Update Compliance

[mavhc]

Time to get rid of WSUS and wander into the new world of Update Compliance!

 

It's (probably) free, although do need to sign up to Azure and sms auth, and add a credit card, that the promise won't be used without you authorising it. Takes about 5 mins to create the Azure service once you click to create it.

 

https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb

 

https://docs.microsoft.com/en-us/windows/deployment/update/windows-analytics-get-started has a list of domains that need to bypass HTTPS interception.

 

GPO: Windows Components/Data Collection and Preview Build

Allow device name to be sent in Windows diagnostic data Enabled

Allow Telemetry Enabled

3 - Full

 

Configure the Commercial ID Enabled

Paste in your ID from the Azure portal.

 

Set p2p sharing for updates to reduce internet bandwidth.

[mavhc]

And after 1 month you have to switch from free trial to pay as you go, but it's still free. Also although the subscription changes it's still named Free Trial unless you change it, and even then takes a few mins to update

[mavhc]

Also while you're there, enable Update Readiness and Device Health, no other changes needed. Get reports on what caused your BSODs (driver, version number, which computers) and what apps crashed the most.

[mavhc]

Device Health pointed out that an ethernet driver in 1 model of desktop we had was crashing sometimes, so updated that (weirdly would update from clicking update drive in Device Manager, but not from WU)

 

Also

 

Just in time for 1909

[garethEds]

So is this the way forward from WSUS?

 

Gareth

[free780]

It's a shame you can't specify 1809 for example. You can get updates to happen out of hours. You can set the policies without the Azure part but you get no reporting.

[DrCheese]

Is there any way to sign up for azure without putting Credit Card details in? We don't have a school credit card and for obvious reasons I don't want to use my own!

[mavhc]

I just used my own, they said they won't charge it without asking, at which point I'd change it to something the school would use. They also said it shouldn't cost anything.

 

I'm pretty sure MS want to replace WSUS with this, given all the effort they've put into this, and all the no effort they've put into WSUS. Really they want to kill Windows Server entirely, all their new stuff is "Only works if you pay for Azure AD Premium" etc. Good way to get me signed into Azure and using the free stuff, now I'll be happier switching to their paid stuff because I'm already used to it.

 

You can delay feature updates for 365 days

[deano3693]

Anyone using this and how useful have you found it? Are you just using it for Update Compliance or also Device Health etc?

[mdrabble]

How does this fit in with the likes of SCCM?

[mavhc]

Device Health has pointed out to me that my hp desktops were having an ethernet driver issue, updated driver, seems fine now, wouldn't have noticed otherwise

[robyholmes]

I've set this up today but I'm unsure how this fits with WSUS. Do I remove the WSUS settings and point it to Windows Update?

[sparkeh]

I've set this up today but I'm unsure how this fits with WSUS. Do I remove the WSUS settings and point it to Windows Update?

Update Compliance just reports on the state of your machines, so you still need a way of getting the updates installed on your machines. This could be with WSUS, Windows Update for Business, direct with Windows Update etc.

 

Personally, I use sccm which leverages WSUS, I wouldn't recommend stopping using WSUS to go to directly using Windows Update. If you are happy with WSUS continue to use it and add in Update Compliance for reporting.

[robyholmes]

Update Compliance just reports on the state of your machines, so you still need a way of getting the updates installed on your machines. This could be with WSUS, Windows Update for Business, direct with Windows Update etc.

 

Personally, I use sccm which leverages WSUS, I wouldn't recommend stopping using WSUS to go to directly using Windows Update. If you are happy with WSUS continue to use it and add in Update Compliance for reporting.

 

Got it, confirmed what I've just found. I think I was thinking of Windows Update for Business. I'll stick with WSUS for now then as its working. Cheers

[mavhc]

If it's working not much reason to change, problem is MS have moved on to p2p delivery etc, WSUS rarely copes well with drivers for example, and now you have store apps updating, and computers not on the network needing updates, and hourly AV updates.

 

75% on 1909

25% on 1903

[PyROm]

Am I right in thinking device health is now part of Desktop Analytics, so needs A3 license or above to use?

[mavhc]

Would explain why that and the compatibility one have vanished from my dashboard

[SpaceInvader83]

Has anyone had any issues where Update Compliance on the Azure dash just stops updating? I've had it a couple of times in the past year and both times have ended up starting again and pushing out the new Commercial ID to my clients.

 

In the Log Analytics workspace it has this under the Resource Health: We are currently unable to determine the health of this workspace.

Edited November 18, 2020 by SpaceInvader83

[mavhc]

I've had it where it doesn't update for a few days, guess the free tier is lowest priority

[mavhc]

https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-get-started is the new url, old one doesn't explain much about signing up

[garethEds]

Also while you're there, enable Update Readiness and Device Health, no other changes needed. Get reports on what caused your BSODs (driver, version number, which computers) and what apps crashed the most.

 

Where do I find these two things mate?

 

Gareth

[caffrey]

@Katy has a good blog on it @garethedmondson

 

https://katystech.blog/2021/06/wufb-and-update-compliance/

[mavhc]

Where do I find these two things mate?

 

Gareth

 

I think they're not free any more, they vanished from my azure.