WUFB - OS version updates and GPO

[petben]

I want to move to WUFB (from WSUS) on our GPO controlled computers, it is already setup in Intune, but I am concerned that an incorrect setting may push out OS version updates. I want to apply feature updates automatically (22H2 to 24H2 for example), but I will do major OS upgrades (Win10 to Win11 for example) myself.

 

Which GPO settings should I set for this, the options seem very limited to 'Select Feature Updates - Yes'.

There is also the fact that some of the computers in the WUFB POlicy are Windows 10 and some are Windows 11.

 

Last questions I want to use WUFB for Servers too but have read varying reports of whether it works at all. Obvs the OS upgrade question is very relevant to this too.

Edited February 26, 2025 by petben

[jthompson]

WUFB works for servers in terms of the actual updating, GPO options, etc., but the reporting side of things (aka "Windows Update for Businsess reports") only shows client systems, not servers. To monitor/report your servers' updates, you'd have to work out some other way.

 

Our inventory system (GLPI) collects OS details which includes the OS build number, so we can determine the status of the monthly cumulative updates from that. For instance, the build number for Server 2022 with the most recent CU applied (Feb 2025) is 20348.3207, whereas the previous month's build was 20348.3091.

 

Another option is Azure Update Manager for your on-prem servers, using Azure Arc to get them to appear in Azure. That used to be free for on-prem servers, but now isn't.

 

In terms of Win10 and keeping it from updateing to 11, set up some WMI filters in Group Policy and have a Win10 WUFB GPO scoped to the Win10 WMI filter, and a Win11 WUFB GPO scoped to the Win11 WMI filter. The key option in the GPO(s) is going to be "Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Update → Windows Update for Business → Select the target Feature Update version". Set that accordingly in your Win10 and Win11 WUFB GPOs and you should be golden.

 

For the WMI filters, use:

 

Windows 10

Namespace: root\CIMv2

Query: select * from Win32_OperatingSystem where ((Version like "10.0.1%") and (ProductType="1"))

 

Windows 11

Namespace: root\CIMv2

Query: select * from Win32_OperatingSystem where ((Version like "10.0.2%") and (ProductType="1"))

[petben]

thanks for the detailed reply.

 

I am thinking to just put the Product version in the GPO, leaving the Target version as blank so Windows will get all feature updates but only in that OS version?

e.g.

"Windows 10"

"Windows 11"

 

do you know how I can get the exact Product version names for Server 2019, 2022 and 2025? Powershell..?

 

 

I have created the server WMI filters from various sources on web, but they seem very specific version numbers....what do you use?

 

[jthompson]

I don't specify any target version in the server GPOs. I leave it as Not configured and they're fine. They won't upgrade to the next version (i.e. a Server 2019 won't attempt to upgrade to Server 2022, etc.). That's been the case for the last year, at least, and I've never had any of them attempt their own in-place upgrade. All the in-place upgrades have been manual by me. You'll want to test your GPO,though, obvs.

 

Looking a bit more online, there's also this article - https://learn.microsoft.com/en-us/windows-server/get-started/manage-feature-updates-group-policy#disable-the-windows-server-2025-feature-update - which suggests leaving "Which Windows product version would you like to receive feature updates for?" blank and setting "Target Version for Feature Updates" to "hold".

 

The version numbers in your WMI filters look fine. Server 2022 is always going to be version 10.0.20348.xxxx, likewise for the others. The numbers look more specific than for Win10/11, but the % wildcards are the thing. Win11 23H2 is 10.0.22631.xxxx and 24H2 is 10.0.26100.xxxx.

Edited February 26, 2025 by jthompson

[petben]

thanks, so to condlude I will have a single server update GPO applied to any server on any OS, no server WMI filters.

In this GPO the feature update settings as https://learn.microsoft.com/en-us/windows-server/get-started/manage-feature-updates-group-policy#disable-the-windows-server-2025-feature-update.

will prevent auto updating:

2019 to 2025

2022 to 2025

 

and you're sure 2019 to 2022 will not just auto update...!?

 

[jthompson]

thanks, so to condlude I will have a single server update GPO applied to any server on any OS, no server WMI filters.

In this GPO the feature update settings as https://learn.microsoft.com/en-us/windows-server/get-started/manage-feature-updates-group-policy#disable-the-windows-server-2025-feature-update.

will prevent auto updating:

2019 to 2025

2022 to 2025

 

and you're sure 2019 to 2022 will not just auto update...!?

 

 

That's how I have my server WUFB GPO set (with the only difference being that I have the target version as not configured, rather than configured as "none").

 

Do test it against a 2019 server, though (spin up a temp 2019 server if you want). Certainly none of mine have ever attempted to upgrade themselves.

 

Another option might be to set "Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Update → Specify source service for specific classes of Windows Updates" such that feature updates are sourced from WSUS rather than Windows Update. I don't think you'll need to, but hey.

[petben]

hello jthompson, I dont suppose you had subsequent filtering/firewall changes after moving to WUFB. we are getting an error which we think is becuase the machines can't access the relevant places online. In the past they only needed to go to the WSUS server. did you make any chanes to filtering/firewall?

 

Thanks

[jthompson]

I don't have a list, but there'll obviosuly be some URLs that need to be allowed in order for machines to communicate with and donload from the Windows Update online services. Whether that's different from what WSUS would've required anyway, I've no idea. This is a list of URLs needed for a WSUS server, so maybe that's a decent place to start?

 

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc708605(v=ws.10)?redirectedfrom=MSDN#to-configure-your-firewall