Windows as a Service Windows 10 · PDF file 20kannan.c/ https: ... Windows as a Service...

Kamal’s ConfigMgr - System Center Configuration Manager

https://social.technet.microsoft.com/profile/kamala%20kannan.c/

https://kamalakannansccmblog.wordpress.com/

Windows as a

Service – Windows 10

Thanks to Microsoft Documents.




Introduction:

Windows 10 offers two update release types: feature updates and quality updates. Feature

updates account for the functionality previously deployed in major revision upgrades. Quality

updates represent traditional Windows updates, previously referred to as servicing updates. To

align with this new feature update and quality update delivery model, Windows 10 has three

servicing branches, each of which provides different levels of flexibility over when these

updates are delivered. Three servicing branches are available to Windows 10 clients: Current

Branch (CB), Current Branch for Business (CBB), and the Long-Term Servicing Branch (LTSB).

Logon to the Windows 10 Machine:

Click on the start menu as shown in the figure




1. a

Note: Search for the Settings as well.

Click on the below settings for the Update and Security:




Can click here for the settings tab




Click on the update and security for the Settings




Click on the advanced options from the right side of the prompted Window




Advanced options we can review the available options which are for how to install the updates

like reviewing.

Selection of this option make a machine as current branch for business until the Microsoft

approve a current branch update as CB – Busi ess e ca ’t i stall a update to the achi e which brings more granularity to the Servicing management for the WaaS (Windows 10), either




manually or using Group policy, we will discuss further more in the document later.

The Defer feature updates flag specifies if a client is in CB or CBB. If you set that flag, the

Windows 10 client will receive feature updates only after Microsoft has released them to CBB.

To defer updates further, you can use a variety of servicing tools, including WSUS, System

Center Configuration Manager, and Windows Update for Business through Group Policy, and

MDM solutions such as Microsoft Intune.

For some organizations, special-purpose devices such as those used to control factory or

medical equipment or to run ATMs require a stricter, less frequent feature update cycle than

CB or CBB can offer. For those machines, install Windows 10 Enterprise LTSB to avoid feature

updates for up to 10 years. Windows 10 Enterprise LTSB lacks many in-box apps built on the

Universal Windows Platform and Cortana integration. We will compare Windows 10 Enterprise

LTSB to Windows 10 Enterprise.




Windows 10 Enterprise LTSB does ’t ha e ser ici g optio s for feature updates; each ti e the feature updates are needed, you must use a media-based in-place upgrade procedure. As this

lab showed, in addition to that limitation, many other application elements have been

removed.

Windows Insider Program:

In addition to the CB, CBB, and LTSB servicing branches, the Windows

Insider Program enables organizations to experience Windows builds as

Microsoft develops them. Windows Insider machines can help with

preliminary testing efforts, before the next build of Windows is released. As

builds get closer to their CB release, organizations can use the Windows

Insider builds to test their critical business applications.

By click on the highlighted component from Windows 10 we can go to the

below screen “Get Started” and sign in with the MS Account i.e... hotmail or Outlook account to participate in the optional program




Waas Management with the Help of WSUS:

Above we discussed about the Auto update and Manual control of WaaS for

Windows 10.

Using WSUS to manage Windows 10 updates is simple and familiar. If you’re currently using WSUS to manage Windows updates, you’ll manage Windows 10 updates the same way. In this exercise, you will review express update

settings in WSUS. You can use express installation files to limit the

bandwidth that is consumed on the local network. However, this is at the

costs of additional bandwidth on the Internet connection and additional local

disk space. By default, WSUS does not use express installation files.

Depending on your requirements, you may want to enable download of

express updates.

Logon to the Server where the WSUS is installed..




Click on the Server Manager and go to the Tools and Windows server

Update Services.

On the WSUS Console In the Options section, click Update Files and

Languages




Updates typically consist of new versions of files that already exist on the

computer that is being updated. On a binary level, these existing files might

not differ very much from updated versions. The express installation files

feature identifies the exact bytes between versions, creates and distributes

updates of only those differences, and then merges the existing file together

with the updated bytes.

Sometimes this feature is called delta delivery because it downloads only the

delta (difference) between two versions of a file. Express installation files are

larger than the updates that are distributed to client computers because the

express installation file contains all possible versions of each file that is to be

updated.

For the purposes of this lab, you will accept the default value (checkbox

cleared) because selecting this checkbox will delay the lab by 15 minutes or

more.




If your local network traffic is being negatively impacted by Windows Update

traffic, consider enabling this setting. However, know that if you enable this

setting that you will increase the amount of data downloaded from Windows

Update and the local storage requirements.

You saw how easy it is to configure express updates in WSUS. Express

updates can significantly reduce the time it takes for Windows 10 devices

you use WSUS to manage to install quality updates. However, remember

that the trade of is increased download file sizes from Windows Update and

more storage requirements on your WSUS servers.




Deployment using the Computer Group:

Below we are going to see,You can use computer groups to target a subset

of machines that require specific installation times for quality and feature

updates. These groups represent your deployment rings, as controlled by

WSUS. You can populate the groups either manually by using the WSUS

Administration Console or automatically through Group Policy. Regardless of

the method you choose, you must first create the groups in the WSUS

Administration Console. Then, later in this lab, you will be using client-side

targeting to populate the group. For more information about the deployment

rings discussed in this lab, review the Knowledge box. In the “Using WSUS” exercises, you work with the first deployment ring: WIN10 Ring 1 Pilot IT.




We need to type the created AD group for the Servicing using the WSUS, in

my Case it was Win10 Pilot IT WaaS

Within the WSUS Administration Console, you can create automatic approval

rules that automatically approve and set a deadline for specific updates

targeted at specific machines. This approach is less time-consuming than

administrators manually approving quality updates each month or feature

updates multiple times per year. In this exercise, you create an automatic

approval rule for the WIN10 Pilot IT deployment ring.

We create a New Automatic Approval - Options - Automatic Approval -

New Rule .




Choose the below selected components from the classification, Product and

Approval.

Specify a name for the Automatic Approvals.

Note:

WSUS doesn’t honor any existing month, week, or day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a machine that WSUS is manages updates for, when WSUS approves the

update it will be installed on the machine, regardless of whether Group

Policy is configured to wait.




Name of the Rule – Windows 10 Automatic Approval.

WSUS doesn’t honor any existing month, week, or day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a

machine that WSUS is manages updates for, when WSUS approves the

update it will be installed on the machine, regardless of whether Group

Policy is configured to wait.

The WSUS Administration Console provides a friendly interface from which

you can manage Windows 10 quality and feature updates. When you need to

add many machines to their correct WSUS deployment ring, however, it can

be time-consuming to do so manually in the WSUS Administration Console.

For these cases, consider using Group Policy to target the correct clients,

automatically adding them to the correct WSUS deployment ring based on

an Active Directory security group. This process is called client-side

targeting. Before enabling client-side targeting in Group Policy, however,




you must configure WSUS to accept Group Policy computer assignment

rather than the default manual-assignment method.

You have configured WSUS to use client-side targeting. By using client-side

targeting, you can quickly add machines in Active Directory groups to

computer groups in WSUS rather than adding the computers to groups

manually.

Configuring the GPO:

When using WSUS to manage updates on Windows client computers, you

must configure the Configure Automatic Updates and Intranet Microsoft

Update Service Location Group Policy settings for your environment. Doing

so forces the affected clients to contact the WSUS server so that it can

manage them. Use this process to specify these settings and deploy them to

all machines in the WIN10 Ring 1 Pilot IT deployment ring.




Open the Group Policy Management Console (GPMC) by clicking the Server

Manager icon on the taskbar, and then clicking Tools > Group Policy

Management.

Else go to the Server Manager –Tools – Group Policy Management.




Right-click the newly created GPO, and then click Edit. (2) In the Group

Policy Management Editor, go to Computer

Configuration\Policies\Administrative Templates\Windows

Components\Windows Update.

Right-click the Configure Automatic Updates setting, and then

click Edit. (2) In the Configure Automatic Updates dialog box,

select Enable. (3) Under Options, select 3 - Auto download and notify

for install from the Configure automatic updating list, and then

click OK.




Apply – Ok.

Go to the scope of that GPO – Delete the existing security filter and add for

the Group of computer which we are targeting to for the machine.

Create a new group policy like above and give the name as per the below

instructions.




In GPMC, expand Forest\Domains\Contoso.com. (2) Right-

click corp.contoso.com, and then click Create a GPO in this domain,

and Link it here. (3) In the New GPO dialog box, name the new

GPO WSUS – Client Targeting - WIN10 Ring 1 Pilot IT and then

click OK.

Right-click the newly created GPO, and then click Edit. (2) In the Group

Policy Management Editor, go to Computer

Configuration\Policies\Administrative Templates\Windows

Components\Windows Update

Right-click Enable client-side targeting, and then click Edit. (2) In

the Enable client-side targeting dialog box, select Enable. (3) In

the Target group name for this computer box, type WIN10 Ring 1

Pilot IT, and then click OK.




Give the name of the group which you going to target for the application and

then Apply - OK to close it.

GPMC, select the WSUS – Client Targeting - WIN10 Ring 1 Pilot

IT policy, and view the Scope tab on the right side of the

screen. (3) Under Security Filtering, remove the

default AUTHENTICATED USERS security group, and then add the WIN10

Ring 1 Pilot IT group.

Below the diagram for the same.




Now that you’ve configured automatic updates, update service location, and client-side targeting for the WIN10 Ring 1 Pilot IT deployment ring, you

must verify that the configuration was successful. Ultimately, the affected

clients will contact the specified WSUS server during its next update cycle,

but for this lab, you’ll force an update so that you can see the machine appear in its correct WSUS computer group automatically.

Enabling Current Branch for Business:

In GPMC, expand Forest\Domains\Contoso.com. (2) Right-

click corp.contoso.com, and then click Create a GPO in this domain,

and Link it here. (3) In the New GPO dialog box, name the new

GPO Enable Current Branch for Business




Right-click the Select when Feature Updates are received setting, and

then click Edit. (2) In the Select when Feature Updates are

received dialog box, click Enable. (2) Under Options, in Select the branch

readiness level for the future updates that you want to

receive, select Current Branch for Business, and then click OK.

Right-click the Select when Feature Updates are received setting, and

then click Edit. (2) In the Select when Feature Updates are




received dialog box, click Enable. (2) Under Options, in Select the branch

readiness level for the future updates that you want to

receive, select Current Branch for Business, and then click OK.

click the Enable Current Branch for Business policy, and then view

the Scope tab on the right side of the screen. (2) Under Security

Filtering, remove AUTHENTICATED USERS and add the Windows 10 –

Current Branch for Business Machines group.




In the Configuration Manager console, go to Assets and

Compliance\Overview\Device Collections. (2) On the Ribbon, in

the Create group, click Create Device Collection




System Center Configuration Manager discovers clients’ Servicing Branch and stores that value in the OSBranch attribute, which you’ll use to create collections based on Servicing Branch. The values in this attribute can be 0

(Current Branch), 1 (Current Branch for Business), or 2 (Long-Term

Servicing Branch).

In the Criterion Properties dialog box, leave the Type as Simple Value,

and then click Select. (2) In the Select Attribute dialog box, from

the Attribute class list, select System Resource. (3) From

the Attribute list, select Operating System Readiness Branch, and then

click OK. (4) Leave Operator set to is equal to; in the Value box,

type 0. (5) Click OK.




You can manage Windows 10 updates with System Center Configuration

Manager in two ways. You can manage quality updates by using traditional

automatic deployment rules (ADRs). Feature updates, however, depend on

the servicing branch that the individual managed client is in. You manage

feature updates by using a new feature available in System Center

Configuration Manager version 1511 and later called Servicing Plans. Those

you configure similar to ADRs, but they manage the deployment schedule of

features updates. Because feature updates are available to CB and CBB at

different times, you configure servicing plans according to the servicing

branch the client receiving the plan is in.




Microsoft added a new protection feature to System Center Configuration

Manager that prevents accidental installation of high-risk deployments such

as operating system upgrades on site systems. If you select a collection (for

example All Systems) that has a site system in it, you may receive a

warning message.




For Current branch for business we need to choose the Business Ready and

then it would be available only when its business ready.




Click Summary, click Next to complete the Servicing Plan, and then

click Close.




Click Summary, click Next to complete the Servicing Plan, and then

click Close.

LTSB:

Servicing plans are ideal for managing feature updates on Windows 10

machines in the CB or CBB servicing branches, but there may be times when

you need to deploy a Windows 10 feature update through a task sequence in

System Center Configuration Manager. One of those times is when you’re

applying LTSB feature updates to Windows 10 LTSB clients. Because those

updates aren’t available in servicing plans, you must deploy them as you would a traditional Windows in-place upgrade—by using the installation

media. As with any source content in System Center Configuration Manager,

you must distribute upgrade packages to the distribution points before client

computers can use them. In this exercise, you simply distribute the newly

created upgrade package.




In the Configuration Manager console, go to Software

Library\Overview\Operating Systems\Operating System Upgrade

Packages. (2) On the Ribbon, in the Create group, click Add Operating

System Upgrade Package.




On the General page, in the Name field, type Windows 10 Enterprise -

Version 1607. (2) In Version type1607, and then click Next. (3) On

the Summary page, click next to create the package. (4) On

the Completion page, click Close

) In the Configuration Manager console, go to Software

Library\Overview\Operating Systems\Operating System Upgrade

Packages, and then select the Windows 10 Enterprise –

Version 1607 software upgrade package. (2) On the Ribbon, in

the Deployment group, click Distribute Content.




Task sequences are simply a list of steps that execute in order. They are

structured and have the ability to logically determine whether steps execute

based on certain conditions. With that in mind, task sequences offer

something unique over servicing plans: they can perform additional steps

before or after a feature update is performed. Also, unlike servicing plans,

task sequences are typically driven from installation media rather than

updates. When a new feature update becomes available to Windows 10, the

published ISO is updated, as well. You use this updated ISO to apply a

feature update to clients by using a task sequence. This is the same process

as a traditional in-place upgrade. Also, for special-use devices running

Windows 10 Enterprise LTSB, this is the only way to apply feature updates to

them. In this exercise, you use the previously created upgrade package

within a task sequence to deploy a Windows 10 feature update.




in the Create Task Sequence Wizard, on the Create a new task

sequence page, select Upgrade an operating system from upgrade

package, and then click Next




On the Task Sequence Information page, in Task sequence name,

type Upgrade Windows 10 Enterprise – Version 1607, and then

click Next.




If you have a product key paste it here for the deployment.

Based on the requirement or need of yours please choose the available for

installation or required for installation on the Include updates tab.

As per the below diagram in my case it was an available install.




Click Next and choose the Required application if there are any needed to be

added in the task sequence.




Next -Close.

In the Configuration Manager console, go to Software

Library\Overview\Operating Systems\Task Sequences, and then

select the Upgrade Windows 10 Enterprise – Version 1607 task

sequence. (2) On the Ribbon, in the Deployment group, click Deploy.




Based on the deployment type it would be available or required.

The task sequence would be visible when it’s upgrading or else would be

available in the Software center for the installation to be completed.

Windows as a Service Windows 10 · PDF file 20kannan.c/ https: ... Windows as a Service...

Documents

Transcript of Windows as a Service Windows 10 · PDF file 20kannan.c/ https: ... Windows as a Service...