Chapter 11: Managing Updates

It is a considerable challenge keeping computer systems secure from external threats, such as malware and hackers. For earlier versions of Windows, with the Windows Update app, you could determine whether the Operating System (OS) was updated automatically with new functionality, security updates, and improvements. Many users opted to disable the Install updates automatically option, which made their systems vulnerable to attack.

Windows 10 changed the game in terms of updates and reliability, as new updates are now rolled out frequently. These updates are automatically downloaded and installed by Windows Update.

The following topics will be covered in this chapter:

• Selecting the appropriate servicing channel
• Configuring the Windows Update options
• Checking for updates
• Validating and testing updates
• Troubleshooting updates

By providing you with the skills to learn several key strategies to keep Windows 10 up to date,...

Technical requirements

In this chapter, you will see that we use PowerShell code. This code is available on the GitHub page: https://github.com/PacktPublishing/Microsoft-Exam-MD-100-Windows-10-Certification-Guide/tree/master/Chapter11

Throughout this chapter, you will need to follow some steps to configure settings. All of the steps covered in this chapter that you will need to follow have also been recorded. You can find those videos at https://bit.ly/2LsQDqD.

Selecting the appropriate servicing channel

New versions of Windows are usually released every couple of years. The introduction of these new versions to an organization then becomes a project, either by using a wipe-and-load process to install the latest version of the OS on, existing machines or by transitioning, as part of the hardware replacement cycle, to the newer version of the OS.

Either way, it takes a tremendous amount of time and energy to complete specific tasks. A new configuration has been introduced to Windows 10. This new model, called Windows as a service, allows organizations to reconsider how they implement and update Windows. Updating Windows is no longer a project that occurs every couple of years, but is in fact, now a continuous cycle.

In this section, you will get to know Windows as a service, how you can select the appropriate servicing channel for your organization, and how you can distribute the updates with deployment rings.

Getting to know Windows...

Configuring the Windows Update options

You will be able to customize the Windows Update settings after you have planned your deployment rings. You can do this either on a per-computer basis, using the Settings app, or by using GPOs to configure computers that are AD DS domain-joined.

To configure the Windows Update settings on an individual computer, follow these steps:

1. Open Settings | Update & Security option. The following screenshot shows the window that will show up:

Figure 11.2 - The Windows Update settings

As you can see in the preceding screenshot, there are several options that you can configure, including the following:

• Pause updates for 7 days: As of Windows 10 1903, this setting will pause Windows updates for 7 days, but before Windows 10 1903, this setting was set to a value of 35 days. So, when you click on the Pause updates for 7 days option, the following screen is displayed:

Figure 11.3 -...

Checking for updates

Typically, manually checking for updates isn't required on Windows. You can do this quickly by following these steps:

1. Open Settings | Update & Security option.
2. Click on the Check for updates button on the Windows Update page, as shown:

Figure 11.5 - The Check for updates button

Windows connects to Windows Update and gets a list of any updates that are pending, as you can see in the following screenshot, where an update is downloading:

Figure 11.6 - Downloading an update from Windows Update

If updates are available, they start downloading and installing automatically, even if you have configured settings in a GPO to only notify you of downloading and installing.

You have now learned how to check for updates manually. If any updates are pending, then these updates will be downloaded and installed.

In the next section, we are going to learn how you can test and validate updates.

Validating and testing updates

You need to know how updating Windows will affect users' devices. Therefore, you need time to verify and check the changes before they are made available to your organization.

We have already discussed how to use a servicing channel to build the notion of deployment rings, along with deferment values. Using deployment rings helps you to get and check potential updates before continued deployment.

You can also consider using additional services to distribute updates to Windows, rather than relying solely on Windows Update servers. You can choose between the following deployment tools to spread the Windows updates in your organization:

• Windows Server Update Services (WSUS): This is a server role for Windows Server 2019. WSUS downloads updates from servers running Windows Update. You can then customize how it propagates these changes to your client computers. This gives you time to check the changes and verify them.
• Windows Update...

Troubleshooting updates

If a system does not receive updates, then you have to review the Settings app and group policy settings. We have to review them to ensure updates are not deferred or paused.

So, to troubleshoot, in this case, you have to check that the two Windows Update services are running—namely, the Windows Update service and Background Intelligent Transfer Service.

You can find these services in the Services snap-in. Use the following steps to find that snap-in:

1. Click on the Start icon.
2. Type in Services.msc.
3. Then, click on Services.
4. The Services snap-in will open, as shown:

Figure 11.7 - The Services snap-in

In the previous screenshot, you can see all the services that are available on Windows 10. To use the troubleshooter, you need two specific services from the list, which are pointed out in the previous screenshot. These are the Windows Update service and Background Intelligent Transfer Service (BITS).

...

Summary

You learned, throughout this chapter, that it's essential to keep your Windows 10 devices up to date. You learned what the term Windows as a service is and that there are three servicing channels that you can use in your organization. By using deployment rings in your organization, you can have control over the deployment of your updates. You can configure deployment rings with GPOs or with Microsoft Endpoint Manager.

You can now configure Windows Update on a machine via a GPO or Microsoft Endpoint Manager. You can also change the active hours, pause any updates, or view the update history. You now know about the various ways of finding and solving upgrade problems using different techniques, as well as which resources are important for Windows Update to update properly. Also, you now know how to uninstall and roll back updates in different ways.

You learned that you can configure delivery optimization to speed up the downloading of updates to client computers. Furthermore...

Questions

1. Can anyone opt into the Windows Insider Program?
2. Is the Semi-Annual Channel (Targeted) a valid servicing channel?
3. If you manually check for updates, can you install the updates at a later time?
4. Is it necessary to test and validate updates before you deploy them to the rest of your organization?
5. Are Background Tasks Infrastructure Service and Windows Update services critical for Windows updates?

Further reading

• Overview of Windows as a service: https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview
• Build deployment rings for Windows 10 updates: https://docs.microsoft.com/en-us/windows/deployment/update/waas-deployment-rings-windows-10-updates
• Delivery Optimization for Windows 10 updates: https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization
• Windows Server Update Services (WSUS): https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus
• Deploy updates using Windows Update for business: https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb
• Learn about Configuration Manager: https://docs.microsoft.com/en-us/configmgr/core/understand/introduction
• Microsoft Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) provider for your devices: https://docs.microsoft...