Updating Windows 10, version 1903 using Configuration Manager or WSUS
Published May 23 2019 01:56 PM 132K Views
Microsoft

This week, we announced the release of Windows 10, version 1903 and Windows Server, version 1903. As you look to deploy these feature updates in your organization, I want to tell you about some changes we are making to the way Windows Server Update Services (WSUS) and System Center Configuration Manager download feature and quality updates.

Deploying updates using System Center Configuration Manager

In order to deploy feature and quality updates to devices running Windows 10, version 1903 or Windows Server, version 1903 (and later), you will need to ensure that you are running the current branch of System Center Configuration Manager, which is version 1902. Then, in the Configuration Manager console, enable the Software Update point to download updates for Windows 10, version 1903 and later and/or Windows Server, version 1903 and later.

Note: Once you make this change, updates will be available for version 1903 and later versions of the Windows 10 and Windows Server operating systems.

configmgr-client.png
Figure 1. Selecting Windows 10, version 1903 and later in Configuration Manager, version 1902.

configmgr-server.PNG
Figure 2. Selecting Windows Server, version 1903 and later in Configuration Manager, version 1902.

Deploying updates using Windows Server Updates Services

If you are using Windows Server Update Services (WSUS) to deploy updates to devices running Windows 10, version 1903 or Windows Server, version 1903 (and later), you will need to select a new product category to sync and download updates. To make this change in WSUS, open the Update Services administrator console, select Options > Products and Classifications, and, in the Products tab, select Windows 10, version 1903 and later and/or Windows Server, version 1903 and later.

Note: Once you make this change, updates will be available for version 1903 and later versions of the Windows 10 and Windows Server operating systems.

wsus-client.png
Figure 3. Selecting Windows 10, version 1903 and later in the WSUS console.

wsus-server.PNG
Figure 4. Selecting Windows Server, version 1903 and later in the WSUS console.

Frequently asked questions

Will a new product category be created for each future release of Windows 10 or Windows Server?

No. We plan to service future releases of Windows 10 and Windows Server with the Windows 10, version 1903 and later and Windows Server, version 1903 and later product categories.

Why does this category need to be manually configured in Configuration Manager, version 1902 and WSUS?

With Windows 10, version 1903, we are introducing new product categories to enable future support for the Unified Update Platform (UUP) for on-premises management solutions, which provides improved delivery technologies for Windows updates. A configuration change is, therefore, required for environments running the latest public release of Configuration Manager, as well as for environments using WSUS (without Configuration Manager) for updates. (Note: UUP for on-premises management solutions is not yet available. We will have future news regarding UUP, including a public preview, at a later date.)

I am using Configuration Manager, version 1810. Can I deploy updates to Windows 10, version 1903 or Windows Server, version 1903?

No. In order to deploy updates to Windows 10, version 1903 or or Windows Server, version 1903 devices, Configuration Manager, version 1902 or later is required. We recommend that you update to the current branch as soon as possible to ensure that your Windows 10, version 1903 devices receive the targeted quality updates.

Will I have to select a new option each time Windows 10, Windows Server, or Configuration Manager is updated?

No. We plan to automatically add this new category to software update point (SUP) synchronization configurations and existing automatic deployment rules (ADRs) upon upgrade to the next version of Configuration Manager in environments in which Windows 10 updates are currently being synchronized.

Tools and resources

For help with configuring and deploying updates for Windows 10, please see the following resources: 

And, for the latest updates on new releases, tools, and resources, stay tuned to this blog and follow us @MSWindowsITPro on Twitter.

47 Comments
Silver Contributor

So, do i understand this right? Previously it was enough to just select Windows 10 (without any other version or anything) to get all past, current and future updates (including feature updates if Upgrades category is selected). This is still enough to get the 1903 feature update itself (i already see it synced in my test WSUS box in Upgrades view). But after one upgrades machines to 1903, future CU, Security and other updates will only be synced if Windows 10 1903 and later branch is selected? I know you are reasoning this with UUP changes. But i wonder what other benefits it could have. Say now, when general Windows 10 branch is selected, i get updates for all supported versions, though we only use the latest one. So i have to decline a lot of updates. Maybe in future we can avoid this by only selecting branches with versions we use? Say i would have 1903 and 1909 branches selected, so WSUS will only sync security and CU updates for these versions? Or will we have to select the general Windows 10 branch anyway and thus will get all not relevant updates with it?

Copper Contributor

We are using 1810 and can still see Windows 10 1903 in Products listing.

Silver Contributor

Yes, you can (and i see it too), but i'm asking about the future. After you upgrade to 1903 version.

Copper Contributor

My comment was for this line of this post, was not answering your query.

In order to deploy feature and quality updates to devices running Windows 10, version 1903 or Windows Server, version 1903 (and later), you will need to ensure that you are running the current branch of System Center Configuration Manager, which is version 1902.

Silver Contributor

I see, i thought you mistyped 1809 :) Anyway, i think this also applies. You should be able to see 1903 upgrade, but you won't be able to sync new updates for 1903 version if you use 1810 SCCM. At least this is what i gather from this post.

Copper Contributor

Is it possible to upgrade from 1607 to 1903, with Enterprise LTSB edition?

Microsoft

@wroot Future versions of Windows 10 will not be listed individually. For now 1903 is because we are changing the way updates are delivered. But that change will stick on future versions, so there won't be a need to list each one. For Server, we already list them all individually so this really isn't a change in the way you select to receive updates for server, but the delivery of them is changed in Server as well.

Microsoft

@Ihsan_1895  You can upgrade from LTSC to SAC. So this should not be a problem., Keep in mind that Windows 10, version 1903 only comes in SAC version, not LTSC. 

Copper Contributor

sorry my for my mistakes, I mean 1607 LTSB

Microsoft

Same. LTSC=LTSB. So answer is the same.

Copper Contributor
Echoing Santosh Seth, can we get a confirmation that ConfigMgr 1902 is not strictly required to service 1903 machines yet? While I can see the 1903 products in my SUP, I've not actually tried to push anything from our PROD 1806. We hadn't planned to push up to 1902 just yet, but it'll be good to know if it's a must on our schedules.
Community Manager

@Santosh Seth and @TPSIntune - ConfigMgr 1902 is required for Windows 10, version 1903. (Support for Windows 10 in Configuration Manager has a matrix of which versions of Windows 10 you can use with which versions of ConfigMgr.) Per Rae Goodhart, "It may or may not work - proceed at your own risk. We don't support it nor test it on anything before 1902, but we don't block it either."

Brass Contributor

So, when I upgrade every single copy of Windows 10 in my environment to 1903, can I deselect the "Windows 10" category and get rid of it wholly?

Silver Contributor

No, you still will need general Windows 10 branch/product to get updates after you upgrade to 1909 or later versions.

Brass Contributor

@wrootHuh? Was that sarcasm?

Silver Contributor

No. I don't see how my reply can be sarcastic. I'm just explaining why Windows 10 category still has to be selected.

Silver Contributor

Oh, maybe when Joe Lurie replied that future versions of Windows 10 will not requite separate categories, he actually meant that all future versions will use that new "Windows 10, 1903 and later" category. And maybe in that case older "Windows 10" category won't be needed indeed (if you have only 1903 or later versions in your network).

Copper Contributor
@Joe Lurie why will future versions not require this I actually like this idea more so you have better control. Its annoying to see updates for 1703, 1607, 1803 if they are builds I have never deployed in my environment then have to time consolingly deny them every single month. That fact that WSUS has not received a UI facelift in so long to better manage this stuff is disappointing especially if you don't tie it to SCCM. Same thing with freaking Itanium updates where is there no way to disable them or auto deny them if I dont have any of that hardware so every month I have to go deny them so they dont show in the unapproved interface. We still need to control so WUFB in the clound is not a good choice but WSUS needs improvement after a lot of stagnation Make this simpler on us please.
Deleted
Not applicable

I have all of this setup in WSUS and began testing on three computers.  Two of the three computers have identical hardware configs.  Two of the three have installed the updates while one continues to say that it's 100% patched and doesn't need this update.  It's one of the two identical machines.  Even when I check in with Microsoft updates, it still says there is nothing to install.  What gives?

Brass Contributor

@Joe Lurie 

 

The ADK really needs to be added in 'Tools' https://docs.microsoft.com/en-us/sccm/ or at least mentioned somewhere with a board to be able to discuss issues present.

 

There are components for IT Pro/Enterprise that are found in the ADK, and there is currently no where to adequately report issues - as Insider Community is useless and Feedback Hub is sub-par.

 

 

This isn't the first time the Servicing Stack has broken the Windows Recovery image - and there is no clear information as to why a repeat incident has occurred where components are uninstalled without reinstallation.

 

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/dear-microsoft-please-ensure-tha...

 

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/windows-1903-dear-microsoft-plea...

 

The MDT and ADK should come hand in hand - @Andre Da Costa even mentioned to post in the MDT forums in those spam posts I posted in the Answers Community: https://social.technet.microsoft.com/Forums/en-US/home?forum=mdt

 

@Yvette O'Meally The alternative was to stalk you on Twitter, and I'm lucky you bothered to reply and tag one of the Servicing Developers, so I could badger his twitter to make sure that the issue was known to resolve it as fast as possible.

 

Yet - if you notice on the 2nd post: https://answers.microsoft.com/en-us/windows/forum/windows_10-update/dear-microsoft-please-ensure-tha...

The very next Servicing Stack update was STILL not error-free - and furthermore referencing a dll that simply does not exist in the ADK.

Where are we suppose to report things like this?

 

I don't like doing this - but I've been using GitHub as a bug reporting platform as the ADK API is probably in the closed Intranet Microsoft.Dev and public have no access to those documents.

https://github.com/MicrosoftDocs/windows-itpro-docs/issues/3882

 

I've even began to track the File changes for Servicing Stack KBs in an attempt to narrow down the cause for the issues above, but also because trying to fish for information for ADK issues is a mammoth task as information is spread across dev blogs, news releases and community pages for techbench and msdn.

https://github.com/NeoBeum/SSU-Monitor/commit/7e2153874127b08f208d8cb6f9dfa138990bd6ed#diff-434b59b7...

Copper Contributor

Hi,

 

We are using WSUS to manage windows updates

 

In our organization, we have different windows 10 versions (1709 / 1703 / 1809.........).

 

I need to update all windows 10 pc to the same version 1903.

 

But I have configured WSUS as above instructions.

 

But I have got the below error on all windows 10 pc.

 

Windows 10.JPG

 

 

 1. Is it possible to get all windows 10 versions to 1903 using WSUS?

 

2. Could you please guide me to resolve above mentioned error

 

Thanks,

Waruna. 

 

Silver Contributor

You may try stopping the windows update service and deleting the SoftwareDistribution folder in C:\Windows, then run the service again. You also didn't mention if this error happens on all versions of Windows 10.

Copper Contributor

Hi, 

 

I tried to upgrade the 1803 to 1903 SAC Windows 10 enterprise edition,  I  download and install both feature and security update via "Windows update" directly,  and then i use the update tool directly from below Microsoft URL, after a 30 mins, the SAC build number updated to 1903, 

I just wonder is above upgrade process is correct and expected,  is there any easy or automatic way to do it?

BTW, I found offline device cannot run above update tool. so how we manage the offline device?

Actually, my key question is how we manage it in enterprise situation ? is above SCCM deploy including Build number upgrade? or just deployment the features update pack?

 

Thanks

Donovan LEE

 

 

https://www.microsoft.com/en-us/software-download/windows10?ranMID=24542&ranEAID=TnL5HPStwNw&ranSite...

 

Copper Contributor

@wroot 

Hi, Thanks for your response.  

I have followd mentioned instructions,

additional details, 

We have 150+ windows 10 computers with different version (1511 / 1507 / 1607 / 1703 / 1709 / 1803 / 1809).

We are using WSUS (Windows server 2016 - (1607) ) for distributing the update to that windows 10 computers.

We need to get all windows 10 computers to windows 10 1903 version.

 

All versions get the above-mentioned error. 

 

Silver Contributor

It was a few years ago and i was getting other error, but maybe it will help you. I had to do a few adjustments in IIS settings, so WSUS wouldn't choke on huge Windows 10 updates https://www.wroot.lt/wp/technology/wsus-woes-with-windows-10-en

Copper Contributor

I have upgraded some of my windows 10 1809 to 1903 and now all 1903 cannot get updates from my wsus server. I can get offices updates from wsus but not windows updates.  wsus downloads the 1903 updates from microsoft but i cannot get it from wsus. please help.  i have try stopping the WU service and delete the SD folder. but that didnt help. i check my gpo but there is nothing stand out to prevent it. 

 

 

thank you, 

Silver Contributor

Have you enabled new product in WSUS settings?

wsus-client.png

Copper Contributor

yes. my wsus got the updates for me to approve it. After i approve to my win 10 1903 groups, wsus download the updates. but after download to the wsus, wsus never push it out to client 1903. i even approve the servicing stack first but it never push down to 1903 after downloads. 

Silver Contributor

I'm not sure if you understand. You MUST enable "Windows 10, version 1903 and later" product in WSUS settings to be able to provide updates to Windows 10 after you upgrade to 1903. We have it enabled and our PCs get updates for 1903 just fine.

Copper Contributor

Capture.PNG

 

I do understand. i enable them already. 

Copper Contributor

I also check this box as someone else on the internet say that is what they have to do also. Capture.PNG

Silver Contributor

Upgrades classification is needed to be able to get big feature updates themselves (1809, 1903, etc.). It looks like your settings are correct. Although, you have products with drivers selected as well. I don't think this should cause this problem, but i personally do not distribute drivers via WSUS and it has caused various problems in the past.

Copper Contributor

Do you have a gpo that configured clients to just update from wsus and not the Internet?

does anyone experience this issue? or does anyone have a solution to this issue? thank you, 

Silver Contributor

Yes, we point to our WSUS server in GPO.

Copper Contributor
Copper Contributor

when i click on the link, it stated message cannot be found. 

Copper Contributor
Copper Contributor
Not sure why its no being found. Search for "Windows 10 Enterprise 64 bit 1809 update to 1903 with WSUS Update Fail with Error 0xc1900208"
Copper Contributor

still same message. 

Copper Contributor

I even manually install the latest servicing stack for 1903. still no luck. 

Copper Contributor

Capture.PNG

 

I have solve the issue. I change the gpo for wsus on the 1903 group to not configured. after i did that, wsus push updates for 1903. 

Silver Contributor

Well, you shouldn't be touching Windows Update for Business GPO settings when you use WSUS.

Copper Contributor

A little gotcha that tripped me up depending on your setup.  If you are using SCCM and Automatic Deployment Rules for specific product updates to specific collections, be sure to add 'Windows 10, version 1903 and later' to the product filter or they won't be pushed out.  If you just 'shotgun' everything out and let the computers figure it out, then it shouldn't be needed.

Copper Contributor

Hi,

Just come across a strange issue when using SCCM Servicing Plan to upgrade to Win 10 1903. I've added the "1903 or later" category to both SUP and SCCM. If under Servicing PLans you click on "all  Windows 10 Updates" you can see the 1903 updates, however if you try to create a plan under SAC ring you only get to see updates to 1809, nothing for 1903. If you select the apparently defunct SAC-T ring you can see the 1903 updates! We've never used the SAC-T ring anywhere and I know upgrade had previously been visible as our test VM's upgraded to 1903 last month (0 day offset), but later  deployments (+30 days in this case) are only showing the 1809 upgrade and not surprisingly I have 100% compliance :) 

 

I've confirmed with two other SCCM deployments that currently the 1903 Feature Update only shows up if you select the SAC-T ring!

 

Anyone have any idea what's happening here? Have updates been tagged with wrong ring?

 

Any and all suggestions welcomed :)

 

Richard

Copper Contributor

@wroot

 

According to your experience, in case we have only windows 10 version 1809 in the environment , which one of the following category we have to choose:

-windows 10, version 1809 and later, servicing drivers.

-windows 10, version 1809 and later, upgrades & servicing drivers.

- windows 10.

 

** Do we have to choose the last one(windows 10)?

 

w10 v 1809 category.jpg

 

Silver Contributor

Do you want to also distribute drivers? If not, then just these are enough:

Windows 10

Windows 10, version 1903 and later

Copper Contributor

Thanks a TON Joe.  I wasted a couple of hours troubleshooting before I found your article!

Version history
Last update:
‎May 30 2019 09:46 AM
Updated by: