Hey guys welcome back this is Bernardo from the BTNHD and today is all about Windows updates
for business and let's get into it okay so what is Windows Update for Business so what
is WUFB Windows Update for Business allows an administrator to define Windows Update
servicing rings.
These are admin defined groups of machines where you can pre test some updates and decide
how quickly they receive updates types of rings would be the following.
You have a testing ring, pilot and a rollout now for testing this ring will have no delays
in updates as soon as they are released computers in this group would receive these updates
to test out now for pilot this group would be set to defer the updates for a few days
after the initial group will receive the updates.
Now the last group is the rollout would be the remainder of the systems within your environment,
updates will be set to differ and be installed few days after the second ring which is your
pilot ring.
Now why rings or groups, allows an automated way of pushing out updates to test groups
and pausing them if something doesn't set well within your environment if something
goes wrong, you're able to go inside the group or their policies which I'm going to show
you guys right now and then you're able to pause it so why use Windows Update for businesses.
Now don't get me wrong there is WSUS and that's what I like to use within my environment but
Windows Update for businesses is an automated process for those that don't have staff or
resources to manage WSUS or SCCM within their environment you're able to automate everything
and just forget about it the only time you actually have to touch it is when something
goes wrong and then you have to go in there and pause it.
Now to configure Windows Update for businesses is GPO group policies all the way.
Now the primary location for this GPO is actually located within Computer Configuration, Administrative
Templates, windows components, Windows updates, and then within Windows updates, you're going
to see Windows updates for business, I logged into my domain controller, and I'm going to
right click on the Start menu go to run, and I'm going to type in WINVER hit ok my domain
controller is actually running on a Windows Server 2019.
Right.
And I'm going to open up my Active Directory I already created the groups that I'm going
to actually add the computers inside this group so I could push out these updates, but
I created my pilot, my rollout, and my testing.
Now for the GPO to work correctly I am doing security filtering.
So, these GPOs are going to target these security groups.
Now within your Group Policy Manager create your GPO, the name for the GPO I kept it kind
of simple is the same as the Group Policy so I called it BTNHD pilot, rollout and testing,
I attached each GPO into an OU, you are able to base this on OU, but it really depends
on how you want to deploy within your environment.
Now, each GPO is based on a security filter.
So as you can see my pilot is being security filtered, only to be pushed out to the BTNHD
pilot security group.
The same thing goes with the rollout.
And the same thing goes with the testing.
So the security filtering for each GPO is based on that security group now we're going
to open up our testing policy, and within testing policies, like I said, Go inside Computer
Configuration and inside Computer Configuration you're going to go inside Administrative Templates
within there go to Windows components, go all the way to the bottom until you see Windows
updates, and within Windows Update you're going to see Windows Update for Business.
Now inside this folder you're only going to see three policies, and we're only going to
focus on two of them.
Now we're going to select the first one, and we're going to double click on it now this
one allows you to select when preview builds and feature updates are received.
We're going to enable it by default it's going to have preview built fast but you are able
to change it.
For this example, I'm going to change it to semi annual channel, and the days to defer
the update I'm going to set at zero again this is for testing once the updates are released.
I want my testing group to get it as soon as possible.
So the next one that we are going to configure is select when quality updates are received
so double click on it.
We're going to enable it from here I'm going to leave it as zero, I want this testing group
to receive the updates as soon as possible.
And the next policy is pilot.
Now for the pilot policy we're going to configure select when preview builds and feature updates
are received.
We're going to keep it as semi annual channel for for the days we are going to set it for
seven days.
Now I can't really tell you what's best practice within your environment.
So play around with this but for me, I'm going to set it for seven days again within the
pilot GPO, we're going to select when quality updates are received.
Make sure you enable it.
And for this, we're going to change zero to three days now for the last policy which would
be the rollout.
Once your testing group has test everything out, you push it out to your pilot.
Once your pilot is satisfied no issues, then you're going to roll it out to everyone.
Now from here again going inside the windows for update business node, you're going to
open up select when preview builds and feature updates are released, enable that.
Again, we're going to do semi annual channel, really depends on your environment, but this
is what I'm going to do within my environment, and for the days I'm going to change it for
30.
I think the max days that you are able to set within this GPO is 35.
And last but not least for your rollout you want to change select when the quality updates
are received enable it, and for this one I'm going to set it for seven days.
Now if you're having any issues with the policies, you're able to go and see one of the GPOs
and just pause the quality update starting a specific date, I think by default GPOs are
set to automatically update to the machines, about an hour or two hours you are able to
change it's not best practice to change when the GPO is being pushed out to machines.
But if you have any issues with any of these GPOs just go inside the GPO and then pause
the quality update to our starting point and that's it guys that is my take on Windows
Update for businesses hopefully you guys enjoyed this video make sure to hit that like button
also do not forget about punching, elbow and smashing that subscribe button to get the
latest and greatest from this guy, and I'll catch you guys on the next one.
Peace out.