MEM | Windows 10 update rings explained

Posted on by

It might be self-explanatory for some but not so much for others. So, for you out there who are uncertain about what to configure, which values to use and how it works, please read on.

I always recommend having multiple update rings, to be able to verify the quality of the updates and avoid unnecessary disruption for your end users. Have at least three.

Phase 1 – Test
To check if the updates result in a blue screen or any other obvious issue.

Phase 2 – Pilot
To test the core functionality of all your business-critical applications. You have created a set of pre-defined tests to verify the functionality of your critical applications, haven’t you?

Phase 3 – Production
Create the number of production rings that is best for your organization. Don’t overdo it. Keep it simple to avoid confusion, and a long update window.

In addition to these rings, I would recommend testing with the Windows Insider builds for verifying your business-critical applications. That’s for getting an early notification if you need to fix your application, – if – it should have any issues with the next build.

Example | Phase 3 – Production ring

The settings below, are the ones I would recommend for your production ring. The number of deferral days is always up for discussion. If you don’t agree with my recommendations, feel free to use whatever you think is best.

Note!
For ‘Feature update deferral period’, make sure to set it 0 (zero) if you want to control which build your organization should run. Ref. ‘Windows 10 feature update policy‘

User experience | [1] deadline settings and [2] ‘Auto reboot before deadline’

Update ring actions

  • Delete
    When you delete an update ring, be aware that the devices that have already got the settings from that ring will continue to use those settings until someone changes them.
  • Pause
    Pause is only available after it has been assigned. When click pause you can select between either ‘feature’ or ‘quality’. The pause period is by default for 35 days.
  • Resume
    Once you have paused an update (feature or quality) you can at any given time resume it. Only the update type you have pause will be enabled for resume.
  • Extend
    If you need to pause for more than 35 days, you have the option to extend that by another 35 days.
  • Uninstall
    This will prompt you to specify which update type (feature/quality) you want to uninstall.
    Feature updates can only be uninstalled if the time hasn’t passed the number of days you have specified in that ring. See the setting “Set feature update uninstall period (2 – 60 days)”
    Quality updates can be uninstalled until you install a new quality update.

Avoid back-to-back updates

If you have paused a quality update and the updates resume (automatically resumes after 35 days) you could end up with clients updating and then a few days later scan and update again.

Example:
Updates get paused on January 31st. They will automatically resume on March 7th and notice it has passed its deadline and install the updates. Then, two days later (March 9th) it’ll do another scan and install updates. If using deferral days and deadline days, they will just adjust the installation time based on those settings. But you would end up with the same result. Back-to-back updates.
You can avoid this by extending the pause (see update ring actions) with a few days or change your deferral days.

Links

Uncategorized