S01E05 - Configuring Windows Update for Business in Microsoft Intune - (I.T)

Steve and Adam discuss and configure Windows Update for Business in Microsoft Intune.
00:00 - Intro
00:39 - Microsoft Endpoint Management admin center
aka.ms/dmac
00:55 - Manage Windows 10 software updates in Intune
docs.microsoft.com/intune/win...
16:36 - Discussion around Delivery Optimization
docs.microsoft.com/intune/del...
20:07 - How long does it take for devices to get a policy, profile, or app after they are assigned?
docs.microsoft.com/intune/dev...
22:53 - Intune and device management discussion
28:34 - Recap
Visit our websites and social media for more or to get in touch with us
Steve Hosking - Microsoft MMD Team
/ onpremcloudguy
steven.hosking.com.au/
mvp.microsoft.com/en-us/Publi...
github.com/onpremcloudguy
Adam Gross - Microsoft MVP - Enterprise Mobility
/ adamgrosstx
www.asquaredozen.com
github.com/AdamGrossTX
mvp.microsoft.com/en-us/Publi...
Ben Reader - Microsoft MVP - Enterprise Mobility
/ powers_hell
www.powers-hell.com/
github.com/tabs-not-spaces
mvp.microsoft.com/en-us/Publi...

[@dannoble3477]

Great content, guys! Usually fall asleep during tutorials, but your presentation style is very engaging!

[@llamadrama2256]

Just found your channel and am new to Intune, but really engaged already and just awesome content, thanks Steve & Adam

[@jayasenan]

Love your videos. Please keep them coming. You're making things understandable and easy for the admins out there.

[@Jmar123]

Shout out to Dom!!! Good hearing your voice at the end. Keep up the good work guys. I have a lot of videos to catch up on but am very excited to continue in this series.

[@tony6626]

Started following this series, really great stuff guys - thanks for putting this together.

[@benwiln5244]

Chaps these videos are really really helpful! Thanks for uploading them!

[@samiijay93]

Stumbled on your content by accident, had no intention of staying around and watching an entire 30 minute video but your online chemistry and teaching style is awesome and engaging. Well done bros! You've got another subscriber.

[@mikegaudreau5853]

I have a seminar tomorrow on VPN & split tunneling, SCCM, and patch management....I wish we could use Intune. So amazing. Thanks so much for the videos. Well done!!

[@johndoucette444]

Good content. Well presented.

[@-dash]

Getting ready to take the MD-101 and this is helping a ton!

[@Sendefehler09]

Thanks to you, helped me a lot. Keep it up!

[@michaelwaterman3553]

Another good explanation, thanks.

[@erickm119]

Awesome work and a great team. you got a new subscriber! :-)

[@Anarchyontheweb]

Could we get a Delivery Optimization settings themed video?

[@microsoftsarker]

Thank you for the information

[@jusdesireable3224]

Just finding this, do you guys have an updated version to this with newer view?

[@TotalCoreDump]

Is there a way to pause the feature update to one particular update for example I don't want my clients to beyond 1803?

[@jueliang]

Hey Steve and Adam show, thanks for posting such great contents. Question about the Windows update: I am setting up kiosk device in Intune with Autopilot. Does the kiosk device automatically has a slower update cycle? If not, how can we configure the update policy for kiosk with minimum Windows update close to a LTSB device? Thank you.

[@_dh88]

Is there ever a scenario where you would assign an Update Ring to a user group ?

[@samsthoughts6867]

I have a question regarding managing Production devices vs Pilot devices. If I have e.g. 4 update rings. Do I pause three of them until my pilot update ring has been tested? Then once we are happy, continue with the next ring, and so on?

[@antons9685]

you guys rocks

[@Gary-ev3vl]

Hi would it be possible to disable the "Check for updates" on client computer and let the auto it happen automatically? THanks

[@ankur9952]

When Microsoft product update is allowed while creating update ring then this apply to office products as well ? Do we need to create separate policy for office updates ? or existing Win10 Update ring is sufficient ? In case if we still create another policy for Office updates using admin template then which policy will take precedence.

[@michaelheagerty3301]

Hi Steve and Adam, really liking your videos, and thank you for your time and effort. keep it up :) I do have a question for Intune Windows updates. Is there support / alternative solutions for Windows Servers? And is there a way to block specific updates or by category (security, critical, etc)?

[@IntuneTraining]

Unfortunately you can’t manage Servers with Intune today. The new Tenant Attach feature of ConfigMgr will let you take some actions and deploy security settings through ConfigMgr to Servers, but nothing related to software updates for servers in Intune.

[@TheMistashmoe]

How long after you create the Ring, add machines and then sync the policy does the machine start downloading windows updates?

[@sunilpal7933]

In some scenario i have observed windows 10 device are getting feature upgraded from 1809 to 1909 even if we kept feature deployment settings to Windows 10 1903.Any suggestion.

[@TheMistashmoe]

Is there a way to verify updates have been installed and see if any have failed?

[@abdullahulu1425]

Hey Steve and Adams, Thank you for this awesome training series. As I understand from the Update Rings, its a great way to follow the major annual updates. What about the urgent security or other system patches for Workstations/Servers? Can you share with us how we can easily and instantly respond for the urgent patch updates?

[@Mike_Hartman]

That would fall under the "Quality update" policy. These are your monthly security updates, service stack, adobe flash security updates, etc.

[@avinashgowda1412]

Hey Guys.. Would you please make a video on Update Compliance and pulling Update reports on Power BI. I am sort of stuck in analyzing and generating reports on Updates. Desktop Analytics is way more general and doesn't get me in deep analysis of update status. Thanks in advance.

[@freshnerfresnido9413]

Good day. Thanks for this but can I ask? you mentioned having groups of phase deployment so in this video, you created the first group which is the pilot group. How do you deploy the remaining groups? Do you create a new policy?

[@IntuneTraining]

Yes, create a new policy for each group.

[@bruhatthedesk5118]

Gentleman, I am at an absolute loss and need some advice. I paused updates for all of my users, and re-enabled them at a suitable point. Now, they are still saying "Updates are paused from your Company"

[@HealthywithDev]

I followed all steps mentioned by you but when i check device status in update ring policy deployment status is showing Not Applicable, no update folder created in registry, VDI windows version is 22H2, can you please help on this?

[@Residentq3]

As an SCCM guy i have tons of questions. So if you have an environment with windows 10 pro and not enterprise, there is no brancecache support, when you deploy to your machines, everyone goes through the internet to download the updates? What about reporting afterwards? Can you choose specific updates if you only wanna deploy the servicing stack update? What about new machines that has not recieved policy yet, they will just download and install updates, before synced and intune policy, that comes with an update deployment? Would you be able to specify the zone for MS updates to the intune platform before that via GPO? Got many questions.

[@IntuneTraining]

This video may not help, but we just released it and it covers the Feature Update Preview feature to let you lock in at a certain patch level. Intune.Training - Episode 30 - Configuring Windows 10 Feature Update Policies in Intune kzbin.info/www/bejne/gJe2oXeMr6ZlebM You will be leveraging UUP and Delivery Optimization that’s built into the OS. The experience will be basically like a home user gets. You set up groups that become your phased deployment rings then you create a policy for each ring with specific deferral periods set so that you can space them out. Reporting isn’t great at this point but it’s being worked on.

[@robertmmurraysr]

I know this is an older video and I have watched a number of the videos on the same topic. I am working for a company where I inherited a number of PCs that were brought into our environment through acquisitons and years of different methods to configure and update windows. I currently have the environment co-managed and have 4k PCs that are now being configured and updated via Intune 90% of the time. But I have some PCs that are stubborn and will not update even though they have synced with Intune. I am assuming this may have something to do with the quality of health of the PC as they migrated from previous environments that were using WSUS or SCCM. I have already checked their health with the standard practices and they look good. Any ideas on what video I can look at from your stories to help with my next efforts...

[@leonardobenetti4177]

Hi in the company i'm working for this months we received 100 computers that after updates stoped working. Some of them go stuck during access on the account, others go stuck after moving mouse. I would like to know if it's possible to disable all the windows updates except security. I really need this information cause right now we blocked everything and we are installing October security patch manually. This is very stressfull cause we had 700 computers registered on Intune. Can you please help me create a policy to block everything instead of security updates?

[@ErikWooldridge]

As you know SCCM has the ability to generate fairly complex compliance reports for a whole heap of things including Windows Updates. Is there any way to get detail on updates managed by InTune? I want more detail than just "non compliant". I'm just starting to play with InTune and Desktop analytics, but haven't found a good way to do this yet. It seems like Desktop Analytics collects a lot of data so there has to be something usable there, right?

[@IntuneTraining]

Not presently. If you are just looking for Windows 10 Latest CU, then you can use the build number of the OS to tell you the patch level. But beyond that, there’s not much in the way of compliance and reporting. We have given this feedback to the product team and they are hopefully going to provide more visibility into the update compliance reporting side of things. Just noting today native to Intune. And DA only works when attached to ConfigMgr.

[@twistedsab]

configure logs and store them in a server share. there is many ways to do powershell and task manager. audits would do it as well log updates success and failure

[@geekacullen]

Hi guys, Thank you so much for these videos. They have been a huge help in getting a test environment off the ground. I have a question. I was able to create a group for the licensing as you did, but then later on when I tried to create a group for the Update Ring, I get insufficient Privileges error. Any reason why I could create a group in the beginning and not now?

[@IntuneTraining]

My guess would be someone has messed with your AAD permissions.

[@geekacullen]

@@IntuneTraining figured it out. I had global admin permission in AAD, but had to add myself as admin to the intune permissions as well. Everything worked after that.

[@sunilpal7933]

Thanks for the video. I have 1 query can we able to deploy windows update to azure registered devices.

[@IntuneTraining]

Only if they are managed by Intune.

[@ItstheITProblem]

if we reset all the programs were lost? it will take a day to reinstall all of those? let me know if i am missing something here...

[@IntuneTraining]

Can you clarify your question? You want to do a full device reset and then wondering how long it will take to get apps reinstalled?

[@contentlight3486]

I have a question. Does intune first downloads the Windows updates to Azure Blob storage and then push updates to End devices in tenant?

[@IntuneTraining]

No. Devices pull updates directly from the Windows Update CDN network. If you have Delivery Optimization or other bandwidth management tech in place, your machines could benefit from peer to peer content sharing. But by default or it’s just coming from the CDN.

[@JinxLouzy]

How do I check and monitor that all the enrolled devices have the latest security updates? I want to look at individual machines and check for what patches they have or have not from Intune.

[@IntuneTraining]

We recommend to use Microsoft Defender ATP as it has some great graphs for windows 10 updates and alike. But if you can’t justify the e5 licence look at the full build number as it shows the minor update that has been installed, and then cross check here docs.microsoft.com/en-us/windows/release-information/

[@mattiasmelkersen5643]

you can use update compliance to that if you create a workspace. www.jeffgilb.com/update-compliance-with-intune/

[@dhruvinpatel8428]

Can we control windows update? Is there any option to stop auto windows update and push when we want from intune?

[@IntuneTraining]

Once you configure and deploy update policies, standard windows updates are no longer followed. -- Ben

[@kerrypangan5236]

Hello I work with a small municipal company with 200 workers. Our methods of updates for them are doing each one individually. Does this program by Microsoft be integrated for free? And how and where do I start? Majority of our employees are on windows 1903 and some are on 1909.

[@razvan.dumitru]

Hi Kerry. I assume your PCs are domain joined to a local Active Directory. For this to work, first of all you would need an Azure Subscription and/or an Enterprise and Mobility Suite license for every user/pc (www.microsoft.com/en-us/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing). Once these are bought, you would most probably need to sync the objects from your local AD to Azure AD by using AADSync which is sort of an application that can be installed even on a DC and which you then configure to sync objects from onprem to the cloud. Once your objects are in your cloud, you'll be able to manage them like shown in the video. Bottom line is that in order to manage stuff with Intune (as shown in the video), you need to have user accounts/computer accounts up in Azure. Microsoft also provides 2 "on premise" alternatives: 1. A server solution that does some of the things that Intune is capable of, called SCCM, look that up, maybe that's more appropriate for your needs. 2. WSUS role on a Windows Server and or GPOs. docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus . With some fiddling around you should be able to reach the same output.

[@ranjithkumarduraisamy4728]

Quick one, what if a same device is part of two rings? The one with prior deadline/defer takes precedence?

[@IntuneTraining]

The policies will conflict, and will potentially not apply any settings at all, or it will get into a race condition. Use the exclude process to avoid it. Or even better use the dynamic process in autopatch

[@ranjithkumarduraisamy4728]

@@IntuneTraining That was fast and perfect. Thank you.

[@TheMistashmoe]

Can you pick what updates get deployed? if you didn't want the chromium update with Edge?

[@IntuneTraining]

There are Edge update policies where you can configure which update cycle to use. Overall though, WUfB is designed to give you the latest updates with no ability to select updates to deploy.

[@TheMistashmoe]

@@IntuneTraining how about remote uninstalling a problem patch?

[@1993jhonty]

what about third-party software that is not on the business store?

[@IntuneTraining]

Try services like Patch My PC. WUfB doesn't support any 3rd party updates.

[@taksiobs]

How will I push a particular update? Like KB5001567 through intune?

[@IntuneTraining]

The concept of singular updates hasn't been a requirement for a few years now. Updates are deployed in cumulative update packs. Just set and forget!

[@taksiobs]

@@IntuneTraining wow, thanks for thr reply. ❤️ I'm really trying to get my hands on these stuff recently.

[@chrgeorgeson]

Suprised they'd recommended updating drivers. No way.