Today we will look at the new Update Compliance Service in Windows Analytics.
Which gives you a unified view of the update and anti-malware
status of your Windows 10 devices
regardless of your management solution.
I will show you have you can use it to keep your devices secure and up to date,
track the overall protection and threat status,
and monitor your updated deployments and troubleshoot issues as they arise.
With Windows 10, we have developed solutions as part of Windows Analytics Service
that bring you the power of Windows telemetry
to help you lower your cost of deploying,
servicing and supporting Windows 10.
As an example,
Upgrade Readiness service helps you plan for Windows 10 upgrades
by helping identify and resolve app and driver compatibility blockers.
You can learn more on a previous Microsoft Mechanics demo bench
at the link below.
With Update Compliance which is our focus for today,
we look to keep devices
secure and reliable by keeping them up to date.
Let's start by looking at the dashboard.
You can see from the left
an overview blade with key metrics and alerts that you can act on.
We also surface key information on quality updates
and feature updates
that show you your overall compliance and deployment status.
And lastly,
we show you your protection and threat status
for devices that are enabled with Windows Defender Anti-virus.
To use Update Compliance,
you'll need to configure devices with Windows telemetry level minimum at Basic.
Here's an example of how you can do it in Group Policy,
but you can use the management option that you prefer.
Now let's go back to our dashboard starting with the OS alerts.
Here you can see devices
where Update is in progress and have been installed for more than a week.
We can also see devices
missing multiple security updates.
Although I don't have it here,
but here is where you can see devices with an OS running
past the end of support.
You can also do additional drill downs
to look at devices that fall in each of these categories.
Let's go back to the dashboard to look at the alerts for update failures.
This is where you can expect to see deployment failures
for quality as well as feature updates.
I'm going to click on the 1703 row
which is the latest feature update, also known as Windows 10 creators update.
We can go here and add a quick filter
to look at the deployment errors for this particular deployment.
As you can see from here,
devices have failed due to various reasons.
Some of them have failed because Windows Update is unreachable,
some devices have incompatible apps,
devices with disk errors and some devices do not have enough disk space.
So with this data, you can take the necessary actions within your management tool.
Coming back to the dashboard
lets take a quick look at the quality and feature updates sections.
This is where you can expect to see
devices that are kept secure and up to date.
Additionally, we also provide enhanced visibility
for security update deployments
to track whether the devices have the update installed,
if they have the update in progress or deferred,
if the updates failed,
or if there are devices with status unknown.
Moving on to the feature update section,
we give you similar visibility on the updated deployments
across all the Windows 10 releases
as well as all the servicing channels like the Current Branch,
Current Branch for Business,
and Long-Term Servicing Branch that you may have deployed.
Finally, lets look at how you can determine anti-malware compliance
for devices that are enabled with Windows Defender Anti-virus.
To get Windows Defender Anti-Virus insights,
you'll need to enabled cloud delivered protection on your devices
Here's an example of how you can do it with Group Policy.
You can find it under Administrative Templates,
Computer Configuration,
Windows Defender Anti-virus, Maps.
Coming back to the dashboard on the protection status view,
you can monitor if the devices are sufficiently protected.
Such as if the signatures are up to date,
as well as if the Real-time protection is enabled.
You can also do additional drill downs
to look at devices
with insufficient protection and take necessary actions within your management tool.
Another view on the dashboard is the threat status view.
Here you can look at the active viruses that were found and cleaned
and those that were not successfully remediated.
You can do an additional drill down to look at the devices
and the remediation status,
Here you can see the different threat errors which is why the remediation failed.
Things like Network issues,
Operation aborted,
Disk full, and File too large.
And once again, you can take this data
to take the necessary actions within your management tools.
So that was a tour of some of the insights available to you with Update Compliance.
Getting started with Update Compliance is easy.
If you already have Update Readiness up and running
like you see in this Workspace,
you can go to the OMS solutions gallery,
find the update compliance solution
and hit "Add".
Otherwise to get started
you can go to the Windows Analytics website
as I have it open here.
You can sign in as a new customer or an existing OMS customer.
If you sign in as a new customer,
You will need to first create an OMS Workspace.
Give it a name.
And choose the region you want the Workspace to be created in.
An email address and view the terms and conditions before you check the agreement box and click create.
Once the Workspace is created
it will ask you to link to an Azure subscription.
If you don't have one
you can create one by using the "Create New" button.
Since I have one, I'll go ahead and use it.
As Windows Analytics Solutions are either free
or attached to a Windows license
your Azure subscription will not be billed for using them.
Now like we see here,
you're ready to add the full Windows Analytics suite
Or select "Update Compliance" as an individual solution.
An important tip.
Once you have on-boarded the full Windows Analytics suite,
or added Update Compliance Solution
you will need to copy the commercial ID from your OMS Workspace.
You can find the commercial ID in your Workspace settings.
Connected sources.
Windows Telemetry.
All you need to do is copy the commercial ID from your Workspace
and then deploy to your devices.
Here's an example of how you deploy Commercial ID using Group Policy.
You look under the Computer Configuration, Administrative Templates,
Windows Components, Data Collection and Preview Builds.
And look for "Configure the Commercial ID" field.
You can copy the commercial ID that you obtained from your Workspace.
And then click OK.
So that was an overview of Update Compliance
part of Windows analytics.
Coming soon, you can expect seamless integration with Microsoft Intune.
As well as insights on delivery optimization.
Update Compliance will be generally available later this year
You can learn more and join this preview today at the links below.
Thanks for watching.
Microsoft Mechanics
www.microsoft.com/mechanics