Table of contents
TOC
Collapse the table of content
Expand the table of content

Configure Windows Update for Business

Dani Halfin|Last Updated: 2/2/2017
|
1 Contributor

Applies to

  • Windows 10
  • Windows 10 Mobile

Looking for consumer information? See Windows Update: FAQ

You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for both Windows 10, version 1511, and Windows 10, version 1607. The MDM policies use the OMA-URI setting from the Policy CSP.

Important

For Windows Update for Business policies to be honored, the Telemetry level of the device must be set to 1 (Basic) or higher. If it is set to 0 (Security), Windows Update for Business policies will have no effect. For instructions, see Configure the operating system telemetry level.

Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic and in Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile.

Start by grouping devices

By grouping devices with similar deferral periods, administrators are able to cluster devices into deployment or validation groups which can be as a quality control measure as updates are deployed in Windows 10. With deferral windows and the ability to pause updates, administrators can effectively control and measure update deployments, updating a small pool of devices first to verify quality, prior to a broader roll-out to their organization. For more information, see Build deployment rings for Windows 10 updates.

Tip

In addition to setting up multiple rings for your update deployments, also incorporate devices enrolled in the Windows Insider Program as part of your deployment strategy. This will provide you the chance to not only evaluate new features before they are broadly available to the public, but it also increases the lead time to provide feedback and influence Microsoft’s design on functional aspects of the product. For more information on Windows Insider program, see https://insider.windows.com/.

Configure devices for Current Branch (CB) or Current Branch for Business (CBB)

With Windows Update for Business, you can set a device to be on either the Current Branch (CB) or the Current Branch for Business (CBB) servicing branch. For more information on this servicing model, see Windows 10 servicing options.

Release branch policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > Select when Feature Updates are received
\Policies\Microsoft\Windows\WindowsUpdate\BranchReadinessLevel
GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Upgrades and Updates
\Policies\Microsoft\Windows\WindowsUpdate\DeferUpgrade
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
BranchReadinessLevel
\Microsoft\PolicyManager\default\Update\BranchReadinessLevel
MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
RequireDeferredUpgrade
\Microsoft\PolicyManager\default\Update\RequireDeferUpgrade

Configure when devices receive Feature Updates

After you configure the servicing branch (CB or CBB), you can then define if, and for how long, you would like to defer receiving Feature Updates following their availability from Microsoft on Windows Update. You can defer receiving these Feature Updates for a period of 180 days from their release by setting the DeferFeatureUpdatesPeriodinDays value.

Important

This policy does not apply to Windows 10 Mobile Enterprise.

Examples

SettingsScenario and behavior
Device is on CB
DeferFeatureUpdatesPeriodinDays=30
Feature Update X is first publically available on Windows Update as a CB in January. Device will not receive update until February, 30 days later.
Device is on CBB
DeferFeatureUpdatesPeriodinDays=30
Feature Update X is first publically available on Windows Update as a CB in January. Four months later, in April, Feature Update X is released to CBB. Device will receive the Feature Update 30 days following this CBB release and will update in May.


Defer Feature Updates policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > Select when Feature Updates are received
\Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdates
\Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdatesPeriodInDays
GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Upgrades and Updates
\Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
DeferFeatureUpdatesPeriodInDays
\Microsoft\PolicyManager\default\Update\DeferFeatureUpdatesPeriodInDays
MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
DeferUpgrade
\Microsoft\PolicyManager\default\Update\RequireDeferUpgrade

Pause Feature Updates

You can also pause a device from receiving Feature Updates by a period of up to 60 days from when the value is set. After 60 days has passed, pause functionality will automatically expire and the device will scan Windows Update for applicable Feature Updates. Following this scan, Feature Updates for the device can then be paused again.

Important

This policy does not apply to Windows 10 Mobile Enterprise.

Pause Feature Updates policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > Select when Feature Updates are received
\Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates
GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Upgrades and Updates
\Policies\Microsoft\Windows\WindowsUpdate\Pause
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
PauseFeatureUpdates
\Microsoft\PolicyManager\default\Update\PauseFeatureUpdates
MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
DeferUpgrade
\Microsoft\PolicyManager\default\Update\Pause

You can check the date Feature Updates were paused at by checking the registry key PausedFeatureDate under HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings.

The local group policy editor (GPEdit.msc) will not reflect if your Feature Update Pause period has expired. Although the device will resume Feature Updates after 60 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Feature Updates, you can check the status registry key PausedFeatureStatus under HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings.

ValueStatus
0Feature Updates not paused
1Feature Updates paused
2Feature Updates have auto-resumed after being paused

Configure when devices receive Quality Updates

Quality Updates are typically published the first Tuesday of every month, though can be released at any time by Microsoft. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 35 days from their release by setting the DeferQualityUpdatesPeriodinDays value.

You can set your system to receive updates for other Microsoft products—known as Microsoft Updates (such as Microsoft Office, Visual Studio)—along with Windows Updates by setting the AllowMUUpdateService policy. When this is done, these Microsoft Updates will follow the same deferral and pause rules as all other Quality Updates.

Important

This policy defers both Feature and Quality Updates on Windows 10 Mobile Enterprise.

Defer Quality Updates policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > Select when Quality Updates are received
\Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdates
\Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdatesPeriodInDays
GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Upgrades and Updates
\Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
DeferQualityUpdatesPeriodInDays
\Microsoft\PolicyManager\default\Update\DeferQualityUpdatesPeriodInDays
MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
DeferUpgrade
\Microsoft\PolicyManager\default\Update\RequireDeferUpdate

Pause Quality Updates

You can also pause a system from receiving Quality Updates for a period of up to 35 days from when the value is set. After 35 days has passed, pause functionality will automatically expire and the system will scan Windows Updates for applicable Quality Updates. Following this scan, Quality Updates for the device can then be paused again.

Important

This policy pauses both Feature and Quality Updates on Windows 10 Mobile Enterprise.

Pause Quality Updates policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > Select when Quality Updates are received
\Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdates
GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Upgrades and Updates
\Policies\Microsoft\Windows\WindowsUpdate\Pause
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
PauseQualityUpdates
\Microsoft\PolicyManager\default\Update\PauseQualityUpdates
MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
DeferUpgrade
\Microsoft\PolicyManager\default\Update\Pause

You can check the date that Quality Updates were paused at by checking the registry key PausedQualityDate under HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings.

The local group policy editor (GPEdit.msc) will not reflect if your Quality Update Pause period has expired. Although the device will resume Quality Updates after 35 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Quality Updates, you can check the status registry key PausedQualityStatus under HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings.

ValueStatus
0Quality Updates not paused
1Quality Updates paused
2Quality Updates have auto-resumed after being paused

Exclude drivers from Quality Updates

In Windows 10, version 1607, you can selectively option out of receiving driver update packages as part of your normal quality update cycle. This policy will not pertain to updates to inbox drivers (which will be packaged within a security or critical update) or to Feature Updates, where drivers may be dynamically installed to ensure the Feature Update process can complete.

Exclude driver policies

PolicySets registry key under HKLM\Software
GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates
\Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate
MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
ExcludeWUDriversInQualityUpdate
\Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate

Summary: MDM and Group Policy for version 1607

Below are quick-reference tables of the supported Windows Update for Business policy values for Windows 10, version 1607.

GPO: HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

GPO KeyKey typeValue
BranchReadinessLevelREG_DWORD16: systems take Feature Updates for the Current Branch (CB)
32: systems take Feature Updates for the Current Branch for Business (CBB)
Note: Other value or absent: receive all applicable updates (CB)
DeferQualityUpdatesREG_DWORD1: defer quality updates
Other value or absent: don’t defer quality updates
DeferQualityUpdatesPeriodinDaysREG_DWORD0-30: defer quality updates by given days
PauseQualityUpdatesREG_DWORD1: pause quality updates
Other value or absent: don’t pause quality updates
DeferFeatureUpdatesREG_DWORD1: defer feature updates
Other value or absent: don’t defer feature updates
DeferFeatureUpdatesPeriodinDaysREG_DWORD0-180: defer feature updates by given days
PauseFeatureUpdatesREG_DWORD1: pause feature updates
Other value or absent: don’t pause feature updates
ExcludeWUDriversInQualityUpdateREG_DWORD1: exclude Windows Update drivers
Other value or absent: offer Windows Update drivers

MDM: HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Update

MDM KeyKey typeValue
BranchReadinessLevelREG_DWORD16: systems take Feature Updates for the Current Branch (CB)
32: systems take Feature Updates for the Current Branch for Business (CBB)
Note: Other value or absent: receive all applicable updates (CB)
DeferQualityUpdatesPeriodinDaysREG_DWORD0-30: defer quality updates by given days
PauseQualityUpdatesREG_DWORD1: pause quality updates
Other value or absent: don’t pause quality updates
DeferFeatureUpdatesPeriodinDaysREG_DWORD0-180: defer feature updates by given days
PauseFeatureUpdatesREG_DWORD1: pause feature updates
Other value or absent: don’t pause feature updates
ExcludeWUDriversinQualityUpdateREG_DWORD1: exclude Windows Update drivers
Other value or absent: offer Windows Update drivers

Update devices from Windows 10, version 1511 to version 1607

Due to the changes in the Windows Update for Business feature set, Windows 10, version 1607, uses different GPO and MDM keys than those available in version 1511. However,Windows Update for Business clients running version 1511 will still see their policies honored after they update to version 1607; the old policy keys will continue to exist with their values ported forward during the update. Following the update to version 1607, it should be noted that only the version 1511 keys will be populated and not the new version 1607 keys, until the newer keys are explicitly defined on the device by the administrator.

How version 1511 policies are respected on version 1607

When a client running version 1607 sees an update available on Windows Update, the client will first evaluate and execute against the Windows Updates for Business policy keys for version 1607. If these are not present, it will then check to see if any of the version 1511 keys are set and defer accordingly. Update keys for version 1607 will always supersede the version 1511 equivalent.

Comparing the version 1511 keys to the version 1607 keys

In the Windows Update for Business policies in version 1511, all the deferral rules were grouped under a single policy where pausing affected both upgrades and updates. In Windows 10, version 1607, this functionality has been broken out into separate polices: deferral of Feature and Quality Updates can be enabled and paused independently of one other.

Group Policy keys
Version 1511 GPO keysVersion 1607 GPO keys
DeferUpgrade: enable/disable
    Enabling allows user to set deferral periods for upgrades and updates. It also puts the device on CBB (no ability to defer updates while on the CB branch).

DeferUpgradePeriod: 0 - 8 months

DeferUpdatePeriod: 1 – 4 weeks

Pause: enable/disable
   Enabling will pause both upgrades and updates for a max of 35 days
DeferFeatureUpdates: enable/disable
BranchReadinessLevel
   Set device on CB or CBB
DeferFeatureUpdatesPeriodinDays: 1 - 180 days

PauseFeatureUpdates: enable/disable
   Enabling will pause Feature updates for a max of 60 days
DeferQualityUpdates: Enable/disable

DeferQualityUpdatesPeriodinDays: 0 - 30 days

PauseQualityUpdates: enable/disable
   Enabling will pause Quality updates for a max of 35 days
ExcludeWUDrivers: enable/disable
MDM keys
Version 1511 MDM keysVersion 1607 MDM keys
RequireDeferUpgade: bool
   Puts the device on CBB (no ability to defer updates while on the CB branch).

DeferUpgradePeriod: 0 - 8 months

DeferUpdatePeriod: 1 – 4 weeks

PauseDeferrals: bool
   Enabling will pause both upgrades and updates for a max of 35 days
BranchReadinessLevel
   Set system on CB or CBB

DeferFeatureUpdatesPeriodinDays: 1 - 180 days

PauseFeatureUpdates: enable/disable
   Enabling will pause Feature updates for a max of 60 days
DeferQualityUpdatesPeriodinDays: 0 - 30 days

PauseQualityUpdates: enable/disable
    Enabling will pause Quality updates for a max of 35 days
ExcludeWUDriversInQualityUpdate: enable/disable</td>
© 2017 Microsoft