[21h2] Win 10 End of Support vs. Updates

[Gongalong]

Hi folks,

 

I'm looking at Win 10 feature updates for the Summer and just wanted to check my understanding.

 

Normally we always rebuild classroom PCs in the Summer with the latest version of Win 10, but this Summer I am looking at going away for 4 weeks and won't have time to rebuild them, if I go away. We currently have 21H2 education on our classroom PCs, and that has an end of support life of 22/6/24. Therefore it leaves a gap of 3 or so weeks before the 2024 Summer hols start. I am trying to gauge how much that exposes us from a security point-of-view.

 

Is it absolutely the case that security updates stop at the end of the support life, or do critical updates, or some other class of updates, still get produced for the build?

 

Thanks

[Steve21]

In reality 21H2 and 22H2 are same base all the way back to 2004 so shouldn’t cause much issues

 

However I’m not sure why you wouldn’t just push the enablement patch out, few minutes and it’s upgraded and gives you another year on top it’s not a real upgrade anywhere from 2004-20H2-21H2-22H2

 

Steve

[Dos_Box]

Found this on here - https://learn.microsoft.com/en-us/lifecycle/overview/product-end-of-support-overview

 

Modern Policy. Product governed by the Modern Policy follow a continuous support and servicing model. Customers must take the latest update to remain supported. Products and services will provide a minimum of 12 months' notice prior to retirement

 

This was taken from the info on here - https://learn.microsoft.com/en-us/lifecycle/products/windows-10-enterprise-and-education - which states that Education versions are on the 'Modern' lifestyle policy.

Sorry about that, but it does look like there will be no security updates past that. What that means in reality (current threats etc.) is anyones guess. I'm also wondering whether ther desktops might receive upgrade nag messages once the end of life date is reached too.

Perhaps it might be better to schedule an upgrade this summer instead?

[Gongalong]

However I’m not sure why you wouldn’t just push the enablement patch out, few minutes and it’s upgraded and gives you another year on top it’s not a real upgrade anywhere from 2004-20H2-21H2-22H2

Normally we have the time in the Summer, and because we have a changing set of apps that go onto PCs, and it also acts as a good check of the hardware, we just go for the rebuild. This summer though I'd like to avoid it. If only the end of support life was mid-July...

 

We roll windows updates out on a monthly basis, typically middle of the month, to try and retain a balance between getting them on PCs and Microsoft breaking things. I appreciate there are different view on that, but factoring that in as well it does suggest that a window of 3-4 weeks might not be catastrophic.

[Steve21]

Normally we have the time in the Summer, and because we have a changing set of apps that go onto PCs, and it also acts as a good check of the hardware, we just go for the rebuild. This summer though I'd like to avoid it. If only the end of support life was mid-July...

 

We roll windows updates out on a monthly basis, typically middle of the month, to try and retain a balance between getting them on PCs and Microsoft breaking things. I appreciate there are different view on that, but factoring that in as well it does suggest that a window of 3-4 weeks might not be catastrophic.

 

I mean the enablement patch not a full rebuilt. The upgrade file for anything between 2004-22H2 is a less than 1mb file to upgrade them in place and a few minutes

 

That was released back in July, and should be easily testable on a few of your machines in advance. Takes about 5 minutes to install tops

 

Then when you next do a full rebuilt you’ll already have tested it anyway

 

Steve

[mavhc]

I'd go with multiple rings of rolling out updates, 1% of devices, then 10%, then 100%, if you pay MS they'll automate that for you too. But there's been no real changes in Win10, so just install the version updates, they're smaller than most monthly updates.

 

As soon as an update appears someone will reverse engineer it and use the discovered flaw to attack people, patch security things asap

[Gongalong]

However I’m not sure why you wouldn’t just push the enablement patch out, few minutes and it’s upgraded and gives you another year on top it’s not a real upgrade anywhere from 2004-20H2-21H2-22H2

This is the first I've heard of the enablement package, I'm surprised I've not seen mention of it! So you apply the package and it just updates the build? Why do feature updates through Windows update (or installing from a newer build) take so long, why don't Microsoft just use this package? I'm confused, LOL.

[Steve21]

This is the first I've heard of the enablement package, I'm surprised I've not seen mention of it! So you apply the package and it just updates the build? Why do feature updates through Windows update (or installing from a newer build) take so long, why don't Microsoft just use this package? I'm confused, LOL.

 

I guess the best way I can explain it would be like this.

 

1) So take 2004 as your current built, every month you get normal window updates (some of these are active updates, others are hidden and dormant features that are new but you can't see).

2) When testing for 21H1 is complete, they can just release a small update to "enable those dormant items" that are already installed on your computer from previous updates.

3) This then repeats each time so then you install some windows updates, with hidden 21h2 features, and again after testing they flick the dormant items on, therefore you've already installed those updates in the past just enabled them.

 

Compared with the feature update it's installing all of those updates you already have installed from scratch as such, so it takes the time for all of those to enable/install etc

 

We haven't used a single feature update since entablements were used really, unless we find an old device that's ancient to upgrade And then when we update our images over Summer and do refresh builds it just continues that way, we deploy 21h2 and the next enablement comes along and upgrades etc repeat the windows lifecycle

 

Steve

[Gongalong]

We use MEMCM for deployment and Windows Updates. Is it something you use, and can the enablement package be deployed with that? I've had a quick search but am not spotting a very clear guide on how to use the packages.

 

There are some benefits in rebuild the PCs as we do get to update the apps all in one blow, test all is good with the hardware, and get a clean install. Still, interesting to hear there's an alternate approach. I had heard that it was possible to apply feature updates through MEMCM.

[Steve21]

We use MEMCM for deployment and Windows Updates. Is it something you use, and can the enablement package be deployed with that? I've had a quick search but am not spotting a very clear guide on how to use the packages.

 

There are some benefits in rebuild the PCs as we do get to update the apps all in one blow, test all is good with the hardware, and get a clean install. Still, interesting to hear there's an alternate approach. I had heard that it was possible to apply feature updates through MEMCM.

 

As in sccm style mem or intune? But yes to both is the answer

 

As long as you have feature updates enabled as the category you should see the enablement packages and can just deploy them as normal in sccm. You’ll have both showing on the updates tab, just pick the enablement instead of the feature update and deploy as per normal (whether seperate deployment or as normal update package)

 

Steve

[Gongalong]

SCCM style MEMCM. We haven't broached Intune/Azure yet, at least in terms of adding computers (we have 365), and have some impediments to moving to that.

 

Deploying an enablement package sounds easy enough.