td align="left">Use the Settings app to enroll the device in the Windows Insider Program.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">Current Branch for Business</td>
|
||||
<td align="left">Select the <strong>Defer upgrade</strong> setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Current Branch release.</td>
|
||||
<td align="left">Semi-Annual Channel</td>
|
||||
<td align="left">Select the <strong>Defer upgrade</strong> setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Semi-Annual Channel release.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">Long-Term Servicing Branch</td>
|
||||
<td align="left">Long-Term Servicing Channel</td>
|
||||
<td align="left">Not directly possible (requires wipe-and-load).</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left" rowspan="3">Current Branch for Business</td>
|
||||
<td align="left" rowspan="3">Semi-Annual Channel</td>
|
||||
<td align="left">Insider</td>
|
||||
<td align="left">Use the Settings app to enroll the device in the Windows Insider Program.</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">Current Branch</td>
|
||||
<td align="left">Disable the <strong>Defer upgrade</strong> setting, or move the device to a target group or flight that will receive the latest Current Branch release.</td>
|
||||
<td align="left">Semi-Annual Channel (Targeted)</td>
|
||||
<td align="left">Disable the <strong>Defer upgrade</strong> setting, or move the device to a target group or flight that will receive the latest Current Semi-Annual Channel release.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">Long-Term Servicing Branch</td>
|
||||
<td align="left">Long-Term Servicing Channel</td>
|
||||
<td align="left">Not directly possible (requires wipe-and-load).</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left" rowspan="3">Long-Term Servicing Branch</td>
|
||||
<td align="left" rowspan="3">Long-Term Servicing Channel</td>
|
||||
<td align="left">Insider</td>
|
||||
<td align="left">Use media to upgrade to the latest Windows Insider Program build.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">Current Branch</td>
|
||||
<td align="left">Use media to upgrade to a later Current Branch build. (Note that the Current Branch build must be a later build.)</td>
|
||||
<td align="left">Long-Term Servicing Channel (Targeted)</td>
|
||||
<td align="left">Use media to upgrade to a later Long-Term Servicing Channel build. (Note that the Long-Term Servicing Channel build must be a later build.)</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">Current Branch for Business</td>
|
||||
<td align="left">Use media to upgrade to a later Current Branch for Business build (Current Branch build plus fixes). Note that it must be a later build.</td>
|
||||
<td align="left">Long-Term Servicing Channel</td>
|
||||
<td align="left">Use media to upgrade to a later Long-Term Servicing Channel for Business build (Long-Term Servicing Channel build plus fixes). Note that it must be a later build.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -195,10 +203,10 @@ By enabling the Group Policy setting under **Computer Configuration\Administrati
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | Assign devices to servicing branches for Windows 10 updates (this topic) |
|
||||
|  | Assign devices to servicing channels for Windows 10 updates (this topic) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
@ -27,19 +27,21 @@ In the past, traditional Windows deployments tended to be large, lengthy, and ex
|
||||
|
||||
Windows 10 spreads the traditional deployment effort of a Windows upgrade, which typically occurred every few years, over smaller, continuous updates. With this change, you must approach the ongoing deployment and servicing of Windows differently. A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. Here’s an example of what this process might look like:
|
||||
|
||||
- **Configure test devices.** Configure testing PCs in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Current Branch (CB) servicing branch. Typically, this would be a small number of test machines that IT staff members use to evaluate prereleased builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device.
|
||||
- **Identify excluded PCs.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than CB or Current Branch for Business (CBB) can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these PCs, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly.
|
||||
- **Configure test devices.** Configure testing PCs in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Semi-annual Channel. Typically, this would be a small number of test machines that IT staff members use to evaluate prereleased builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device.
|
||||
- **Identify excluded PCs.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the Semi-annual Channel can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these PCs, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly.
|
||||
- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible.
|
||||
- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or System Center Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools).
|
||||
- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md).
|
||||
|
||||
>[!NOTE]
|
||||
>This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](../planning/index.md).
|
||||
>
|
||||
>>Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version.
|
||||
|
||||
Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful:
|
||||
|
||||
1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility.
|
||||
2. **Pilot and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have pilot groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your pilot groups running in the CB servicing branch that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it.
|
||||
2. **Target and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the Semi-annual channel that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it.
|
||||
3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department.
|
||||
|
||||
|
||||
@ -47,10 +49,10 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou
|
||||
|
||||
| | |
|
||||
| --- | --- |
|
||||
|  | [Learn about updates and servicing branches](waas-overview.md) |
|
||||
|  | [Learn about updates and servicing channels](waas-overview.md) |
|
||||
|  | Prepare servicing strategy for Windows 10 updates (this topic) |
|
||||
|  | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) |
|
||||
|  | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) |
|
||||
|  | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) |
|
||||
|  | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)</br>or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)</br>or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) |
|
||||
|
||||
|
@ -18,6 +18,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
Using Group Policy to manage Windows Update for Business is simple and familiar: use the same Group Policy Management Console (GPMC) you use to manage other device and user policy settings in your environment. Before configuring the Windows Update for Business Group Policy settings, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment.
|
||||
|
||||
In Windows 10 version 1511, only Current Branch for Business (CBB) upgrades could be delayed, restricting the Current Branch (CB) builds to a single deployment ring. Windows 10 version 1607, however, has a new Group Policy setting that allows you to delay feature updates for both CB and CBB, broadening the use of the CB servicing branch.
|
||||
@ -339,7 +344,7 @@ The **Ring 4 Broad business users** deployment ring has now been configured. Fin
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -19,6 +19,11 @@ ms.author: daniha
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products.
|
||||
>
|
||||
>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel.
|
||||
|
||||
You can use Intune to configure Windows Update for Business even if you don’t have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment.
|
||||
|
||||
Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build.
|
||||
@ -262,7 +267,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r
|
||||
- [Overview of Windows as a service](waas-overview.md)
|
||||
- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
|
||||
- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
|
||||
- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
|
||||
- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md)
|
||||
- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
|
||||
- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
|
||||
- [Configure BranchCache for Windows 10 updates](waas-branchcache.md)
|
||||
|
@ -30,7 +30,7 @@ See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-1
|
||||
Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
|
||||
The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility KBs are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
|
||||
|
||||
Windows 10 LTSB is not supported by Upgrade Readiness. The LTSB (long term servicing branch) of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not compatible with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-branch) to understand more about LTSB.
|
||||
Windows 10 LTSB is not supported by Upgrade Readiness. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not compatible with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSB.
|
||||
|
||||
## Operations Management Suite
|
||||
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
@ -105,7 +106,7 @@ Configuration for onboarded machines: telemetry reporting frequency | ./Device/V
|
||||
|
||||
1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Select **Endpoint management** on the **Navigation pane**.
|
||||
a. Select **Endpoint management** > **Client management** on the **Navigation pane**.
|
||||
|
||||
b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
|
||||
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: iawilt
|
||||
author: iaanw
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
Before Width: | Height: | Size: 75 KiB After Width: | Height: | Size: 105 KiB |
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
@ -7,6 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: iawilt
|
||||
author: iaanw
|
||||
localizationpriority: high
|
||||
---
|
||||
|