Edit

Share via

Integrate Windows Update client policies with management solutions

Looking for consumer information? See Windows Update: FAQ.

You can integrate Windows Update client policy deployments with existing management tools such as Windows Server Update Services (WSUS) and Microsoft Configuration Manager.

Tip

This feature was formerly known as Windows Update for Business.

Integrate Windows Update client policies with Windows Server Update Services

For Windows 10, version 1607 and later, devices can be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). When using both WSUS and Windows Update client policies:

  • Devices receive their Windows content from Microsoft and defer these updates according to Windows Update client policies
  • All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows won't follow your deferral policies.

Configuration example #1: Deferring Windows Update updates with other update content hosted on WSUS

Configuration:

  • Device is configured to defer Windows quality updates using Windows Update client policies
  • Device is also configured to be managed by WSUS
  • Device isn't configured to enable Microsoft Update (Update/AllowMUUpdateService = not enabled)
  • Admin has opted to put updates to Office and other products on WSUS
  • Admin has also put third-party drivers on WSUS
Content Metadata source Payload source Deferred?
Updates to Windows Windows Update Windows Update Yes
Updates to Office and other products WSUS WSUS No
Third-party drivers WSUS WSUS No

diagram of content flow

Configuration example #2: Excluding drivers from Windows quality updates using Windows Update client policies

Configuration:

  • Device is configured to defer Windows quality updates and to exclude drivers from Windows Update quality updates (ExcludeWUDriversInQualityUpdate = enabled)
  • Device is also configured to be managed by WSUS
  • Admin has opted to put Windows Update drivers on WSUS
Content Metadata source Payload source Deferred?
Updates to Windows (excluding drivers) Windows Update Windows Update Yes
Updates to Office and other products WSUS WSUS No
Drivers WSUS WSUS No

diagram of content flow 2

Configuration example #3: Device configured to receive Microsoft updates

Configuration:

  • Device is configured to defer quality updates using Windows Update client policies and to be managed by WSUS
  • Device is configured to receive updates for other Microsoft products along with updates to Windows (Update/AllowMUUpdateService = enabled)
  • Admin has also placed Microsoft Update, non-Microsoft, and locally published update content on the WSUS server

In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS weren't enabled.

  • In a non-WSUS case, these updates would be deferred just as any update to Windows would be.
  • However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies aren't applied.
Content Metadata source Payload source Deferred?
Updates to Windows (excluding drivers) Microsoft Update Microsoft Update Yes
Updates to Office and other products Microsoft Update Microsoft Update No
Drivers, third-party applications WSUS WSUS No

diagram of content flow 3

Note

Because the admin enabled Update/AllowMUUpdateService, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner.

Integrate Windows Update client policies with Microsoft Configuration Manager

For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update client policies (that is, setting deferral policies on those devices). Such devices are visible in the Configuration Manager console, however they appear with a detection state of Unknown.

Example of unknown devices.

For more information, see Integration with Windows Update client policies.