Patch Management and Windows 10
VIDEO Datto RMM: Patch Management Best Practices
Datto RMM technical experts Jon North and Aaron Engels explain why Patch Management is such a critical business offering. They cover what Windows updates and Patch Management look like in 2019 and beyond, with Cumulative Updates and Windows as a Service. They explain how you can leverage Datto RMM in the most efficient way for your business and offer their best practices suggestions to improve your current patching and updating strategies. Also refer to the Windows 7 to Windows 10 webinar recording to learn how you can control Feature Updates for Windows 10 with Datto RMM.
About Windows 10 updates
Windows 10 is managed very differently from the operating systems that came before it. Windows updates in particular are handled much more closely by Microsoft in Windows 10, and the changes become more pronounced with each update.
This document will list all Windows 10 versions and will go through some of the new update terminology used for Windows 10. It will list a few common scenarios users can expect when managing Windows 10 updates, and it will also show how to solve them.
|Version String||Nickname||Build Number||Release Date|
|1507||Threshold 1||10240||July 2015|
|1511||November Update||10586||November 2015|
|1607||Anniversary Update||14393||July 2016|
|1703||Creators Update||15063||March 2017|
|1709||Fall Creators Update||16299||October 2017|
|1803||April 2018 Update||17134||April 2018|
|1809||October 2018 Update||17763||November 2018|
|1903||May 2019 Update||18362||May 2019|
|1909||November 2019 Update||18363||November 2019|
Users can expect to see the following terms used when handling Windows 10 updates:
|Windows Update for Business||From Microsoft: "Windows Update for Business is a collection of policy settings that control updates for devices that use Windows 10."
Refer to this Microsoft Support article.
|Quality Update||This is analogous to an old-style KB update or an update on "Update Tuesday". It is an update which requires rebooting the computer and which carries a number of small, quality-of-life improvements and security fixes. Older operating systems received lots of smaller updates, while Windows 10 receives update rollups which contain all of the smaller updates in a single unit.|
|Feature Update||This is analogous to a Service Pack. A Feature Update upgrades Windows 10's version, adding new features, interface changes and (often) new management considerations.
Windows 10 uses a dual-naming versioning system: a four-digit number (month and year) followed by a nickname. An example is version 1607, the Anniversary Update. Refer to Windows 10 versions.
Feature Updates are delivered as new operating systems over Electronic Software Distribution (ESD files). They are often large in size (more than 2 GB) and require a specific method of installation.
|Driver Update||These remain more or less as they always were. They are small bundles of software drivers installed as demanded by the system in response to hardware requirements.|
|Security Update||As of April 2017, Windows 10 (not Server 2016) will be receiving Security Updates. Security Updates are bundles of security-related patches released a few weeks before a Quality Update. Administrators who opt out of installing them will see the same patches included in that month’s Quality Update. For more information about cumulative updates, refer to this Microsoft blog article.|
|Update Rollup||These used to be used by Microsoft as a convenience to users setting up new devices with legacy operating systems. With Windows 10, updates are contained within one or two monthly update rollups instead of smaller individual update packs. This system removes a lot of granularity previously granted to System Administrators over individual patches. This is magnified by the cumulative nature of updates, where subsequent updates will include previously-missed patches.|
|Branch/Channel||A Windows 10 device can be put into one of two categories, called Channels or Branches, to determine how often it receives updates:
• Targeted Semi-Annual Channel – Devices receive both Quality and Feature updates on a mandatory basis. These updates are issued as soon as Microsoft clear them for release. Legacy Term: "Current Branch" (CB).
• Broad Semi-Annual Channel – Devices receive Quality updates on a mandatory basis. Feature updates can be deferred for up to a set time period. Some updates are issued 4 months after Targeted devices receive them and can be deferred for up to a year in total. Legacy Term: “Current Branch for Business” (CBB).
For instructions on switching channels, refer to Channel switching.
There is also Long-Term Servicing Channel (LTSC) Windows. It is a separate version that only receives Quality Updates and not Feature Updates. For more information, refer to this article.
|Defer||The term Microsoft use to delay the checking for and installation of Windows updates. The amount of time one can defer updates for depends on the version of Windows 10 the device is running. Deferring an update does not change its frequency. Updates will not show up in patch scans if they have been deferred until the deferral time has passed. If three updates are released in a month, users will receive three update notifications but they will do so once their device's deferral period has expired.|
Microsoft Windows 10 receives multiple forms of updates, the most notable being Quality Updates and Feature Updates. The former is an umbrella term used to encompass updates for security and performance, while the latter refers to larger updates released every few months which upgrade Windows 10 to an entirely new version.
Windows 10 Feature Updates are generally referred to either by title (e.g. “Fall Creators Update”) or by their year-month version number (e.g. 1511, 1603, 1709, etc.), and have traditionally not been managed by Datto RMM due to the unique way Windows 10 handles their installation.
The Windows 10 Upgrade component (so named to distinguish it from Quality Updates) aims to bridge this gap by installing Windows 10 as part of a component instead of as part of the patch management process. You can download the component from the ComStore.
Windows 10 Feature Updates in their purest sense are delivered as disc images which install an entirely new build of the operating system in "Upgrade mode". This is why, after installing a Feature Update, the Windows Update history screen is cleared. Most Windows 10 users downloading Feature Updates via Windows Update receive these updates not as disc images but as delta updates much smaller in size which update only the elements of the OS that need updating.
Given their unorthodox composition, it is appropriate that such updates are installed in their own unique way. It is this installation method that Datto RMM has been unable to replicate outside of the Windows Update subsystem (refer to Windows 10 Feature Updates and Datto RMM patch management), therefore, this component-based method aims to bridge the gap. However, in the interest of automation, it is wiser for Datto RMM to deal with the entire disc image than to attempt to calculate deltas on a per-device basis.
Before using the component
The following points should be considered before using the Windows 10 Upgrade component. The component itself will check for these conditions and will fail if they are not met.
- The component will upgrade a Professional edition of Windows only.
- The devices being upgraded must be running at least Windows 7 SP1.
- Devices must have at least 20GB of free space to perform the upgrade. The Windows 10 disc image can be as large as 7GB, and the installation process requires an additional 10GB.
- Devices must be capable of downloading from https://storage.centrastage.net.
What the component does
The Windows 10 Upgrade component performs the following steps:
- Checks to ensure the device is running at least Windows 7 SP1.
- Checks to ensure the edition of the Windows OS installed on the device is of type Professional.
- Checks to ensure there is at least 20GB of free space on the endpoint’s system drive.
- Checks device architecture (only for 64-bit component).
- Downloads a Windows 10 ISO from Datto RMM. This file can be up to 7GB in size. As such, please be aware that the download process may take a long time. Unfortunately, these files cannot be cached by local caches. However, the ISO the component downloads can be copied and re-used locally as desired. If you choose to copy the ISO to your local networks or to provide your own, you should set the usrImagePath and usrLanguage variables as shown:
NOTE By default, the ISO downloaded is in English. Users wishing to install Windows in a different language will need to link to their own Windows 10 ISO for their preferred language, or use the components described in Windows 7 to Windows 10 in-place upgrade by component.
- Mounts the ISO.
- Executes the Windows 10 setup procedure silently and upgrades to the latest build of Windows 10.
Deployment of Enterprise editions
Microsoft freely provides disc images of Windows 10 Home and Professional editions, however, Enterprise editions of Windows cannot be distributed freely and must be obtained directly from Microsoft. Datto is not able to distribute Windows 10 Enterprise, rendering a ComStore solution untenable.
To overcome this shortcoming, the components developed for a Windows 7 to 10 in-place upgrade can additionally upgrade an earlier build of Windows 10 Enterprise edition to the latest. These components can be found at the end of the Windows 7 to Windows 10 in-place upgrade by component topic.
To switch channels, you can use Datto RMM's Windows Update policy. You can configure the policy to switch a device from Semi-Annual Channel (Targeted) to Semi-Annual Channel (Broad) and automatically defer Feature and Quality Updates. It also enables Windows Telemetry, as switching Channel requires this feature to be enabled. For more information, refer to Update Channel.
Due to the way in which Windows 10 Feature Updates are handled, they are not supported by Datto RMM patch management. The issue revolves around the way devices with a Feature Update queued must be rebooted. Windows does not properly detect how Datto RMM places the updates it has downloaded into the Windows 10 update queue, meaning devices are left unaware they have an update to install and therefore disregard it.
Windows 10 Feature Updates cannot be installed via Patch Management, however, they can be installed via a component from the ComStore. For more information, refer to Windows 10 Upgrade component.
To block Windows 10 Feature Updates from appearing within the Datto RMM Patch Management section, the best solution is to use a policy to only approve patches that are smaller than 1.5 GB in size. Research done internally indicates that Windows Feature Updates are around 2 GB at a minimum.
Once the update is blocked, an Administrator will need to install it manually onto their devices using a USB Stick or DVD.
This is due to the nature of Windows 10. The retroactivity of Windows 10 patches, where the updates of month 2 will include those missed in month 1, works alongside the cumulative nature of the patch rollups to ensure that devices receive all the patches Microsoft says the device needs. While it is possible to hide or skip Windows 10 patches entirely, Administrators will find the patches they have blacklisted in month 1 re-appearing in month 2's update, making the process one of debatable usefulness.
Microsoft treats the Windows 10 Home version drastically differently from its Pro and Enterprise versions. Windows 10 Home does not have a group policy editor and only works on Current Branch (CB). For more information, refer to this article.
Datto RMM is an enterprise software product and does not formally support Home versions of Windows 10. Devices requiring enterprise-grade management must be running enterprise-grade software. For more information on supported operating systems, refer to Supported operating systems and Agent requirements.
Users who wish to use Datto RMM patch management and disable Windows Update entirely will find that Windows 10's update system conflicts with Datto RMM.
It is a complicated issue but here are some points to consider:
Windows Update cannot be disabled on Windows 10.
The most unobtrusive form of Windows Update is "level 2" which disables Windows' automatic updating functionality but still permits it to check. It will notify the user when updates are available and remind them regularly.
Administrators can switch to the Broad Semi-Annual Channel, which defers Feature and Quality Updates, but they will still arrive. Administrators receive a "grace period" but the updates arrive in the same frequency, just with a delay. For more information, refer to Update Channel in the Create a Windows Update policy topic.
Driver updates can still be disabled entirely, but Feature and Quality updates can only ever be deferred.
Users wishing to update as seldom as possible should consider using Long-Term Servicing Branch versions of Windows 10.