Blog

Windows Update For Business – Update Rings

In this post we will focus on Windows Update For Business – Update Rings. We will learn about settings that are included in the process of creating update rings. There are many settings available and it can be really confusing what each setting do. I will try to explain in an easy way with some good practical examples. At the end I will include some good practices that you can consider when creating update ring on your own.

UPDATE SETTINGS

Servicing channel tell us how often updates are delivered to users for deployment. For example Semi annual channel delivers feature updates twice a year. In addition to the Semi annual channel service channel, Insider Channel is available and its separated into three categories.

• • Insider Preview FAST – Dev Channel
  • Insider Preview SLOW – Beta Channel
  • Insider Release Preview – Release Preview Channel (DEFAULT Insider Channel)

Insider channels are often used for testing new technology/updates before deployment to production.

Microsoft product updates – Enable or Disable updates for other Microsoft Products.

Windows Drivers – Enable or Disable us getting new drivers through Windows updates.

Quality update deferral period – Specifies in how many days quality updates will available for installation after being released from Microsoft. For example, Microsoft releases update on Tuesday and if deferral period is set to two days, update will be visible on Friday. Note – if we are using multiple servicing channel including Insider Preview, its recommended that deferral period is shorter because updates have already been tested.

Feature update deferral period – Specifies in how many days feature updates will available for installation after being released from Microsoft. For example, Microsoft releases update on Tuesday and if deferral period is set to two days, update will be visible on Friday. Note – if we are using multiple servicing channel including Insider Preview, its recommended that deferral period is shorter because updates have already been tested.

Set feature update uninstall period – Specifies how many days we have option to uninstall last feature update.

USER EXPERIENCE SETTINGS

Automatic update behavior specifies when and how updates will be installed. Different options are available:

• Auto install at maintenance time – Automatically download and install the updates. Restart is not automatic, users must confirm restart prompt.
• Auto install at maintenance time and restart – Automatically download and install the updates. Restart is automatic and is based on active hours. If active hours are not specified, automatic restart can happen immediately after updates installation.
• Notify install  – Notify users before downloading and installing the updates. User action is required for downloading and installing updates. If the user takes no action, the update will not install until deadline.
• Auto install and restart at scheduled time – Automatically download and install the updates. Restart happen at scheduled time.
• Auto install and reboot without end-user control – Automatically download and install the updates. Device is automatically restarted outside working hours. If active hours are not specified, automatic restart can happen immediately after updates installation.
• Reset to default – Restore the original auto update settings on machines that run the Windows 10 and Windows 11. This original settings allow device to automatically determine active hours based on device activity.

Active hours start/end – It defines work hours in company. During this time period updates won’t be affecting computers (download/install updates, reboot).

Restart checks – Check if computer status is optimal for reboot. For example check for the following criteria: battery level, game mode, presentation mode etc. If computer status is optimal computer will restart.

Option to pause Windows update – Allows users to manually pause the updates.

Option to check for updates – Allows users to manually check for updates. For example user can check for new update before it is required. Note: which updates will be available after checking depends on service channel and deferral period.

Require user approval prior to dismiss restart notification – Gives user permission for dismissing the restart of computer, if no action given the device will restart. Note – User can dismiss restart even if active hours are specified and are already over.

Remind user prior to required auto-restart with dismissible reminder (hours) – Reminds users for auto-restart. Users can dismiss restart (for certain number of hours).

Remind user prior to required auto-restart with permanent reminder (minutes) – Reminds users for auto-restart. Users cannot dismiss restart anymore (restart will happen in less than one hour). Note – This if final reminder before reboot and cannot be canceled anymore.

Change notification update level – Specifies which Windows updates notifications users see

Use deadline settings – Tells us when installing updates is required and cannot be postponed anymore. Deadline settings are very important because enables administrators to force installation of updates if users ignoring that.

There are three sub deadline settings

• Deadline for feature updates – Specifies the number of days that user has before feature updates are installed on their devices automatically.
• Deadline for quality updates – Specifies the number of days a user has before quality updates are installed on their devices automatically.
• Grace period – Defines amount of days after deadline that updates will be installed and device will restart. For example if grace period is set to 0 days, device will be rebooted immediately after deadline is over. Note – Recommended settings is 0 or 1 day because users had have enough time to install updates.

Restart before deadline – If updates are downloaded and ready before the deadline, the computer will try to restart and install the updates before the deadline (outside working hours). In the second case (if set to NO), there will be no restart before the deadline until the user allows it.

MY TIPS:

For smaller companies with small number of users, insider channels are not that crucial.

For bigger companies with bigger number of users, insider channels are recommended because in insider rings users are already testing new updates. So time for deploying updates to production is shorter, because updates already been tested.

Deferral time should be as short as possible, so users get updates regular.

It is necessarily to get good knowledge about company in which you implementing Windows Updates especially getting information about current update policy. It is necessarily to listen for users feedback for configuring the most optimal update policy.

USEFUL LINKS:

Windows for Business Update settings for Microsoft Intune | Microsoft Docs

Introducing Windows Insider Channels | Windows Insider Blog