Forum Discussion

SamTeerlinck's avatar
SamTeerlinck
Brass Contributor
Nov 14, 2019

Windows Update roll back for specific device.

Hi all,

 

We are slowly implementing Windows Update rings with Intune in our organization. We have seen that it is possible to roll back potentially harmful updates.

From the Microsoft documentation we can see that it is possible in the Update ring to roll back all of the assigned users. What we are not sure and can't find anywhere is if it is actually possible to roll back an update for a specific group of devices.

Let's say we apply the ring to almost all users/devices, and only a few people are having trouble with the update. Do we really have to roll back the entire ring or can we do this manually for one or more devices?

 

Microsoft documentation:

https://docs.microsoft.com/en-us/intune/protect/windows-update-for-business-configure#uninstall

 

Thanks in advance!

  • SamTeerlinck 

     

    I'm pretty sure you can only roll updates back for the ring itself, affecting all members.

     

    My suggestion would be to create several rings with staggered deferrals. Have some users be early adopters (with the lowest deferral value) to fully test your updates in all device scenarios and uses before rolling out to the wider estate.

     

    To resolve your situation, you could create a new ring with a long deferral, move the problematic devices into this ring. Then deploy a Powershell script to remove the problematic update, EG containING:

     

    wusa /uninstall /kb:KBNUMBER

     

    Then once you've decided on  your long term update strategy and incorporate those devices into it.

     

     

     

  • cjitsolutions's avatar
    cjitsolutions
    Brass Contributor

    SamTeerlinck 

     

    I'm pretty sure you can only roll updates back for the ring itself, affecting all members.

     

    My suggestion would be to create several rings with staggered deferrals. Have some users be early adopters (with the lowest deferral value) to fully test your updates in all device scenarios and uses before rolling out to the wider estate.

     

    To resolve your situation, you could create a new ring with a long deferral, move the problematic devices into this ring. Then deploy a Powershell script to remove the problematic update, EG containING:

     

    wusa /uninstall /kb:KBNUMBER

     

    Then once you've decided on  your long term update strategy and incorporate those devices into it.

     

     

     

Resources