4.3MD-102Intermediate

Est: ~15 mins•Verified: 2026-08

Windows Update for Business: Update Rings & Policies

Design and implement Windows Update for Business (WUfB) deployment rings, quality and feature update deferrals, expedited zero-day patches, and driver management.

Tags:#WUfB#Windows Updates#Update Rings#Feature Updates#Quality Updates#MD-102

Overview

Windows Update for Business (WUfB) is a cloud-based patch management solution that integrates directly with the Windows Update cloud service. It eliminates the need to maintain on-premises Windows Server Update Services (WSUS) infrastructure.

Through Microsoft Intune, administrators manage updates using four key policy types:

Update Rings for Windows 10 and Later: Defines cadence, servicing channels (General Availability), deferral periods, deadline compliance windows, and user restart behavior.
Feature Updates for Windows 10 and Later: Locks fleets to a specific target Windows version (e.g., Windows 11 23H2 or 24H2) and prevents unapproved major OS upgrades.
Quality Updates for Windows 10 and Later (Expedited Updates): Overrides standard deferral rings to immediately install out-of-band or critical security zero-day patches via the Windows Update Medic Service.
Driver Updates for Windows 10 and Later: Approves, schedules, and pauses OEM driver and firmware updates through Intune.

---

When to Use

Deployment Ring	Target Audience	Deferral (Quality)	Deferral (Feature)	Purpose
Ring 0: Preview / IT	IT Staff, Volunteers (5%)	0 days	0 days	Early validation of patches against line-of-business tools.
Ring 1: Pilot / Early	Business Unit Champions (15%)	3–5 days	14 days	Validates stability across diverse hardware models.
Ring 2: Broad Production	General Employees (80%)	7–14 days	60–90 days	Maximum stability; prevents widespread patch disruption.
Expedited Policy	High-Risk Zero-Day Threat	Bypass (0 days)	N/A	Enforces immediate installation and reboot for active CVE exploits.

---

Prerequisites

Licensing Requirements:

Windows 10/11 Pro, Enterprise, or Education.
Microsoft 365 E3/E5, Business Premium, or Intune Plan 1.
Windows Update for Business deployment service (WUfB-DS) requires Windows Enterprise E3/E5 or Microsoft 365 E3/E5 for Driver and Expedited policies.

Endpoint Telemetry Requirements:

Windows Diagnostic Data must be set to at least Required (formerly Basic).
Network access to:
*.prod.do.dsp.mp.microsoft.com (Delivery Optimization)
*.update.microsoft.com
*.delivery.mp.microsoft.com

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Windows
        └── Manage updates
            ├── Update rings for Windows 10 and later
            ├── Feature updates for Windows 10 and later
            ├── Quality updates for Windows 10 and later (Expedite)
            └── Driver updates for Windows 10 and later

---

Step-by-Step Implementation

Step 1: Create an Update Ring for Windows 10 and Later

Navigate to Intune Admin Center > Devices > Windows > Manage updates > Update rings for Windows 10 and later > Create profile.
Name: WUfB-Ring-2-BroadProduction.
Configure settings:

Servicing channel: General Availability channel
Quality update deferral period (days): 7
Feature update deferral period (days): 0 (Best practice: Defer features using Feature Update Profiles instead)
Automatic update behavior: Auto install and restart at scheduled time (or Auto install and restart at maintenance time)
Active hours start: 8 AM | Active hours end: 5 PM
Deadline settings:
Quality update deadline (days): 3
Feature update deadline (days): 7
Grace period (days): 2
Auto reboot before deadline: Yes

Assignments: Assign to group Sec-Devices-Broad-Production.

Step 2: Create a Feature Update Profile (Version Lock)

Under Manage updates, select Feature updates for Windows 10 and later > Create profile.
Feature update to deploy: Select Windows 11, version 23H2.
Rollout options: Make update available as soon as possible (or Roll out updates gradually).
This ensures machines on Windows 10/11 upgrade specifically to 23H2 and do NOT automatically jump to newer preview builds.

Step 3: Configure Expedited Security Quality Update (Zero-Day Emergency)

Select Quality updates for Windows 10 and later > Create profile.
Expedite installation of quality updates if device OS version less than: Select latest security release (e.g., 2026.08 B Security Updates for Windows 11).
Number of days until restart is enforced: 1 (or 0 for emergency immediate restart).
Assign to target devices to bypass standard ring deferral days.

---

PowerShell Automation

Inspect WUfB Policy Values Configured via Registry:

PowerShell

# Query Intune MDM Update policy registry keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update" | 
    Select-Object DeferQualityUpdatesPeriodInDays, DeferFeatureUpdatesPeriodInDays, ConfigureDeadlineForQualityUpdates, ActiveHoursStart, ActiveHoursEnd

# Query Windows Update Agent client state
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Results = $Searcher.Search("IsInstalled=0 and Type='Software'")
Write-Host "Pending Updates Count: $($Results.Updates.Count)"

Force Immediate Windows Update Scan & Detection:

PowerShell

# Triggers Windows Update background scan using USOClient
usoclient.exe StartScan
usoclient.exe StartDownload

---

Microsoft Graph Automation

Query Update Rings Configured in Intune via Graph:

PowerShell

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# List all Windows Update deployment rings
Get-MgDeviceManagementWindowsUpdateScheduledInstall | 
    Select-Object id, scheduledInstallDay, scheduledInstallTime

# Get active update ring configurations
Get-MgDeviceManagementDeviceConfiguration -Filter "contains(displayName, 'WUfB')" | 
    Select-Object id, displayName, lastModifiedDateTime

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Endpoint registry reflects DeferQualityUpdatesPeriodInDays matching the assigned ring.

Active Hours in local Settings > Windows Update match Intune policy (e.g., 8:00 AM to 5:00 PM).

Feature updates policy successfully pins the maximum allowable OS build.

Deadline notification banner appears 24 hours prior to forced restart.

Devices report patch compliance status in Intune Monitor > Windows update rings.

Diagnostic Logs & Channels

Channel / Tool	Log Location	Purpose
Windows Update Client Operational	`Applications and Services Logs > Microsoft > Windows > WindowsUpdateClient > Operational`	Records update download starts, installation successes (Event 19), and failures (Event 20).
USO Client Event Log	`Microsoft-Windows-Update-Session-Orchestrator`	Logs active hours conflicts, reboot schedules, and deadline timer expirations.
Get-WindowsUpdateLog	`C:\Users\\Desktop\WindowsUpdate.log`	PowerShell cmdlet decoding ETL trace files into readable plain-text update engine logs.

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
Error `0x80240020` / `0x8024500c`	Local group policy or dual-scan conflict; machine is still pointing to internal WSUS server.	Remove `HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer` and set `UseWUServer = 0`.
Device not receiving updates	Windows Diagnostic Data (Telemetry) is disabled or set to `0` (Security mode).	Set Diagnostic Data to Required or Optional in Intune Device Restrictions profile.
User forced reboot during work	Active Hours improperly configured or deadline set to 0 days without grace period.	Configure 12+ hour Active Hours span and provide a minimum 2-day Grace Period for restarts.

---

Production Best Practices

Production Best Practice

Use Delivery Optimization (DO) to Save Bandwidth:

Always pair WUfB with an Intune Delivery Optimization policy configured for Group / Subnet Peer-to-Peer mode (DownloadMode = 2). This allows endpoints on the same corporate branch subnet to share patch chunks locally, cutting internet bandwidth usage by 70–85%.

Security Caution

Do Not Mix Deferral in Rings and Feature Profiles:

If you configure Feature Update Profiles to control OS versions, always set Feature update deferral period (days) to 0 in your Update Rings. Combining feature deferrals with feature update profiles creates conflicting pause timers.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Quality vs Feature Deferral Limits: Quality updates can be deferred for up to 30 days. Feature updates in Update Rings can be deferred up to 365 days.
Grace Period: The Grace Period countdown begins after the deadline has expired, giving users extra time to restart before a hard reboot is forced.
Dual Scan Trap: If an endpoint is targeted by both WSUS GPO and WUfB deferrals, "Dual Scan" engages, which can bypass WSUS approvals unless explicitly disabled.

---

Official Documentation

PREVIOUS TOPIC4.2 Endpoint Privilege Management (EPM) Policies NEXT TOPIC4.4 Assigned Access: Single-App & Multi-App Kiosk