Forum Discussion
Moving from ConfigMgr to WUfB and GPO cleanup
egoodman disabling "Configure Automatic Updates" will result in WUfB not working given it will literally disable automatic updates for that device. With WUfB less is actually more.
Configure:
- Some update offering policies to manage which updates are offered when
- Compliance deadline for feature updates and quality updates and grace period
Honestly, that is it. That is all you really need to configure to have a great end user experience and keep devices compliant.
Do Not Configure:
- Disable Configure Automatic Updates (honestly, I recommend not setting this policy at all given if you require the end user to take action via notify to download/install or schedule an install you are likely to slow down compliance of the device).
- Disable end user access to Windows Update features (if you configure this policy the end user will not be able to schedule their reboots, prompt download/install for updates you push down, etc. providing a bad experience and hurting compliance).
- Display option for notifications to disabled (please only turn off notifications when a device is a kiosk device. If it is an end user device or multi-user device this is a terrible experience).
- There are a bunch of other policies I would recommend not configuring and will likely put together a blog on such shortly. 🙂
Finally, when you are using Configuration Manager with "do not allow deferrals to cause scans against Windows Update" you will not get any updates from Windows Update AND the native update stack / UX will not be in use. That means that all of the Windows Udpate policies pertaining to experience (including configure automatic updates) will not apply. Therefore for 100% ConfigMgr environments this should not be a problem.
Please let me know if you have any more questions. 🙂
Microsoftegoodman disabling "Configure Automatic Updates" will result in WUfB not working given it will literally disable automatic updates for that device. With WUfB less is actually more.
Configure:
- Some update offering policies to manage which updates are offered when
- Compliance deadline for feature updates and quality updates and grace period
Honestly, that is it. That is all you really need to configure to have a great end user experience and keep devices compliant.
Do Not Configure:
- Disable Configure Automatic Updates (honestly, I recommend not setting this policy at all given if you require the end user to take action via notify to download/install or schedule an install you are likely to slow down compliance of the device).
- Disable end user access to Windows Update features (if you configure this policy the end user will not be able to schedule their reboots, prompt download/install for updates you push down, etc. providing a bad experience and hurting compliance).
- Display option for notifications to disabled (please only turn off notifications when a device is a kiosk device. If it is an end user device or multi-user device this is a terrible experience).
- There are a bunch of other policies I would recommend not configuring and will likely put together a blog on such shortly. 🙂
Finally, when you are using Configuration Manager with "do not allow deferrals to cause scans against Windows Update" you will not get any updates from Windows Update AND the native update stack / UX will not be in use. That means that all of the Windows Udpate policies pertaining to experience (including configure automatic updates) will not apply. Therefore for 100% ConfigMgr environments this should not be a problem.
Please let me know if you have any more questions. 🙂
Thank you so much. We are in the same boat but still having issues. In our scenario we have the following GPO configured currently :
Configure Automatic Updates - Set as Disabled from Domain GPO
Do not allow update deferral policies to cause scans against Windows Update - Set as Disabled from Local GPO (from SCCM)
Do not connect to any Windows Update Internet locations - Set as Enabled from Domain GPO
Specify intranet Microsoft update service location - Set as Enabled from Local GPO (from SCCM)To manage from Intune we are planning to do the following
1. Add the device to Co-management
2. Modify the following GPO's
Configure Automatic Updates - Delete the Registry Entry and set as Not Configured in GPO
3. Create a new profile under "Windows 10 update rings" in Intune with the required settings and assign to the devicesWill that help us to move towards to WuFB or do we need to do anything else ?
Thanks,
V
