Device Management

You have learned about remote administration and jump server configuration for troubleshooting, deployment, and general work-use scenarios in the previous chapters. In this chapter, we’ll look at the new mobile device management (MDM) capabilities of Windows 10 and 11, discuss caveats of the Windows 10/11 Group Policy Object (GPO) processing, and have a deeper look at patching and servicing, including the deployment solutions of the needed quality and feature updates such as Windows Update for Business (WUfB), Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager (MECM) (aka System Center Configuration Manager, or SCCM), and third-party solutions.

In this chapter, the following topics will be covered:

• Evolving business needs
• MDM
• Changes to GPOs in Windows 10/11
• Servicing and patching
• Update deployment solutions

Evolving business needs

According to Forrester Research, mobility is the new normal. Information workers will erase the boundary between enterprise and consumer technologies, and therefore mobility is certainly a defining vector in the evolution of the new business world. 56% of information workers send their first email before getting to the office, and 73% send their last email after leaving the office. 52% of information workers are using 3 or more devices for work.

Business needs are evolving with the new Industry 4.0, from employees working Monday to Friday, 9 to 5 toward a 24/7 blur of work and personal activity; from computers on a local area network (LAN) corporate network toward multiple devices, anytime, anywhere; and from on-premises applications and file hosting toward Software-as-a-Service (SaaS) applications and cloud-based file hosting.

With the onset of the pandemic in 2020, the world of work has changed for good. Working from home or remotely, a variety of video...

MDM

When discussing MDM, we need to look back in time to understand its origin and some of its limitations. Back in June 2002, the non-profit organization Open Mobile Alliance (OMA) was formed. OMA was merged with the Internet Protocol Smart Objects (IPSO) Alliance and rebranded to OMA SpecWorks (for more information, visit https://packt.link/LPlLG). The OMA Device Management (OMA DM) specification was originally designed for the management of mobile devices such as mobile phones, tablets, and personal digital assistants (PDAs). It was intended to provision and configure devices and enable software updates and fault management. There is a fixed set of OMA-DM protocol commands all vendors support. Currently, Windows 11 22H2 and higher supports MDM protocol version 14.0 (for more information, visit https://packt.link/raIgs).

MDM configuration objects are stored in a so-called OMA Uniform Resource Identifier (OMA URI) (for more information, visit https://packt.link/4VuZ4). You will...

Changes to GPOs in Windows 10/11

Besides the major changes to MDM management, there are also changes to the GPO processing of Windows 10/11, which were first introduced with Windows 10 and will be covered now. These changes begin with GPOs only applicable to certain stock-keeping units (SKUs), known issues when upgrading your central policy definition store, and known issues when editing new GPOs, including GPPs with the old Group Policy Management Console (GPMC).

Enterprise- and Education-only GPOs

There have been policies that apply only to Windows 10/11, but for the first time ever in Windows history, there are also now GPOs, since Windows 10, that apply to certain SKUs only. Several GPOs for customizing Windows 10/11 apply only to Windows 10/11 Enterprise and Education SKUs. At the time of writing this book, the following GPOs have such a restriction:

• Configure Spotlight on the lock screen
• Turn off all Windows Spotlight features
• Turn off Microsoft consumer...

Servicing and patching

When we talk about changes to the way to service (or patch) Windows, it’s important to first understand how things worked with Windows 7 and Windows 8.1. Each month, Microsoft released somewhere between 1 and 20 individual fixes for each one: some security updates, and some non-security updates. Most of these patches were General Distribution Release (GDR), meaning available on Windows Update (WU), WSUS, and Windows Update Catalog. Some patches were released under Limited Distribution Release (LDR) (also formerly known as Quick Fix Engineering (QFE)). LDR packages contain other fixes that have not undergone such extensive testing and resolve issues that only a fraction of the millions of Windows users might ever encounter. These LDR patches need to be downloaded on separate KB pages or sometimes requested from Microsoft services.

Most organizations deploy security fixes right away. But the non-security fixes sometimes aren’t deployed at all,...

Summary

In this chapter, you learned about the new MDM capabilities and changes in GPO processing of Windows 10/11. In the servicing and update part, we discussed the different update delivery solutions and gave recommendations for building servicing rings to keep up with the fast Windows 10/11 release cadence. With the options presented, you should now be able to set all the necessary settings for successful and smooth patching, planning release rings, and optimizing patch traffic regardless of whether you are still on-prem or already modern with MDM/Azure AD. Please use, if possible, the presented possibilities for testing preview builds to be best prepared for new Windows versions.

In the next chapter, we will have a closer look at protecting enterprise data in bring your own device (BYOD) scenarios.