[mdt] Adding MS updates in to your deployment of Windows 10

[kennysarmy]

Can I ask how everyone updates their Windows 10 deployments with the latest updates?

 

I've been reading through a few online posts, one mentions doing it via WSUS Offline Updater - is that the preferred method or is there a better way?

 

I have a WSUS server.

[CHiLL]

We use SCCM for it. When an OS is deployed, one of the steps in the Task Sequence is to look for and install all available updates at that time. I have an update rule that runs every second Wednesday (day after patch Tuesday) to look for and download available updates. That is then deployed to a defined collection of computers. SCCM also has another feature called 'Scheduled Updates', which allows you to effectively inject the available updates into your WIM. That way there's less work for the machine to do during the OSD.

[kennysarmy]

I don't have SCCM - just using MDT / WDS

 

Think I'll give the WSUS Offline Updater option a go...

 

If it's good enough for Bernardo !

 

[computer_expert]

I use OSDBuilder to inject the latest updates into the WIM. Anything else is then pulled from WSUS.

[kennysarmy]

So partly a success...

 

I've downloaded the updates using the WSUS Offline Update tool and can call the Update.cmd file which attempts to apply the updates at the end of my MDT task sequence.

 

 

The process begins and it installs kb4515383 which is "Servicing stack update for Windows 10 version 1903"

 

The command prompt then says "Installation Successful. Please reboot your system now and recall update afterwards"

 

I also get the Deployment Success screen, so as far as the deployment process goes, everything in the task sequence has finished.

 

 

Is it possible to reboot the PC automatically and then call the Update.cmd file again to install the main batch of updates?

[computer_expert]

Enable the pre/post windows update task sequence steps (just above your 'custom tasks' folder). This should then pull the latest updates from from your WSUS server, providing the machine has either applied GPO with WSUS configuration, or you have manually specified WSUSServer in customsettings.ini as below:

 

WSUSServer=http://wsus-server.fqdn:8530

 

MDT will then handle the reboots for you.

 

If you want to continue with WSUSOffline, you'd have to manually watch the WSUSOffline process and see how many reboots it needs (it's variable), then keep calling update.cmd from the TS like you are, then using the MDT task sequence step to reboot the PC every time WSUSoffline requests a reboot. If you don't let MDT handle the reboots then you will break the task sequence.