Windows updates

[SeeFights]

Hi all - apologies if this doesn't belong here but i was wondering how or what ways do people run windows updates on scale without physically logging into each machine, running windows updates and restarting each machine. We only have about 100PC's but when I'm doing this on my own it can take 1-2 days depending on how out of date a machine is.

 

I googled somethings and found Command Prompting "UsoClient ScanInstallWait" is meant to scan, download, install and restart the machine but it doesn't do anything.

 

I then found I can use powershell and do "powershell.exe -command "(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()"" and thats meant to do the same thing however I cant find a way to run Powershell in CMD.

 

See we use Senso as a monitoring software and it lets us run modules and one of them is CMD but I wanted to know if theres an alternative i could be doing?

[GK1999]

Are you domain-joined? If so WUfB 

 

Intune? Autopatch 

[SeeFights]

Just now, GK1999 said:

Are you domain-joined? If so WUfB 

 

Intune? Autopatch 

we are domain joined, whats wufb?

[GK1999]

Just now, SeeFights said:

we are domain joined, whats wufb?

Windows Update for Business

 

Windows Update for Business (WUfB) is a free Microsoft cloud-based service that allows IT administrators to manage and automate updates (security, quality, drivers, and features) for Windows 10/11 devices, reducing the need for on-premises infrastructure like WSUS. It uses update rings for controlled, phased deployment. 

[SeeFights]

Just now, GK1999 said:

Windows Update for Business

 

Windows Update for Business (WUfB) is a free Microsoft cloud-based service that allows IT administrators to manage and automate updates (security, quality, drivers, and features) for Windows 10/11 devices, reducing the need for on-premises infrastructure like WSUS. It uses update rings for controlled, phased deployment. 

aha sadly we are a wsus based network. guessing its not compatable?

[GK1999]

Just now, SeeFights said:

aha sadly we are a wsus based network. guessing its not compatable?

Get rid of WSUS and use WUfB. WSUS is now deprecated. 

 

Best move I ever did was to bin WSUS off in favour for WUfB

 

 

 

[3s-gtech]

You just switch your Group Policies over from WSUS to WUfB and turn off your WSUS server. Even with WSUS, you should never have needed to manually update them - Group Policy allows you control this.

 

  

1 minute ago, GK1999 said:

Get rid of WSUS and use WUfB. WSUS is now deprecated. 

 

Best move I ever did was to bin WSUS off in favour for WUfB

 

 

 

 

Agreed. Poxy server needed constant maintenance.

Edited April 1 by 3s-gtech

[SeeFights]

1 minute ago, GK1999 said:

Get rid of WSUS and use WUfB. WSUS is now deprecated. 

 

Best move I ever did was to bin WSUS off in favour for WUfB

 

 

 

sadly i am not the network manager, just  a tech so i have no persuasion in these swaps.

[SeeFights]

Just now, 3s-gtech said:

You just switch your Group Policies over from WSUS to WUfB and turn off your WSUS server. Even with WSUS, you should never have needed to manually update them - Group Policy allows you control this.

the computers seem to pull updates but i still have to manually log in to each one and then run windows update.

[3s-gtech]

Your Group Policy settings aren't complete then - GP can auto-schedule updates, install and restart PCs. It's in the Computer Configuration settings.

[SeeFights]

Just now, 3s-gtech said:

Your Group Policy settings aren't complete then - GP can auto-schedule updates, install and restart PCs. It's in the Computer Configuration settings.

ill have a little poke around the Group Policy settings then, we are quite happy with WSUS (much better then what we had before) its just when it comes to half terms 3/4 of my job is going round, updating pcs and restarting them. Sounds easy but its a task i know should be automated.

[SeeFights]

5 minutes ago, 3s-gtech said:

Your Group Policy settings aren't complete then - GP can auto-schedule updates, install and restart PCs. It's in the Computer Configuration settings.

update - found the policy setting and we only had 1 configured. great.

 

Configuring them now, thanks for the help.

[Olliedawg]

Have a look at Action1. It would be free for you with only 100 endpoints, this can completely automate windows updates, plus third party applications.

[3s-gtech]

See the below. Computer Configuration --> Policies --> Administrative Templates --> Windows Components --> Windows Update --> Manage end user experience (that's in the 25H2 ADMX, it will differ in earlier ones)

[SeeFights]

59 minutes ago, 3s-gtech said:

See the below. Computer Configuration --> Policies --> Administrative Templates --> Windows Components --> Windows Update --> Manage end user experience (that's in the 25H2 ADMX, it will differ in earlier ones)

The above is currently what i have configured. I also have configured the below to help with when the PC should restart;

 

We just struggle with staff members constantly ignoring updates. Critical updates can be pending for months and when we ask we can never get their machines so this is a big help if it works

Edited April 1 by SeeFights

[jmak]

But seriously - you need to ditch WSUS and move to WUfB. WSUS was always a necessary evil - it needed a lot of love to keep it reliable. With WUfB you remove one more pain point. 

 

Also, once per half term is not nearly often enough to run updates. We run them every day. Shared machines get force rebooted every night. Single user machines get a forced reboot once a week ) users get a notification when there's an update waiting to be installed. If they fail to choose a time convenient to them, they lose control and it's forced on them over the weekend. There were moans when we first implemented it, but users soon learned that it's better to choose a time than be unexpectedly forced into it.

[SeeFights]

1 minute ago, jmak said:

But seriously - you need to ditch WSUS and move to WUfB. WSUS was always a necessary evil - it needed a lot of love to keep it reliable. With WUfB you remove one more pain point. 

 

Also, once per half term is not nearly often enough to run updates. We run them every day. Shared machines get force rebooted every night. Single user machines get a forced reboot once a week ) users get a notification when there's an update waiting to be installed. If they fail to choose a time convenient to them, they lose control and it's forced on them over the weekend. There were moans when we first implemented it, but users soon learned that it's better to choose a time than be unexpectedly forced into it.

Sadly, we cant move from WSUS as I am not the NW Manager - We are in the near future (12 months) moving to Chrome due to moving into a trust but I mean...its a pain my ass when i remote onto someone's machine and see the red windows update icon.

The way i have it configured now will be;

• Check every day
• Auto Download and Schedule
• Auto Install Every Week
  • Dont auto restart between 8AM and 4PM
• Auto restart when the following is met;
  • Non Critical updates have been waiting to install for >4 Days
  • Critical updates have been waiting >7 Days.

Sadly our machines are made up of Laptops and Desktops but the main culprit is the desktops.

[msi_school]

15 minutes ago, SeeFights said:

• Auto restart when the following is met;
  • Non Critical updates have been waiting to install for >4 Days
  • Critical updates have been waiting >7 Days.

I think you have these two the wrong way round

[SeeFights]

1 minute ago, msi_school said:

I think you have these two the wrong way round

this is what the setting says, should they be swapped?

[msi_school]

Windows updates are confusing, especially as WSUS is depreciated so Microsoft are not even trying to keep it upto date with their current terminology. 

 

The comment I quoted had critical and non critical updates listed and I assume you will wan to have the critical ones installed ASAP whilst the Non critical ones can wait.

 

Your second comment is looking at Quality and Feature updates. Quality updates are the monthly updates and contain bug fixes, Driver updates and minor tweaks. These need to be installed quickly as they are fixing issues in your install, it is considered good pactice to install these with in 14 days of release.

 

Feature updates are new releases of WIndows such as 25H2, 26H1 these have much larger changes and are not required to be installed for security reasons for longer as the previous version will still be supported good practice for these depends on the EOL date of the previous version.

 

These time scales are both within the range I would expect and are so much better than your current system of updating at half term.

[SeeFights]

1 minute ago, msi_school said:

Windows updates are confusing, especially as WSUS is depreciated so Microsoft are not even trying to keep it upto date with their current terminology. 

 

The comment I quoted had critical and non critical updates listed and I assume you will wan to have the critical ones installed ASAP whilst the Non critical ones can wait.

 

Your second comment is looking at Quality and Feature updates. Quality updates are the monthly updates and contain bug fixes, Driver updates and minor tweaks. These need to be installed quickly as they are fixing issues in your install, it is considered good pactice to install these with in 14 days of release.

 

Feature updates are new releases of WIndows such as 25H2, 26H1 these have much larger changes and are not required to be installed for security reasons for longer as the previous version will still be supported good practice for these depends on the EOL date of the previous version.

 

These time scales are both within the range I would expect and are so much better than your current system of updating at half term.

i always thought non critical and critical is the unfancy way of calling Quality and Feature updates - my bad!

[Zedster1974-MGS]

+1 for  Action 1 - Unified Cross-Platform Patch Management | Action1  first 200 devices are free

[AlphamaleZed]

I run windows updates through GPO/InTune daily. Servers once a week too.

I have a enforce shutdown PC daily at 10pm etc...

I have also set internal PCs to content cache off of eachother so its not bulk pulling a whole load of PCs.

 

We have solar so I have set PCs to switch on everyday at 7:30-8 weekdays only and then switch off about 1 hour inactivity enough to get windows updates.

 

DM Me and i can send you what settings you need if your doing the same setup. Works a treat!

[sigma]

On 01/04/2026 at 10:20, SeeFights said:

Sadly, we cant move from WSUS as I am not the NW Manager - We are in the near future (12 months) moving to Chrome due to moving into a trust but I mean...its a pain my ass when i remote onto someone's machine and see the red windows update icon.

The way i have it configured now will be;

• Check every day
• Auto Download and Schedule
• Auto Install Every Week
  • Dont auto restart between 8AM and 4PM
• Auto restart when the following is met;
  • Non Critical updates have been waiting to install for >4 Days
  • Critical updates have been waiting >7 Days.

Sadly our machines are made up of Laptops and Desktops but the main culprit is the desktops.

We too enforce an auto shutdown every night with onsite devices.

 

I am more cautious with updates though since the current risk of new updates breaking things is greater then not installing them quickly "in most cases".  That means I don't install them until I am happy with them, and sometime I skip some completely.  We are not Microsoft's Beta testers.  I have a poweshell script to fix devices that have stopped playing nice with WSUS.

 

It's always teacher laptops that cause the biggest problems. 

 

 

[ultraspy2000]

Just like few others have mentioned Action1 is very good option.  

Unified Cross-Platform Patch Management | Action1