This document describes the Windows Update for Business GPO Settings, what they do, and our defaults.
Windows Update for Business Overview
WUFB is our new delivery method for windows updates on campus for MSL customers. The old delivery method (WSUS) has been deprecated and is no longer supported by Microsoft. Currently we control updates via Group Policy, however, this may change in the future depending on licensing and adoption of Intune. Since we control updates via GPO we lack certain granular control that we used to have in WSUS, but these shortfalls can be mostly compensated for with our other management tools like BigFix in the event of issues.
Group Policy Object Settings
The below table is a copy of the SEAM standard WUFB GPO, with comments describing what policies do in case their brief description is unclear. Note that some units receiving MSL services may have a delay between when Windows Updates are released and when their unit receives the update. This is controlled by a GPO setting called "Select When Quality Updates are received".
| Windows Components/Windows Update/Legacy Policies |
Setting |
Comment |
| Allow Automatic Updates immediate installation |
Enabled |
Allows Windows to automatically install certain updates that do not require restart or interrupt normal Windows services |
| Allow non-administrators to receive update notifications |
Disabled |
|
| Delay Restart for scheduled installations |
Enabled |
|
| Wait the following period before proceeding with a scheduled |
| restart (minutes): |
30 |
|
| Do not allow update deferral policies to cause scans against Windows Update |
Enabled |
|
| Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box |
Enabled |
|
| Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates |
Enabled |
|
| No auto-restart with logged on users for scheduled automatic updates installations |
Enabled |
|
| Re-prompt for restart with scheduled installations |
Enabled |
|
| Wait the following period before prompting again with a scheduled |
| restart (minutes): |
480 |
|
| Turn on recommended updates via Automatic Updates |
Enabled |
|
| Windows Components/Windows Update/Manage end user experience |
Setting |
Comment |
| Configure Automatic Updates |
Enabled |
Enable this to allow the below options to be configured |
| Configure automatic updating: |
4 - Auto download and schedule the install |
| The following settings are only required and applicable if 4 is selected. |
| Install during automatic maintenance |
Disabled |
| Scheduled install day: |
0 - Every day |
| Scheduled install time: |
03:00 |
| If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below: |
| Every week |
Enabled |
| First week of the month |
Disabled |
| Second week of the month |
Disabled |
| Third week of the month |
Disabled |
| Fourth week of the month |
Disabled |
|
| Install updates for other Microsoft products |
Disabled |
|
| Windows Components/Windows Update/Manage updates offered from Windows Server Update Service |
Setting |
Comment |
| Allow signed updates from an intranet Microsoft update service location |
Disabled |
This setting disables the deprecated WSUS feature. |
| Automatic Updates detection frequency |
Enabled |
This setting is enabled in case it interacts with WUFB, but it can likely be disabled if desired |
| Check for updates at the following |
| interval (hours): |
4 |
|
| Specify intranet Microsoft update service location |
Disabled |
This setting only matters if using WSUS, which we don't. |
| Windows Components/Windows Update/Manage updates offered from Windows Update |
Setting |
Comment |
| Do not include drivers with Windows Updates |
Enabled |
This setting bloats the install size by an astronomical amount, driver updates are handled separately |
| Select the target Feature Update version |
Enabled |
This setting allows control over which Feature Updates are installed on endpoints. It is updated as new feature updates are approved. |
| Which Windows product version would you like to receive feature updates for? e.g., Windows 10 |
Windows 11 |
| Target Version for Feature Updates |
25H2 |
|
| Select when Preview Builds and Feature Updates are received |
Enabled |
This setting allows control over when Feature Updates are installed, we leave it at 0 currently since we only update the Target Version when we are ready to deploy the update. |
| How many days after a Feature Update is released would you like to defer the update before it is offered to the device? |
0 |
| Pause Preview Builds or Feature Updates starting: |
|
| (format yyyy-mm-dd example: 2016-10-30) |
|
| Select when Quality Updates are received |
Enabled |
This setting may be changed to delay normal monthly Windows Updates, some units have this configured for a 1 week delay. |
| After a quality update is released, defer receiving it for this many days: |
0 |
| Pause Quality Updates starting |
|
| (format yyyy-mm-dd example: 2016-10-30) |
|
| Extra Registry Settings |
State |
Comment |
| Software\Microsoft\Windows\CurrentVersion\Policies\Servicing\RepairContentServerSource |
2 |
This setting instructs the endpoint to bypass any WSUS server and acquire repair files directly from Microsoft. |
