%3CLINGO-SUB%20id%3D%22lingo-sub-1660970%22%20slang%3D%22en-US%22%3EThird-Party%20Updates%20and%20Windows%20Update%20for%20Business%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1660970%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWhile%20using%20Windows%20Updates%20for%20Business%20(WUfB)%20is%20not%20for%20everyone%2C%20its%20simplicity%20and%20familiar%20end-user%20experience%20make%20it%20quite%20attractive%20to%20many%20organizations.%20One%20thing%20that%20WUfB%20does%20not%20provide%20today%2C%20though%2C%20is%20updates%20for%20third-party%20products.%20For%20that%2C%20you%20need%20to%20continue%20to%20use%20an%20on-premises%20solution%20like%20Microsoft%20Endpoint%20Manager%20Configuration%20Manager%20to%20complement%20WUfB.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EUltimately%2C%20deploying%20third-party%20updates%20when%20using%20WUfB%20is%20no%20different%20than%20deploying%20them%20using%20Configuration%20Manager%20by%20itself.%20Enabling%20third-party%20updates%20with%20WUfB%20requires%20the%20following%20three%20things%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3E%3CSTRONG%3EEnable%20and%20configure%20WUfB.%3C%2FSTRONG%3E%3CBR%20%2F%3ETo%20enable%20WUfB%2C%20configure%20any%20WUfB%20related%20policy%20or%20setting%20using%20one%20of%20the%20following%20methods%3A%3CUL%3E%0A%3CLI%3EGroup%20policy%20or%20MDM%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fupdate%2Fwaas-configure-wufb%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EConfigure%20Windows%20Update%20for%20Business%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E%3CSUP%20id%3D%22footnote_plugin_tooltip_1%22%20class%3D%22footnote_plugin_tooltip_text%22%3E1%3C%2FSUP%3E%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fconfigmgr%2Fsum%2Fdeploy-use%2Fintegrate-windows-update-for-business-windows-10%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIntegrate%20with%20Windows%20Update%20for%20Business%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EIntune%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fintune%2Fprotect%2Fwindows-update-for-business-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EManage%20Windows%2010%20software%20updates%20in%20Intune%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3COL%20start%3D%222%22%3E%0A%3CLI%3E%3CSTRONG%3EConfigure%20and%20enable%20software%20updates%20in%20%3CSPAN%3EConfiguration%20Manager.%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CBR%20%2F%3ESee%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fconfigmgr%2Fsum%2Fplan-design%2Fplan-for-software-updates%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EPlan%20for%20software%20updates%20in%20Configuration%20Manager%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eif%20necessary.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EConfigure%20and%20enable%20third-party%20updates%20in%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E.%3C%2FSTRONG%3E%3CBR%20%2F%3EDo%20this%20using%20a%20handful%20of%20different%20methods%2C%20including%20the%20following%3A%3CUL%3E%0A%3CLI%3ESystem%20Center%20Update%20Publisher%20(SCUP).%3C%2FLI%3E%0A%3CLI%3EThe%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fconfigmgr%2Fsum%2Fdeploy-use%2Fthird-party-software-updates%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethird-party%20updates%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Efeature%20set%20built%20into%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E.%3C%2FLI%3E%0A%3CLI%3EA%20tool%20from%20a%20third-party%20like%20PatchMyPC%2C%20Flexera%2C%20SolarWinds%2C%20or%20Ivanti.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%3ESo%2C%20how%20does%20ConfigMgr%20work%20with%20WUfB%20to%20deliver%20third-party%20updates%3F%20The%20answer%20is%20dual-scan.%20Note%20that%20although%20dual-scan%20did%20cause%20some%20confusion%20in%20the%20past%20that%20resulted%20in%20premature%20installations%20of%20Windows%2010%20builds%2C%20you%20should%20not%20be%20afraid%20of%20it%20once%20you%20see%20how%20it%20works%20(as%20described%20in%20this%20post).%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1267770637%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%20id%3D%22toc-hId--1267622730%22%3EDual-scan%3C%2FH2%3E%0A%3CP%3EDual-scan%20is%20a%20feature%20of%20Windows%20and%20the%20Windows%20Update%20Agent%20(WUA).%20It%20enables%20the%20WUA%20to%20use%20both%20WUfB%20and%20an%20on-premises%20WSUS%20instance%20to%20scan%20for%20update%20applicability%20and%20compliance.%20When%20you%20enable%20dual-scan%2C%20the%20WUA%20uses%20WUfB%20(and%20only%20WUfB)%20for%20Windows%20updates%20and%20WSUS%20for%20non-Windows%20updates.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20enable%20dual-scan%2C%20enable%20a%20WUfB%20deferral%20policy%20on%20a%20system%20with%20a%20local%20WSUS%20server%20configured.%20This%20can%20be%20a%20WSUS%20server%20configured%20by%20Configuration%20Manager%20(the%20scenario%20discussed%20here)%20or%20a%20stand-alone%20WSUS%20server.%20That%E2%80%99s%20all%20there%20is%20to%20it.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20don%E2%80%99t%20want%20dual-scan%2C%20don%E2%80%99t%20enable%20any%20WUfB%20deferral%20policies.%20This%20is%20where%20the%20disconnect%20usually%20happens%2C%20as%20these%20policies%20are%20for%20WUfB%20only.%20They%20have%20no%20effect%20or%20purpose%20if%20another%20solution%20for%20deploying%20Windows%20updates%20is%20used%2C%20like%20Configuration%20Manager%20or%20WSUS%2C%20but%20they%20do%20enable%20dual-scan.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20premature%20installation%20of%20Windows%2010%20builds%20that%20some%20enterprise%20customers%20experienced%20wasn%E2%80%99t%20dual-scan%E2%80%99s%20fault.%20It%20was%20just%20doing%20its%20job%20as%20the%20product%20team%20designed%20it%2C%20and%20as%20described%20in%20this%20post.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ESee%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fconfiguration-manager-archive%2Fusing-configmgr-with-windows-10-wufb-deferral-policies%2Fba-p%2F274278%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3EUsing%20ConfigMgr%20With%20Windows%2010%20WUfB%20Deferral%20Policies%3C%2FA%3E%3CSPAN%3E%26nbsp%3Bfor%20further%20details%20on%20dual-scan%20and%20how%20to%20explicitly%20stop%20it.%20As%20noted%2C%20though%2C%20there%E2%80%99s%20no%20reason%20to%20do%20anything%20if%20you%20don%E2%80%99t%20want%20dual-scan%20except%20not%20to%20enable%20any%20deferral%20policies.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1219742196%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%20id%3D%22toc-hId-1219890103%22%3EResults%3C%2FH2%3E%0A%3CP%3ETo%20prove%20out%20deploying%20third-party%20updates%20using%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E%20with%20WUfB%20enabled%2C%20I%20used%20one%20of%20the%20existing%20co-managed%20systems%20in%20my%20lab.%20The%20name%20of%20this%20system%20is%20ELKWIN2.%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1910303670%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%20id%3D%22toc-hId-1910451577%22%3E%26nbsp%3B%3C%2FH3%3E%0A%3CH3%20id%3D%22toc-hId-102849207%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%20id%3D%22toc-hId-102997114%22%3E%3CI%20class%3D%22fas%20fa-check%22%3E%3C%2FI%3EWUfB%20Configured%3C%2FH3%3E%0A%3CP%3EELKWIN2%20started%20life%20as%20a%20Win%2010%201909%20system%20and%20was%20updated%20to%202004%20using%20WUfB%3B%20it%20continues%20to%20receive%20quality%20updates%20from%20WUfB.%20You%20can%20see%20the%20Windows%20Update%20configuration%20in%20the%20following%20two%20screenshots%20from%20ELKWIN2%2C%20confirming%20the%20WUfB%20configuration.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-WindowsUpdateSettings.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F217999i3AF01C5887A3C142%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-WindowsUpdateSettings.png%22%20alt%3D%22Windows%20Update%20settings%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EWindows%20Update%20settings%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-ViewConfiguredUpdatePolicies.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F217998i85673B711104504C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-ViewConfiguredUpdatePolicies.png%22%20alt%3D%22Configured%20update%20policies%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EConfigured%20update%20policies%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1704605256%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%20id%3D%22toc-hId--1704457349%22%3ESoftware%20Updates%20Configured%3C%2FH3%3E%0A%3CP%3EEven%20though%20WUfB%20is%20configured%20on%20ELKWIN2%20using%20Intune%2C%20the%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E%20Software%20Updates%20configuration%20is%20still%20targeted%20to%20the%20system%20and%20still%20applies%20to%20the%20system.%20Since%20ELKWIN2%20is%20configured%20for%20WUfB%20and%20has%20a%20local%20WSUS%20server%20configured%2C%20dual-scan%20is%20also%20enabled.%20The%20following%20two%20screenshots%20show%20the%20WSUS%20server%20configuration%20and%20local%20group%20policies%20configured%20by%20the%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E%20agent.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-RSOP.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218000iD0B4408C6C55D10D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-RSOP.png%22%20alt%3D%22RSOP%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ERSOP%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-RegEdit.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218001iA7E1C5DF4D755DC9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-RegEdit.png%22%20alt%3D%22Registry%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ERegistry%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-782907577%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%20id%3D%22toc-hId-783055484%22%3EThird-party%20Updates%20Configured%3C%2FH3%3E%0A%3CP%3EFor%20this%2C%20I%20created%20a%20custom%20update%20(for%20a%20custom%20application)%20in%20SCUP%20and%20published%20it%20to%20the%20Windows%20Server%20Update%20Services%20(WSUS)%20server.%20After%20synchronizing%20the%20update%20catalog%20in%20%3CSPAN%3EConfiguration%20Manager%3C%2FSPAN%3E%2C%20the%20update%20showed%20up%20in%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EAll%20Software%20Updates%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eview%2C%20ready%20for%20compliance%20scanning%20and%20deployment.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22SCUP-FakeApp.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218002i87FA1F7C0B6B8D2B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22SCUP-FakeApp.png%22%20alt%3D%22FakeApp%202.0%20in%20System%20Center%20Updates%20Publisher%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFakeApp%202.0%20in%20System%20Center%20Updates%20Publisher%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ConfigMgr-FakeApp.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218003i603B41C0592A72A1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ConfigMgr-FakeApp.png%22%20alt%3D%22FakeApp%202.0%20Upgrade%20in%20Configuration%20Manager%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFakeApp%202.0%20Upgrade%20in%20Configuration%20Manager%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EI%20then%20initiated%20a%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3ESoftware%20Update%20Scan%20Cycle%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3Bfrom%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EActions%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3Etab%20in%20the%20Configuration%20Manager%20Control%20Panel%20applet%20on%20ELKWIN2.%20Finally%2C%20I%20forced%20ELKWIN2%20to%20send%20all%20queued%20state%20messages%20to%20the%20site%20and%20checked%20the%20reports.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-SpecificUpdateCompliance.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218005iE05942BAE2DADC4F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-SpecificUpdateCompliance.png%22%20alt%3D%22Specific%20compliance%20state%20for%20an%20update%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ESpecific%20compliance%20state%20for%20an%20update%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ELKWIN2-SpecificComputerCompliance.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218006i8DD573CFD44F03C1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ELKWIN2-SpecificComputerCompliance.png%22%20alt%3D%22Compliance%20state%20for%20a%20specific%20computer%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ECompliance%20state%20for%20a%20specific%20computer%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EAs%20the%20reports%20show%2C%20ELKWIN2%20requires%20the%20FakeApp%202.0%20Upgrade.%20Also%2C%20note%20that%20no%20Windows%20updates%20show%20at%20all%20for%20ELKWIN2.%20That%E2%80%99s%20dual-scan%20at%20work.%20All%20that%20is%20required%20now%20is%20to%20download%20and%20deploy%20the%20update%20or%20configure%20an%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fhome.memftw.com%2Fwhat-automatic-deployment-rules-actually-do%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAutomatic%20Deployment%20Rule%3C%2FA%3E%26nbsp%3Bto%20do%20this%20for%20us.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-772404473%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%20id%3D%22toc-hId-772552380%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CH2%20id%3D%22toc-hId--1035049990%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%20id%3D%22toc-hId--1034902083%22%3EConclusion%3C%2FH2%3E%0A%3CP%3EEven%20though%20WUfB%20doesn%E2%80%99t%20directly%20support%20third-party%20updates%2C%20it%E2%80%99s%20still%20possible%20to%20deploy%20and%20manage%20them%20using%20the%20ever-faithful%20Configuration%20Manager%20and%20the%20built-in%20Windows%20dual-scan%20functionality.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EFootnotes%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E1.%26nbsp%3B%3CSPAN%3ENote%20that%20Configuration%20Manager%20does%20not%20currently%20include%20the%20most%20recent%20configuration%20options%20for%20WUfB.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1660970%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWhile%20using%20Windows%20Updates%20for%20Business%20(WUfB)%20is%20not%20for%20everyone%2C%20its%20simplicity%20and%20familiar%20end-user%20experience%20make%20it%20quite%20attractive%20to%20many%20organizations.%20One%20thing%20that%20WUfB%20does%20not%20provide%20today%2C%20though%2C%20is%20updates%20for%20third-party%20products.%20For%20that%2C%20you%20need%20to%20continue%20to%20use%20an%20on-premises%20solution%20like%20Microsoft%20Endpoint%20Manager%20Configuration%20Manager%20to%20complement%20WUfB.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1660970%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Update%20for%20Business%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECM%20current%20branch%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESoftware%20update%20management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1671223%22%20slang%3D%22en-US%22%3ERe%3A%20Third-Party%20Updates%20and%20Windows%20Update%20for%20Business%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1671223%22%20slang%3D%22en-US%22%3E%3CP%3ENice%20write%20up%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F629631%22%20target%3D%22_blank%22%3E%40Jason_Sandys%3C%2FA%3E.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1671543%22%20slang%3D%22en-US%22%3ERe%3A%20Third-Party%20Updates%20and%20Windows%20Update%20for%20Business%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1671543%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Jason.%20This%20is%20really%20a%20great%20explanation.%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20working%20on%20similar%20situation%20were%20we%20moved%20few%20pilot%20user%20to%20WUfB%20and%20then%20realized%20that%20Edge%20Chromium%20updates%20are%20not%20getting%20delivered%20to%20pilot%20user%20using%20SCCM%20as%20the%20windows%20update%20workload%20is%20moved%20to%20Intune.%20Is%20there%20any%20workaround%20for%20Edge%20Chromium%20updates%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1689923%22%20slang%3D%22en-US%22%3ERe%3A%20Third-Party%20Updates%20and%20Windows%20Update%20for%20Business%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1689923%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F209026%22%20target%3D%22_blank%22%3E%40ranjan%20manna%3C%2FA%3E.%20Edge%20Chromium%20has%20its%20own%20update%20engine%20that%20downloads%20and%20installs%20updates%20from%20Microsoft%20Update%20automatically%20following%20any%20deferrals%20that%20you%20have%20configured%20for%20quality%20updates.%20If%20you%20install%20Edge%20using%20the%20ConfigMgr%20built%20in%20method%2C%20this%20does%2C%20by%20default%2C%20disable%20automatic%20updates%20though%20so%20you'll%20need%20to%20re-enable.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

While using Windows Updates for Business (WUfB) is not for everyone, its simplicity and familiar end-user experience make it quite attractive to many organizations. One thing that WUfB does not provide today is updates for third-party products. For that, you need to continue to use an on-premises solution like Microsoft Endpoint Manager Configuration Manager to complement WUfB.

 

Ultimately, deploying third-party updates when using WUfB is no different than deploying them using Configuration Manager by itself. Enabling third-party updates with WUfB requires the following three things:

 

  1. Enable and configure WUfB.
    To enable WUfB, configure any WUfB related policy or setting using one of the following methods:
  1. Configure and enable software updates in Configuration Manager.
    See Plan for software updates in Configuration Manager if necessary.
  2. Configure and enable third-party updates in Configuration Manager.
    Do this using a handful of different methods, including the following:
    • System Center Update Publisher (SCUP).
    • The third-party updates feature set built into Configuration Manager.
    • A tool from a third-party.

So, how does Configuration Manager work with WUfB to deliver third-party updates? The answer is dual-scan. Note that although dual-scan did cause some confusion in the past that resulted in the unintended installation of updates, you should not be afraid of it once you see how it works (as described in this post).

 

Dual-scan

Dual-scan is a feature of the Windows Update (WU) client. It enables the WU client to use WUfB and an on-premises WSUS instance to scan for update applicability and compliance. When you enable dual-scan, the WU client uses WUfB (and only WUfB) for Windows product updates and WSUS for non-Windows updates.

 

To enable dual-scan, enable a WUfB deferral policy on a system with a local WSUS server configured. This can be a WSUS server integrated into and automatically configured by, Configuration Manager (the scenario discussed here) or a stand-alone WSUS server. That’s all there is to it.

 

If you don’t want dual-scan, don’t enable any WUfB deferral policies. This is where a disconnect usually happens, as these policies are for WUfB only. They have no effect or purpose if another solution for deploying Windows updates is used, like Configuration Manager or WSUS, but they enable dual-scan.

 

See Using ConfigMgr With Windows 10 WUfB Deferral Policies for further details on dual-scan and explicitly stopping it.

 

Results

To prove out deploying third-party updates using Configuration Manager with WUfB enabled, I used one of the existing co-managed systems in my lab. The name of this system is ELKWIN2.

 

WUfB Configured

ELKWIN2 started life as a Windows 10 1909 system and was updated to 2004 using WUfB; it continues to receive quality updates from WUfB. You can see the Windows Update configuration in the following two screenshots from ELKWIN2, confirming the WUfB configuration.

 

Windows Update settingsWindows Update settingsConfigured update policiesConfigured update policies

 

Software Updates Configured

Even though WUfB is configured on ELKWIN2 using Intune, the Configuration Manager Software Updates configuration is still targeted to the system and still applies to the system. Since ELKWIN2 is configured for WUfB and has a local WSUS server configured, dual-scan is also enabled. The following two screenshots show the WSUS server configuration and local group policies configured by the Configuration Manager agent.

 

Resultant Set of PoliciesResultant Set of Policies

RegistryRegistry

 

Third-party Updates Configured

For this, I created a custom update (for a custom application) in SCUP and published it to the Windows Server Update Services (WSUS) server integrated with the Configuration Manager site in my lab. After synchronizing the update catalog in Configuration Manager, the update showed up in the All Software Updates view, ready for compliance scanning and deployment.

 

FakeApp 2.0 in System Center Updates PublisherFakeApp 2.0 in System Center Updates Publisher

FakeApp 2.0 Upgrade in Configuration ManagerFakeApp 2.0 Upgrade in Configuration Manager

 

I then initiated a Software Update Scan Cycle from the Actions tab in the Configuration Manager Control Panel applet on ELKWIN2. Finally, I forced ELKWIN2 to send all queued state messages to the site and checked the reports.

Specific compliance state for an update (FakeApp 2.0 Upgrade)Specific compliance state for an update (FakeApp 2.0 Upgrade)

Compliance state for a specific computer (ELKWIN2)Compliance state for a specific computer (ELKWIN2)

 

As the reports show, ELKWIN2 requires the FakeApp 2.0 Upgrade. Also, note that no Windows updates show at all for ELKWIN2. That’s dual-scan at work. All that is necessary now is to download and deploy the update or configure an Automatic Deployment Rule to do this for us.

 

Conclusion

Even though WUfB doesn’t support third-party updates, it’s still possible to deploy and manage them using the ever-faithful Configuration Manager and the built-in Windows dual-scan functionality.

3 Comments

Nice write up, @Jason_Sandys

Visitor

Thanks Jason. This is really a great explanation. 

We are working on similar situation were we moved few pilot user to WUfB and then realized that Edge Chromium updates are not getting delivered to pilot user using SCCM as the windows update workload is moved to Intune. Is there any workaround for Edge Chromium updates ?

Microsoft

Hi @ranjan manna. Edge Chromium has its own update engine that downloads and installs updates from Microsoft Update automatically following any deferrals that you have configured for quality updates. If you install Edge using the ConfigMgr built in method, this does, by default, disable automatic updates though so you'll need to re-enable.