(calm music)
- Coming up we'll take a closer look
at Windows updates and what you can now do
from the Endpoint Manager admin center from the Cloud
to stay in control of how updates are delivered
and your granular options for when they get installed.
And to walk us through everything,
we're joined once again by Jason Githens
from the Windows management team at Microsoft.
Welcome back to the show.
- Thanks, happy to be here.
Looking forward to this. - Thanks, Jason.
Last time you were on the show we actually covered
the evolution of Windows device management
and what gets better when you move to the Cloud.
And if you miss that show, you can check it out
at our playlist at aka.ms/ManagementMechanics.
As we started looking at update management,
at the time you said we could do an entire show on that.
So here we are, we're literally doing just that,
an entire show on update management.
- Yeah, I'm really glad we have time to dig in this.
It's a big topic
and it's a fundamental part of Windows manageability.
The good news is that there are a lot of new options
to manage Windows updates from the Cloud.
And if you haven't looked at Windows Update for Business
in a while, I think you'll be surprised about the amount
of control there is now through Microsoft Endpoint Manager.
- And today we're really going to focus in
on both Windows quality updates,
the ones that are published monthly that deliver
security updates as well as bug fixes,
as well as Windows feature updates,
which deliver new features
and are delivered less frequently.
And a lot of us are probably using
Configuration Manager right now to deliver updates.
So for anyone who's watching and wondering
what's the right time, or is now the right time
to move to Cloud-based update management,
can you describe what some of the differences are?
- If you're using Configuration Manager now,
although there's granularity and control,
it can be a lot to manage and track
as you update your Windows devices.
And you're probably running a lot of infrastructure
to maintain service levels and uptime.
As we talked about in the last show,
while most devices today are connected to the internet,
as people work more hybrid they're connecting
less frequently to corporate networks.
So Cloud-based updates makes a lot of sense now,
especially if you need to deploy
security updates fast and reliably.
Plus, a lot of the pain goes away for the processes
used to manage updates when moving
from on-prem to the Cloud, but let me start with the pain
and show you how things get better.
I have Configuration Manager running here.
I'll go to Configure Site Components,
then Software Update Point.
In Classifications you can see
I have Security Updates selected and that's pretty common.
In the Products tab I need to choose which products I want
and even when I get to Windows products
there are a ton of products to sift through and approve.
And once everything is synchronizing
with the update service, you'll see this long list
in all software updates that I need to approve and deploy.
So as you can see, there are quite a few
hoops to jump through to curate your Windows update service
based on your organizational needs.
- And while you can set up automatic rules
if you wanted to, using Config Manager, those still
need to be created and monitored and maintained
just to make sure they're all working properly.
- Exactly, so let me show you
the path to making things easier.
Because in Cloud we curate the updates for you,
and it's typically faster to just have these updates
delivered directly from the Windows Update Cloud Service
following the policies you set in Endpoint Manager.
The first thing you'll need to do is set up
co-management for Config Manager using Cloud Attach.
And we have an interactive guide that steps you
through the process at aka.ms/CloudAttach.
In this case, I've already configured Cloud Attach.
So now I just need to configure it so that
Windows update policies are managed via Intune.
In my environment I'll go into its properties.
I'll go to the Workloads tab and you can configure
which services are authoritated
for different management control categories,
either Config Manager or Intune.
And then in Windows Update Policies
I can move this slider here to allow Intune
to manage Windows updates.
- And what you just did with that slider is going to open up
a ton of new possibilities in a new universe
for Cloud-based Endpoint Manager update policy options.
- Absolutely, it does.
And once you know how these work
and how each policy works together,
you'll see there's a lot of control.
In Endpoint Manager's device settings for Windows,
you'll see three different Windows update policy options.
And even though two of them say Preview,
these are fully supported and production ready.
I'll create one for each of these in a second.
Importantly, all three policy types
have an install before date,
enforced by a deadline and a short grace period,
for when updates need to be finalized.
And let me take a moment to explain how this works.
If the deferral dates you set
for your update ring policy and Feature Updates
or Quality Updates don't line up, remember this.
For Feature Updates to minimize disruptions,
the policy with the install by date furthest out will win.
Whereas for Quality Updates, to ensure security fixes
are installed as soon as possible,
the policy with the closest date wins.
- And I think this is going to make a ton more sense
once we start to create a policy for each different type.
Even though a lot of us might have been focused in
on that one for Quality Updates,
of those different three options, its job, really,
is just to speed up deployment of security fixes
in some cases where your broader update ring policies
might be a bit too relaxed for that particular month.
- That's right, based on how each policy relates to another.
We really need to start with an update ring policy,
then feature update policy,
and end with a quality update policy.
The update ring policy has the most options and controls.
So let me start by creating a new update ring.
I'll name it Default Update Ring.
Here I can choose, if I want, all Microsoft updates,
as well as drivers, then these next
couple of deferral settings are super important.
Think of them like, 'Pause updates until this number of days
after the update is published in Windows Update.'
For quality updates, I can set a deferral period.
And this should be based on how much risk
you're willing to take by delaying the update.
Typically we see something between 0 and 10 days.
Now don't worry if you set this to 10 days, for example,
and there's a quality update
that you need to roll out faster.
We'll get to that option in a minute
when we go through the quality update policy options.
Now let's continue with feature update deferral.
We recommend setting the deferral here to zero days.
I know that might sound scary,
but we'll also come back to this topic in a second
when we get to the feature update policy.
As I move down this screen,
you'll also see how long we keep the option open
to uninstall feature updates when the period expires,
which will free up that disc space.
- And this next set of options that are under
Update Behavior are another area where controls
tend to get a lot smarter if you're coming from,
for example, Config Manager or WSUS.
No one likes an unexpected forced reboot.
And these next set of settings will actually help with that
- True, and there are quite a few options,
but I'll point to the best ones for most organizations.
First, for automatic update behavior
we recommend the reset to default option.
This sets up devices to automatically scan
each day for updates and uses the built-in
Windows intelligent active hours to determine timeframes
when people aren't typically using their device.
It also gives each user the opportunity to set
the best active hours for themselves so that their device
doesn't restart while they're working.
If you have a case where you need to
set specific active hours,
use the Auto install and restart at maintenance times,
and set the active hours start and end times.
Then the last setting
we recommend you configure are the deadlines.
These are different than the deferrals.
We recommend that you allow them.
Deadlines of the period of time after the deferral
and until the update is installed.
And as you probably know, for a cumulative quality update
to fully install, Windows needs to reboot.
So we also have a grace period for that reboot to occur
and how long a user can delay that before it's enforced.
Until then, the end user is notified daily
and can specify a reboot time and the system
will try to reboot outside of active hours.
Most organizations are typically setting
the feature update deadline to seven days,
the quality update deadline to three days,
and a grace period of two days as well.
Now to finish out this policy, you can optionally set tags.
I'll skip that.
Then I can assign the policy to the right device group.
I'll go ahead and choose all devices.
From there I can review and create the policy.
- And if you're thinking this one policy isn't currently
set up to roll out feature updates over time,
now we're going to actually get to that option
with the feature update policy.
- We are, and I only showed how you'd set up
your default update ring policy.
But you would want to set up other rings.
And going back to our feature update deferral of zero days,
it probably sounded like a leap of faith,
but it'll make sense in a second.
I'm going to create a feature update policy profile.
I'll give it a name: Windows 10 21H2.
Here, you can see the name of the feature update
we want to target with this policy.
I have all the supported feature update options here
for Windows 10 and a Windows 11 option, too.
- And I really like that these aren't
the long build or version numbers,
just the normal feature update names.
As you can see, though, with that policy update,
it's just one feature update per policy.
You need to edit that or create a new one
to deploy subsequent feature updates.
- That's by design.
Now let's override that zero days deferral policy
we set for feature updates before
and push that time out to the date we want.
As long as this policy has the same devices in scope
and it's further out in the future
than the number of deferral days you set
in the update rings policy, it'll win.
To do that, in the rollout options I need to choose
an option that specifies an exact date.
In our case, our fiscal year ends on June 30
and people are super busy leading up to that day,
so I'll set this to be mid-July as a low-activity date
that should be least disruptive.
And if you want to roll out your feature update
gradually over time to extend the change management period,
you can set a first group availability date
and a final group availability date.
I'll choose to roll this out over a month
with seven days in between groups
so everything happens in waves or rings.
We will calculate these groups in the back end.
Here, either option of course
will use delivery optimization so that update files
are shared between managed peers on the same local network.
And once you've configured the deployment settings,
the rest of the steps are the same
as the update ring I created before.
- Okay, so now it comes down to just that one
final update policy for quality updates
that we said we'd come back to.
Why don't we explain how you'd use that one?
- The easiest way to think of quality update policies
are like break glass policies, to override
your normal update ring settings and get security updates
delivered as soon as possible, even if it means
forcing a reboot on a user during business hours.
So I'll create one now and name it June 2022.
This dropdown lets me choose the update level
the device needs to have for policy enforcement.
You can see it goes back three months.
The top option is the most aggressive one,
meaning that even devices that received
last month's quality updates will get this one fast.
And this is basically setting the deferral period
and the deadline of the quality update
to zero days in this case.
Then you have a restart enforcement,
which was our grace period from before.
And that can be zero, one, or two days.
Typically one day is a good choice,
which is why it's the default.
Then to finish off the policy
you set tags and group assignments like the others.
- And importantly here, that quality update profile
works together with normal update ring policies.
So once you configure these policies, how do we make sure,
then, that all of your policies get applied,
that the devices are compliant and ready to go?
- Sure. You can use compliance reports for that.
To do that, first you configure compliance policies
so that reporting knows what to look for
and you can see I have a few here already.
From here I can head over to my reports and find my devices
that are out of compliance, meaning if they don't have
a minimum update level, for example.
I'll navigate to the device compliance report.
And I can see that most of my devices are up to date
with the exception of this device.
It looks like it's running an
out-of-date version of Windows 10.
So now I can reach out to Adele
and troubleshoot what's going on with their device.
- So we've covered a ton of ground today in terms
of update management and also your tooling options.
So for anyone who's watching right now looking to learn more
or maybe update their updating process,
what do you recommend?
- So for using WSUS or Config Manager
to manage all of your updates, I'd encourage you to start
testing out some of the update policies we showed today.
And if you're on Config Manager,
check out aka.ms/CloudAttach to get our interactive guide
that walks you through all the steps to connect
your on-prem infrastructure to the Cloud.
- Thanks Jason, for joining us today
and also sharing all the new info on update management.
Of course, keep following our series
at aka.ms/ManagementMechanics for more on Windows management
and subscribe to Microsoft Mechanics if you haven't already.
And thank you so much for watching.
(chill music)